@astrosheep/keiyaku 2.9.12 → 2.9.13

package/build/core/settlement/verification.js

@@ -1,426 +1,554 @@
-import { spawn } from "node:child_process";
-import { getConfig } from "../../config/env.js";
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { randomBytes } from "node:crypto";
+import { fileURLToPath } from "node:url";
+import { setTimeout as delay } from "node:timers/promises";
+import { DatabaseSync } from "node:sqlite";
+import { z } from "zod";
 import { assertSettingsKnobUsable } from "../../config/settings/disease.js";
 import { loadKeiyakuSettings } from "../../config/settings/loader.js";
-import { PROCESS_GROUP_KILL_GRACE_MS, ProcessTreeTerminationError, ownedProcessIdentity, ownedProcessIsLive, terminateOwnedProcess, terminateProcessGroup, } from "../process-group.js";
-import { VerificationCoordination } from "./verification-coordination.js";
-import { VERIFICATION_SUPERVISOR_PROTOCOL_VERSION, supervisorMessageSchema, verificationSupervisorArguments, } from "./verification-supervisor.js";
+import { createUlid } from "../ids.js";
+import { effectiveVerification } from "../lifecycle-history.js";
+import { beginConnectionBoundRunnerClose, acquireRunnerLease, acquireRunnerLostProof, initializeRunnerLeaseDatabase, launchDetachedProcess, openDetachedLeaseBootstrap, observeRunnerLease, receiveDetachedLease, RUN_CONTROL_BOOTSTRAP_ENV, RunnerLeaseUnavailableError, terminateProcessGroup, } from "../run-control/index.js";
 const OUTPUT_TAIL_BYTES = 8_192;
-const COORDINATION_POLL_MS = 50;
-const COORDINATION_RECOVERY_MARGIN_MS = 60_000;
+const RUN_WAIT_POLL_MS = 25;
+const RUN_START_TIMEOUT_MS = 30_000;
+const RUNTIME_DIRECTORY = [".keiyaku", "runtime"];
+const VERIFICATION_RUN_SCHEMA_VERSION = 4;
+const RUNNER_FAILURE_CODES = ["SPAWN_FAILED", "PROCESS_TERMINATED", "TIMED_OUT", "CANCELLED", "TREE_TERMINATION_FAILED", "RUNNER_LOST"];
+export class VerificationRunFormatError extends Error {
+    code = "VERIFICATION_RUN_FORMAT_INVALID";
+    constructor(message, options) {
+        super(message, options);
+        this.name = "VerificationRunFormatError";
+    }
+}
+export class VerificationRunWaitTimeoutError extends Error {
+    runId;
+    code = "VERIFICATION_RUN_WAIT_TIMEOUT";
+    constructor(runId) {
+        super(`verification run '${runId}' did not reach a terminal result before the observation deadline`);
+        this.runId = runId;
+        this.name = "VerificationRunWaitTimeoutError";
+    }
+}
+export class VerificationRunUnknownError extends Error {
+    runId;
+    code = "VERIFICATION_RUN_UNKNOWN";
+    constructor(runId) {
+        super(`verification run '${runId}' does not exist`);
+        this.runId = runId;
+        this.name = "VerificationRunUnknownError";
+    }
+}
 class OutputTailCollector {
-    #chunks = [];
-    #retainedBytes = 0;
+    #tail = Buffer.alloc(0);
     #totalBytes = 0;
     push(chunk) {
         const value = Buffer.from(chunk);
         this.#totalBytes += value.byteLength;
-        this.#chunks.push(value);
-        this.#retainedBytes += value.byteLength;
-        while (this.#retainedBytes > OUTPUT_TAIL_BYTES && this.#chunks.length > 0) {
-            const first = this.#chunks[0];
-            const excess = this.#retainedBytes - OUTPUT_TAIL_BYTES;
-            if (first.byteLength <= excess) {
-                this.#chunks.shift();
-                this.#retainedBytes -= first.byteLength;
-            }
-            else {
-                this.#chunks[0] = first.subarray(excess);
-                this.#retainedBytes -= excess;
-            }
-        }
+        this.#tail = Buffer.concat([this.#tail, value]).subarray(-OUTPUT_TAIL_BYTES);
     }
     result() {
-        return {
-            tail: Buffer.concat(this.#chunks).toString("utf8"),
-            truncated: this.#totalBytes > this.#retainedBytes,
-            omittedBytes: this.#totalBytes - this.#retainedBytes,
+        return { tail: this.#tail.toString("utf8"), truncated: this.#totalBytes > this.#tail.byteLength, omittedBytes: this.#totalBytes - this.#tail.byteLength };
+    }
+}
+function runtimeDirectory(root) { return path.join(root, ...RUNTIME_DIRECTORY); }
+export function verificationRunDatabasePath(root) { return path.join(runtimeDirectory(root), "verification-runs.sqlite"); }
+export function verificationRunLeasePath(root, runId) {
+    return path.join(runtimeDirectory(root), `verification-run-${runId}.lease`);
+}
+function currentSchemaVersion(database) {
+    const row = database.prepare("PRAGMA user_version").get();
+    if (!row || typeof row.user_version !== "number" || !Number.isInteger(row.user_version)) {
+        throw new VerificationRunFormatError("VerificationRun database has an invalid schema version");
+    }
+    return row.user_version;
+}
+function createCurrentSchema(database) {
+    database.exec("BEGIN IMMEDIATE");
+    try {
+        database.exec(`
+    CREATE TABLE verification_runs (
+      run_id TEXT PRIMARY KEY, execution_cwd TEXT NOT NULL, candidate_head TEXT NOT NULL, candidate_tree TEXT NOT NULL,
+      plan_json TEXT NOT NULL, started_at_ms INTEGER NOT NULL,
+      cancel_requested INTEGER NOT NULL DEFAULT 0, terminal_json TEXT, finished_at_ms INTEGER
+    ) STRICT;
+    CREATE TABLE verification_run_receipts (
+      run_id TEXT NOT NULL REFERENCES verification_runs(run_id), item_index INTEGER NOT NULL, receipt_json TEXT NOT NULL,
+      PRIMARY KEY (run_id, item_index)
+    ) STRICT;
+    PRAGMA user_version = ${VERIFICATION_RUN_SCHEMA_VERSION};
+    `);
+        database.exec("COMMIT");
+    }
+    catch (error) {
+        database.exec("ROLLBACK");
+        throw error;
+    }
+}
+function assertCurrentSchema(database, created) {
+    const version = currentSchemaVersion(database);
+    if (version === 0 && created)
+        createCurrentSchema(database);
+    else if (version !== VERIFICATION_RUN_SCHEMA_VERSION) {
+        throw new VerificationRunFormatError(`unsupported VerificationRun database schema version ${version}`);
+    }
+}
+function openValidatedDatabase(databasePath, readOnly, created) {
+    const database = readOnly ? new DatabaseSync(databasePath, { readOnly: true }) : new DatabaseSync(databasePath);
+    // Wait under concurrent runner writes for both mutable and read-only observers.
+    database.exec("PRAGMA busy_timeout = 5000;");
+    try {
+        assertCurrentSchema(database, created);
+    }
+    catch (error) {
+        database.close();
+        throw error;
+    }
+    return database;
+}
+/** Mutable store used only by launch/runner paths that may create the runtime DB. */
+function openRunDatabase(root) {
+    fs.mkdirSync(runtimeDirectory(root), { recursive: true });
+    const databasePath = verificationRunDatabasePath(root);
+    return openValidatedDatabase(databasePath, false, !fs.existsSync(databasePath));
+}
+/** Existing store only; never creates a runtime database under an arbitrary cwd. */
+function openExistingRunDatabase(root, readOnly) {
+    const databasePath = verificationRunDatabasePath(root);
+    if (!fs.existsSync(databasePath))
+        return null;
+    return openValidatedDatabase(databasePath, readOnly, false);
+}
+function emptyTail() { return { tail: "", truncated: false, omittedBytes: 0 }; }
+function executorFor(entry) {
+    return entry.executor;
+}
+function stringField(value, location) {
+    if (typeof value !== "string")
+        throw new VerificationRunFormatError(`${location} must be a string`);
+    return value;
+}
+function integerField(value, location) {
+    if (typeof value !== "number" || !Number.isSafeInteger(value))
+        throw new VerificationRunFormatError(`${location} must be an integer`);
+    return value;
+}
+function jsonValue(raw, location) {
+    try {
+        return JSON.parse(raw);
+    }
+    catch (error) {
+        throw new VerificationRunFormatError(`${location} is not valid JSON`, { cause: error });
+    }
+}
+const outputTailSchema = z.strictObject({ tail: z.string(), truncated: z.boolean(), omittedBytes: z.number().int().nonnegative() });
+const planEntrySchema = z.strictObject({
+    source: z.enum(["contract", "repository-gate"]), label: z.string(), declaration: z.string(),
+    executor: z.string(), command: z.string(), args: z.array(z.string()), shell: z.boolean(), timeoutMs: z.number().int().positive(),
+});
+const executionCommon = { durationMs: z.number().int().nonnegative(), stdout: outputTailSchema, stderr: outputTailSchema };
+const executionSchema = z.discriminatedUnion("status", [
+    z.strictObject({ status: z.literal("executed"), code: z.number().int(), ...executionCommon }),
+    z.strictObject({ status: z.literal("runner_failed"), ...executionCommon, cause: z.strictObject({ code: z.enum(RUNNER_FAILURE_CODES), message: z.string() }) }),
+]);
+const resultSchema = planEntrySchema.extend({
+    candidate: z.strictObject({ head: z.string(), tree: z.string() }), executor: z.string(), execution: executionSchema,
+});
+const terminalSchema = z.discriminatedUnion("status", [
+    z.strictObject({ status: z.literal("completed"), results: z.array(resultSchema) }),
+    z.strictObject({ status: z.literal("runner_lost"), results: z.array(resultSchema), detail: z.string() }),
+]);
+function parseCurrent(schema, value, location) {
+    const parsed = schema.safeParse(value);
+    if (!parsed.success)
+        throw new VerificationRunFormatError(`${location} is not current: ${z.prettifyError(parsed.error)}`);
+    return parsed.data;
+}
+function parseResult(value, location) { return parseCurrent(resultSchema, value, location); }
+function parsePlan(raw) {
+    const value = jsonValue(raw, "VerificationRun plan");
+    if (!Array.isArray(value))
+        throw new VerificationRunFormatError("VerificationRun plan must be an array");
+    return parseCurrent(z.array(planEntrySchema), value, "VerificationRun plan");
+}
+function parseTerminal(raw) {
+    if (raw === null)
+        return null;
+    return parseCurrent(terminalSchema, jsonValue(raw, "VerificationRun terminal"), "VerificationRun terminal");
+}
+function readReceipts(database, runId, plan) {
+    const rows = database.prepare(`
+    SELECT item_index, receipt_json FROM verification_run_receipts WHERE run_id = ? ORDER BY item_index
+  `).all(runId);
+    if (rows.length > plan.length)
+        throw new VerificationRunFormatError("VerificationRun has more receipts than plan items");
+    return rows.map((row, index) => {
+        if (integerField(row.item_index, `VerificationRun receipt[${index}] index`) !== index) {
+            throw new VerificationRunFormatError("VerificationRun receipts are not a contiguous ordered prefix");
+        }
+        return parseResult(jsonValue(stringField(row.receipt_json, `VerificationRun receipt[${index}]`), `VerificationRun receipt[${index}]`), `VerificationRun receipt[${index}]`);
+    });
+}
+function rowToRun(row, plan, candidate, receipts) {
+    if (typeof row.terminal_json !== "string" && row.terminal_json !== null)
+        throw new VerificationRunFormatError("VerificationRun terminal is invalid");
+    return {
+        id: stringField(row.run_id, "VerificationRun id"),
+        cwd: stringField(row.execution_cwd, "VerificationRun execution cwd"),
+        candidate, plan,
+        startedAtMs: integerField(row.started_at_ms, "VerificationRun start time"),
+        receipts,
+        terminal: parseTerminal(row.terminal_json === null ? null : stringField(row.terminal_json, "VerificationRun terminal")),
+        finishedAtMs: row.finished_at_ms === null ? null : integerField(row.finished_at_ms, "VerificationRun finish time"),
+    };
+}
+export function readVerificationRun(root, runId) {
+    const database = openExistingRunDatabase(root, true);
+    if (!database)
+        return null;
+    try {
+        const row = database.prepare(`
+      SELECT run_id, execution_cwd, candidate_head, candidate_tree, plan_json, started_at_ms,
+             terminal_json, finished_at_ms FROM verification_runs WHERE run_id = ?
+    `).get(runId);
+        if (!row)
+            return null;
+        const plan = parsePlan(stringField(row.plan_json, "VerificationRun plan"));
+        const candidate = {
+            head: stringField(row.candidate_head, "VerificationRun candidate head"),
+            tree: stringField(row.candidate_tree, "VerificationRun candidate tree"),
         };
+        return rowToRun(row, plan, candidate, readReceipts(database, runId, plan));
+    }
+    finally {
+        database.close();
+    }
+}
+export function createVerificationRun(input, id = createUlid(input.nowMs ?? Date.now(), [...randomBytes(10)])) {
+    const startedAtMs = input.nowMs ?? Date.now();
+    const database = openRunDatabase(input.root);
+    try {
+        database.prepare(`
+      INSERT INTO verification_runs (run_id, execution_cwd, candidate_head, candidate_tree, plan_json, started_at_ms)
+      VALUES (?, ?, ?, ?, ?, ?)
+    `).run(id, input.cwd, input.candidate.head, input.candidate.tree, JSON.stringify(input.plan), startedAtMs);
+    }
+    finally {
+        database.close();
+    }
+    return { id, cwd: input.cwd, candidate: input.candidate, plan: [...input.plan], startedAtMs, receipts: [], terminal: null, finishedAtMs: null };
+}
+export function requestVerificationRunCancellation(root, runId) {
+    const database = openExistingRunDatabase(root, false);
+    if (!database)
+        return false;
+    try {
+        return database.prepare(`UPDATE verification_runs SET cancel_requested = 1 WHERE run_id = ? AND terminal_json IS NULL`).run(runId).changes > 0;
+    }
+    finally {
+        database.close();
+    }
+}
+function isCancellationRequested(database, runId) {
+    const row = database.prepare("SELECT cancel_requested FROM verification_runs WHERE run_id = ?").get(runId);
+    return row?.cancel_requested === 1;
+}
+function writeReceipt(database, runId, itemIndex, result) {
+    database.prepare(`INSERT INTO verification_run_receipts (run_id, item_index, receipt_json) VALUES (?, ?, ?)`).run(runId, itemIndex, JSON.stringify(result));
+}
+function writeRunTerminal(database, runId, terminal) {
+    const updated = database.prepare(`
+    UPDATE verification_runs SET terminal_json = ?, finished_at_ms = ? WHERE run_id = ? AND terminal_json IS NULL
+  `).run(JSON.stringify(terminal), Date.now(), runId);
+    if (updated.changes !== 1)
+        throw new Error(`verification run '${runId}' is already terminal`);
+}
+function commitRunTerminal(database, runId, terminal) {
+    database.exec("BEGIN IMMEDIATE");
+    try {
+        writeRunTerminal(database, runId, terminal);
+        database.exec("COMMIT");
+    }
+    catch (error) {
+        database.exec("ROLLBACK");
+        throw error;
+    }
+}
+function lostResults(run, detail) {
+    const entry = run.plan[run.receipts.length];
+    if (!entry)
+        return [...run.receipts];
+    return [...run.receipts, {
+            ...entry, candidate: run.candidate, executor: executorFor(entry),
+            execution: { status: "runner_failed", durationMs: 0, stdout: emptyTail(), stderr: emptyTail(), cause: { code: "RUNNER_LOST", message: detail } },
+        }];
+}
+function settleRunnerLost(root, run, detail) {
+    const proof = acquireRunnerLostProof(verificationRunLeasePath(root, run.id));
+    const database = openRunDatabase(root);
+    try {
+        const current = readVerificationRun(root, run.id);
+        if (!current)
+            throw new Error(`verification run '${run.id}' disappeared`);
+        if (current.terminal)
+            return current.terminal;
+        const terminal = { status: "runner_lost", results: lostResults(current, detail), detail };
+        commitRunTerminal(database, run.id, terminal);
+        return terminal;
+    }
+    catch (error) {
+        const reread = readVerificationRun(root, run.id);
+        if (reread?.terminal)
+            return reread.terminal;
+        throw error;
+    }
+    finally {
+        database.close();
+        proof.close();
+    }
+}
+export async function waitForVerificationRun(input) {
+    const deadline = input.deadlineMs ?? (input.timeoutMs === undefined ? undefined : Date.now() + input.timeoutMs);
+    for (;;) {
+        input.signal?.throwIfAborted();
+        const run = readVerificationRun(input.root, input.runId);
+        if (!run)
+            throw new VerificationRunUnknownError(input.runId);
+        if (run.terminal)
+            return run.terminal;
+        if (observeRunnerLease(verificationRunLeasePath(input.root, input.runId)).state === "released") {
+            return settleRunnerLost(input.root, run, "verification runner lease was released before terminal evidence");
+        }
+        const remaining = deadline === undefined ? undefined : deadline - Date.now();
+        if (remaining !== undefined && remaining <= 0)
+            throw new VerificationRunWaitTimeoutError(input.runId);
+        await delay(remaining === undefined ? RUN_WAIT_POLL_MS : Math.min(RUN_WAIT_POLL_MS, remaining));
+    }
+}
+const MODULE_FILE = fileURLToPath(import.meta.url);
+const PACKAGE_ROOT = path.resolve(path.dirname(MODULE_FILE), "..", "..", "..");
+const RUNNER_ENTRY = MODULE_FILE.endsWith(".ts")
+    ? [process.execPath, "--import", "tsx", path.join(PACKAGE_ROOT, "src", "index.ts"), "__keiyaku-verify"]
+    : [process.execPath, path.join(PACKAGE_ROOT, "build", "index.js"), "__keiyaku-verify"];
+function verificationRunnerLaunch(root, runId) {
+    const [command, ...args] = RUNNER_ENTRY;
+    if (!command)
+        throw new Error("verification runner command is empty");
+    return {
+        command, args: [...args, path.resolve(root), runId], unref: true,
+        options: { stdio: ["ignore", "ignore", "ignore", "ipc"], env: { ...process.env, [RUN_CONTROL_BOOTSTRAP_ENV]: "1" } },
+    };
+}
+function settleFailedVerificationLaunch(root, run, detail) {
+    const current = readVerificationRun(root, run.id) ?? run;
+    if (current.terminal)
+        return current;
+    return { ...current, terminal: settleRunnerLost(root, current, detail), finishedAtMs: Date.now() };
+}
+export async function startVerificationRun(input) {
+    const runId = createUlid(Date.now(), [...randomBytes(10)]);
+    const leasePath = verificationRunLeasePath(input.root, runId);
+    fs.mkdirSync(runtimeDirectory(input.root), { recursive: true });
+    initializeRunnerLeaseDatabase(leasePath);
+    let launchOwnership;
+    try {
+        launchOwnership = acquireRunnerLease(leasePath);
     }
+    catch (error) {
+        throw new Error(`verification runner launch ownership could not be acquired: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
+    }
+    let run;
+    try {
+        run = createVerificationRun(input, runId);
+    }
+    catch (error) {
+        launchOwnership.close();
+        throw error;
+    }
+    const opened = await openDetachedLeaseBootstrap({
+        coordinate: run.id, leasePath, parentLease: launchOwnership,
+        launch: verificationRunnerLaunch(input.root, run.id), deadline: Date.now() + RUN_START_TIMEOUT_MS,
+    });
+    if (opened.status === "failed")
+        return settleFailedVerificationLaunch(input.root, run, `verification runner launch failed: ${opened.detail}`);
+    if (input.signal?.aborted)
+        requestVerificationRunCancellation(input.root, run.id);
+    const authorized = await opened.bootstrap.authorize();
+    if (authorized.status === "failed")
+        return settleFailedVerificationLaunch(input.root, run, `verification runner launch failed: ${authorized.detail}`);
+    return readVerificationRun(input.root, run.id) ?? run;
+}
+export async function runVerificationPlan(input) {
+    const root = input.root ?? input.cwd;
+    const run = await startVerificationRun({ root, cwd: input.cwd, candidate: input.candidate, plan: input.plan, signal: input.signal });
+    const runId = run.id;
+    return {
+        runId,
+        async awaitTerminal() {
+            // Owner abort requests stop and must observe terminal cleanup.
+            // CLI wait/status never call this path; they observe only.
+            const requestCancellation = () => { requestVerificationRunCancellation(root, runId); };
+            input.signal?.addEventListener("abort", requestCancellation, { once: true });
+            if (input.signal?.aborted)
+                requestCancellation();
+            try {
+                const terminal = await waitForVerificationRun({ root, runId });
+                return { runId, terminal, results: [...terminal.results] };
+            }
+            finally {
+                input.signal?.removeEventListener("abort", requestCancellation);
+            }
+        },
+    };
 }
 export function verificationExecutor(command) {
     const basename = command.command.split(/[\\/]/).pop() ?? "";
     const executor = basename.toLowerCase().replace(/\.exe$/, "");
-    if (executor !== "bash" && executor !== "zsh" && executor !== "pwsh") {
+    if (executor !== "bash" && executor !== "zsh" && executor !== "pwsh")
         return { cause: "unsupported_executor" };
-    }
     const bodyIndex = command.args.findIndex((arg) => arg === "-c" || arg === "-lc" || arg === "-Command");
     const body = bodyIndex < 0 ? undefined : command.args[bodyIndex + 1];
-    if (body === undefined)
-        return { cause: "missing_command_body" };
-    return { executor, body };
+    return body === undefined ? { cause: "missing_command_body" } : { executor, body };
 }
-/** The document schema owns parsing and persistence; this only consumes its resolved declarations. */
 export function contractVerificationDeclarations(lifecycle) {
-    const bind = lifecycle.history.find(({ entry }) => entry.kind === "bind")?.entry;
-    return bind?.kind === "bind" ? bind.data.verification : [];
+    return effectiveVerification(lifecycle.history.map(({ entry }) => entry));
 }
 export function composeVerificationPlan(input) {
-    const contract = input.contract ?? [];
     const timeoutMs = input.timeoutMs ?? 300_000;
     return [
-        ...contract.map((declaration, index) => ({
-            source: "contract",
-            label: `Verification ${index + 1}`,
-            declaration,
-            command: declaration,
-            args: [],
-            shell: true,
-            timeoutMs,
+        ...(input.contract ?? []).map((declaration, index) => ({
+            source: "contract", label: `Verification ${index + 1}`, declaration: declaration.script,
+            executor: declaration.executor, command: declaration.executor,
+            args: declaration.executor === "pwsh" ? ["-Command", declaration.script] : ["-c", declaration.script],
+            shell: false, timeoutMs,
         })),
         ...input.repositoryGates.map((gate) => ({
-            source: "repository-gate",
-            label: gate.label,
-            declaration: gate.label,
-            command: gate.command,
-            args: [...gate.args],
-            shell: false,
-            timeoutMs,
+            source: "repository-gate", label: gate.label, declaration: gate.label, executor: gate.command,
+            command: gate.command, args: [...gate.args], shell: false, timeoutMs,
         })),
     ];
 }
 export async function resolveVerificationPolicy(cwd) {
     const loaded = await loadKeiyakuSettings(cwd);
     assertSettingsKnobUsable(loaded, "gate");
-    return {
-        commands: loaded.knobs?.gate?.commands ?? [],
-        timeoutMs: loaded.knobs?.gate?.timeoutMs ?? 300_000,
-    };
-}
-function executorFor(entry) {
-    if (!entry.shell)
-        return entry.command;
-    return process.platform === "win32" ? (process.env.ComSpec ?? "cmd.exe") : "/bin/sh";
+    return { commands: loaded.knobs?.gate?.commands ?? [], timeoutMs: loaded.knobs?.gate?.timeoutMs ?? 300_000 };
 }
-export async function runVerificationPlanEntry(cwd, entry, signal, onSupervisorSpawned) {
+export async function executeVerificationRunEntry(input) {
     const started = process.hrtime.bigint();
-    return new Promise((resolve, reject) => {
+    return await new Promise((resolve) => {
         const stdout = new OutputTailCollector();
         const stderr = new OutputTailCollector();
         let settled = false;
-        let timer;
-        let cancel;
+        let stopping;
+        const streams = () => ({ durationMs: Number((process.hrtime.bigint() - started) / 1000000n), stdout: stdout.result(), stderr: stderr.result() });
+        let child;
         const finish = (execution) => {
             if (settled)
                 return;
             settled = true;
-            if (timer)
-                clearTimeout(timer);
-            if (cancel)
-                signal?.removeEventListener("abort", cancel);
+            clearTimeout(timer);
+            input.signal?.removeEventListener("abort", cancel);
             resolve(execution);
         };
-        const streams = () => ({
-            durationMs: Number((process.hrtime.bigint() - started) / 1000000n),
-            stdout: stdout.result(),
-            stderr: stderr.result(),
-        });
-        let terminating;
-        let terminal;
-        const child = spawn(process.execPath, verificationSupervisorArguments(), {
-            cwd: process.cwd(),
-            shell: false,
-            stdio: ["ignore", "pipe", "pipe", "ipc"],
-            env: getConfig().runtimeEnv,
-            detached: process.platform !== "win32",
-        });
-        child.stdout?.on("data", (chunk) => stdout.push(chunk));
-        child.stderr?.on("data", (chunk) => stderr.push(chunk));
-        child.once("error", (error) => {
-            finish({
-                status: "runner_failed",
-                ...streams(),
-                cause: { code: "SPAWN_FAILED", message: error.message },
-            });
-        });
-        const detachUncleanSupervisor = () => {
-            child.stdout?.destroy();
-            child.stderr?.destroy();
-            if (child.connected)
-                child.disconnect();
-            child.unref();
-        };
-        const identity = ownedProcessIdentity(child);
-        if (identity && onSupervisorSpawned) {
-            try {
-                onSupervisorSpawned(identity);
-            }
-            catch (error) {
-                void terminateProcessGroup(child).then(() => reject(error), (terminationError) => reject(new ProcessTreeTerminationError(`runner registration failed and cleanup failed: ${terminationError instanceof Error ? terminationError.message : String(terminationError)}`, { cause: error })));
+        const stop = (cause) => {
+            if (settled || stopping)
                 return;
-            }
+            stopping = cause;
+            void terminateProcessGroup(child).then(() => finish({ status: "runner_failed", ...streams(), cause: { code: cause, message: cause === "TIMED_OUT" ? `verification exceeded ${input.entry.timeoutMs}ms` : "verification cancelled" } }), (error) => finish({ status: "runner_failed", ...streams(), cause: { code: "TREE_TERMINATION_FAILED", message: error instanceof Error ? error.message : String(error) } }));
+        };
+        const cancel = () => stop("CANCELLED");
+        const timer = setTimeout(() => stop("TIMED_OUT"), input.entry.timeoutMs);
+        timer.unref?.();
+        try {
+            child = launchDetachedProcess({
+                command: input.entry.command, args: input.entry.args,
+                options: { cwd: input.cwd, shell: input.entry.shell, stdio: ["ignore", "pipe", "pipe"] },
+            });
         }
-        child.on("message", (raw) => {
-            const parsed = supervisorMessageSchema.safeParse(raw);
-            if (!parsed.success)
+        catch (error) {
+            finish({ status: "runner_failed", ...streams(), cause: { code: "SPAWN_FAILED", message: error instanceof Error ? error.message : String(error) } });
+            return;
+        }
+        child.stdout?.on("data", (chunk) => stdout.push(chunk));
+        child.stderr?.on("data", (chunk) => stderr.push(chunk));
+        child.once("error", (error) => finish({ status: "runner_failed", ...streams(), cause: { code: "SPAWN_FAILED", message: error.message } }));
+        child.once("close", (code, closeSignal) => {
+            if (stopping)
                 return;
-            const message = parsed.data;
-            if (message.type === "ready") {
-                if (terminating)
-                    return;
-                const configureMessage = {
-                    version: VERIFICATION_SUPERVISOR_PROTOCOL_VERSION,
-                    type: "configure",
-                    cwd,
-                    command: entry.command,
-                    args: entry.args,
-                    shell: entry.shell,
-                    timeoutMs: entry.timeoutMs,
-                };
-                child.send?.(configureMessage);
+            if (closeSignal || code === null) {
+                finish({ status: "runner_failed", ...streams(), cause: { code: "PROCESS_TERMINATED", message: `executor terminated${closeSignal ? ` by ${closeSignal}` : " without an exit status"}` } });
             }
-            else if (message.type === "configured") {
-                if (terminating)
-                    return;
-                const startMessage = {
-                    version: VERIFICATION_SUPERVISOR_PROTOCOL_VERSION,
-                    type: "start",
-                };
-                child.send?.(startMessage);
-            }
-            else if (message.type === "terminal") {
-                terminal = message;
-                if (message.outcome.kind === "tree-termination-failed" && !terminating) {
-                    const supervisorFailure = message.outcome.message;
-                    terminating = "TIMED_OUT";
-                    void terminateProcessGroup(child).then(() => {
-                        finish({
-                            status: "runner_failed",
-                            ...streams(),
-                            cause: { code: "TIMED_OUT", message: `verification exceeded ${entry.timeoutMs}ms` },
-                        });
-                    }, (error) => {
-                        detachUncleanSupervisor();
-                        finish({
-                            status: "runner_failed",
-                            ...streams(),
-                            cause: {
-                                code: "TREE_TERMINATION_FAILED",
-                                message: `${supervisorFailure}; parent cleanup failed: ${error instanceof Error ? error.message : String(error)}`,
-                            },
-                        });
-                    });
-                }
+            else {
+                finish({ status: "executed", ...streams(), code });
             }
         });
-        const terminate = (cause) => {
-            if (settled || terminating)
-                return;
-            terminating = cause;
-            void terminateProcessGroup(child).then(() => {
-                finish({
-                    status: "runner_failed",
-                    ...streams(),
-                    cause: {
-                        code: cause,
-                        message: cause === "TIMED_OUT" ? `verification exceeded ${entry.timeoutMs}ms` : "verification cancelled",
-                    },
-                });
-            }, (error) => {
-                detachUncleanSupervisor();
-                finish({
-                    status: "runner_failed",
-                    ...streams(),
-                    cause: {
-                        code: error instanceof ProcessTreeTerminationError ? error.code : "TREE_TERMINATION_FAILED",
-                        message: error instanceof Error ? error.message : String(error),
-                    },
-                });
-            });
-        };
-        timer = setTimeout(() => terminate("TIMED_OUT"), entry.timeoutMs);
-        timer.unref?.();
-        cancel = () => terminate("CANCELLED");
-        signal?.addEventListener("abort", cancel, { once: true });
-        if (signal?.aborted)
+        input.signal?.addEventListener("abort", cancel, { once: true });
+        if (input.signal?.aborted)
             cancel();
-        child.once("close", (code, closeSignal) => {
-            void (async () => {
-                if (timer)
-                    clearTimeout(timer);
-                if (cancel)
-                    signal?.removeEventListener("abort", cancel);
-                if (terminating)
-                    return;
-                if (identity && ownedProcessIsLive(identity)) {
-                    try {
-                        await terminateOwnedProcess(identity);
-                    }
-                    catch (error) {
-                        finish({
-                            status: "runner_failed",
-                            ...streams(),
-                            cause: {
-                                code: "TREE_TERMINATION_FAILED",
-                                message: error instanceof Error ? error.message : String(error),
-                            },
-                        });
-                        return;
-                    }
-                }
-                if (!terminal) {
-                    finish({
-                        status: "runner_failed",
-                        ...streams(),
-                        cause: {
-                            code: "PROCESS_TERMINATED",
-                            message: `verification supervisor terminated${closeSignal ? ` by ${closeSignal}` : code === null ? " without an exit status" : ` with exit ${code}`}`,
-                        },
-                    });
-                    return;
-                }
-                const observed = { durationMs: terminal.durationMs, stdout: stdout.result(), stderr: stderr.result() };
-                if (terminal.outcome.kind === "exit") {
-                    finish({ status: "executed", ...observed, code: terminal.outcome.code });
-                }
-                else if (terminal.outcome.kind === "spawn-failed") {
-                    finish({ status: "runner_failed", ...observed, cause: { code: "SPAWN_FAILED", message: terminal.outcome.message } });
-                }
-                else if (terminal.outcome.kind === "timeout") {
-                    finish({ status: "runner_failed", ...observed, cause: { code: "TIMED_OUT", message: `verification exceeded ${entry.timeoutMs}ms` } });
-                }
-                else if (terminal.outcome.kind === "signal") {
-                    finish({
-                        status: "runner_failed",
-                        ...observed,
-                        cause: {
-                            code: "PROCESS_TERMINATED",
-                            message: `executor terminated${terminal.outcome.signal ? ` by ${terminal.outcome.signal}` : " without an exit status"}`,
-                        },
-                    });
-                }
-                else {
-                    finish({
-                        status: "runner_failed",
-                        ...observed,
-                        cause: { code: "TREE_TERMINATION_FAILED", message: terminal.outcome.message },
-                    });
-                }
-            })();
-        });
     });
 }
-export async function runVerificationPlan(input) {
-    const execute = async (supervisorLifecycle) => {
-        const results = [];
-        for (const entry of input.plan) {
-            if (input.signal?.aborted) {
-                const empty = { tail: "", truncated: false, omittedBytes: 0 };
-                results.push({
-                    ...entry,
-                    candidate: input.candidate,
-                    executor: executorFor(entry),
-                    execution: {
-                        status: "runner_failed",
-                        durationMs: 0,
-                        stdout: empty,
-                        stderr: empty,
-                        cause: { code: "CANCELLED", message: "verification cancelled before runner spawn" },
-                    },
-                });
+export async function executePersistedVerificationRun(root, runId, inheritedLease) {
+    const initial = readVerificationRun(root, runId);
+    if (!initial || initial.terminal)
+        return;
+    const database = openRunDatabase(root);
+    let lease = inheritedLease;
+    let cancellationPoll;
+    try {
+        initializeRunnerLeaseDatabase(verificationRunLeasePath(root, runId));
+        lease ??= acquireRunnerLease(verificationRunLeasePath(root, runId));
+        const adopted = readVerificationRun(root, runId);
+        if (!adopted || adopted.terminal)
+            return;
+        const controller = new AbortController();
+        cancellationPoll = setInterval(() => { if (isCancellationRequested(database, runId))
+            controller.abort(); }, RUN_WAIT_POLL_MS);
+        cancellationPoll.unref?.();
+        const results = [...adopted.receipts];
+        for (let index = adopted.receipts.length; index < adopted.plan.length; index += 1) {
+            const entry = adopted.plan[index];
+            if (isCancellationRequested(database, runId))
+                controller.abort();
+            const execution = controller.signal.aborted
+                ? { status: "runner_failed", durationMs: 0, stdout: emptyTail(), stderr: emptyTail(), cause: { code: "CANCELLED", message: "verification cancelled before executor spawn" } }
+                : await executeVerificationRunEntry({ cwd: initial.cwd, entry, signal: controller.signal });
+            const result = { ...entry, candidate: adopted.candidate, executor: executorFor(entry), execution };
+            writeReceipt(database, runId, index, result);
+            results.push(result);
+            if (execution.status === "runner_failed" && (execution.cause.code === "CANCELLED" || execution.cause.code === "TREE_TERMINATION_FAILED"))
                 break;
-            }
-            let supervisorRecorded = false;
-            const execution = await runVerificationPlanEntry(input.cwd, entry, input.signal, supervisorLifecycle
-                ? (identity) => {
-                    supervisorLifecycle.spawned(identity);
-                    supervisorRecorded = true;
-                }
-                : undefined);
-            const cleanupFailed = execution.status === "runner_failed"
-                && execution.cause.code === "TREE_TERMINATION_FAILED";
-            if (supervisorRecorded && !cleanupFailed)
-                supervisorLifecycle?.cleaned();
-            results.push({
-                ...entry,
-                candidate: input.candidate,
-                executor: executorFor(entry),
-                execution,
-            });
-            if (execution.status === "runner_failed"
-                && (execution.cause.code === "CANCELLED" || execution.cause.code === "TREE_TERMINATION_FAILED"))
-                break;
-        }
-        return results;
-    };
-    const key = input.coordinationKey ?? JSON.stringify({
-        cwd: input.cwd,
-        candidate: input.candidate,
-        plan: input.plan,
-    });
-    const memoryKey = JSON.stringify({ root: input.coordinationRoot ?? null, key });
-    const existing = verificationRuns.get(memoryKey);
-    if (existing)
-        return await existing;
-    const run = input.coordinationRoot
-        ? runCoordinatedVerification({
-            root: input.coordinationRoot,
-            key,
-            execute,
-            signal: input.signal,
-            candidate: input.candidate,
-            plan: input.plan,
-        })
-        : execute();
-    const tracked = run.finally(() => verificationRuns.delete(memoryKey));
-    verificationRuns.set(memoryKey, tracked);
-    return await tracked;
-}
-const verificationRuns = new Map();
-async function wait(ms) {
-    await new Promise((resolve) => setTimeout(resolve, ms));
-}
-function cancelledResults(candidate, plan) {
-    const entry = plan[0];
-    if (!entry)
-        return [];
-    const empty = { tail: "", truncated: false, omittedBytes: 0 };
-    return [{
-            ...entry,
-            candidate,
-            executor: executorFor(entry),
-            execution: {
-                status: "runner_failed",
-                durationMs: 0,
-                stdout: empty,
-                stderr: empty,
-                cause: { code: "CANCELLED", message: "verification cancelled while waiting for an identical active execution" },
-            },
-        }];
-}
-async function runCoordinatedVerification(input) {
-    const coordination = new VerificationCoordination(input.root);
-    const fingerprint = coordination.fingerprint(input.key);
-    const staleAfterMs = input.plan.reduce((total, entry) => total + entry.timeoutMs + PROCESS_GROUP_KILL_GRACE_MS, COORDINATION_RECOVERY_MARGIN_MS);
-    for (;;) {
-        if (input.signal?.aborted)
-            return cancelledResults(input.candidate, input.plan);
-        const claim = coordination.claim(fingerprint, staleAfterMs);
-        if (claim.status === "receipt")
-            return claim.results;
-        if (claim.status === "wait") {
-            await wait(COORDINATION_POLL_MS);
-            continue;
         }
+        const close = beginConnectionBoundRunnerClose(database, lease);
         try {
-            if (claim.priorSupervisor) {
-                await terminateOwnedProcess(claim.priorSupervisor);
-                coordination.clearSupervisor(fingerprint, claim.token);
-            }
-            const lifecycle = {
-                spawned: (identity) => coordination.recordSupervisor(fingerprint, claim.token, identity),
-                cleaned: () => coordination.clearSupervisor(fingerprint, claim.token),
-            };
-            const results = await input.execute(lifecycle);
-            const completion = coordination.complete(fingerprint, claim.token, results);
-            if (completion.status === "ownership-lost") {
-                throw new Error("verification coordination ownership changed before receipt publication");
-            }
-            return results;
+            writeRunTerminal(database, runId, { status: "completed", results });
+            close.commit();
+            lease = undefined;
         }
         catch (error) {
-            coordination.releaseForTakeover(fingerprint, claim.token);
+            if (close.leaseOwnership === "retained")
+                close.rollback();
+            else
+                lease = undefined;
             throw error;
         }
     }
+    catch (error) {
+        if (!lease && error instanceof RunnerLeaseUnavailableError && observeRunnerLease(verificationRunLeasePath(root, runId)).state === "held")
+            return;
+        throw error;
+    }
+    finally {
+        if (cancellationPoll)
+            clearInterval(cancellationPoll);
+        if (lease)
+            lease.close();
+        database.close();
+    }
+}
+export async function runVerificationRuntime(root, runId) {
+    const transfer = await receiveDetachedLease({ coordinate: runId, leasePath: verificationRunLeasePath(root, runId) });
+    if (transfer.status === "authorized")
+        await executePersistedVerificationRun(root, runId, transfer.lease);
 }