@aviaratech/ai-delivery 0.3.5 → 0.3.7

package/dist/verification.js

@@ -1,7 +1,7 @@
 import { spawn, spawnSync } from 'node:child_process';
 import { randomUUID } from 'node:crypto';
 import { createRequire } from 'node:module';
-import { existsSync, unlinkSync, lstatSync, readFileSync, readdirSync, realpathSync, statfsSync } from 'node:fs';
+import { closeSync, existsSync, fsyncSync, openSync, unlinkSync, lstatSync, mkdirSync, rmdirSync, renameSync, readFileSync, readdirSync, realpathSync, statfsSync, } from 'node:fs';
 import { basename, dirname, join, resolve, sep } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { z } from 'zod';
@@ -125,6 +125,254 @@ function assertResourceBounds(bounds) {
     if (process.platform === 'win32')
         throw new DeliveryError('Resource observation requires POSIX process support.');
 }
+const OUTPUT_GATE_ENV = 'AI_DELIVERY_OUTPUT_OBSERVATION_GATE';
+const GateOwnerSchema = z.strictObject({ pid: z.number().int().positive(), identity: z.string().min(1) });
+const OutputGateSchema = z.strictObject({ directory: z.string().min(1), id: z.uuid(), owner: GateOwnerSchema });
+const GateClaimSchema = z.strictObject({
+    gateId: z.uuid(),
+    id: z.uuid(),
+    kind: z.enum(['scan', 'fixture']),
+    owner: GateOwnerSchema,
+});
+function gateOwner() {
+    const owner = processSnapshot().get(process.pid);
+    if (!owner)
+        throw new DeliveryError('Filesystem observation gate owner is unavailable.');
+    return { pid: owner.pid, identity: owner.identity };
+}
+function assertGateDirectory(path) {
+    const metadata = lstatSync(path);
+    if (!metadata.isDirectory() || (metadata.mode & 0o077) !== 0 || realpathSync(path) !== path)
+        throw new DeliveryError('Filesystem observation gate directory is invalid.');
+}
+function readOutputGate(value) {
+    try {
+        const gate = OutputGateSchema.parse(JSON.parse(value));
+        assertOutputGate(gate);
+        return gate;
+    }
+    catch (error) {
+        throw new DeliveryError('Filesystem observation gate capability is invalid or stale: ' +
+            (error instanceof Error ? error.message : String(error)));
+    }
+}
+function gateOwnerAlive(owner, snapshot = processSnapshot()) {
+    const current = snapshot.get(owner.pid);
+    return current?.identity === owner.identity && !current.status.startsWith('Z');
+}
+function assertOutputGate(gate, abandoned = false) {
+    assertGateDirectory(gate.directory);
+    const manifest = OutputGateSchema.parse(JSON.parse(assertPrivateFile(join(gate.directory, 'gate.json')).toString('utf8')));
+    const snapshot = processSnapshot();
+    let actor = snapshot.get(process.pid);
+    const ancestors = new Set();
+    while (actor && actor.pid !== gate.owner.pid && !ancestors.has(actor.pid)) {
+        ancestors.add(actor.pid);
+        actor = snapshot.get(actor.ppid);
+    }
+    if (digestValue(manifest) !== digestValue(gate) ||
+        (abandoned
+            ? gateOwnerAlive(gate.owner, snapshot)
+            : !gateOwnerAlive(gate.owner, snapshot) || actor?.identity !== gate.owner.identity))
+        throw new DeliveryError('Filesystem observation gate ownership changed, was abandoned or is not an inherited ancestor.');
+}
+function readGateClaim(gate, path) {
+    const claim = GateClaimSchema.parse(JSON.parse(assertPrivateFile(path).toString('utf8')));
+    if (claim.gateId !== gate.id)
+        throw new DeliveryError('Filesystem observation gate claim belongs to another run.');
+    return claim;
+}
+function gateScanRequests(gate) {
+    const directory = join(gate.directory, 'requests');
+    assertGateDirectory(directory);
+    const requests = readdirSync(directory);
+    if (requests.length > 1024 || requests.some((name) => !/^[a-f0-9-]{36}\.json$/u.test(name)))
+        throw new DeliveryError('Filesystem observation gate scan requests are invalid.');
+    const live = [];
+    const snapshot = processSnapshot();
+    for (const name of requests) {
+        let claim;
+        try {
+            claim = readGateClaim(gate, join(directory, name));
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                continue;
+            throw error;
+        }
+        if (claim.kind !== 'scan' || name !== claim.id + '.json' || !gateOwnerAlive(claim.owner, snapshot))
+            throw new DeliveryError('Filesystem observation gate scan request was abandoned.');
+        live.push(name);
+    }
+    return live;
+}
+function removeGateClaim(gate, path, claim) {
+    if (digestValue(readGateClaim(gate, path)) !== digestValue(claim))
+        throw new DeliveryError('Filesystem observation gate claim changed before release.');
+    unlinkSync(path);
+}
+async function withOutputGateLock(gate, kind, operation, signal) {
+    if (!gate)
+        return operation();
+    assertOutputGate(gate);
+    const claim = { gateId: gate.id, id: randomUUID(), kind, owner: gateOwner() };
+    const request = kind === 'scan' ? join(gate.directory, 'requests', claim.id + '.json') : undefined;
+    const lock = join(gate.directory, 'held');
+    const holder = join(lock, 'owner.json');
+    if (request) {
+        const staging = join(gate.directory, claim.id + '.pending');
+        writePrivateJsonFileAtomically(staging, claim);
+        renameSync(staging, request);
+    }
+    let acquired;
+    let incompleteSince;
+    let fixtureWait;
+    const release = () => {
+        if (!acquired)
+            return;
+        const metadata = lstatSync(lock);
+        if (!metadata.isDirectory() || metadata.dev !== acquired.dev || metadata.ino !== acquired.ino)
+            throw new DeliveryError('Filesystem observation gate lock changed before release.');
+        if (readdirSync(lock).join(',') !== 'owner.json')
+            throw new DeliveryError('Filesystem observation gate lock has unrelated metadata.');
+        removeGateClaim(gate, holder, claim);
+        rmdirSync(lock);
+        acquired = undefined;
+    };
+    try {
+        for (;;) {
+            if (signal?.aborted)
+                throw new DeliveryError('Filesystem observation gate wait cancelled.');
+            assertOutputGate(gate);
+            const requests = gateScanRequests(gate);
+            if (kind === 'scan' || requests.length === 0) {
+                let created = false;
+                try {
+                    mkdirSync(lock, { mode: 0o700 });
+                    created = true;
+                }
+                catch (error) {
+                    if (error.code !== 'EEXIST')
+                        throw error;
+                }
+                if (created) {
+                    const metadata = lstatSync(lock);
+                    acquired = { dev: metadata.dev, ino: metadata.ino };
+                    writePrivateJsonFileAtomically(holder, claim);
+                    // A scan may queue between the fixture's request check and atomic lock acquisition.
+                    if (kind === 'scan' || gateScanRequests(gate).length === 0)
+                        return await operation();
+                    release();
+                }
+            }
+            if (existsSync(lock)) {
+                try {
+                    assertGateDirectory(lock);
+                    const current = readGateClaim(gate, holder);
+                    incompleteSince = undefined;
+                    if (!gateOwnerAlive(current.owner))
+                        throw new DeliveryError('Filesystem observation gate fixture or scanner was abandoned.');
+                    if (kind === 'scan' && current.kind === 'fixture') {
+                        if (fixtureWait?.claimId !== current.id)
+                            fixtureWait = { claimId: current.id, since: Date.now() };
+                        // A negative reader that blocks prevents strict output observation; terminate this command, never steal its live lease.
+                        if (Date.now() - fixtureWait.since > 5000)
+                            throw new DeliveryError('Filesystem-negative fixture did not release a waiting output scan within 5 seconds; reader or teardown is stalled.');
+                    }
+                    else
+                        fixtureWait = undefined;
+                }
+                catch (error) {
+                    if (error.code !== 'ENOENT')
+                        throw error;
+                    incompleteSince ??= Date.now();
+                    // A concrete publication failure, never an elapsed fixture-work allowance or stale-lock takeover.
+                    if (Date.now() - incompleteSince > 2000)
+                        throw new DeliveryError('Filesystem observation gate owner publication is incomplete.');
+                }
+            }
+            await new Promise((resolve) => setTimeout(resolve, 100));
+        }
+    }
+    finally {
+        try {
+            release();
+        }
+        finally {
+            if (request)
+                removeGateClaim(gate, request, claim);
+        }
+    }
+}
+/** Run a real filesystem-negative fixture between strict scans; the callback must clean it up before returning. */
+export async function withVerificationFilesystemFixture(operation) {
+    const capability = process.env[OUTPUT_GATE_ENV];
+    return withOutputGateLock(capability === undefined ? undefined : readOutputGate(capability), 'fixture', operation);
+}
+function retireOutputGate(gate, abandoned = false) {
+    assertOutputGate(gate, abandoned);
+    const requests = join(gate.directory, 'requests');
+    const held = join(gate.directory, 'held');
+    if (readdirSync(gate.directory).some((name) => !['gate.json', 'requests', 'held'].includes(name)))
+        throw new DeliveryError('Filesystem observation gate has unrelated or incomplete metadata.');
+    if (existsSync(held)) {
+        assertGateDirectory(held);
+        if (readdirSync(held).join(',') !== 'owner.json')
+            throw new DeliveryError('Filesystem observation gate lock has unrelated metadata.');
+        const claim = readGateClaim(gate, join(held, 'owner.json'));
+        if (gateOwnerAlive(claim.owner))
+            throw new DeliveryError('Filesystem observation gate still has a live holder.');
+        removeGateClaim(gate, join(held, 'owner.json'), claim);
+        rmdirSync(held);
+    }
+    for (const name of readdirSync(requests)) {
+        if (!/^[a-f0-9-]{36}\.json$/u.test(name))
+            throw new DeliveryError('Filesystem observation gate has unrelated metadata.');
+        const path = join(requests, name);
+        const claim = readGateClaim(gate, path);
+        if (claim.kind !== 'scan' || name !== claim.id + '.json')
+            throw new DeliveryError('Filesystem observation gate has unrelated scan metadata.');
+        if (gateOwnerAlive(claim.owner))
+            throw new DeliveryError('Filesystem observation gate still has a live scan request.');
+        removeGateClaim(gate, path, claim);
+    }
+    rmdirSync(requests);
+    if (digestValue(JSON.parse(assertPrivateFile(join(gate.directory, 'gate.json')).toString('utf8'))) !==
+        digestValue(gate))
+        throw new DeliveryError('Filesystem observation gate changed before retirement.');
+    unlinkSync(join(gate.directory, 'gate.json'));
+    rmdirSync(gate.directory);
+}
+async function withOutputObservationGate(root, enabled, operation) {
+    const inherited = process.env[OUTPUT_GATE_ENV];
+    if (inherited !== undefined)
+        return operation(readOutputGate(inherited));
+    if (!enabled)
+        return operation(undefined);
+    const id = randomUUID();
+    const namespace = join(gitCommonDir(root), 'ai-delivery', 'output-observation', worktreeDigest(root).slice(7));
+    ensurePrivateDirectoryDurably(namespace);
+    // The existing writer has recovered and confirmed old command quiescence before this operation.
+    for (const priorId of readdirSync(namespace)) {
+        z.uuid().parse(priorId);
+        const path = join(namespace, priorId);
+        assertGateDirectory(path);
+        const prior = OutputGateSchema.parse(JSON.parse(assertPrivateFile(join(path, 'gate.json')).toString('utf8')));
+        if (prior.id !== priorId || prior.directory !== path || gateOwnerAlive(prior.owner))
+            throw new DeliveryError('Prior filesystem observation gate is live or has conflicting ownership.');
+        retireOutputGate(prior, true);
+    }
+    const directory = join(namespace, id);
+    ensurePrivateDirectoryDurably(join(directory, 'requests'));
+    const gate = { directory, id, owner: gateOwner() };
+    writePrivateJsonFileAtomically(join(directory, 'gate.json'), gate);
+    try {
+        return await operation(gate);
+    }
+    finally {
+        retireOutputGate(gate);
+    }
+}
 const OutputBaselineCheckpointSchema = z.strictObject({
     baselineId: z.string().regex(/^sha256:[a-f0-9]{64}$/u),
     files: z.array(z.tuple([z.string().min(1), z.number().int().nonnegative().safe()])),
@@ -187,7 +435,7 @@ function scanOutputRoots(roots) {
     }
     return files;
 }
-function outputBaseline(repoRoot, common, classificationReceiptId, bounds) {
+async function outputBaseline(repoRoot, common, classificationReceiptId, bounds, gate, signal) {
     if (bounds.outputRoots === undefined)
         return undefined;
     const roots = bounds.outputRoots.map((path) => resolve(repoRoot, path)).sort();
@@ -236,7 +484,7 @@ function outputBaseline(repoRoot, common, classificationReceiptId, bounds) {
     let checkpoint;
     if (state?.status !== 'complete') {
         const content = {
-            files: [...scanOutputRoots(roots)].sort(([left], [right]) => (left < right ? -1 : left > right ? 1 : 0)),
+            files: [...(await withOutputGateLock(gate, 'scan', () => scanOutputRoots(roots), signal))].sort(([left], [right]) => (left < right ? -1 : left > right ? 1 : 0)),
             inputId,
             roots,
             schemaVersion: 'ai-delivery.output-baseline@1',
@@ -261,11 +509,11 @@ function outputBaseline(repoRoot, common, classificationReceiptId, bounds) {
         checkpoint.files.some(([file], index) => (index > 0 && file <= checkpoint.files[index - 1][0]) ||
             !roots.some((root) => file === root || file.startsWith(`${root}${sep}`))))
         throw new DeliveryError('Filesystem output baseline checkpoint is corrupt or belongs to another input.');
-    return { baselineId, roots, files: new Map(checkpoint.files) };
+    return { baselineId, roots, files: new Map(checkpoint.files), ...(gate === undefined ? {} : { gate }) };
 }
-function positiveNewOutputBytes(baseline) {
+async function positiveNewOutputBytes(baseline, signal) {
     let bytes = 0;
-    for (const [path, size] of scanOutputRoots(baseline.roots)) {
+    for (const [path, size] of await withOutputGateLock(baseline.gate, 'scan', () => scanOutputRoots(baseline.roots), signal)) {
         bytes += Math.max(0, size - (baseline.files.get(path) ?? 0));
         if (!Number.isSafeInteger(bytes))
             throw new DeliveryError('Filesystem output observation overflowed.');
@@ -382,7 +630,7 @@ function observeOwnedProcesses(state, snapshot) {
     state.sampled = true;
     return [...selected.values()];
 }
-function sampleOwnedTree(state, repoRoot, bounds, baseline) {
+function sampleOwnedTree(state, repoRoot, bounds, baseline, newOutputBytes) {
     const owned = observeOwnedProcesses(state, processSnapshot());
     const rssBytes = owned.reduce((total, member) => total + member.rssBytes, 0);
     if (!Number.isSafeInteger(rssBytes))
@@ -393,7 +641,6 @@ function sampleOwnedTree(state, repoRoot, bounds, baseline) {
     const available = freeDiskBytes(repoRoot, baseline);
     if (available < bounds.minFreeDiskBytes)
         throw new DeliveryError(`Free disk fell below limit ${bounds.minFreeDiskBytes}.`);
-    const newOutputBytes = baseline === undefined ? undefined : positiveNewOutputBytes(baseline);
     if (newOutputBytes !== undefined && !Number.isSafeInteger(newOutputBytes)) {
         throw new DeliveryError('Filesystem output observation overflowed.');
     }
@@ -492,9 +739,30 @@ const WriterStateSchema = z
     if (stateId !== digestValue(content))
         ctx.addIssue({ code: 'custom', message: 'Writer state is corrupt.' });
 });
-async function withVerificationWriter(root, operation) {
+/** @internal Read-only closure check shared by inspection and the locked transition lease. */
+export function assertWorktreeTransitionWriterQuiescent(worktreePath, bytes) {
+    if (bytes === undefined)
+        return;
+    const previous = WriterStateSchema.parse(JSON.parse(bytes.toString('utf8')));
+    if (previous.worktreeDigest !== worktreeDigest(worktreePath))
+        throw new DeliveryError('Verification writer belongs to another worktree.');
+    const snapshot = processSnapshot();
+    const owner = snapshot.get(previous.owner.pid);
+    if (owner?.identity === previous.owner.identity && !owner.status.startsWith('Z'))
+        throw new DeliveryError('A live verification writer still owns this worktree.');
+    if (previous.command.phase === 'starting')
+        throw new DeliveryError('Interrupted writer has unknown command ownership; reconcile before retrying.');
+    if (previous.command.phase === 'running') {
+        const identities = [previous.command.root, ...previous.command.tracked];
+        const groups = new Set([previous.command.root.pid, ...previous.command.tracked.map((member) => member.pgid)]);
+        if (identities.some((member) => snapshot.has(member.pid)) ||
+            [...snapshot.values()].some((member) => groups.has(member.pgid)))
+            throw new DeliveryError('Transition requires identity-bound command and process-group absence.');
+    }
+}
+async function withVerificationWriter(root, operation, transition, commonDirectory) {
     const digest = worktreeDigest(root);
-    const path = join(gitCommonDir(root), 'ai-delivery', 'writers@1', `${digest.slice(7)}.json`);
+    const path = join(commonDirectory ?? gitCommonDir(root), 'ai-delivery', 'writers@1', `${digest.slice(7)}.json`);
     ensurePrivateDirectoryDurably(dirname(path));
     return withLock(path, {
         projectRoot: root,
@@ -504,8 +772,23 @@ async function withVerificationWriter(root, operation) {
             const owner = snapshot.get(process.pid);
             if (owner === undefined || owner.status.startsWith('Z'))
                 throw new DeliveryError('Verification writer identity is unknown.');
-            if (existsSync(path)) {
-                const previous = WriterStateSchema.parse(JSON.parse(assertPrivateFile(path).toString('utf8')));
+            let previousBytes;
+            if (transition) {
+                try {
+                    lstatSync(path);
+                    previousBytes = assertPrivateFile(path);
+                }
+                catch (error) {
+                    if (error.code !== 'ENOENT')
+                        throw error;
+                }
+            }
+            else if (existsSync(path))
+                previousBytes = assertPrivateFile(path);
+            if (transition)
+                assertWorktreeTransitionWriterQuiescent(root, previousBytes);
+            if (previousBytes !== undefined && !transition) {
+                const previous = WriterStateSchema.parse(JSON.parse(previousBytes.toString('utf8')));
                 if (previous.worktreeDigest !== digest)
                     throw new DeliveryError('Verification writer belongs to another worktree.');
                 const priorOwner = snapshot.get(previous.owner.pid);
@@ -533,9 +816,15 @@ async function withVerificationWriter(root, operation) {
                     });
                 }
             }
+            if (transition) {
+                await transition.beforeClaim({
+                    previousBytes: previousBytes === undefined ? undefined : Buffer.from(previousBytes),
+                    owner: { pid: owner.pid, identity: owner.identity },
+                });
+            }
             let state = {
                 schemaVersion: 'ai-delivery.verification-writer@1',
-                writerId: randomUUID(),
+                writerId: transition?.writerId ?? randomUUID(),
                 worktreeDigest: digest,
                 owner: { pid: owner.pid, identity: owner.identity },
                 command: { phase: 'idle' },
@@ -544,6 +833,22 @@ async function withVerificationWriter(root, operation) {
                 state = { ...state, command };
                 writePrivateJsonFileAtomically(path, { ...state, stateId: digestValue(state) });
             };
+            if (transition) {
+                const bytes = Buffer.from(`${JSON.stringify({ ...state, stateId: digestValue(state) }, null, 2)}\n`);
+                await transition.recordClaim(Buffer.from(bytes));
+                let actual;
+                try {
+                    lstatSync(path);
+                    actual = assertPrivateFile(path);
+                }
+                catch (error) {
+                    if (error.code !== 'ENOENT')
+                        throw error;
+                }
+                if ((actual === undefined) !== (previousBytes === undefined) ||
+                    (actual !== undefined && previousBytes !== undefined && !actual.equals(previousBytes)))
+                    throw new DeliveryError('Writer changed after transition intent preservation.');
+            }
             persist({ phase: 'idle' });
             const writer = {
                 starting: () => persist({ phase: 'starting' }),
@@ -563,22 +868,80 @@ async function withVerificationWriter(root, operation) {
                         throw new DeliveryError('Verification writer command quiescence is not confirmed.');
                 },
             };
-            const releaseWriter = () => {
-                const current = WriterStateSchema.parse(JSON.parse(assertPrivateFile(path).toString('utf8')));
+            const releaseWriter = async () => {
+                const bytes = assertPrivateFile(path);
+                const current = WriterStateSchema.parse(JSON.parse(bytes.toString('utf8')));
                 if (current.writerId !== state.writerId)
                     throw new DeliveryError('Verification writer ownership changed.');
-                if (current.command.phase === 'idle')
+                if (current.command.phase === 'idle') {
+                    if (transition) {
+                        await transition.recordRelease(Buffer.from(bytes));
+                        if (!assertPrivateFile(path).equals(bytes))
+                            throw new DeliveryError('Writer changed before recorded release.');
+                    }
                     unlinkSync(path);
+                    if (transition) {
+                        const descriptor = openSync(dirname(path), 'r');
+                        try {
+                            fsyncSync(descriptor);
+                        }
+                        finally {
+                            closeSync(descriptor);
+                        }
+                        try {
+                            lstatSync(path);
+                        }
+                        catch (error) {
+                            if (error.code !== 'ENOENT')
+                                throw error;
+                            await transition.afterRelease?.();
+                            return;
+                        }
+                        throw new DeliveryError('Writer absence is not confirmed after recorded release.');
+                    }
+                }
             };
             try {
+                await transition?.afterClaim?.(Buffer.from(assertPrivateFile(path)));
                 return await operation(writer);
             }
             finally {
-                releaseWriter();
+                await releaseWriter();
             }
         },
     });
 }
+/** @internal Hold the existing writer lock while reading a sealed transition; never claim or recover its slot. */
+export async function withWorktreeTransitionWriterAbsent(repoRoot, worktreePath, operation) {
+    const path = join(gitCommonDir(repoRoot), 'ai-delivery', 'writers@1', `${worktreeDigest(worktreePath).slice(7)}.json`);
+    return withLock(path, {
+        projectRoot: repoRoot,
+        timeout: 200,
+        operation: async () => {
+            try {
+                lstatSync(path);
+            }
+            catch (error) {
+                if (error.code !== 'ENOENT')
+                    throw error;
+                return operation();
+            }
+            throw new DeliveryError('Sealed transition writer absence postcondition drifted.');
+        },
+    });
+}
+/** @internal Check-only lease for the explicit transition owner; never recovers or signals old commands. */
+export async function withWorktreeTransitionWriterLease(input, operation) {
+    z.uuid().parse(input.writerId);
+    const repository = gitRoot(input.repoRoot);
+    const subject = input.worktreePath === undefined ? repository : resolve(input.worktreePath);
+    return withVerificationWriter(subject, async (writer) => {
+        writer.assertQuiescent();
+        const result = await operation();
+        writer.assertQuiescent();
+        return result;
+    }, input, gitCommonDir(repository));
+}
 function primaryRoot(worktreeRoot) {
     const common = gitCommonDir(worktreeRoot);
     if (basename(common) !== '.git')
@@ -597,8 +960,7 @@ function assertRegisteredIssue(worktreeRoot, issueNumber, allowMerged = false) {
 function worktreeDigest(root) {
     return digestValue(resolve(root));
 }
-function producerDigest() {
-    const root = dirname(fileURLToPath(import.meta.url));
+function producerContent(root) {
     const code = [];
     const collect = (directory) => {
         for (const entry of readdirSync(directory, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
@@ -646,7 +1008,22 @@ function producerDigest() {
         }
     };
     collectDependencies(join(dirname(root), 'package.json'));
-    return digestValue({ code, dependencies: [...dependencies].sort(([a], [b]) => a.localeCompare(b)) });
+    return { code, dependencies: [...dependencies].sort(([a], [b]) => a.localeCompare(b)) };
+}
+function producerDigest(root = dirname(fileURLToPath(import.meta.url))) {
+    return digestValue(producerContent(root));
+}
+/** @internal Retained public code is hashed as data; it is never imported or executed. */
+export function retainedWorktreeTransitionProducerDigest(distDirectory) {
+    return producerDigest(realpathSync(distDirectory));
+}
+/** @internal Preserve the same dependency manifests that participate in the existing producer digest. */
+export function retainedWorktreeTransitionDependencyManifests(distDirectory) {
+    return producerContent(realpathSync(distDirectory)).dependencies.map(([source, digest]) => ({ source, digest }));
+}
+/** @internal Original manifests validate as history and cannot authorize current verification. */
+export function readWorktreeTransitionRun(bytes) {
+    return parseRun(JSON.parse(bytes.toString('utf8')));
 }
 function manifestPath(common, headSha, root) {
     return root === undefined
@@ -756,6 +1133,9 @@ function runStageCommand(repoRoot, argv, abortSignal, onRunning, resourceBounds,
             cwd: repoRoot,
             detached: process.platform !== 'win32',
             stdio: ['pipe', 'pipe', 'pipe'],
+            ...(baseline?.gate === undefined
+                ? {}
+                : { env: { ...process.env, [OUTPUT_GATE_ENV]: JSON.stringify(baseline.gate) } }),
         });
         const stdout = [];
         const stderr = [];
@@ -769,6 +1149,8 @@ function runStageCommand(repoRoot, argv, abortSignal, onRunning, resourceBounds,
         let closed = false;
         let settled = false;
         let commandReleased = false;
+        let pendingOutput;
+        const scanCancellation = new AbortController();
         let closeTimer;
         let exitPipeTimer;
         let resourceTimer;
@@ -825,6 +1207,7 @@ function runStageCommand(repoRoot, argv, abortSignal, onRunning, resourceBounds,
             if (failure !== undefined)
                 return;
             failure = reason;
+            scanCancellation.abort();
             killOwned();
             if (!closed) {
                 closeTimer = setTimeout(() => {
@@ -881,10 +1264,26 @@ function runStageCommand(repoRoot, argv, abortSignal, onRunning, resourceBounds,
                         onResourceSample?.(result);
                         onRunning?.(outputBytes, result);
                     }
-                    if (!commandReleased) {
-                        commandReleased = true;
-                        child.stdin.end('run\n');
-                    }
+                    if (closed || pendingOutput !== undefined)
+                        return;
+                    pendingOutput = (async () => {
+                        if (resourceBounds !== undefined && baseline !== undefined) {
+                            const bytes = await positiveNewOutputBytes(baseline, scanCancellation.signal);
+                            if (failure !== undefined)
+                                return;
+                            const result = sampleOwnedTree(owned, repoRoot, resourceBounds, baseline, bytes);
+                            onResourceSample?.(result);
+                            onRunning?.(outputBytes, result);
+                        }
+                        if (failure === undefined && !commandReleased) {
+                            commandReleased = true;
+                            child.stdin.end('run\n');
+                        }
+                    })()
+                        .catch((error) => stop(error instanceof Error ? error.message : String(error)))
+                        .finally(() => {
+                        pendingOutput = undefined;
+                    });
                 }
                 catch (error) {
                     stop(error instanceof Error ? error.message : String(error));
@@ -908,11 +1307,11 @@ function runStageCommand(repoRoot, argv, abortSignal, onRunning, resourceBounds,
             closed = true;
             if (settled)
                 return;
-            clearWatchers();
+            await pendingOutput;
             if (failure === undefined && owned !== undefined) {
                 try {
                     if (resourceBounds !== undefined) {
-                        const sample = sampleOwnedTree(owned, repoRoot, resourceBounds, baseline);
+                        const sample = sampleOwnedTree(owned, repoRoot, resourceBounds, baseline, baseline === undefined ? undefined : await positiveNewOutputBytes(baseline, scanCancellation.signal));
                         onResourceSample?.(sample);
                         onRunning?.(outputBytes, sample);
                     }
@@ -955,18 +1354,20 @@ function runStageCommand(repoRoot, argv, abortSignal, onRunning, resourceBounds,
             resolve(Buffer.concat([...stdout, ...stderr], outputBytes));
         };
         child.once('close', (code, signal) => {
-            void handleClose(code, signal).catch((error) => {
+            void handleClose(code, signal)
+                .catch((error) => {
                 settled = true;
                 reject(error);
-            });
+            })
+                .finally(clearWatchers);
         });
     });
 }
 export async function verifyIssue(input) {
     const root = gitRoot(input.repoRoot);
-    return withVerificationWriter(root, (writer) => verifyIssueOwned(input, writer));
+    return withVerificationWriter(root, (writer) => withOutputObservationGate(root, input.resourceBounds?.outputRoots !== undefined, (gate) => verifyIssueOwned(input, writer, gate)));
 }
-async function verifyIssueOwned(input, writer) {
+async function verifyIssueOwned(input, writer, gate) {
     const assertNotCancelled = () => {
         if (input.signal?.aborted)
             throw new DeliveryError('Verification cancelled.');
@@ -996,7 +1397,7 @@ async function verifyIssueOwned(input, writer) {
     });
     const baseline = input.resourceBounds === undefined
         ? undefined
-        : outputBaseline(root, common, classification.receiptId, input.resourceBounds);
+        : await outputBaseline(root, common, classification.receiptId, input.resourceBounds, gate, input.signal);
     if (input.resourceBounds !== undefined)
         assertDiskHeadroom(root, input.resourceBounds, baseline);
     const receipts = [];
@@ -1149,6 +1550,9 @@ async function verifyIssueOwned(input, writer) {
                         sampledFreeDiskBytes: sample.freeDiskBytes,
                         ...(sample.newOutputBytes === undefined ? {} : { sampledNewOutputBytes: sample.newOutputBytes }),
                         ownedProcessCount: sample.ownedProcessCount,
+                        ...(baseline !== undefined && sample.newOutputBytes === undefined
+                            ? { reason: 'waiting for strict filesystem output scan' }
+                            : {}),
                     }),
             });
             progress(0);
@@ -1211,6 +1615,19 @@ async function verifyIssueOwned(input, writer) {
         });
     }
     assertNotCancelled();
+    if (baseline !== undefined && input.resourceBounds !== undefined) {
+        const bytes = await positiveNewOutputBytes(baseline, input.signal);
+        if (bytes > input.resourceBounds.maxNewOutputBytes)
+            throw new DeliveryError('Positive new filesystem output ' + bytes + ' exceeded limit ' + input.resourceBounds.maxNewOutputBytes + '.');
+        assertDiskHeadroom(root, input.resourceBounds, baseline);
+        recordResourceSample({
+            aggregateRssBytes: 0,
+            freeDiskBytes: freeDiskBytes(root, baseline),
+            newOutputBytes: bytes,
+            ownedProcessCount: 0,
+        });
+    }
+    assertNotCancelled();
     assertRepositoryClassificationCurrent({
         classification,
         configDigest: loaded.configDigest,
@@ -1299,41 +1716,48 @@ export async function withRuntimeSetupWriter(root, operation) {
                     if (roots[i] === roots[i - 1] || roots[i].startsWith(`${roots[i - 1]}${sep}`))
                         throw new DeliveryError('Filesystem output roots must not overlap.');
             }
-            const files = roots === undefined ? undefined : scanOutputRoots(roots);
-            const baseline = roots === undefined || files === undefined
-                ? undefined
-                : {
-                    roots,
-                    files,
-                    baselineId: digestValue([...files]),
-                };
-            assertDiskHeadroom(root, bounds, baseline);
-            const started = Date.now();
-            const output = await runStageCommand(root, argv, signal, (capturedOutputBytes, sample) => reportVerificationProgress({
-                state: 'running',
-                stageId: 'runtime-setup',
-                completedStages: 0,
-                reusedStages: 0,
-                remainingStages: 1,
-                elapsedMs: Date.now() - started,
-                capturedOutputBytes,
-                ...(sample === undefined
-                    ? {}
+            return withOutputObservationGate(root, roots !== undefined, async (gate) => {
+                const files = roots === undefined
+                    ? undefined
+                    : await withOutputGateLock(gate, 'scan', () => scanOutputRoots(roots), signal);
+                const baseline = roots === undefined || files === undefined
+                    ? undefined
                     : {
-                        sampledAggregateRssBytes: sample.aggregateRssBytes,
-                        sampledFreeDiskBytes: sample.freeDiskBytes,
-                        sampledNewOutputBytes: sample.newOutputBytes,
-                    }),
-            }), bounds, baseline, undefined, writer);
-            reportVerificationProgress({
-                state: 'completed',
-                stageId: 'runtime-setup',
-                completedStages: 1,
-                reusedStages: 0,
-                remainingStages: 0,
-                elapsedMs: Date.now() - started,
+                        roots,
+                        files,
+                        baselineId: digestValue([...files]),
+                        ...(gate === undefined ? {} : { gate }),
+                    };
+                assertDiskHeadroom(root, bounds, baseline);
+                const started = Date.now();
+                const output = await runStageCommand(root, argv, signal, (capturedOutputBytes, sample) => reportVerificationProgress({
+                    state: 'running',
+                    stageId: 'runtime-setup',
+                    completedStages: 0,
+                    reusedStages: 0,
+                    remainingStages: 1,
+                    elapsedMs: Date.now() - started,
+                    capturedOutputBytes,
+                    ...(sample === undefined
+                        ? {}
+                        : {
+                            sampledAggregateRssBytes: sample.aggregateRssBytes,
+                            sampledFreeDiskBytes: sample.freeDiskBytes,
+                            sampledNewOutputBytes: sample.newOutputBytes,
+                        }),
+                }), bounds, baseline, undefined, writer);
+                if (signal?.aborted)
+                    throw new DeliveryError('Runtime setup cancelled.');
+                reportVerificationProgress({
+                    state: 'completed',
+                    stageId: 'runtime-setup',
+                    completedStages: 1,
+                    reusedStages: 0,
+                    remainingStages: 0,
+                    elapsedMs: Date.now() - started,
+                });
+                return output;
             });
-            return output;
         },
     }));
 }