@code-yeongyu/senpi-agent-core 2026.10.27-1 → 2026.10.30-1

package/dist/durable/wake-host.js

@@ -0,0 +1,70 @@
+/**
+ * The WakeHost contract of the durable core (packages/agent/docs/durable-core-adr.md): wake ordering for hosts that can
+ * be evicted (a Durable Object) or put to sleep (a laptop). A process timer is lost with its host and runs late across
+ * a sleep, so the host keeps a durable alarm and follows one ordering, shared by every host here:
+ *
+ * - admit: arm a recovery heartbeat durably BEFORE work that can commit starts. A commit whose host dies before the
+ *   alarm update would otherwise strand its wake; an early alarm is harmless, a missing one loses work. The host counts
+ *   admissions in flight and arms as active while any is, so no concurrent update or fire can clear that heartbeat
+ *   before the admitted work commits; when the last admitted work succeeds, it arms from the loop's wake.
+ * - update: after each commit, arm min(heartbeat if active, the loop's earliest wake); clear only when idle.
+ * - fire: re-arm the heartbeat before resuming, so a resume that dies is retried; then arm from the loop's wake.
+ * - start (a new instance): arm a fallback before anything can throw, then resume what a lost instance left.
+ *
+ * Timers inside the loop are not the WakeHost's. Where a host can neither be evicted nor sleep it reduces to a timer.
+ */
+const DEFAULT_HEARTBEAT_MS = 60_000;
+/** The alarm time for a wake state: a heartbeat while active, never later than the earliest wake. */
+function recoveryAlarmAt(wake, now, heartbeatMs) {
+    const heartbeat = wake.active ? now + heartbeatMs : undefined;
+    if (heartbeat === undefined)
+        return wake.at;
+    return wake.at === undefined ? heartbeat : Math.min(heartbeat, wake.at);
+}
+export function createWakeHost(options) {
+    const { alarm, now, wake, resume } = options;
+    const heartbeatMs = options.heartbeatMs ?? DEFAULT_HEARTBEAT_MS;
+    const point = (op) => options.onWakePoint?.({ op, at: "armed" });
+    let admitted = 0;
+    const arm = async (state) => {
+        const at = recoveryAlarmAt(admitted > 0 ? { ...state, active: true } : state, now(), heartbeatMs);
+        if (at === undefined)
+            await alarm.clear();
+        else
+            await alarm.set(at);
+    };
+    return {
+        async start() {
+            const fallback = now() + heartbeatMs;
+            const current = await alarm.read();
+            if (current === undefined || current > fallback)
+                await alarm.set(fallback);
+            point("start");
+            await resume();
+            await arm(wake());
+        },
+        async admit(work) {
+            admitted++;
+            let result;
+            try {
+                await arm({ ...wake(), active: true });
+                point("admit");
+                result = await work();
+            }
+            finally {
+                admitted--;
+            }
+            if (admitted === 0)
+                await arm(wake());
+            return result;
+        },
+        update: (state) => arm(state),
+        async fire() {
+            await arm({ ...wake(), active: true });
+            point("fire");
+            await resume();
+            await arm(wake());
+        },
+    };
+}
+//# sourceMappingURL=wake-host.js.map

package/dist/harness/pico3/kinds/generation.js

@@ -1,4 +1,4 @@
-import { AssistantMessageFrameEncoder, isRetryableAssistantError } from "@earendil-works/pi-ai";
+import { AssistantMessageFrameEncoder, isRetryableAssistantError, sanitizeProviderErrorMessage, } from "@earendil-works/pi-ai";
 import { estimateContextTokens } from "@earendil-works/pi-ai/utils/estimate";
 import { planManagedEntry, prepareDraft, sameSnapshot, takeSnapshot } from "../system.js";
 import { toStored, } from "../types.js";
@@ -291,6 +291,8 @@ async function stream(cp, model, messages, rt, ctx) {
             errorMessage: String(error),
             timestamp: rt.now(),
         };
+        // A thrown provider error never passed the stream boundary: classify and redact it the same way (senpi#4282).
+        sanitizeProviderErrorMessage(terminal);
     }
     if (pending.length > 0)
         await flush();

package/dist/harness/utils/read-folders/index.d.ts

@@ -3,7 +3,7 @@ export * from "./types.ts";
 /** Frozen measured selection, not a runtime registry that can enable unmeasured grammars. */
 export declare const READ_FOLDER_SELECTION: Readonly<{
     readonly head: "6da8ef1361ef73928df8685e071f2a1826d3b17e";
-    readonly selectionSha256: "d7c502a1597e652f584877c0004ba6cde7c9393c8661ccbc388e3661ae66a634";
+    readonly selectionSha256: "dd4b1fa66ed151e330cd7efaf7ca649d244257d52e2a79422e868da60c0edd8b";
     readonly wasm: true;
     readonly rawReasons: Readonly<{
         readonly ts: "wasm_candidate_below_threshold";

package/dist/harness/utils/read-folders/index.js

@@ -4,7 +4,7 @@ export * from "./types.js";
 /** Frozen measured selection, not a runtime registry that can enable unmeasured grammars. */
 export const READ_FOLDER_SELECTION = Object.freeze({
     head: "6da8ef1361ef73928df8685e071f2a1826d3b17e",
-    selectionSha256: "d7c502a1597e652f584877c0004ba6cde7c9393c8661ccbc388e3661ae66a634",
+    selectionSha256: "dd4b1fa66ed151e330cd7efaf7ca649d244257d52e2a79422e868da60c0edd8b",
     wasm: true,
     rawReasons: Object.freeze({
         ts: "wasm_candidate_below_threshold",

package/dist/harness/utils/read-folders/tree-sitter/engine.d.ts

@@ -11,7 +11,7 @@ export type TreeSitterFolderOptions = {
     readonly parseBudgetMs?: number;
     readonly resolveGrammar?: GrammarResolver;
     readonly resolveRuntime?: () => Promise<string | undefined>;
-    /** Off for tests that inject resolvers; the shipped read path always shares one loaded grammar. */
+    /** Controls grammar/parser sharing; runtime initialization is always shared by resolved path. */
     readonly cache?: boolean;
 };
 /**

package/dist/harness/utils/read-folders/tree-sitter/engine.js

@@ -5,32 +5,47 @@ import { foldRangesFromSyntax } from "./syntax.js";
 export const TREE_SITTER_PARSE_BUDGET_MS = 250;
 export const TREE_SITTER_FOLDER_ID = "tree-sitter-wasm";
 export const TREE_SITTER_FOLDER_VERSION = "1";
-let runtime;
+const runtimes = new Map();
 const grammars = new Map();
-async function loadRuntime(resolveRuntime) {
-    try {
+// Parser.init and Language.load share process-global state, even across cache resets.
+let runtimeLoads = Promise.resolve();
+function loadRuntime(wasm) {
+    const existing = runtimes.get(wasm);
+    if (existing)
+        return existing;
+    const pending = runtimeLoads
+        .then(async () => {
         const module = await import("web-tree-sitter");
-        const wasm = await resolveRuntime();
         await module.Parser.init(wasm ? { locateFile: () => wasm } : undefined);
         return module;
-    }
-    catch {
+    })
+        .catch(() => {
+        if (runtimes.get(wasm) === pending)
+            runtimes.delete(wasm);
         return undefined;
-    }
+    });
+    runtimes.set(wasm, pending);
+    return pending;
 }
 async function loadParser(language, options) {
-    const resolveGrammar = options.resolveGrammar ?? resolveGrammarPath;
-    const resolveRuntime = options.resolveRuntime ?? resolveRuntimePath;
-    const grammar = await resolveGrammar(language);
-    if (!grammar)
+    try {
+        const grammar = await (options.resolveGrammar ?? resolveGrammarPath)(language);
+        // A missing grammar is a stable negative cache entry, not a failed load.
+        if (!grammar)
+            return null;
+        const wasm = await (options.resolveRuntime ?? resolveRuntimePath)();
+        const runtime = loadRuntime(wasm);
+        const pending = runtimeLoads.then(async () => {
+            const module = await runtime;
+            return module && instantiate(module, grammar, language);
+        });
+        // Reserve the whole init/grammar operation before another path can enqueue an init.
+        runtimeLoads = pending.then(() => undefined);
+        return pending;
+    }
+    catch {
         return undefined;
-    if (options.cache === false) {
-        const module = await loadRuntime(resolveRuntime);
-        return module && instantiate(module, grammar, language);
     }
-    runtime ??= loadRuntime(resolveRuntime);
-    const module = await runtime;
-    return module && instantiate(module, grammar, language);
 }
 async function instantiate(module, grammar, language) {
     try {
@@ -76,7 +91,11 @@ export async function loadTreeSitterFolder(language, options) {
         ? load()
         : (grammars.get(language) ??
             (() => {
-                const pending = load();
+                const pending = load().then((loaded) => {
+                    if (loaded === undefined && grammars.get(language) === pending)
+                        grammars.delete(language);
+                    return loaded;
+                });
                 grammars.set(language, pending);
                 return pending;
             })()));
@@ -91,7 +110,7 @@ export async function loadTreeSitterFolder(language, options) {
 }
 /** Test seam: drop the memoized runtime/grammars so a resolver change is observable. */
 export function resetTreeSitterGrammars() {
-    runtime = undefined;
+    runtimes.clear();
     grammars.clear();
 }
 //# sourceMappingURL=engine.js.map

package/dist/internal-events.d.ts

@@ -1,3 +1,4 @@
+/** Internal to senpi packages; not a public API; may change without notice. */
 import { type AssistantProgress } from "@earendil-works/pi-ai";
 import type { AgentEvent, AgentLoopConfig } from "./types.ts";
 export declare const internalProgressSink: unique symbol;

package/dist/internal-events.js

@@ -1,3 +1,4 @@
+/** Internal to senpi packages; not a public API; may change without notice. */
 import { subscribeAssistantCapture } from "@earendil-works/pi-ai";
 export const internalProgressSink = Symbol("internalProgressSink");
 const channels = new WeakMap();

package/dist/testing/win32-sim.d.ts

@@ -0,0 +1,76 @@
+/**
+ * Win32 simulation profile for code-level Windows tests on any host (test support only; no product code imports it).
+ *
+ * It simulates five Windows behaviors:
+ * - `\` paths with a drive letter (`C:\dir\file`), mapped onto a backing POSIX directory;
+ * - case-insensitive, case-preserving names;
+ * - named-pipe endpoints (`\\.\pipe\<name>`), which are not filesystem paths;
+ * - `EBUSY`/`EPERM` on rename or delete of a file that is open;
+ * - signal-less process termination: a supported signal terminates at once and no handler runs.
+ */
+import type { ChildProcess } from "node:child_process";
+import * as fsp from "node:fs/promises";
+type Win32ErrorCode = "EBUSY" | "EPERM" | "ENOSYS";
+export type Win32OpenFileErrorCode = "EBUSY" | "EPERM";
+/** The errno error shape Node throws on Windows, with `dest` for two-path calls such as rename. */
+export interface Win32ErrnoException extends NodeJS.ErrnoException {
+    dest?: string;
+}
+/** Builds the error Node throws on Windows for `code` from `syscall`. */
+export declare function win32Error(code: Win32ErrorCode, syscall: string, filePath?: string, dest?: string): Win32ErrnoException;
+/** Compares two Windows names (path segments, paths or pipe names) the way Windows does: case-insensitively. */
+export declare function win32NamesEqual(left: string, right: string): boolean;
+/** Turns a relative POSIX-style path (`dir/file`) into a drive-letter Windows path (`C:\dir\file`). */
+export declare function toWin32Path(relativePath: string, drive?: string): string;
+/** True for an absolute drive-letter path such as `C:\dir` (forward slashes are accepted, as on Windows). */
+export declare function isWin32DrivePath(candidate: string): boolean;
+export declare const WIN32_PIPE_PREFIX = "\\\\.\\pipe\\";
+/** Builds the named-pipe endpoint (`\\.\pipe\<name>`) a Windows transport listens on instead of a socket file. */
+export declare function win32PipeEndpoint(name: string): string;
+/** True when `endpoint` is a local named-pipe endpoint; the prefix is matched case-insensitively, as on Windows. */
+export declare function isWin32PipeEndpoint(endpoint: string): boolean;
+export interface Win32SimFsOptions {
+    /** Backing POSIX directory; drive `C:` maps to `<root>/C`. */
+    root: string;
+    /** Error for a rename whose source or destination is open. Default `EPERM`. */
+    renameOpenFileError?: Win32OpenFileErrorCode;
+    /** Error for an unlink or rm that would remove an open file. Default `EBUSY`. */
+    deleteOpenFileError?: Win32OpenFileErrorCode;
+}
+/** An open file in a {@link Win32SimFs}; the file counts as open until `close()`. */
+export interface Win32SimFileHandle {
+    readonly handle: fsp.FileHandle;
+    close(): Promise<void>;
+}
+/**
+ * A filesystem that behaves like Windows over a backing directory: it takes only drive-letter paths, resolves every
+ * segment case-insensitively while keeping the case a name was created with, and refuses to rename or delete an open
+ * file with Windows errors.
+ */
+export declare class Win32SimFs {
+    #private;
+    constructor(options: Win32SimFsOptions);
+    /** Maps a drive-letter path to its backing path, matching existing names case-insensitively. */
+    resolve(win32Path: string): Promise<string>;
+    mkdir(win32Path: string): Promise<void>;
+    writeFile(win32Path: string, data: string | Uint8Array): Promise<void>;
+    readFile(win32Path: string): Promise<Buffer>;
+    /** Names in a directory, in the case each was created with. */
+    readdir(win32Path: string): Promise<string[]>;
+    exists(win32Path: string): Promise<boolean>;
+    /** Opens a file; until `close()` it cannot be renamed or deleted. */
+    open(win32Path: string, flags?: string): Promise<Win32SimFileHandle>;
+    /** Renames or replaces a file; a rename that only changes a name's case keeps one entry with the new case. */
+    rename(from: string, to: string): Promise<void>;
+    unlink(win32Path: string): Promise<void>;
+    /** Like `fs.rm` with `recursive`; fails with the delete error while any file at or under the path is open. */
+    rm(win32Path: string): Promise<void>;
+}
+/**
+ * Sends `signal` with Windows semantics. Signal `0` only probes liveness. A supported signal terminates the process
+ * immediately, so no signal handler runs (the POSIX child is sent `SIGKILL` and reports it). Any other signal throws
+ * `ENOSYS` and leaves the process running.
+ */
+export declare function win32Kill(target: ChildProcess | number, signal?: NodeJS.Signals | 0): boolean;
+export {};
+//# sourceMappingURL=win32-sim.d.ts.map

package/dist/testing/win32-sim.js

@@ -0,0 +1,197 @@
+import * as fsp from "node:fs/promises";
+import * as path from "node:path";
+/** Node's Windows errno values (libuv `UV_E*` on win32). */
+const WIN32_ERRNO = { EBUSY: -4082, EPERM: -4048, ENOSYS: -4054 };
+const WIN32_ERROR_DESCRIPTION = {
+    EBUSY: "resource busy or locked",
+    EPERM: "operation not permitted",
+    ENOSYS: "function not implemented",
+};
+/** Builds the error Node throws on Windows for `code` from `syscall`. */
+export function win32Error(code, syscall, filePath, dest) {
+    let target = "";
+    if (filePath !== undefined)
+        target = dest === undefined ? ` '${filePath}'` : ` '${filePath}' -> '${dest}'`;
+    const error = new Error(`${code}: ${WIN32_ERROR_DESCRIPTION[code]}, ${syscall}${target}`);
+    error.code = code;
+    error.errno = WIN32_ERRNO[code];
+    error.syscall = syscall;
+    if (filePath !== undefined)
+        error.path = filePath;
+    if (dest !== undefined)
+        error.dest = dest;
+    return error;
+}
+/** Compares two Windows names (path segments, paths or pipe names) the way Windows does: case-insensitively. */
+export function win32NamesEqual(left, right) {
+    return left.toUpperCase() === right.toUpperCase();
+}
+const DRIVE_LETTER = /^[A-Za-z]$/;
+const DRIVE_PATH = /^([A-Za-z]):\\(.*)$/s;
+/** Turns a relative POSIX-style path (`dir/file`) into a drive-letter Windows path (`C:\dir\file`). */
+export function toWin32Path(relativePath, drive = "C") {
+    if (!DRIVE_LETTER.test(drive))
+        throw new RangeError(`win32 sim: drive must be one letter, got ${JSON.stringify(drive)}`);
+    if (relativePath.startsWith("/")) {
+        throw new RangeError(`win32 sim: expected a relative path, got ${JSON.stringify(relativePath)}`);
+    }
+    return path.win32.join(`${drive.toUpperCase()}:\\`, ...relativePath.split("/"));
+}
+/** True for an absolute drive-letter path such as `C:\dir` (forward slashes are accepted, as on Windows). */
+export function isWin32DrivePath(candidate) {
+    return DRIVE_PATH.test(path.win32.normalize(candidate));
+}
+export const WIN32_PIPE_PREFIX = "\\\\.\\pipe\\";
+/** Windows limits a full pipe name to 256 characters. */
+const WIN32_PIPE_MAX_LENGTH = 256;
+/** Builds the named-pipe endpoint (`\\.\pipe\<name>`) a Windows transport listens on instead of a socket file. */
+export function win32PipeEndpoint(name) {
+    if (name.length === 0 || name.includes("\\")) {
+        throw new RangeError(`win32 sim: a pipe name must be non-empty and contain no backslash, got ${JSON.stringify(name)}`);
+    }
+    const endpoint = `${WIN32_PIPE_PREFIX}${name}`;
+    if (endpoint.length > WIN32_PIPE_MAX_LENGTH) {
+        throw new RangeError(`win32 sim: a pipe endpoint is at most ${WIN32_PIPE_MAX_LENGTH} characters`);
+    }
+    return endpoint;
+}
+/** True when `endpoint` is a local named-pipe endpoint; the prefix is matched case-insensitively, as on Windows. */
+export function isWin32PipeEndpoint(endpoint) {
+    const name = endpoint.slice(WIN32_PIPE_PREFIX.length);
+    return (win32NamesEqual(endpoint.slice(0, WIN32_PIPE_PREFIX.length), WIN32_PIPE_PREFIX) &&
+        name.length > 0 &&
+        !name.includes("\\"));
+}
+function hasErrorCode(error, code) {
+    return error instanceof Error && "code" in error && error.code === code;
+}
+/**
+ * A filesystem that behaves like Windows over a backing directory: it takes only drive-letter paths, resolves every
+ * segment case-insensitively while keeping the case a name was created with, and refuses to rename or delete an open
+ * file with Windows errors.
+ */
+export class Win32SimFs {
+    #root;
+    #renameOpenFileError;
+    #deleteOpenFileError;
+    #openCounts = new Map();
+    constructor(options) {
+        this.#root = options.root;
+        this.#renameOpenFileError = options.renameOpenFileError ?? "EPERM";
+        this.#deleteOpenFileError = options.deleteOpenFileError ?? "EBUSY";
+    }
+    /** Maps a drive-letter path to its backing path, matching existing names case-insensitively. */
+    async resolve(win32Path) {
+        const match = DRIVE_PATH.exec(path.win32.normalize(win32Path));
+        if (match === null) {
+            throw new TypeError(`win32 sim: expected a drive-letter path such as C:\\dir\\file, got ${JSON.stringify(win32Path)}`);
+        }
+        const [, drive = "", rest = ""] = match;
+        const segments = rest.split("\\").filter((segment) => segment.length > 0);
+        let current = path.join(this.#root, drive.toUpperCase());
+        for (const [index, segment] of segments.entries()) {
+            let entries;
+            try {
+                entries = await fsp.readdir(current);
+            }
+            catch (error) {
+                if (hasErrorCode(error, "ENOENT") || hasErrorCode(error, "ENOTDIR")) {
+                    return path.join(current, ...segments.slice(index));
+                }
+                throw error;
+            }
+            current = path.join(current, entries.find((entry) => win32NamesEqual(entry, segment)) ?? segment);
+        }
+        return current;
+    }
+    async mkdir(win32Path) {
+        await fsp.mkdir(await this.resolve(win32Path), { recursive: true });
+    }
+    async writeFile(win32Path, data) {
+        await fsp.writeFile(await this.resolve(win32Path), data);
+    }
+    async readFile(win32Path) {
+        return fsp.readFile(await this.resolve(win32Path));
+    }
+    /** Names in a directory, in the case each was created with. */
+    async readdir(win32Path) {
+        return (await fsp.readdir(await this.resolve(win32Path))).sort();
+    }
+    async exists(win32Path) {
+        try {
+            await fsp.stat(await this.resolve(win32Path));
+            return true;
+        }
+        catch (error) {
+            if (hasErrorCode(error, "ENOENT"))
+                return false;
+            throw error;
+        }
+    }
+    /** Opens a file; until `close()` it cannot be renamed or deleted. */
+    async open(win32Path, flags = "r") {
+        const backing = await this.resolve(win32Path);
+        const handle = await fsp.open(backing, flags);
+        this.#openCounts.set(backing, (this.#openCounts.get(backing) ?? 0) + 1);
+        let closed = false;
+        return {
+            handle,
+            close: async () => {
+                if (closed)
+                    return;
+                closed = true;
+                const remaining = (this.#openCounts.get(backing) ?? 1) - 1;
+                if (remaining === 0)
+                    this.#openCounts.delete(backing);
+                else
+                    this.#openCounts.set(backing, remaining);
+                await handle.close();
+            },
+        };
+    }
+    /** Renames or replaces a file; a rename that only changes a name's case keeps one entry with the new case. */
+    async rename(from, to) {
+        const source = await this.resolve(from);
+        let target = await this.resolve(to);
+        if (this.#isOpen(source) || this.#isOpen(target))
+            throw win32Error(this.#renameOpenFileError, "rename", from, to);
+        if (target === source)
+            target = path.join(path.dirname(source), path.win32.basename(path.win32.normalize(to)));
+        await fsp.rename(source, target);
+    }
+    async unlink(win32Path) {
+        const backing = await this.resolve(win32Path);
+        if (this.#isOpen(backing))
+            throw win32Error(this.#deleteOpenFileError, "unlink", win32Path);
+        await fsp.unlink(backing);
+    }
+    /** Like `fs.rm` with `recursive`; fails with the delete error while any file at or under the path is open. */
+    async rm(win32Path) {
+        const backing = await this.resolve(win32Path);
+        const inside = `${backing}${path.sep}`;
+        for (const open of this.#openCounts.keys()) {
+            if (open === backing || open.startsWith(inside))
+                throw win32Error(this.#deleteOpenFileError, "rm", win32Path);
+        }
+        await fsp.rm(backing, { recursive: true });
+    }
+    #isOpen(backing) {
+        return this.#openCounts.has(backing);
+    }
+}
+/** The signals Node accepts on Windows; every one of them terminates the process outright. */
+const WIN32_KILL_SIGNALS = new Set(["SIGKILL", "SIGTERM", "SIGINT", "SIGQUIT"]);
+/**
+ * Sends `signal` with Windows semantics. Signal `0` only probes liveness. A supported signal terminates the process
+ * immediately, so no signal handler runs (the POSIX child is sent `SIGKILL` and reports it). Any other signal throws
+ * `ENOSYS` and leaves the process running.
+ */
+export function win32Kill(target, signal = "SIGTERM") {
+    if (signal !== 0 && !WIN32_KILL_SIGNALS.has(signal))
+        throw win32Error("ENOSYS", "kill");
+    const posixSignal = signal === 0 ? 0 : "SIGKILL";
+    if (typeof target === "number")
+        return process.kill(target, posixSignal);
+    return target.kill(posixSignal);
+}
+//# sourceMappingURL=win32-sim.js.map

package/dist/transport/in-process-carrier.d.ts

@@ -0,0 +1,19 @@
+import { type LocalEndpoint } from "./local-endpoint.ts";
+import type { CarrierSide } from "./transport.ts";
+/** One dialed link between two carrier sides; it can drop and re-attach. */
+export interface CarrierLink {
+    connect(): void;
+    drop(): void;
+    readonly connected: boolean;
+}
+export interface InProcessNetworkOptions {
+    /** Runs one message hand-off later; default `queueMicrotask`. Tests pass manual timers. */
+    readonly schedule?: (deliver: () => void) => void;
+}
+/** In-process carriers addressed by local endpoints, so fused and local runs need no socket. */
+export interface InProcessNetwork {
+    listen(endpoint: LocalEndpoint, side: CarrierSide): () => void;
+    dial(endpoint: LocalEndpoint, side: CarrierSide): CarrierLink;
+}
+export declare function createInProcessNetwork(options?: InProcessNetworkOptions): InProcessNetwork;
+//# sourceMappingURL=in-process-carrier.d.ts.map

package/dist/transport/in-process-carrier.js

@@ -0,0 +1,63 @@
+import { endpointKey } from "./local-endpoint.js";
+function createLink(a, b, schedule) {
+    let generation = 0;
+    let up = false;
+    const drop = () => {
+        if (!up)
+            return;
+        up = false;
+        generation += 1;
+        a.detached();
+        b.detached();
+    };
+    const half = (to, at) => ({
+        send: (message) => {
+            schedule(() => {
+                if (up && generation === at)
+                    to.message(message);
+            });
+            return true;
+        },
+        close: () => {
+            if (generation === at)
+                drop();
+        },
+    });
+    return {
+        connect() {
+            if (up)
+                return;
+            up = true;
+            generation += 1;
+            a.attached(half(b, generation));
+            b.attached(half(a, generation));
+        },
+        drop,
+        get connected() {
+            return up;
+        },
+    };
+}
+export function createInProcessNetwork(options = {}) {
+    const schedule = options.schedule ?? queueMicrotask;
+    const listeners = new Map();
+    return {
+        listen(endpoint, side) {
+            const key = endpointKey(endpoint);
+            if (listeners.has(key))
+                throw new Error(`in-process carrier: ${endpoint.address} already has a listener`);
+            listeners.set(key, { side, dialed: false });
+            return () => void listeners.delete(key);
+        },
+        dial(endpoint, side) {
+            const listener = listeners.get(endpointKey(endpoint));
+            if (listener === undefined)
+                throw new Error(`in-process carrier: no listener at ${endpoint.address}`);
+            if (listener.dialed)
+                throw new Error(`in-process carrier: ${endpoint.address} is already dialed`);
+            listener.dialed = true;
+            return createLink(side, listener.side, schedule);
+        },
+    };
+}
+//# sourceMappingURL=in-process-carrier.js.map

package/dist/transport/local-endpoint.d.ts

@@ -0,0 +1,13 @@
+/** Where a local transport listens: an owner-only Unix socket on POSIX, a named pipe (no file, no mode) on Windows. */
+export type LocalEndpoint = {
+    readonly kind: "unix-socket";
+    readonly address: string;
+    readonly mode: number;
+} | {
+    readonly kind: "named-pipe";
+    readonly address: string;
+};
+export declare function localEndpoint(platform: string, name: string, socketDir: string): LocalEndpoint;
+/** The identity of an endpoint: Windows pipe names compare case-insensitively, socket paths exactly. */
+export declare function endpointKey(endpoint: LocalEndpoint): string;
+//# sourceMappingURL=local-endpoint.d.ts.map

package/dist/transport/local-endpoint.js

@@ -0,0 +1,20 @@
+const PIPE_PREFIX = "\\\\.\\pipe\\";
+const PIPE_MAX_LENGTH = 256;
+const OWNER_ONLY = 0o600;
+export function localEndpoint(platform, name, socketDir) {
+    if (name.length === 0 || /[\\/]/.test(name)) {
+        throw new RangeError(`local endpoint: a name must be non-empty with no path separator, got ${JSON.stringify(name)}`);
+    }
+    if (platform === "win32") {
+        const address = `${PIPE_PREFIX}${name}`;
+        if (address.length > PIPE_MAX_LENGTH)
+            throw new RangeError(`local endpoint: a pipe name is at most ${PIPE_MAX_LENGTH} characters`);
+        return { kind: "named-pipe", address };
+    }
+    return { kind: "unix-socket", address: `${socketDir.replace(/\/+$/, "")}/${name}.sock`, mode: OWNER_ONLY };
+}
+/** The identity of an endpoint: Windows pipe names compare case-insensitively, socket paths exactly. */
+export function endpointKey(endpoint) {
+    return endpoint.kind === "named-pipe" ? endpoint.address.toUpperCase() : endpoint.address;
+}
+//# sourceMappingURL=local-endpoint.js.map

package/dist/transport/reliable-transport.d.ts

@@ -0,0 +1,40 @@
+import { type TransportClock, type TransportFrame, type TransportSide } from "./transport.ts";
+/** The reference transport's wire messages: per-lane sequence numbers from 1, and cumulative ACKs of delivered frames. */
+export type ReferencePacket = {
+    readonly kind: "data";
+    readonly lane: string;
+    readonly seq: number;
+    readonly payload: Uint8Array;
+} | {
+    readonly kind: "ack";
+    readonly lane: string;
+    readonly seq: number;
+};
+export interface ReliableTransportOptions {
+    readonly clock: TransportClock;
+    /** Frames per lane that may be sent and unacknowledged at once. Default 32. */
+    readonly window?: number;
+    /**
+     * Without ACK progress on a lane for this long, that lane's unacknowledged frames are sent again from its last ACK.
+     * Each lane keeps its own deadline, so progress on one lane never postpones another's retransmit. Default 1000.
+     */
+    readonly retransmitMs?: number;
+    /** A receiver that throws: the frame still counts as delivered (it is never delivered twice). */
+    readonly onHandlerError: (error: unknown, frame: TransportFrame) => void;
+}
+/** The decoder a conformance host uses to watch the reference transport's wire. */
+export declare function decodeReferencePacket(message: unknown): {
+    readonly kind: "data" | "ack";
+    readonly lane: string;
+    readonly seq: number;
+} | {
+    readonly kind: "other";
+};
+/**
+ * The reference transport: per-lane send windows (backpressure), round-robin transmission across lanes (fairness),
+ * cumulative ACKs sent only after the receiver's handler settles, and go-back-N from each lane's last ACK on re-attach or
+ * on that lane's own retransmit timeout. A receiver drops anything that is not the next frame of its lane, so it delivers each frame
+ * once and in order over any carrier that may drop, lose, delay or reorder messages.
+ */
+export declare function createReliableTransport(options: ReliableTransportOptions): TransportSide;
+//# sourceMappingURL=reliable-transport.d.ts.map