@codyswann/lisa 4.28.4 → 4.29.0

package/dist/configs/vitest/scratch-bound-cleanup.js

@@ -0,0 +1,155 @@
+/** Kernel-bound deletion programs for scratch roots and their direct children. */
+import { spawnSync } from "node:child_process";
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { scratchPathIdentity, } from "./scratch-owner.js";
+import { BOUND_CHILDREN_CLEANUP_PROGRAM } from "./scratch-bound-cleanup-programs.js";
+export { BOUND_DIRECTORY_CLEANUP_PROGRAM } from "./scratch-bound-cleanup-programs.js";
+/** Exit status used when the child cwd does not match the expected inode. */
+const BOUND_CLEANUP_IDENTITY_EXIT = 73;
+/**
+ * Demand one inert direct basename, never a path.
+ * @param basename - Candidate direct-child name
+ */
+function validateBasename(basename) {
+    if (basename === "" ||
+        basename === "." ||
+        basename === ".." ||
+        path.basename(basename) !== basename ||
+        basename.includes("/") ||
+        basename.includes("\\")) {
+        throw new Error(`Scratch candidate must be a direct basename: ${basename}`);
+    }
+    if (Buffer.byteLength(basename, "utf8") > 1_024) {
+        throw new Error("Scratch candidate basename exceeds 1024 bytes");
+    }
+}
+/**
+ * Read one candidate without converting absence into an exception.
+ * @param candidate - Candidate path
+ * @returns Candidate metadata, or undefined when already absent
+ */
+function lstatIfPresent(candidate) {
+    try {
+        return fs.lstatSync(candidate);
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return undefined;
+        throw error;
+    }
+}
+/**
+ * Assert that an already-owned parent still has its pinned identity.
+ * @param expected - Pinned parent identity
+ */
+function assertScratchPathIdentity(expected) {
+    const current = scratchPathIdentity(expected.canonicalPath);
+    if (current.canonicalPath !== expected.canonicalPath ||
+        current.dev !== expected.dev ||
+        current.ino !== expected.ino) {
+        throw new Error("Scratch parent identity changed before child cleanup");
+    }
+}
+/**
+ * Inspect a direct child after its pinned parent passes revalidation.
+ * @param parent - Pinned parent identity
+ * @param basename - Direct-child name
+ * @param child - Candidate path
+ * @returns Candidate metadata, or undefined when already absent
+ */
+function inspectAuthorizedScratchChild(parent, basename, child) {
+    validateBasename(basename);
+    assertScratchPathIdentity(parent);
+    return lstatIfPresent(child);
+}
+/**
+ * Capture every present candidate while the parent remains pinned.
+ * @param options - Batched child-removal options
+ * @returns Bound cleanup descriptions for present children
+ */
+function collectAuthorizedChildren(options) {
+    assertScratchPathIdentity(options.parent);
+    return options.basenames.flatMap(basename => {
+        const child = path.join(options.parent.canonicalPath, basename);
+        options.beforeIdentityCheck?.(child);
+        const stat = inspectAuthorizedScratchChild(options.parent, basename, child);
+        if (stat === undefined)
+            return [];
+        options.afterIdentityCheck?.(child);
+        return [
+            {
+                basename,
+                dev: String(stat.dev),
+                ino: String(stat.ino),
+                directory: stat.isDirectory(),
+                symlink: stat.isSymbolicLink(),
+            },
+        ];
+    });
+}
+/**
+ * Execute the inode-bound child-cleanup worker.
+ * @param options - Batched child-removal options
+ * @param input - Validated serialized child descriptions
+ * @returns Worker result
+ */
+function executeBoundChildrenCleanup(options, input) {
+    options.beforeBoundCleanup?.();
+    return spawnSync(process.execPath, [
+        "--input-type=commonjs",
+        "--eval",
+        BOUND_CHILDREN_CLEANUP_PROGRAM,
+        String(options.parent.dev),
+        String(options.parent.ino),
+    ], {
+        cwd: options.parent.canonicalPath,
+        encoding: "utf8",
+        input,
+        maxBuffer: 64 * 1024,
+    });
+}
+/**
+ * Remove direct children through one process bound to the parent inode.
+ * @param options - Batched child-removal options
+ */
+export function removeAuthorizedScratchChildren(options) {
+    if (new Set(options.basenames).size !== options.basenames.length) {
+        throw new Error("Scratch child cleanup refuses duplicate basenames");
+    }
+    const items = collectAuthorizedChildren(options);
+    if (items.length === 0)
+        return;
+    const input = JSON.stringify(items);
+    if (Buffer.byteLength(input, "utf8") > 32 * 1024 * 1024) {
+        throw new Error("Scratch child cleanup batch exceeds 33554432 bytes");
+    }
+    const result = executeBoundChildrenCleanup(options, input);
+    if (result.error !== undefined)
+        throw result.error;
+    if (result.status === BOUND_CLEANUP_IDENTITY_EXIT) {
+        throw new Error(result.stderr.trim() ||
+            "Scratch child identity changed before bound cleanup");
+    }
+    if (result.status !== 0 || result.signal !== null) {
+        throw new Error(`Scratch bound cleanup failed: ${result.stderr.trim() || result.signal || String(result.status)}`);
+    }
+    assertScratchPathIdentity(options.parent);
+}
+/**
+ * Remove one direct child through the batched authority.
+ * @param options - Single child-removal options
+ */
+export function removeAuthorizedScratchChild(options) {
+    removeAuthorizedScratchChildren({
+        parent: options.parent,
+        basenames: [options.basename],
+        ...(options.beforeIdentityCheck === undefined
+            ? {}
+            : { beforeIdentityCheck: options.beforeIdentityCheck }),
+        ...(options.afterIdentityCheck === undefined
+            ? {}
+            : { afterIdentityCheck: options.afterIdentityCheck }),
+    });
+}
+//# sourceMappingURL=scratch-bound-cleanup.js.map

package/dist/configs/vitest/scratch-bound-cleanup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scratch-bound-cleanup.js","sourceRoot":"","sources":["../../../src/configs/vitest/scratch-bound-cleanup.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAClF,OAAO,EAAE,SAAS,EAAyB,MAAM,oBAAoB,CAAC;AACtE,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EACL,mBAAmB,GAEpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,8BAA8B,EAAE,MAAM,qCAAqC,CAAC;AAErF,OAAO,EAAE,+BAA+B,EAAE,MAAM,qCAAqC,CAAC;AAmBtF,6EAA6E;AAC7E,MAAM,2BAA2B,GAAG,EAAE,CAAC;AAEvC;;;GAGG;AACH,SAAS,gBAAgB,CAAC,QAAgB;IACxC,IACE,QAAQ,KAAK,EAAE;QACf,QAAQ,KAAK,GAAG;QAChB,QAAQ,KAAK,IAAI;QACjB,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,QAAQ;QACpC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;QACtB,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EACvB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,gDAAgD,QAAQ,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,KAAK,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,SAAiB;IACvC,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACzE,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,yBAAyB,CAAC,QAA6B;IAC9D,MAAM,OAAO,GAAG,mBAAmB,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;IAC5D,IACE,OAAO,CAAC,aAAa,KAAK,QAAQ,CAAC,aAAa;QAChD,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,GAAG;QAC5B,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,GAAG,EAC5B,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,6BAA6B,CACpC,MAA2B,EAC3B,QAAgB,EAChB,KAAa;IAEb,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC3B,yBAAyB,CAAC,MAAM,CAAC,CAAC;IAClC,OAAO,cAAc,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED;;;;GAIG;AACH,SAAS,yBAAyB,CAChC,OAA+C;IAE/C,yBAAyB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1C,OAAO,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE;QAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;QAChE,OAAO,CAAC,mBAAmB,EAAE,CAAC,KAAK,CAAC,CAAC;QACrC,MAAM,IAAI,GAAG,6BAA6B,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC5E,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,EAAE,CAAC;QAClC,OAAO,CAAC,kBAAkB,EAAE,CAAC,KAAK,CAAC,CAAC;QACpC,OAAO;YACL;gBACE,QAAQ;gBACR,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;gBACrB,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;gBACrB,SAAS,EAAE,IAAI,CAAC,WAAW,EAAE;gBAC7B,OAAO,EAAE,IAAI,CAAC,cAAc,EAAE;aAC/B;SACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,SAAS,2BAA2B,CAClC,OAA+C,EAC/C,KAAa;IAEb,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC;IAC/B,OAAO,SAAS,CACd,OAAO,CAAC,QAAQ,EAChB;QACE,uBAAuB;QACvB,QAAQ;QACR,8BAA8B;QAC9B,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC;QAC1B,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC;KAC3B,EACD;QACE,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,aAAa;QACjC,QAAQ,EAAE,MAAM;QAChB,KAAK;QACL,SAAS,EAAE,EAAE,GAAG,IAAI;KACrB,CACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,+BAA+B,CAC7C,OAA+C;IAE/C,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,KAAK,GAAG,yBAAyB,CAAC,OAAO,CAAC,CAAC;IACjD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,MAAM,GAAG,2BAA2B,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC3D,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS;QAAE,MAAM,MAAM,CAAC,KAAK,CAAC;IACnD,IAAI,MAAM,CAAC,MAAM,KAAK,2BAA2B,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CACb,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE;YAClB,qDAAqD,CACxD,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CACb,iCAAiC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAClG,CAAC;IACJ,CAAC;IACD,yBAAyB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;AAC5C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,4BAA4B,CAC1C,OAA4C;IAE5C,+BAA+B,CAAC;QAC9B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,SAAS,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC7B,GAAG,CAAC,OAAO,CAAC,mBAAmB,KAAK,SAAS;YAC3C,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,mBAAmB,EAAE,OAAO,CAAC,mBAAmB,EAAE,CAAC;QACzD,GAAG,CAAC,OAAO,CAAC,kBAAkB,KAAK,SAAS;YAC1C,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,kBAAkB,EAAE,OAAO,CAAC,kBAAkB,EAAE,CAAC;KACxD,CAAC,CAAC;AACL,CAAC"}

package/dist/configs/vitest/scratch-bound-root-cleanup.d.ts

@@ -0,0 +1,17 @@
+import { type ScratchNamespaceAuthority } from "./scratch-namespace-authority.js";
+import { type ScratchPathIdentity } from "./scratch-owner.js";
+/** Options for an authorised root removal. */
+export interface RemoveAuthorizedScratchRootOptions {
+    readonly authority: ScratchNamespaceAuthority;
+    readonly basename: string;
+    readonly expectedToken?: string;
+    readonly expectedIdentity?: ScratchPathIdentity;
+    readonly afterIdentityCheck?: (candidate: string) => void;
+}
+/**
+ * Quarantine and delete one direct owned root.
+ * @param options - Authorized root-removal options
+ * @returns Whether an existing root was removed
+ */
+export declare function removeAuthorizedScratchRoot(options: RemoveAuthorizedScratchRootOptions): boolean;
+//# sourceMappingURL=scratch-bound-root-cleanup.d.ts.map

package/dist/configs/vitest/scratch-bound-root-cleanup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scratch-bound-root-cleanup.d.ts","sourceRoot":"","sources":["../../../src/configs/vitest/scratch-bound-root-cleanup.ts"],"names":[],"mappings":"AAMA,OAAO,EAGL,KAAK,yBAAyB,EAC/B,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EAEL,KAAK,mBAAmB,EACzB,MAAM,oBAAoB,CAAC;AAE5B,8CAA8C;AAC9C,MAAM,WAAW,kCAAkC;IACjD,QAAQ,CAAC,SAAS,EAAE,yBAAyB,CAAC;IAC9C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,mBAAmB,CAAC;IAChD,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC;CAC3D;AAsJD;;;;GAIG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,kCAAkC,GAC1C,OAAO,CA8BT"}

package/dist/configs/vitest/scratch-bound-root-cleanup.js

@@ -0,0 +1,149 @@
+/** Kernel-bound removal of one token-authorized scratch run root. */
+import { randomBytes } from "node:crypto";
+import { spawnSync } from "node:child_process";
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { SCRATCH_QUARANTINE_PREFIX, assertScratchNamespaceAuthority, } from "./scratch-namespace-authority.js";
+import { BOUND_DIRECTORY_CLEANUP_PROGRAM } from "./scratch-bound-cleanup-programs.js";
+import { readScratchOwnerRecord, } from "./scratch-owner.js";
+/** Exit status used when a child cwd does not match its expected inode. */
+const BOUND_CLEANUP_IDENTITY_EXIT = 73;
+/**
+ * Demand one inert direct basename, never a path.
+ * @param basename - Candidate direct-child name
+ */
+function validateBasename(basename) {
+    if (basename === "" ||
+        basename === "." ||
+        basename === ".." ||
+        path.basename(basename) !== basename ||
+        basename.includes("/") ||
+        basename.includes("\\")) {
+        throw new Error(`Scratch candidate must be a direct basename: ${basename}`);
+    }
+}
+/**
+ * Read one candidate without converting absence into an exception.
+ * @param candidate - Candidate path
+ * @returns Candidate metadata, or undefined when already absent
+ */
+function lstatIfPresent(candidate) {
+    try {
+        return fs.lstatSync(candidate);
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return undefined;
+        throw error;
+    }
+}
+/**
+ * Clear a directory through a cwd bound to the inspected inode.
+ * @param candidate - Directory path
+ * @param expected - Pinned directory identity
+ */
+function clearDirectoryThroughBoundCwd(candidate, expected) {
+    const result = spawnSync(process.execPath, [
+        "--input-type=commonjs",
+        "--eval",
+        BOUND_DIRECTORY_CLEANUP_PROGRAM,
+        String(expected.dev),
+        String(expected.ino),
+    ], { cwd: candidate, encoding: "utf8", maxBuffer: 64 * 1024 });
+    if (result.error !== undefined)
+        throw result.error;
+    if (result.status === BOUND_CLEANUP_IDENTITY_EXIT) {
+        throw new Error("Scratch directory identity changed before bound cleanup");
+    }
+    if (result.status !== 0 || result.signal !== null) {
+        throw new Error(`Scratch bound cleanup failed: ${result.stderr.trim() || result.signal || String(result.status)}`);
+    }
+}
+/**
+ * Bind an optional armed inode identity to the inspected candidate.
+ * @param options - Authorized root-removal options
+ * @param stat - Candidate metadata when present
+ * @returns Validated metadata, or undefined when already absent
+ */
+function validateExpectedRootIdentity(options, stat) {
+    if (stat !== undefined &&
+        options.expectedIdentity !== undefined &&
+        (stat.dev !== options.expectedIdentity.dev ||
+            stat.ino !== options.expectedIdentity.ino)) {
+        throw new Error("Scratch root identity does not match armed intent");
+    }
+    return stat;
+}
+/**
+ * Validate authority before reading a destructive candidate.
+ * @param options - Authorized root-removal options
+ * @param candidate - Candidate path
+ * @returns Candidate metadata, or undefined when already absent
+ */
+function inspectAuthorizedCandidate(options, candidate) {
+    validateBasename(options.basename);
+    assertScratchNamespaceAuthority(options.authority);
+    return validateExpectedRootIdentity(options, lstatIfPresent(candidate));
+}
+/**
+ * Revalidate an expected marker token at a specific path.
+ * @param candidate - Candidate path
+ * @param expectedToken - Token authorized by the caller
+ * @param phase - Whether validation occurs before or after quarantine
+ */
+function assertOwnerToken(candidate, expectedToken, phase) {
+    if (expectedToken === undefined)
+        return;
+    const owner = readScratchOwnerRecord(candidate);
+    if (owner.token !== expectedToken) {
+        throw new Error(`Scratch owner token changed ${phase} quarantine`);
+    }
+}
+/**
+ * Revalidate and unlink the renamed candidate.
+ * @param quarantine - Quarantined path
+ * @param before - Pinned pre-rename metadata
+ * @param expectedToken - Token authorized by the caller
+ * @param afterIdentityCheck - Optional adversarial test hook
+ * @returns True after successful removal
+ */
+function removeVerifiedQuarantine(quarantine, before, expectedToken, afterIdentityCheck) {
+    const after = fs.lstatSync(quarantine);
+    if (after.isSymbolicLink() ||
+        after.dev !== before.dev ||
+        after.ino !== before.ino) {
+        throw new Error("Scratch root identity changed during quarantine");
+    }
+    afterIdentityCheck?.(quarantine);
+    assertOwnerToken(quarantine, expectedToken, "after");
+    clearDirectoryThroughBoundCwd(quarantine, after);
+    fs.rmdirSync(quarantine);
+    return true;
+}
+/**
+ * Quarantine and delete one direct owned root.
+ * @param options - Authorized root-removal options
+ * @returns Whether an existing root was removed
+ */
+export function removeAuthorizedScratchRoot(options) {
+    const candidate = path.join(options.authority.namespace.canonicalPath, options.basename);
+    const quarantineName = `${SCRATCH_QUARANTINE_PREFIX}${randomBytes(16).toString("hex")}`;
+    const quarantine = path.join(options.authority.namespace.canonicalPath, quarantineName);
+    const before = inspectAuthorizedCandidate(options, candidate);
+    if (before === undefined)
+        return false;
+    if (before.isSymbolicLink() || !before.isDirectory()) {
+        throw new Error(`Scratch root authority refuses non-directory or symlink: ${candidate}`);
+    }
+    assertOwnerToken(candidate, options.expectedToken, "before");
+    try {
+        fs.renameSync(candidate, quarantine);
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return false;
+        throw error;
+    }
+    return removeVerifiedQuarantine(quarantine, before, options.expectedToken, options.afterIdentityCheck);
+}
+//# sourceMappingURL=scratch-bound-root-cleanup.js.map

package/dist/configs/vitest/scratch-bound-root-cleanup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scratch-bound-root-cleanup.js","sourceRoot":"","sources":["../../../src/configs/vitest/scratch-bound-root-cleanup.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EACL,yBAAyB,EACzB,+BAA+B,GAEhC,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,+BAA+B,EAAE,MAAM,qCAAqC,CAAC;AACtF,OAAO,EACL,sBAAsB,GAEvB,MAAM,oBAAoB,CAAC;AAW5B,2EAA2E;AAC3E,MAAM,2BAA2B,GAAG,EAAE,CAAC;AAEvC;;;GAGG;AACH,SAAS,gBAAgB,CAAC,QAAgB;IACxC,IACE,QAAQ,KAAK,EAAE;QACf,QAAQ,KAAK,GAAG;QAChB,QAAQ,KAAK,IAAI;QACjB,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,QAAQ;QACpC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;QACtB,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EACvB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,gDAAgD,QAAQ,EAAE,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,SAAiB;IACvC,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACzE,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,6BAA6B,CACpC,SAAiB,EACjB,QAAkB;IAElB,MAAM,MAAM,GAAG,SAAS,CACtB,OAAO,CAAC,QAAQ,EAChB;QACE,uBAAuB;QACvB,QAAQ;QACR,+BAA+B;QAC/B,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;QACpB,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;KACrB,EACD,EAAE,GAAG,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,EAAE,CAC3D,CAAC;IACF,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS;QAAE,MAAM,MAAM,CAAC,KAAK,CAAC;IACnD,IAAI,MAAM,CAAC,MAAM,KAAK,2BAA2B,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CACb,iCAAiC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAClG,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,4BAA4B,CACnC,OAA2C,EAC3C,IAA0B;IAE1B,IACE,IAAI,KAAK,SAAS;QAClB,OAAO,CAAC,gBAAgB,KAAK,SAAS;QACtC,CAAC,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,gBAAgB,CAAC,GAAG;YACxC,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAC5C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,SAAS,0BAA0B,CACjC,OAA2C,EAC3C,SAAiB;IAEjB,gBAAgB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACnC,+BAA+B,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACnD,OAAO,4BAA4B,CAAC,OAAO,EAAE,cAAc,CAAC,SAAS,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED;;;;;GAKG;AACH,SAAS,gBAAgB,CACvB,SAAiB,EACjB,aAAiC,EACjC,KAAyB;IAEzB,IAAI,aAAa,KAAK,SAAS;QAAE,OAAO;IACxC,MAAM,KAAK,GAAG,sBAAsB,CAAC,SAAS,CAAC,CAAC;IAChD,IAAI,KAAK,CAAC,KAAK,KAAK,aAAa,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,+BAA+B,KAAK,aAAa,CAAC,CAAC;IACrE,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,wBAAwB,CAC/B,UAAkB,EAClB,MAAgB,EAChB,aAAiC,EACjC,kBAA6D;IAE7D,MAAM,KAAK,GAAG,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IACvC,IACE,KAAK,CAAC,cAAc,EAAE;QACtB,KAAK,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG;QACxB,KAAK,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,EACxB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,kBAAkB,EAAE,CAAC,UAAU,CAAC,CAAC;IACjC,gBAAgB,CAAC,UAAU,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;IACrD,6BAA6B,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACjD,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IACzB,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,2BAA2B,CACzC,OAA2C;IAE3C,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CACzB,OAAO,CAAC,SAAS,CAAC,SAAS,CAAC,aAAa,EACzC,OAAO,CAAC,QAAQ,CACjB,CAAC;IACF,MAAM,cAAc,GAAG,GAAG,yBAAyB,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;IACxF,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAC1B,OAAO,CAAC,SAAS,CAAC,SAAS,CAAC,aAAa,EACzC,cAAc,CACf,CAAC;IACF,MAAM,MAAM,GAAG,0BAA0B,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC9D,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACvC,IAAI,MAAM,CAAC,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CACb,4DAA4D,SAAS,EAAE,CACxE,CAAC;IACJ,CAAC;IACD,gBAAgB,CAAC,SAAS,EAAE,OAAO,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;IAC7D,IAAI,CAAC;QACH,EAAE,CAAC,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QACrE,MAAM,KAAK,CAAC;IACd,CAAC;IACD,OAAO,wBAAwB,CAC7B,UAAU,EACV,MAAM,EACN,OAAO,CAAC,aAAa,EACrB,OAAO,CAAC,kBAAkB,CAC3B,CAAC;AACJ,CAAC"}

package/dist/configs/vitest/scratch-global-setup.d.ts

@@ -1,3 +1,4 @@
+import { processBirthFingerprintSnapshot } from "./scratch-owner.js";
 /**
  * Upper bound on entries the namespace may hold that **nobody owns**.
  *
@@ -35,7 +36,7 @@ export declare const MAX_NAMESPACE_ENTRIES = 512;
 export interface NamespaceResidue {
     /** Entries whose owning process is gone but which were not removed */
     readonly orphaned: readonly string[];
-    /** Entries that do not follow the run-root naming scheme at all */
+    /** Entries whose exact dead ownership cannot be established */
     readonly unrecognised: readonly string[];
     /** Total entries present */
     readonly total: number;
@@ -50,26 +51,33 @@ export interface NamespaceResidue {
  * that regression into a failure instead of a slow leak.
  * @param dir - Namespace directory to inspect
  * @param alive - Liveness probe, overridable for tests
+ * @param birth - Process-birth probe, overridable for tests
  * @returns The classified residue.
  */
-export declare const inspectNamespace: (dir?: string, alive?: (pid: number) => boolean) => NamespaceResidue;
+export declare const inspectNamespace: (dir?: string, alive?: (pid: number) => boolean, birth?: (pid: number) => string | undefined) => NamespaceResidue;
 /**
  * Builds the failure message for a namespace that is accumulating.
  *
  * Every branch names the directory and the offending entries, because the
  * failure this replaces was a 60-second timeout that named nothing.
  *
- * `unrecognised` is deliberately NOT a failure. It was, and it wedged: one
- * foreign directory in the namespace failed every subsequent run, forever, with
- * a message a downstream user could not act on. Those entries are reclaimed on
- * age by the sweep instead. What remains here are the two conditions that mean
- * this fix itself has stopped working — residue the sweep should have taken and
- * did not, and a namespace growing without bound.
+ * `unrecognised` is deliberately a fail-closed refusal. A foreign, malformed,
+ * or identity-mismatched entry is preserved because age and naming are not
+ * deletion authority; proceeding would silently permit unbounded residue, and
+ * deleting it could destroy a live sibling's work. The diagnostic therefore
+ * names the bounded entries and gives the only safe manual recovery rule.
  * @param dir - Namespace directory inspected
  * @param residue - What the inspection found
  * @returns The message, or `undefined` when the namespace is healthy.
  */
 export declare const describeResidueFailure: (dir: string, residue: NamespaceResidue) => string | undefined;
+/**
+ * Sweeps the namespace and reports what survived.
+ * @param alive - Process liveness probe shared by both phases
+ * @param snapshot - One bulk process-birth snapshot provider
+ * @returns The residue remaining after the sweep.
+ */
+export declare const sweepThenInspect: (alive?: (pid: number) => boolean, snapshot?: typeof processBirthFingerprintSnapshot) => NamespaceResidue;
 /**
  * Renders the banner printed at the moment of refusal.
  *
@@ -193,7 +201,7 @@ export declare const announceRefusal: (failure: string, writeNotice?: (text: str
  * A refusal speaks twice — a banner before collection and a summary line at
  * exit — and the two are not redundant. They are the top and the bottom of a
  * transcript nobody reads in full.
- * @throws When residue is present that the sweep cannot or did not reclaim.
+ * @throws {Error} When residue is present that the sweep cannot or did not reclaim.
  */
 export declare const setup: () => void;
 /**

package/dist/configs/vitest/scratch-global-setup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scratch-global-setup.d.ts","sourceRoot":"","sources":["../../../src/configs/vitest/scratch-global-setup.ts"],"names":[],"mappings":"AAkDA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,eAAO,MAAM,qBAAqB,MAAM,CAAC;AAEzC,iDAAiD;AACjD,MAAM,WAAW,gBAAgB;IAC/B,sEAAsE;IACtE,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,mEAAmE;IACnE,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,4BAA4B;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,gBAAgB,GAC3B,MAAK,MAA8B,EACnC,QAAO,CAAC,GAAG,EAAE,MAAM,KAAK,OAAwB,KAC/C,gBAWF,CAAC;AAUF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,sBAAsB,GACjC,KAAK,MAAM,EACX,SAAS,gBAAgB,KACxB,MAAM,GAAG,SA2BX,CAAC;AA2BF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,eAAO,MAAM,mBAAmB,GAAI,SAAS,MAAM,KAAG,MAcxC,CAAC;AAKf;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,oBAAoB,GAAI,SAAS,MAAM,KAAG,MAG/B,CAAC;AAEzB;;;;;GAKG;AACH,eAAO,MAAM,eAAe,mBAAmB,CAAC;AAQhD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,iBAAiB,GAC5B,SAAS,MAAM,EACf,QAAO,CAAC,IAAI,EAAE,MAAM,KAAK,IAExB,KACA,IAIF,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,eAAO,MAAM,eAAe,GAC1B,SAAS,MAAM,EACf,cAAa,CAAC,IAAI,EAAE,MAAM,KAAK,IAE9B,KACA,IAMF,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,KAAK,QAAO,IAexB,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,QAAQ,QAAO,IAE3B,CAAC"}
+{"version":3,"file":"scratch-global-setup.d.ts","sourceRoot":"","sources":["../../../src/configs/vitest/scratch-global-setup.ts"],"names":[],"mappings":"AAmDA,OAAO,EAGL,+BAA+B,EAGhC,MAAM,oBAAoB,CAAC;AAE5B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,eAAO,MAAM,qBAAqB,MAAM,CAAC;AAEzC,iDAAiD;AACjD,MAAM,WAAW,gBAAgB;IAC/B,sEAAsE;IACtE,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,+DAA+D;IAC/D,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,4BAA4B;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AA4DD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,gBAAgB,GAC3B,MAAK,MAA8B,EACnC,QAAO,CAAC,GAAG,EAAE,MAAM,KAAK,OAAwB,EAChD,QAAO,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,SAAmC,KACnE,gBAgBF,CAAC;AAeF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,sBAAsB,GACjC,KAAK,MAAM,EACX,SAAS,gBAAgB,KACxB,MAAM,GAAG,SAsCX,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,GAC3B,QAAO,CAAC,GAAG,EAAE,MAAM,KAAK,OAAwB,EAChD,WAAU,OAAO,+BAAiE,KACjF,gBAQF,CAAC;AAgBF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,eAAO,MAAM,mBAAmB,GAAI,SAAS,MAAM,KAAG,MAcxC,CAAC;AAKf;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,oBAAoB,GAAI,SAAS,MAAM,KAAG,MAG/B,CAAC;AAEzB;;;;;GAKG;AACH,eAAO,MAAM,eAAe,mBAAmB,CAAC;AAQhD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,iBAAiB,GAC5B,SAAS,MAAM,EACf,QAAO,CAAC,IAAI,EAAE,MAAM,KAAK,IAExB,KACA,IAIF,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,eAAO,MAAM,eAAe,GAC1B,SAAS,MAAM,EACf,cAAa,CAAC,IAAI,EAAE,MAAM,KAAK,IAE9B,KACA,IAMF,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,KAAK,QAAO,IAexB,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,QAAQ,QAAO,IAE3B,CAAC"}

package/dist/configs/vitest/scratch-global-setup.js

@@ -3,10 +3,11 @@
  *
  * Runs once in the main Vitest process, on either side of the whole run.
  *
- * `setup` reclaims residue left by runs that were killed and then REFUSES TO
- * START a run whose namespace is accumulating — the accumulation being the
- * entire defect this exists to prevent, arriving one directory at a time.
- * `teardown` reclaims what this run allocated.
+ * `setup` reclaims residue only when a valid owner marker proves the exact root
+ * belongs to a dead process. It REFUSES TO START when a root cannot be removed
+ * with that authority or when proven-dead residue survives the sweep. That
+ * fail-closed distinction prevents a cleanup guard from deleting a live
+ * sibling's work. `teardown` reclaims what this run allocated.
  *
  * The check is deliberately a hard failure. A previous version of this problem
  * was invisible for a working day because every instrument that met the
@@ -29,16 +30,18 @@
  * a hook the runner ignores is the exact defect this file was written to stop,
  * reproduced inside the guard itself.
  *
- * Checking at the start rather than the end costs nothing that matters: a run's
- * own residue is reclaimed by the next run's sweep, and the next run's check
- * sees whatever that sweep could not take. Accumulation is a trend, and a trend
- * is still visible one run later.
+ * Checking at the start rather than the end costs nothing that matters: the
+ * next run reclaims roots whose exact dead ownership it can prove, preserves
+ * uncertain paths, and refuses before collection if anything unsafe remains.
+ * Accumulation is a trend, and a trend is still visible one run later.
  * @see {@link module:configs/vitest/scratch} for the reclaim rules
  * @module configs/vitest/scratch-global-setup
  */
-import { writeSync } from "node:fs";
+import { lstatSync, realpathSync, writeSync } from "node:fs";
+import * as path from "node:path";
 import { env } from "node:process";
-import { isProcessAlive, parseRunRootName, readNamespaceEntries, scratchNamespaceDir, sweepScratchNamespace, } from "./scratch.js";
+import { isProcessAlive, liveOwnerBirthProbe, readNamespaceEntries, scratchNamespaceDir, sweepScratchNamespace, } from "./scratch.js";
+import { classifyScratchOwner, processBirthFingerprint, processBirthFingerprintSnapshot, readScratchOwnerRecord, } from "./scratch-owner.js";
 /**
  * Upper bound on entries the namespace may hold that **nobody owns**.
  *
@@ -72,6 +75,50 @@ import { isProcessAlive, parseRunRootName, readNamespaceEntries, scratchNamespac
  * against measured harm and belongs in its own ticket.
  */
 export const MAX_NAMESPACE_ENTRIES = 512;
+/**
+ * Verify that a durable marker names the physical root and namespace inspected.
+ * @param dir - Canonical namespace path
+ * @param root - Direct child root
+ * @param owner - Valid owner marker
+ * @returns True when device, inode, and canonical identities all match
+ */
+function markerMatchesInspectedPath(dir, root, owner) {
+    const namespaceStat = lstatSync(dir);
+    const rootStat = lstatSync(root);
+    return (!rootStat.isSymbolicLink() &&
+        rootStat.isDirectory() &&
+        owner.namespace.canonicalPath === realpathSync(dir) &&
+        owner.namespace.dev === namespaceStat.dev &&
+        owner.namespace.ino === namespaceStat.ino &&
+        owner.root.canonicalPath === realpathSync(root) &&
+        owner.root.dev === rootStat.dev &&
+        owner.root.ino === rootStat.ino);
+}
+/**
+ * Classify one direct namespace child without treating age as authority.
+ * @param dir - Canonical namespace path
+ * @param name - Direct child basename
+ * @param alive - Pid liveness probe
+ * @param birth - Process-birth probe
+ * @returns Fail-closed entry disposition
+ */
+function classifyNamespaceEntry(dir, name, alive, birth) {
+    const root = path.join(dir, name);
+    try {
+        const owner = readScratchOwnerRecord(root);
+        if (!markerMatchesInspectedPath(dir, root, owner))
+            return "unrecognised";
+        return classifyScratchOwner(owner, {
+            isProcessAlive: alive,
+            processBirthFingerprint: birth,
+        }) === "preserve"
+            ? "live"
+            : "orphaned";
+    }
+    catch {
+        return "unrecognised";
+    }
+}
 /**
  * Classifies what is left in the namespace.
  *
@@ -82,16 +129,22 @@ export const MAX_NAMESPACE_ENTRIES = 512;
  * that regression into a failure instead of a slow leak.
  * @param dir - Namespace directory to inspect
  * @param alive - Liveness probe, overridable for tests
+ * @param birth - Process-birth probe, overridable for tests
  * @returns The classified residue.
  */
-export const inspectNamespace = (dir = scratchNamespaceDir(), alive = isProcessAlive) => {
+export const inspectNamespace = (dir = scratchNamespaceDir(), alive = isProcessAlive, birth = processBirthFingerprint) => {
     const entries = readNamespaceEntries(dir);
+    const classified = entries.map(name => ({
+        name,
+        disposition: classifyNamespaceEntry(dir, name, alive, birth),
+    }));
     return {
-        orphaned: entries.filter(name => {
-            const owner = parseRunRootName(name);
-            return owner !== undefined && !alive(owner.pid);
-        }),
-        unrecognised: entries.filter(name => parseRunRootName(name) === undefined),
+        orphaned: classified
+            .filter(entry => entry.disposition === "orphaned")
+            .map(entry => entry.name),
+        unrecognised: classified
+            .filter(entry => entry.disposition === "unrecognised")
+            .map(entry => entry.name),
         total: entries.length,
     };
 };
@@ -101,18 +154,20 @@ export const inspectNamespace = (dir = scratchNamespaceDir(), alive = isProcessA
  * @returns A comma-separated sample, elided beyond five.
  */
 const sample = (names) => names.slice(0, 5).join(", ") + (names.length > 5 ? ", …" : "");
+/** Safe operator recovery when automatic deletion authority is unavailable. */
+const MANUAL_RECOVERY_GUIDANCE = "Remove only an exact entry whose dead owner you can independently verify. " +
+    "Do not clear the shared namespace or remove a live sibling's root.";
 /**
  * Builds the failure message for a namespace that is accumulating.
  *
  * Every branch names the directory and the offending entries, because the
  * failure this replaces was a 60-second timeout that named nothing.
  *
- * `unrecognised` is deliberately NOT a failure. It was, and it wedged: one
- * foreign directory in the namespace failed every subsequent run, forever, with
- * a message a downstream user could not act on. Those entries are reclaimed on
- * age by the sweep instead. What remains here are the two conditions that mean
- * this fix itself has stopped working — residue the sweep should have taken and
- * did not, and a namespace growing without bound.
+ * `unrecognised` is deliberately a fail-closed refusal. A foreign, malformed,
+ * or identity-mismatched entry is preserved because age and naming are not
+ * deletion authority; proceeding would silently permit unbounded residue, and
+ * deleting it could destroy a live sibling's work. The diagnostic therefore
+ * names the bounded entries and gives the only safe manual recovery rule.
  * @param dir - Namespace directory inspected
  * @param residue - What the inspection found
  * @returns The message, or `undefined` when the namespace is healthy.
@@ -122,7 +177,15 @@ export const describeResidueFailure = (dir, residue) => {
         return (`Test scratch namespace ${dir} still holds ${String(residue.orphaned.length)} ` +
             `root(s) whose owning process is gone, after a sweep that should have ` +
             `removed them: ${sample(residue.orphaned)}. Reclaim-on-start is not ` +
-            `working, so a killed run's residue is now permanent.`);
+            `working, so a killed run's residue is now permanent. ${MANUAL_RECOVERY_GUIDANCE}`);
+    }
+    if (residue.unrecognised.length > 0) {
+        return (`Test scratch namespace ${dir} holds ${String(residue.unrecognised.length)} ` +
+            `root(s) without valid owner-marker authority: ${sample(residue.unrecognised)}. ` +
+            `Lisa preserved the uncertain residue instead of deleting a path that ` +
+            `cannot be bound to a token and process-birth fingerprint. ` +
+            `There are ${String(residue.total)} entries in total; the historical ` +
+            `accumulating-residue ceiling is ${String(MAX_NAMESPACE_ENTRIES)}. ${MANUAL_RECOVERY_GUIDANCE}`);
     }
     // Entries no live process owns. Written as the general expression rather
     // than as `unrecognised` alone: the orphaned branch above returns first
@@ -134,18 +197,24 @@ export const describeResidueFailure = (dir, residue) => {
             `live process owns, past the ceiling of ${String(MAX_NAMESPACE_ENTRIES)} ` +
             `(${String(residue.total)} entries in total, the rest being work in ` +
             `flight). Scratch space is accumulating rather than being reclaimed — ` +
-            `the condition this guard exists to prevent.`);
+            `the condition this guard exists to prevent. ${MANUAL_RECOVERY_GUIDANCE}`);
     }
     return undefined;
 };
 /**
  * Sweeps the namespace and reports what survived.
- * @param dir - Namespace directory
+ * @param alive - Process liveness probe shared by both phases
+ * @param snapshot - One bulk process-birth snapshot provider
  * @returns The residue remaining after the sweep.
  */
-const sweepThenInspect = (dir) => {
-    sweepScratchNamespace({ dir });
-    return inspectNamespace(dir);
+export const sweepThenInspect = (alive = isProcessAlive, snapshot = processBirthFingerprintSnapshot) => {
+    const dir = scratchNamespaceDir();
+    const birth = liveOwnerBirthProbe(dir, alive, snapshot);
+    sweepScratchNamespace({
+        isProcessAlive: alive,
+        processBirthFingerprint: birth,
+    });
+    return inspectNamespace(dir, alive, birth);
 };
 /**
  * Audits the namespace, tolerating a sibling run's worker exiting mid-audit.
@@ -154,12 +223,11 @@ const sweepThenInspect = (dir) => {
  * inspection, through no fault of this run. Sweeping once more before treating
  * an orphan as a defect keeps a guard built to catch a permanent leak from
  * failing on a transient one.
- * @param dir - Namespace directory
  * @returns The residue to judge.
  */
-const auditNamespace = (dir) => {
-    const first = sweepThenInspect(dir);
-    return first.orphaned.length > 0 ? sweepThenInspect(dir) : first;
+const auditNamespace = () => {
+    const first = sweepThenInspect();
+    return first.orphaned.length > 0 ? sweepThenInspect() : first;
 };
 /**
  * Renders the banner printed at the moment of refusal.
@@ -321,7 +389,7 @@ export const announceRefusal = (failure, writeNotice = text => {
  * A refusal speaks twice — a banner before collection and a summary line at
  * exit — and the two are not redundant. They are the top and the bottom of a
  * transcript nobody reads in full.
- * @throws When residue is present that the sweep cannot or did not reclaim.
+ * @throws {Error} When residue is present that the sweep cannot or did not reclaim.
  */
 export const setup = () => {
     // The namespace directory is not created here. `createRunRoot` makes it
@@ -329,7 +397,7 @@ export const setup = () => {
     // inspection treat an absent namespace as an empty one — so creating it would
     // be a side effect ahead of the audit that buys nothing.
     const dir = scratchNamespaceDir();
-    const residue = auditNamespace(dir);
+    const residue = auditNamespace();
     const failure = describeResidueFailure(dir, residue);
     if (failure !== undefined) {
         // Both halves of the announcement happen before the throw, because the
@@ -354,6 +422,6 @@ export const setup = () => {
  * approximately true.
  */
 export const teardown = () => {
-    sweepScratchNamespace({ dir: scratchNamespaceDir() });
+    sweepScratchNamespace();
 };
 //# sourceMappingURL=scratch-global-setup.js.map