@cotal-ai/cli 0.16.0 → 0.17.0

package/dist/lib/delivery-proc.js

@@ -1,50 +1,77 @@
 import { spawn } from "node:child_process";
 import { existsSync, openSync, closeSync, writeFileSync, readFileSync, rmSync } from "node:fs";
 import { DEFAULT_SERVER, mintCreds, newIdentity, waitForDeliveryLease, } from "@cotal-ai/core";
-import { DELIVERY_CREDS_KEY, authDir, findCotalRoot, getSoleSpaceAuth, listSpaceAccounts, workspaceSecretStore } from "@cotal-ai/workspace";
+import { DELIVERY_CREDS_KEY, authDir, findCotalRoot, getSoleSpaceAuth, listSpaceAccounts, parsePid, probeLiveness, workspaceSecretStore } from "@cotal-ai/workspace";
 import { selfArgv } from "./self-exec.js";
 import { resolveSpace } from "./status.js";
 import { cotalPath } from "./paths.js";
-import { ensureManager, managerHasDeliveryMarker, managerUp, stopManager } from "./manager-proc.js";
+import { MANAGER_PID_PATH, ensureManager, managerHasDeliveryMarker, managerLiveness, stopManager } from "./manager-proc.js";
 const PID_PATH = () => cotalPath("delivery.pid");
 // The daemon's cred goes through the secret-store seam; the shared key (== the filename, so the
 // file stays `.cotal/delivery.creds`) comes from workspace — never a hand-copied literal.
 const credsStore = () => workspaceSecretStore(findCotalRoot());
-function alive(pid) {
-    try {
-        process.kill(pid, 0);
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
-/** True if the delivery daemon we started for this folder is still running (pid file + liveness). */
-export function deliveryUp() {
+/** The recorded daemon's liveness, THREE-VALUED plus absent. See {@link managerLiveness} for why the
+ *  boolean collapse is the defect: `unknown` is reachable on a real kernel (a seccomp
+ *  `SECCOMP_RET_ERRNO` filter or an LSM policy answers `kill(pid, 0)` with an arbitrary errno and
+ *  libuv preserves it), and both ways of folding it into a boolean fail silently. */
+export function deliveryLiveness(probe = probeLiveness) {
     const p = PID_PATH();
     if (!existsSync(p))
-        return false;
-    const pid = Number(readFileSync(p, "utf8").trim());
-    return Number.isFinite(pid) && alive(pid);
+        return "absent";
+    const raw = readFileSync(p, "utf8").trim();
+    if (raw === "")
+        return "absent";
+    const pid = parsePid(raw);
+    if (pid === undefined)
+        return "unattributable"; // see managerLiveness: never fold this into absent
+    return probe(pid);
+}
+/** True only if the daemon is PROVABLY running. Callers that ACT on the answer take
+ *  {@link deliveryLiveness} instead; this cannot express "cannot tell". */
+export function deliveryUp() {
+    return deliveryLiveness() === "alive";
 }
 /** True when this folder runs an authed mesh — the only mode with a delivery daemon (Plane-3 needs the
  *  trusted reader; open dev mode is live-only). */
 function hasAuth() {
     return listSpaceAccounts(authDir(findCotalRoot())).length > 0;
 }
-/** True if an OLD (pre-delivery-daemon) Plane-3-hosting manager is live: a `manager.pid` that is alive
- *  but carries no delivery-aware marker. Such a manager still calls `startPlane3` and would double-bind
- *  `fanout`/`reader` against the new daemon. */
-function oldHostingManagerLive() {
-    return managerUp() && !managerHasDeliveryMarker();
+/** The cutover preflight's verdict, THREE-VALUED, because the boolean it replaced was read before the
+ *  refusal boundary and therefore defeated it.
+ *
+ *  `managerUp()` folds `unknown` to false, so an unattributable manager with no marker (which IS the
+ *  old Plane-3-hosting shape) read as "no old manager", the preflight skipped, and `ensureDelivery`
+ *  went on to mint a credential, write a pidfile and start a second daemon. Only afterwards did
+ *  `ensureManager` throw. Everything the refusal was supposed to prevent had already happened, and
+ *  the daemon's own lease cannot help: it is a delivery-daemon-only mechanism and can neither prove
+ *  nor exclude an old manager still hosting Plane 3.
+ *
+ *  A guard that runs after the work is not a guard, so this one reads the tri-state directly and the
+ *  caller refuses BEFORE anything is minted, written or started. */
+function oldHostingManagerVerdict(probe = probeLiveness) {
+    const state = managerLiveness(probe);
+    if (state === "unknown" || state === "unattributable")
+        return "indeterminate";
+    if (state !== "alive")
+        return "proceed"; // dead or absent: nothing is hosting Plane 3
+    return managerHasDeliveryMarker() ? "proceed" : "stop-it"; // alive: the marker decides
 }
 /** Cutover preflight — the FIRST action, BEFORE the daemon can bind: stop any old Plane-3-hosting
  *  manager (live `manager.pid` without the delivery-aware marker) so it never double-binds the
  *  daemon's durables. A delivery-aware (this-build) manager is left running. No-op on a fresh install. */
-export function stopOldHostingManagerIfPresent() {
-    if (oldHostingManagerLive()) {
+export async function stopOldHostingManagerIfPresent(probe = probeLiveness, signal) {
+    const verdict = oldHostingManagerVerdict(probe);
+    // FIRST action, before any mint/write/start, so the refusal actually fences the daemon.
+    if (verdict === "indeterminate")
+        throw new Error(`the recorded manager pid (${readFileSync(MANAGER_PID_PATH(), "utf8").trim()}) cannot be attributed, so the delivery cutover preflight cannot run: the kernel answered neither "running" nor "no such process" (a seccomp filter or LSM policy does this inside some sandboxes).\n` +
+            `Refusing before the daemon starts. If that manager is an old Plane-3-hosting one it is still bound to fanout/reader, and starting the daemon anyway would double-bind them; the daemon's own lease cannot detect that.\n` +
+            `NEXT: verify the process yourself (\`ps -p <pid>\`). If it is gone, remove \`.cotal/manager.pid\` and re-run. If it is running, stop it with \`cotal down\` first.`);
+    if (verdict === "stop-it") {
         console.error("• stopping an old Plane-3-hosting manager before starting the delivery daemon (cutover preflight)");
-        stopManager();
+        // stopManager THROWS rather than reporting a stop it did not achieve (EPERM, or a process that
+        // outlived SIGTERM), so reaching the next line is the proof the old manager is gone. Letting that
+        // throw propagate is the point: the daemon must not start beside a manager still bound to Plane 3.
+        await stopManager(probe, signal);
     }
 }
 /** Start the delivery daemon detached (pid in `.cotal/delivery.pid`, output to `.cotal/delivery.log`),
@@ -60,6 +87,15 @@ export function startDeliveryDetached(o = {}) {
         o.space ?? resolveSpace(process.cwd()),
         "--server",
         o.server ?? DEFAULT_SERVER,
+        // Propagate the broker's transport decision. The daemon cannot derive it: it learns everything
+        // from argv by design - it is a pre-minted scoped-cred client, injectable behind a SecretStore,
+        // and making it read the machine-local mesh registry to pick a transport would couple a
+        // hosted-composable daemon to a workstation artifact. So the launcher, which DOES know, tells it.
+        //
+        // Without this the daemon connects plaintext-capable to a TLS broker and nothing looks wrong,
+        // because it still upgrades on the server's INFO. It holds a STANDING credential and reconnects
+        // unattended, so that exposure would repeat on every reconnect with nobody watching.
+        ...(o.tls ? ["--tls"] : []),
     ];
     // Internal child re-exec (the `up` that reached here already seeded); the delivery daemon does not
     // launch agents, so it skips the connector seed on boot (a direct `cotal deliver` still seeds).
@@ -74,10 +110,10 @@ export function startDeliveryDetached(o = {}) {
  *  never double-binds. Mints a SCOPED `delivery` cred from the local signer ONCE, writes it to
  *  `.cotal/delivery.creds` (0600), and launches the daemon WITHOUT signer access. Best-effort — callers
  *  treat it as non-fatal (a missing daemon degrades durable delivery, never live). */
-export async function ensureDelivery(o = {}) {
+export async function ensureDelivery(o = {}, probe = probeLiveness) {
     if (!hasAuth())
         return { running: false }; // open dev mode — no daemon, agents are live-only
-    if (oldHostingManagerLive()) {
+    if (oldHostingManagerVerdict(probe) === "stop-it") {
         console.error("✗ delivery: an old Plane-3-hosting manager is still live (no delivery-aware marker). Refusing to start the daemon - run `cotal down` first, then retry.");
         return { running: false };
     }
@@ -90,7 +126,15 @@ export async function ensureDelivery(o = {}) {
     const creds = await mintCreds(auth, id, "delivery");
     const space = o.space ?? resolveSpace(process.cwd());
     const server = o.server ?? DEFAULT_SERVER;
-    if (!deliveryUp()) {
+    const deliveryState = deliveryLiveness(probe);
+    // Same refusal as the manager: an unattributable pid must not be silently reused (a daemon
+    // reported running that is not there) nor silently replaced (two daemons on one fanout).
+    if (deliveryState === "unknown" || deliveryState === "unattributable")
+        throw new Error(`the recorded delivery daemon pid (${readFileSync(PID_PATH(), "utf8").trim()}) cannot be attributed: the kernel answered neither "running" nor "no such process".\n` +
+            `A seccomp filter or LSM policy that intercepts \`kill(pid, 0)\` does this, so it is expected inside some sandboxes and containers.\n` +
+            `Cotal will not guess: reusing it would report a daemon that is not there, and starting a second would put two daemons on one fanout.\n` +
+            `NEXT: verify the process yourself (\`ps -p <pid>\`). If it is gone, remove \`.cotal/delivery.pid\` and re-run. If it is running, use it or stop it.`);
+    if (deliveryState !== "alive") {
         // The store's put hardens `.cotal/` first (the cred is born under a private ACL, no race) and
         // lands it atomically — same path and bytes as before the seam.
         await credsStore().put(DELIVERY_CREDS_KEY, creds);
@@ -109,25 +153,67 @@ export async function ensureDelivery(o = {}) {
  *  kill runs even if the creds delete fails (finally) — a delete error must never leave the daemon
  *  alive to outlive the teardown and reattach to a restarted broker; the error still propagates
  *  after the kill so the caller can surface it. */
-export async function stopDelivery() {
-    try {
+export async function stopDelivery(probe = probeLiveness, signal) {
+    const send = signal ?? ((pid, sig) => process.kill(pid, sig));
+    const p = PID_PATH();
+    // ORDER MATTERS, AND IT USED TO BE BACKWARDS. The credential was deleted FIRST, in a try whose
+    // finally then signalled and removed the pidfile unconditionally. Under a refused signal that left
+    // a LIVE daemon with no pidfile and no standing credential: still connected, still serving, and its
+    // reconnect and renewal source deleted out from under it, while the function returned success.
+    // Nothing is removed now until the process is proven gone.
+    // Once death is PROVEN, both records are stale and the pidfile goes first: a creds-delete failure
+    // (a blocked path, a store error) must still propagate loudly, but it must not leave behind a
+    // pidfile for a process that is definitely gone. delivery-teardown.smoke.ts pins exactly that
+    // combination, and caught this when the first version of this fix ordered them the other way.
+    const removeRecords = async () => {
+        rmSync(p, { force: true });
         await credsStore().delete(DELIVERY_CREDS_KEY);
+    };
+    if (!existsSync(p)) {
+        await credsStore().delete(DELIVERY_CREDS_KEY); // no pid recorded: no live daemon to strand
+        return;
+    }
+    const raw = readFileSync(p, "utf8").trim();
+    const pid = parsePid(raw);
+    if (pid === undefined) {
+        if (raw === "") {
+            await removeRecords(); // pre-protocol husk, nothing behind it
+            return;
+        }
+        // See the manager helper: unattributable content may front a live daemon, and clearing it here
+        // would also delete the standing credential of a process still using it.
+        throw new Error(`the delivery pidfile at ${p} is unattributable (${JSON.stringify(raw)}): it may still front a running daemon nobody can identify.\n` +
+            `Refusing to remove it or its standing credential, and refusing to report a clean stop.\n` +
+            `NEXT: find and stop that process, then remove the file by hand.`);
+    }
+    const before = probe(pid);
+    if (before === "dead") {
+        await removeRecords();
+        return;
+    }
+    if (before === "unknown")
+        throw new Error(`refusing to stop the delivery daemon (pid ${pid}): its liveness cannot be determined (a seccomp filter or LSM policy answers kill(pid,0) with an arbitrary errno).\n` +
+            `The pidfile and standing credential are LEFT IN PLACE: removing them would strand a daemon that may still be connected, with its renewal source gone.\n` +
+            `NEXT: verify with \`ps -p ${pid}\`, then stop it yourself or remove \`.cotal/delivery.pid\` if it is gone.`);
+    try {
+        send(pid, "SIGTERM");
     }
-    finally {
-        const p = PID_PATH();
-        if (existsSync(p)) {
-            const pid = Number(readFileSync(p, "utf8").trim());
-            if (Number.isFinite(pid)) {
-                try {
-                    process.kill(pid, "SIGTERM");
-                }
-                catch {
-                    /* already gone */
-                }
-            }
-            rmSync(p);
+    catch (e) {
+        const code = e.code;
+        if (code === "ESRCH") {
+            await removeRecords(); // raced to exit between probe and signal
+            return;
         }
+        throw new Error(`refusing to stop the delivery daemon (pid ${pid}): the signal was rejected (${code ?? "unknown error"}).\n` +
+            `EPERM means it belongs to another user, so it is running and not ours to stop. The pidfile and standing credential are LEFT IN PLACE.\n` +
+            `NEXT: stop it as its owner, or remove \`.cotal/delivery.pid\` if you are certain it is gone.`);
     }
+    const deadline = Date.now() + 15_000;
+    while (probe(pid) !== "dead" && Date.now() < deadline)
+        await new Promise((r) => setTimeout(r, 100));
+    if (probe(pid) !== "dead")
+        throw new Error(`the delivery daemon (pid ${pid}) accepted SIGTERM but its death could not be confirmed; its pidfile and credential were preserved rather than recording a stop that did not happen.`);
+    await removeRecords();
 }
 /** Bring up the control plane in the correct cutover order: OLD-manager preflight → delivery daemon
  *  (auth only, fails closed on a live old manager) → manager (lifecycle, writes the delivery-aware
@@ -135,7 +221,7 @@ export async function stopDelivery() {
  *  first only to close the old-manager double-bind window and so freshly-spawned agents find the
  *  `ctl.delivery` responder for their boot self-join (a miss honest-degrades to live-only). */
 export async function ensureControlPlane(o = {}) {
-    stopOldHostingManagerIfPresent();
+    await stopOldHostingManagerIfPresent();
     await ensureDelivery(o);
     return ensureManager(o);
 }

package/dist/lib/delivery-proc.js.map

@@ -1 +1 @@
-{"version":3,"file":"delivery-proc.js","sourceRoot":"","sources":["../../src/lib/delivery-proc.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC/F,OAAO,EACL,cAAc,EACd,SAAS,EACT,WAAW,EACX,oBAAoB,GACrB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC5I,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,wBAAwB,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEpG,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;AACjD,gGAAgG;AAChG,0FAA0F;AAC1F,MAAM,UAAU,GAAG,GAAG,EAAE,CAAC,oBAAoB,CAAC,aAAa,EAAE,CAAC,CAAC;AAI/D,SAAS,KAAK,CAAC,GAAW;IACxB,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,UAAU;IACxB,MAAM,CAAC,GAAG,QAAQ,EAAE,CAAC;IACrB,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACjC,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACnD,OAAO,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC;AAC5C,CAAC;AAED;mDACmD;AACnD,SAAS,OAAO;IACd,OAAO,iBAAiB,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;AAChE,CAAC;AAED;;gDAEgD;AAChD,SAAS,qBAAqB;IAC5B,OAAO,SAAS,EAAE,IAAI,CAAC,wBAAwB,EAAE,CAAC;AACpD,CAAC;AAED;;0GAE0G;AAC1G,MAAM,UAAU,8BAA8B;IAC5C,IAAI,qBAAqB,EAAE,EAAE,CAAC;QAC5B,OAAO,CAAC,KAAK,CAAC,mGAAmG,CAAC,CAAC;QACnH,WAAW,EAAE,CAAC;IAChB,CAAC;AACH,CAAC;AAED;;8FAE8F;AAC9F,MAAM,UAAU,qBAAqB,CAAC,IAAU,EAAE;IAChD,MAAM,EAAE,GAAG,QAAQ,CAAC,SAAS,CAAC,cAAc,CAAC,EAAE,GAAG,CAAC,CAAC;IACpD,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,QAAQ,EAAE,CAAC;IACnC,MAAM,IAAI,GAAG;QACX,GAAG,IAAI;QACP,SAAS;QACT,SAAS;QACT,CAAC,CAAC,KAAK,IAAI,YAAY,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QACtC,UAAU;QACV,CAAC,CAAC,MAAM,IAAI,cAAc;KAC3B,CAAC;IACF,mGAAmG;IACnG,gGAAgG;IAChG,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,yBAAyB,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACxI,SAAS,CAAC,EAAE,CAAC,CAAC;IACd,KAAK,CAAC,KAAK,EAAE,CAAC;IACd,aAAa,CAAC,QAAQ,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7C,OAAO,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC;AACxB,CAAC;AAED;;;;sFAIsF;AACtF,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAU,EAAE;IAC/C,IAAI,CAAC,OAAO,EAAE;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,kDAAkD;IAC7F,IAAI,qBAAqB,EAAE,EAAE,CAAC;QAC5B,OAAO,CAAC,KAAK,CACX,yJAAyJ,CAC1J,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IACD,uGAAuG;IACvG,wGAAwG;IACxG,sGAAsG;IACtG,kBAAkB;IAClB,MAAM,IAAI,GAAG,CAAC,MAAM,gBAAgB,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAE,CAAC;IAC/E,MAAM,EAAE,GAAG,WAAW,EAAE,CAAC;IACzB,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,EAAE,EAAE,UAAU,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI,YAAY,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,IAAI,cAAc,CAAC;IAC1C,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;QAClB,8FAA8F;QAC9F,gEAAgE;QAChE,MAAM,UAAU,EAAE,CAAC,GAAG,CAAC,kBAAkB,EAAE,KAAK,CAAC,CAAC;QAClD,qBAAqB,CAAC,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IACjD,CAAC;IACD,kGAAkG;IAClG,uGAAuG;IACvG,wGAAwG;IACxG,mEAAmE;IACnE,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;IACvF,IAAI,CAAC,KAAK;QACR,OAAO,CAAC,KAAK,CAAC,sGAAsG,CAAC,CAAC;IACxH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED;;;mDAGmD;AACnD,MAAM,CAAC,KAAK,UAAU,YAAY;IAChC,IAAI,CAAC;QACH,MAAM,UAAU,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;IAChD,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,GAAG,QAAQ,EAAE,CAAC;QACrB,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;YAClB,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YACnD,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACzB,IAAI,CAAC;oBACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;gBAC/B,CAAC;gBAAC,MAAM,CAAC;oBACP,kBAAkB;gBACpB,CAAC;YACH,CAAC;YACD,MAAM,CAAC,CAAC,CAAC,CAAC;QACZ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;+FAI+F;AAC/F,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAAU,EAAE;IACnD,8BAA8B,EAAE,CAAC;IACjC,MAAM,cAAc,CAAC,CAAC,CAAC,CAAC;IACxB,OAAO,aAAa,CAAC,CAAC,CAAC,CAAC;AAC1B,CAAC"}
+{"version":3,"file":"delivery-proc.js","sourceRoot":"","sources":["../../src/lib/delivery-proc.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC/F,OAAO,EACL,cAAc,EACd,SAAS,EACT,WAAW,EACX,oBAAoB,GACrB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,QAAQ,EAAE,aAAa,EAAsB,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AACzL,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,wBAAwB,EAAE,eAAe,EAAE,WAAW,EAAiB,MAAM,mBAAmB,CAAC;AAE3I,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;AACjD,gGAAgG;AAChG,0FAA0F;AAC1F,MAAM,UAAU,GAAG,GAAG,EAAE,CAAC,oBAAoB,CAAC,aAAa,EAAE,CAAC,CAAC;AAS/D;;;qFAGqF;AACrF,MAAM,UAAU,gBAAgB,CAAC,QAAuB,aAAa;IACnE,MAAM,CAAC,GAAG,QAAQ,EAAE,CAAC;IACrB,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO,QAAQ,CAAC;IACpC,MAAM,GAAG,GAAG,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3C,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,QAAQ,CAAC;IAChC,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,gBAAgB,CAAC,CAAC,mDAAmD;IACnG,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC;AACpB,CAAC;AAED;2EAC2E;AAC3E,MAAM,UAAU,UAAU;IACxB,OAAO,gBAAgB,EAAE,KAAK,OAAO,CAAC;AACxC,CAAC;AAID;mDACmD;AACnD,SAAS,OAAO;IACd,OAAO,iBAAiB,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;;;;;;oEAWoE;AACpE,SAAS,wBAAwB,CAAC,QAAuB,aAAa;IACpE,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,gBAAgB;QAAE,OAAO,eAAe,CAAC;IAC9E,IAAI,KAAK,KAAK,OAAO;QAAE,OAAO,SAAS,CAAC,CAAC,6CAA6C;IACtF,OAAO,wBAAwB,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,4BAA4B;AACzF,CAAC;AAED;;0GAE0G;AAC1G,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,QAAuB,aAAa,EAAE,MAAiB;IAC1G,MAAM,OAAO,GAAG,wBAAwB,CAAC,KAAK,CAAC,CAAC;IAChD,wFAAwF;IACxF,IAAI,OAAO,KAAK,eAAe;QAC7B,MAAM,IAAI,KAAK,CACb,6BAA6B,YAAY,CAAC,gBAAgB,EAAE,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,uMAAuM;YACjR,0NAA0N;YAC1N,oKAAoK,CACvK,CAAC;IACJ,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,CAAC,KAAK,CAAC,mGAAmG,CAAC,CAAC;QACnH,+FAA+F;QAC/F,kGAAkG;QAClG,mGAAmG;QACnG,MAAM,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACnC,CAAC;AACH,CAAC;AAED;;8FAE8F;AAC9F,MAAM,UAAU,qBAAqB,CAAC,IAAU,EAAE;IAChD,MAAM,EAAE,GAAG,QAAQ,CAAC,SAAS,CAAC,cAAc,CAAC,EAAE,GAAG,CAAC,CAAC;IACpD,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,QAAQ,EAAE,CAAC;IACnC,MAAM,IAAI,GAAG;QACX,GAAG,IAAI;QACP,SAAS;QACT,SAAS;QACT,CAAC,CAAC,KAAK,IAAI,YAAY,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QACtC,UAAU;QACV,CAAC,CAAC,MAAM,IAAI,cAAc;QAC1B,+FAA+F;QAC/F,gGAAgG;QAChG,wFAAwF;QACxF,kGAAkG;QAClG,EAAE;QACF,8FAA8F;QAC9F,gGAAgG;QAChG,qFAAqF;QACrF,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5B,CAAC;IACF,mGAAmG;IACnG,gGAAgG;IAChG,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,yBAAyB,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACxI,SAAS,CAAC,EAAE,CAAC,CAAC;IACd,KAAK,CAAC,KAAK,EAAE,CAAC;IACd,aAAa,CAAC,QAAQ,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7C,OAAO,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC;AACxB,CAAC;AAED;;;;sFAIsF;AACtF,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAU,EAAE,EAAE,QAAuB,aAAa;IACrF,IAAI,CAAC,OAAO,EAAE;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,kDAAkD;IAC7F,IAAI,wBAAwB,CAAC,KAAK,CAAC,KAAK,SAAS,EAAE,CAAC;QAClD,OAAO,CAAC,KAAK,CACX,yJAAyJ,CAC1J,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IACD,uGAAuG;IACvG,wGAAwG;IACxG,sGAAsG;IACtG,kBAAkB;IAClB,MAAM,IAAI,GAAG,CAAC,MAAM,gBAAgB,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAE,CAAC;IAC/E,MAAM,EAAE,GAAG,WAAW,EAAE,CAAC;IACzB,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,EAAE,EAAE,UAAU,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI,YAAY,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,IAAI,cAAc,CAAC;IAC1C,MAAM,aAAa,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAC9C,2FAA2F;IAC3F,yFAAyF;IACzF,IAAI,aAAa,KAAK,SAAS,IAAI,aAAa,KAAK,gBAAgB;QACnE,MAAM,IAAI,KAAK,CACb,qCAAqC,YAAY,CAAC,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,wFAAwF;YAClK,sIAAsI;YACtI,wIAAwI;YACxI,qJAAqJ,CACxJ,CAAC;IACJ,IAAI,aAAa,KAAK,OAAO,EAAE,CAAC;QAC9B,8FAA8F;QAC9F,gEAAgE;QAChE,MAAM,UAAU,EAAE,CAAC,GAAG,CAAC,kBAAkB,EAAE,KAAK,CAAC,CAAC;QAClD,qBAAqB,CAAC,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IACjD,CAAC;IACD,kGAAkG;IAClG,uGAAuG;IACvG,wGAAwG;IACxG,mEAAmE;IACnE,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;IACvF,IAAI,CAAC,KAAK;QACR,OAAO,CAAC,KAAK,CAAC,sGAAsG,CAAC,CAAC;IACxH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED;;;mDAGmD;AACnD,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,QAAuB,aAAa,EAAE,MAAiB;IACxF,MAAM,IAAI,GAAa,MAAM,IAAI,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IACxE,MAAM,CAAC,GAAG,QAAQ,EAAE,CAAC;IACrB,+FAA+F;IAC/F,mGAAmG;IACnG,oGAAoG;IACpG,+FAA+F;IAC/F,2DAA2D;IAC3D,kGAAkG;IAClG,8FAA8F;IAC9F,8FAA8F;IAC9F,8FAA8F;IAC9F,MAAM,aAAa,GAAG,KAAK,IAAmB,EAAE;QAC9C,MAAM,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3B,MAAM,UAAU,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;IAChD,CAAC,CAAC;IACF,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;QACnB,MAAM,UAAU,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,4CAA4C;QAC3F,OAAO;IACT,CAAC;IACD,MAAM,GAAG,GAAG,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3C,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;YACf,MAAM,aAAa,EAAE,CAAC,CAAC,uCAAuC;YAC9D,OAAO;QACT,CAAC;QACD,+FAA+F;QAC/F,yEAAyE;QACzE,MAAM,IAAI,KAAK,CACb,2BAA2B,CAAC,uBAAuB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,+DAA+D;YACnI,0FAA0F;YAC1F,iEAAiE,CACpE,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,MAAM,aAAa,EAAE,CAAC;QACtB,OAAO;IACT,CAAC;IACD,IAAI,MAAM,KAAK,SAAS;QACtB,MAAM,IAAI,KAAK,CACb,6CAA6C,GAAG,sHAAsH;YACpK,yJAAyJ;YACzJ,6BAA6B,GAAG,4EAA4E,CAC/G,CAAC;IACJ,IAAI,CAAC;QACH,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IACvB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,GAAI,CAA2B,CAAC,IAAI,CAAC;QAC/C,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YACrB,MAAM,aAAa,EAAE,CAAC,CAAC,yCAAyC;YAChE,OAAO;QACT,CAAC;QACD,MAAM,IAAI,KAAK,CACb,6CAA6C,GAAG,+BAA+B,IAAI,IAAI,eAAe,MAAM;YAC1G,yIAAyI;YACzI,8FAA8F,CACjG,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC;IACrC,OAAO,KAAK,CAAC,GAAG,CAAC,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ;QAAE,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IACpG,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,MAAM;QACvB,MAAM,IAAI,KAAK,CACb,4BAA4B,GAAG,sJAAsJ,CACtL,CAAC;IACJ,MAAM,aAAa,EAAE,CAAC;AACxB,CAAC;AAED;;;;+FAI+F;AAC/F,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAAU,EAAE;IACnD,MAAM,8BAA8B,EAAE,CAAC;IACvC,MAAM,cAAc,CAAC,CAAC,CAAC,CAAC;IACxB,OAAO,aAAa,CAAC,CAAC,CAAC,CAAC;AAC1B,CAAC"}

package/dist/lib/manager-proc.d.ts

@@ -1,4 +1,19 @@
-/** True if the manager we started for this folder is still running (pid file + liveness). */
+import { type LivenessProbe } from "@cotal-ai/workspace";
+/** Exported so the delivery cutover preflight can NAME the pid it refused on: an error that says
+ *  "cannot be attributed" without saying which pid is not actionable. */
+export declare const MANAGER_PID_PATH: () => string;
+/** The recorded manager's liveness, THREE-VALUED plus absent, because collapsing it to a boolean is
+ *  what made this dangerous. Both collapses are silent and both are wrong:
+ *    `!== "dead"`  -> an `unknown` reports UP forever; no retry clears it and nothing starts.
+ *    `=== "alive"` -> an `unknown` reports DOWN and a second manager launches onto a possibly-live one.
+ *  `unknown` is REACHABLE on a real kernel, not just under a test shim: a Linux seccomp filter
+ *  (`SECCOMP_RET_ERRNO`) or an LSM policy can return an arbitrary errno for `kill(pid, 0)` without
+ *  executing it at all, and libuv preserves it. Proven with a live seccomp BPF filter, not by
+ *  interposition. So the caller has to SEE the third state and refuse. */
+export declare function managerLiveness(probe?: LivenessProbe): "alive" | "dead" | "unknown" | "absent" | "unattributable";
+/** True only if the manager is PROVABLY running. `unknown` is not up, and callers that would ACT on
+ *  that answer must use {@link managerLiveness} instead: this boolean cannot express the difference
+ *  between "not running" and "cannot tell", and acting on the difference is the whole point. */
 export declare function managerUp(): boolean;
 /** True if the live manager carries a delivery-aware marker BOUND to its current pid (i.e. it's THIS
  *  build, non-hosting). Fail-closed: the marker stores the pid it was written for, and this requires it
@@ -20,11 +35,20 @@ export declare function startManagerDetached(o?: {
     attachHost?: string;
     resumeAttempt?: string;
     resumeCommitToken?: string;
+    wsPort?: number;
 }): number;
 /** Make the control plane available: reuse a manager already running for this folder, else start
  *  one detached. Best-effort — callers treat it as non-fatal. A caller that needs THE manager to
  *  carry a runtime/launch spec (`up -f`) must stop any leftover manager first — a reused one is
  *  taken as-is. */
+/** Refuse to stand a manager up OVER a record we cannot read or attribute.
+ *
+ *  Exported because `ensureManager` is not the only path that starts one: `cotal spawn -f` calls
+ *  `startManagerDetached` directly after its own lease checks, and so skipped this entirely. A lease
+ *  says nobody is ANSWERING; it does not say the recorded pid is dead. Overwriting an unknown or
+ *  unattributable record is the same defect as deleting it, reached through a different verb, which
+ *  is the third time that shape has appeared in this change. Any future starter calls this first. */
+export declare function assertManagerRecordReplaceable(probe?: LivenessProbe): void;
 export declare function ensureManager(o?: {
     space?: string;
     server?: string;
@@ -34,10 +58,29 @@ export declare function ensureManager(o?: {
     attachHost?: string;
     resumeAttempt?: string;
     resumeCommitToken?: string;
-}): {
+    wsPort?: number;
+}, probe?: LivenessProbe): {
     running: boolean;
 };
-/** Stop the detached (pty) manager if we started one. Used when switching to the cmux-tab manager
- *  so the two don't both answer the control plane (queue-grouped requests would split between them). */
-export declare function stopManager(): void;
+/** A signal, injectable for the same reason the probe is: `EPERM` from `kill` is producible only by
+ *  another user's process or by kernel policy, so the branch that handles it is otherwise unreachable
+ *  from a test. Production passes nothing. */
+export type SignalFn = (pid: number, signal: NodeJS.Signals) => void;
+/** What a stop actually achieved, because "void" let this function claim success it had not earned. */
+export type StopVerdict = "stopped" | "already-gone";
+/** Blocking sleep. DO NOT reintroduce this for death-waiting: it blocks the event loop, so a child
+ *  of this process is never reaped, remains a signalable zombie, and reads `alive` forever. That
+ *  turned `cotal up` + Ctrl-C into an exit-1 that left the broker running. Death-waits await. */
+/** Stop the detached (pty) manager if we started one, and remove its records ONLY once it is gone.
+ *
+ *  THIS USED TO CATCH EVERY SIGNAL FAILURE AS "already gone" AND DELETE THE RECORDS ANYWAY. That was
+ *  survivable while `EPERM` was misread as dead, because the caller never got here: the cutover
+ *  preflight skipped a manager it thought was not running. Resolving `EPERM` to `alive` (the fix this
+ *  change exists for) makes the preflight recognise ANOTHER USER's live manager and call this, at
+ *  which point the old code sent a signal it was not permitted to send, swallowed the refusal, and
+ *  deleted the pidfile and marker of a process that was still running and still bound to Plane 3.
+ *  A correct fix upstream reaching a latent destructive bug downstream is the worst shape available,
+ *  so this refuses instead: records are removed only on proven death, never on a signal we could not
+ *  send or a death we could not confirm. Found by review, with a kernel seccomp proof. */
+export declare function stopManager(probe?: LivenessProbe, signal?: SignalFn | undefined): Promise<StopVerdict>;
 //# sourceMappingURL=manager-proc.d.ts.map

package/dist/lib/manager-proc.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"manager-proc.d.ts","sourceRoot":"","sources":["../../src/lib/manager-proc.ts"],"names":[],"mappings":"AAwBA,6FAA6F;AAC7F,wBAAgB,SAAS,IAAI,OAAO,CAKnC;AAED;;;;2CAI2C;AAC3C,wBAAgB,wBAAwB,IAAI,OAAO,CAOlD;AAED;;;;0FAI0F;AAC1F,wBAAgB,oBAAoB,CAClC,CAAC,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAAO,GACxK,MAAM,CAwCR;AAED;;;mBAGmB;AACnB,wBAAgB,aAAa,CAC3B,CAAC,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAAO,GACxK;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,CAItB;AAED;wGACwG;AACxG,wBAAgB,WAAW,IAAI,IAAI,CAalC"}
+{"version":3,"file":"manager-proc.d.ts","sourceRoot":"","sources":["../../src/lib/manager-proc.ts"],"names":[],"mappings":"AAMA,OAAO,EAA2B,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAElF;yEACyE;AACzE,eAAO,MAAM,gBAAgB,QAAO,MAAkC,CAAC;AASvE;;;;;;;0EAO0E;AAC1E,wBAAgB,eAAe,CAAC,KAAK,GAAE,aAA6B,GAAG,OAAO,GAAG,MAAM,GAAG,SAAS,GAAG,QAAQ,GAAG,gBAAgB,CAYhI;AAED;;gGAEgG;AAChG,wBAAgB,SAAS,IAAI,OAAO,CAEnC;AAID;;;;2CAI2C;AAC3C,wBAAgB,wBAAwB,IAAI,OAAO,CAOlD;AAED;;;;0FAI0F;AAC1F,wBAAgB,oBAAoB,CAClC,CAAC,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAO,GACzL,MAAM,CA0CR;AAED;;;mBAGmB;AACnB;;;;;;qGAMqG;AACrG,wBAAgB,8BAA8B,CAAC,KAAK,GAAE,aAA6B,GAAG,IAAI,CAczF;AAED,wBAAgB,aAAa,CAC3B,CAAC,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAO,EAC1L,KAAK,GAAE,aAA6B,GACnC;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,CAMtB;AAED;;8CAE8C;AAC9C,MAAM,MAAM,QAAQ,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,KAAK,IAAI,CAAC;AAErE,uGAAuG;AACvG,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,cAAc,CAAC;AAErD;;iGAEiG;AAGjG;;;;;;;;;;0FAU0F;AAC1F,wBAAsB,WAAW,CAAC,KAAK,GAAE,aAA6B,EAAE,MAAM,GAAE,QAAQ,GAAG,SAAqB,GAAG,OAAO,CAAC,WAAW,CAAC,CAsEtI"}

package/dist/lib/manager-proc.js

@@ -4,29 +4,46 @@ import { DEFAULT_SERVER } from "@cotal-ai/core";
 import { selfArgv } from "./self-exec.js";
 import { resolveSpace } from "./status.js";
 import { cotalPath } from "./paths.js";
-const PID_PATH = () => cotalPath("manager.pid");
+import { parsePid, probeLiveness } from "@cotal-ai/workspace";
+/** Exported so the delivery cutover preflight can NAME the pid it refused on: an error that says
+ *  "cannot be attributed" without saying which pid is not actionable. */
+export const MANAGER_PID_PATH = () => cotalPath("manager.pid");
+const PID_PATH = MANAGER_PID_PATH;
 /** Sibling marker of `manager.pid`: written by THIS build's manager (which no longer hosts Plane-3 —
  *  the server-side delivery daemon does). Its presence beside a live `manager.pid` proves the manager is
  *  "delivery-aware" / non-hosting. A live `manager.pid` WITHOUT this marker is an OLD (pre-delivery-daemon)
  *  manager that still calls `startPlane3` — the delivery preflight stops it before the daemon binds, so an
  *  old hosting manager never double-binds `fanout`/`reader` against the new daemon. */
 const DELIVERY_AWARE_MARKER = () => cotalPath("manager.delivery-aware");
-function alive(pid) {
-    try {
-        process.kill(pid, 0); // signal 0: liveness probe, doesn't actually signal
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
-/** True if the manager we started for this folder is still running (pid file + liveness). */
-export function managerUp() {
+/** The recorded manager's liveness, THREE-VALUED plus absent, because collapsing it to a boolean is
+ *  what made this dangerous. Both collapses are silent and both are wrong:
+ *    `!== "dead"`  -> an `unknown` reports UP forever; no retry clears it and nothing starts.
+ *    `=== "alive"` -> an `unknown` reports DOWN and a second manager launches onto a possibly-live one.
+ *  `unknown` is REACHABLE on a real kernel, not just under a test shim: a Linux seccomp filter
+ *  (`SECCOMP_RET_ERRNO`) or an LSM policy can return an arbitrary errno for `kill(pid, 0)` without
+ *  executing it at all, and libuv preserves it. Proven with a live seccomp BPF filter, not by
+ *  interposition. So the caller has to SEE the third state and refuse. */
+export function managerLiveness(probe = probeLiveness) {
     const p = PID_PATH();
     if (!existsSync(p))
-        return false;
-    const pid = Number(readFileSync(p, "utf8").trim());
-    return Number.isFinite(pid) && alive(pid);
+        return "absent";
+    const raw = readFileSync(p, "utf8").trim();
+    if (raw === "")
+        return "absent"; // a pre-protocol husk: nothing is behind it
+    const pid = parsePid(raw);
+    // NOT `absent`. Folding non-empty corrupt content into "no manager recorded" is what let the
+    // ensure paths OVERWRITE it and launch a replacement, which is the same defect as deleting it:
+    // that record may front a live process nobody can identify. `absent` means no pidfile (or an
+    // empty husk); corrupt content is its own state and every action path must refuse on it.
+    if (pid === undefined)
+        return "unattributable";
+    return probe(pid);
+}
+/** True only if the manager is PROVABLY running. `unknown` is not up, and callers that would ACT on
+ *  that answer must use {@link managerLiveness} instead: this boolean cannot express the difference
+ *  between "not running" and "cannot tell", and acting on the difference is the whole point. */
+export function managerUp() {
+    return managerLiveness() === "alive";
 }
 /** True if the live manager carries a delivery-aware marker BOUND to its current pid (i.e. it's THIS
  *  build, non-hosting). Fail-closed: the marker stores the pid it was written for, and this requires it
@@ -79,6 +96,8 @@ export function startManagerDetached(o = {}) {
         ...(o.launch ? ["--launch", o.launch] : []),
         ...(o.resumeAttempt ? ["--resume-attempt", o.resumeAttempt] : []),
         ...(o.resumeCommitToken ? ["--resume-commit-token", o.resumeCommitToken] : []),
+        // P2 item 6: the broker ws listener port (loopback) for the console session client's wsUrl.
+        ...(o.wsPort !== undefined ? ["--ws-port", String(o.wsPort)] : []),
     ];
     // This is an INTERNAL child re-exec: the `up`/`spawn` that reached here already ran the first-run
     // connector seed, so the manager skips it on boot (a direct `cotal supervise` still seeds).
@@ -95,28 +114,110 @@ export function startManagerDetached(o = {}) {
  *  one detached. Best-effort — callers treat it as non-fatal. A caller that needs THE manager to
  *  carry a runtime/launch spec (`up -f`) must stop any leftover manager first — a reused one is
  *  taken as-is. */
-export function ensureManager(o = {}) {
-    if (managerUp())
+/** Refuse to stand a manager up OVER a record we cannot read or attribute.
+ *
+ *  Exported because `ensureManager` is not the only path that starts one: `cotal spawn -f` calls
+ *  `startManagerDetached` directly after its own lease checks, and so skipped this entirely. A lease
+ *  says nobody is ANSWERING; it does not say the recorded pid is dead. Overwriting an unknown or
+ *  unattributable record is the same defect as deleting it, reached through a different verb, which
+ *  is the third time that shape has appeared in this change. Any future starter calls this first. */
+export function assertManagerRecordReplaceable(probe = probeLiveness) {
+    const state = managerLiveness(probe);
+    if (state === "unattributable")
+        throw new Error(`the manager pidfile at ${PID_PATH()} holds content that is not a pid (${JSON.stringify(readFileSync(PID_PATH(), "utf8").trim())}).\n` +
+            `Refusing to start a manager over it: that record may front a live process nobody can identify, and overwriting it would orphan the process while reporting a healthy control plane.\n` +
+            `NEXT: find and stop that process, then remove \`.cotal/manager.pid\` by hand.`);
+    if (state === "unknown")
+        throw new Error(`the recorded manager pid (${readFileSync(PID_PATH(), "utf8").trim()}) cannot be attributed: the kernel answered neither "running" nor "no such process" (a seccomp filter or LSM policy does this inside some sandboxes).\n` +
+            `Refusing to start a manager over it: it may still be running and bound to the control plane.\n` +
+            `NEXT: verify with \`ps -p <pid>\`. If it is gone, remove \`.cotal/manager.pid\` and re-run.`);
+}
+export function ensureManager(o = {}, probe = probeLiveness) {
+    const state = managerLiveness(probe);
+    if (state === "alive")
         return { running: true };
+    assertManagerRecordReplaceable(probe); // refuses on unknown / unattributable
     startManagerDetached(o);
     return { running: true };
 }
-/** Stop the detached (pty) manager if we started one. Used when switching to the cmux-tab manager
- *  so the two don't both answer the control plane (queue-grouped requests would split between them). */
-export function stopManager() {
+/** Blocking sleep. DO NOT reintroduce this for death-waiting: it blocks the event loop, so a child
+ *  of this process is never reaped, remains a signalable zombie, and reads `alive` forever. That
+ *  turned `cotal up` + Ctrl-C into an exit-1 that left the broker running. Death-waits await. */
+// (sleepSync removed: see above.)
+/** Stop the detached (pty) manager if we started one, and remove its records ONLY once it is gone.
+ *
+ *  THIS USED TO CATCH EVERY SIGNAL FAILURE AS "already gone" AND DELETE THE RECORDS ANYWAY. That was
+ *  survivable while `EPERM` was misread as dead, because the caller never got here: the cutover
+ *  preflight skipped a manager it thought was not running. Resolving `EPERM` to `alive` (the fix this
+ *  change exists for) makes the preflight recognise ANOTHER USER's live manager and call this, at
+ *  which point the old code sent a signal it was not permitted to send, swallowed the refusal, and
+ *  deleted the pidfile and marker of a process that was still running and still bound to Plane 3.
+ *  A correct fix upstream reaching a latent destructive bug downstream is the worst shape available,
+ *  so this refuses instead: records are removed only on proven death, never on a signal we could not
+ *  send or a death we could not confirm. Found by review, with a kernel seccomp proof. */
+export async function stopManager(probe = probeLiveness, signal = undefined) {
+    const send = signal ?? ((pid, sig) => process.kill(pid, sig));
     const p = PID_PATH();
-    rmSync(DELIVERY_AWARE_MARKER(), { force: true }); // drop the marker with the pid (gone either way)
-    if (!existsSync(p))
-        return;
-    const pid = Number(readFileSync(p, "utf8").trim());
-    if (Number.isFinite(pid)) {
-        try {
-            process.kill(pid, "SIGTERM");
+    const marker = DELIVERY_AWARE_MARKER();
+    const clear = () => {
+        rmSync(marker, { force: true });
+        rmSync(p, { force: true });
+    };
+    if (!existsSync(p)) {
+        rmSync(marker, { force: true }); // a marker with no pid records nothing
+        return "already-gone";
+    }
+    const raw = readFileSync(p, "utf8").trim();
+    const pid = parsePid(raw);
+    if (pid === undefined) {
+        // An EMPTY pidfile is a pre-protocol husk with nothing behind it, and clearing it is safe. ANY
+        // OTHER unattributable content (garbled, fractional, out of range) may still front a LIVE
+        // process we cannot identify or signal, so removing it would orphan that process while
+        // reporting a clean stop. The contract at the top of pid.ts says such content is never a pid to
+        // delete a record against; this is that rule at the destructive end, matching down.ts:298-311
+        // and stopAuthService, which already refuse. My first version cleared it.
+        if (raw === "") {
+            clear();
+            return "already-gone";
         }
-        catch {
-            /* already gone */
+        throw new Error(`the manager pidfile at ${p} is unattributable (${JSON.stringify(raw)}): it may still front a running process nobody can identify.\n` +
+            `Refusing to remove it or report a clean stop; the delivery-aware marker is preserved with it.\n` +
+            `NEXT: find and stop that process, then remove the file by hand.`);
+    }
+    const before = probe(pid);
+    if (before === "dead") {
+        clear();
+        return "already-gone";
+    }
+    if (before === "unknown")
+        throw new Error(`refusing to stop manager pid ${pid}: its liveness cannot be determined (the kernel answered neither "running" nor "no such process"; a seccomp filter or LSM policy does this).\n` +
+            `The pidfile and delivery-aware marker are LEFT IN PLACE: deleting them would orphan a process that may still be bound to the control plane.\n` +
+            `NEXT: verify with \`ps -p ${pid}\`, then stop it yourself or remove \`.cotal/manager.pid\` if it is gone.`);
+    try {
+        send(pid, "SIGTERM");
+    }
+    catch (e) {
+        const code = e.code;
+        if (code === "ESRCH") {
+            clear(); // died between the probe and the signal, which is an ordinary race and genuinely gone
+            return "already-gone";
         }
+        throw new Error(`refusing to stop manager pid ${pid}: the signal was rejected (${code ?? "unknown error"}).\n` +
+            `EPERM here means the process belongs to another user, so it is running and NOT ours to stop. The pidfile and marker are LEFT IN PLACE.\n` +
+            `NEXT: stop it as its owner, or remove \`.cotal/manager.pid\` if you are certain it is gone.`);
     }
-    rmSync(p);
+    // The signal was accepted, which is not the same as the process being gone. Prove it before
+    // removing the record, bounded, because a record deleted while its process lives is the defect.
+    // AWAIT, never a blocking sleep: this process spawned the manager, so the event loop must run
+    // for it to be reaped. A blocked loop leaves a zombie that still answers kill(pid,0).
+    for (let i = 0; i < 40 && probe(pid) === "alive"; i++)
+        await new Promise((r) => setTimeout(r, 50));
+    const after = probe(pid);
+    if (after !== "dead")
+        throw new Error(`manager pid ${pid} accepted SIGTERM but was still ${after === "alive" ? "running" : "unattributable"} after 2s.\n` +
+            `The pidfile and marker are LEFT IN PLACE rather than recording a stop that did not happen.\n` +
+            `NEXT: check \`ps -p ${pid}\` and stop it directly if it is wedged.`);
+    clear();
+    return "stopped";
 }
 //# sourceMappingURL=manager-proc.js.map

package/dist/lib/manager-proc.js.map

@@ -1 +1 @@
-{"version":3,"file":"manager-proc.js","sourceRoot":"","sources":["../../src/lib/manager-proc.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC1G,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEvC,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;AAChD;;;;uFAIuF;AACvF,MAAM,qBAAqB,GAAG,GAAG,EAAE,CAAC,SAAS,CAAC,wBAAwB,CAAC,CAAC;AAExE,SAAS,KAAK,CAAC,GAAW;IACxB,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,oDAAoD;QAC1E,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,SAAS;IACvB,MAAM,CAAC,GAAG,QAAQ,EAAE,CAAC;IACrB,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACjC,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACnD,OAAO,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC;AAC5C,CAAC;AAED;;;;2CAI2C;AAC3C,MAAM,UAAU,wBAAwB;IACtC,MAAM,UAAU,GAAG,qBAAqB,EAAE,CAAC;IAC3C,MAAM,OAAO,GAAG,QAAQ,EAAE,CAAC;IAC3B,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IAClE,MAAM,SAAS,GAAG,MAAM,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAClE,MAAM,OAAO,GAAG,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7D,OAAO,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,SAAS,KAAK,OAAO,CAAC;AACzF,CAAC;AAED;;;;0FAI0F;AAC1F,MAAM,UAAU,oBAAoB,CAClC,IAAuK,EAAE;IAEzK,4FAA4F;IAC5F,iGAAiG;IACjG,gGAAgG;IAChG,qEAAqE;IACrE,MAAM,EAAE,GAAG,QAAQ,CAAC,SAAS,CAAC,aAAa,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IAC1D,iGAAiG;IACjG,+FAA+F;IAC/F,8FAA8F;IAC9F,yCAAyC;IACzC,IAAI,CAAC;QAAC,SAAS,CAAC,SAAS,CAAC,aAAa,CAAC,EAAE,KAAK,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,gDAAgD,CAAC,CAAC;IAC9G,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,QAAQ,EAAE,CAAC;IACnC,MAAM,IAAI,GAAG;QACX,GAAG,IAAI;QACP,WAAW;QACX,SAAS;QACT,CAAC,CAAC,KAAK,IAAI,YAAY,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QACtC,UAAU;QACV,CAAC,CAAC,MAAM,IAAI,cAAc;QAC1B,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,0FAA0F;QAC1F,gGAAgG;QAChG,mGAAmG;QACnG,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,mGAAmG;QACnG,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,kBAAkB,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,GAAG,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,uBAAuB,EAAE,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/E,CAAC;IACF,kGAAkG;IAClG,4FAA4F;IAC5F,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,yBAAyB,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACxI,SAAS,CAAC,EAAE,CAAC,CAAC;IACd,KAAK,CAAC,KAAK,EAAE,CAAC;IACd,aAAa,CAAC,QAAQ,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7C,qGAAqG;IACrG,mGAAmG;IACnG,aAAa,CAAC,qBAAqB,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,OAAO,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC;AACxB,CAAC;AAED;;;mBAGmB;AACnB,MAAM,UAAU,aAAa,CAC3B,IAAuK,EAAE;IAEzK,IAAI,SAAS,EAAE;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC1C,oBAAoB,CAAC,CAAC,CAAC,CAAC;IACxB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED;wGACwG;AACxG,MAAM,UAAU,WAAW;IACzB,MAAM,CAAC,GAAG,QAAQ,EAAE,CAAC;IACrB,MAAM,CAAC,qBAAqB,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,iDAAiD;IACnG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO;IAC3B,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACnD,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,kBAAkB;QACpB,CAAC;IACH,CAAC;IACD,MAAM,CAAC,CAAC,CAAC,CAAC;AACZ,CAAC"}
+{"version":3,"file":"manager-proc.js","sourceRoot":"","sources":["../../src/lib/manager-proc.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC1G,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAsB,MAAM,qBAAqB,CAAC;AAElF;yEACyE;AACzE,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAW,EAAE,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;AACvE,MAAM,QAAQ,GAAG,gBAAgB,CAAC;AAClC;;;;uFAIuF;AACvF,MAAM,qBAAqB,GAAG,GAAG,EAAE,CAAC,SAAS,CAAC,wBAAwB,CAAC,CAAC;AAExE;;;;;;;0EAO0E;AAC1E,MAAM,UAAU,eAAe,CAAC,QAAuB,aAAa;IAClE,MAAM,CAAC,GAAG,QAAQ,EAAE,CAAC;IACrB,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO,QAAQ,CAAC;IACpC,MAAM,GAAG,GAAG,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3C,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,QAAQ,CAAC,CAAC,4CAA4C;IAC7E,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC1B,6FAA6F;IAC7F,+FAA+F;IAC/F,6FAA6F;IAC7F,yFAAyF;IACzF,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,gBAAgB,CAAC;IAC/C,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC;AACpB,CAAC;AAED;;gGAEgG;AAChG,MAAM,UAAU,SAAS;IACvB,OAAO,eAAe,EAAE,KAAK,OAAO,CAAC;AACvC,CAAC;AAID;;;;2CAI2C;AAC3C,MAAM,UAAU,wBAAwB;IACtC,MAAM,UAAU,GAAG,qBAAqB,EAAE,CAAC;IAC3C,MAAM,OAAO,GAAG,QAAQ,EAAE,CAAC;IAC3B,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IAClE,MAAM,SAAS,GAAG,MAAM,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAClE,MAAM,OAAO,GAAG,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7D,OAAO,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,SAAS,KAAK,OAAO,CAAC;AACzF,CAAC;AAED;;;;0FAI0F;AAC1F,MAAM,UAAU,oBAAoB,CAClC,IAAwL,EAAE;IAE1L,4FAA4F;IAC5F,iGAAiG;IACjG,gGAAgG;IAChG,qEAAqE;IACrE,MAAM,EAAE,GAAG,QAAQ,CAAC,SAAS,CAAC,aAAa,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IAC1D,iGAAiG;IACjG,+FAA+F;IAC/F,8FAA8F;IAC9F,yCAAyC;IACzC,IAAI,CAAC;QAAC,SAAS,CAAC,SAAS,CAAC,aAAa,CAAC,EAAE,KAAK,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,gDAAgD,CAAC,CAAC;IAC9G,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,QAAQ,EAAE,CAAC;IACnC,MAAM,IAAI,GAAG;QACX,GAAG,IAAI;QACP,WAAW;QACX,SAAS;QACT,CAAC,CAAC,KAAK,IAAI,YAAY,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QACtC,UAAU;QACV,CAAC,CAAC,MAAM,IAAI,cAAc;QAC1B,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,0FAA0F;QAC1F,gGAAgG;QAChG,mGAAmG;QACnG,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,mGAAmG;QACnG,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,kBAAkB,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,GAAG,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,uBAAuB,EAAE,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9E,4FAA4F;QAC5F,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KACnE,CAAC;IACF,kGAAkG;IAClG,4FAA4F;IAC5F,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,yBAAyB,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACxI,SAAS,CAAC,EAAE,CAAC,CAAC;IACd,KAAK,CAAC,KAAK,EAAE,CAAC;IACd,aAAa,CAAC,QAAQ,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7C,qGAAqG;IACrG,mGAAmG;IACnG,aAAa,CAAC,qBAAqB,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,OAAO,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC;AACxB,CAAC;AAED;;;mBAGmB;AACnB;;;;;;qGAMqG;AACrG,MAAM,UAAU,8BAA8B,CAAC,QAAuB,aAAa;IACjF,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,KAAK,KAAK,gBAAgB;QAC5B,MAAM,IAAI,KAAK,CACb,0BAA0B,QAAQ,EAAE,qCAAqC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM;YACpI,uLAAuL;YACvL,+EAA+E,CAClF,CAAC;IACJ,IAAI,KAAK,KAAK,SAAS;QACrB,MAAM,IAAI,KAAK,CACb,6BAA6B,YAAY,CAAC,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,yJAAyJ;YAC3N,gGAAgG;YAChG,6FAA6F,CAChG,CAAC;AACN,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,IAAwL,EAAE,EAC1L,QAAuB,aAAa;IAEpC,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,KAAK,KAAK,OAAO;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAChD,8BAA8B,CAAC,KAAK,CAAC,CAAC,CAAC,sCAAsC;IAC7E,oBAAoB,CAAC,CAAC,CAAC,CAAC;IACxB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAUD;;iGAEiG;AACjG,kCAAkC;AAElC;;;;;;;;;;0FAU0F;AAC1F,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,QAAuB,aAAa,EAAE,SAA+B,SAAS;IAC9G,MAAM,IAAI,GAAa,MAAM,IAAI,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IACxE,MAAM,CAAC,GAAG,QAAQ,EAAE,CAAC;IACrB,MAAM,MAAM,GAAG,qBAAqB,EAAE,CAAC;IACvC,MAAM,KAAK,GAAG,GAAS,EAAE;QACvB,MAAM,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAChC,MAAM,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7B,CAAC,CAAC;IACF,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;QACnB,MAAM,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,uCAAuC;QACxE,OAAO,cAAc,CAAC;IACxB,CAAC;IACD,MAAM,GAAG,GAAG,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3C,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,+FAA+F;QAC/F,0FAA0F;QAC1F,uFAAuF;QACvF,gGAAgG;QAChG,8FAA8F;QAC9F,0EAA0E;QAC1E,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;YACf,KAAK,EAAE,CAAC;YACR,OAAO,cAAc,CAAC;QACxB,CAAC;QACD,MAAM,IAAI,KAAK,CACb,0BAA0B,CAAC,uBAAuB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,gEAAgE;YACnI,iGAAiG;YACjG,iEAAiE,CACpE,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,KAAK,EAAE,CAAC;QACR,OAAO,cAAc,CAAC;IACxB,CAAC;IACD,IAAI,MAAM,KAAK,SAAS;QACtB,MAAM,IAAI,KAAK,CACb,gCAAgC,GAAG,gJAAgJ;YACjL,+IAA+I;YAC/I,6BAA6B,GAAG,2EAA2E,CAC9G,CAAC;IACJ,IAAI,CAAC;QACH,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IACvB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,GAAI,CAA2B,CAAC,IAAI,CAAC;QAC/C,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YACrB,KAAK,EAAE,CAAC,CAAC,sFAAsF;YAC/F,OAAO,cAAc,CAAC;QACxB,CAAC;QACD,MAAM,IAAI,KAAK,CACb,gCAAgC,GAAG,8BAA8B,IAAI,IAAI,eAAe,MAAM;YAC5F,0IAA0I;YAC1I,6FAA6F,CAChG,CAAC;IACJ,CAAC;IACD,4FAA4F;IAC5F,gGAAgG;IAChG,8FAA8F;IAC9F,sFAAsF;IACtF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,OAAO,EAAE,CAAC,EAAE;QAAE,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IACnG,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,IAAI,KAAK,KAAK,MAAM;QAClB,MAAM,IAAI,KAAK,CACb,eAAe,GAAG,mCAAmC,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAgB,cAAc;YACjH,8FAA8F;YAC9F,uBAAuB,GAAG,0CAA0C,CACvE,CAAC;IACJ,KAAK,EAAE,CAAC;IACR,OAAO,SAAS,CAAC;AACnB,CAAC"}