@ctrl-spc/cs 0.7.13 → 0.7.15

package/dist/daemon-processes.js

@@ -0,0 +1,756 @@
+import { randomUUID } from 'node:crypto';
+import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { readOperation } from './daemon-lock.js';
+import { lifecycleDir } from './config.js';
+import { getOwnedProcessIdentity, inspectProcessTree, inspectWindowsJob, terminateOwnedTree, windowsJobName, validMacCoalition } from './win-shell.js';
+let context = null;
+let admitting = true;
+let forcedOperationId = null;
+const claims = new Set();
+const liveRpcClaims = new Set();
+const claimWaiters = new Set();
+const admissionWaiters = new Set();
+const handles = new Map();
+const creating = new Set();
+function path() { return join(lifecycleDir(), 'owned-work.json'); }
+function record(value) { return !!value && typeof value === 'object' && !Array.isArray(value); }
+function identity(value) {
+    return record(value) && Number.isInteger(value.pid) && value.pid > 0
+        && Number.isInteger(value.ppid) && typeof value.owner === 'string'
+        && typeof value.birth === 'string' && typeof value.commandHash === 'string'
+        && (value.pgid === undefined || Number.isInteger(value.pgid) && value.pgid > 0)
+        && (value.windowsJob === undefined || typeof value.windowsJob === 'string')
+        && (value.macCoalition === undefined || validMacCoalition(value.macCoalition))
+        && (value.macProcessVersion === undefined || Number.isInteger(value.macProcessVersion) && value.macProcessVersion > 0);
+}
+function reference(value) {
+    if (!record(value))
+        return false;
+    const ids = (v) => v === null || Array.isArray(v) && v.every((id) => typeof id === 'string');
+    if (value.surface === 'panel')
+        return typeof value.runId === 'string' && typeof value.cardId === 'string'
+            && (value.processToken === null || typeof value.processToken === 'string') && typeof value.startedAt === 'string'
+            && (value.resumedAt === null || typeof value.resumedAt === 'string') && ids(value.observedPendingTurnIds)
+            && (value.pid === undefined || value.pid === null || Number.isInteger(value.pid) && value.pid > 0);
+    if (value.surface === 'worker')
+        return typeof value.todoId === 'string' && (value.workerId === null || typeof value.workerId === 'string')
+            && typeof value.claimedAt === 'string' && ids(value.observedPendingMessageIds);
+    if (value.surface === 'reply')
+        return typeof value.todoId === 'string' && ids(value.observedPendingMessageIds)
+            && Array.isArray(value.messageLeases) && value.messageLeases.every((v) => record(v) && typeof v.id === 'string' && typeof v.taken_at === 'string')
+            && Array.isArray(value.grantLeases) && value.grantLeases.every((v) => record(v) && typeof v.id === 'string' && typeof v.resume_taken_at === 'string');
+    return false;
+}
+function readStore() {
+    if (!existsSync(path()))
+        return { version: 1, entries: [], legacy: [] };
+    const value = JSON.parse(readFileSync(path(), 'utf8'));
+    if (!record(value) || (value.legacyBootstrap !== undefined && typeof value.legacyBootstrap !== 'boolean') || (value.rpcClaims !== undefined && (!Array.isArray(value.rpcClaims) || !value.rpcClaims.every((row) => record(row) && typeof row.id === 'string' && ['panel', 'cli'].includes(String(row.surface)) && typeof row.action === 'string' && typeof row.accountId === 'string' && typeof row.machineId === 'string' && typeof row.instanceNonce === 'string'))) || value.version !== 1 || !Array.isArray(value.entries) || !Array.isArray(value.legacy)
+        || !value.entries.every((entry) => record(entry) && typeof entry.id === 'string'
+            && typeof entry.accountId === 'string' && typeof entry.machineId === 'string' && typeof entry.instanceNonce === 'string'
+            && (entry.harness === null || typeof entry.harness === 'string') && (entry.reference === null || reference(entry.reference))
+            && (entry.process === null || identity(entry.process)) && Array.isArray(entry.descendants) && entry.descendants.every(identity)
+            && ['pending', 'running', 'exited'].includes(String(entry.state))
+            && (entry.rpcId === undefined || typeof entry.rpcId === 'string')
+            && (entry.unstarted === undefined || typeof entry.unstarted === 'boolean')
+            && (entry.spawning === undefined || typeof entry.spawning === 'boolean')
+            && (entry.gatedCreation === undefined || typeof entry.gatedCreation === 'boolean')
+            && (entry.windowsJob === undefined || typeof entry.windowsJob === 'string')
+            && (entry.rawPid === undefined || Number.isInteger(entry.rawPid) && entry.rawPid > 0)
+            && (entry.preparationFailure === undefined || record(entry.preparationFailure)
+                && typeof entry.preparationFailure.reason === 'string' && [1, 2, 3].includes(Number(entry.preparationFailure.level))
+                && record(entry.reference) && entry.reference.surface === 'panel')
+            && (entry.interruption === null || record(entry.interruption) && typeof entry.interruption.operationId === 'string' && typeof entry.interruption.interruptedAt === 'string'))
+        || !value.legacy.every((item) => record(item) && typeof item.accountId === 'string' && typeof item.machineId === 'string'
+            && typeof item.complete === 'boolean' && (item.panelComplete === undefined || typeof item.panelComplete === 'boolean') && Array.isArray(item.holds)
+            && item.holds.every((hold) => record(hold) && typeof hold.todoId === 'string'
+                && Array.isArray(hold.messageIds) && hold.messageIds.every((id) => typeof id === 'string')
+                && Array.isArray(hold.messageSources) && hold.messageSources.every((source) => record(source) && typeof source.id === 'string' && typeof source.taken_at === 'string')
+                && Array.isArray(hold.permissionSources) && hold.permissionSources.every((source) => record(source) && typeof source.id === 'string' && typeof source.state === 'string' && (source.consumed_at === null || typeof source.consumed_at === 'string'))))) {
+        throw new Error('Owned execution records are incomplete. Work remains protected; inspect the local lifecycle record.');
+    }
+    const store = value;
+    const intents = readIntents();
+    for (const entry of store.entries) {
+        if (!entry.preparationFailure)
+            entry.interruption ??= intents[entry.id] ?? intents[`instance:${entry.instanceNonce}`] ?? null;
+    }
+    return store;
+}
+function readIntents() {
+    const intentPath = join(lifecycleDir(), 'interruption-intent.json');
+    if (!existsSync(intentPath))
+        return {};
+    const intents = JSON.parse(readFileSync(intentPath, 'utf8'));
+    if (!record(intents) || !Object.values(intents).every((intent) => record(intent)
+        && typeof intent.operationId === 'string' && typeof intent.interruptedAt === 'string')) {
+        throw new Error('The local interruption intent is incomplete. Work remains protected.');
+    }
+    return intents;
+}
+function writeStore(value) {
+    mkdirSync(lifecycleDir(), { recursive: true, mode: 0o700 });
+    const temporary = `${path()}.${randomUUID()}.tmp`;
+    try {
+        writeFileSync(temporary, JSON.stringify(value), { mode: 0o600, flag: 'wx' });
+        renameSync(temporary, path());
+    }
+    finally {
+        if (existsSync(temporary))
+            rmSync(temporary);
+    }
+}
+function changeEntry(id, update) {
+    const store = readStore();
+    const entry = store.entries.find((candidate) => candidate.id === id);
+    if (!entry)
+        throw new Error('The owned execution record disappeared. No further work may start.');
+    update(entry);
+    writeStore(store);
+    return entry;
+}
+function removeEntry(id) {
+    const store = readStore();
+    store.entries = store.entries.filter((entry) => entry.id !== id);
+    writeStore(store);
+    handles.delete(id);
+    creating.delete(id);
+}
+function requireContext() {
+    if (!context?.accountId)
+        throw new Error('No authenticated local execution owner is available.');
+    return { ...context, accountId: context.accountId };
+}
+export function initializeOwnedWork(input) {
+    if (context?.instanceNonce !== input.instanceNonce) {
+        claims.clear();
+        liveRpcClaims.clear();
+        for (const id of creating)
+            if (!handles.has(id))
+                creating.delete(id);
+    }
+    context = { ...input, legacyUpgrade: input.legacyUpgrade ?? false };
+    admitting = true;
+    forcedOperationId = null;
+    if (input.legacyUpgrade) {
+        const store = readStore();
+        store.legacyBootstrap = true;
+        writeStore(store);
+    }
+    if (input.accountId)
+        setOwnedWorkAccount(input.accountId);
+}
+export function setOwnedWorkAccount(accountId) {
+    if (!context)
+        throw new Error('The local runtime must own execution before authentication starts.');
+    context.accountId = accountId;
+    const store = readStore();
+    if (context.legacyUpgrade || store.legacyBootstrap) {
+        if (!store.legacy.some((item) => item.accountId === accountId && item.machineId === context.machineId)) {
+            store.legacy.push({ accountId, machineId: context.machineId, complete: false, panelComplete: false, holds: [] });
+        }
+        store.legacyBootstrap = false;
+        writeStore(store);
+    }
+}
+export function hasOwnedWorkContext() { return context !== null; }
+export function ownedWorkAllowed() {
+    if (!context)
+        return true;
+    const operation = readOperation();
+    return admitting && !readStore().entries.some((entry) => entry.preparationFailure
+        && entry.accountId === context.accountId && entry.machineId === context.machineId)
+        && (!operation || !['stop', 'restart'].includes(operation.action) || operation.successor === context.instanceNonce);
+}
+/** A claim remains visible until its caller has created pending execution records. */
+export function beginOwnedClaim() {
+    if (!ownedWorkAllowed())
+        throw new Error('CTRL+SPC is stopping and is not accepting new work.');
+    if (!context)
+        return () => { };
+    const id = randomUUID();
+    claims.add(id);
+    return () => {
+        claims.delete(id);
+        if (claims.size === 0)
+            for (const resolve of claimWaiters)
+                resolve();
+    };
+}
+export async function suspendOwnedWorkAdmission(options = {}) {
+    admitting = false;
+    if (options.waitForClaims !== false && claims.size)
+        await new Promise((resolve) => { claimWaiters.add(resolve); }).finally(() => claimWaiters.clear());
+}
+export function resumeOwnedWorkAdmission() {
+    admitting = true;
+    for (const resolve of admissionWaiters)
+        resolve();
+    admissionWaiters.clear();
+}
+export function reserveOwnedWork(ref, harness = null, workId) {
+    const owner = requireContext();
+    const store = readStore();
+    const prior = store.entries.find((row) => row.unstarted && row.instanceNonce === owner.instanceNonce
+        && row.reference && (ref ? sameAttempt(row.reference, ref) : workId ? row.reference.surface === 'panel' && row.reference.runId === workId : false));
+    const entry = prior ?? {
+        id: randomUUID(), accountId: owner.accountId, machineId: owner.machineId, instanceNonce: owner.instanceNonce,
+        harness, reference: ref, process: null, descendants: [], state: 'pending', interruption: null,
+    };
+    entry.unstarted = false;
+    if (harness)
+        entry.harness = harness;
+    if (ref) {
+        entry.reference = ref;
+        store.entries = store.entries.filter((row) => row.id === entry.id || !row.unstarted || !row.reference || !sameAttempt(row.reference, ref));
+    }
+    if (!prior)
+        store.entries.push(entry);
+    writeStore(store);
+    let registering = false;
+    const interrupted = () => readStore().entries.find((candidate) => candidate.id === entry.id)?.interruption != null;
+    const waitForPromptAdmission = async () => {
+        let waited = false;
+        while (!ownedWorkAllowed() && !interrupted() && context?.accountId === owner.accountId && context.machineId === owner.machineId) {
+            waited = true;
+            await new Promise((resolve) => setTimeout(resolve, 100));
+        }
+        if (interrupted())
+            throw new Error('Work was interrupted by the local service command.');
+        if (context?.accountId !== owner.accountId || context.machineId !== owner.machineId) {
+            throw new Error('This execution belongs to the previous signed-in account.');
+        }
+        return waited;
+    };
+    return {
+        id: entry.id,
+        interrupted,
+        waitForPromptAdmission,
+        beforeSpawn: () => {
+            if (context?.accountId !== owner.accountId || context.machineId !== owner.machineId) {
+                throw new Error('This execution belongs to the previous signed-in account.');
+            }
+            if (forcedOperationId || interrupted()) {
+                changeEntry(entry.id, (row) => {
+                    if (row.reference) {
+                        row.state = 'exited';
+                        row.interruption ??= { operationId: forcedOperationId ?? readOperation()?.id ?? randomUUID(), interruptedAt: new Date().toISOString() };
+                    }
+                });
+                throw new Error('Work was interrupted before its harness could start.');
+            }
+            changeEntry(entry.id, (row) => {
+                row.spawning = true;
+                row.gatedCreation = true;
+                if (process.platform === 'win32')
+                    row.windowsJob = windowsJobName(row.id);
+            });
+            creating.add(entry.id);
+        },
+        complete: () => {
+            const current = readStore().entries.find((row) => row.id === entry.id);
+            if (current?.preparationFailure && current.state !== 'exited')
+                throw new Error('The unprompted harness must exit before its preparation failure is released.');
+            if (current && !current.interruption)
+                removeEntry(entry.id);
+        },
+        deferFailure: (reason, level) => {
+            changeEntry(entry.id, (row) => {
+                if (row.reference?.surface !== 'panel')
+                    throw new Error('A failed preparation requires its exact panel attempt.');
+                if (row.interruption)
+                    return;
+                row.preparationFailure = { reason, level };
+                if (!row.process && !row.spawning)
+                    row.state = 'exited';
+            });
+        },
+        exited: () => confirmOwnedExecutionExited(entry.id),
+        finishPreparation: () => {
+            if (registering)
+                return;
+            const current = readStore().entries.find((row) => row.id === entry.id);
+            if (!current)
+                return;
+            if (current.preparationFailure)
+                return;
+            if (current.interruption && current.reference)
+                changeEntry(entry.id, (row) => { row.state = 'exited'; });
+            else
+                removeEntry(entry.id);
+        },
+        setReference: (value, agent) => {
+            const current = readStore();
+            const row = current.entries.find((item) => item.id === entry.id);
+            if (!row)
+                throw new Error('The pending execution record disappeared.');
+            row.reference = value;
+            if (agent)
+                row.harness = agent;
+            current.entries = current.entries.filter((item) => item.id === entry.id || !item.unstarted || !item.reference || !sameAttempt(item.reference, value));
+            writeStore(current);
+        },
+        abandon: () => {
+            const current = readStore().entries.find((candidate) => candidate.id === entry.id);
+            if (!current)
+                return;
+            if (current.preparationFailure)
+                return;
+            if (current.process)
+                throw new Error('A registered process must be observed exited before its record is released.');
+            if (current.interruption && current.reference)
+                changeEntry(entry.id, (row) => { row.state = 'exited'; });
+            else
+                removeEntry(entry.id);
+        },
+        register: async (child, agent) => {
+            registering = true;
+            handles.set(entry.id, child);
+            changeEntry(entry.id, (row) => { if (typeof child.pid === 'number')
+                row.rawPid = child.pid; if (agent)
+                row.harness = agent; });
+            const process = await getOwnedProcessIdentity(child);
+            if (!process) {
+                if (readStore().entries.find((row) => row.id === entry.id)?.gatedCreation) {
+                    changeEntry(entry.id, (row) => { row.spawning = false; row.state = 'exited'; });
+                    creating.delete(entry.id);
+                }
+                throw new Error('The harness exited before its process identity could be recorded.');
+            }
+            changeEntry(entry.id, (row) => { row.process = process; row.state = 'running'; row.spawning = false; });
+            creating.delete(entry.id);
+            const descendants = await inspectProcessTree(process);
+            changeEntry(entry.id, (row) => { row.descendants = descendants; });
+            await waitForPromptAdmission();
+            return { id: entry.id, interrupted, exited: () => confirmOwnedExecutionExited(entry.id) };
+        },
+    };
+}
+function assertWorkDeadline(deadline) {
+    if (deadline !== undefined && Date.now() >= deadline)
+        throw new Error('Service operation did not finish within its deadline. No replacement may start.');
+}
+async function remainingProcesses(entry, deadline) {
+    assertWorkDeadline(deadline);
+    if (!entry.process) {
+        if (!entry.spawning)
+            return [];
+        if (!entry.gatedCreation)
+            throw new Error('A harness creation did not record its operating system identity. Its ownership must be verified before replacement.');
+        if (process.platform === 'win32' && !entry.windowsJob)
+            throw new Error('The Windows execution gate has no durable Job identity. Its closure cannot be verified.');
+        const handle = handles.get(entry.id);
+        if (handle) {
+            const process = await getOwnedProcessIdentity(handle, deadline);
+            assertWorkDeadline(deadline);
+            if (process) {
+                entry.process = process;
+                changeEntry(entry.id, (row) => { row.process = process; row.spawning = false; row.state = 'running'; });
+            }
+            else
+                changeEntry(entry.id, (row) => { row.spawning = false; row.state = 'exited'; });
+            creating.delete(entry.id);
+        }
+        else {
+            if (creating.has(entry.id))
+                throw new Error('The owned execution gate is still being created.');
+            // A grant is sent only after the boundary above is durable. A dead
+            // creator without that identity could never have admitted a harness.
+            if (entry.windowsJob && (await inspectWindowsJob(entry.windowsJob, deadline)).exists) {
+                throw new Error('The unprompted execution gate is still closing. Retry the service command.');
+            }
+            assertWorkDeadline(deadline);
+            changeEntry(entry.id, (row) => { row.spawning = false; row.state = 'exited'; });
+        }
+        if (!entry.process)
+            return [];
+    }
+    const remaining = await inspectProcessTree(entry.process, deadline, entry.descendants);
+    assertWorkDeadline(deadline);
+    return remaining;
+}
+export async function confirmOwnedExecutionExited(id, deadline) {
+    assertWorkDeadline(deadline);
+    const entry = readStore().entries.find((candidate) => candidate.id === id);
+    if (!entry)
+        return;
+    const remaining = await remainingProcesses(entry, deadline);
+    if (remaining.length) {
+        changeEntry(id, (row) => { row.descendants = remaining; });
+        throw new Error('The harness wrapper exited while owned execution remains. The service still owns that work.');
+    }
+    assertWorkDeadline(deadline);
+    changeEntry(id, (row) => { row.state = 'exited'; });
+    handles.delete(id);
+}
+function summary(entry) {
+    const ref = entry.reference;
+    return {
+        id: entry.id, surface: ref?.surface ?? 'claim', harness: entry.harness,
+        workId: ref ? ref.surface === 'panel' ? ref.runId : ref.todoId : null,
+        ...(ref?.surface === 'panel' ? { cardId: ref.cardId } : {}), pid: entry.process?.pid ?? null,
+    };
+}
+export async function snapshotOwnedWork(deadline) {
+    assertWorkDeadline(deadline);
+    const store = readStore();
+    const result = { active: [], pending: [], claimPending: [], unknown: [], receipts: 0, legacyHeldTodoIds: [] };
+    for (const entry of store.entries) {
+        if (entry.preparationFailure) {
+            result.receipts++;
+            if (entry.state === 'exited')
+                continue;
+        }
+        if (entry.interruption)
+            result.receipts++;
+        if (entry.state === 'exited') {
+            if (!entry.interruption) {
+                if (context && entry.instanceNonce !== context.instanceNonce) {
+                    if (entry.reference) {
+                        changeEntry(entry.id, (row) => { row.interruption = { operationId: row.rpcId ?? randomUUID(), interruptedAt: new Date().toISOString() }; });
+                        result.receipts++;
+                    }
+                    else
+                        removeEntry(entry.id);
+                }
+                else
+                    result.pending.push(summary(entry));
+            }
+            continue;
+        }
+        if (!entry.process) {
+            if (entry.spawning) {
+                if (creating.has(entry.id) && !handles.has(entry.id)) {
+                    result.pending.push(summary(entry));
+                    continue;
+                }
+                const liveCreation = handles.has(entry.id);
+                try {
+                    const alive = await remainingProcesses(entry, deadline);
+                    if (alive.length) {
+                        result.active.push(summary(entry));
+                        continue;
+                    }
+                    if (!entry.preparationFailure && !entry.interruption && entry.reference && !liveCreation) {
+                        changeEntry(entry.id, (row) => { row.interruption = { operationId: row.rpcId ?? randomUUID(), interruptedAt: new Date().toISOString() }; });
+                        result.receipts++;
+                    }
+                    else if (!entry.preparationFailure && !entry.interruption && liveCreation)
+                        result.pending.push(summary(entry));
+                }
+                catch {
+                    result.unknown.push(summary(entry));
+                }
+                continue;
+            }
+            if (!entry.reference && context && entry.instanceNonce !== context.instanceNonce)
+                removeEntry(entry.id);
+            else if (entry.reference && context && entry.instanceNonce !== context.instanceNonce) {
+                changeEntry(entry.id, (row) => { row.state = 'exited'; row.interruption ??= { operationId: row.rpcId ?? randomUUID(), interruptedAt: new Date().toISOString() }; });
+                result.receipts++;
+            }
+            else
+                result.pending.push(summary(entry));
+            continue;
+        }
+        try {
+            const alive = await remainingProcesses(entry, deadline);
+            if (alive.length) {
+                changeEntry(entry.id, (row) => { row.descendants = alive; });
+                result.active.push(summary(entry));
+            }
+            else if (entry.preparationFailure)
+                changeEntry(entry.id, (row) => { row.state = 'exited'; });
+            else if (!entry.interruption && context && entry.instanceNonce !== context.instanceNonce) {
+                // Process exit did not acknowledge cloud settlement. Preserve the exact
+                // old attempt so startup can stop it without touching a newer claim.
+                if (entry.reference) {
+                    changeEntry(entry.id, (row) => { row.state = 'exited'; row.interruption = { operationId: row.rpcId ?? randomUUID(), interruptedAt: new Date().toISOString() }; });
+                    result.receipts++;
+                }
+                else
+                    removeEntry(entry.id);
+            }
+            else if (!entry.interruption) {
+                changeEntry(entry.id, (row) => { row.state = 'exited'; });
+                result.pending.push(summary(entry));
+            }
+            else
+                changeEntry(entry.id, (row) => { row.state = 'exited'; });
+        }
+        catch {
+            result.unknown.push(summary(entry));
+        }
+    }
+    for (const id of claims)
+        result.claimPending.push({ id, surface: 'claim', harness: null, workId: null, pid: null });
+    for (const claim of store.rpcClaims ?? []) {
+        result.receipts++;
+        if (claim.instanceNonce === context?.instanceNonce && liveRpcClaims.has(claim.id))
+            result.claimPending.push({ id: claim.id, surface: 'claim', harness: null, workId: null, pid: null });
+    }
+    result.pending.push(...result.claimPending);
+    result.legacyHeldTodoIds = legacyHeldTodoIds();
+    assertWorkDeadline(deadline);
+    return result;
+}
+/** The caller has already closed admission. Persist every interruption before any signal. */
+export function ownedWorkInstanceNonces() { return [...new Set(readStore().entries.map((row) => row.instanceNonce))]; }
+function assertInterruptionOperation(operationId) {
+    if (readOperation()?.id !== operationId)
+        throw new Error('The service operation no longer owns the interruption. No further process was changed.');
+}
+export async function markOwnedWorkInterrupted(operationId, instanceNonces = context ? [context.instanceNonce] : []) {
+    assertInterruptionOperation(operationId);
+    admitting = false;
+    forcedOperationId = operationId;
+    const store = readStore();
+    const interruptedAt = new Date().toISOString();
+    const intents = { ...readIntents(), ...Object.fromEntries(store.entries.filter((entry) => !entry.preparationFailure && (entry.interruption || instanceNonces.includes(entry.instanceNonce)))
+            .map((entry) => [entry.id, entry.interruption ?? { operationId, interruptedAt }])) };
+    for (const nonce of instanceNonces)
+        intents[`instance:${nonce}`] ??= { operationId, interruptedAt };
+    mkdirSync(lifecycleDir(), { recursive: true, mode: 0o700 });
+    const target = join(lifecycleDir(), 'interruption-intent.json');
+    const temporary = `${target}.${randomUUID()}.tmp`;
+    try {
+        writeFileSync(temporary, JSON.stringify(intents), { mode: 0o600, flag: 'wx' });
+        renameSync(temporary, target);
+    }
+    finally {
+        if (existsSync(temporary))
+            rmSync(temporary);
+    }
+}
+export async function interruptOwnedWork(operationId, deadline, instanceNonces = context ? [context.instanceNonce] : []) {
+    assertWorkDeadline(deadline);
+    await markOwnedWorkInterrupted(operationId, instanceNonces);
+    const store = readStore();
+    for (const resolve of admissionWaiters)
+        resolve();
+    admissionWaiters.clear();
+    for (const entry of store.entries) {
+        assertInterruptionOperation(operationId);
+        if (!instanceNonces.includes(entry.instanceNonce) || entry.state === 'exited')
+            continue;
+        if (!entry.process && entry.spawning)
+            await remainingProcesses(entry, deadline);
+        if (!entry.process) {
+            if (!entry.spawning) {
+                if (entry.reference)
+                    changeEntry(entry.id, (row) => { row.state = 'exited'; });
+                else
+                    removeEntry(entry.id);
+            }
+            continue;
+        }
+        await terminateOwnedTree(entry.process, { force: true, deadline, known: entry.descendants });
+        assertInterruptionOperation(operationId);
+        await confirmOwnedExecutionExited(entry.id, deadline);
+    }
+    assertInterruptionOperation(operationId);
+    const after = await snapshotOwnedWork(deadline);
+    assertWorkDeadline(deadline);
+    if (after.active.length || after.unknown.length || after.pending.some((row) => !after.claimPending.some((claim) => claim.id === row.id))) {
+        throw new Error('Some owned execution or pending claims have not ended. No replacement may start.');
+    }
+}
+export function interruptionReceipts(surface) {
+    const owner = requireContext();
+    return readStore().entries.flatMap((entry) => entry.accountId === owner.accountId && entry.machineId === owner.machineId
+        && entry.reference?.surface === surface && entry.interruption && entry.state === 'exited'
+        ? [{ id: entry.id, accountId: entry.accountId, machineId: entry.machineId, instanceNonce: entry.instanceNonce, harness: entry.harness,
+                reference: entry.reference, process: entry.process, descendants: entry.descendants, ...entry.interruption }]
+        : []);
+}
+export function acknowledgeInterruption(id) {
+    const owner = requireContext();
+    const entry = readStore().entries.find((candidate) => candidate.id === id);
+    if (!entry)
+        return;
+    if (entry.accountId !== owner.accountId || entry.machineId !== owner.machineId || entry.state !== 'exited' || !entry.interruption) {
+        throw new Error('Interruption acknowledgement does not match this account and ended execution.');
+    }
+    removeEntry(id);
+}
+export function failedPanelPreparations() {
+    const owner = requireContext();
+    return readStore().entries.flatMap((entry) => entry.accountId === owner.accountId && entry.machineId === owner.machineId
+        && entry.reference?.surface === 'panel' && entry.preparationFailure && entry.state === 'exited'
+        ? [{ id: entry.id, attempt: entry.reference, ...entry.preparationFailure }] : []);
+}
+/** Recovery must consult the durable owner after an account loop is recreated. */
+function heldPanelEntry(attempt) {
+    const owner = requireContext();
+    return readStore().entries.find((entry) => entry.accountId === owner.accountId && entry.machineId === owner.machineId
+        && entry.reference?.surface === 'panel' && entry.reference.runId === attempt.runId
+        && entry.reference.processToken === attempt.processToken && entry.reference.startedAt === attempt.startedAt
+        && entry.reference.resumedAt === attempt.resumedAt);
+}
+export function ownedPanelAttemptHeld(attempt) {
+    return heldPanelEntry(attempt) !== undefined;
+}
+/** Local files remain protected even when another account cannot read the run. */
+export function ownedLocalPanelOwnerHeld(runId) {
+    const owner = requireContext();
+    return readStore().entries.some((entry) => entry.machineId === owner.machineId
+        && entry.reference?.surface === 'panel' && entry.reference.runId === runId);
+}
+export async function stopOwnedPanelAttempt(attempt) {
+    const entry = heldPanelEntry(attempt);
+    if (!entry || entry.state === 'exited')
+        return;
+    if (!entry.process)
+        throw new Error('This run still has an unverified local execution. Its process record remains protected.');
+    const deadline = Date.now() + 30_000;
+    await terminateOwnedTree(entry.process, { force: true, deadline, known: entry.descendants });
+    await confirmOwnedExecutionExited(entry.id, deadline);
+}
+/** A transport PID can exit before its owned tool processes and settlement. */
+export function ownedWorkerExecutionHeld(workerId) {
+    const owner = requireContext();
+    return readStore().entries.some((entry) => entry.accountId === owner.accountId && entry.machineId === owner.machineId
+        && entry.reference?.surface === 'worker' && entry.reference.workerId === workerId);
+}
+/** A stale worker row cannot identify a later claim on the same request. */
+export function ownedWorkerClaimedAt(workerId) {
+    const owner = requireContext();
+    const ref = readStore().entries.find((entry) => entry.accountId === owner.accountId && entry.machineId === owner.machineId
+        && entry.reference?.surface === 'worker' && entry.reference.workerId === workerId)?.reference;
+    return ref?.surface === 'worker' ? ref.claimedAt : null;
+}
+export function acknowledgePreparationFailure(id) {
+    const owner = requireContext();
+    const entry = readStore().entries.find((candidate) => candidate.id === id);
+    if (!entry)
+        return;
+    if (entry.accountId !== owner.accountId || entry.machineId !== owner.machineId || entry.state !== 'exited' || !entry.preparationFailure) {
+        throw new Error('Preparation acknowledgement does not match this account and ended execution.');
+    }
+    removeEntry(id);
+}
+export function legacySnapshotNeeded() {
+    if (!context?.accountId)
+        return false;
+    const state = readStore().legacy.find((item) => item.accountId === context.accountId && item.machineId === context.machineId);
+    return !!state && !state.complete;
+}
+export function saveLegacySnapshot(holds) {
+    const owner = requireContext();
+    const store = readStore();
+    const state = store.legacy.find((item) => item.accountId === owner.accountId && item.machineId === owner.machineId);
+    if (!state || state.complete)
+        return;
+    state.holds = holds;
+    state.complete = true;
+    writeStore(store);
+}
+export function legacyTodoHolds() {
+    if (!context?.accountId)
+        return [];
+    return readStore().legacy.find((item) => item.accountId === context.accountId && item.machineId === context.machineId)?.holds ?? [];
+}
+export function legacyHeldTodoIds() { return legacyTodoHolds().map((item) => item.todoId); }
+export function releaseLegacyTodoHold(todoId) {
+    const owner = requireContext();
+    const store = readStore();
+    const state = store.legacy.find((item) => item.accountId === owner.accountId && item.machineId === owner.machineId);
+    if (!state)
+        return;
+    state.holds = state.holds.filter((item) => item.todoId !== todoId);
+    writeStore(store);
+}
+export function legacyPanelSnapshotNeeded() {
+    if (!context?.accountId)
+        return false;
+    const state = readStore().legacy.find((item) => item.accountId === context.accountId && item.machineId === context.machineId);
+    return !!state && !state.panelComplete;
+}
+export function completeLegacyPanelSnapshot() {
+    const owner = requireContext();
+    const store = readStore();
+    const state = store.legacy.find((item) => item.accountId === owner.accountId && item.machineId === owner.machineId);
+    if (state) {
+        state.panelComplete = true;
+        writeStore(store);
+    }
+}
+/** A boot-proven old attempt has no surviving local process, but still needs an exact cloud receipt. */
+export function recordExitedInterruption(ref, operationId = randomUUID()) {
+    const owner = requireContext();
+    const store = readStore();
+    if (store.entries.some((row) => row.accountId === owner.accountId && row.machineId === owner.machineId
+        && row.reference && JSON.stringify(row.reference) === JSON.stringify(ref)))
+        return;
+    store.entries.push({ id: randomUUID(), accountId: owner.accountId, machineId: owner.machineId,
+        instanceNonce: owner.instanceNonce, harness: null, reference: ref, process: null, descendants: [],
+        state: 'exited', interruption: { operationId, interruptedAt: new Date().toISOString() } });
+    writeStore(store);
+}
+function sameAttempt(a, b) {
+    if (a.surface !== b.surface)
+        return false;
+    if (a.surface === 'panel' && b.surface === 'panel')
+        return a.runId === b.runId && a.processToken === b.processToken
+            && a.startedAt === b.startedAt && a.resumedAt === b.resumedAt;
+    if (a.surface === 'worker' && b.surface === 'worker')
+        return a.todoId === b.todoId && a.claimedAt === b.claimedAt
+            && (a.workerId === null || b.workerId === null || a.workerId === b.workerId);
+    if (a.surface === 'reply' && b.surface === 'reply')
+        return a.todoId === b.todoId
+            && a.messageLeases.every((source) => b.messageLeases.some((other) => other.id === source.id && other.taken_at === source.taken_at))
+            && a.grantLeases.every((source) => b.grantLeases.some((other) => other.id === source.id && other.resume_taken_at === source.resume_taken_at));
+    return false;
+}
+export function beginRpcClaim(surface, action) {
+    if (!ownedWorkAllowed())
+        throw new Error('This machine is not accepting new work.');
+    const owner = requireContext();
+    const store = readStore();
+    const id = randomUUID();
+    liveRpcClaims.add(id);
+    (store.rpcClaims ??= []).push({ id, surface, action, accountId: owner.accountId, machineId: owner.machineId, instanceNonce: owner.instanceNonce });
+    writeStore(store);
+    return id;
+}
+export function pendingRpcClaims(surface) {
+    const owner = requireContext();
+    return (readStore().rpcClaims ?? []).filter((row) => row.surface === surface && row.accountId === owner.accountId && row.machineId === owner.machineId && !liveRpcClaims.has(row.id));
+}
+export function deferRpcClaim(id) { liveRpcClaims.delete(id); }
+export function recordRpcClaims(id, refs, interrupted = false) {
+    const owner = requireContext();
+    interrupted ||= forcedOperationId !== null;
+    const store = readStore();
+    const claim = (store.rpcClaims ?? []).find((row) => row.id === id && row.accountId === owner.accountId && row.machineId === owner.machineId);
+    if (!claim) {
+        if ((store.rpcClaims ?? []).some((row) => row.id === id))
+            throw new Error('The claim receipt does not belong to this account.');
+        return;
+    }
+    for (const ref of refs) {
+        if (store.entries.some((row) => row.reference && row.accountId === owner.accountId && sameAttempt(row.reference, ref)))
+            continue;
+        store.entries.push({ id: randomUUID(), accountId: owner.accountId, machineId: owner.machineId,
+            instanceNonce: owner.instanceNonce, harness: null, reference: ref, process: null, descendants: [],
+            state: interrupted ? 'exited' : 'pending', interruption: interrupted ? { operationId: id, interruptedAt: new Date().toISOString() } : null,
+            rpcId: id, unstarted: true });
+    }
+    store.rpcClaims = store.rpcClaims?.filter((row) => row.id !== id);
+    writeStore(store);
+    liveRpcClaims.delete(id);
+}
+export function finishRpcClaims(ids) {
+    const owner = requireContext();
+    const store = readStore();
+    store.entries = store.entries.filter((row) => !row.unstarted || !row.rpcId || !ids.includes(row.rpcId)
+        || row.accountId !== owner.accountId || row.machineId !== owner.machineId || row.interruption || row.preparationFailure);
+    writeStore(store);
+}
+export function pendingPanelAttempt(runId) {
+    const owner = requireContext();
+    const row = readStore().entries.find((entry) => entry.instanceNonce === owner.instanceNonce && entry.state === 'pending'
+        && entry.reference?.surface === 'panel' && entry.reference.runId === runId);
+    return row?.reference?.surface === 'panel' ? row.reference : null;
+}