@descryy/runtime-orchestrator 0.3.0 → 0.4.1

package/dist/cgroup-partial-restriction.js

@@ -1,57 +1,30 @@
 /**
- * Partial going-forward resource restriction for an already-running,
- * attached-to process, via cgroups v2 -- the second, narrower alternative
- * next to respawn-and-supervise (`respawn-and-supervise.ts`).
+ * Partial going-forward resource restriction for an already-running, attached-to
+ * process, via cgroups v2 — narrower alternative to `respawn-and-supervise.ts`.
  *
- * **What this genuinely gets you, stated exactly, because the honest
- * boundary here is not the same shape as spawn-mode's.** Moving a live
- * pid's cgroup membership (writing it into a delegated cgroup's own
- * `cgroup.procs`, per the kernel's cgroups v2 unified hierarchy) applies
- * real, kernel-enforced resource limits -- `memory.max`, `cpu.max`,
- * `pids.max` -- to a process this runtime never spawned, without killing
- * or restarting it. That is real and this module proves it for real (see
- * the test suite). **It does NOT, and structurally cannot, give the moved
- * process any filesystem or network isolation.** Changing which mount or
- * network namespace an already-running process belongs to needs `setns()`
- * against a live pid -- a fundamentally different, far more invasive
- * operation than a cgroup move, not attempted here and out of scope for
- * this pass. Every value this module returns, and every place this
- * capability is described, says so: `CGROUP_PARTIAL_RESTRICTION_SCOPE`
- * below is the literal, load-bearing string every result carries, precisely
- * so nothing downstream can round it up to "sandboxed" or "isolated" --
- * words that would misrepresent this as equivalent to `sandbox.ts`'s real
- * spawn-time bwrap isolation.
+ * Moving a live pid into a delegated cgroup applies real kernel-enforced limits
+ * (`memory.max`, `cpu.max`, `pids.max`) without killing/restarting it. **It does
+ * NOT and cannot give filesystem or network isolation** — that needs `setns()`
+ * against a live pid, out of scope here. `CGROUP_PARTIAL_RESTRICTION_SCOPE` is the
+ * literal string every result carries so nothing downstream rounds this up to
+ * "sandboxed"/"isolated" (which would misrepresent it as `sandbox.ts`'s real
+ * spawn-time bwrap isolation).
  *
- * **How the delegated cgroup is found -- measured on this host, not
- * assumed from cgroups v2 documentation.** A non-root user cannot write
- * anywhere under `/sys/fs/cgroup` by default; what makes any of this
- * possible at all is a systemd user session's own delegation
- * (`user@<uid>.service`, `Delegate=yes`), which typically extends through
- * `app.slice`/`session.slice`/`background.slice` beneath it. But
- * delegation is not uniform all the way down: cgroups v2's "no internal
- * processes" rule means a *leaf* cgroup that already directly holds a
- * process (a systemd `.scope`, including the very one this Node process
- * itself runs in) generally cannot have its `subtree_control` extended
- * further -- writing to it fails with `EBUSY`, measured directly against
- * this repo's own dev host while building this module. `findDelegatedCgroupAncestor`
- * therefore does not trust `cgroup.subtree_control` text or permission
- * bits alone; it walks up from this process's own `/proc/self/cgroup` path
- * and, at each ancestor, creates a real, temporary probe child directory
- * and checks whether the kernel actually gave it a `memory.max` file --
- * the only way to honestly know a given ancestor's delegation reaches that
- * far, empirically, the same "prove it against the real mechanism" standard
- * `sandbox.ts`'s own escape tests hold spawn-mode isolation to.
+ * Finding the delegated ancestor: a non-root user can only write under
+ * `/sys/fs/cgroup` where a systemd user session delegates it (`Delegate=yes`).
+ * Delegation isn't uniform all the way down — a leaf cgroup already holding a
+ * process (e.g. this Node process's own scope) generally can't extend
+ * `subtree_control` further; writing fails `EBUSY` (measured on this repo's dev
+ * host). So `findDelegatedCgroupAncestor` doesn't trust subtree_control text or
+ * permission bits — it walks up from `/proc/self/cgroup` and, at each ancestor,
+ * creates a real temporary probe child and checks whether the kernel actually gave
+ * it a `memory.max` file.
  */
 import { existsSync, mkdirSync, readFileSync, rmdirSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { isProcessAlive } from "./attach-to-running-process.js";
 const CGROUP_ROOT = "/sys/fs/cgroup";
-/**
- * The literal, load-bearing scope string. Every `CgroupMoveResult` carries
- * this exact value under `scope` -- never restated by hand elsewhere, so a
- * caller (or a future capability-report string, or a decisions-inbox entry)
- * that quotes `.scope` can never accidentally drift from this wording.
- */
+/** Literal scope string every `CgroupMoveResult` carries under `scope` — never restated by hand, so quotes of it can't drift. */
 export const CGROUP_PARTIAL_RESTRICTION_SCOPE = "partial -- resource limits only, no filesystem or network isolation";
 function ownUnifiedCgroupPath() {
     let content;
@@ -62,10 +35,7 @@ function ownUnifiedCgroupPath() {
         return null;
     }
     for (const line of content.trim().split("\n")) {
-        // cgroups v2 unified-hierarchy lines read "0::<path>" -- hierarchy id 0,
-        // no named controllers (that's a v1 concept), then the path. A host
-        // still running v1 controllers alongside v2 has other numbered lines
-        // here too; only the "0::" one is this module's concern.
+        // unified-hierarchy lines read "0::<path>"; only the "0::" line matters here
         const firstColon = line.indexOf(":");
         const secondColon = line.indexOf(":", firstColon + 1);
         if (firstColon === -1 || secondColon === -1)
@@ -77,13 +47,10 @@ function ownUnifiedCgroupPath() {
     return null;
 }
 /**
- * Real, empirical probe -- not a permission-bit read. See this module's own
- * doc for why: a directory can be `mkdir`-able yet still produce a child
- * with no `memory.max` at all, when the controller was never actually
- * enabled in that parent's own `cgroup.subtree_control` (this process's own
- * leaf scope is exactly this shape, measured directly). The only honest
- * test is creating a real probe child and checking what the kernel actually
- * gave it.
+ * Real empirical probe, not a permission-bit read — a directory can be
+ * `mkdir`-able yet its child still lack `memory.max` if the controller was never
+ * enabled in `subtree_control` (this process's own leaf scope is exactly this
+ * shape, measured directly).
  */
 function probeControllableChild(candidateDir) {
     const probe = join(candidateDir, `.descry-cgroup-probe-${String(process.pid)}-${String(Date.now())}-${String(Math.random()).slice(2, 8)}`);
@@ -98,18 +65,15 @@ function probeControllableChild(candidateDir) {
         rmdirSync(probe);
     }
     catch {
-        // Best-effort cleanup of our own just-created probe directory -- not
-        // this module's problem if something else raced to touch it first.
+        // best-effort cleanup; not our problem if something raced to touch it first
     }
     return controllable;
 }
 /**
- * Walks up from this process's own cgroup toward `/sys/fs/cgroup`, returning
- * the deepest (most specific) ancestor directory whose children genuinely
- * get a real `memory.max` -- i.e. the actual delegation boundary, not
- * merely a directory this uid happens to own. `null` when cgroups v2 is not
- * mounted, this process's own cgroup path cannot be determined, or no
- * ancestor all the way to the root passes the probe (no delegation at all).
+ * Walks up from this process's cgroup toward `/sys/fs/cgroup`, returning the
+ * deepest ancestor whose children genuinely get a real `memory.max` — the actual
+ * delegation boundary. `null` if cgroups v2 isn't mounted, own path can't be
+ * determined, or no ancestor passes the probe.
  */
 export function findDelegatedCgroupAncestor() {
     if (process.platform !== "linux")
@@ -120,10 +84,7 @@ export function findDelegatedCgroupAncestor() {
     if (ownPath === null)
         return null;
     let dir = join(CGROUP_ROOT, ownPath.replace(/^\/+/, ""));
-    // Walk strictly upward, never testing CGROUP_ROOT itself -- writing
-    // limits at the true root would apply host-wide and is root-only on
-    // every real system anyway, so it is deliberately excluded rather than
-    // reached as a fallback.
+    // never test CGROUP_ROOT itself: root-wide limits are root-only anyway
     while (dir !== CGROUP_ROOT && dirname(dir) !== dir) {
         if (existsSync(dir) && probeControllableChild(dir))
             return dir;
@@ -150,16 +111,13 @@ export function cgroupV2Capability() {
     return { availability: "available", reason: null };
 }
 /**
- * Moves `options.pid` -- an already-running process this runtime did not
- * spawn -- into a newly created, resource-limited cgroup. Throws (does not
- * silently proceed) when the target is not alive, when `cgroupV2Capability()`
- * reports unavailable, or when a declared limit's controller file does not
- * actually exist under the delegated ancestor found for it.
+ * Moves `options.pid` (a process this runtime did not spawn) into a newly created,
+ * resource-limited cgroup. Throws if the target isn't alive, `cgroupV2Capability()`
+ * is unavailable, or a declared limit's controller file doesn't exist.
  *
- * Limits are written to the new cgroup BEFORE the pid is moved into it, so
- * a process is never observed inside a cgroup with a half-applied limit
- * set; if any write fails, the created (still-empty) cgroup is removed and
- * the error is rethrown rather than left as an orphaned, unlimited group.
+ * Limits are written before the pid is moved in, so a process is never observed
+ * with a half-applied limit set; on any write failure the still-empty cgroup is
+ * removed and the error rethrown, never left orphaned.
  */
 export function moveProcessIntoRestrictedCgroup(options) {
     if (!isProcessAlive(options.pid)) {
@@ -171,8 +129,7 @@ export function moveProcessIntoRestrictedCgroup(options) {
     }
     const ancestor = findDelegatedCgroupAncestor();
     if (ancestor === null) {
-        // Unreachable given capability.availability === "available" above, but
-        // narrows the type honestly rather than a non-null assertion.
+        // unreachable given availability check above; narrows the type honestly
         throw new Error("moveProcessIntoRestrictedCgroup: no delegated cgroup ancestor found despite capability reporting available -- internal inconsistency.");
     }
     const cgroupPath = join(ancestor, `descry-restrict-${options.nameHint ?? String(options.pid)}-${String(Date.now())}`);
@@ -184,17 +141,14 @@ export function moveProcessIntoRestrictedCgroup(options) {
         }
         if (options.limits.memoryMaxBytes !== undefined) {
             writeFileSync(join(cgroupPath, "memory.max"), String(options.limits.memoryMaxBytes));
-            // See CgroupResourceLimits.memoryMaxBytes's own comment: without this,
-            // a host with swap available reclaims into swap instead of killing,
-            // and memory.max stops being a real limit. Best-effort -- a host with
-            // no memory.swap.max file at all (swap accounting compiled out, or no
-            // swap controller delegated) still gets a real memory.max, just
-            // without this hardening; not a reason to refuse the whole call.
+            // see memoryMaxBytes doc: without this, swap makes memory.max a soft limit.
+            // best-effort -- no memory.swap.max file (swap accounting disabled/not
+            // delegated) still gets a real memory.max, just without this hardening
             try {
                 writeFileSync(join(cgroupPath, "memory.swap.max"), "0");
             }
             catch {
-                // Disclosed above, not silently pretended to have succeeded.
+                // disclosed above, not pretended to have succeeded
             }
         }
         if (options.limits.maxProcesses !== undefined) {
@@ -203,7 +157,7 @@ export function moveProcessIntoRestrictedCgroup(options) {
         if (options.limits.cpuMax !== undefined) {
             writeFileSync(join(cgroupPath, "cpu.max"), options.limits.cpuMax);
         }
-        // Moved last, only once every requested limit is confirmed written.
+        // moved last, only once every requested limit is confirmed written
         writeFileSync(join(cgroupPath, "cgroup.procs"), String(options.pid));
     }
     catch (error) {
@@ -211,9 +165,8 @@ export function moveProcessIntoRestrictedCgroup(options) {
             rmdirSync(cgroupPath);
         }
         catch {
-            // Best-effort -- if the pid was already moved in before the failure,
-            // the directory is non-empty and cannot be removed; nothing more this
-            // catch can honestly do about that.
+            // best-effort: if the pid was already moved in, the dir is non-empty
+            // and can't be removed
         }
         throw new Error(`moveProcessIntoRestrictedCgroup: failed to apply limits or move pid ${String(options.pid)} into ${cgroupPath}: ${error instanceof Error ? error.message : String(error)}`);
     }

package/dist/cgroup-partial-restriction.js.map

@@ -1 +1 @@
-{"version":3,"file":"cgroup-partial-restriction.js","sourceRoot":"","sources":["../src/cgroup-partial-restriction.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACxF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE1C,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAEhE,MAAM,WAAW,GAAG,gBAAgB,CAAC;AAErC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,qEAA8E,CAAC;AAE/H,SAAS,oBAAoB;IAC3B,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,YAAY,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9C,yEAAyE;QACzE,oEAAoE;QACpE,qEAAqE;QACrE,yDAAyD;QACzD,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACrC,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,UAAU,GAAG,CAAC,CAAC,CAAC;QACtD,IAAI,UAAU,KAAK,CAAC,CAAC,IAAI,WAAW,KAAK,CAAC,CAAC;YAAE,SAAS;QACtD,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,KAAK,GAAG,IAAI,UAAU,GAAG,CAAC,KAAK,WAAW,EAAE,CAAC;YACxE,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,sBAAsB,CAAC,YAAoB;IAClD,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,EAAE,wBAAwB,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IAC3I,IAAI,CAAC;QACH,SAAS,CAAC,KAAK,CAAC,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,YAAY,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC;IAC3D,IAAI,CAAC;QACH,SAAS,CAAC,KAAK,CAAC,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,qEAAqE;QACrE,mEAAmE;IACrE,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,2BAA2B;IACzC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAC9C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,oBAAoB,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAEtE,MAAM,OAAO,GAAG,oBAAoB,EAAE,CAAC;IACvC,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAElC,IAAI,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;IACzD,oEAAoE;IACpE,oEAAoE;IACpE,uEAAuE;IACvE,yBAAyB;IACzB,OAAO,GAAG,KAAK,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,GAAG,EAAE,CAAC;QACnD,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,sBAAsB,CAAC,GAAG,CAAC;YAAE,OAAO,GAAG,CAAC;QAC/D,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,EAAE,mEAAmE,OAAO,CAAC,QAAQ,GAAG,EAAE,CAAC;IACzI,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,oBAAoB,CAAC,CAAC,EAAE,CAAC;QACzD,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,WAAW,4FAA4F,EAAE,CAAC;IAC7J,CAAC;IACD,MAAM,QAAQ,GAAG,2BAA2B,EAAE,CAAC;IAC/C,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO;YACL,YAAY,EAAE,aAAa;YAC3B,MAAM,EACJ,iIAAiI;gBACjI,+HAA+H;gBAC/H,2GAA2G;SAC9G,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACrD,CAAC;AAmDD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,+BAA+B,CAAC,OAI/C;IACC,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,wCAAwC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,8DAA8D,CAAC,CAAC;IAC7I,CAAC;IAED,MAAM,UAAU,GAAG,kBAAkB,EAAE,CAAC;IACxC,IAAI,UAAU,CAAC,YAAY,KAAK,WAAW,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,oDAAoD,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,QAAQ,GAAG,2BAA2B,EAAE,CAAC;IAC/C,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,uEAAuE;QACvE,8DAA8D;QAC9D,MAAM,IAAI,KAAK,CAAC,uIAAuI,CAAC,CAAC;IAC3J,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,EAAE,mBAAmB,OAAO,CAAC,QAAQ,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IACtH,SAAS,CAAC,UAAU,CAAC,CAAC;IAEtB,IAAI,CAAC;QACH,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC;YACpF,MAAM,IAAI,KAAK,CACb,2DAA2D,QAAQ,uEAAuE;gBACxI,mDAAmD,CACtD,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;YAChD,aAAa,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC;YACrF,uEAAuE;YACvE,oEAAoE;YACpE,sEAAsE;YACtE,sEAAsE;YACtE,gEAAgE;YAChE,iEAAiE;YACjE,IAAI,CAAC;gBACH,aAAa,CAAC,IAAI,CAAC,UAAU,EAAE,iBAAiB,CAAC,EAAE,GAAG,CAAC,CAAC;YAC1D,CAAC;YAAC,MAAM,CAAC;gBACP,6DAA6D;YAC/D,CAAC;QACH,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YAC9C,aAAa,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;QACnF,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACxC,aAAa,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACpE,CAAC;QACD,oEAAoE;QACpE,aAAa,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IACvE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC;YACH,SAAS,CAAC,UAAU,CAAC,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACP,qEAAqE;YACrE,sEAAsE;YACtE,oCAAoC;QACtC,CAAC;QACD,MAAM,IAAI,KAAK,CACb,uEAAuE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,UAAU,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC3K,CAAC;IACJ,CAAC;IAED,OAAO;QACL,OAAO,EAAE,IAAI;QACb,UAAU;QACV,KAAK,EAAE,gCAAgC;QACvC,aAAa,EAAE,OAAO,CAAC,MAAM;QAC7B,OAAO,EAAE,GAAG,EAAE;YACZ,IAAI,CAAC;gBACH,SAAS,CAAC,UAAU,CAAC,CAAC;gBACtB,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"cgroup-partial-restriction.js","sourceRoot":"","sources":["../src/cgroup-partial-restriction.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACxF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE1C,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAEhE,MAAM,WAAW,GAAG,gBAAgB,CAAC;AAErC,iIAAiI;AACjI,MAAM,CAAC,MAAM,gCAAgC,GAAG,qEAA8E,CAAC;AAE/H,SAAS,oBAAoB;IAC3B,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,YAAY,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9C,6EAA6E;QAC7E,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACrC,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,UAAU,GAAG,CAAC,CAAC,CAAC;QACtD,IAAI,UAAU,KAAK,CAAC,CAAC,IAAI,WAAW,KAAK,CAAC,CAAC;YAAE,SAAS;QACtD,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,KAAK,GAAG,IAAI,UAAU,GAAG,CAAC,KAAK,WAAW,EAAE,CAAC;YACxE,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,SAAS,sBAAsB,CAAC,YAAoB;IAClD,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,EAAE,wBAAwB,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IAC3I,IAAI,CAAC;QACH,SAAS,CAAC,KAAK,CAAC,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,YAAY,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC;IAC3D,IAAI,CAAC;QACH,SAAS,CAAC,KAAK,CAAC,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,4EAA4E;IAC9E,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B;IACzC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAC9C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,oBAAoB,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAEtE,MAAM,OAAO,GAAG,oBAAoB,EAAE,CAAC;IACvC,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAElC,IAAI,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;IACzD,uEAAuE;IACvE,OAAO,GAAG,KAAK,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,GAAG,EAAE,CAAC;QACnD,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,sBAAsB,CAAC,GAAG,CAAC;YAAE,OAAO,GAAG,CAAC;QAC/D,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,EAAE,mEAAmE,OAAO,CAAC,QAAQ,GAAG,EAAE,CAAC;IACzI,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,oBAAoB,CAAC,CAAC,EAAE,CAAC;QACzD,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,WAAW,4FAA4F,EAAE,CAAC;IAC7J,CAAC;IACD,MAAM,QAAQ,GAAG,2BAA2B,EAAE,CAAC;IAC/C,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO;YACL,YAAY,EAAE,aAAa;YAC3B,MAAM,EACJ,iIAAiI;gBACjI,+HAA+H;gBAC/H,2GAA2G;SAC9G,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACrD,CAAC;AAoCD;;;;;;;;GAQG;AACH,MAAM,UAAU,+BAA+B,CAAC,OAI/C;IACC,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,wCAAwC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,8DAA8D,CAAC,CAAC;IAC7I,CAAC;IAED,MAAM,UAAU,GAAG,kBAAkB,EAAE,CAAC;IACxC,IAAI,UAAU,CAAC,YAAY,KAAK,WAAW,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,oDAAoD,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,QAAQ,GAAG,2BAA2B,EAAE,CAAC;IAC/C,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,wEAAwE;QACxE,MAAM,IAAI,KAAK,CAAC,uIAAuI,CAAC,CAAC;IAC3J,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,EAAE,mBAAmB,OAAO,CAAC,QAAQ,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IACtH,SAAS,CAAC,UAAU,CAAC,CAAC;IAEtB,IAAI,CAAC;QACH,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC;YACpF,MAAM,IAAI,KAAK,CACb,2DAA2D,QAAQ,uEAAuE;gBACxI,mDAAmD,CACtD,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;YAChD,aAAa,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC;YACrF,4EAA4E;YAC5E,uEAAuE;YACvE,uEAAuE;YACvE,IAAI,CAAC;gBACH,aAAa,CAAC,IAAI,CAAC,UAAU,EAAE,iBAAiB,CAAC,EAAE,GAAG,CAAC,CAAC;YAC1D,CAAC;YAAC,MAAM,CAAC;gBACP,mDAAmD;YACrD,CAAC;QACH,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YAC9C,aAAa,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;QACnF,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACxC,aAAa,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACpE,CAAC;QACD,mEAAmE;QACnE,aAAa,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IACvE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC;YACH,SAAS,CAAC,UAAU,CAAC,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACP,qEAAqE;YACrE,uBAAuB;QACzB,CAAC;QACD,MAAM,IAAI,KAAK,CACb,uEAAuE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,UAAU,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC3K,CAAC;IACJ,CAAC;IAED,OAAO;QACL,OAAO,EAAE,IAAI;QACb,UAAU;QACV,KAAK,EAAE,gCAAgC;QACvC,aAAa,EAAE,OAAO,CAAC,MAAM;QAC7B,OAAO,EAAE,GAAG,EAAE;YACZ,IAAI,CAAC;gBACH,SAAS,CAAC,UAAU,CAAC,CAAC;gBACtB,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/collector-version.d.ts

@@ -1,12 +1,7 @@
 /**
- * `Evidence.collectorVersion`'s source for evidence the orchestrator itself
- * emits directly (e.g. `COLLECTOR_ERROR` for a collector that never got
- * past `start()`, so no collector-owned code ever ran to attribute the row
- * to): this package's own `package.json` "version", read from the artifact
- * itself rather than hand-duplicated into a second string that can drift
- * from what actually shipped. Same idea as `nodeVersion` elsewhere in this
- * repo (`process.version`, always known, never probed) applied to a
- * package instead of the Node runtime.
+ * `Evidence.collectorVersion` for orchestrator-emitted evidence (e.g. `COLLECTOR_ERROR`
+ * before any collector ran). Reads `package.json` directly so it can't drift from
+ * what shipped, same approach as `nodeVersion`'s use of `process.version`.
  */
 export declare const COLLECTOR_VERSION: string;
 //# sourceMappingURL=collector-version.d.ts.map

package/dist/collector-version.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"collector-version.d.ts","sourceRoot":"","sources":["../src/collector-version.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAMH,eAAO,MAAM,iBAAiB,EAAE,MAA6E,CAAC"}
+{"version":3,"file":"collector-version.d.ts","sourceRoot":"","sources":["../src/collector-version.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH,eAAO,MAAM,iBAAiB,EAAE,MAA6E,CAAC"}

package/dist/collector-version.js

@@ -1,12 +1,7 @@
 /**
- * `Evidence.collectorVersion`'s source for evidence the orchestrator itself
- * emits directly (e.g. `COLLECTOR_ERROR` for a collector that never got
- * past `start()`, so no collector-owned code ever ran to attribute the row
- * to): this package's own `package.json` "version", read from the artifact
- * itself rather than hand-duplicated into a second string that can drift
- * from what actually shipped. Same idea as `nodeVersion` elsewhere in this
- * repo (`process.version`, always known, never probed) applied to a
- * package instead of the Node runtime.
+ * `Evidence.collectorVersion` for orchestrator-emitted evidence (e.g. `COLLECTOR_ERROR`
+ * before any collector ran). Reads `package.json` directly so it can't drift from
+ * what shipped, same approach as `nodeVersion`'s use of `process.version`.
  */
 import { createRequire } from "node:module";
 const require = createRequire(import.meta.url);

package/dist/collector-version.js.map

@@ -1 +1 @@
-{"version":3,"file":"collector-version.js","sourceRoot":"","sources":["../src/collector-version.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAE/C,MAAM,CAAC,MAAM,iBAAiB,GAAY,OAAO,CAAC,iBAAiB,CAAkC,CAAC,OAAO,CAAC"}
+{"version":3,"file":"collector-version.js","sourceRoot":"","sources":["../src/collector-version.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAE/C,MAAM,CAAC,MAAM,iBAAiB,GAAY,OAAO,CAAC,iBAAiB,CAAkC,CAAC,OAAO,CAAC"}

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 export type { PollingProcessOutputSourceOptions } from "./polling-output-source.ts";
 export { createPollingProcessOutputSource } from "./polling-output-source.ts";
-export type { AttachToRunningProcessOptions } from "./attach-to-running-process.ts";
+export type { AttachToRunningProcessOptions, AttachedProcessOutputSource } from "./attach-to-running-process.ts";
 export { attachToRunningProcess, isProcessAlive } from "./attach-to-running-process.ts";
 export type { AttachToRunningNodeProcessOptions } from "./attach-to-running-node-process.ts";
 export { attachToRunningNodeProcess, discoverNodeInspectorUrl } from "./attach-to-running-node-process.ts";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,iCAAiC,EAAE,MAAM,4BAA4B,CAAC;AACpF,OAAO,EAAE,gCAAgC,EAAE,MAAM,4BAA4B,CAAC;AAC9E,YAAY,EAAE,6BAA6B,EAAE,MAAM,gCAAgC,CAAC;AACpF,OAAO,EAAE,sBAAsB,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AACxF,YAAY,EAAE,iCAAiC,EAAE,MAAM,qCAAqC,CAAC;AAC7F,OAAO,EAAE,0BAA0B,EAAE,wBAAwB,EAAE,MAAM,qCAAqC,CAAC;AAC3G,YAAY,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,YAAY,EAAE,gCAAgC,EAAE,MAAM,oCAAoC,CAAC;AAC3F,OAAO,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,YAAY,EACV,cAAc,EACd,oBAAoB,EACpB,0BAA0B,EAC1B,yBAAyB,GAC1B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,MAAM,4BAA4B,CAAC;AAC9F,YAAY,EACV,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,gCAAgC,EAChC,kBAAkB,EAClB,2BAA2B,EAC3B,+BAA+B,GAChC,MAAM,iCAAiC,CAAC;AACzC,YAAY,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACnI,OAAO,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACtH,YAAY,EACV,2BAA2B,EAC3B,4BAA4B,EAC5B,6BAA6B,GAC9B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,8BAA8B,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,iCAAiC,EAAE,MAAM,4BAA4B,CAAC;AACpF,OAAO,EAAE,gCAAgC,EAAE,MAAM,4BAA4B,CAAC;AAC9E,YAAY,EAAE,6BAA6B,EAAE,2BAA2B,EAAE,MAAM,gCAAgC,CAAC;AACjH,OAAO,EAAE,sBAAsB,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AACxF,YAAY,EAAE,iCAAiC,EAAE,MAAM,qCAAqC,CAAC;AAC7F,OAAO,EAAE,0BAA0B,EAAE,wBAAwB,EAAE,MAAM,qCAAqC,CAAC;AAC3G,YAAY,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,YAAY,EAAE,gCAAgC,EAAE,MAAM,oCAAoC,CAAC;AAC3F,OAAO,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,YAAY,EACV,cAAc,EACd,oBAAoB,EACpB,0BAA0B,EAC1B,yBAAyB,GAC1B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,MAAM,4BAA4B,CAAC;AAC9F,YAAY,EACV,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,gCAAgC,EAChC,kBAAkB,EAClB,2BAA2B,EAC3B,+BAA+B,GAChC,MAAM,iCAAiC,CAAC;AACzC,YAAY,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACnI,OAAO,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACtH,YAAY,EACV,2BAA2B,EAC3B,4BAA4B,EAC5B,6BAA6B,GAC9B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,8BAA8B,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC"}

package/dist/instrumented-execution.d.ts

@@ -1,30 +1,14 @@
 /**
- * **The assembly nothing else performed.**
+ * The assembly wiring the runtime's pieces together in production code (previously
+ * only connected ad hoc by tests). Runs an `ExecutionController` over a `services`
+ * configuration; wraps each spawned process in a live `ProcessOutputSource`
+ * (polls the buffer, yields each line once); builds a `CollectorContext` with a
+ * real `resolveSourceRoot` closed over the execution's own processes; starts,
+ * drains and stops the adapter's collectors; writes every emitted item through
+ * `EvidenceStore` so redaction runs (plan §28).
  *
- * Every piece of the runtime existed and none of them were wired together
- * in production code: the controller spawned services, `RuntimeAdapter`
- * could build collectors, `resolveServiceRootForOrigin` could map an origin
- * to a source root, and `EvidenceStore` could persist. Only tests ever
- * connected them, each in its own way, which meant the thing the product
- * actually does had no single implementation to be right or wrong.
- *
- * This module is that implementation. It:
- *
- * 1. runs an `ExecutionController` over a `services` configuration;
- * 2. wraps each spawned process in a **live** `ProcessOutputSource` that
- *    polls the accumulated buffer and yields each line exactly once;
- * 3. builds a `CollectorContext` carrying a real `resolveSourceRoot`,
- *    closed over the execution's own processes — the channel RT-033 added
- *    and RT-029 built the lookup for, which until now nothing populated;
- * 4. starts the adapter's collectors, drains them, stops them;
- * 5. writes every emitted item through `EvidenceStore`, so redaction runs
- *    rather than being assumed (plan §28).
- *
- * **What it deliberately does not do.** It does not decide whether a
- * finding exists, does not correlate to graph nodes, and does not drive a
- * browser. Those are separate stages with separate contracts, and folding
- * them in here would make the one place that assembles the runtime also the
- * place that judges it.
+ * Deliberately does not decide whether a finding exists, correlate to graph
+ * nodes, or drive a browser — separate stages, separate contracts.
  */
 import type { Evidence, Execution, ExecutionConfiguration, ProcessHandle, ServiceRootLookup } from "@descryy/runtime-contracts";
 import type { RuntimeAdapter, OutboundHttpLaunch } from "@descryy/runtime-backend-observation";
@@ -46,38 +30,23 @@ export interface InstrumentedExecutionInput {
      */
     readonly observeForMs: number;
     /**
-     * **Opt-in, per service name** (a key into `execution.configuration.services`):
-     * front that service with `InboundProxy` (RT-192, DEC-271) once — and
-     * only once — its OWN readiness has already succeeded. This module never
-     * re-asks the question; it reads the answer `controller.run()` already
-     * produced (`ExecutionController.serviceStartResults`), the same
-     * "readiness confirmed on the app's real port FIRST, proxy started AFTER"
-     * sequencing `cross-service-trace.test.ts` performs by hand.
+     * Opt-in, per service name: front that service with `InboundProxy` (RT-192,
+     * DEC-271) once its own readiness has already succeeded — reads the answer
+     * `controller.run()` already produced (`serviceStartResults`), never re-asks.
+     * Absent or unnamed service: unchanged behaviour, no proxy.
      *
-     * Absent, or a service not named here, is today's behaviour, unchanged:
-     * no proxy, traffic observed only through whatever collectors `adapter`
-     * itself supplies.
-     *
-     * **This does not close any per-language "HTTP observation" checklist
-     * row.** Every one of those rows uses a self-initiated fixture — the app
-     * calls itself via the exact `PORT` it bound — which has no separate
-     * public port for a proxy to sit in front of. This flag makes
-     * `InboundProxy` available for a *future externally-driven* scenario
-     * (the shape RT-196/`cross-service-trace.test.ts` already proved by
-     * hand); it does not retroactively make any current fixture
-     * externally-driven.
+     * Does not close any per-language "HTTP observation" checklist row — those use
+     * self-initiated fixtures with no separate public port for a proxy to front.
+     * This only makes `InboundProxy` available for a future externally-driven
+     * scenario.
      */
     readonly frontWithInboundProxy?: Readonly<Record<string, boolean>>;
     /**
-     * Fires once every collector for this run — including any `InboundProxy`
-     * `frontWithInboundProxy` started — has started, and before the
-     * observation window's sleep begins. Exists so a caller (chiefly a test)
-     * can drive real traffic through a just-started proxy while it and the
-     * service it fronts are still alive; `InstrumentedExecutionResult` itself
-     * is only returned after the whole run has already stopped every
-     * process, which is too late for that. A throwing callback is not caught
-     * here, matching `RunOptions.onProcessLifecycleEvent`'s own "must not
-     * hang, may not silently swallow its own failure" rule.
+     * Fires once every collector (including any fronting proxy) has started, before
+     * the observation window's sleep. Lets a caller drive real traffic through a
+     * just-started proxy while it's still alive — `InstrumentedExecutionResult` is
+     * only returned after the run has stopped everything, too late for that. A
+     * throwing callback is not caught here.
      */
     readonly onReady?: (info: {
         readonly execution: Execution;
@@ -98,19 +67,11 @@ export interface InstrumentedExecutionResult {
     /**
      * What the declared whole-execution budget actually did to this run.
      *
-     * `ExecutionConfiguration.timeoutMs` is published to callers as the
-     * whole-execution budget, and before this it bounded only how long a
-     * *service* was allowed to live: `ExecutionController` armed a timer that
-     * killed the processes, and this function then slept the full
-     * `observeForMs` anyway, drained collectors and returned. Measured, not
-     * theoretical — a 1500ms budget with a 12000ms window returned after
-     * 12288ms with zero evidence, because the services had been dead for the
-     * last 10.8s of a window nothing shortened.
-     *
-     * Reported as a struct rather than left implicit in the elapsed time so a
-     * caller can say *which* of the two it got: a full window that found
-     * nothing, or a window cut short before it could. Those are the same two
-     * claims the five report categories exist to keep apart, one layer down.
+     * `timeoutMs` used to bound only the service, not the observation window: a
+     * 1500ms budget with a 12000ms window measurably returned after 12288ms with
+     * zero evidence, since services had been dead for the last 10.8s. Reported as a
+     * struct so a caller can tell a full window that found nothing from one cut
+     * short before it could.
      */
     readonly budget: ExecutionBudgetOutcome;
 }
@@ -129,13 +90,9 @@ export interface ExecutionBudgetOutcome {
 }
 /**
  * Builds the origin → source-root lookup a collector reads through
- * `CollectorContext.resolveSourceRoot`.
- *
- * This is the piece that had been missing at both ends: RT-029 wrote the
- * lookup and nothing called it; RT-033 added the channel and nothing filled
- * it. It closes over the execution's *own* processes, which is what makes
- * the port→service join possible at all — under ephemeral ports the
- * configuration cannot know the port, so only the running process can say.
+ * `CollectorContext.resolveSourceRoot`. Closes over the execution's own
+ * processes, which is what makes the port→service join possible at all — under
+ * ephemeral ports only the running process knows its own port.
  */
 export declare function createSourceRootResolver(processes: readonly ProcessHandle[], configuration: ExecutionConfiguration): (origin: string) => ServiceRootLookup;
 /**

package/dist/instrumented-execution.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"instrumented-execution.d.ts","sourceRoot":"","sources":["../src/instrumented-execution.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAIH,OAAO,KAAK,EAEV,QAAQ,EACR,SAAS,EACT,sBAAsB,EACtB,aAAa,EACb,iBAAiB,EAClB,MAAM,4BAA4B,CAAC;AAEpC,OAAO,KAAK,EAAE,cAAc,EAAuB,kBAAkB,EAAE,MAAM,sCAAsC,CAAC;AAGpH,OAAO,EAEL,KAAK,oBAAoB,EACzB,KAAK,UAAU,EAGhB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAKhE,MAAM,WAAW,0BAA0B;IACzC,oIAAoI;IACpI,QAAQ,CAAC,SAAS,EAAE,oBAAoB,CAAC;IACzC,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,8FAA8F;IAC9F,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC,qIAAqI;IACrI,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAC9B;;;;;OAKG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACnE;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE;QACxB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;QAC9B,mHAAmH;QACnH,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;KACvD,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5B;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,SAAS,QAAQ,EAAE,CAAC;IACvC,6GAA6G;IAC7G,QAAQ,CAAC,qBAAqB,EAAE,SAAS;QAAE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,YAAY,EAAE,UAAU,CAAC,OAAO,4BAA4B,EAAE,SAAS,CAAC,cAAc,CAAC,CAAC,CAAA;KAAE,EAAE,CAAC;IAC/K,8HAA8H;IAC9H,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAC;CACzC;AAED,gDAAgD;AAChD,MAAM,WAAW,sBAAsB;IACrC,oDAAoD;IACpD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,mDAAmD;IACnD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,qCAAqC;IACrC,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC;IACxC,sGAAsG;IACtG,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,yHAAyH;IACzH,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;CAC5B;AAED;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,SAAS,aAAa,EAAE,EACnC,aAAa,EAAE,sBAAsB,GACpC,CAAC,MAAM,EAAE,MAAM,KAAK,iBAAiB,CAEvC;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,oBAAoB,EAC/B,MAAM,EAAE,kBAAkB,GACzB,oBAAoB,CAyBtB;AAED,wBAAsB,wBAAwB,CAAC,KAAK,EAAE,0BAA0B,GAAG,OAAO,CAAC,2BAA2B,CAAC,CA6mBtH"}
+{"version":3,"file":"instrumented-execution.d.ts","sourceRoot":"","sources":["../src/instrumented-execution.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,OAAO,KAAK,EAEV,QAAQ,EACR,SAAS,EACT,sBAAsB,EACtB,aAAa,EACb,iBAAiB,EAClB,MAAM,4BAA4B,CAAC;AAEpC,OAAO,KAAK,EAAE,cAAc,EAAuB,kBAAkB,EAAE,MAAM,sCAAsC,CAAC;AAGpH,OAAO,EAEL,KAAK,oBAAoB,EACzB,KAAK,UAAU,EAGhB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAKhE,MAAM,WAAW,0BAA0B;IACzC,oIAAoI;IACpI,QAAQ,CAAC,SAAS,EAAE,oBAAoB,CAAC;IACzC,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,8FAA8F;IAC9F,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC,qIAAqI;IACrI,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAC9B;;;;;OAKG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACnE;;;;;;OAMG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE;QACxB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;QAC9B,mHAAmH;QACnH,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;KACvD,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5B;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,SAAS,QAAQ,EAAE,CAAC;IACvC,6GAA6G;IAC7G,QAAQ,CAAC,qBAAqB,EAAE,SAAS;QAAE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,YAAY,EAAE,UAAU,CAAC,OAAO,4BAA4B,EAAE,SAAS,CAAC,cAAc,CAAC,CAAC,CAAA;KAAE,EAAE,CAAC;IAC/K,8HAA8H;IAC9H,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC;;;;;;;;OAQG;IACH,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAC;CACzC;AAED,gDAAgD;AAChD,MAAM,WAAW,sBAAsB;IACrC,oDAAoD;IACpD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,mDAAmD;IACnD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,qCAAqC;IACrC,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC;IACxC,sGAAsG;IACtG,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,yHAAyH;IACzH,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;CAC5B;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,SAAS,aAAa,EAAE,EACnC,aAAa,EAAE,sBAAsB,GACpC,CAAC,MAAM,EAAE,MAAM,KAAK,iBAAiB,CAEvC;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,oBAAoB,EAC/B,MAAM,EAAE,kBAAkB,GACzB,oBAAoB,CAwBtB;AAED,wBAAsB,wBAAwB,CAAC,KAAK,EAAE,0BAA0B,GAAG,OAAO,CAAC,2BAA2B,CAAC,CA8etH"}