@descryy/runtime-orchestrator 0.4.8 → 0.4.9

package/dist/instrumented-execution.js

@@ -1,696 +0,0 @@
-/**
- * The assembly wiring the runtime's pieces together in production code (previously
- * only connected ad hoc by tests). Runs an `ExecutionController` over a `services`
- * configuration; wraps each spawned process in a live `ProcessOutputSource`
- * (polls the buffer, yields each line once); builds a `CollectorContext` with a
- * real `resolveSourceRoot` closed over the execution's own processes; starts,
- * drains and stops the adapter's collectors; writes every emitted item through
- * `EvidenceStore` so redaction runs (plan §28).
- *
- * Deliberately does not decide whether a finding exists, correlate to graph
- * nodes, or drive a browser — separate stages, separate contracts.
- */
-import { delimiter } from "node:path";
-import { resolveServiceRootForOrigin } from "@descryy/runtime-contracts";
-import { createInboundProxy } from "@descryy/runtime-backend-observation";
-import { createExternalRequestCollector } from "@descryy/runtime-external-service-observation";
-import { ExecutionController, checkDependencyVersions, checkEnvironmentVersion, runPreflight, portFreeCheck, readinessTargetCheck, createProcessOutputReader, } from "@descryy/runtime-controller";
-import { EvidenceStore } from "@descryy/runtime-evidence-store";
-import { createPollingProcessOutputSource } from "./polling-output-source.js";
-import { COLLECTOR_VERSION } from "./collector-version.js";
-/**
- * Every spawned service's captured output, read off the controller at the
- * moment the result is built. Keyed by service name, which is also the only
- * thing that can be joined back to `ExecutionConfiguration.services`; a handle
- * with no service name has nothing to key on and is skipped.
- */
-function captureServiceOutput(controller) {
-    const output = {};
-    for (const handle of controller.execution.processes) {
-        if (handle.serviceName === null)
-            continue;
-        output[handle.serviceName] = controller.readProcessOutput(handle.serviceName);
-    }
-    return output;
-}
-/**
- * Builds the origin → source-root lookup a collector reads through
- * `CollectorContext.resolveSourceRoot`. Closes over the execution's own
- * processes, which is what makes the port→service join possible at all — under
- * ephemeral ports only the running process knows its own port.
- */
-export function createSourceRootResolver(processes, configuration) {
-    return (origin) => resolveServiceRootForOrigin(origin, { processes, configuration });
-}
-/**
- * Rewrites every spawnable service so it launches with outbound
- * instrumentation in place.
- *
- * The declaration comes from the adapter and names no language; this function
- * applies it and also names none. `attach`-mode services are skipped: their
- * process is already running, so there is no launch left to influence, and
- * pretending otherwise would claim instrumentation that is not there.
- */
-export function applyOutboundLaunch(execution, launch) {
-    const services = {};
-    for (const [name, service] of Object.entries(execution.configuration.services)) {
-        if (service.command === undefined) {
-            services[name] = service;
-            continue;
-        }
-        const prepend = new Set(launch.prependToExisting ?? []);
-        const env = { ...service.env };
-        for (const [key, value] of Object.entries(launch.env ?? {})) {
-            // extend, don't replace, a variable the target relies on (PYTHONPATH is the
-            // live case) -- replacing it breaks the app's own module resolution
-            const existing = prepend.has(key) ? (service.env?.[key] ?? process.env[key] ?? "") : "";
-            env[key] = existing === "" ? value : `${value}${delimiter}${existing}`;
-        }
-        services[name] = {
-            ...service,
-            ...(Object.keys(env).length === 0 ? {} : { env }),
-            ...(launch.interpreterArgs === undefined || launch.interpreterArgs.length === 0
-                ? {}
-                : { interpreterArgs: [...(service.interpreterArgs ?? []), ...launch.interpreterArgs] }),
-        };
-    }
-    return { ...execution, configuration: { ...execution.configuration, services } };
-}
-/**
- * RT-263: the checks this run's own preflight can answer before anything is spawned or
- * attached to — see `@descryy/runtime-controller`'s preflight.ts for the engine. Scoped
- * deliberately narrow: a command-mode (boot) service's declared readiness target is not
- * yet reachable by definition (nothing has started), so only its configured fixed port
- * being free is checked, the same precondition RT-024's ephemeral-port default exists to
- * avoid needing at all. An attach-mode service is expected to already be running, so its
- * declared readiness checks are probed directly, single-shot — filtered to `http`/
- * `tcp-port`, the only kinds answerable without a live process's own output (a
- * `log-pattern` or `command` check would misreport "broken" before this run has started
- * anything to produce output for it to read).
- */
-function buildPreflightChecks(configuration, runOptions) {
-    const checks = [];
-    for (const [name, service] of Object.entries(configuration.services)) {
-        if (service.attach !== undefined) {
-            const readinessSpec = runOptions.readiness[name];
-            if (readinessSpec === undefined)
-                continue;
-            const declared = readinessSpec.checks({ port: service.port ?? 0, outputReader: createProcessOutputReader(() => "") });
-            const singleShotTestable = declared.filter((check) => check.kind === "http" || check.kind === "tcp-port");
-            if (singleShotTestable.length > 0) {
-                checks.push(readinessTargetCheck(`service "${name}" (attach) declared readiness target`, singleShotTestable));
-            }
-        }
-        else if (service.command !== undefined && service.port !== undefined) {
-            checks.push(portFreeCheck("127.0.0.1", service.port, `service "${name}"'s configured port ${String(service.port)} is free`));
-        }
-    }
-    return checks;
-}
-export async function runInstrumentedExecution(input) {
-    // outbound observation needs two things: a collector to read the marker lines,
-    // and a launch that installs client instrumentation before app code can capture
-    // an unpatched client. The launch is adapter-declared and language-specific; an
-    // adapter that declares nothing gets neither.
-    //
-    // budget clock starts here, not at controller.run() -- marginally earlier than
-    // the controller's own timer, so a caller never waits past its declared bound
-    const budgetStartedAt = Date.now();
-    const outboundLaunch = input.adapter.outboundHttpLaunch?.() ?? null;
-    const launchedExecution = outboundLaunch === null ? input.execution : applyOutboundLaunch(input.execution, outboundLaunch);
-    const configuration = launchedExecution.configuration;
-    // closure, not repeated per-return: there are four returns, and one quietly
-    // reporting a different number is the bug this field exists to catch
-    const budgetOutcome = (observedForMs) => {
-        const elapsedMs = Date.now() - budgetStartedAt;
-        return {
-            declaredMs: configuration.timeoutMs,
-            elapsedMs,
-            requestedObservationMs: input.observeForMs,
-            observedForMs,
-            exceeded: elapsedMs > configuration.timeoutMs,
-        };
-    };
-    const controller = ExecutionController.create(launchedExecution);
-    // B7: the execution row, minted here and nowhere else in production.
-    // `EvidenceStore.recordExecution` was complete and tested since the
-    // `executions` table was added -- schema, redaction, environment capture,
-    // upsert -- but this repo's and descry-core's own sources together held
-    // exactly two callers of it outside its own tests, both in
-    // evidence-store's test suite. Every evidence row this run is about to
-    // write carries `controller.execution.executionId`, so the parent row
-    // must exist before the first of them does; `controller.execution` is
-    // real the moment `create()` returns (it mints the id synchronously),
-    // which is before `controller.run()` -- and therefore before this
-    // function's own first `store.write()`, in the catch block just below.
-    input.store.recordExecution({
-        executionId: controller.execution.executionId,
-        application: controller.execution.application,
-        repository: controller.execution.repository,
-        commit: controller.execution.commit,
-        configuration: controller.execution.configuration,
-    });
-    // RT-263: read-only ready check, before anything is spawned or attached to. Reuses
-    // exactly the preconditions the run below depends on, so a broken setup is named with
-    // its fix in seconds rather than after the full readiness wait (up to each service's
-    // own `timeoutMs`) has already failed. Never mutates anything -- see preflight.ts.
-    const preflight = await runPreflight(buildPreflightChecks(configuration, input.runOptions));
-    if (preflight.status === "broken") {
-        return {
-            execution: controller.execution,
-            evidence: [],
-            collectorCapabilities: [],
-            validationError: "preflight failed before this run started anything: " +
-                preflight.checks
-                    .filter((check) => check.required && !check.ok)
-                    .map((check) => `${check.label} — ${check.message}`)
-                    .join("; "),
-            budget: budgetOutcome(0),
-            // Refused before spawning, so nothing can have been said -- empty is the true
-            // answer here, not a default standing in for one.
-            serviceOutput: {},
-        };
-    }
-    // RT-219: controller.run()'s one throw path (spawnProcess catch/rethrow, after
-    // recording the failure in serviceStartResults) used to reject this whole
-    // function uncaught -- zero evidence trail. Caught here and written through
-    // EvidenceStore tagged "harness", same "resolves normally" contract RT-219
-    // established for collector.start(). controller.execution/serviceStartResults
-    // are both already real at this point (run() mutates state before it throws).
-    let execution;
-    try {
-        execution = await controller.run(input.runOptions);
-    }
-    catch (error) {
-        const detail = error instanceof Error ? `${error.name}: ${error.message}` : String(error);
-        const harnessEvidence = input.store.write({
-            executionId: controller.execution.executionId,
-            timestamp: new Date().toISOString(),
-            source: "harness",
-            service: null,
-            process: null,
-            eventType: "COLLECTOR_ERROR",
-            payload: {
-                raw: `ExecutionController.run() threw instead of resolving: ${detail}`,
-                error: detail,
-            },
-            traceId: null,
-            requestId: null,
-            correlationId: null,
-            graphNodeId: null,
-            sourceLocation: null,
-            stackTrace: null,
-            confidence: 1,
-            collectorVersion: COLLECTOR_VERSION,
-        });
-        return {
-            execution: controller.execution,
-            evidence: [harnessEvidence],
-            collectorCapabilities: [],
-            validationError: `ExecutionController.run() threw: ${detail}`,
-            budget: budgetOutcome(0),
-            // The throw path is where output matters most: whatever the service
-            // printed before the run came apart is the only account of it there is.
-            serviceOutput: captureServiceOutput(controller),
-        };
-    }
-    if (controller.validationError !== null) {
-        return {
-            execution,
-            evidence: [],
-            collectorCapabilities: [],
-            validationError: controller.validationError,
-            budget: budgetOutcome(0),
-            // Refused before spawning, so nothing can have been said. Empty here is
-            // the true answer, not a default standing in for one.
-            serviceOutput: {},
-        };
-    }
-    // a handle with no serviceName can't be attributed to a config entry -- skipped
-    // declared before the sources close over it: the flip lets stop() finish rather
-    // than wait forever on a source still watching a live buffer
-    let finished = false;
-    const sources = [];
-    // second, independent source per process -- NOT shared with the backend
-    // collector's: createPollingProcessOutputSource yields each line exactly once,
-    // so sharing means two collectors race for it. Measured: sharing made the
-    // backend log collector eat every DESCRY_EXTERNAL_REQUEST line and the outbound
-    // collector report nothing, reading as "no outbound calls".
-    const namedSources = [];
-    for (const handle of execution.processes) {
-        if (handle.serviceName === null)
-            continue;
-        const serviceName = handle.serviceName;
-        // stamped here, at construction -- by the time evidence reaches
-        // correlateExecution the handle is out of scope and this association is gone
-        sources.push(createPollingProcessOutputSource({
-            processId: handle.processId,
-            serviceName,
-            readOutput: () => controller.readProcessOutput(serviceName),
-            isFinished: () => finished,
-        }));
-        namedSources.push({
-            serviceName,
-            source: createPollingProcessOutputSource({
-                processId: handle.processId,
-                serviceName,
-                readOutput: () => controller.readProcessOutput(serviceName),
-                isFinished: () => finished,
-            }),
-        });
-    }
-    const backendCollectors = input.adapter.createBackendCollectors(sources);
-    // only started when the launch above actually installed instrumentation --
-    // otherwise it would report "no outbound calls" for a service making them,
-    // worse than declining to look. createExternalRequestCollector names no
-    // language itself; the adapter's stack parser is the only language-specific bit.
-    const outboundCollectors = outboundLaunch === null
-        ? []
-        : namedSources.map(({ source, serviceName }) => createExternalRequestCollector({
-            source,
-            service: serviceName,
-            stackTraceParser: input.adapter.stackTraceParser,
-        }));
-    const emitted = [];
-    // RT-261: bounds on the evidence THIS run accumulates in memory, on top of
-    // (not instead of) each collector's own bounds -- a noisy app that clears
-    // every per-collector cap by fanning across many sources could still grow
-    // this array without limit. Starting values, not measurements.
-    //
-    // Per-source: caps how many events any single `source` (roughly, one
-    // collector's worth) contributes before the rest are dropped -- disclosed
-    // once per source, not once per dropped event, so the disclosure itself
-    // can't become the thing that blows the budget.
-    const MAX_EVENTS_PER_SOURCE = 10_000;
-    // Whole-run: caps total evidence payload bytes across every source. Past
-    // it, a payload that would grow the total further is kept as a summary
-    // instead of dropped outright -- the row (and its eventType/source/ids)
-    // still exists, only its body is what got cut.
-    const MAX_RUN_EVIDENCE_BYTES = 50 * 1024 * 1024;
-    const eventCountBySource = new Map();
-    const sourcesAtCap = new Set();
-    let totalEvidenceBytes = 0;
-    let runCapDisclosed = false;
-    function approximatePayloadBytes(payload) {
-        try {
-            return Buffer.byteLength(JSON.stringify(payload ?? {}), "utf8");
-        }
-        catch {
-            // Circular or otherwise unstringifiable -- treat as unknown-but-nonzero
-            // rather than crash the collector that produced it.
-            return 0;
-        }
-    }
-    function harnessDisclosure(raw, collectorId, error) {
-        return input.store.write({
-            executionId: execution.executionId,
-            timestamp: new Date().toISOString(),
-            source: "harness",
-            service: null,
-            process: null,
-            eventType: "COLLECTOR_ERROR",
-            payload: error === undefined ? { raw, collectorId } : { raw, collectorId, error },
-            traceId: null,
-            requestId: null,
-            correlationId: null,
-            graphNodeId: null,
-            sourceLocation: null,
-            stackTrace: null,
-            confidence: 1,
-            collectorVersion: COLLECTOR_VERSION,
-        });
-    }
-    // dependency/environment version-mismatch checks (DEC-NEXT-fault-layer-empirical-
-    // confirmation.md): tagged "dependency-check"/"environment-check" rather than the
-    // service's own source, so a reader can tell version drift from an app
-    // observation. Run once per service (own cwd/lockfile/engines.node),
-    // unconditionally, but only emitted as evidence on an actual mismatch.
-    //
-    // observedNodeVersion is process.version captured once during controller.run();
-    // never re-probed here.
-    const observedNodeVersion = execution.environmentMetadata?.nodeVersion ?? process.version;
-    for (const handle of execution.processes) {
-        if (handle.serviceName === null)
-            continue;
-        const serviceConfig = configuration.services[handle.serviceName];
-        if (serviceConfig === undefined)
-            continue;
-        const dependencyResult = checkDependencyVersions(serviceConfig.cwd);
-        for (const mismatch of dependencyResult.mismatches) {
-            emitted.push(input.store.write({
-                executionId: execution.executionId,
-                timestamp: new Date().toISOString(),
-                source: "dependency-check",
-                service: handle.serviceName,
-                process: handle.processId,
-                eventType: "DEPENDENCY_VERSION_MISMATCH",
-                payload: {
-                    raw: `dependency "${mismatch.name}": lockfile declares ${mismatch.declaredVersion}, resolved ${mismatch.resolvedVersion}`,
-                    name: mismatch.name,
-                    declaredVersion: mismatch.declaredVersion,
-                    resolvedVersion: mismatch.resolvedVersion,
-                },
-                traceId: null,
-                requestId: null,
-                correlationId: null,
-                graphNodeId: null,
-                sourceLocation: null,
-                stackTrace: null,
-                confidence: 1,
-                collectorVersion: COLLECTOR_VERSION,
-            }));
-        }
-        const environmentResult = checkEnvironmentVersion(serviceConfig.cwd, observedNodeVersion);
-        if (environmentResult.mismatch) {
-            emitted.push(input.store.write({
-                executionId: execution.executionId,
-                timestamp: new Date().toISOString(),
-                source: "environment-check",
-                service: handle.serviceName,
-                process: handle.processId,
-                eventType: "ENVIRONMENT_VERSION_MISMATCH",
-                payload: {
-                    raw: `declared node version ${environmentResult.declaredVersion ?? "unknown"} (${environmentResult.declaredSource ?? "unknown"}), observed ${environmentResult.observedVersion}`,
-                    declaredVersion: environmentResult.declaredVersion,
-                    declaredSource: environmentResult.declaredSource,
-                    observedVersion: environmentResult.observedVersion,
-                },
-                traceId: null,
-                requestId: null,
-                correlationId: null,
-                graphNodeId: null,
-                sourceLocation: null,
-                stackTrace: null,
-                confidence: 1,
-                collectorVersion: COLLECTOR_VERSION,
-            }));
-        }
-    }
-    // opt-in InboundProxy wiring (RT-192, DEC-271), see frontWithInboundProxy's doc.
-    // Built after controller.run() returns, so readiness already exists in
-    // serviceStartResults -- this loop reads that answer, never re-derives it.
-    const proxies = [];
-    if (input.frontWithInboundProxy !== undefined) {
-        for (const handle of execution.processes) {
-            const serviceName = handle.serviceName;
-            if (serviceName === null)
-                continue;
-            if (input.frontWithInboundProxy[serviceName] !== true)
-                continue;
-            const readinessOutcome = controller.serviceStartResults.find((result) => result.serviceName === serviceName && result.stage === "readiness");
-            if (readinessOutcome?.succeeded !== true || handle.port === null) {
-                // requested but never proven live -- reported as COLLECTOR_ERROR, not a
-                // silent no-proxy fallback (plan §17: "not observed" vs "nothing there")
-                emitted.push(input.store.write({
-                    executionId: execution.executionId,
-                    timestamp: new Date().toISOString(),
-                    source: "backend-process",
-                    service: serviceName,
-                    process: handle.processId,
-                    eventType: "COLLECTOR_ERROR",
-                    payload: {
-                        raw: `service "${serviceName}" was flagged frontWithInboundProxy but its own readiness never succeeded -- never fronting a process that was not proven live`,
-                        collectorId: `inbound-proxy:${handle.processId}`,
-                    },
-                    traceId: null,
-                    requestId: null,
-                    correlationId: null,
-                    graphNodeId: null,
-                    sourceLocation: null,
-                    stackTrace: null,
-                    confidence: 1,
-                    collectorVersion: COLLECTOR_VERSION,
-                }));
-                continue;
-            }
-            proxies.push({
-                serviceName,
-                proxy: createInboundProxy({
-                    targetHost: "127.0.0.1",
-                    targetPort: handle.port,
-                    processId: handle.processId,
-                    service: serviceName,
-                }),
-            });
-        }
-    }
-    const collectors = [...backendCollectors, ...outboundCollectors, ...proxies.map((entry) => entry.proxy.collector)];
-    const context = {
-        executionId: execution.executionId,
-        configuration,
-        // redaction runs here, on the way in -- EvidenceStore.write() is the only
-        // path that sets redactionStatus (plan §28)
-        //
-        // RT-261: bounded before it reaches the store, not after -- see the
-        // MAX_EVENTS_PER_SOURCE/MAX_RUN_EVIDENCE_BYTES block above this function.
-        emit: (evidenceInput) => {
-            const { source } = evidenceInput;
-            const countSoFar = eventCountBySource.get(source) ?? 0;
-            if (countSoFar >= MAX_EVENTS_PER_SOURCE) {
-                if (!sourcesAtCap.has(source)) {
-                    sourcesAtCap.add(source);
-                    emitted.push(harnessDisclosure(`source "${source}" reached this run's ${String(MAX_EVENTS_PER_SOURCE)}-event cap -- further events from it are dropped ` +
-                        "for the rest of this run, disclosed once here rather than per dropped event.", source));
-                }
-                return;
-            }
-            eventCountBySource.set(source, countSoFar + 1);
-            const payloadBytes = approximatePayloadBytes(evidenceInput.payload);
-            if (totalEvidenceBytes + payloadBytes > MAX_RUN_EVIDENCE_BYTES) {
-                if (!runCapDisclosed) {
-                    runCapDisclosed = true;
-                    emitted.push(harnessDisclosure(`this run's whole-execution evidence cap (${String(MAX_RUN_EVIDENCE_BYTES)} bytes) was reached -- further large ` +
-                        "payloads are kept as a summary (eventType/source/ids only) instead of dropped outright.", "orchestrator:evidence-cap"));
-                }
-                const summarized = input.store.write({
-                    ...evidenceInput,
-                    executionId: execution.executionId,
-                    payload: {
-                        raw: `payload dropped -- this run's whole-execution evidence cap (${String(MAX_RUN_EVIDENCE_BYTES)} bytes) was already reached`,
-                        originalEventType: evidenceInput.eventType,
-                    },
-                });
-                emitted.push(summarized);
-                totalEvidenceBytes += approximatePayloadBytes(summarized.payload);
-                return;
-            }
-            totalEvidenceBytes += payloadBytes;
-            emitted.push(input.store.write({ ...evidenceInput, executionId: execution.executionId }));
-        },
-        resolveSourceRoot: createSourceRootResolver(execution.processes, configuration),
-    };
-    // RT-219: collector.start()'s documented failure path resolves {available:
-    // false, reason}, handled below. A collector that instead THROWS out of
-    // start() is a different claim -- the harness's own machinery breaking, not
-    // "I looked and could not" -- so it's caught here and tagged "harness" rather
-    // than the collector's domain source, instead of aborting this Promise.all
-    // uncaught with zero evidence trail.
-    const startOutcomes = await Promise.all(collectors.map(async (collector) => {
-        try {
-            return { collector, result: await collector.start(context), threw: false };
-        }
-        catch (error) {
-            const detail = error instanceof Error ? `${error.name}: ${error.message}` : String(error);
-            emitted.push(input.store.write({
-                executionId: execution.executionId,
-                timestamp: new Date().toISOString(),
-                source: "harness",
-                service: null,
-                process: null,
-                eventType: "COLLECTOR_ERROR",
-                payload: {
-                    raw: `collector "${collector.collectorId}" threw during start() instead of resolving {available:false}: ${detail}`,
-                    collectorId: collector.collectorId,
-                    error: detail,
-                },
-                traceId: null,
-                requestId: null,
-                correlationId: null,
-                graphNodeId: null,
-                sourceLocation: null,
-                stackTrace: null,
-                confidence: 1,
-                collectorVersion: COLLECTOR_VERSION,
-            }));
-            return { collector, result: { available: false, reason: `start() threw: ${detail}` }, threw: true };
-        }
-    }));
-    // a thrown start() was already reported above under "harness" -- excluded here
-    // to avoid double-reporting the same failure under "backend-process"
-    const unavailable = startOutcomes.filter((entry) => !entry.threw && !entry.result.available);
-    // reported, never silently absent (plan §17: "not observed" vs "nothing there")
-    for (const entry of unavailable) {
-        emitted.push(input.store.write({
-            executionId: execution.executionId,
-            timestamp: new Date().toISOString(),
-            source: "backend-process",
-            service: null,
-            process: null,
-            eventType: "COLLECTOR_ERROR",
-            payload: {
-                raw: `collector "${entry.collector.collectorId}" reported unavailable at start: ${entry.result.available ? "" : (entry.result.reason ?? "no reason given")}`,
-                collectorId: entry.collector.collectorId,
-            },
-            traceId: null,
-            requestId: null,
-            correlationId: null,
-            graphNodeId: null,
-            sourceLocation: null,
-            stackTrace: null,
-            confidence: 1,
-            collectorVersion: COLLECTOR_VERSION,
-        }));
-    }
-    // proxies with available:false above never reach here -- port stayed null
-    const proxyPorts = {};
-    for (const entry of proxies) {
-        const port = entry.proxy.port();
-        if (port !== null)
-            proxyPorts[entry.serviceName] = port;
-    }
-    // Wrapped because a throw above teardown used to leak the whole execution.
-    // onReady is caller code, documented not to be caught -- but "not caught" and
-    // "not cleaned up" are different promises: when onReady threw, finished stayed
-    // false, so collector.stop()/controller.stop() were skipped, sources kept
-    // polling, the spawned child was never killed, and the timer held the event
-    // loop open. Measured: rejects in 270ms, process then never exits. Exception
-    // still propagates unchanged to the caller; only the leak goes away.
-    //
-    // Found the hard way: a worktree missing node_modules made a test's onReady
-    // throw after a correctly bounded readiness wait, then the suite hung for
-    // twenty minutes.
-    let observationMs = 0;
-    let bodyFailure = null;
-    let teardownFailure = null;
-    try {
-        await input.onReady?.({ execution, proxyPorts });
-        // observation window is bounded by the declared budget, not just observeForMs
-        // -- unconditionally sleeping the full window used to leave timeoutMs bounding
-        // only the service, not the wait; measured, a 1500ms budget with a 12000ms
-        // window returned after 12288ms with zero evidence (services dead the whole
-        // remainder). Clamped rather than aborted: teardown still owns OS resources
-        // and must run; the overshoot is reported via budget.exceeded, not hidden.
-        const remainingMs = budgetStartedAt + configuration.timeoutMs - Date.now();
-        observationMs = Math.max(0, Math.min(input.observeForMs, remainingMs));
-        if (observationMs > 0) {
-            await new Promise((resolve) => setTimeout(resolve, observationMs));
-        }
-        // rule 7: cut-short window is a labelled degradation. execution.state's
-        // TIMED_OUT says the services stopped early, not that observation did --
-        // tagged "harness"/COLLECTOR_ERROR to keep "found nothing" apart from
-        // "stopped looking".
-        if (observationMs < input.observeForMs) {
-            emitted.push(input.store.write({
-                executionId: execution.executionId,
-                timestamp: new Date().toISOString(),
-                source: "harness",
-                service: null,
-                process: null,
-                eventType: "COLLECTOR_ERROR",
-                payload: {
-                    raw: `the observation window was cut short by the declared whole-execution budget: ` +
-                        `observed for ${String(observationMs)}ms of the ${String(input.observeForMs)}ms requested, ` +
-                        `against a ${String(configuration.timeoutMs)}ms budget. Evidence from this run is partial — ` +
-                        `absence of an event is not evidence the application did not produce one.`,
-                    collectorId: "orchestrator:execution-budget",
-                },
-                traceId: null,
-                requestId: null,
-                correlationId: null,
-                graphNodeId: null,
-                sourceLocation: null,
-                stackTrace: null,
-                confidence: 1,
-                collectorVersion: COLLECTOR_VERSION,
-            }));
-        }
-    }
-    catch (error) {
-        // held, not handled -- rethrown below, unchanged, once teardown has run
-        bodyFailure = { error };
-    }
-    finally {
-        // order matters: sources must be told the process is done before stop()
-        // awaits their drain, or it waits forever on a generator polling a live buffer
-        finished = true;
-        // RT-262: before this, `Promise.all` meant one collector's stop() throwing
-        // aborted the group immediately -- collectors after it in the array never
-        // got their own stop() called, and (worse) the app-process kill below sat
-        // inside the same try, so it never ran either: a single misbehaving
-        // collector both dropped other collectors' teardown AND leaked the real
-        // spawned process. `allSettled` runs every collector's stop() to
-        // completion regardless of any other's outcome; a rejection becomes a
-        // disclosed COLLECTOR_ERROR (its own evidence survives this run, it just
-        // named what went wrong) instead of an exception that skips the rest.
-        const stopOutcomes = await Promise.allSettled(collectors.map((collector) => collector.stop()));
-        for (let index = 0; index < stopOutcomes.length; index++) {
-            const outcome = stopOutcomes[index];
-            if (outcome?.status !== "rejected")
-                continue;
-            const collector = collectors[index];
-            const detail = outcome.reason instanceof Error ? `${outcome.reason.name}: ${outcome.reason.message}` : String(outcome.reason);
-            emitted.push(harnessDisclosure(`collector "${collector?.collectorId ?? "unknown"}" threw during stop(): ${detail}`, collector?.collectorId ?? "unknown", detail));
-        }
-        try {
-            // Always runs, even if one or more collectors above threw during
-            // stop() -- killing the real app process must never depend on every
-            // collector's own teardown succeeding. This is the one failure RT-262
-            // still escalates: a process Descry cannot confirm it killed is a
-            // leaked process, not a degraded observation.
-            if (observationMs < input.observeForMs) {
-                await controller.timeout();
-            }
-            else {
-                await controller.stop();
-            }
-        }
-        catch (teardownError) {
-            // held and rethrown below rather than thrown inside finally, which can
-            // discard an in-flight exception
-            if (bodyFailure === null) {
-                teardownFailure = { error: teardownError };
-            }
-            else {
-                // caller's error is the actionable one; a teardown failure must not
-                // silently replace it -- written to the evidence store instead (tagged
-                // "harness", RT-219) rather than thrown. Not in the returned array, but
-                // the store is durable so the record survives the throw.
-                input.store.write({
-                    executionId: execution.executionId,
-                    timestamp: new Date().toISOString(),
-                    source: "harness",
-                    service: null,
-                    process: null,
-                    eventType: "COLLECTOR_ERROR",
-                    payload: {
-                        raw: "teardown also failed while unwinding from an earlier failure, and is recorded rather than " +
-                            `thrown so it does not mask it: ${teardownError instanceof Error ? `${teardownError.name}: ${teardownError.message}` : String(teardownError)}`,
-                        collectorId: "orchestrator:teardown",
-                    },
-                    traceId: null,
-                    requestId: null,
-                    correlationId: null,
-                    graphNodeId: null,
-                    sourceLocation: null,
-                    stackTrace: null,
-                    confidence: 1,
-                    collectorVersion: COLLECTOR_VERSION,
-                });
-            }
-        }
-    }
-    // rethrown untouched, same object/stack; caller's failure wins over teardown's
-    if (bodyFailure !== null)
-        throw bodyFailure.error;
-    if (teardownFailure !== null)
-        throw teardownFailure.error;
-    return {
-        execution: controller.execution,
-        evidence: emitted,
-        collectorCapabilities: collectors.map((collector) => ({ collectorId: collector.collectorId, capabilities: collector.capabilities() })),
-        validationError: null,
-        budget: budgetOutcome(observationMs),
-        serviceOutput: captureServiceOutput(controller),
-    };
-}
-//# sourceMappingURL=instrumented-execution.js.map