@duckmind/dm-darwin-x64 0.66.5 → 0.66.6

package/extensions/dm-lens/dist/clients/instance-reaper.js

@@ -0,0 +1,682 @@
+export const STALE_HEARTBEAT_MS = 6 * 60 * 60 * 1000;
+import { spawn as nodeSpawn } from "node:child_process";
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { writeFileAtomicAsync } from "./atomic-write.js";
+import { sweepOwnStagingFiles } from "./atomic-write-staging.js";
+import { acquireQuarantinePidFileLock } from "./bounded-pid-file-lock.js";
+import { unrefChildAndPipes } from "./child-unref.js";
+import { incrementDegradationCount, recordDegradationOnce } from "./degradation-ledger.js";
+import { getGlobalDmLensDir } from "./file-utils.js";
+import { resolveBackstopStateDir } from "./instance-reaper-state.js";
+import { isInstanceRegistryEnabled, pruneDeadInstances as pruneDeadRegistryInstances, readInstanceRegistry } from "./instance-registry.js";
+import { logLatency } from "./latency-logger.js";
+import { isInPidNamespace, ownPidNamespace, queryProcessIdentities, queryProcessTable, readOwnerTags, windowsExe } from "./process-snapshot.js";
+const isWindows = process.platform === "win32";
+function isInstanceKillEligible(instance, isPidAlive, startOf) {
+  if (!isPidAlive(instance.pid))
+    return true;
+  return isAnotherProcess(instance.processStart, startOf(instance.pid));
+}
+function isAnotherProcess(recorded, current) {
+  const bootOf = (start) => start.includes("@") ? start.slice(start.indexOf("@") + 1) : "";
+  return recorded !== undefined && current !== undefined && current !== recorded && bootOf(current) === bootOf(recorded);
+}
+function isInstanceEntryStale(instance, now) {
+  const heartbeatMs = Date.parse(instance.heartbeatAt);
+  if (Number.isNaN(heartbeatMs))
+    return true;
+  return now - heartbeatMs > STALE_HEARTBEAT_MS;
+}
+function collectLiveMarkers(registry, isPidAlive) {
+  const liveMarkers = new Set;
+  for (const instance of registry) {
+    if (!isPidAlive(instance.pid))
+      continue;
+    for (const child of instance.lspChildren) {
+      if (child.marker)
+        liveMarkers.add(child.marker);
+    }
+  }
+  return liveMarkers;
+}
+function classifyDeadInstanceChildren(instance, isPidAlive, matchProcess, liveMarkers, out) {
+  for (const child of instance.lspChildren) {
+    const childAlive = isPidAlive(child.pid);
+    if (childAlive) {
+      const expected = {
+        command: child.command,
+        marker: child.marker,
+        processStart: child.processStart
+      };
+      const identityOk = matchProcess ? matchProcess(child.pid, expected) : true;
+      if (identityOk) {
+        out.childrenToKill.push({
+          pid: child.pid,
+          serverId: child.serverId,
+          ...expected
+        });
+        continue;
+      }
+    }
+    if (child.marker && !liveMarkers.has(child.marker)) {
+      out.markerSearches.push({
+        marker: child.marker,
+        serverId: child.serverId
+      });
+    }
+  }
+}
+export function decideOrphanReaping(registry, isPidAlive, matchProcess, now = Date.now(), startOf = () => {
+  return;
+}, judgeable = () => true) {
+  const deadInstances = [];
+  const staleInstances = [];
+  const childrenToKill = [];
+  const markerSearches = [];
+  const liveMarkers = collectLiveMarkers(registry, isPidAlive);
+  for (const instance of registry) {
+    if (judgeable(instance) && isInstanceKillEligible(instance, isPidAlive, startOf)) {
+      deadInstances.push(instance);
+      classifyDeadInstanceChildren(instance, isPidAlive, matchProcess, liveMarkers, {
+        childrenToKill,
+        markerSearches
+      });
+    } else if (isInstanceEntryStale(instance, now)) {
+      staleInstances.push(instance);
+    }
+  }
+  return { deadInstances, staleInstances, childrenToKill, markerSearches };
+}
+export function realIsPidAlive(pid) {
+  if (!Number.isFinite(pid) || pid <= 0)
+    return false;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (err) {
+    const code = err?.code;
+    if (code === "ESRCH")
+      return false;
+    return true;
+  }
+}
+const STAGE_PID_PATTERN = /\.stage-(\d+)-/;
+export function isStaleStageFile(entry, artifactPrefix) {
+  if (!entry.startsWith(artifactPrefix))
+    return false;
+  const match = STAGE_PID_PATTERN.exec(entry);
+  if (!match)
+    return false;
+  return !realIsPidAlive(Number(match[1]));
+}
+export const ATOMIC_STAGE_SWEEP_MAX_ENTRIES = 512;
+export async function sweepAtomicWriteStages(directories, options = {}) {
+  const requestedMax = options.maxEntries ?? ATOMIC_STAGE_SWEEP_MAX_ENTRIES;
+  const maxEntries = Number.isFinite(requestedMax) ? Math.max(1, Math.floor(requestedMax)) : ATOMIC_STAGE_SWEEP_MAX_ENTRIES;
+  const isPidAlive = options.isPidAlive ?? realIsPidAlive;
+  return sweepOwnStagingFiles(directories, { maxEntries, isPidAlive });
+}
+async function findPidsByMarkerWindows(marker) {
+  if (!isWindows || !marker)
+    return [];
+  const result = await queryProcessTable({
+    fields: ["pid"],
+    filter: { column: "CommandLine", op: "like", values: [marker] },
+    excludeSelfPid: true
+  }, {
+    timeoutMs: BACKSTOP_SCAN_TIMEOUT_MS,
+    onTimeout: (child) => terminateScannerChild(child, {
+      kind: "orphan-backstop-scanner-escalated",
+      timeoutMs: BACKSTOP_SCAN_TIMEOUT_MS
+    })
+  });
+  if (result.status !== "ok") {
+    recordDegradationOnce({
+      kind: "orphan-backstop-scan-failed",
+      subject: "marker-search",
+      reason: `marker command-line search ${result.status}`
+    });
+  }
+  return result.rows.map((row) => row.pid);
+}
+async function queryIdentities(pids) {
+  const result = await queryProcessIdentities(pids, {
+    timeoutMs: BACKSTOP_SCAN_TIMEOUT_MS,
+    onTimeout: (child) => terminateScannerChild(child, {
+      kind: "orphan-backstop-scanner-escalated",
+      timeoutMs: BACKSTOP_SCAN_TIMEOUT_MS
+    })
+  });
+  const psReportedNoSuchPid = !isWindows && result.status === "exit-error";
+  const failed = result.status !== "ok" && !psReportedNoSuchPid;
+  if (failed) {
+    recordDegradationOnce({
+      kind: "orphan-backstop-scan-failed",
+      subject: "identity-query",
+      reason: `command-line identity query ${result.status}; reap suppressed this sweep`
+    });
+  }
+  return { identities: result.identities, failed };
+}
+export function buildIdentityMatcher(identities) {
+  return (pid, expected) => {
+    const identity = identities.get(pid);
+    if (identity === undefined)
+      return false;
+    if (expected.processStart === undefined || identity.start !== expected.processStart)
+      return false;
+    const cmdline = identity.command;
+    if (expected.marker && cmdline.includes(expected.marker))
+      return true;
+    const basename = path.basename(expected.command ?? "").toLowerCase();
+    if (!basename)
+      return false;
+    return cmdline.toLowerCase().includes(basename);
+  };
+}
+const KILL_VERIFY_ATTEMPTS = 5;
+const KILL_VERIFY_INTERVAL_MS = 100;
+function sleepUnref(ms) {
+  return new Promise((resolve) => {
+    const timer = setTimeout(resolve, ms);
+    timer.unref();
+  });
+}
+async function killPidTree(pid, options = {}) {
+  if (!Number.isFinite(pid) || pid <= 0)
+    return "invalid";
+  if (options.confirmIdentity && !await options.confirmIdentity())
+    return "changed";
+  if (isWindows) {
+    try {
+      const taskkill = windowsExe("taskkill.exe");
+      const killer = nodeSpawn(taskkill, ["/F", "/T", "/PID", String(pid)], {
+        shell: false,
+        windowsHide: true,
+        stdio: "ignore"
+      });
+      unrefChildAndPipes(killer);
+      await new Promise((resolve) => {
+        killer.once("close", () => resolve());
+        killer.once("error", () => resolve());
+      });
+    } catch {}
+  } else {
+    try {
+      process.kill(-pid, "SIGKILL");
+    } catch {
+      try {
+        process.kill(pid, "SIGKILL");
+      } catch {}
+    }
+  }
+  return await verifyPidGone(pid, options);
+}
+async function verifyPidGone(pid, options = {}) {
+  const isPidAlive = options.isPidAlive ?? realIsPidAlive;
+  const attempts = Math.max(1, options.verifyAttempts ?? KILL_VERIFY_ATTEMPTS);
+  const intervalMs = Math.max(0, options.verifyIntervalMs ?? KILL_VERIFY_INTERVAL_MS);
+  for (let attempt = 0;attempt < attempts; attempt++) {
+    let alive;
+    try {
+      alive = isPidAlive(pid);
+    } catch {
+      alive = true;
+    }
+    if (!alive)
+      return "gone";
+    if (attempt < attempts - 1)
+      await sleepUnref(intervalMs);
+  }
+  return "alive";
+}
+const MANAGED_BINARIES = [
+  { name: "ast-grep", launcher: "native" },
+  { name: "opengrep-core", launcher: "native" },
+  { name: "opengrep", launcher: "native" },
+  { name: "marksman", launcher: "native" },
+  { name: "zizmor", launcher: "native" },
+  { name: "typos-lsp", launcher: "native" },
+  { name: "yaml-language-server", launcher: "node" },
+  { name: "typescript-language-server", launcher: "node" }
+];
+export const MANAGED_BINARY_NAMES = MANAGED_BINARIES.map((binary) => binary.name);
+export const MANAGED_IMAGE_NAMES = [
+  ...new Set(MANAGED_BINARIES.map((binary) => binary.launcher === "node" ? "node.exe" : `${binary.name}.exe`))
+];
+export function decideBackstopOrphanReaping(processes, registry, isPidAlive, options = {}) {
+  return partitionBackstopCandidates(processes, registry, isPidAlive, options).eligible;
+}
+export const BACKSTOP_SPAWN_GRACE_MS = 60000;
+function isOwnerDead(proc, isPidAlive, platform, startOf) {
+  if (platform !== "win32") {
+    const tag = proc.ownerTag;
+    if (tag === undefined)
+      return false;
+    if (!isPidAlive(tag.pid))
+      return true;
+    return isAnotherProcess(tag.start, startOf(tag.pid));
+  }
+  const parent = proc.parentPid;
+  if (!Number.isFinite(parent) || parent <= 0 || parent === proc.pid)
+    return false;
+  if (!isPidAlive(parent))
+    return true;
+  const parentStart = Date.parse(startOf(parent) ?? "");
+  return parentStart > Date.parse(proc.start ?? "") + WINDOWS_DST_MARGIN_MS;
+}
+const WINDOWS_DST_MARGIN_MS = 3600000;
+export function partitionBackstopCandidates(processes, registry, isPidAlive, options = {}) {
+  const graceMs = Math.max(0, options.graceMs ?? BACKSTOP_SPAWN_GRACE_MS);
+  const platform = options.platform ?? process.platform;
+  const startOf = options.startOf ?? (() => {
+    return;
+  });
+  const trackedStarts = new Map;
+  for (const instance of registry) {
+    for (const child of instance.lspChildren) {
+      const starts = trackedStarts.get(child.pid) ?? [];
+      starts.push(child.processStart);
+      trackedStarts.set(child.pid, starts);
+    }
+  }
+  const isTracked = (proc) => trackedStarts.get(proc.pid)?.some((start) => start === undefined || start === proc.start) === true;
+  const partition = {
+    eligible: [],
+    tooFresh: [],
+    unknownAge: [],
+    unknownStart: []
+  };
+  for (const proc of processes) {
+    if (isTracked(proc))
+      continue;
+    if (!isOwnerDead(proc, isPidAlive, platform, startOf))
+      continue;
+    if (proc.start === undefined) {
+      partition.unknownStart.push(proc);
+      continue;
+    }
+    if (graceMs > 0) {
+      const ageMs = proc.ageMs;
+      if (typeof ageMs !== "number" || !Number.isFinite(ageMs)) {
+        partition.unknownAge.push(proc);
+        continue;
+      }
+      if (ageMs < graceMs) {
+        partition.tooFresh.push(proc);
+        continue;
+      }
+    }
+    partition.eligible.push(proc);
+  }
+  return partition;
+}
+async function enumerateManagedProcesses(options = {}) {
+  const scanTimeoutMs = options.timeoutMs ?? BACKSTOP_SCAN_TIMEOUT_MS;
+  const result = await queryProcessTable({
+    fields: ["pid", "ppid", "ageMs", "command"],
+    filter: { column: "Name", op: "eq", values: MANAGED_IMAGE_NAMES }
+  }, {
+    timeoutMs: scanTimeoutMs,
+    onTimeout: (child) => terminateScannerChild(child, {
+      verifyAttempts: options.verifyAttempts,
+      verifyIntervalMs: options.verifyIntervalMs,
+      kind: "orphan-backstop-scanner-escalated",
+      timeoutMs: scanTimeoutMs
+    })
+  });
+  return narrowToManagedBinaries(result.rows.map((row) => ({
+    pid: row.pid,
+    parentPid: row.ppid,
+    command: row.command,
+    ageMs: row.ageMs
+  })), result);
+}
+function narrowToManagedBinaries(processes, result) {
+  return {
+    processes: processes.filter((proc) => matchesManagedBinary(proc.command)),
+    status: result.status,
+    timeoutKill: result.timeoutKill
+  };
+}
+export async function terminateScannerChild(child, options) {
+  const pid = child.pid;
+  const outcome = typeof pid === "number" && pid > 0 ? await killPidTree(pid, {
+    verifyAttempts: options.verifyAttempts,
+    verifyIntervalMs: options.verifyIntervalMs
+  }) : "invalid";
+  incrementDegradationCount({
+    kind: options.kind,
+    subject: `${isWindows ? "win32-cim" : "posix-ps"}#${pid ?? "no-pid"}`,
+    reason: `scan exceeded its ${options.timeoutMs}ms timeout; tree kill reported ${outcome}`
+  });
+  return outcome;
+}
+export const BACKSTOP_SCAN_TIMEOUT_MS = 5000;
+function matchesManagedBinary(command) {
+  const lower = command.toLowerCase();
+  return MANAGED_BINARY_NAMES.some((name) => lower.includes(name.toLowerCase()));
+}
+export async function sweepUntrackedOrphans(options = {}) {
+  const startedAt = Date.now();
+  if (!isInstanceRegistryEnabled()) {
+    return logBackstopOutcome("disabled", startedAt, {}, options.onComplete);
+  }
+  const cooldownMs = Math.max(0, options.cooldownMs ?? BACKSTOP_COOLDOWN_MS);
+  let release = null;
+  try {
+    release = await acquireBackstopLock();
+    if (release === null) {
+      return logBackstopOutcome("concurrent", startedAt, {}, options.onComplete);
+    }
+    const throttled = await isWithinCooldown(Date.now(), cooldownMs, options);
+    if (throttled !== undefined) {
+      return logBackstopOutcome("cooldown", startedAt, {
+        sinceLastMs: throttled
+      }, options.onComplete);
+    }
+    await writeBackstopStamp(startedAt);
+    const [registry, scan] = await Promise.all([
+      readInstanceRegistry(),
+      enumerateManagedProcesses({
+        timeoutMs: options.scanTimeoutMs,
+        verifyAttempts: options.verifyAttempts,
+        verifyIntervalMs: options.verifyIntervalMs
+      })
+    ]);
+    if (scan.status !== "ok") {
+      recordDegradationOnce({
+        kind: "orphan-backstop-scan-failed",
+        subject: isWindows ? "win32-cim" : "posix-ps",
+        reason: `process enumeration ${scan.status}`
+      });
+      return logBackstopOutcome("error", startedAt, {
+        scanStatus: scan.status,
+        scannerKill: scan.timeoutKill,
+        scanned: scan.processes.length
+      }, options.onComplete);
+    }
+    const pids = scan.processes.map((proc) => proc.pid);
+    const tagScan = await readTags(pids);
+    if (tagScan.status !== "ok") {
+      recordDegradationOnce({
+        kind: "orphan-backstop-scan-failed",
+        subject: "owner-tag-query",
+        reason: `owner tag query ${tagScan.status}; POSIX reap suppressed this sweep`
+      });
+    }
+    const tags = tagScan.tags;
+    const { identities } = await queryIdentities([
+      ...pids,
+      ...[...tags.values()].map((tag) => tag.pid),
+      ...scan.processes.map((proc) => proc.parentPid)
+    ]);
+    const partition = partitionBackstopCandidates(scan.processes.map((proc) => ({
+      ...proc,
+      start: identities.get(proc.pid)?.start,
+      ownerTag: tags.get(proc.pid)
+    })), registry, realIsPidAlive, {
+      graceMs: options.graceMs,
+      startOf: (pid) => identities.get(pid)?.start
+    });
+    for (const proc of partition.unknownAge) {
+      incrementDegradationCount({
+        kind: "orphan-backstop-age-unknown",
+        subject: describeManagedProcess(proc),
+        reason: "OS snapshot reported no usable process creation time"
+      });
+    }
+    const killed = [];
+    const unverified = [];
+    let identityChanged = 0;
+    for (const proc of partition.eligible) {
+      const identity = describeManagedProcess(proc);
+      const outcome = await killPidTree(proc.pid, {
+        verifyAttempts: options.verifyAttempts,
+        verifyIntervalMs: options.verifyIntervalMs,
+        confirmIdentity: async () => {
+          const now = (await queryIdentities([proc.pid])).identities.get(proc.pid);
+          const tagNow = (await readTags([proc.pid])).tags.get(proc.pid);
+          return now !== undefined && now.start === proc.start && matchesManagedBinary(now.command) && tagNow?.pid === proc.ownerTag?.pid && tagNow?.start === proc.ownerTag?.start;
+        }
+      });
+      if (outcome === "changed") {
+        identityChanged++;
+        continue;
+      }
+      if (outcome === "gone") {
+        killed.push(identity);
+        continue;
+      }
+      unverified.push(identity);
+      incrementDegradationCount({
+        kind: "orphan-backstop-kill-unverified",
+        subject: identity,
+        reason: `kill attempted, process still ${outcome === "alive" ? "alive" : "unresolvable"}`
+      });
+    }
+    const retryAt = scheduleGraceRetryIfNeeded(partition, options);
+    return logBackstopOutcome(classifyKillOutcome(killed.length, unverified.length), startedAt, {
+      scanStatus: scan.status,
+      scanned: scan.processes.length,
+      eligible: partition.eligible.length,
+      tooFresh: partition.tooFresh.length,
+      unknownAge: partition.unknownAge.length,
+      unknownStart: partition.unknownStart.length,
+      tagged: tags.size,
+      untagged: scan.processes.length - tags.size,
+      killed: killed.length,
+      killUnverified: unverified.length,
+      identityChanged,
+      killedProcesses: killed.slice(0, BACKSTOP_IDENTITY_LOG_LIMIT),
+      unverifiedProcesses: unverified.slice(0, BACKSTOP_IDENTITY_LOG_LIMIT),
+      graceRetryInMs: retryAt
+    }, options.onComplete);
+  } catch (error) {
+    recordDegradationOnce({
+      kind: "orphan-backstop-scan-failed",
+      subject: "sweep",
+      reason: `sweep threw: ${error instanceof Error ? error.message : String(error)}`
+    });
+    return logBackstopOutcome("error", startedAt, { threw: true }, options.onComplete);
+  } finally {
+    if (release) {
+      await release().catch(() => {});
+    }
+  }
+}
+function classifyKillOutcome(killed, unverified) {
+  if (unverified === 0)
+    return killed > 0 ? "reaped" : "clean";
+  return killed > 0 ? "partial" : "unverified";
+}
+const BACKSTOP_COOLDOWN_MS = 30 * 60 * 1000;
+const BACKSTOP_START_DELAY_MS = 30000;
+const BACKSTOP_IDENTITY_LOG_LIMIT = 10;
+const BACKSTOP_GRACE_RETRY_MARGIN_MS = 30000;
+const BACKSTOP_LOCK_STALE_MS = 120000;
+export function scheduleUntrackedOrphanSweep(delayMs = BACKSTOP_START_DELAY_MS, options = {}) {
+  const timer = setTimeout(() => {
+    sweepUntrackedOrphans(options).catch(() => {});
+  }, Math.max(0, delayMs));
+  timer.unref();
+  return timer;
+}
+function scheduleGraceRetryIfNeeded(partition, options) {
+  if (options.allowGraceRetry === false)
+    return;
+  if (partition.tooFresh.length === 0)
+    return;
+  const graceMs = Math.max(0, options.graceMs ?? BACKSTOP_SPAWN_GRACE_MS);
+  const delayMs = Math.max(0, options.graceRetryDelayMs ?? graceMs + BACKSTOP_GRACE_RETRY_MARGIN_MS);
+  scheduleUntrackedOrphanSweep(delayMs, {
+    ...options,
+    force: true,
+    allowGraceRetry: false
+  });
+  options.onGraceRetryScheduled?.(delayMs);
+  return delayMs;
+}
+async function acquireBackstopLock() {
+  try {
+    return await acquireQuarantinePidFileLock(path.join(resolveBackstopStateDir(getGlobalDmLensDir()), "orphan-backstop.lock"), {
+      waitMs: 0,
+      retryMs: 50,
+      staleMs: BACKSTOP_LOCK_STALE_MS,
+      timeoutMessage: "orphan backstop sweep lock contended",
+      onContention: "skip-log",
+      logContention: () => {}
+    });
+  } catch {
+    return async () => {};
+  }
+}
+async function isWithinCooldown(now, cooldownMs, options) {
+  if (cooldownMs <= 0 || options.force)
+    return;
+  const lastSweepAt = await readBackstopStamp();
+  if (lastSweepAt === undefined)
+    return;
+  const sinceLastMs = now - lastSweepAt;
+  return sinceLastMs < cooldownMs ? sinceLastMs : undefined;
+}
+function readTags(pids) {
+  return readOwnerTags(pids, {
+    timeoutMs: BACKSTOP_SCAN_TIMEOUT_MS,
+    onTimeout: (child) => terminateScannerChild(child, {
+      kind: "orphan-backstop-scanner-escalated",
+      timeoutMs: BACKSTOP_SCAN_TIMEOUT_MS
+    })
+  });
+}
+function describeManagedProcess(proc) {
+  const lower = proc.command.toLowerCase();
+  const matched = MANAGED_BINARY_NAMES.find((name) => lower.includes(name.toLowerCase()));
+  return `${matched ?? "unknown"}#${proc.pid}`;
+}
+function logBackstopOutcome(outcome, startedAt, metadata, onComplete) {
+  try {
+    logLatency({
+      type: "phase",
+      phase: "orphan_backstop_reaped",
+      filePath: "",
+      durationMs: Date.now() - startedAt,
+      metadata: { outcome, ...metadata }
+    });
+  } catch {}
+  try {
+    onComplete?.(outcome);
+  } catch {}
+  return outcome;
+}
+function backstopStampPath() {
+  return path.join(resolveBackstopStateDir(getGlobalDmLensDir()), "orphan-backstop.json");
+}
+async function readBackstopStamp() {
+  try {
+    const raw = await fs.promises.readFile(backstopStampPath(), "utf8");
+    const parsed = JSON.parse(raw);
+    const value = parsed?.lastSweepAt;
+    return typeof value === "number" && Number.isFinite(value) ? value : undefined;
+  } catch {
+    return;
+  }
+}
+async function writeBackstopStamp(at) {
+  try {
+    await fs.promises.mkdir(resolveBackstopStateDir(getGlobalDmLensDir()), {
+      recursive: true
+    });
+    await writeFileAtomicAsync(backstopStampPath(), JSON.stringify({ lastSweepAt: at }));
+  } catch {}
+}
+export async function sweepOrphans() {
+  if (!isInstanceRegistryEnabled())
+    return;
+  const startedAt = Date.now();
+  try {
+    const registry = await readInstanceRegistry();
+    if (registry.length === 0)
+      return;
+    const ownNamespace = ownPidNamespace();
+    const judgeable = (entry) => isInPidNamespace(entry, ownNamespace);
+    const candidatePids = registry.flatMap((instance) => [
+      instance.pid,
+      ...instance.lspChildren.map((child) => child.pid)
+    ]);
+    const { identities, failed } = await queryIdentities(candidatePids);
+    const matchProcess = buildIdentityMatcher(identities);
+    const decision = decideOrphanReaping(registry, realIsPidAlive, matchProcess, Date.now(), (pid) => identities.get(pid)?.start, judgeable);
+    let killedCount = 0;
+    let unverifiedCount = 0;
+    let identityChangedCount = 0;
+    const killedServerIds = [];
+    const killAndAccount = async (pid, serverId, stillSame) => {
+      const outcome = await killPidTree(pid, {
+        confirmIdentity: async () => stillSame((await queryIdentities([pid])).identities)
+      });
+      if (outcome === "changed") {
+        identityChangedCount++;
+        return;
+      }
+      if (outcome === "gone") {
+        killedCount++;
+        killedServerIds.push(serverId);
+        return;
+      }
+      unverifiedCount++;
+      incrementDegradationCount({
+        kind: "orphan-reap-kill-unverified",
+        subject: `${serverId}#${pid}`,
+        reason: `kill attempted, process still ${outcome === "alive" ? "alive" : "unresolvable"}`
+      });
+    };
+    for (const child of decision.childrenToKill) {
+      await killAndAccount(child.pid, child.serverId, (now) => buildIdentityMatcher(now)(child.pid, child));
+    }
+    for (const search of decision.markerSearches) {
+      try {
+        const pids = await findPidsByMarkerWindows(search.marker);
+        for (const pid of pids) {
+          await killAndAccount(pid, search.serverId, (now) => now.get(pid)?.command.includes(search.marker) === true);
+        }
+      } catch {}
+    }
+    const pruneTargets = [
+      ...failed ? [] : decision.deadInstances,
+      ...decision.staleInstances
+    ].map((instance) => ({
+      pid: instance.pid,
+      processStart: instance.processStart,
+      pidNamespace: instance.pidNamespace
+    }));
+    if (pruneTargets.length > 0) {
+      try {
+        await pruneDeadInstances(pruneTargets);
+      } catch {}
+    }
+    try {
+      logLatency({
+        type: "phase",
+        phase: "orphan_lsp_reaped",
+        filePath: "",
+        durationMs: Date.now() - startedAt,
+        metadata: {
+          deadInstances: decision.deadInstances.length,
+          staleInstances: decision.staleInstances.length,
+          killed: killedCount,
+          killUnverified: unverifiedCount,
+          identityChanged: identityChangedCount,
+          serverIds: killedServerIds,
+          markerSearches: decision.markerSearches.length
+        }
+      });
+    } catch {}
+  } catch {}
+}
+export async function pruneDeadInstances(dead) {
+  try {
+    await pruneDeadRegistryInstances(dead);
+  } catch {}
+}