@gajae-code/coding-agent 0.17.1 → 0.17.4

package/src/extensibility/gjc-plugins/registry.ts

@@ -1,6 +1,14 @@
 import { createHash, randomBytes } from "node:crypto";
 import * as fs from "node:fs/promises";
+import * as os from "node:os";
 import * as path from "node:path";
+import {
+	exactUnlink,
+	linkNoReplacePath,
+	type NativeExactFileIdentity,
+	type NativeNoReplaceResult,
+	renameNoReplacePath,
+} from "@gajae-code/natives";
 import { compileGjcPluginBundle } from "./compiler";
 import { migrateGjcPluginEntries } from "./migration";
 import { gjcPluginProjectRoot, gjcPluginUserRoot } from "./paths";
@@ -11,6 +19,11 @@ const LOCK_FILENAME = "registry.lock";
 const LOCK_TIMEOUT_MS = 5000;
 const LOCK_RETRY_MS = 50;
 
+export const RegistryLockTestHooks: {
+	beforeEviction?: (lockPath: string, raw: string) => void | Promise<void>;
+	beforePublish?: (stagingPath: string, lockPath: string) => void | Promise<void>;
+} = {};
+
 export function registryRootForScope(scope: GjcPluginScope, cwd: string): string {
 	return scope === "user" ? gjcPluginUserRoot() : gjcPluginProjectRoot(cwd);
 }
@@ -323,57 +336,203 @@ export async function readRegistry(
 	if (!migrated.changed && discovered.length === 0) return registry;
 	// Re-check under the lock before persisting. Migration and legacy-root
 	// discovery are one transaction, never a normal runtime loader path.
-	return await withRegistryLock(scope, cwd, async () => {
-		const latest = await readRegistryRaw(scope, cwd);
-		const latestDiscovered = await discoverLegacyEntries(scope, cwd, latest.plugins);
-		const latestMigrated = await migrateGjcPluginEntries([...latest.plugins, ...latestDiscovered]);
-		if (latestMigrated.changed || latestDiscovered.length > 0) {
-			const next: GjcPluginRegistry = { ...latest, plugins: sortRegistryEntries(latestMigrated.entries) };
-			await writeRegistryUnlocked(next, cwd, scope);
-			return next;
+	// Contention (a concurrent install elsewhere) must not fail startup reads:
+	// the effective registry is already computed, so degrade to returning it
+	// unpersisted and let a later uncontended session write the migrated
+	// state. Mutating install paths keep their fail-loud install_conflict.
+	try {
+		return await withRegistryLock(scope, cwd, async () => {
+			const latest = await readRegistryRaw(scope, cwd);
+			const latestDiscovered = await discoverLegacyEntries(scope, cwd, latest.plugins);
+			const latestMigrated = await migrateGjcPluginEntries([...latest.plugins, ...latestDiscovered]);
+			if (latestMigrated.changed || latestDiscovered.length > 0) {
+				const next: GjcPluginRegistry = { ...latest, plugins: sortRegistryEntries(latestMigrated.entries) };
+				await writeRegistryUnlocked(next, cwd, scope);
+				return next;
+			}
+			return latest;
+		});
+	} catch (error) {
+		if (error instanceof GjcPluginLoadError && error.code === "install_conflict") {
+			return { ...registry, plugins: sortRegistryEntries(migrated.entries) };
 		}
-		return latest;
+		throw error;
+	}
+}
+
+const LOCK_NONCE_PATTERN = /^[0-9a-f]{16}$/;
+
+interface RegistryLockToken {
+	pid: number;
+	/** Host segment of a host-tagged token; null for legacy `pid-nonce` tokens. */
+	host: string | null;
+}
+
+function parseRegistryLockToken(raw: string): RegistryLockToken | null {
+	const parts = raw.trim().split("-");
+	if (parts.length < 2) return null;
+	const pid = Number(parts[0]);
+	const nonce = parts[parts.length - 1];
+	if (!Number.isInteger(pid) || pid <= 0 || !LOCK_NONCE_PATTERN.test(nonce)) return null;
+	// Hostnames may contain '-', so everything between the first and last
+	// segment is the host; a single middle segment that is empty (or absent)
+	// means a legacy token.
+	const host = parts.slice(1, -1).join("-");
+	return { pid, host: host.length > 0 ? host : null };
+}
+
+/**
+ * A holder is assumed alive unless provably dead: ourselves, a live PID
+ * (EPERM counts — the process exists under another user), or a lock written
+ * on another host (a project registry can live on shared storage, where a
+ * local PID probe would be meaningless) all stay fail-closed.
+ */
+function registryLockHolderAlive(holder: RegistryLockToken): boolean {
+	if (holder.pid === process.pid) return true;
+	if (holder.host !== null && holder.host !== os.hostname()) return true;
+	try {
+		process.kill(holder.pid, 0);
+		return true;
+	} catch (error) {
+		return (error as NodeJS.ErrnoException)?.code === "EPERM";
+	}
+}
+
+async function captureRegistryLockIdentity(lockPath: string): Promise<NativeExactFileIdentity | null> {
+	try {
+		const [bytes, stat, parent] = await Promise.all([
+			fs.readFile(lockPath),
+			fs.lstat(lockPath, { bigint: true }),
+			fs.stat(path.dirname(lockPath), { bigint: true }),
+		]);
+		if (!stat.isFile()) return null;
+		return {
+			dev: stat.dev,
+			ino: stat.ino,
+			nlink: stat.nlink,
+			parentDev: parent.dev,
+			parentIno: parent.ino,
+			size: stat.size,
+			mtimeNs: stat.mtimeNs,
+			sha256: createHash("sha256").update(bytes).digest("hex"),
+		};
+	} catch (error) {
+		if (isEnoent(error)) return null;
+		throw error;
+	}
+}
+
+async function evictRegistryLock(lockPath: string, raw: string): Promise<boolean> {
+	const identity = await captureRegistryLockIdentity(lockPath);
+	if (!identity) return false;
+	const expectedHash = createHash("sha256").update(raw).digest("hex");
+	if (identity.sha256 !== expectedHash) return false;
+	await RegistryLockTestHooks.beforeEviction?.(lockPath, raw);
+	const result = exactUnlink(lockPath, {
+		...identity,
+		quarantineName: `${LOCK_FILENAME}.evict-${process.pid}-${randomBytes(4).toString("hex")}`,
 	});
+	return result.ok || result.code === "cleanup_pending";
+}
+
+function publishRegistryLock(stagingPath: string, lockPath: string): NativeNoReplaceResult {
+	let result = renameNoReplacePath(stagingPath, lockPath);
+	if (
+		!result.ok &&
+		result.mutationState === "not_committed" &&
+		(result.reason === "atomic_unavailable" || result.reason === "invalid_request")
+	) {
+		// linkat is the no-overwrite fallback on filesystems without a
+		// no-replace rename. Both paths expose the complete token only after the
+		// atomic claim, so a crash cannot publish an empty or partial lock.
+		result = linkNoReplacePath(stagingPath, lockPath);
+	}
+	return result;
 }
 
 async function acquireLock(lockPath: string): Promise<() => Promise<void>> {
 	await fs.mkdir(path.dirname(lockPath), { recursive: true });
-	const token = `${process.pid}-${randomBytes(8).toString("hex")}`;
+	const token = `${process.pid}-${os.hostname()}-${randomBytes(8).toString("hex")}`;
 	const deadline = Date.now() + LOCK_TIMEOUT_MS;
 	for (;;) {
+		const stagingPath = `${lockPath}.tmp-${process.pid}-${randomBytes(4).toString("hex")}`;
+		let publication: NativeNoReplaceResult | undefined;
 		try {
-			const handle = await fs.open(lockPath, "wx");
-			try {
-				await handle.writeFile(token);
-			} finally {
-				await handle.close();
+			await fs.writeFile(stagingPath, token, { encoding: "utf8", flag: "wx", mode: 0o600 });
+			await RegistryLockTestHooks.beforePublish?.(stagingPath, lockPath);
+			publication = publishRegistryLock(stagingPath, lockPath);
+			if (publication.ok) {
+				let released = false;
+				return async () => {
+					if (released) return;
+					released = true;
+					// Owner-safe release: only remove the lock if it is still ours.
+					try {
+						const current = await fs.readFile(lockPath, "utf8");
+						if (current === token) await fs.rm(lockPath, { force: true });
+					} catch {
+						// Lock already gone; nothing to release.
+					}
+				};
+			}
+			if (publication.reason !== "destination_exists") {
+				throw new Error(
+					`Failed to publish GJC plugin registry lock at ${lockPath}: ${publication.code ?? publication.reason}`,
+				);
 			}
-			let released = false;
-			return async () => {
-				if (released) return;
-				released = true;
-				// Owner-safe release: only remove the lock if it is still ours.
-				try {
-					const current = await fs.readFile(lockPath, "utf8");
-					if (current === token) await fs.rm(lockPath, { force: true });
-				} catch {
-					// Lock already gone; nothing to release.
-				}
-			};
 		} catch (error) {
-			if ((error as NodeJS.ErrnoException)?.code !== "EEXIST") throw error;
-			// Fail-closed: never auto-evict an existing lock (a live holder may run
-			// longer than the timeout). Time out instead and leave the lock for
-			// diagnostics/manual cleanup. A lease/heartbeat protocol can be added
-			// later if automatic stale recovery becomes necessary.
-			if (Date.now() > deadline) {
-				throw new GjcPluginLoadError(
-					"install_conflict",
-					`Timed out acquiring GJC plugin registry lock at ${lockPath}; remove it manually if no install is running`,
+			if (publication?.reason === "destination_exists") {
+				// Continue into stale inspection below.
+			} else if (
+				publication === undefined &&
+				["EACCES", "EPERM"].includes((error as NodeJS.ErrnoException)?.code ?? "")
+			) {
+				// A read-only registry directory can still contain a lock left by a
+				// dead writer. Inspect that lock and return the normal bounded
+				// install_conflict rather than surfacing the staging-file permission
+				// error immediately.
+				const lockExists = await fs.stat(lockPath).then(
+					() => true,
+					(error: unknown) => !isEnoent(error),
 				);
+				if (!lockExists) throw error;
+			} else throw error;
+		} finally {
+			if (publication?.mutationState !== "unknown") await fs.rm(stagingPath, { force: true }).catch(() => {});
+		}
+
+		// Stale recovery: a writer that died mid-transaction never releases
+		// its lock, and without recovery that lock poisons every later
+		// session until manual cleanup. Evict only a provably dead holder:
+		// a host-tagged token on this host. Legacy `pid-nonce` tokens have no
+		// trustworthy host identity, so they always fail closed: a local PID
+		// probe cannot prove that a remote holder on shared storage is dead.
+		// Live holders still fail closed below — they may legitimately outlive
+		// our timeout.
+		const raw = await fs.readFile(lockPath, "utf8").catch(() => null);
+		const holder = raw === null ? null : parseRegistryLockToken(raw);
+		if (raw !== null && holder !== null && holder.host !== null && !registryLockHolderAlive(holder)) {
+			try {
+				// exactUnlink verifies the observed inode, parent, size, mtime,
+				// and bytes inside the removal primitive. A replacement published
+				// after this read is therefore never consumed by stale recovery.
+				await evictRegistryLock(lockPath, raw);
+			} catch {
+				// Raced with another evictor or a fresh holder, or the removal
+				// itself failed (lockfile owned by another user, read-only mount,
+				// EBUSY/EPERM on Windows). Fall through to the shared deadline
+				// and backoff below either way: a removal that keeps failing must
+				// end in the bounded install_conflict timeout, never an unbounded
+				// spin.
 			}
-			await new Promise(resolve => setTimeout(resolve, LOCK_RETRY_MS));
 		}
+		if (Date.now() > deadline) {
+			throw new GjcPluginLoadError(
+				"install_conflict",
+				`Timed out acquiring GJC plugin registry lock at ${lockPath}; remove it manually if no install is running`,
+			);
+		}
+		await new Promise(resolve => setTimeout(resolve, LOCK_RETRY_MS));
 	}
 }
 

package/src/extensibility/runtime-skill-discovery.ts

@@ -54,6 +54,16 @@ export interface RuntimeSkillDiscoveryResult {
 	candidates: RuntimeSkillDiscoveryCandidate[];
 	/** Deduped skill metadata the query filter ran against, including bundled entries; candidates.length <= scanned. */
 	scanned: number;
+	/**
+	 * Skills left after the query filter, before the page slice: the denominator
+	 * a page is a page *of*. `scanned` counts everything the filter ran against,
+	 * so it cannot serve this role.
+	 */
+	matching: number;
+	/** Normalized zero-based offset the returned page starts at. */
+	offset: number;
+	/** Offset of the next page, present only while one exists; omitted on the final page. */
+	nextOffset?: number;
 	diagnostics: RuntimeSkillDiscoveryDiagnostics;
 }
 
@@ -65,6 +75,8 @@ export interface DiscoverRuntimeSkillsOptions {
 	profileAuthority?: "default" | "custom";
 	query?: string;
 	limit?: number;
+	/** Zero-based index into the matching set the returned page starts at; defaults to 0. */
+	offset?: number;
 	source?: RuntimeSkillDiscoveryScope | "all";
 	policy?: SkillsSettings;
 }
@@ -74,11 +86,26 @@ function getRuntimeHome(): string {
 }
 
 const DEFAULT_LIMIT = 20;
-const MAX_LIMIT = 50;
+/**
+ * Upper bound every caller's `limit` clamps to. Exported so `gjc skills discover`
+ * can default a human to the widest page the library will serve instead of the
+ * model-context-sized `DEFAULT_LIMIT`.
+ */
+export const SKILL_DISCOVERY_MAX_LIMIT = 50;
 const MAX_DIAGNOSTICS = 10;
 function normalizeLimit(limit: number | undefined): number {
 	if (limit === undefined || !Number.isFinite(limit)) return DEFAULT_LIMIT;
-	return Math.max(1, Math.min(MAX_LIMIT, Math.trunc(limit)));
+	return Math.max(1, Math.min(SKILL_DISCOVERY_MAX_LIMIT, Math.trunc(limit)));
+}
+
+/**
+ * Offsets are clamped from below only. An offset past the end is a legitimate
+ * empty final page (the catalog shrank between pages), not an error, so it is
+ * reported rather than silently snapped back onto the last populated page.
+ */
+function normalizeOffset(offset: number | undefined): number {
+	if (offset === undefined || !Number.isFinite(offset) || offset < 0) return 0;
+	return Math.trunc(offset);
 }
 
 interface ProjectScanDir {
@@ -558,9 +585,40 @@ export async function discoverRuntimeSkills(
 		seenNames,
 		diagnostics,
 	);
+	const limit = normalizeLimit(options.limit);
+	const offset = normalizeOffset(options.offset);
+	const matching = candidates.length;
+	const page = candidates.slice(offset, offset + limit);
+	// Continuation is omitted on the final page, so "is there more" is the
+	// presence of the field rather than a value the caller has to compare.
+	const nextOffset = offset + page.length < matching ? offset + page.length : undefined;
+	// Appended directly instead of through pushDiagnostic: these are the only
+	// messages that explain why a skill the caller can see on disk is absent
+	// from the result, and the reported case (several stale
+	// skills.customDirectories entries, one "does not exist" message each)
+	// fills the MAX_DIAGNOSTICS budget before the slice is ever reached. A
+	// dropped paging notice makes the truncation invisible again.
+	if (page.length === 0) {
+		if (offset > 0 && matching > 0) {
+			diagnostics.push(
+				`no skills at offset ${offset}; ${matching} matching skill${matching === 1 ? "" : "s"} total, pass --offset 0 to start over`,
+			);
+		}
+	} else if (nextOffset !== undefined) {
+		diagnostics.push(
+			`showing ${offset + 1}-${offset + page.length} of ${matching} matching skills; pass --offset ${nextOffset} for the next page, or narrow the query`,
+		);
+	} else if (offset > 0) {
+		// Final page of a multi-page walk: no continuation to offer, but the
+		// caller still needs to know this page is not the whole matching set.
+		diagnostics.push(`showing ${offset + 1}-${offset + page.length} of ${matching} matching skills`);
+	}
 	return {
-		candidates: candidates.slice(0, normalizeLimit(options.limit)),
+		candidates: page,
 		scanned,
+		matching,
+		offset,
+		...(nextOffset === undefined ? {} : { nextOffset }),
 		diagnostics: { messages: diagnostics },
 	};
 }

package/src/extensibility/shared-events.ts

@@ -93,9 +93,11 @@ export interface SessionCompactEvent {
 	fromExtension: boolean;
 }
 
-/** Fired on process exit (SIGINT/SIGTERM) */
+/** Fired during session teardown, including process exit and SDK host self-reap. */
 export interface SessionShutdownEvent {
 	type: "session_shutdown";
+	/** Set only when the SDK host reaped itself after detached-idle grace. */
+	reason?: "detached_idle";
 }
 
 /** Preparation data for tree navigation (used by session_before_tree event) */

package/src/gjc-runtime/managed-owner-admission.ts

@@ -128,8 +128,15 @@ function safeChildToken(value: string): boolean {
 	}
 }
 
-async function readExactJsons(root: string, files: readonly string[]): Promise<unknown[] | null> {
-	if (process.platform !== "linux") return null;
+/**
+ * The exact reader needs the Linux-only recovery-fs authority, so an unavailable
+ * read has two very different causes. A blocked operator cannot act on either
+ * unless the outcome says which one it was, so the unavailable arm names it.
+ */
+type ExactJsonRead = { values: unknown[] } | { reader: "unsupported_platform" | "read_failed" };
+
+async function readExactJsons(root: string, files: readonly string[]): Promise<ExactJsonRead> {
+	if (process.platform !== "linux") return { reader: "unsupported_platform" };
 	try {
 		const { openRecoveryFsRoot } = require("@gajae-code/natives") as Pick<
 			typeof import("@gajae-code/natives"),
@@ -140,17 +147,37 @@ async function readExactJsons(root: string, files: readonly string[]): Promise<u
 			const values: unknown[] = [];
 			for (const file of files) {
 				const result = authority.read(file, 64 * 1024);
-				if (!result.ok || !result.data) return null;
+				if (!result.ok || !result.data) return { reader: "read_failed" };
 				const content = Buffer.from(result.data).toString("utf8");
-				if (!content.endsWith("\n") || content.indexOf("\n") !== content.length - 1) return null;
+				if (!content.endsWith("\n") || content.indexOf("\n") !== content.length - 1)
+					return { reader: "read_failed" };
 				values.push(JSON.parse(content));
 			}
-			return values;
+			return { values };
 		} finally {
 			authority.close();
 		}
 	} catch {
-		return null;
+		return { reader: "read_failed" };
+	}
+}
+
+function exactJsonValues(read: ExactJsonRead): unknown[] {
+	return "values" in read ? read.values : [];
+}
+
+function exactReaderDetails(read: ExactJsonRead): Record<string, unknown> {
+	return "values" in read ? {} : { platform: process.platform, evidence_reader: read.reader };
+}
+
+function readerExplanation(details: Record<string, unknown>): string {
+	switch (details.evidence_reader) {
+		case "unsupported_platform":
+			return ` (platform ${process.platform}: exact binding reader unsupported)`;
+		case "read_failed":
+			return ` (platform ${process.platform}: exact binding evidence unreadable)`;
+		default:
+			return "";
 	}
 }
 
@@ -187,6 +214,22 @@ async function durableHandoff(
 	}
 }
 
+/**
+ * Fails closed and says so. The durable handoff is the record of authority, but
+ * nothing reads it during an incident, so the same reason also goes to stderr:
+ * otherwise a blocked child exits 75 having printed nothing at all.
+ */
+async function blockAdmission(
+	owner: { root: string; generation: string; sessionId: string },
+	reason: string,
+	details: Record<string, unknown> = {},
+): Promise<{ kind: "blocked" }> {
+	await durableHandoff(owner.root, owner.generation, owner.sessionId, reason, details);
+	process.stderr.write(`child admission blocked: ${reason}${readerExplanation(details)}\n`);
+	process.exitCode = 75;
+	return { kind: "blocked" };
+}
+
 /**
  * This is the pre-CLI barrier. A replacement is identified only by the exact
  * predecessor token supplied by its launch binding; directory enumeration is
@@ -198,12 +241,9 @@ export async function admitManagedOwnerBeforeCli(): Promise<ManagedOwnerAdmissio
 	const childToken = process.env[MANAGED_OWNER_CHILD_TOKEN_ENV]?.trim();
 	const predecessorToken = process.env[MANAGED_OWNER_PREDECESSOR_TOKEN_ENV]?.trim();
 	if (childToken && !predecessorToken) {
-		if (!safeChildToken(childToken)) {
-			await durableHandoff(owner.root, owner.generation, owner.sessionId, "exact_child_binding_unavailable");
-			process.exitCode = 75;
-			return { kind: "blocked" };
-		}
-		const [binding] = (await readExactJsons(owner.root, [`child-${childToken}.binding.json`])) ?? [];
+		if (!safeChildToken(childToken)) return blockAdmission(owner, "exact_child_binding_unavailable");
+		const read = await readExactJsons(owner.root, [`child-${childToken}.binding.json`]);
+		const [binding] = exactJsonValues(read);
 		if (
 			isBinding(binding, {
 				generation: owner.generation,
@@ -214,33 +254,20 @@ export async function admitManagedOwnerBeforeCli(): Promise<ManagedOwnerAdmissio
 			})
 		)
 			return { kind: "supervised" };
-		await durableHandoff(owner.root, owner.generation, owner.sessionId, "exact_child_binding_unavailable");
-		process.exitCode = 75;
-		return { kind: "blocked" };
+		return blockAdmission(owner, "exact_child_binding_unavailable", exactReaderDetails(read));
 	}
 	const predecessorGeneration = process.env[MANAGED_OWNER_PREDECESSOR_GENERATION_ENV]?.trim();
 	const predecessorRunId = process.env[MANAGED_OWNER_PREDECESSOR_RUN_ID_ENV]?.trim();
 	const predecessorIncarnation = process.env[MANAGED_OWNER_PREDECESSOR_INCARNATION_ENV]?.trim();
-	if (!predecessorGeneration || !predecessorRunId || !predecessorIncarnation) {
-		await durableHandoff(owner.root, owner.generation, owner.sessionId, "replacement_predecessor_identity_missing");
-		process.exitCode = 75;
-		return { kind: "blocked" };
-	}
-	if (!predecessorToken) {
-		await durableHandoff(owner.root, owner.generation, owner.sessionId, "replacement_predecessor_binding_missing");
-		process.exitCode = 75;
-		return { kind: "blocked" };
-	}
-	if (!safeChildToken(predecessorToken)) {
-		await durableHandoff(owner.root, owner.generation, owner.sessionId, "replacement_predecessor_binding_untrusted");
-		process.exitCode = 75;
-		return { kind: "blocked" };
-	}
-	const [binding, receipt] =
-		(await readExactJsons(owner.root, [
-			`child-${predecessorToken}.binding.json`,
-			`sigabrt-${predecessorToken}.receipt.json`,
-		])) ?? [];
+	if (!predecessorGeneration || !predecessorRunId || !predecessorIncarnation)
+		return blockAdmission(owner, "replacement_predecessor_identity_missing");
+	if (!predecessorToken) return blockAdmission(owner, "replacement_predecessor_binding_missing");
+	if (!safeChildToken(predecessorToken)) return blockAdmission(owner, "replacement_predecessor_binding_untrusted");
+	const read = await readExactJsons(owner.root, [
+		`child-${predecessorToken}.binding.json`,
+		`sigabrt-${predecessorToken}.receipt.json`,
+	]);
+	const [binding, receipt] = exactJsonValues(read);
 	if (
 		!isBinding(binding, {
 			generation: predecessorGeneration,
@@ -249,16 +276,10 @@ export async function admitManagedOwnerBeforeCli(): Promise<ManagedOwnerAdmissio
 			incarnation: predecessorIncarnation,
 			token: predecessorToken,
 		})
-	) {
-		await durableHandoff(owner.root, owner.generation, owner.sessionId, "replacement_predecessor_binding_untrusted");
-		process.exitCode = 75;
-		return { kind: "blocked" };
-	}
-	if (!isReceipt(receipt, binding)) {
-		await durableHandoff(owner.root, owner.generation, owner.sessionId, "exact_sigabrt_receipt_untrusted");
-		process.exitCode = 75;
-		return { kind: "blocked" };
-	}
+	)
+		return blockAdmission(owner, "replacement_predecessor_binding_untrusted", exactReaderDetails(read));
+	if (!isReceipt(receipt, binding))
+		return blockAdmission(owner, "exact_sigabrt_receipt_untrusted", exactReaderDetails(read));
 	const admission = {
 		session_id: owner.sessionId,
 		endpoint_incarnation: predecessorIncarnation,
@@ -287,11 +308,7 @@ export async function admitManagedOwnerBeforeCli(): Promise<ManagedOwnerAdmissio
 		},
 		decision,
 	});
-	if (decision.disposition !== "resume") {
-		await durableHandoff(owner.root, owner.generation, owner.sessionId, decision.reason);
-		process.exitCode = 75;
-		return { kind: "blocked" };
-	}
+	if (decision.disposition !== "resume") return blockAdmission(owner, decision.reason);
 	return { kind: "recovery", context: { root: owner.root, binding, receipt, admission, decision } };
 }