@junghanacs/entwurf 0.13.1 → 0.14.1

package/scripts/smoke-pi-attach.ts

@@ -25,7 +25,7 @@
  * WHY THE PI SIDE IS THE SEAM AND NOT A REAL `pi` PROCESS. The record + address half
  * is driven through `birthPiCitizen` — the exact function `entwurf-control.ts`'s
  * session_start calls — so this gate stays deterministic (no model, no network, no
- * cost) and belongs in `pnpm check`. That a REAL `pi --entwurf-control` process
+ * cost) and belongs in `pnpm run check:full`. That a REAL `pi --entwurf-control` process
  * executes that seam is a different axis, owned by the LIVE gate
  * (`smoke-resident-garden-guard`, inverted in this same cut). Two axes, neither
  * pretending to be the other.

package/scripts/smoke-user-scope-citizen.sh

@@ -8,7 +8,7 @@
 # cwd because entwurf was absent from ~/.pi/agent/settings.json packages[]).
 # statusline `?` had a tripwire; THIS omission had none and hid until GLG hit it
 # in another repo. This gate is that missing tripwire: if the registration ever
-# regresses, `pnpm check` goes red.
+# regresses, `pnpm run check:full` goes red.
 #
 # Cells 11–13 close the second omission (#53 B): every case here drove a fake
 # settings file with ABSOLUTE entries, so the portable, settings-relative form this

package/scripts/tsconfig.json

@@ -26,6 +26,7 @@
 	"exclude": ["../node_modules", "../mcp", "../plugins"],
 	"include": [
 		"./**/*.ts",
+		"../test/**/*.ts",
 		"../pi-extensions/lib/**/*.ts",
 		"../pi-extensions/model-lock.ts",
 		"../pi-extensions/meta-bridge-hook.ts",

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-preflight.js

@@ -1,160 +0,0 @@
-/**
- * entwurf-preflight — 0.11 Stage 0 (2): the SINGLE trust/launch decision owner.
- *
- * The controlled-launch surface, the global `project_trust` handler, and any
- * MCP fact tool ALL consume this module's outcome — nobody else re-derives a
- * prefix, re-reads `trust.json`, or re-probes trust inputs. pi's raw trust
- * semantics are followed by importing pi's PUBLIC root exports directly (frozen
- * decision 9, 재구현 금지): `ProjectTrustStore` (the canonical `trust.json`
- * reader, which itself canonicalizes the cwd and takes a `proper-lockfile` on
- * every read) and `hasTrustRequiringProjectResources` (the trust-input probe).
- * We never copy pi's trust detail — if pi changes it, this import tracks it.
- *
- * The returned `PreflightOutcome` is deliberately RICH, not just {kind,reason}:
- * a fact tool must explain *why* a cwd is approved and *what* it may load
- * without re-running the probe, and an error/handler must name the matched root
- * or the trust-store value. Thin outcomes would push callers to recompute, which
- * is exactly the re-derivation this module exists to prevent.
- *
- * trust ≠ discovery: this decision touches the store for a SINGLE launch-time
- * cwd only. `peers`/`who-can` discovery does not call here (frozen decision 4).
- *
- * Precedence (frozen decision 8) — saved distrust is stronger than a prefix
- * allow; a prefix only promotes the UNDECIDED (null) case; no-trust-inputs is
- * trusted but needs no launch arg; everything else is fail-fast:
- *
- *   saved === false        → deny           (explicit distrust; store wins)
- *   saved === true         → approve        (saved trust → internal --approve)
- *   null + prefix match    → approve        (operator prefix promotes null→yes)
- *   null + no trust inputs → trusted-no-arg (no trust-gated input — pi 0.79.x
- *                                             excludes AGENTS.md/CLAUDE.md, so
- *                                             context files may still be loaded)
- *   else (null + inputs)   → fail-fast      (unknown/untrusted controlled launch)
- *
- * Injection (frozen decision 4): `agentDir` defaults to `getAgentDir()` but is
- * overridable so tests point `ProjectTrustStore` at a temp dir (or set
- * `PI_CODING_AGENT_DIR`, same isolation as 0.10.0) and never read or dirty the
- * operator's real `~/.pi/agent/trust.json`. `prefixRoots` is an OPERATOR-policy
- * input with NO package default (frozen decision 7): a public package must not
- * hardcode a broad auto-approve, so an empty roots list means "no prefix
- * promotion" — the caller injects the operator's roots (e.g. `~/repos/gh`).
- */
-import { realpathSync } from "node:fs";
-import { homedir } from "node:os";
-import { isAbsolute, join, resolve, sep } from "node:path";
-import { getAgentDir, hasTrustRequiringProjectResources, ProjectTrustStore, } from "@earendil-works/pi-coding-agent";
-/**
- * Render the human-facing reason a controlled launch was refused (N3b). This is
- * a PURE formatter over a deny outcome — it does NOT touch a launcher, a socket,
- * or pi; wiring it into the controlled-launch surface is bucket B (step 5), not
- * here. The launcher/handler/error layers all call this so the refusal text is
- * identical everywhere and always sourced from F5a evidence.
- *
- * The inherited-false branch is the one that matters: an operator distrust on an
- * ANCESTOR (e.g. `~/repos/gh`) silently denies a child cwd, and an agent CANNOT
- * lift it — that is an intended security property (N3a: a controlled launch
- * short-circuits on `trustOverride` and never reaches the human-only active
- * prompt). So the message must (1) name the inherited source (`inheritedFrom`)
- * and (2) give the only real remedy: open an interactive pi AT the cwd and
- * approve, which writes a direct child trust that beats the inherited decision
- * (the "escape direction" proven in check-pi-preflight #13b).
- */
-export function formatPreflightDenial(outcome) {
-    const cwd = outcome.canonicalCwd;
-    const openHere = `open an interactive pi at ${cwd} and approve when prompted`;
-    if (outcome.reason === "saved-false") {
-        if (outcome.trustStoreInherited && outcome.trustStoreEntryPath !== undefined) {
-            return (`Controlled launch refused: ${cwd} is distrusted by inheritance from ${outcome.trustStoreEntryPath} ` +
-                `(an ancestor carries a saved "no"). An agent cannot self-promote trust — this is an intended ` +
-                `security property. To trust THIS cwd only, ${openHere}; that writes a direct decision for ${cwd} ` +
-                `which overrides the inherited one.`);
-        }
-        return `Controlled launch refused: ${cwd} is explicitly distrusted (a saved "no" on this directory). To change it, ${openHere}.`;
-    }
-    // fail-fast: undecided + trust inputs + no operator prefix root.
-    return (`Controlled launch refused: ${cwd} is untrusted — it has trust inputs but no saved decision and no ` +
-        `operator prefix root. Refusing a silent degraded launch. Either add ${cwd} under an operator prefix ` +
-        `root, or ${openHere}.`);
-}
-/**
- * Normalize a path the way pi resolves one before the trust store sees it:
- * expand a leading `~`, make it absolute (`path.resolve`), then `realpathSync`;
- * on a resolve failure fall back to the RESOLVED absolute path (not the raw
- * input), so a not-yet-existing root still compares on an absolute basis.
- */
-function normalizePath(p) {
-    let expanded = p;
-    if (p === "~") {
-        expanded = homedir();
-    }
-    else if (p.startsWith("~/")) {
-        expanded = join(homedir(), p.slice(2));
-    }
-    const abs = isAbsolute(expanded) ? expanded : resolve(expanded);
-    try {
-        return realpathSync(abs);
-    }
-    catch {
-        return abs;
-    }
-}
-/**
- * Return the canonical operator root that contains `canonicalCwd`, by canonical
- * path + separator boundary (frozen decision 7). `/org` matches `/org/a` but NOT
- * `/org2` — never a bare `startsWith`. Roots are normalized the same as the cwd.
- */
-function matchedPrefixRoot(canonicalCwd, roots) {
-    for (const root of roots) {
-        const r = normalizePath(root);
-        if (canonicalCwd === r || canonicalCwd.startsWith(r + sep)) {
-            return r;
-        }
-    }
-    return undefined;
-}
-/** Decide trust for a single controlled-launch cwd. See module header. */
-export function preflight(input) {
-    const agentDir = input.agentDir ?? getAgentDir();
-    const prefixRoots = input.prefixRoots ?? [];
-    const canonicalCwd = normalizePath(input.cwd);
-    const store = new ProjectTrustStore(agentDir);
-    // getEntry, not get: get() throws away which path decided. getEntry returns
-    // `{ path, decision } | null` — the nearest ancestor (or the cwd itself)
-    // carrying an explicit decision. We recover the same decision value AND the
-    // deciding path, so the fact/handler/error layers can name an inherited
-    // source without re-walking the store. entry.path is pi-canonical, the same
-    // realpath axis as `canonicalCwd`, so an entry on the cwd ITSELF compares
-    // equal (= direct) and an ancestor compares unequal (= inherited).
-    const entry = store.getEntry(input.cwd);
-    const trustStoreDecision = entry?.decision ?? null;
-    const trustStoreInherited = entry !== null && entry.path !== canonicalCwd;
-    // Computed unconditionally: a fact tool must report what a prefix-approved
-    // cwd could load, so the probe runs even when a prefix already decides.
-    const hasTrustInputs = hasTrustRequiringProjectResources(input.cwd);
-    const matched = matchedPrefixRoot(canonicalCwd, prefixRoots);
-    const evidence = {
-        launchArgs: [],
-        trustStoreDecision,
-        trustStoreInherited,
-        hasTrustInputs,
-        canonicalCwd,
-        ...(entry !== null ? { trustStoreEntryPath: entry.path } : {}),
-        ...(matched !== undefined ? { matchedPrefixRoot: matched } : {}),
-    };
-    // Explicit distrust wins over everything, including a prefix match.
-    if (trustStoreDecision === false) {
-        return { ...evidence, kind: "deny", reason: "saved-false" };
-    }
-    if (trustStoreDecision === true) {
-        return { ...evidence, kind: "approve", reason: "saved-true", launchArgs: ["--approve"] };
-    }
-    // trustStoreDecision === null (undecided): a prefix promotes it; otherwise the
-    // absence of trust inputs makes it trusted-but-no-arg; otherwise fail-fast.
-    if (matched !== undefined) {
-        return { ...evidence, kind: "approve", reason: "prefix-match", launchArgs: ["--approve"] };
-    }
-    if (!hasTrustInputs) {
-        return { ...evidence, kind: "trusted-no-arg", reason: "no-trust-inputs" };
-    }
-    return { ...evidence, kind: "deny", reason: "fail-fast" };
-}

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-v2-spawn-production.js

@@ -1,273 +0,0 @@
-/**
- * entwurf-v2-spawn-production — the PRODUCTION `SpawnBgResumeDeps` factory for the 5c-3a
- * spawn-bg watcher (0.11 Stage 0 step 5c-3c). It wires the six injected IO seams the pure
- * watcher (`executeSpawnBgResume`) declares onto the real world: spawn a resume child as a
- * resident citizen, observe its control socket by CONNECTABILITY (not mere existence),
- * watch its exit, time the observe window, and kill on timeout. The watcher's release
- * policy is untouched — this module only supplies the IO.
- *
- * Every seam stays injectable (defaults = the real fns) so a DETERMINISTIC gate drives
- * spawnChild's argv, the exit/timeout/kill wiring, and the socket-alive verdict WITHOUT a
- * real pi spawn or socket — the heavy live path (a real `pi --entwurf-control` resident
- * child + a real unix-socket connect) is proven once by a separate opt-in smoke
- * (`smoke-entwurf-v2-spawn-live`), kept OUT of `pnpm check` so the every-commit loop stays
- * fast and deterministic (D5: chain = deterministic gate; live smoke = phase gate before 5d).
- *
- * The factory does NOT capture `plan` or `lock` (D3): `SpawnBgResumeDeps.spawnChild(plan)`
- * already takes the plan, and the lock is the watcher's authority — it flows to
- * `deps.releaseLock` from the watcher, never from here. A captured plan/lock would be a
- * second authority that could drift from the one the watcher holds.
- *
- * socket-alive = CONNECTABLE, never file-exists (GPT 5c-3c, Q5): inspect the EXACT
- * `plan.expectedSocketPath` (via the path-addressed `inspectControlSocketPath` — no gid
- * re-derivation), map to liveness through the shared `mapInspectionToLiveness`, then apply
- * `socketWatchVerdict`: a connectable socket is alive; a forged address (symlink / not a
- * socket) is rejected IMMEDIATELY (time does not heal a forged path → the watcher's backstop
- * kills and fail-closes to a retained lock); a dead/indeterminate socket keeps waiting (the
- * dormant citizen's stale socket file, or a stall, is "not up yet", not a failure).
- */
-import { spawn } from "node:child_process";
-import { existsSync } from "node:fs";
-import * as fs from "node:fs/promises";
-import { getEntwurfExplicitExtensions, mirrorChildStderr, readSessionIdentity } from "./entwurf-core.js";
-import { buildResumePiArgs } from "./entwurf-resume-args.js";
-import { releaseLock } from "./entwurf-v2-lock.js";
-import { readAddressableMetaIdentity } from "./meta-session.js";
-import { inspectControlSocketPath, mapInspectionToLiveness } from "./socket-discovery.js";
-import { probeSocketLiveness } from "./socket-probe.js";
-/**
- * Translate a mapped socket observation into the watcher's poll decision.
- *   - forged  — an address-conflict (symlink / not-a-socket). NOT a transient liveness
- *     state: time cannot turn a forged path into a live socket, so the poll must REJECT
- *     immediately (→ watcher backstop → kill → retained), never keep waiting.
- *   - alive   — a connectable socket. Resolve: the resumed citizen is up.
- *   - wait    — dead (the dormant citizen's stale/absent socket — "not up yet") or
- *     indeterminate (a stall). Keep polling until the socket connects, or the observe
- *     timeout / abort ends the wait.
- */
-export function socketWatchVerdict(mapped) {
-    if ("addressConflict" in mapped)
-        return "forged";
-    return mapped.liveness === "alive" ? "alive" : "wait";
-}
-/** Narrow a watcher-supplied SpawnedChild back to the production handle. A child that is
- * NOT one we spawned (no `proc` / `exitPromise`) is a mis-wire — fail loud, never no-op. */
-function requireProductionChild(child) {
-    const c = child;
-    if (!c.proc || !c.exitPromise) {
-        throw new Error("entwurf-v2-spawn-production: child handle has no proc/exitPromise (mis-wired SpawnBgResumeDeps).");
-    }
-    return c;
-}
-/**
- * Resolve launch identity for a resume. The TARGET is now resolved through the
- * meta-record (#50 C2): `gardenId → record.transcriptPath`. It used to be a global
- * header scan for a JSONL whose header id equalled the garden id — which only worked
- * while entwurf forced pi's session id to BE the garden id. With the record minting the
- * address, that scan cannot find anything (a citizen's header carries pi's own uuid), so
- * keeping it would not have been a "smaller change", it would have been a broken one.
- *
- * The record is also the AUTHORIZATION now (#50 C3). The old gates — `requireEntwurf`
- * (an `entwurf` tag in the session NAME, planted by a name mirror that no longer
- * exists) and the sessionId-bound resume-marker env — are deleted. Record-backed pi
- * citizens are all siblings (LOCKED PROTOCOL 6), so "this garden id names a pi citizen
- * with a recorded transcript" is the whole test, PLUS one integrity check: the resumed
- * file's header id must equal `record.nativeSessionId` (pi owns the transcript, the
- * record remembers whose it is — a mismatch means the transcriptPath is stale or
- * foreign, and resuming it would put a turn into a different being's session).
- *
- * That check is per-record, and per-record is not enough: the v2 lock domain is keyed on
- * GARDEN ID, so two records sharing one `nativeSessionId` would each pass their own
- * integrity check and resume the SAME transcript concurrently under two different locks.
- * Hence {@link readAddressableMetaIdentity} rather than the plain targeted read (#52) —
- * a resume is exactly the moment a record stops being data and becomes an address.
- *
- * Everything else is unchanged authority: readSessionIdentity (first model_change) for
- * provider/model/cwd, getEntwurfExplicitExtensions for bridge re-injection (#29 fail-fast).
- * Throws on anything that makes a resume impossible; each throw becomes the watcher's
- * `spawn-start-failed` (no child to watch → release), never a silent no-op.
- */
-export function resolveResumeLaunchIdentity(plan) {
-    const record = readAddressableMetaIdentity(plan.sessionId);
-    if (record.backend !== "pi") {
-        throw new Error(`entwurf-v2-spawn-production: ${plan.sessionId} is a ${record.backend} citizen — ` +
-            `spawn-bg resume is a host-adapter capability, and its domain currently contains backend pi only. ` +
-            `This is a relaunch capability, not the control-socket rail and not citizen rank.`);
-    }
-    const sessionFile = record.transcriptPath;
-    if (!sessionFile) {
-        throw new Error(`entwurf-v2-spawn-production: ${plan.sessionId} has no recorded transcriptPath — ` +
-            `the citizen never wrote a session file (no turn yet), so there is nothing to resume.`);
-    }
-    // A recorded path is only a resume target while the file is actually on disk.
-    // Without this check a missing transcript falls through readSessionIdentity's
-    // ENOENT swallow and surfaces as "no recorded model" — the wrong cause (F7):
-    // the transcript was deleted, or the record carries a phantom path minted
-    // before birth guarded on file existence.
-    if (!existsSync(sessionFile)) {
-        throw new Error(`entwurf-v2-spawn-production: ${plan.sessionId} recorded transcriptPath "${sessionFile}" ` +
-            `does not exist on disk — the transcript was deleted, or the record carries a phantom ` +
-            `path from a pre-guard birth; nothing to resume.`);
-    }
-    const identity = readSessionIdentity(sessionFile);
-    const resumeModel = identity?.modelId ?? null;
-    if (!identity || !resumeModel) {
-        throw new Error(`entwurf-v2-spawn-production: ${plan.sessionId} has no recorded model — cannot resume.`);
-    }
-    if (identity.sessionId !== record.nativeSessionId) {
-        throw new Error(`entwurf-v2-spawn-production: ${plan.sessionId} transcript header id "${identity.sessionId ?? "(none)"}" ` +
-            `does not match the record's nativeSessionId "${record.nativeSessionId}" — the recorded transcriptPath ` +
-            `is stale or points at a foreign session file; refusing to resume another being's transcript.`);
-    }
-    const explicitExtensions = getEntwurfExplicitExtensions(resumeModel, false, identity.provider);
-    if (explicitExtensions.unresolvedAcpIntent) {
-        throw new Error(`entwurf-v2-spawn-production: ${plan.sessionId} recorded provider=entwurf but the bridge ` +
-            `extension could not be resolved — refusing to resume with an unknown provider (#29).`);
-    }
-    if (!identity.cwd) {
-        throw new Error(`entwurf-v2-spawn-production: ${plan.sessionId} header has no cwd (the cold-resume authority, #9).`);
-    }
-    return {
-        sessionFile,
-        cwd: identity.cwd,
-        explicitExtensionArgs: explicitExtensions.args,
-        provider: explicitExtensions.provider ?? identity.provider,
-        model: explicitExtensions.modelOverride ?? resumeModel,
-    };
-}
-const DEFAULT_POLL_INTERVAL_MS = 150;
-const DEFAULT_KILL_GRACE_MS = 5_000;
-/** The default spawnChild: a detached, unref'd `pi` resident child with stderr mirrored —
- * the same launch posture as the legacy worker, minus `--no-extensions` (the argv comes
- * from buildResumePiArgs v2-control). Detached so the resumed citizen survives this parent. */
-function defaultSpawnChild(cmd, args, cwd) {
-    const proc = spawn(cmd, [...args], {
-        cwd,
-        shell: false,
-        detached: true,
-        stdio: ["ignore", "ignore", "pipe"],
-    });
-    proc.unref();
-    mirrorChildStderr(proc);
-    return proc;
-}
-/**
- * Build the production `SpawnBgResumeDeps` the 5c-3a watcher consumes. The factory captures
- * NO plan and NO lock (D3) — both flow through the watcher. Pass `opts` to inject fakes for
- * the deterministic gate; the defaults are the real IO.
- */
-export function makeProductionSpawnBgResumeDeps(opts = {}) {
-    const pollIntervalMs = opts.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
-    const killGraceMs = opts.killGraceMs ?? DEFAULT_KILL_GRACE_MS;
-    const resolveIdentity = opts.resolveIdentity ?? resolveResumeLaunchIdentity;
-    const spawnChildFn = opts.spawnChild ?? defaultSpawnChild;
-    const lstatFn = opts.lstatFn ?? ((p) => fs.lstat(p));
-    const probeFn = opts.probeFn ?? ((socketPath) => probeSocketLiveness(socketPath, { timeoutMs: opts.probeTimeoutMs }));
-    const releaseFn = opts.releaseFn ?? ((lock) => void releaseLock(lock));
-    const setTimeoutFn = opts.setTimeoutFn ?? ((cb, ms) => setTimeout(cb, ms));
-    const clearTimeoutFn = opts.clearTimeoutFn ?? ((t) => clearTimeout(t));
-    // An abortable delay: resolves after `ms`, or rejects on abort (clearing the timer). Used
-    // by both awaitTimeout (the observe/grace deadlines) and the socket poll's inter-poll sleep.
-    const abortableDelay = (ms, signal) => new Promise((resolve, reject) => {
-        if (signal.aborted) {
-            reject(new Error("aborted"));
-            return;
-        }
-        const timer = setTimeoutFn(() => {
-            signal.removeEventListener("abort", onAbort);
-            resolve();
-        }, ms);
-        const onAbort = () => {
-            clearTimeoutFn(timer);
-            reject(new Error("aborted"));
-        };
-        signal.addEventListener("abort", onAbort, { once: true });
-    });
-    return {
-        killGraceMs,
-        spawnChild: async (plan) => {
-            const identity = resolveIdentity(plan);
-            const args = buildResumePiArgs({
-                variant: "v2-control",
-                sessionFile: identity.sessionFile,
-                explicitExtensionArgs: identity.explicitExtensionArgs,
-                provider: identity.provider,
-                model: identity.model,
-                prompt: plan.prompt,
-                launchArgs: plan.launchArgs,
-            });
-            const proc = spawnChildFn("pi", args, identity.cwd);
-            // B2: capture exit EAGERLY — the instant the proc exists, before we even await the
-            // spawn — so a fast exit cannot slip through the gap before awaitChildExit. Resolve-
-            // only (a signal kill reports null); it never rejects, so racing it against abort is safe.
-            const exitPromise = new Promise((resolve) => {
-                proc.on("exit", (code) => resolve(typeof code === "number" ? code : null));
-            });
-            // B1: a started process is NOT guaranteed by `spawn()` returning — a spawn-time
-            // failure (ENOENT pi / exec error) arrives as an `error` event, not a sync throw. Wait
-            // for the `spawn` event to confirm a real start; an `error` before it rejects, which the
-            // watcher turns into spawn-start-failed (release, nothing to watch) — NOT a silent
-            // spawn-started that later stalls into a wrongful retained lock.
-            await new Promise((resolve, reject) => {
-                const onSpawn = () => {
-                    cleanup();
-                    resolve();
-                };
-                const onError = (err) => {
-                    cleanup();
-                    reject(err instanceof Error ? err : new Error(`spawn failed: ${String(err)}`));
-                };
-                const cleanup = () => {
-                    proc.removeListener("spawn", onSpawn);
-                    proc.removeListener("error", onError);
-                };
-                proc.on("spawn", onSpawn);
-                proc.on("error", onError);
-            });
-            const child = { pid: proc.pid, proc, exitPromise };
-            return child;
-        },
-        awaitSocketAlive: async (socketPath, signal) => {
-            // Poll the EXACT path (no gid re-derivation). Connectable → resolve; forged →
-            // reject NOW; dead/indeterminate → wait one interval and re-poll, until abort.
-            while (!signal.aborted) {
-                const inspection = await inspectControlSocketPath(socketPath, lstatFn);
-                const mapped = await mapInspectionToLiveness(inspection, probeFn);
-                const verdict = socketWatchVerdict(mapped);
-                if (verdict === "alive")
-                    return;
-                if (verdict === "forged") {
-                    throw new Error(`entwurf-v2-spawn-production: forged control-socket address at ${socketPath} (never connected).`);
-                }
-                // wait — sleep one interval, honoring abort (rejects → loop exits below).
-                await abortableDelay(pollIntervalMs, signal);
-            }
-            throw new Error("entwurf-v2-spawn-production: awaitSocketAlive aborted before the socket became alive.");
-        },
-        awaitChildExit: (child, signal) => 
-        // Race the EAGER exitPromise (installed at spawn, so a fast exit is already captured —
-        // B2) against abort. exitPromise is resolve-only, so the loser never surfaces as an
-        // unhandled rejection; only the abort branch rejects.
-        new Promise((resolve, reject) => {
-            const { exitPromise } = requireProductionChild(child);
-            if (signal.aborted) {
-                reject(new Error("aborted"));
-                return;
-            }
-            const onAbort = () => reject(new Error("aborted"));
-            signal.addEventListener("abort", onAbort, { once: true });
-            exitPromise.then((code) => {
-                signal.removeEventListener("abort", onAbort);
-                resolve(code);
-            });
-        }),
-        awaitTimeout: (ms, signal) => abortableDelay(ms, signal),
-        killChild: (child) => {
-            // SIGTERM only this slice — the watcher's killGrace then waits for the resulting
-            // child-exited; if none arrives it returns lock-retained (a SIGKILL escalator is a
-            // separate policy + smoke). Best-effort: the watcher catches a throw here.
-            requireProductionChild(child).proc.kill("SIGTERM");
-        },
-        releaseLock: (lock) => releaseFn(lock),
-    };
-}