@llblab/pi-kit 0.38.4 → 0.39.0

package/node_modules/@llblab/pi-actors/docs/template-recipes.md

@@ -37,6 +37,8 @@ JSON is the most direct form for structured composition:
 }
 ```
 
+For shell-free Windows child Pi execution, use the Node executable followed immediately by the current Pi SDK's resolved `dist/bundle/cli.js` (or unbundled `dist/cli.js`) as its first argument. This exact SDK CLI form retains managed session placement, prompt materialization, Recipe context and text-print response selection; JSON/RPC/interactive streams remain withheld. An arbitrary script named `cli.js` is not recognized, and `.cmd` wrappers are not implicitly executed through a shell.
+
 ### Markdown
 
 Markdown uses YAML frontmatter for the Recipe contract and one executable fence for `template`:
@@ -77,6 +79,8 @@ A Recipe file must not declare top-level `name`. Within a command-template graph
 
 The following fields belong to the file-level Recipe contract. Unless noted otherwise, each field is optional.
 
+Planned, not implemented: additional root Run policy fields are specified in [Run supervision and self-contained outcomes](./run-supervision.md#exact-launch-api). They are not supported fields in the current table below.
+
 | Field | Type | Default | Contract |
 | --- | --- | --- | --- |
 | `description` | string | none | Human-facing purpose used by discovery and tool surfaces. Describe the outcome, not implementation history. |

package/node_modules/@llblab/pi-actors/docs/windows-process-observation.md

@@ -0,0 +1,248 @@
+# Windows Process Observation Recovery
+
+Status: User-approved architectural preparation; default native adoption remains gated. The corrected UTF-8 transport passed the actual Windows two-child/long-Unicode differential, including all five live/post-close cases and final fresh ESRCH. Earlier source-bound diagnostics localized a refusal to live scalar long (`S=N!=B`); its exact historical codec/content transformation remains unknown. The private raw-wire codec is now implemented and independently reviewed, with mirrored properties and normal build/invariant/process-owner integration; it is not imported by production readers. The subordinate-adapter preparation contract below has independent identity/fallback and artifact-handoff review, with an explicit raw-null exclusion closing the identified profile-admission gap. This is not an adopted binary-distribution or default-activation decision. Broader profiles and full-load convergence remain unproved. PowerShell remains the production backend. Its scalar/shared stdout codec and the independent full-instance reference now have a UTF-8 alignment correction accepted by the actual two-child Windows differential; packaged native assets, full-SDK fixture interception and default native selection remain unchanged. The existing [invocation-local identity contract](coordinator-delivery.md#invocation-local-windows-identity-observation) remains the production contract until a separately reviewed change supersedes a specific clause.
+
+## Problem and non-goals
+
+The current Windows reader starts PowerShell for each independently fresh scalar acquisition and each bounded shared acquisition. Both commands now project only consumed properties, but native convergence remains unproved. CI [41915780299](https://github.com/llblab/pi-actors/actions/runs/41915780299) finished with eight successful checks, Windows installed failure and macOS installed cancellation for hosted-runner capacity. Windows installed failed both packed genuine research and source public-spawn acceptance; public packed execution was not reached.
+
+The original failed public settlement bracket contains one synchronous shared call of 4511.520 ms in a roughly 8294.288 ms driver-local bracket. This establishes substantial blocking cost, not the cause of the entire policy gap or the original runner's state. Numeric PID presence, a later final-precommit snapshot and cross-process duration sums cannot establish original-runner survival or exit. The separate research reader retains its existing 20000 ms parent timeout; the captured SIGTERM does not identify its last operation.
+
+The later unchanged-production candidate `16a3417` completed [normal validation 42018306856](https://github.com/llblab/pi-actors/actions/runs/42018306856) with nine successful checks and Windows installed failure. Source-and-packed private research passed this time; source public-spawn failed in the first `overflow` cohort, and public packed execution was not reached. The original slightly wider 9773.292 ms driver bracket recorded one shared call of 5651.349 ms; original-runner exit remained unproven. This is still a PowerShell-path failure, not a native-adapter result or evidence that query cost explains the entire gap. The isolated MI pass does not relabel it.
+
+The goal is cheaper fresh observation with unchanged evidence strength, not a cache, longer deadline, new supervision system or a diagnostic subsystem for its own sake. Product correctness, observation quality and speed are separate gates.
+
+### Bounded original-runner diagnostic
+
+The public SDK fixture now has a temporary observer, with failure-only output, for the first `overflow` Run in each layout driver. It reserves one constructor candidate through public `node:diagnostics_channel`, matches executable/full public arguments/state directory/PID at successful `spawn`, and retains that original object's `close` callback facts. Private receipt binding follows the unchanged durable capture and requires the exact frame object and immutable signature. An unrelated first candidate makes the diagnostic unavailable; there is no replacement search, spawn interception, product hook, extra query, timer or wait.
+
+Optional `failure_evidence.original_runner` freezes original callback facts at settlement catch entry, captures available public runtime fields before callback revocation, attempts owned teardown, then projects frozen observations with post-attempt teardown uncertainty. The catch-only `runtime_terminal_fields` category reads `exitCode` and `signalCode` at most once each from the same retained original object: safe-integer/null yields `exit_code_set`, null/recognized builtin OS signal yields `signal_code_set`, and null/null yields `null_pair`. Invalid, read-faulted, unbound, uncovered, released or changed-capture observations yield `unavailable`; no raw code, signal or private cause is projected. Getter/catch-clock reentrancy can invalidate this new category but cannot replace frozen entry callback facts.
+
+A terminal runtime-field category establishes only that Node reflected original-runner termination by the read sequence; it does not date the exit or prove OS absence, identity or scope closure. `null_pair` cannot distinguish continued runner activity from delayed exit dispatch. `close_not_observed` means callback not observed, never “alive”; unavailable binding or listener coverage admits no close timestamp. A valid `sampled_ms` is only the same-driver catch sample, not admitted close evidence. Positive close-before-catch does not establish settlement-deadline compliance, exact kernel-exit timing, descendant closure, absence or cleanup authority. Failed removal may leave an inert callback and remains unconfirmed.
+
+Source, pure-property and independent implementation review cover this diagnostic; actual source/packed SDK and Windows convergence remain separate gates. It changes neither the shipping PowerShell reader nor the ESRCH, original-close, workload, watchdog or fresh-absence cleanup requirements. Retain uncertain roots; do not add manual probes or cleanup to improve diagnostic yield.
+
+### Direct SDK-settlement remediation priority
+
+The earlier CI-remediation track addressed the existing Windows runner lifecycle, independently of the proposed native adapter. Candidate `1486176` finished [Validate 42397743169](https://github.com/llblab/pi-actors/actions/runs/42397743169) with eight of nine product shards and audit passing; Windows installed failed at SOURCE first-overflow settlement for captured PID 1656/generation `bea51279-f4bc-431f-b70d-e1e25b00d5d3`. The matched original object's close callback was absent, saved natural0/execution-done0 did not establish exit, and the unchanged eight-second absence policy ended unproven. The wider driver bracket's one 5025.8459 ms shared acquisition is advisory cost, not proof of the cause or complete critical path. Native `S=N!=B` evidence does not repair this lifecycle refusal.
+
+Candidate `59b9d29` again finished [Validate 42413622977](https://github.com/llblab/pi-actors/actions/runs/42413622977) with eight of nine product shards and audit passing; Windows installed failed in SOURCE before the public SDK group's PACKED phase. The matched original object yielded `runtime_terminal_fields: null_pair`, no observed close and no observation faults. This leaves runner activity versus delayed exit dispatch unresolved; saved natural0/execution-done0 does not prove exit or readiness before settlement. The fixture releases the workload gate and immediately calls settlement, reading the ordinary outcome only after success; its failure outcome is collected after catch. Complete logs and checkout/tree provenance remain retained investigation evidence, not a causal repair.
+
+Control-flow inspection establishes that the exact original runner uses file-backed stdout/stderr, not parent-owned pipes; a generic parent-pipe drain correction is unsupported. `scripts/async-runner.mjs` prefers existing `dist/lib` runtime owners even in the SOURCE-layout journey, so any later production correction must bind both authoritative TypeScript and the selected compiled owner. Post-result Trace/lifecycle-release work and delayed driver dispatch remain hypotheses, not demonstrated causes.
+
+On the selected source/dist path, execution and final native revalidation precede the sole canonical result commit; terminal Trace append and lifecycle release can follow it. There is no early canonical-result writer on that path. Possible postcommit waiting is not an incident-proven cause.
+
+An actual-caller/settlement-helper controlled-port counterexample demonstrates that work still pending at the old eight-second limit can fail settlement and produce a later natural0 diagnostic. It proves source ordering, not the historical Windows cause or actual latency.
+
+The source-reviewed, operator-admitted fixture correction now releases the gate, awaits strictly correlated canonical work readiness for the original captured owner/Run/generation and physical metadata/result frame, then starts a five-second fresh-ESRCH policy. Readiness uses only the remainder of the existing whole-layout SDK watchdog (900 s Windows/300 s elsewhere), never a new per-Run allowance or watchdog reset. This explicitly moves the physical deadline and reduces the former eight-second duration; it is not an unchanged deadline. Missing result is pending, not absence; malformed, unsupported, changed or wrong-generation sources cannot establish readiness. Result/readiness is never exit or deletion authority. Keep outcome validation and failure-mode mutations after settlement, independent ten-second original-close acceptance, final-crossing fresh probes, exact failure ordering, body-failure cleanup and uncertain-root retention. Nineteen focused actual-owner properties and independent review cover the corrected source flow, including the real 1800-artifact declaration shape. Canonical metadata uses the existing 1 MiB input allowance independently of the unchanged 64 KiB result bound; complete reads and physical/generation fences remain required. The focused properties alone are controlled source proof. Candidate `a8cf20b` subsequently passed the complete public SOURCE/PACKED SDK boundary test on actual Windows in [Validate 42423556508](https://github.com/llblab/pi-actors/actions/runs/42423556508): both layouts, 87 genuine Runs each, all nine modes and both 40-member cohorts, with unchanged outcome/fresh-cleanup assertions (572731.9673 ms). Its own checkout log binds merge `96852adbdfe0a7ba12026eb5e57b6fb4a6ab4047` to the reviewed tree. This accepts the prospective fixture correction under the admitted policy, not a reconstruction of the old Windows cause. The installed shard still failed a separate private coordinator/research final fresh-PID gate; the complete matrix and native compatibility remain unaccepted. The bounded ownership inquiry found the producer/reader work awaited and no demonstrated omission to repair. The final positive probe correctly retained state; the surfaced PID has no proven role, original generation or reuse explanation. A generation-aware replacement for the strict final bare-PID rule requires explicit admission and reviewed positive termination/resource proof, not a close flag or an assumed mismatch. No luck rerun.
+
+Direct diagnosis must separate continued runner execution, pending stdio/handle closure and delayed driver callback dispatch where original-object/control-flow evidence permits; missing facts must remain unavailable. No distinction alone replaces original identity, fresh ESRCH, original-close acceptance or scope/resource cleanup proof. Preserve the exact command, workload/cohorts and timing policies except the explicitly admitted completion-boundary phase/duration correction; prefer a causally supported local correction over new instrumentation, and require a concrete decision-relevant falsifier before adding observation. T instrumentation and native backend adoption remain deferred under their separate gates. CI green must be observed on the actual reviewed candidate; no failing required PR check may be hidden or relabeled.
+
+### Current native Unicode transport correction
+
+Candidate `a431515` passed all nine product shards plus audit in [Validate 42431142343](https://github.com/llblab/pi-actors/actions/runs/42431142343). The unchanged private cleanup passed on this attempt; that is non-reproduction, not a causal explanation of the earlier positive-PID refusal or admission of generation-aware cleanup. The strict final fresh-ESRCH rule remains unchanged. The only remaining red check was [native experiment 42431142320](https://github.com/llblab/pi-actors/actions/runs/42431142320), whose own checkout `be241f1edf66db058ea5aec83844f520ecf8aa44` again reported `S=N!=B` for live scalar long.
+
+Source inspection found a concrete producer/consumer mismatch: both shipping PowerShell queries and the independent full-instance reference left stdout encoding implicit while Node consumed UTF-8. The correction sets `[Console]::OutputEncoding = [System.Text.UTF8Encoding]::new($false, $true);` before the unchanged JSON output pipeline. This explicitly selects BOM-free UTF-8 with encoder exceptions instead of replacement; it does not change JSON escaping, query selection, optional-field normalization, `.trim()`, comparison or digest algorithms. The full-instance query stays independent of the MI representation adapter. Its corrected transport intentionally differs from old B; neither historical byte identity nor optional T-observer noninterference is claimed.
+
+Saved identities are not migrated, rehashed or accepted as lossy aliases. A newly accurate Unicode observation may differ from an older corrupted record: the existing live comparison must still return `owner_mismatch`, and unavailable acquisition remains `unsupported_proof`, never absence or deletion authority. ASCII values and the consumed identity schema remain unchanged.
+
+Actual-owner pre-fix regressions failed and the corrected portable source/property and rebuilt-JavaScript checks pass. Candidate `5839065` passed [Windows native 42435117771](https://github.com/llblab/pi-actors/actions/runs/42435117771), own checkout `724c263bfaa624ff64280c9ed1d72f6fffe853f8`/tree `ff73bfeaa646575c0e02e0cbf8a0217b52945d95`: 13 properties including nine finite PowerShell encoder roundtrips, both ready original children and all five live/post-close observations. Every date/command/digest/verifier flag passed; two child closes, five native-helper closes, two full-instance closes and two synchronous current-reference terminations preceded final fresh ESRCH. This is positive acceptance for that tested profile, not arbitrary provider/UTC/architecture admission, full SDK convergence or default backend activation.
+
+The same candidate's Windows installed job in [Validate 42435117795](https://github.com/llblab/pi-actors/actions/runs/42435117795) passed public SOURCE/PACKED174 again but failed the unchanged private post-research final fresh-PID guard (`3172` present). Its own checkout confirms the same committed tree. The role, original generation and reuse explanation remain unavailable; the prior ownership inquiry still applies and the final refusal correctly retains state. This is not evidence that UTF-8 caused the refusal or permission to weaken cleanup.
+
+That job's two public SDK timing summaries also recorded zero calls because the existing observer recognized only the pre-correction PowerShell grammar. The source repair admits the exact optional strict BOM-free UTF-8 statement in those same anchored scalar/shared/full-instance commands, preserving the old grammar and all original-call/clock/privacy/cap behavior. Actual-builder RED-to-GREEN properties cover the blind spot and reject duplicate, non-strict/BOM or suffixed variants. Zero records were not proof of zero native IO; restoring observation neither establishes private-PID liveness nor fixes that separate gate. Independent review approved the narrow repair. Candidate `4461d0f` then passed all nine product shards plus audit in [Validate 42438289689](https://github.com/llblab/pi-actors/actions/runs/42438289689), as well as [native 42438289688](https://github.com/llblab/pi-actors/actions/runs/42438289688). The installed job's own checkout `43c7d56803f3c2914cd133ad3710aa380aeb582e` binds tree `7deafe2c2f7c5fb096df4620817475f7c0359474`; complete public SOURCE/PACKED174 passed in 578294.3167 ms. Its usable timing summaries recorded 1088/1084 calls, with no saturation or omitted records. This accepts restored command recognition on actual Windows; summed native duration still is not wall-critical-path time. The unchanged private cleanup also passed this attempt, which is non-reproduction, not a causal repair or permission to replace fresh ESRCH.
+
+## Selected architecture
+
+Recommend a one-shot user-mode Windows helper using the documented native Management Infrastructure client API against local `root/cimv2`, `Win32_Process`, WMIDCOM. Each invocation owns one application/session/query operation, consumes complete results, releases native resources and exits naturally. It receives numeric PIDs and a fixed query profile only, never expected identities, Run metadata, paths, control instructions or cleanup authority.
+
+```text
+Existing scalar/shared admission and original frame
+  -> internal fresh acquisition
+     -> one-shot native MI application/session/query
+  -> compatibility decoding
+  -> existing identity comparison and frame/callback fences
+```
+
+This removes PowerShell initialization, not synchronous provider cost. MI result retrieval can still block. Neither speed nor deadline recovery follows from the API choice.
+
+- `runs-process.ts` continues to own acquisition/decoding/native identity. The helper is a platform adapter, not another lifecycle facade.
+- `runs-status.ts` retains original metadata/ownership/physical-frame admission and independent assembly/fallback/revalidation.
+- `async-runs.ts`, `runs-results.ts` and Control retain their current authority boundaries and checks. No production hook, public backend selector or observation bridge is introduced in the first slice.
+- Native observations never survive an invocation or cross a callback. No broker, daemon, retained PID map or asynchronous stale snapshot substitutes for a fresh read.
+- A helper session/operation is query-resource ownership, not an original-child lifecycle capability.
+
+### Representation and failure contract
+
+The existing consumed identity remains exactly:
+
+```text
+start_time = decoded CreationDate string
+command = `${string ExecutablePath or ""}\n${string CommandLine or ""}`.trim()
+cwd = absent
+```
+
+Do not reconstruct command lines, strengthen optional path visibility, canonicalize paths or silently rewrite historical fingerprints. Native FILETIME, DMTF, MI timestamps and the PowerShell JSON date are not interchangeable strings. The prototype must retain typed MI timestamp components privately and validate its candidate formatter against real reference values, including offset and precision. Unknown profiles are unsupported, not guessed. Unicode and optional/null/type handling must preserve the consumed JavaScript strings without normalizing or dropping UTF-16 code units.
+
+Scalar and shared profiles remain distinct: only the shared result needs a returned native ProcessId for correlation. Query inputs remain unique positive safe integers, at most 64 for shared, with no DWORD truncation. Numeric-only textual query construction remains bounded at 4096 ASCII characters; complete output remains bounded at 1 MiB. Complete retrieval, duplicate/foreign-row rejection and borrowed-instance copying precede consumption. A missing row, denied access, malformed output or query failure is not native absence.
+
+The prototype must distinguish transport, retrieval and operation outcomes, copy borrowed values before the next retrieval, drain to `moreResults=false`, close operation before session before application and release owned error data. A cleanup hang or leaked helper is a falsifier, not permission to force exit.
+
+The next candidate's fallback contract is specified below, separately from current production behavior: no retry through an identity mismatch or replacement, no rebinding to later metadata and no fabricated absence. Existing PowerShell remains the baseline for unsupported optimized profiles; neither the inert experiment nor this design changes reader selection.
+
+## First implementation checkpoint: inert differential prototype
+
+Implement only excluded test/prototype sources under `tests/fixtures/`, with no production imports, package assets or native default selection. The checkpoint owns a native MI source, one standalone harness and focused protocol/adapter properties in the existing installed-script owner where appropriate. It does not add skips or alter the fixed SDK journey.
+
+1. Launch one controlled child owned directly by the harness. Capture the original ChildProcess and its actual spawn/close receipts, require a genuine ready message, and retain its workload gate until observations finish. This uses ordinary owned-child fixture lifecycle, not a global spawn interception or cross-process clock carrier.
+2. Obtain a reference identity through the existing PowerShell reader and retain that reference in a fixture-owned on-disk frame. Exercise the historically consumed representation, not a native-formatted replacement presented as old data. The harness must verify any additional full-instance reference command against the actual old grammar rather than accidentally comparing the candidate to itself.
+3. Query the same original child through native MI. Compare decoded date and combined-command strings, native identity digest and existing verifier decisions against the retained reference. A wrong expected identity must reject without repair. A child replacement, unexpected close, unsupported date profile or incomplete query is not a successful comparison.
+4. Record acquisition durations separately in the harness's one local clock. Close receipt times describe callback dispatch, not exact kernel-exit times; no clock alignment or inference that query cost explains the whole policy gap is allowed. Do not log raw command lines, identity strings, paths, stacks or private digests; report bounded compatibility flags, status categories and durations.
+5. Release the child normally, await actual close and require fresh ESRCH immediately before any deletion. Keep uncertain state on all failures. No kill, unref override or forced process exit.
+
+Start with one ready child and scalar plus one-row shared comparison. Broader PID/type/Unicode/date partitions use deterministic properties; broader live differential coverage follows only after the basic native experiment succeeds. One comparison cannot establish all-provider equivalence or full-load performance.
+
+### Native execution and CI
+
+The current Linux/offline TypeScript build cannot manufacture a Windows helper. The initial native build is a test-only Windows x64 experiment using the hosted runner's installed SDK/MSVC, with exact toolchain/source/artifact provenance recorded. No operator compiler, download-at-install, privileged setup or release asset is added. If those tools are unavailable, report an unexecuted experiment rather than success or a product skip.
+
+Use a separately bounded Windows prototype CI job/workflow if needed to obtain the native experiment. Keep its CPU workload on a separate runner from the unchanged product benchmark, use existing pinned action conventions and read-only permissions, and add no publication/OIDC behavior. Existing normal validation is not weakened, bypassed or relabeled by a successful prototype. Prototype wiring and trusted build-command quoting are part of implementation review before any guarded same-PR update.
+
+A CI watchdog is an administrative execution bound, not observed helper/child absence. Canceled or hung experiments retain uncertainty and never authorize cleanup. Do not increase existing product, SDK or fixture deadlines to obtain a pass.
+
+## First native result
+
+On candidate `16a3417`, [isolated experiment 42018307139](https://github.com/llblab/pi-actors/actions/runs/42018307139), job `127214304702`, passed on Windows x64. Toolset `14.51.36231` and SDK `10.0.26100.0` compiled source SHA-256 `3c0a68950d86d5b00de4fe0ee475ec9b1b50ccb728085716cee312a515f3abe5` into artifact SHA-256 `28f136e00048a7c025a67fd21fcd257d7c30af299af70e89bd327847c6d47716`; the inspected direct dependency list was `kernel32.dll`, `mi.dll`. This is recorded build provenance, not a reproducible-build or general runtime-dependency guarantee.
+
+All four focused properties passed without skips. Scalar and one-row shared results matched the reference's consumed date, combined command, digest and verifier decisions, including wrong-expected rejection and unavailable-proof distinction. Both native helpers closed naturally; the original child was spawned, ready, released and closed, and every captured PID qualified by fresh ESRCH before cleanup.
+
+Measured acquisitions were 66.703 ms scalar and 56.641 ms shared; sequential current/historical PowerShell references measured 1450.226 ms and 342.047 ms. These are one child's sequential observations with different warm-up conditions, not an equivalent full SDK benchmark, statistical speedup or recovered eight-second settlement. The production reader was unchanged. Accept only this tested child/profile; do not infer 64-row/large-Unicode/non-UTC/provider-error/architecture parity or default activation.
+
+### Two-child differential source checkpoint
+
+The excluded harness now owns two simultaneously ready original child objects, with distinct short and real long Unicode/quoting arguments. Its private three-key readiness acknowledgement binds the JSON length and SHA-256 of actual child `process.argv.slice(4)` to the parent's expected arguments; it does not reconstruct an OS command identity. Each child retains both genuine current projected scalar and historical full-instance scalar PowerShell references plus a digest in an exclusive physical/byte-fenced frame. This does not exercise the production shared PowerShell reader.
+
+Five fresh native observations cover live scalar short, live scalar long, shared `[long, short]`, naturally closed-short scalar missing, and closed-short/live-long shared. Every present row must match both retained references through all six existing comparison flags. Post-close observations retain both physical frames while fencing only the original live long child. Missing short must remain `unsupported_proof` under injected true liveness; a returned short row falsifies the case. Reversed request order is not provider-reordering evidence; pure properties separately reverse row arrays.
+
+The actual experiment and failure cleanup share one release routine: attempt every eligible original child before any settlement wait, preserve exact falsy faults and callback encounter order, continue after a failed close, and never resend or reappend already surfaced faults. Callback success and backpressure are distinct from natural close. The closed `native-mi-experiment-v1` success projection uses `compatible-tested-two-children-only`, fixed query/role facts, source/artifact hashes and separate lifecycle counts: two child closes, five native-helper closes, two historical-reference closes and two current-reference synchronous native terminations. Raw identities, argv, private argv hashes, paths, receipts and cause chains stay private. Final fresh ESRCH for every captured PID immediately precedes the sole deletion; uncertain roots remain retained.
+
+Candidate `77c7942` failed the [broader isolated Windows experiment 42380613595](https://github.com/llblab/pi-actors/actions/runs/42380613595), job `128427244017`, on actual checkout `0abfc057f8720452407be9c599df0b50c74ff33b` and tree `20e033a2342b3d75ec4912c346271a14c5b26b76`. Both native units built, all seven producer-property groups/256 assertions and the five then-current Node properties passed, but the differential refused an initial scalar comparison: date matched; command, digest and acceptance did not. The closed failure report does not identify short versus long or the differing raw component. This does not establish an encoding/provider cause, complete lifecycle counts, cleanup acceptance or broader compatibility.
+
+The reviewed diagnostic source adds at most one separate `native-mi-command-diagnostic-v1` JSON line before the unchanged experiment failure line and exit 1. Its six fixed fields are `schema`, `stage`, `case`, `reference`, `executable_relation` and `command_line_relation`; the two cases are initial live scalar short/long, with historical-full-instance reference. Component relations distinguish equal/different strings, reference-only/native-only strings and both nonstrings, without claiming that nonstring means null. The record is bounded to 512 UTF-8 bytes including LF and uses only already acquired, validated responses. It exposes no raw identity, argv, PID, paths, hashes, lengths, offsets or errors, and performs no new query. First matching facts freeze before cleanup; added raw-component references are released after use or unwind. Unavailable diagnostics are omitted. Optional write faults cannot suppress the baseline failure path; baseline write faults retain their existing semantics.
+
+Candidate `54667a3` reproduced the refusal in [Windows experiment 42385378853](https://github.com/llblab/pi-actors/actions/runs/42385378853), job `128441527002`, on actual checkout `22b32f52db7a2fdf7624c6c45a44972fab34565d` and tree `17666e4c51a91ee62f67417736327f37834d7d2c`. Both native units built; seven producer groups/256 assertions and all six Node properties passed. One valid six-field diagnostic (213 UTF-8 bytes including LF) immediately preceded the unchanged refusal: `live-scalar-long`, `executable_relation: equal-strings`, `command_line_relation: different-strings`. Both differing CommandLine components were strings, not an optional string/nonstring partition. Date still matched; command, digest and acceptance did not. This supplies that attempt's case/component witness only: raw content, encoding, provider semantics and cause remain unobserved, and it cannot retrospectively attribute `77c7942`. Later cases, full lifecycle counts and final fresh ESRCH acceptance were not reached.
+
+Six focused properties, syntax, TypeScript, diff checks and independent implementation/F1 review cover the diagnostic boundaries, including an actual controlled-port RED-to-GREEN correction. The captured Windows record proves this delivery, not general stdout atomicity/delivery, asynchronous stream-error handling, provider-fault coverage or cleanup. A passing later attempt without reproduction is not a causal repair. Source/artifact hashes alone neither authenticate executable origin nor bind immutable execution bytes. The later UTF-8 correction and restored timing recognition have actual Windows acceptance as recorded above. N1.2p environment/UTC/precision admission, asset approval, activation and unchanged full SDK/native convergence remain separate gates. No mandatory check, native bound or deadline changed.
+
+### Pre-stdout boundary witness — source preparation
+
+The reviewed excluded harness prepares one optional LONG-only witness S from the same already acquired PowerShell CommandLine, before stdout serialization. It adds no provider query or helper process. One direct UTF-16-unit transcriber handles both S and a computed control containing NUL, isolated surrogates and a non-BMP pair; the private ASCII capsule is bounded to 131200 bytes and S to 32767 units. All optional PowerShell work precedes the unchanged last serialization pipeline. The exclusive reservation retains the original parent FileHandle; seed/nonce, same-writer-stream EOF, physical correspondence, bounded explicit-position reads through actual EOF and stable frames gate admission. S is withheld until parent close succeeds, and is read only after the original capture/decode, current-reference equality, source-hash and frame gates. That equality is conditional consumed-identity evidence, not equivalence to an unmodified historical process at the same instant.
+
+At most one `native-mi-prestdout-diagnostic-v1` record can accompany the first initial LONG scalar command mismatch with valid string S, historical decoded B and native decoded N, where B differs from N. Its exactly five string fields are `schema`, `stage`, `case`, `reference` and `relation`; `native-only-match`, `baseline-only-match` and `neither-match` classify strict S/B/N equality without exposing their contents. The record fits 512 UTF-8 bytes including LF and precedes the existing six-field diagnostic, which remains adjacent to the unchanged baseline failure line. Unavailable control/data omits this record without retry or identity substitution; independent optional-write faults cannot preempt the baseline. Raw added references clear after use or unwind. Unknown ownership or observed parent-close failure retains the root and prevents full success; confirmed private closure still cannot replace fresh ESRCH for every captured PID before deletion. Valid file bytes do not prove writer flush/disposal, durability or resource closure.
+
+Twelve focused properties pass without skips, together with syntax-first, TypeScript, diff and protected-source/inverse checks; independent whole implementation review found no blocking source issue. These are source, controlled-port and extracted-main VM proofs, not complete physical end-to-end composition or general Windows protocol coverage. PowerShell noninterference/profile admission, all five real native cases and full lifecycle/fresh-ESRCH acceptance remain unproved. S matching N but not B would localize a historical serialization/transport/decoding boundary, not identify a codec, authorize a fingerprint change or establish a causal repair. B-only or neither-match reject different simple explanations; unavailable S supports no inference. The shipping reader, native bounds and mandatory SDK checks are unchanged.
+
+Candidate `1486176` produced `native-only-match` in [Windows experiment 42397743112](https://github.com/llblab/pi-actors/actions/runs/42397743112), job `128478664886`, on actual checkout `649c1c1bd7be22b131fbc6ccb902997fc0d05c3b` and API-bound tree `0786eb47704ee88a072ddcc39f12139273eec0fd` (parents `1486176` and unchanged main `b30ff24`). Both native units built; seven producer groups/256 assertions and all twelve Node properties passed without skips (Node properties: 404.5797 ms). A valid 164-byte five-field record immediately preceded the 213-byte legacy diagnostic and unchanged scalar command-mismatch failure/exit 1. Under the bound reviewed source, the admitted pre-stdout string S strictly matched native-decoded N and differed from historical-decoded B; executable strings still matched. This is an actual single witness-path admission through its control, descriptor and parent-close gates, not a general sharing/metadata/noninterference guarantee or independent writer-closure proof. It localizes this attempt's difference to historical serialization/transport/decoding, not a specific layer, codec, correct side or causal correction, and cannot retrospectively attribute older attempts. Later cases, full lifecycle counts and final fresh ESRCH acceptance were not reached.
+
+Independent next-act diagnosis found no causally justified compatibility correction. The historical path's fatal UTF-8 decoding and JSON parsing succeeded in the witnessed attempt; valid UTF-8 does not establish fidelity to the original string. The proposed missing boundary is T: CommandLine represented by the single actual in-memory JSON result destined for historical stdout, before output encoding. T matching S would exclude selection/serialization as the first divergence; T matching B would exclude an output-decoder-only explanation; neither or unavailable permits no correction. This is an unadopted inquiry, not another observer or baseline. Capturing T must not silently replace the current unchanged-last-pipeline/status contract, serialize twice, reconstruct expected identity or assume writer closure. Bounded feasibility evaluation did not establish a concrete mechanism preserving exact stdout/stderr/status/error ordering: materialize-then-emit or inline observation changes the terminal flow, while post-pipeline work reopens F1. T remains deferred; changing the last-pipeline clause alone would not supply the missing noninterference argument. This is a bounded design stop, not a theorem that every PowerShell observation is impossible. Reopening requires a concrete independently reviewed mechanism before explicit source adoption; the current S contract does not grant it.
+
+## Next integration contract — reviewed preparation
+
+This is a concrete preparation boundary, reviewed independently for identity/fallback and artifact handoff, not approval to ship or activate a native executable. Open work and approval gates remain solely in `BACKLOG.md` (N1); this section owns the proposed design. The selected approach is one private subordinate adapter plus reviewed committed assets, not a general backend framework or second release assembly.
+
+### Ownership and supported representation
+
+The native producer now has one unrouted source owner at `native/windows-mi/windows-mi.cpp`; the standalone differential remains a test consumer. Invocation/asset verification and raw-MI compatibility decoding belong to `lib/runs-process-windows-mi.ts`, with mirrored adapter properties. Keep one producer implementation rather than independent prototype/shipping copies. Source placement does not approve executable distribution, package inclusion or production routing. `runs-process.ts` retains legacy identity construction, digest/comparison and its public contract; the subordinate adapter must not import that owner. At eventual activation, change only the acquisition seam in `readWindowsIdentity` and `readWindowsProcessIdentities`. Do not move original-frame admission, liveness/status precedence, scalar fallback or callback/publication/Control/teardown fences from their current owners.
+
+The complete private adapter will return validated legacy-shaped property rows and a closed acquisition outcome, never expected identities, verifier decisions, Run metadata or lifecycle capabilities. Its implemented observation stage retains typed timestamp components and raw optional-field facts explicitly as `decoded_unadmitted`, with no date-to-legacy promotion, process invocation, asset loading or profile-admission port. Initial raw-null refusal belongs before normalization; native producer properties and the asset/invocation seam are separate slices. This stage alone cannot supply a process identity or establish freshness. Scalar and shared profiles stay distinct; shared rows require unique exact selected-PID correlation regardless of result order. Preserve the consumed string/optional normalization above, including `.trim()` and UTF-16 code units, lone surrogates and non-BMP pairs. Unexpected MI types, missing required properties and unsupported representations make the entire optimized observation unusable; no stronger path lookup, argv reconstruction or identity-format migration is permitted.
+
+The same private owner separately implements `decodeProvenanceBinding` for an already parsed, flat JSON-value fragment with exactly `source_sha256`, `executable_sha256`, `executable_bytes`, `originating_source_commit` and `originating_build_job`. Complete lowercase ASCII hash/commit lexemes, positive safe-integer byte counts and exact positive decimal-string job identifiers decode into fresh primitive claims labeled `decoded_binding_unadmitted`; malformed fragments return only `unusable/invalid_binding`. Source and installed compiled properties cover those boundaries, including final line terminators and copy independence. This is not a complete manifest, trusted descriptor, byte reader or asset verifier: it checks no file/hash, authentic origin, compiler, dependency or profile and grants no execution permission. Full-manifest format/resource bounds, trusted exact-byte selection, fixed asset lookup and invocation remain separate preparation work; arbitrary executable JavaScript objects are outside this JSON-value contract.
+
+Do not promote the prototype's broad `candidateDate` range wholesale. The initial candidate is UTC-only; production eligibility requires a positively recognized environment/representation profile and real PowerShell serialization witnesses, including precision boundaries. An MI timestamp's zero offset alone, a runner label, a local JavaScript timezone or equality with an expected identity is not that predicate. The first experiment did not record a complete environment-admission witness. Establish the exact native environment/version facts and executable predicate in the broader differential before claiming a supported optimized profile; until that predicate is evidenced, keep profile admission unsupported. Non-UTC/historical profiles remain baseline-only unless separately admitted.
+
+Optional `MI_STRING` null normalization defines codec compatibility only, not admission of an unproved provider-visibility partition. Until that partition has real differential evidence, the initial optimized profile admits only rows whose raw `ExecutablePath` and `CommandLine` are non-null `MI_STRING` values. Preserve and check those raw facts before normalization; a null optional field in any returned row makes the entire optimized acquisition unsupported and selects baseline once. Broader null admission requires separate evidence and a predicate based on observable raw fields/environment facts, never expected-identity equality. Do not strengthen path reads. Non-null fields alone do not establish all-provider equivalence, and they do not bypass the UTC-profile gate.
+
+The six-byte ASCII escape for every UTF-16 unit is deliberately retained for the minimal candidate. Sixty-four 32,767-unit command strings alone require about 12.6 MB before other fields, exceeding the 1 MiB output limit. This is a real unsupported partition, not 64-long-command parity. The native serializer must bound the whole response, continue draining, close resources and reject the entire optimized observation on overflow. Never truncate rows, accept a prefix or widen the budget. Test the actual native producer at the limit; parser-only properties do not prove bounded serialization.
+
+`tests/fixtures/windows-native-mi-producer-properties.cpp` includes that exact owner with test-only compile-time MI/stdio call targets. It exercises actual input, UTF-16 escaping, row copying, aggregate bounds, finite draining, cleanup-attempt ordering and output-failure control flow without another serializer or live process query. Malformed-row witnesses leave subsequent rows otherwise admissible, so duplicate/cardinality refusal cannot mask the intended validation. The isolated Windows workflow now compiles both translation units and executes these producer properties; acceptance requires results bound to the actual sources, compiled artifact and toolchain rather than a Node-only pass. Synthetic MI faults, controlled copy `bad_alloc` and close/delete counters prove only their exercised control-flow/attempt partitions, not real OOM, provider permission or physical resource closure. The real one-child differential remains separate.
+
+### Native producer property checkpoint
+
+Candidate `62a0dcb` passed [isolated Windows validation 42308530762](https://github.com/llblab/pi-actors/actions/runs/42308530762), job `128203935655`, on checked merge `ea114af6b82ab540d7a2f33a83093799e3c377d3` and tree `bb1afbe85e90e2fd4e417eb1afe4c5128bf424f3`. MSVC `14.51.36231` and SDK `10.0.26100.0` compiled the unchanged single producer and corrected property fixture; all seven native property groups and 256 assertions passed. The prior actual Windows run's one failure was a test comparing the 12,582,528-byte escaped command payload to 12 MiB instead of the normative 1 MiB limit. The one-line correction preserves whole-response refusal, all 64 retrievals and the unchanged producer.
+
+The job also passed all four Node properties without skips and the existing one-child scalar/shared differential against current and historical PowerShell. The tested producer artifact was `7a50b77cb3fa6f767896d4f78ddc52f160ea362bad59f8b565d71d211f506fec`; the property artifact was `4e772cb8226d281a2a84600c951057f11c60e507898935f2cb2061fdc3406a63`. Both helper closes, the original child's ready/release/close and fresh ESRCH cleanup were observed. These results close the bounded producer-property/source-promotion checkpoint, not synthetic-fault physical cleanup, broader provider/UTC admission, executable distribution, exact shipping-asset review, default routing or full-load SDK convergence. The shipping reader remains PowerShell.
+
+### Acquisition and fallback
+
+Distinguish complete native observation, unusable/unsupported optimized acquisition, and no admitted identity from a completed observation. These are private acquisition outcomes, not new public status values.
+
+- Unsupported architecture/profile, absent/corrupt/wrong-version assets, unavailable dependency, policy-denied execution, spawn failure, nonzero exit, malformed/incomplete response or representation overflow may select the existing PowerShell acquisition once for that acquisition. Preserve its exact grammar, options and existing scalar/shared error behavior; do not convert a native failure into absence or leak new raw errors into public surfaces.
+- Do not bypass execution policy, relocate/copy an executable to evade blocking, download a replacement, elevate or add a retry loop. Runtime damage selects the baseline; required release-asset damage is a build/package failure instead.
+- A completed native response with a missing PID has no admitted identity for that PID. It does not itself trigger baseline repair and never establishes absence. Preserve the existing independently fresh higher-level shared/scalar fallback against the original fenced row; do not rebind to replacement metadata.
+- Once a supported native identity reaches comparison, mismatch is final for that observation. Neither baseline acquisition nor a more privileged path may repair it. Changed original metadata/ownership/physical frames discard the observation instead of retrying through replacement.
+- Only an independently qualifying fresh liveness observation can produce `dead_pid`. Helpers, empty responses, missing rows, errors, earlier liveness samples and Kill receipts cannot do so.
+
+The first adapter implementation is unrouted: no production import/selection, public backend knob, environment enable switch or dormant default-enable flag. Test the adapter directly. Invocation resources are fresh each time; no result/profile shortcut may smuggle cached native identities across callbacks.
+
+### Artifact and release handoff
+
+Recommendation, pending explicit owner approval: distribute a reviewed unsigned Windows x64 executable as versioned committed repository/npm assets. This adds executable bytes, not a new operator compiler/runtime/privilege requirement. Unsupported architectures remain on the baseline. Approval of this distribution model is distinct from production activation.
+
+```text
+native/windows-mi/windows-mi.cpp
+native/windows-mi/win32-x64/<helper-version>/windows-mi.exe
+native/windows-mi/win32-x64/<helper-version>/manifest.json
+dist/native/windows-mi/…
+```
+
+The versioned manifest binds protocol/profile version, architecture, native source SHA-256, executable size/SHA-256, actual compiler/SDK/build arguments, inspected dependencies and originating exact source commit/build job. The originating commit is the checked-out commit whose source was compiled, not the later asset-import/release commit; retain it unchanged while checking the current source digest. No manifest-containing-own-commit requirement is introduced. Helper versions are independent of the npm version. Digest/manifest verification is integrity and provenance, not executable authenticity, a signature, reproducibility or comprehensive dependency availability. The manifest is not allowed to self-authorize an unreviewed binary/profile.
+
+The isolated Windows workflow may prepare the exact candidate executable plus manifest as a retained CI artifact after its own differential, with existing read-only permissions, no OIDC, no publication and no automatic repository writes. An authorized maintainer imports those exact reviewed bytes in a normal asset-review change; a separately rebuilt executable cannot borrow that artifact's evidence. Retain only executable/provenance/closed test results in the distributable handoff, never private process identities, command lines, fixture state or raw diagnostic logs. Candidate artifact retention does not authorize committing or publishing the executable.
+
+After asset approval, `scripts/build-dist.mjs` verifies the manifest/source/artifact binding and copies the approved bytes into its temporary candidate before atomic replacement. Existing `build:check` compares the binary inventory/bytes too. Add root `native` to the npm allowlist only at that admitted packaging change. Resolve fixed versioned assets relative to `import.meta.url`: source `lib/` → root `native/`, compiled `dist/lib/` → `dist/native/`; never search cwd, PATH or caller-supplied locations.
+
+Offline Linux build/prepack must only verify and copy existing bytes: no Windows execution, MSVC, download or compiler prerequisite. Required asset corruption/missing data must fail packaging rather than silently publish an incomplete optimized package. The existing reusable validation and Ubuntu immutable-tag publish job each check out the repository independently; no native artifact handoff currently connects them. Committed reviewed assets preserve `release.yml` as the sole assembly/publication owner and avoid release-time downloads or a second publication service.
+
+### Minimum broader differential
+
+Actual Windows x64 evidence must use the exact proposed candidate bytes, not merely another compilation from the same source:
+
+- Two simultaneously ready directly owned children, distinct commands and a real long Unicode/quoting payload with non-BMP characters, spaces, quotes and backslashes. Compare each scalar and the two-row shared observation against current projected PowerShell and the historical full-instance reference, correlating by PID rather than returned order.
+- Retain genuine PowerShell identities in owned on-disk frames. Check exact date/combined command/digest, legacy-metadata acceptance and wrong-expected rejection without mismatch fallback. After a captured child's natural close, missing native rows remain unsupported observation; fresh ESRCH independently supplies absence.
+- Record the real environment/profile facts needed for UTC admission and verify the exact predicate independently of expected identity. Controlled date/precision boundaries must also use actual Windows PowerShell serialization; disclose formatter fixtures separately from actual `Win32_Process` rows. Unsupported profiles must select baseline without guessed date repair.
+- Exercise denied launch and MI initialization/query failure through narrowly scoped controlled ports without changing machine policy or privileges. Injected denial proves error routing, not actual provider-permission parity; an unproved provider partition remains unsupported/baseline-only. Do not claim access to arbitrary protected processes.
+- Every captured helper/child closes naturally, and every deletion requires fresh ESRCH. A watchdog, timeout, aggregate timing or callback close receipt is not exact kernel-exit timing or authority to remove uncertain state.
+
+Deterministic ports and native producer properties separately cover PID boundaries 1/64/65, duplicates/invalid safe integers/no DWORD truncation; reordered/duplicate/foreign/missing shared rows and scalar multiple rows; optional null/type codec partitions plus whole-query initial-profile refusal before null normalization; UTF-16/lone-surrogate round-trip; profile/date refusal; complete-wire bounds including actual six-byte expansion; malformed UTF-8/JSON, incomplete retrieval, nonzero/signal/spawn denial, absent/corrupt/wrong-version assets and cleanup faults. Unknown liveness stays unknown. Synthetic 64-row frames cover cardinality/size without spawning 64 workloads or scanning arbitrary PIDs. Existing original metadata/ownership/source-byte/physical-frame and callback-freshness families stay with their owners.
+
+### Preparation, shipping and activation boundaries
+
+The dependency-ready preparation is the unrouted private adapter/codec, mirrored properties, promoted native source and reviewed candidate artifact build/retention path. Keep the package's binary inventory unchanged until asset ownership is approved. No global SDK spawn interceptor or research-marker layer is justified by this integration question.
+
+Before shipping assets, independently review codec/fallback, native resource closure and provenance/distribution, then verify source/dist lookup, offline normal build/prepack, package inventory and exact shipping-byte differential. Before default activation, separately admit the routing change and pass unchanged source-and-packed genuine SDK/native validation through the actual shipping path. The fixed Run layout, workloads, watchdogs, settlement/close/research boundaries, privacy/history/budgets and independently fresh checks remain those of the existing contract; standalone helper latency does not prove recovered SDK settlement.
+
+## Deferred observation and activation work
+
+Do not implement the full 87-Run spawn interceptor or research marker stream merely because a design exists. The inert prototype's directly owned child already supplies its necessary lifecycle evidence. Add further observation only for a specific unanswered question after reviewing its cost and provenance.
+
+If original SDK lifecycle discrimination remains necessary, a later fixture-only interceptor may observe the exact returned ChildProcess in a single launch slot, bind once to the first captured Run/owner/generation/physical frame and retain closed dispatch facts. No error listener may suppress product errors, no original spawn/return/throw/ref/unref/kill behavior changes, and failed/ambiguous binding stays unavailable. Public DTOs are not physical-frame capabilities; any additional file-only capture must be explicit, bounded and reviewed. Close receipt before numeric presence does not by itself prove PID reuse; absent receipt under a blocked event loop does not prove a live original child. ESRCH remains the deletion gate.
+
+For research timeout diagnosis, a later closed enter/ok marker stream can identify last observed entered/completed operations, not assert the phase active at timeout. It must preserve exact provider/workload rejection and ordered cleanup causes, reject arbitrary stderr noise, retain existing raw capture bounds and use the smallest justified record budget. The proposed 512-marker/48-KiB allowance is not adopted. No timestamps, signal handler or extra native probe is necessary for stage ordering.
+
+Default native activation is a later checkpoint requiring consumed-string/status compatibility across supported profiles, naturally closing resources, source/packed parity and unchanged full native acceptance. Approved optimized architectures need auditable source/build/artifact provenance and install-time-independent prebuilt assets; unsupported profiles keep the baseline. Do not promise arm64 support, reproducible binaries, blocked-executable fallback or no-runtime-prerequisite support without verifying them. No package/backend activation follows from a successful scalar experiment.
+
+## Rejected paths and acceptance gates
+
+Reject further query-flag experiments without new evidence, PID-only lifecycle joins, timeout inflation, stale async caches, native-check elision, direct-image-path substitution, undocumented Nt/PEB command-line reads as a presumed drop-in, or a persistent PowerShell broker without demonstrated need.
+
+The first checkpoint is accepted only after independent identity/clock/lifetime, native cleanup, temporal/error/privacy and packaging review; deterministic protocol/adapter checks; and an actual native differential result. Production activation separately requires 87 planned genuine Runs/layout, nine modes, both 40-spawn cohorts, the unchanged 300 s/10 ms workload and 900 s Windows/300 s other SDK watchdog, the operator-admitted five-second completion-boundary ESRCH settlement after strictly correlated canonical work readiness, and separate ten-second original-close acceptance. Other existing eight-second settlement policies remain unchanged. Preserve all source/privacy/generation fences, framing/history contracts and fresh ESRCH before each deletion. Loaded-host UI acceptance and release automation remain separate gates.
+
+## Evidence references
+
+- [Get-CimInstance, PowerShell 5.1](https://learn.microsoft.com/en-us/powershell/module/cimcmdlets/get-ciminstance?view=powershell-5.1)
+- [MI_Application_NewSession](https://learn.microsoft.com/en-us/windows/win32/api/mi/nf-mi-mi_application_newsession)
+- [MI_Session_QueryInstances](https://learn.microsoft.com/en-us/windows/win32/api/mi/nf-mi-mi_session_queryinstances)
+- [MI_Operation_GetInstance](https://learn.microsoft.com/en-us/windows/win32/api/mi/nf-mi-mi_operation_getinstance)
+- [MI_Timestamp](https://learn.microsoft.com/en-us/windows/win32/api/mi/ns-mi-mi_timestamp)
+- [Win32_Process](https://learn.microsoft.com/en-us/windows/win32/cimwin32prov/win32-process)
+- [Node 24 ChildProcess events](https://nodejs.org/docs/latest-v24.x/api/child_process.html)

package/node_modules/@llblab/pi-actors/index.ts

@@ -16,7 +16,7 @@ export default function toolRegistryExtension(pi: Pi.ExtensionAPI) {
       runtime.discoverResources(import.meta.url),
     );
   }
-  pi.on("session_start", async (_event, ctx) => runtime.onSessionStart(ctx));
+  pi.on("session_start", async (event, ctx) => runtime.onSessionStart(ctx, event));
   pi.on("turn_end", (event, ctx) => runtime.onTurnEnd(event, ctx));
   pi.on("agent_settled", async (_event, ctx) => runtime.onAgentSettled(ctx));
   pi.on("context", async (event, ctx) => ({