@modelprofile.com/browser-runtime 3.1.1 → 4.0.0

package/ts/classes.runtimeownership.ts

@@ -0,0 +1,1393 @@
+import * as plugins from './plugins.js';
+import { BrowserRuntimeError } from './errors.js';
+import { randomId } from './utils.js';
+
+const metadataSchema = 1;
+const maximumMetadataBytes = 4096;
+const maximumProcFileBytes = 2 * 1024 * 1024;
+const anchorInitializationAttempts = 200;
+const generationIdPattern = /^[A-Za-z0-9_-]{32}$/u;
+const hashPattern = /^[a-f0-9]{64}$/u;
+const bootIdPattern = /^[a-f0-9]{8}-[a-f0-9]{4}-[1-5][a-f0-9]{3}-[89ab][a-f0-9]{3}-[a-f0-9]{12}$/u;
+const unsignedIntegerPattern = /^(?:0|[1-9][0-9]{0,24})$/u;
+
+type TOwnershipState = 'active' | 'relinquished';
+export type TOwnershipGenerationRemovalReason = 'stale' | 'startup-failure' | 'stop';
+
+interface IRuntimeDirectoryIdentity {
+  uid: number;
+  device: string;
+  inode: string;
+  hash: string;
+}
+
+interface IOwnerMetadata {
+  schema: typeof metadataSchema;
+  state: TOwnershipState;
+  uid: number;
+  runtimeDirectoryDevice: string;
+  runtimeDirectoryInode: string;
+  runtimeDirectoryHash: string;
+  bootId: string;
+  pid: number;
+  processStartTicks: string;
+  generationId: string;
+  nonce: string;
+}
+
+export interface IBrowserRuntimeOwnershipTestingOptions {
+  procRoot?: string;
+  now?(): number;
+  beforeMetadataPublication?(): Promise<void>;
+  beforeGenerationRemoval?(reason: TOwnershipGenerationRemovalReason): Promise<void>;
+}
+
+export interface IBrowserRuntimeOwnershipOptions {
+  runtimeDirectory: string;
+  uid: number;
+  testing?: IBrowserRuntimeOwnershipTestingOptions;
+  onOwnershipLost?(): void;
+}
+
+export interface IBrowserRuntimeGeneration {
+  generationId: string;
+  generationDirectory: string;
+  profileRoot: string;
+  artifactRoot: string;
+}
+
+type TInspectionResult = 'clear' | 'held' | 'indeterminate';
+type TProcessUidState = 'same' | 'other' | 'missing' | 'indeterminate';
+
+const isMissingError = (errorArg: unknown): boolean => (
+  (errorArg as NodeJS.ErrnoException).code === 'ENOENT'
+  || (errorArg as NodeJS.ErrnoException).code === 'ESRCH'
+);
+
+const normalizeOwnershipError = (errorArg: unknown): BrowserRuntimeError => (
+  errorArg instanceof BrowserRuntimeError
+    ? errorArg
+    : new BrowserRuntimeError('FENCED', 'runtime ownership could not be verified')
+);
+
+const statIdentityMatches = (
+  leftArg: plugins.fs.BigIntStats,
+  rightArg: plugins.fs.BigIntStats,
+): boolean => leftArg.dev === rightArg.dev && leftArg.ino === rightArg.ino;
+
+const parseProcessStartTicks = (statTextArg: string, expectedPidArg?: number): string => {
+  if (
+    plugins.Buffer.byteLength(statTextArg, 'utf8') === 0
+    || plugins.Buffer.byteLength(statTextArg, 'utf8') > 16 * 1024
+    || /[\u0000\r]/u.test(statTextArg)
+  ) throw new BrowserRuntimeError('FENCED', 'process identity is malformed');
+  const statText = statTextArg.endsWith('\n') ? statTextArg.slice(0, -1) : statTextArg;
+  if (statText.includes('\n')) {
+    throw new BrowserRuntimeError('FENCED', 'process identity is malformed');
+  }
+  const commandStart = statText.indexOf(' (');
+  const commandEnd = statText.lastIndexOf(') ');
+  if (commandStart <= 0 || commandEnd < commandStart + 2) {
+    throw new BrowserRuntimeError('FENCED', 'process identity is malformed');
+  }
+  const pidText = statText.slice(0, commandStart);
+  const fieldsAfterCommand = statText.slice(commandEnd + 2).split(' ');
+  const processStartTicks = fieldsAfterCommand[19];
+  if (
+    !/^[1-9][0-9]{0,9}$/u.test(pidText)
+    || fieldsAfterCommand.length < 20
+    || !processStartTicks
+    || !unsignedIntegerPattern.test(processStartTicks)
+  ) throw new BrowserRuntimeError('FENCED', 'process identity is malformed');
+  if (expectedPidArg !== undefined && Number(pidText) !== expectedPidArg) {
+    throw new BrowserRuntimeError('FENCED', 'process identity is malformed');
+  }
+  return processStartTicks;
+};
+
+export class BrowserRuntimeOwnership {
+  public readonly runtimeDirectory: string;
+  public readonly lockPath: string;
+  public readonly anchorDirectory: string;
+  private readonly generationsRoot: string;
+  private readonly legacyProfileRoot: string;
+  private readonly legacyArtifactRoot: string;
+  private readonly uid: number;
+  private readonly procRoot: string;
+  private readonly now: () => number;
+  private readonly beforeMetadataPublication?: () => Promise<void>;
+  private readonly beforeGenerationRemoval?: (
+    reason: TOwnershipGenerationRemovalReason,
+  ) => Promise<void>;
+  private readonly onOwnershipLost?: () => void;
+  private directoryHandle?: plugins.fsPromises.FileHandle;
+  private directoryIdentity?: IRuntimeDirectoryIdentity;
+  private anchorDirectoryHandle?: plugins.fsPromises.FileHandle;
+  private anchorDirectoryIdentity?: plugins.fs.BigIntStats;
+  private anchorIdentity?: plugins.fs.BigIntStats;
+  private namedMutex?: plugins.smartipc.NamedMutex;
+  private namedMutexLease?: plugins.smartipc.NamedMutexLease;
+  private lockHandle?: plugins.fsPromises.FileHandle;
+  private lockIdentity?: plugins.fs.BigIntStats;
+  private createdLock = false;
+  private leaseLost = false;
+  private metadata?: IOwnerMetadata;
+  private generation?: IBrowserRuntimeGeneration;
+  private acquirePromise?: Promise<IBrowserRuntimeGeneration>;
+  private releasePromise?: Promise<void>;
+
+  constructor(optionsArg: IBrowserRuntimeOwnershipOptions) {
+    this.runtimeDirectory = plugins.path.resolve(optionsArg.runtimeDirectory);
+    this.lockPath = plugins.path.join(this.runtimeDirectory, 'runtime.lock');
+    this.anchorDirectory = plugins.path.join(this.runtimeDirectory, 'runtime.mutex');
+    this.generationsRoot = plugins.path.join(this.runtimeDirectory, 'generations');
+    this.legacyProfileRoot = plugins.path.join(this.runtimeDirectory, 'profiles');
+    this.legacyArtifactRoot = plugins.path.join(this.runtimeDirectory, 'artifacts');
+    this.uid = optionsArg.uid;
+    this.procRoot = optionsArg.testing?.procRoot ?? '/proc';
+    this.now = optionsArg.testing?.now ?? Date.now;
+    this.beforeMetadataPublication = optionsArg.testing?.beforeMetadataPublication;
+    this.beforeGenerationRemoval = optionsArg.testing?.beforeGenerationRemoval;
+    this.onOwnershipLost = optionsArg.onOwnershipLost;
+  }
+
+  public get owned(): boolean {
+    return Boolean(
+      this.metadata?.state === 'active'
+      && this.generation
+      && this.namedMutexLease?.state === 'active'
+      && !this.leaseLost,
+    );
+  }
+
+  public get cleanupPending(): boolean {
+    return Boolean(
+      this.lockHandle
+      || this.anchorDirectoryHandle
+      || this.directoryHandle
+      || (this.namedMutexLease && this.namedMutexLease.state !== 'released'),
+    );
+  }
+
+  public acquire(): Promise<IBrowserRuntimeGeneration> {
+    if (this.owned) return Promise.resolve({ ...this.generation! });
+    if (this.acquirePromise) return this.acquirePromise;
+    if (this.releasePromise) return this.releasePromise.then(() => this.acquire());
+    const operation = this.acquireInternal().finally(() => {
+      if (this.acquirePromise === operation) this.acquirePromise = undefined;
+    });
+    this.acquirePromise = operation;
+    return operation;
+  }
+
+  public release(
+    reasonArg: Exclude<TOwnershipGenerationRemovalReason, 'stale'> = 'stop',
+  ): Promise<void> {
+    if (this.releasePromise) return this.releasePromise;
+    if (
+      !this.namedMutexLease
+      && !this.lockHandle
+      && !this.anchorDirectoryHandle
+      && !this.directoryHandle
+    ) return Promise.resolve();
+    const operation = this.releaseInternal(reasonArg).catch((error) => {
+      throw normalizeOwnershipError(error);
+    }).finally(() => {
+      if (this.releasePromise === operation) this.releasePromise = undefined;
+    });
+    this.releasePromise = operation;
+    return operation;
+  }
+
+  /** @internal */
+  public async assertCurrentOwnership(): Promise<void> {
+    if (!this.owned) throw new BrowserRuntimeError('FENCED', 'runtime ownership is unavailable');
+    await this.assertRuntimeDirectoryCurrent();
+    await this.assertNativeAnchorCurrent();
+    await this.assertLockPathCurrent();
+  }
+
+  private async acquireInternal(): Promise<IBrowserRuntimeGeneration> {
+    try {
+      await this.openAndValidateRuntimeDirectory();
+      await this.openAndValidateAnchorDirectory();
+      await this.acquireNativeLease();
+      const lockKind = await this.openAndClassifyLock();
+      if (lockKind.kind === 'new') {
+        await this.adoptCreatedLockLayout();
+      } else if (lockKind.kind === 'legacy') {
+        await this.adoptLegacyLock();
+      } else {
+        await this.reclaimMetadataGeneration(lockKind.metadata);
+      }
+      const generation = await this.publishGeneration();
+      return { ...generation };
+    } catch (error) {
+      const normalized = normalizeOwnershipError(error);
+      if (this.metadata?.state === 'active' && this.generation) {
+        try {
+          await this.release('startup-failure');
+        } catch {
+          throw new BrowserRuntimeError('FENCED', 'runtime startup cleanup is incomplete');
+        }
+      } else {
+        if (this.createdLock) {
+          let cleanupError: unknown;
+          try {
+            await this.unlinkCreatedLock();
+          } catch (error) {
+            cleanupError = error;
+          }
+          if (cleanupError && this.createdLock) {
+            throw new BrowserRuntimeError('FENCED', 'runtime startup cleanup is incomplete');
+          }
+          if (cleanupError) {
+            await this.closePassiveHandles().catch(() => {
+              throw new BrowserRuntimeError('FENCED', 'runtime startup cleanup is incomplete');
+            });
+            throw new BrowserRuntimeError('FENCED', 'runtime startup cleanup is incomplete');
+          }
+        }
+        await this.closePassiveHandles();
+      }
+      throw normalized;
+    }
+  }
+
+  private async openAndValidateRuntimeDirectory(): Promise<void> {
+    const createdPath = await plugins.fsPromises.mkdir(this.runtimeDirectory, {
+      recursive: true,
+      mode: 0o700,
+    });
+    let pathStat = await plugins.fsPromises.lstat(this.runtimeDirectory, { bigint: true });
+    if (
+      !pathStat.isDirectory()
+      || pathStat.isSymbolicLink()
+      || pathStat.uid !== BigInt(this.uid)
+    ) throw new BrowserRuntimeError('FENCED', 'runtime directory is not private');
+    if (createdPath !== undefined) {
+      await plugins.fsPromises.chmod(this.runtimeDirectory, 0o700);
+      pathStat = await plugins.fsPromises.lstat(this.runtimeDirectory, { bigint: true });
+    }
+    if ((pathStat.mode & 0o777n) !== 0o700n) {
+      throw new BrowserRuntimeError('FENCED', 'runtime directory is not private');
+    }
+    const realPath = await plugins.fsPromises.realpath(this.runtimeDirectory);
+    if (realPath !== this.runtimeDirectory) {
+      throw new BrowserRuntimeError('FENCED', 'runtime directory path is not canonical');
+    }
+    const handle = await plugins.fsPromises.open(
+      this.runtimeDirectory,
+      plugins.fs.constants.O_RDONLY
+        | plugins.fs.constants.O_DIRECTORY
+        | plugins.fs.constants.O_NOFOLLOW,
+    );
+    this.directoryHandle = handle;
+    let handleStat = await handle.stat({ bigint: true });
+    if (createdPath !== undefined) {
+      await handle.chmod(0o700);
+      await plugins.fsPromises.chmod(this.runtimeDirectory, 0o700);
+      [pathStat, handleStat] = await Promise.all([
+        plugins.fsPromises.lstat(this.runtimeDirectory, { bigint: true }),
+        handle.stat({ bigint: true }),
+      ]);
+    }
+    if (
+      !handleStat.isDirectory()
+      || handleStat.uid !== BigInt(this.uid)
+      || (handleStat.mode & 0o777n) !== 0o700n
+      || !statIdentityMatches(pathStat, handleStat)
+    ) {
+      throw new BrowserRuntimeError('FENCED', 'runtime directory identity changed');
+    }
+    const pathHash = plugins.crypto.createHash('sha256')
+      .update(this.runtimeDirectory, 'utf8')
+      .digest('hex');
+    const device = String(handleStat.dev);
+    const inode = String(handleStat.ino);
+    const hash = plugins.crypto.createHash('sha256')
+      .update(`${this.uid}\0${device}\0${inode}\0${pathHash}`, 'utf8')
+      .digest('hex');
+    this.directoryIdentity = { uid: this.uid, device, inode, hash };
+  }
+
+  private async openAndValidateAnchorDirectory(): Promise<void> {
+    await this.ensurePrivateDirectory(this.anchorDirectory, this.runtimeDirectory);
+    const handle = await plugins.fsPromises.open(
+      this.anchorDirectory,
+      plugins.fs.constants.O_RDONLY
+        | plugins.fs.constants.O_DIRECTORY
+        | plugins.fs.constants.O_NOFOLLOW,
+    );
+    try {
+      const [pathStat, handleStat] = await Promise.all([
+        plugins.fsPromises.lstat(this.anchorDirectory, { bigint: true }),
+        handle.stat({ bigint: true }),
+      ]);
+      if (
+        !pathStat.isDirectory()
+        || pathStat.isSymbolicLink()
+        || pathStat.uid !== BigInt(this.uid)
+        || (pathStat.mode & 0o777n) !== 0o700n
+        || !statIdentityMatches(pathStat, handleStat)
+        || String(handleStat.dev) !== this.directoryIdentity!.device
+      ) throw new BrowserRuntimeError('FENCED', 'runtime mutex anchor directory is unsafe');
+      this.anchorDirectoryHandle = handle;
+      this.anchorDirectoryIdentity = handleStat;
+    } catch (error) {
+      await handle.close().catch(() => undefined);
+      throw error;
+    }
+  }
+
+  private async acquireNativeLease(): Promise<void> {
+    const identity = this.directoryIdentity!;
+    let mutex: plugins.smartipc.NamedMutex;
+    try {
+      mutex = new plugins.smartipc.NamedMutex(
+        `@modelprofile.com/browser-runtime:v1:${identity.uid}:${identity.device}:${identity.inode}:${identity.hash}`,
+        { directoryPath: this.anchorDirectory },
+      );
+    } catch {
+      throw new BrowserRuntimeError('FENCED', 'runtime native ownership backend is unavailable');
+    }
+    await this.ensurePermanentAnchor(mutex.anchorPath);
+    let lease: plugins.smartipc.NamedMutexLease | undefined;
+    try {
+      lease = await mutex.tryAcquire();
+    } catch {
+      throw new BrowserRuntimeError('FENCED', 'runtime native ownership could not be verified');
+    }
+    if (!lease) throw new BrowserRuntimeError('LOCKED');
+    this.namedMutex = mutex;
+    this.namedMutexLease = lease;
+    this.leaseLost = false;
+    this.anchorIdentity = await plugins.fsPromises.lstat(mutex.anchorPath, { bigint: true });
+    await this.assertNativeAnchorCurrent();
+  }
+
+  private async ensurePermanentAnchor(anchorPathArg: string): Promise<void> {
+    if (
+      !this.pathIsWithin(this.anchorDirectory, anchorPathArg)
+      || plugins.path.dirname(anchorPathArg) !== this.anchorDirectory
+    ) throw new BrowserRuntimeError('FENCED', 'runtime mutex anchor escaped containment');
+    const anchorName = plugins.path.basename(anchorPathArg);
+    const entries = await plugins.fsPromises.readdir(this.anchorDirectory, { withFileTypes: true });
+    if (entries.some((entry) => entry.name !== anchorName)) {
+      throw new BrowserRuntimeError('FENCED', 'runtime mutex anchor directory is ambiguous');
+    }
+
+    let handle: plugins.fsPromises.FileHandle;
+    try {
+      handle = await plugins.fsPromises.open(
+        anchorPathArg,
+        plugins.fs.constants.O_RDWR
+          | plugins.fs.constants.O_CREAT
+          | plugins.fs.constants.O_EXCL
+          | plugins.fs.constants.O_NOFOLLOW,
+        0o600,
+      );
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code !== 'EEXIST') throw error;
+      for (let attempt = 0; attempt < anchorInitializationAttempts; attempt += 1) {
+        const stat = await plugins.fsPromises.lstat(anchorPathArg, { bigint: true });
+        if (
+          stat.isFile()
+          && !stat.isSymbolicLink()
+          && stat.uid === BigInt(this.uid)
+          && stat.nlink === 1n
+          && stat.size === 0n
+          && String(stat.dev) === this.directoryIdentity!.device
+        ) {
+          const mode = stat.mode & 0o777n;
+          if (mode === 0o600n) return;
+          if ((mode & 0o177n) !== 0n) {
+            throw new BrowserRuntimeError('FENCED', 'runtime mutex anchor is unsafe');
+          }
+          await new Promise<void>((resolve) => setTimeout(resolve, 10));
+          continue;
+        }
+        throw new BrowserRuntimeError('FENCED', 'runtime mutex anchor is unsafe');
+      }
+      throw new BrowserRuntimeError('FENCED', 'runtime mutex anchor initialization is incomplete');
+    }
+
+    try {
+      await handle.chmod(0o600);
+      await plugins.fsPromises.chmod(anchorPathArg, 0o600);
+      const [pathStat, handleStat] = await Promise.all([
+        plugins.fsPromises.lstat(anchorPathArg, { bigint: true }),
+        handle.stat({ bigint: true }),
+      ]);
+      this.assertPrivateAnchorStat(pathStat);
+      this.assertPrivateAnchorStat(handleStat);
+      if (!statIdentityMatches(pathStat, handleStat)) {
+        throw new BrowserRuntimeError('FENCED', 'runtime mutex anchor identity changed');
+      }
+      await handle.sync();
+      await this.anchorDirectoryHandle!.sync();
+    } finally {
+      await handle.close();
+    }
+  }
+
+  private assertPrivateAnchorStat(statArg: plugins.fs.BigIntStats): void {
+    if (
+      !statArg.isFile()
+      || statArg.isSymbolicLink()
+      || statArg.uid !== BigInt(this.uid)
+      || (statArg.mode & 0o777n) !== 0o600n
+      || statArg.nlink !== 1n
+      || statArg.size !== 0n
+      || String(statArg.dev) !== this.directoryIdentity!.device
+    ) throw new BrowserRuntimeError('FENCED', 'runtime mutex anchor is unsafe');
+  }
+
+  private async assertNativeAnchorCurrent(): Promise<void> {
+    if (
+      !this.namedMutex
+      || !this.namedMutexLease
+      || this.namedMutexLease.state !== 'active'
+      || !this.anchorIdentity
+      || !this.anchorDirectoryHandle
+      || !this.anchorDirectoryIdentity
+      || this.leaseLost
+    ) throw new BrowserRuntimeError('FENCED', 'runtime native ownership is unavailable');
+    const [directoryPathStat, directoryHandleStat, anchorStat] = await Promise.all([
+      plugins.fsPromises.lstat(this.anchorDirectory, { bigint: true }),
+      this.anchorDirectoryHandle.stat({ bigint: true }),
+      plugins.fsPromises.lstat(this.namedMutex.anchorPath, { bigint: true }),
+    ]);
+    if (
+      !directoryPathStat.isDirectory()
+      || directoryPathStat.isSymbolicLink()
+      || directoryPathStat.uid !== BigInt(this.uid)
+      || (directoryPathStat.mode & 0o777n) !== 0o700n
+      || !statIdentityMatches(this.anchorDirectoryIdentity, directoryPathStat)
+      || !statIdentityMatches(this.anchorDirectoryIdentity, directoryHandleStat)
+      || String(directoryHandleStat.dev) !== this.directoryIdentity!.device
+    ) throw new BrowserRuntimeError('FENCED', 'runtime mutex anchor directory identity changed');
+    this.assertPrivateAnchorStat(anchorStat);
+    if (!statIdentityMatches(this.anchorIdentity, anchorStat)) {
+      throw new BrowserRuntimeError('FENCED', 'runtime mutex anchor identity changed');
+    }
+  }
+
+  /** @internal */
+  public async forceOwnershipLossForTesting(): Promise<void> {
+    if (!this.namedMutexLease || this.leaseLost) return;
+    let releaseError: unknown;
+    try {
+      await this.namedMutexLease.release();
+    } catch (error) {
+      releaseError = error;
+    }
+    this.leaseLost = true;
+    this.onOwnershipLost?.();
+    if (releaseError) {
+      throw new BrowserRuntimeError('FENCED', 'runtime native ownership release is uncertain');
+    }
+  }
+
+  private async openAndClassifyLock(): Promise<
+    | { kind: 'new' }
+    | { kind: 'legacy' }
+    | { kind: 'metadata'; metadata: IOwnerMetadata }
+  > {
+    let handle: plugins.fsPromises.FileHandle;
+    try {
+      handle = await plugins.fsPromises.open(
+        this.lockPath,
+        plugins.fs.constants.O_RDWR
+          | plugins.fs.constants.O_CREAT
+          | plugins.fs.constants.O_EXCL
+          | plugins.fs.constants.O_NOFOLLOW,
+        0o600,
+      );
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code !== 'EEXIST') throw error;
+      const pathStat = await this.readPrivateLockPathStat();
+      handle = await plugins.fsPromises.open(
+        this.lockPath,
+        plugins.fs.constants.O_RDWR | plugins.fs.constants.O_NOFOLLOW,
+      );
+      let handleStat: plugins.fs.BigIntStats;
+      try {
+        handleStat = await this.validateLockHandle(handle);
+      } catch (validationError) {
+        await handle.close().catch(() => undefined);
+        throw validationError;
+      }
+      if (!statIdentityMatches(pathStat, handleStat)) {
+        await handle.close();
+        throw new BrowserRuntimeError('FENCED', 'runtime lock identity changed');
+      }
+      this.lockHandle = handle;
+      this.lockIdentity = handleStat;
+      await this.assertLockPathCurrent();
+      if (handleStat.size === 0n) return { kind: 'legacy' };
+      return { kind: 'metadata', metadata: await this.readMetadata() };
+    }
+
+    this.lockHandle = handle;
+    this.createdLock = true;
+    await handle.chmod(0o600);
+    const initialHandleStat = await handle.stat({ bigint: true });
+    const initialPathStat = await plugins.fsPromises.lstat(this.lockPath, { bigint: true });
+    if (
+      !initialHandleStat.isFile()
+      || !initialPathStat.isFile()
+      || initialPathStat.isSymbolicLink()
+      || !statIdentityMatches(initialHandleStat, initialPathStat)
+      || initialHandleStat.uid !== BigInt(this.uid)
+      || initialHandleStat.nlink !== 1n
+      || initialHandleStat.size !== 0n
+    ) throw new BrowserRuntimeError('FENCED', 'runtime lock is unsafe');
+    this.lockIdentity = initialHandleStat;
+    await plugins.fsPromises.chmod(this.lockPath, 0o600);
+    await handle.chmod(0o600);
+    this.lockIdentity = await this.validateLockHandle(handle);
+    await this.assertLockPathCurrent();
+    await this.directoryHandle!.sync();
+    return { kind: 'new' };
+  }
+
+  private async readPrivateLockPathStat(): Promise<plugins.fs.BigIntStats> {
+    let stat: plugins.fs.BigIntStats;
+    try {
+      stat = await plugins.fsPromises.lstat(this.lockPath, { bigint: true });
+    } catch (error) {
+      if (isMissingError(error)) {
+        throw new BrowserRuntimeError('FENCED', 'runtime lock identity changed');
+      }
+      throw error;
+    }
+    this.assertPrivateLockStat(stat);
+    return stat;
+  }
+
+  private async validateLockHandle(
+    handleArg: plugins.fsPromises.FileHandle,
+  ): Promise<plugins.fs.BigIntStats> {
+    const stat = await handleArg.stat({ bigint: true });
+    this.assertPrivateLockStat(stat);
+    return stat;
+  }
+
+  private assertPrivateLockStat(statArg: plugins.fs.BigIntStats): void {
+    if (
+      !statArg.isFile()
+      || statArg.isSymbolicLink()
+      || statArg.uid !== BigInt(this.uid)
+      || (statArg.mode & 0o777n) !== 0o600n
+      || statArg.nlink !== 1n
+      || statArg.size > BigInt(maximumMetadataBytes)
+    ) throw new BrowserRuntimeError('FENCED', 'runtime lock is unsafe');
+  }
+
+  private async assertLockPathCurrent(): Promise<void> {
+    if (!this.lockHandle || !this.lockIdentity) {
+      throw new BrowserRuntimeError('FENCED', 'runtime lock is unavailable');
+    }
+    const [pathStat, handleStat] = await Promise.all([
+      this.readPrivateLockPathStat(),
+      this.validateLockHandle(this.lockHandle),
+    ]);
+    if (
+      !statIdentityMatches(this.lockIdentity, pathStat)
+      || !statIdentityMatches(this.lockIdentity, handleStat)
+    ) throw new BrowserRuntimeError('FENCED', 'runtime lock identity changed');
+  }
+
+  private async adoptCreatedLockLayout(): Promise<void> {
+    await this.assertRuntimeEntries(new Set([
+      'runtime.lock',
+      'runtime.mutex',
+      'profiles',
+      'artifacts',
+    ]));
+    await this.validateOptionalPrivateDirectory(this.legacyProfileRoot);
+    await this.validateOptionalPrivateDirectory(this.legacyArtifactRoot);
+    const [profileInspection, profileEntries, artifactEntries] = await Promise.all([
+      this.inspectProfileProcesses([this.legacyProfileRoot]),
+      this.readOptionalDirectoryEntries(this.legacyProfileRoot),
+      this.readOptionalDirectoryEntries(this.legacyArtifactRoot),
+    ]);
+    if (profileInspection === 'held') throw new BrowserRuntimeError('LOCKED');
+    if (profileInspection === 'indeterminate') {
+      throw new BrowserRuntimeError('FENCED', 'legacy runtime process ownership is indeterminate');
+    }
+    if (profileEntries.length > 0 || artifactEntries.length > 0) {
+      throw new BrowserRuntimeError('FENCED', 'legacy runtime roots are not empty');
+    }
+    await this.assertLockPathCurrent();
+    await this.assertNativeAnchorCurrent();
+    await this.assertRuntimeDirectoryCurrent();
+    const [currentProfileEntries, currentArtifactEntries] = await Promise.all([
+      this.readOptionalDirectoryEntries(this.legacyProfileRoot),
+      this.readOptionalDirectoryEntries(this.legacyArtifactRoot),
+    ]);
+    if (currentProfileEntries.length > 0 || currentArtifactEntries.length > 0) {
+      throw new BrowserRuntimeError('FENCED', 'legacy runtime roots changed');
+    }
+    await this.removePrivateDirectory(this.legacyProfileRoot);
+    await this.removePrivateDirectory(this.legacyArtifactRoot);
+    await this.directoryHandle!.sync();
+  }
+
+  private async unlinkCreatedLock(): Promise<void> {
+    if (!this.createdLock) return;
+    if (!this.lockHandle) {
+      throw new BrowserRuntimeError('FENCED', 'created runtime lock is unavailable');
+    }
+    await this.assertNativeAnchorCurrent();
+    await this.assertRuntimeDirectoryCurrent();
+    const [pathStat, handleStat] = await Promise.all([
+      plugins.fsPromises.lstat(this.lockPath, { bigint: true }),
+      this.lockHandle.stat({ bigint: true }),
+    ]);
+    if (
+      !pathStat.isFile()
+      || pathStat.isSymbolicLink()
+      || !handleStat.isFile()
+      || pathStat.uid !== BigInt(this.uid)
+      || handleStat.uid !== BigInt(this.uid)
+      || pathStat.nlink !== 1n
+      || handleStat.nlink !== 1n
+      || String(pathStat.dev) !== this.directoryIdentity!.device
+      || !statIdentityMatches(pathStat, handleStat)
+      || (this.lockIdentity && !statIdentityMatches(this.lockIdentity, handleStat))
+    ) throw new BrowserRuntimeError('FENCED', 'created runtime lock identity changed');
+    await plugins.fsPromises.unlink(this.lockPath);
+    this.createdLock = false;
+    await this.directoryHandle!.sync();
+  }
+
+  private async adoptLegacyLock(): Promise<void> {
+    await this.assertRuntimeEntries(new Set([
+      'runtime.lock',
+      'runtime.mutex',
+      'profiles',
+      'artifacts',
+    ]));
+    await this.validateOptionalPrivateDirectory(this.legacyProfileRoot);
+    await this.validateOptionalPrivateDirectory(this.legacyArtifactRoot);
+    const [descriptorInspection, profileInspection, predatesBoot] = await Promise.all([
+      this.inspectLegacyLockDescriptors(),
+      this.inspectProfileProcesses([this.legacyProfileRoot]),
+      this.legacyLockPredatesCurrentBoot(),
+    ]);
+    if (descriptorInspection === 'held' || profileInspection === 'held') {
+      throw new BrowserRuntimeError('LOCKED');
+    }
+    if (descriptorInspection === 'indeterminate' || profileInspection === 'indeterminate') {
+      throw new BrowserRuntimeError('FENCED', 'legacy runtime ownership is indeterminate');
+    }
+    if (!predatesBoot) {
+      throw new BrowserRuntimeError('FENCED', 'same-boot legacy runtime ownership is unsafe');
+    }
+    await this.assertLockPathCurrent();
+    if (!await this.legacyLockPredatesCurrentBoot()) {
+      throw new BrowserRuntimeError('FENCED', 'legacy runtime lock timestamp changed');
+    }
+    await this.assertNativeAnchorCurrent();
+    await this.assertRuntimeDirectoryCurrent();
+    await this.removePrivateDirectory(this.legacyProfileRoot);
+    await this.removePrivateDirectory(this.legacyArtifactRoot);
+    await this.directoryHandle!.sync();
+  }
+
+  private async legacyLockPredatesCurrentBoot(): Promise<boolean> {
+    const bootTimeNs = await this.readBootTimeNs();
+    const [pathStat, handleStat] = await Promise.all([
+      this.readPrivateLockPathStat(),
+      this.validateLockHandle(this.lockHandle!),
+    ]);
+    if (
+      !statIdentityMatches(this.lockIdentity!, pathStat)
+      || !statIdentityMatches(this.lockIdentity!, handleStat)
+    ) throw new BrowserRuntimeError('FENCED', 'legacy runtime lock identity changed');
+    const pathTimestamps = [pathStat.birthtimeNs, pathStat.ctimeNs, pathStat.mtimeNs];
+    const handleTimestamps = [handleStat.birthtimeNs, handleStat.ctimeNs, handleStat.mtimeNs];
+    if (pathTimestamps.some((timestamp, index) => (
+      timestamp <= 0n || timestamp !== handleTimestamps[index]
+    ))) throw new BrowserRuntimeError('FENCED', 'legacy runtime lock timestamps are ambiguous');
+    return pathTimestamps.every((timestamp) => timestamp < bootTimeNs);
+  }
+
+  private async readBootTimeNs(): Promise<bigint> {
+    const procStat = await this.readBoundedFile(
+      plugins.path.join(this.procRoot, 'stat'),
+      maximumProcFileBytes,
+    );
+    if (/\u0000|\r/u.test(procStat)) {
+      throw new BrowserRuntimeError('FENCED', 'boot timestamp is malformed');
+    }
+    const bootTimeLines = procStat.split('\n').filter((line) => line.startsWith('btime'));
+    if (bootTimeLines.length !== 1) {
+      throw new BrowserRuntimeError('FENCED', 'boot timestamp is malformed');
+    }
+    const match = /^btime ([1-9][0-9]{0,19})$/u.exec(bootTimeLines[0]!);
+    if (!match) throw new BrowserRuntimeError('FENCED', 'boot timestamp is malformed');
+    const bootTimeNs = BigInt(match[1]!) * 1_000_000_000n;
+    const now = this.now();
+    if (!Number.isSafeInteger(now) || now < 0) {
+      throw new BrowserRuntimeError('FENCED', 'current timestamp is unavailable');
+    }
+    const nowNs = BigInt(now) * 1_000_000n;
+    if (bootTimeNs > nowNs) {
+      throw new BrowserRuntimeError('FENCED', 'boot timestamp is in the future');
+    }
+    return bootTimeNs;
+  }
+
+  private async reclaimMetadataGeneration(metadataArg: IOwnerMetadata): Promise<void> {
+    this.assertMetadataDirectoryIdentity(metadataArg);
+    await this.assertRuntimeEntries(new Set([
+      'runtime.lock',
+      'runtime.mutex',
+      'generations',
+    ]));
+    await this.validateOptionalPrivateDirectory(this.generationsRoot);
+    const generationDirectory = this.generationPath(metadataArg.generationId);
+    const entries = await this.readOptionalDirectoryEntries(this.generationsRoot);
+    if (entries.some((entry) => entry.name !== metadataArg.generationId)) {
+      throw new BrowserRuntimeError('FENCED', 'runtime generation ownership is ambiguous');
+    }
+    await this.validateOptionalGeneration(generationDirectory);
+    const profileInspection = await this.inspectProfileProcesses([
+      plugins.path.join(generationDirectory, 'profiles'),
+    ]);
+    if (profileInspection === 'held') throw new BrowserRuntimeError('LOCKED');
+    if (profileInspection === 'indeterminate') {
+      throw new BrowserRuntimeError('FENCED', 'runtime process ownership is indeterminate');
+    }
+    await this.assertLockPathCurrent();
+    await this.assertNativeAnchorCurrent();
+    await this.assertRuntimeDirectoryCurrent();
+    await this.beforeGenerationRemoval?.('stale');
+    await this.assertLockPathCurrent();
+    await this.assertNativeAnchorCurrent();
+    await this.assertRuntimeDirectoryCurrent();
+    await this.removePrivateDirectory(generationDirectory);
+    await this.syncOptionalDirectory(this.generationsRoot);
+  }
+
+  private async publishGeneration(): Promise<IBrowserRuntimeGeneration> {
+    const identity = this.directoryIdentity!;
+    const generationId = randomId(24);
+    const metadata: IOwnerMetadata = {
+      schema: metadataSchema,
+      state: 'active',
+      uid: this.uid,
+      runtimeDirectoryDevice: identity.device,
+      runtimeDirectoryInode: identity.inode,
+      runtimeDirectoryHash: identity.hash,
+      bootId: await this.readBootId(),
+      pid: process.pid,
+      processStartTicks: parseProcessStartTicks(
+        await this.readBoundedFile(plugins.path.join(this.procRoot, 'self', 'stat'), 16 * 1024),
+        process.pid,
+      ),
+      generationId,
+      nonce: randomId(24),
+    };
+    const generationDirectory = this.generationPath(generationId);
+    const generation: IBrowserRuntimeGeneration = {
+      generationId,
+      generationDirectory,
+      profileRoot: plugins.path.join(generationDirectory, 'profiles'),
+      artifactRoot: plugins.path.join(generationDirectory, 'artifacts'),
+    };
+    await this.beforeMetadataPublication?.();
+    await this.writeMetadata(metadata);
+    this.metadata = metadata;
+    this.generation = generation;
+    await this.ensurePrivateDirectory(this.generationsRoot, this.runtimeDirectory);
+    const entries = await this.readOptionalDirectoryEntries(this.generationsRoot);
+    if (entries.length > 0) {
+      throw new BrowserRuntimeError('FENCED', 'runtime generation root is not empty');
+    }
+    await this.ensurePrivateDirectory(generationDirectory, this.generationsRoot);
+    await this.syncOptionalDirectory(this.generationsRoot);
+    return generation;
+  }
+
+  private async releaseInternal(
+    reasonArg: Exclude<TOwnershipGenerationRemovalReason, 'stale'>,
+  ): Promise<void> {
+    if (this.leaseLost) {
+      await this.closePassiveHandles().catch(() => undefined);
+      throw new BrowserRuntimeError('FENCED', 'runtime ownership was lost');
+    }
+    if (this.createdLock) {
+      await this.unlinkCreatedLock();
+      await this.closeOwnershipHandles();
+      this.metadata = undefined;
+      this.generation = undefined;
+      return;
+    }
+    const metadata = this.metadata;
+    const generation = this.generation;
+    if (metadata?.state === 'active' && generation) {
+      await this.assertLockPathCurrent();
+      await this.assertNativeAnchorCurrent();
+      await this.validateOptionalGeneration(generation.generationDirectory);
+      await this.assertLockPathCurrent();
+      await this.assertNativeAnchorCurrent();
+      await this.assertRuntimeDirectoryCurrent();
+      await this.beforeGenerationRemoval?.(reasonArg);
+      await this.assertLockPathCurrent();
+      await this.assertNativeAnchorCurrent();
+      await this.assertRuntimeDirectoryCurrent();
+      await this.removePrivateDirectory(generation.generationDirectory);
+      await this.syncOptionalDirectory(this.generationsRoot);
+      const relinquished: IOwnerMetadata = { ...metadata, state: 'relinquished' };
+      await this.writeMetadata(relinquished);
+      this.metadata = relinquished;
+    }
+    await this.closeOwnershipHandles();
+    this.metadata = undefined;
+    this.generation = undefined;
+  }
+
+  private async closePassiveHandles(): Promise<void> {
+    try {
+      await this.closeOwnershipHandles();
+    } finally {
+      this.metadata = undefined;
+      this.generation = undefined;
+    }
+  }
+
+  private async closeOwnershipHandles(): Promise<void> {
+    const errors: unknown[] = [];
+    if (this.lockHandle) {
+      await this.lockHandle.close().then(
+        () => {
+          this.lockHandle = undefined;
+          this.lockIdentity = undefined;
+        },
+        (error) => errors.push(error),
+      );
+    }
+    if (this.anchorDirectoryHandle) {
+      await this.anchorDirectoryHandle.close().then(
+        () => {
+          this.anchorDirectoryHandle = undefined;
+          this.anchorDirectoryIdentity = undefined;
+        },
+        (error) => errors.push(error),
+      );
+    }
+    if (this.directoryHandle) {
+      await this.directoryHandle.close().then(
+        () => {
+          this.directoryHandle = undefined;
+          this.directoryIdentity = undefined;
+        },
+        (error) => errors.push(error),
+      );
+    }
+    if (this.namedMutexLease) {
+      await this.namedMutexLease.release().then(
+        () => {
+          this.namedMutexLease = undefined;
+          this.namedMutex = undefined;
+          this.anchorIdentity = undefined;
+          this.leaseLost = false;
+        },
+        (error) => errors.push(error),
+      );
+    }
+    if (errors.length > 0) {
+      throw new BrowserRuntimeError('FENCED', 'runtime ownership handles could not be closed');
+    }
+  }
+
+  private async readMetadata(): Promise<IOwnerMetadata> {
+    const stat = await this.lockHandle!.stat({ bigint: true });
+    if (stat.size <= 0n || stat.size > BigInt(maximumMetadataBytes)) {
+      throw new BrowserRuntimeError('FENCED', 'runtime lock metadata is malformed');
+    }
+    const bytes = plugins.Buffer.alloc(Number(stat.size));
+    let bytesRead = 0;
+    while (bytesRead < bytes.byteLength) {
+      const result = await this.lockHandle!.read(
+        bytes,
+        bytesRead,
+        bytes.byteLength - bytesRead,
+        bytesRead,
+      );
+      if (result.bytesRead <= 0) {
+        throw new BrowserRuntimeError('FENCED', 'runtime lock metadata is unreadable');
+      }
+      bytesRead += result.bytesRead;
+    }
+    let text: string;
+    try {
+      text = new TextDecoder('utf-8', { fatal: true }).decode(bytes);
+    } catch {
+      throw new BrowserRuntimeError('FENCED', 'runtime lock metadata is malformed');
+    }
+    if (!text.endsWith('\n') || text.slice(0, -1).includes('\n')) {
+      throw new BrowserRuntimeError('FENCED', 'runtime lock metadata is malformed');
+    }
+    const serialized = text.slice(0, -1);
+    let parsed: unknown;
+    try {
+      parsed = JSON.parse(serialized);
+    } catch {
+      throw new BrowserRuntimeError('FENCED', 'runtime lock metadata is malformed');
+    }
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+      throw new BrowserRuntimeError('FENCED', 'runtime lock metadata is malformed');
+    }
+    const record = parsed as Record<string, unknown>;
+    const expectedKeys = [
+      'schema',
+      'state',
+      'uid',
+      'runtimeDirectoryDevice',
+      'runtimeDirectoryInode',
+      'runtimeDirectoryHash',
+      'bootId',
+      'pid',
+      'processStartTicks',
+      'generationId',
+      'nonce',
+    ];
+    if (
+      Object.keys(record).length !== expectedKeys.length
+      || expectedKeys.some((key) => !(key in record))
+      || record.schema !== metadataSchema
+      || (record.state !== 'active' && record.state !== 'relinquished')
+      || !Number.isSafeInteger(record.uid)
+      || (record.uid as number) < 1
+      || typeof record.runtimeDirectoryDevice !== 'string'
+      || !unsignedIntegerPattern.test(record.runtimeDirectoryDevice)
+      || typeof record.runtimeDirectoryInode !== 'string'
+      || !unsignedIntegerPattern.test(record.runtimeDirectoryInode)
+      || typeof record.runtimeDirectoryHash !== 'string'
+      || !hashPattern.test(record.runtimeDirectoryHash)
+      || typeof record.bootId !== 'string'
+      || !bootIdPattern.test(record.bootId)
+      || !Number.isSafeInteger(record.pid)
+      || (record.pid as number) < 1
+      || typeof record.processStartTicks !== 'string'
+      || !unsignedIntegerPattern.test(record.processStartTicks)
+      || typeof record.generationId !== 'string'
+      || !generationIdPattern.test(record.generationId)
+      || typeof record.nonce !== 'string'
+      || !generationIdPattern.test(record.nonce)
+      || JSON.stringify(record) !== serialized
+    ) throw new BrowserRuntimeError('FENCED', 'runtime lock metadata is malformed');
+    return record as unknown as IOwnerMetadata;
+  }
+
+  private async writeMetadata(metadataArg: IOwnerMetadata): Promise<void> {
+    await this.assertLockPathCurrent();
+    await this.assertNativeAnchorCurrent();
+    const bytes = plugins.Buffer.from(`${JSON.stringify(metadataArg)}\n`, 'utf8');
+    if (bytes.byteLength > maximumMetadataBytes) {
+      throw new BrowserRuntimeError('FENCED', 'runtime lock metadata exceeds its bound');
+    }
+    let written = 0;
+    while (written < bytes.byteLength) {
+      const result = await this.lockHandle!.write(
+        bytes,
+        written,
+        bytes.byteLength - written,
+        written,
+      );
+      if (result.bytesWritten <= 0) {
+        throw new BrowserRuntimeError('FENCED', 'runtime lock metadata write was incomplete');
+      }
+      written += result.bytesWritten;
+    }
+    await this.lockHandle!.truncate(bytes.byteLength);
+    await this.lockHandle!.sync();
+    this.createdLock = false;
+    await this.assertLockPathCurrent();
+    await this.assertNativeAnchorCurrent();
+  }
+
+  private assertMetadataDirectoryIdentity(metadataArg: IOwnerMetadata): void {
+    const identity = this.directoryIdentity!;
+    if (
+      metadataArg.uid !== identity.uid
+      || metadataArg.runtimeDirectoryDevice !== identity.device
+      || metadataArg.runtimeDirectoryInode !== identity.inode
+      || metadataArg.runtimeDirectoryHash !== identity.hash
+    ) throw new BrowserRuntimeError('FENCED', 'runtime metadata belongs to another directory');
+  }
+
+  private async inspectLegacyLockDescriptors(): Promise<TInspectionResult> {
+    const lockIdentity = this.lockIdentity!;
+    let indeterminate = false;
+    for (const pid of await this.listOwnedProcessIds()) {
+      let descriptorNames: string[];
+      try {
+        descriptorNames = await plugins.fsPromises.readdir(
+          plugins.path.join(this.procRoot, String(pid), 'fd'),
+        );
+      } catch {
+        const uidState = await this.processStillExists(pid);
+        if (uidState === 'missing' || uidState === 'other') continue;
+        indeterminate = true;
+        continue;
+      }
+      for (const descriptorName of descriptorNames) {
+        if (!/^(?:0|[1-9][0-9]*)$/u.test(descriptorName)) {
+          indeterminate = true;
+          continue;
+        }
+        const descriptor = Number(descriptorName);
+        if (pid === process.pid && descriptor === this.lockHandle!.fd) continue;
+        try {
+          const stat = await plugins.fsPromises.stat(
+            plugins.path.join(this.procRoot, String(pid), 'fd', descriptorName),
+            { bigint: true },
+          );
+          if (stat.dev === lockIdentity.dev && stat.ino === lockIdentity.ino) return 'held';
+        } catch (error) {
+          if (isMissingError(error)) continue;
+          indeterminate = true;
+        }
+      }
+    }
+    return indeterminate ? 'indeterminate' : 'clear';
+  }
+
+  private async inspectProfileProcesses(profileRootsArg: string[]): Promise<TInspectionResult> {
+    const roots = profileRootsArg.map((root) => plugins.path.resolve(root));
+    let indeterminate = false;
+    for (const pid of await this.listOwnedProcessIds()) {
+      let cmdline: plugins.Buffer;
+      try {
+        cmdline = await this.readBoundedBuffer(
+          plugins.path.join(this.procRoot, String(pid), 'cmdline'),
+          maximumProcFileBytes,
+        );
+      } catch {
+        const uidState = await this.processStillExists(pid);
+        if (uidState === 'missing' || uidState === 'other') continue;
+        indeterminate = true;
+        continue;
+      }
+      if (cmdline.byteLength === 0) {
+        if (!await this.processIsZombie(pid)) indeterminate = true;
+        continue;
+      }
+      let cmdlineText: string;
+      try {
+        cmdlineText = new TextDecoder('utf-8', { fatal: true }).decode(cmdline);
+      } catch {
+        indeterminate = true;
+        continue;
+      }
+      const argumentsList = cmdlineText.split('\0');
+      if (argumentsList.at(-1) === '') argumentsList.pop();
+      for (let index = 0; index < argumentsList.length; index += 1) {
+        const argument = argumentsList[index]!;
+        let profilePath: string | undefined;
+        if (argument === '--user-data-dir') {
+          profilePath = argumentsList[index + 1];
+        } else if (argument.startsWith('--user-data-dir=')) {
+          profilePath = argument.slice('--user-data-dir='.length);
+        }
+        if (!profilePath || !plugins.path.isAbsolute(profilePath)) continue;
+        const resolved = plugins.path.resolve(profilePath);
+        if (roots.some((root) => resolved === root || this.pathIsWithin(root, resolved))) {
+          return 'held';
+        }
+      }
+    }
+    return indeterminate ? 'indeterminate' : 'clear';
+  }
+
+  private async listOwnedProcessIds(): Promise<number[]> {
+    let entries: plugins.fs.Dirent[];
+    try {
+      entries = await plugins.fsPromises.readdir(this.procRoot, { withFileTypes: true });
+    } catch {
+      throw new BrowserRuntimeError('FENCED', 'process inspection is unavailable');
+    }
+    const processIds: number[] = [];
+    let indeterminate = false;
+    for (const entry of entries) {
+      if (!/^[1-9][0-9]{0,9}$/u.test(entry.name)) continue;
+      const pid = Number(entry.name);
+      try {
+        const stat = await plugins.fsPromises.lstat(
+          plugins.path.join(this.procRoot, entry.name),
+          { bigint: true },
+        );
+        if (!stat.isDirectory() || stat.isSymbolicLink()) {
+          indeterminate = true;
+          continue;
+        }
+      } catch (error) {
+        if (isMissingError(error)) continue;
+        indeterminate = true;
+        continue;
+      }
+      const uidState = await this.processStillExists(pid);
+      if (uidState === 'same') processIds.push(pid);
+      else if (uidState === 'indeterminate') indeterminate = true;
+    }
+    if (indeterminate) {
+      throw new BrowserRuntimeError('FENCED', 'process inspection is indeterminate');
+    }
+    return processIds.sort((left, right) => {
+      if (left === process.pid) return -1;
+      if (right === process.pid) return 1;
+      return left - right;
+    });
+  }
+
+  private async processStillExists(pidArg: number): Promise<TProcessUidState> {
+    const processPath = plugins.path.join(this.procRoot, String(pidArg));
+    try {
+      const status = await this.readBoundedFile(
+        plugins.path.join(processPath, 'status'),
+        64 * 1024,
+      );
+      return this.parseProcessUidState(status);
+    } catch (error) {
+      if (!isMissingError(error)) return 'indeterminate';
+      try {
+        await plugins.fsPromises.lstat(processPath, { bigint: true });
+        return 'indeterminate';
+      } catch (statError) {
+        return isMissingError(statError) ? 'missing' : 'indeterminate';
+      }
+    }
+  }
+
+  private parseProcessUidState(statusArg: string): TProcessUidState {
+    if (/\u0000|\r/u.test(statusArg)) return 'indeterminate';
+    const uidLines = statusArg.split('\n').filter((line) => line.startsWith('Uid:'));
+    if (uidLines.length !== 1) return 'indeterminate';
+    const match = /^Uid:\s+([0-9]+)\s+([0-9]+)\s+([0-9]+)\s+([0-9]+)\s*$/u.exec(
+      uidLines[0]!,
+    );
+    if (!match) return 'indeterminate';
+    const ids = match.slice(1).map(Number);
+    if (ids.some((id) => !Number.isSafeInteger(id) || id < 0 || id > 0xffff_ffff)) {
+      return 'indeterminate';
+    }
+    if (ids.every((id) => id === this.uid)) return 'same';
+    if (ids.every((id) => id !== this.uid)) return 'other';
+    return 'indeterminate';
+  }
+
+  private async processIsZombie(pidArg: number): Promise<boolean> {
+    try {
+      const status = await this.readBoundedFile(
+        plugins.path.join(this.procRoot, String(pidArg), 'status'),
+        64 * 1024,
+      );
+      return /^State:\s+Z(?:\s|$)/mu.test(status);
+    } catch {
+      return false;
+    }
+  }
+
+  private async readBootId(): Promise<string> {
+    const rawBootId = await this.readBoundedFile(
+      plugins.path.join(this.procRoot, 'sys', 'kernel', 'random', 'boot_id'),
+      64,
+    );
+    const bootId = rawBootId.endsWith('\n') ? rawBootId.slice(0, -1) : rawBootId;
+    if (bootId.includes('\n') || bootId.includes('\r') || !bootIdPattern.test(bootId)) {
+      throw new BrowserRuntimeError('FENCED', 'boot identity is malformed');
+    }
+    return bootId;
+  }
+
+  private async readBoundedFile(pathArg: string, maximumBytesArg: number): Promise<string> {
+    const bytes = await this.readBoundedBuffer(pathArg, maximumBytesArg);
+    try {
+      return new TextDecoder('utf-8', { fatal: true }).decode(bytes);
+    } catch {
+      throw new BrowserRuntimeError('FENCED', 'process metadata is malformed');
+    }
+  }
+
+  private async readBoundedBuffer(
+    pathArg: string,
+    maximumBytesArg: number,
+  ): Promise<plugins.Buffer> {
+    const bytes = await plugins.fsPromises.readFile(pathArg);
+    if (bytes.byteLength > maximumBytesArg) {
+      throw new BrowserRuntimeError('FENCED', 'process metadata exceeds its bound');
+    }
+    return bytes;
+  }
+
+  private generationPath(generationIdArg: string): string {
+    if (!generationIdPattern.test(generationIdArg)) {
+      throw new BrowserRuntimeError('FENCED', 'runtime generation identity is malformed');
+    }
+    const generationPath = plugins.path.join(this.generationsRoot, generationIdArg);
+    if (!this.pathIsWithin(this.generationsRoot, generationPath)) {
+      throw new BrowserRuntimeError('FENCED', 'runtime generation escaped containment');
+    }
+    return generationPath;
+  }
+
+  private pathIsWithin(rootArg: string, candidateArg: string): boolean {
+    const relative = plugins.path.relative(rootArg, candidateArg);
+    return relative.length > 0 && relative !== '..'
+      && !relative.startsWith(`..${plugins.path.sep}`)
+      && !plugins.path.isAbsolute(relative);
+  }
+
+  private async assertRuntimeEntries(allowedNamesArg: Set<string>): Promise<void> {
+    await this.assertRuntimeDirectoryCurrent();
+    const entries = await plugins.fsPromises.readdir(this.runtimeDirectory, { withFileTypes: true });
+    if (entries.some((entry) => !allowedNamesArg.has(entry.name))) {
+      throw new BrowserRuntimeError('FENCED', 'runtime directory contains unknown state');
+    }
+  }
+
+  private async assertRuntimeDirectoryCurrent(): Promise<void> {
+    if (!this.directoryHandle || !this.directoryIdentity) {
+      throw new BrowserRuntimeError('FENCED', 'runtime directory is unavailable');
+    }
+    const [pathStat, handleStat] = await Promise.all([
+      plugins.fsPromises.lstat(this.runtimeDirectory, { bigint: true }),
+      this.directoryHandle.stat({ bigint: true }),
+    ]);
+    if (
+      !pathStat.isDirectory()
+      || pathStat.isSymbolicLink()
+      || pathStat.uid !== BigInt(this.uid)
+      || (pathStat.mode & 0o777n) !== 0o700n
+      || !statIdentityMatches(pathStat, handleStat)
+      || String(handleStat.dev) !== this.directoryIdentity.device
+      || String(handleStat.ino) !== this.directoryIdentity.inode
+    ) throw new BrowserRuntimeError('FENCED', 'runtime directory identity changed');
+  }
+
+  private async ensurePrivateDirectory(pathArg: string, parentArg: string): Promise<void> {
+    if (!this.pathIsWithin(parentArg, pathArg)) {
+      throw new BrowserRuntimeError('FENCED', 'runtime path escaped containment');
+    }
+    let created = false;
+    try {
+      await plugins.fsPromises.mkdir(pathArg, { recursive: false, mode: 0o700 });
+      created = true;
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code !== 'EEXIST') throw error;
+    }
+    if (created) {
+      await plugins.fsPromises.chmod(pathArg, 0o700);
+      const handle = await plugins.fsPromises.open(
+        pathArg,
+        plugins.fs.constants.O_RDONLY
+          | plugins.fs.constants.O_DIRECTORY
+          | plugins.fs.constants.O_NOFOLLOW,
+      );
+      try {
+        await handle.chmod(0o700);
+        await plugins.fsPromises.chmod(pathArg, 0o700);
+        const [pathStat, handleStat] = await Promise.all([
+          plugins.fsPromises.lstat(pathArg, { bigint: true }),
+          handle.stat({ bigint: true }),
+        ]);
+        if (
+          !pathStat.isDirectory()
+          || pathStat.isSymbolicLink()
+          || pathStat.uid !== BigInt(this.uid)
+          || (pathStat.mode & 0o777n) !== 0o700n
+          || !statIdentityMatches(pathStat, handleStat)
+        ) throw new BrowserRuntimeError('FENCED', 'runtime directory state is unsafe');
+        await handle.sync();
+      } finally {
+        await handle.close();
+      }
+      await this.syncDirectory(parentArg);
+    }
+    await this.validateOptionalPrivateDirectory(pathArg, false);
+  }
+
+  private async validateOptionalPrivateDirectory(
+    pathArg: string,
+    allowMissingArg = true,
+  ): Promise<boolean> {
+    let stat: plugins.fs.BigIntStats;
+    try {
+      stat = await plugins.fsPromises.lstat(pathArg, { bigint: true });
+    } catch (error) {
+      if (allowMissingArg && isMissingError(error)) return false;
+      throw error;
+    }
+    if (
+      !stat.isDirectory()
+      || stat.isSymbolicLink()
+      || stat.uid !== BigInt(this.uid)
+      || (stat.mode & 0o777n) !== 0o700n
+    ) throw new BrowserRuntimeError('FENCED', 'runtime directory state is unsafe');
+    return true;
+  }
+
+  private async validateOptionalGeneration(generationDirectoryArg: string): Promise<void> {
+    if (!await this.validateOptionalPrivateDirectory(generationDirectoryArg)) return;
+    const entries = await plugins.fsPromises.readdir(generationDirectoryArg, { withFileTypes: true });
+    if (entries.some((entry) => entry.name !== 'profiles' && entry.name !== 'artifacts')) {
+      throw new BrowserRuntimeError('FENCED', 'runtime generation contains unknown state');
+    }
+    await this.validateOptionalPrivateDirectory(
+      plugins.path.join(generationDirectoryArg, 'profiles'),
+    );
+    await this.validateOptionalPrivateDirectory(
+      plugins.path.join(generationDirectoryArg, 'artifacts'),
+    );
+  }
+
+  private async removePrivateDirectory(pathArg: string): Promise<void> {
+    if (!this.pathIsWithin(this.runtimeDirectory, pathArg)) {
+      throw new BrowserRuntimeError('FENCED', 'runtime cleanup escaped containment');
+    }
+    if (!await this.validateOptionalPrivateDirectory(pathArg)) return;
+    await plugins.fsPromises.rm(pathArg, {
+      recursive: true,
+      force: false,
+      maxRetries: 3,
+      retryDelay: 50,
+    });
+  }
+
+  private async readOptionalDirectoryEntries(pathArg: string): Promise<plugins.fs.Dirent[]> {
+    try {
+      return await plugins.fsPromises.readdir(pathArg, { withFileTypes: true });
+    } catch (error) {
+      if (isMissingError(error)) return [];
+      throw error;
+    }
+  }
+
+  private async syncOptionalDirectory(pathArg: string): Promise<void> {
+    try {
+      await this.syncDirectory(pathArg);
+    } catch (error) {
+      if (!isMissingError(error)) throw error;
+    }
+  }
+
+  private async syncDirectory(pathArg: string): Promise<void> {
+    const handle = await plugins.fsPromises.open(
+      pathArg,
+      plugins.fs.constants.O_RDONLY
+        | plugins.fs.constants.O_DIRECTORY
+        | plugins.fs.constants.O_NOFOLLOW,
+    );
+    try {
+      await handle.sync();
+    } finally {
+      await handle.close();
+    }
+  }
+}