@noopolis/daimon 0.2.0 → 0.2.2

package/dist/runtime/productionAgentTools.js

@@ -1,4 +1,4 @@
-import { spawn } from "node:child_process";
+import { spawn, readyTaskClockEnvironment } from "./taskClockProcess.js";
 import { createHash } from "node:crypto";
 import { constants } from "node:fs";
 import { lstat, open, readdir, rename, unlink } from "node:fs/promises";
@@ -12,6 +12,7 @@ import { McpToolCallError, MCP_TOOL_RESULT_MAX_BYTES, renderMcpToolResult, repla
 import { ensureRuntimeHomeDirectory } from "./runtimeHomeLayout.js";
 import { capToolResult, resolveExemptToolNames, resolveToolResultMaxBytes, TOOL_OUTPUT_DIRECTORY_NAME } from "./toolResultSpill.js";
 import { cliChildEnvironment } from "../pi/cliEnvironment.js";
+import { taskClockChildEnvironment, taskClockProcessEnvironment, taskClockTimestamp } from "./taskClock.js";
 const MAX_RESULT = 65_536;
 const TIMEOUT = 10_000;
 /**
@@ -25,6 +26,10 @@ const TIMEOUT = 10_000;
  */
 const DAIMON_ACTION_ID_PREFIX = "daimon-";
 export async function createProductionAgentTools(agent, wakeContext = {}) {
+    taskClockChildEnvironment();
+    for (const server of agent.mcp ?? [])
+        taskClockChildEnvironment(server.env);
+    readyTaskClockEnvironment(cliChildEnvironment([], agent.runtimeHomePath));
     await ensureRuntimeHomeDirectory(agent.runtimeHomePath, "tool-state");
     // Resolved once, at agent start: a malformed bound is a configuration error
     // that should refuse the agent, not a surprise thrown from the middle of a
@@ -202,7 +207,8 @@ function moltnetTool(agent, wakeContext) {
             const prior = await priorReceipt(agent, deliveryId);
             if (prior !== undefined) {
                 wakeContext.spokeFor = wakeContext.current;
-                return { content: [{ type: "text", text: JSON.stringify(prior) }], details: prior };
+                const visible = typeof prior.at === "string" ? { ...prior, at: taskClockTimestamp(prior.at) } : prior;
+                return { content: [{ type: "text", text: JSON.stringify(visible) }], details: visible };
             }
             const response = await machine(agent.moltnet.cliPath, agent.moltnet.configPath, input.network, { version: "moltnet.machine.v1", correlation_id: deliveryId, operation: "send_nudge", send_nudge: { delivery_id: deliveryId, target: { kind, id: target }, body: input.text } });
             const result = moltnetOperationResult(response, "send_nudge", "send");
@@ -219,10 +225,11 @@ function moltnetTool(agent, wakeContext) {
     };
 }
 async function connect(agent, server) {
-    const client = new Client({ name: "daimon-production", version: "0.2.0" });
+    taskClockChildEnvironment(server.env);
+    const client = new Client({ name: "daimon-production", version: "0.2.2" });
     const headers = server.authSecretEnv === undefined ? {} : { authorization: `Bearer ${requiredSecret(server.authSecretEnv)}` };
     const transport = server.transport === "stdio"
-        ? new StdioClientTransport({ command: server.command, args: [...server.args], env: stringEnvironment({ ...server.env, ...cliChildEnvironment([], agent.runtimeHomePath, { executablePath: server.command }) }) })
+        ? new StdioClientTransport({ command: server.command, args: [...server.args], env: stringEnvironment(readyTaskClockEnvironment({ ...server.env, ...cliChildEnvironment([], agent.runtimeHomePath, { executablePath: server.command }) })) })
         : server.transport === "sse" ? new SSEClientTransport(new URL(server.url), { requestInit: { headers } })
             : new StreamableHTTPClientTransport(new URL(server.url), { requestInit: { headers } });
     await client.connect(transport);
@@ -286,8 +293,9 @@ finally {
  * no longer cancel it.
  */
 async function machine(cli, config, network, request) {
+    const clockEnvironment = taskClockChildEnvironment();
     return await new Promise((resolve, reject) => {
-        const child = spawn(cli, ["machine", "--config", config, "--network", network], { stdio: ["pipe", "pipe", "pipe"] });
+        const child = spawn(cli, ["machine", "--config", config, "--network", network], { stdio: ["pipe", "pipe", "pipe"], env: taskClockProcessEnvironment(process.env, clockEnvironment) });
         let output = "", error = "", settled = false;
         const settle = (action) => { if (settled)
             return; settled = true; clearTimeout(timer); action(); };

package/dist/runtime/relocateRuntimeConfig.d.ts

@@ -0,0 +1,14 @@
+import { type OrganizationRuntimeConfig } from "./organizationRuntime.js";
+export type RuntimeConfigLocation = Readonly<{
+    workspace: string;
+    home: string;
+    memory: string;
+    /** Both paths are explicit: runtime config declares no control-token file. */
+    controlToken: Readonly<{
+        from: string;
+        to: string;
+    }>;
+}>;
+/** Rebase one memory-backed agent's path prefixes, preserving instructions verbatim. */
+export declare function relocateRuntimeConfig(config: OrganizationRuntimeConfig, location: RuntimeConfigLocation): OrganizationRuntimeConfig;
+//# sourceMappingURL=relocateRuntimeConfig.d.ts.map

package/dist/runtime/relocateRuntimeConfig.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"relocateRuntimeConfig.d.ts","sourceRoot":"","sources":["../../src/runtime/relocateRuntimeConfig.ts"],"names":[],"mappings":"AACA,OAAO,EAAkC,KAAK,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AAE1G,MAAM,MAAM,qBAAqB,GAAG,QAAQ,CAAC;IAC3C,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,8EAA8E;IAC9E,YAAY,EAAE,QAAQ,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACtD,CAAC,CAAC;AAEH,wFAAwF;AACxF,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,yBAAyB,EAAE,QAAQ,EAAE,qBAAqB,GAAG,yBAAyB,CA8BnI"}

package/dist/runtime/relocateRuntimeConfig.js

@@ -0,0 +1,38 @@
+import { posix } from "node:path";
+import { parseOrganizationRuntimeConfig } from "./organizationRuntime.js";
+/** Rebase one memory-backed agent's path prefixes, preserving instructions verbatim. */
+export function relocateRuntimeConfig(config, location) {
+    const parsed = parseOrganizationRuntimeConfig(config);
+    const agent = parsed.agents[0];
+    if (parsed.agents.length !== 1 || !agent?.memory)
+        throw new TypeError("Relocation requires one memory-backed agent");
+    const mappings = [
+        [agent.workspacePath, location.workspace],
+        [agent.runtimeHomePath, location.home],
+        [agent.memory.runtimeHomePath, location.memory],
+        [location.controlToken.from, location.controlToken.to]
+    ];
+    for (const pair of mappings)
+        for (const value of pair) {
+            if (typeof value !== "string" || !posix.isAbsolute(value) || posix.normalize(value) !== value || value === "/" || value.endsWith("/") || value.includes("\\") || value.includes("\0")) {
+                throw new TypeError("Relocation paths must be canonical absolute POSIX paths other than root");
+            }
+        }
+    // Memory may live below home; the most specific source must own that subtree.
+    const ordered = [...mappings].sort(([a], [b]) => b.length - a.length);
+    if (new Set(ordered.map(([source]) => source)).size !== ordered.length)
+        throw new TypeError("Relocation source paths must be distinct");
+    const relocate = (value) => {
+        if (typeof value === "string") {
+            const mapping = ordered.find(([source]) => value === source || value.startsWith(`${source}/`));
+            return mapping ? mapping[1] + value.slice(mapping[0].length) : value;
+        }
+        if (Array.isArray(value))
+            return value.map(relocate);
+        if (value !== null && typeof value === "object") {
+            return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, key === "instructions" ? item : relocate(item)]));
+        }
+        return value;
+    };
+    return parseOrganizationRuntimeConfig(relocate(parsed));
+}

package/dist/runtime/schedule.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schedule.d.ts","sourceRoot":"","sources":["../../src/runtime/schedule.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,8BAA8B,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAC;AAK5G,eAAO,MAAM,kBAAkB,aAAgB,CAAC;AAKhD,MAAM,MAAM,mBAAmB,GAAG,QAAQ,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AACxH,KAAK,cAAc,GAAG,OAAO,CAAC,2BAA2B,EAAE;IAAE,IAAI,EAAE,UAAU,CAAA;CAAE,CAAC,CAAC;AAGjF,KAAK,KAAK,GAAG,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC;AAE3C,MAAM,MAAM,kBAAkB,GAAG,QAAQ,CAAC;IAAE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAAC,KAAK,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAAC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CAAE,CAAC,CAAC;AACrI,MAAM,MAAM,yBAAyB,GAAG,QAAQ,CAAC;IAC/C,mBAAmB,EAAE,MAAM,CAAC;IAC5B,MAAM,EAAE,SAAS,8BAA8B,EAAE,CAAC;IAClD,8EAA8E;IAC9E,MAAM,CAAC,UAAU,EAAE,mBAAmB,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IACjE,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,iJAAiJ;IACjJ,MAAM,CAAC,EAAE,MAAM,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,OAAO,EAAE,MAAM,KAAK,KAAK,CAAC;IAC5D,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IACpC,4EAA4E;IAC5E,qBAAqB,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,GAAG,WAAW,GAAG,QAAQ,GAAG,gBAAgB,KAAK,IAAI,CAAC;CAC9F,CAAC,CAAC;AAEH,wFAAwF;AACxF,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,yBAAyB,GAAG,kBAAkB,CA8F/F;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,GAAG,mBAAmB,CAGxG;AAED,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAKpE;AAED,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAU1H;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAA8E;AAEnI,iHAAiH;AACjH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,cAAc,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,MAAM,GAAG,MAAM,CAKjG"}
+{"version":3,"file":"schedule.d.ts","sourceRoot":"","sources":["../../src/runtime/schedule.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,8BAA8B,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAC;AAK5G,eAAO,MAAM,kBAAkB,aAAgB,CAAC;AAKhD,MAAM,MAAM,mBAAmB,GAAG,QAAQ,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AACxH,KAAK,cAAc,GAAG,OAAO,CAAC,2BAA2B,EAAE;IAAE,IAAI,EAAE,UAAU,CAAA;CAAE,CAAC,CAAC;AAGjF,KAAK,KAAK,GAAG,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC;AAE3C,MAAM,MAAM,kBAAkB,GAAG,QAAQ,CAAC;IAAE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAAC,KAAK,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAAC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CAAE,CAAC,CAAC;AACrI,MAAM,MAAM,yBAAyB,GAAG,QAAQ,CAAC;IAC/C,mBAAmB,EAAE,MAAM,CAAC;IAC5B,MAAM,EAAE,SAAS,8BAA8B,EAAE,CAAC;IAClD,8EAA8E;IAC9E,MAAM,CAAC,UAAU,EAAE,mBAAmB,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IACjE,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,iJAAiJ;IACjJ,MAAM,CAAC,EAAE,MAAM,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,OAAO,EAAE,MAAM,KAAK,KAAK,CAAC;IAC5D,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IACpC,4EAA4E;IAC5E,qBAAqB,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,GAAG,WAAW,GAAG,QAAQ,GAAG,gBAAgB,KAAK,IAAI,CAAC;CAC9F,CAAC,CAAC;AAEH,wFAAwF;AACxF,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,yBAAyB,GAAG,kBAAkB,CA8F/F;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,GAAG,mBAAmB,CAIxG;AAED,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAKpE;AAED,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAY1H;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAA8E;AAEnI,iHAAiH;AACjH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,cAAc,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,MAAM,GAAG,MAAM,CAKjG"}

package/dist/runtime/schedule.js

@@ -1,3 +1,4 @@
+import { assertTaskInstant, validTaskInstant } from "./taskClock.js";
 import { createHash, randomUUID } from "node:crypto";
 import { constants } from "node:fs";
 import { lstat, open, readFile, rename, unlink } from "node:fs/promises";
@@ -11,7 +12,7 @@ const MAX_SEARCH_CHECKS = 1_000_000;
 const CRON_FIELD_BOUNDS = [[0, 59], [0, 23], [1, 31], [1, 12], [0, 7]];
 /** Schedules create durable pending occurrences; engine execution remains elsewhere. */
 export function createScheduleController(options) {
-    const now = options.now ?? Date.now;
+    const now = () => assertTaskInstant((options.now ?? Date.now)());
     const random = options.random ?? Math.random;
     const setTimer = options.setTimer ?? ((callback, delay) => setTimeout(callback, delay));
     const clearTimer = options.clearTimer ?? clearTimeout;
@@ -131,6 +132,7 @@ export function createScheduleController(options) {
     };
 }
 export function occurrenceFor(agentId, schedule, at) {
+    assertTaskInstant(at);
     const local = schedule.kind === "cron" ? occurrenceForOffset(at, schedule.timezone) : new Date(at).toISOString();
     return { agentId, occurredAt: new Date(at).toISOString(), prompt: schedule.prompt, deliveryId: `schedule:${identity(agentId, schedule)}:${local}` };
 }
@@ -142,16 +144,19 @@ export function isCanonicalScheduleDeliveryId(value) {
         || /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}@(?:GMT(?:[+-]\d{2}:\d{2})?|UTC)$/u.test(occurrence);
 }
 export function nextOccurrence(agentId, schedule, anchor, from) {
+    assertTaskInstant(from);
+    if (anchor !== undefined)
+        assertTaskInstant(anchor);
     if (schedule.kind === "every") {
         const base = anchor ?? from;
-        return base > from ? base : base + (Math.floor((from - base) / schedule.interval_ms) + 1) * schedule.interval_ms;
+        return assertTaskInstant(base > from ? base : base + (Math.floor((from - base) / schedule.interval_ms) + 1) * schedule.interval_ms);
     }
     const fields = parseCron(schedule.cron);
     if (!calendarPossible(fields))
         throw new Error(`schedule ${agentId} is impossible`);
     const found = searchCron(fields, schedule.timezone, from, from + SEARCH_HORIZON_MS, 1);
     if (found !== undefined)
-        return found;
+        return assertTaskInstant(found);
     throw new Error(`schedule ${agentId} has no occurrence within the deterministic search bound`);
 }
 export function cronIsPossible(cron) { try {
@@ -170,7 +175,7 @@ export function jitterOffsetMs(schedule, random) {
 }
 function withFireTarget(entry, schedule, random) {
     const offset = jitterOffsetMs(schedule, random);
-    return offset === 0 ? entry : { ...entry, fire_at_ms: entry.next_due_ms + offset };
+    return offset === 0 ? entry : { ...entry, fire_at_ms: assertTaskInstant(entry.next_due_ms + offset) };
 }
 function withoutPending(entry) {
     return { next_due_ms: entry.next_due_ms, ...(entry.fire_at_ms === undefined ? {} : { fire_at_ms: entry.fire_at_ms }) };
@@ -306,13 +311,13 @@ async function restore(file, allowed) {
         const keys = Object.keys(entry).sort().join();
         if (!["fire_at_ms,next_due_ms", "fire_at_ms,latest_pending,next_due_ms", "latest_pending,next_due_ms", "next_due_ms"].includes(keys))
             throw new Error("schedule state is invalid");
-        if (!Number.isSafeInteger(entry.next_due_ms) || entry.next_due_ms < 0)
+        if (!validTaskInstant(entry.next_due_ms))
             throw new Error("schedule state is invalid");
         const nextDue = entry.next_due_ms;
         const fireAt = entry.fire_at_ms;
         if (fireAt !== undefined) {
             const maximumFireAt = nextDue + jitterOffsetMs(allowed.get(key).schedule, () => 0.999_999_999);
-            if (!Number.isSafeInteger(fireAt) || fireAt < nextDue || fireAt > maximumFireAt)
+            if (!validTaskInstant(fireAt) || fireAt < nextDue || fireAt > maximumFireAt)
                 throw new Error("schedule state is invalid");
         }
         const pending = entry.latest_pending === undefined ? undefined : parseOccurrence(entry.latest_pending);
@@ -338,7 +343,7 @@ function parseOccurrence(value) {
     if (Object.keys(item).sort().join() !== "agentId,deliveryId,occurredAt,prompt" || Object.values(item).some((entry) => typeof entry !== "string" || Buffer.byteLength(entry, "utf8") > 16_384))
         throw new Error("schedule state is invalid");
     const occurredAt = item.occurredAt;
-    if (Number.isNaN(Date.parse(occurredAt)) || new Date(occurredAt).toISOString() !== occurredAt || !/^schedule:[a-f0-9]{64}:/u.test(item.deliveryId))
+    if (!validTaskInstant(Date.parse(occurredAt)) || new Date(occurredAt).toISOString() !== occurredAt || !/^schedule:[a-f0-9]{64}:/u.test(item.deliveryId))
         throw new Error("schedule state is invalid");
     return item;
 }

package/dist/runtime/storeCoordination.d.ts

@@ -15,6 +15,16 @@ export type StoreHostRegistrationIdentity = StoreHostRegistration & Readonly<{
 }>;
 export declare function acquireHostRegistration(root: string, directory: Awaited<ReturnType<typeof open>>, identity: StoreProcessIdentity): Promise<StoreHostRegistration>;
 export declare function releaseHostRegistration(root: string, directory: Awaited<ReturnType<typeof open>>, registration: StoreHostRegistration): Promise<void>;
+/**
+ * Remove `.host-online-*` markers left by hosts that are provably dead in this
+ * PID namespace. A host only ever removes its own marker on a clean close, so
+ * every crash, kill or container recreate left one behind (148 by 2026-10-05),
+ * and the markers count against the store's directory bound. The opening host,
+ * live owners, other namespaces and anything unreadable are left untouched.
+ */
+export declare function pruneDeadHostRegistrations(root: string, directory: Awaited<ReturnType<typeof open>>, self: StoreHostRegistration, liveness: (owner: StoreHostRegistration & Readonly<{
+    generation: string;
+}>) => Promise<boolean>): Promise<number>;
 /** Admin callers hold their durable offline lease before calling this. */
 export declare function listHostRegistrations(root: string): Promise<readonly StoreHostRegistrationIdentity[]>;
 /** Returns undefined when any registration is live, unknown, or changed. */

package/dist/runtime/storeCoordination.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"storeCoordination.d.ts","sourceRoot":"","sources":["../../src/runtime/storeCoordination.ts"],"names":[],"mappings":"AAEA,OAAO,EAAS,IAAI,EAA6B,MAAM,kBAAkB,CAAC;AAG1E,MAAM,MAAM,oBAAoB,GAAG,QAAQ,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAC3J,MAAM,MAAM,qBAAqB,GAAG,oBAAoB,GAAG,QAAQ,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAC1F,MAAM,MAAM,6BAA6B,GAAG,qBAAqB,GAAG,QAAQ,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAE3G,wBAAsB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,IAAI,CAAC,CAAC,EAAE,QAAQ,EAAE,oBAAoB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAWvK;AAED,wBAAsB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,IAAI,CAAC,CAAC,EAAE,YAAY,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAM3J;AAED,0EAA0E;AAC1E,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,6BAA6B,EAAE,CAAC,CAA0O;AACtV,4EAA4E;AAC5E,wBAAsB,0BAA0B,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,IAAI,CAAC,CAAC,EAAE,QAAQ,EAAE,oBAAoB,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,qBAAqB,KAAK,OAAO,CAAC,OAAO,CAAC,EAAE,wBAAwB,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC,CAgB/R;AAkBD,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,6BAA6B,GAAG,MAAM,CAA6E"}
+{"version":3,"file":"storeCoordination.d.ts","sourceRoot":"","sources":["../../src/runtime/storeCoordination.ts"],"names":[],"mappings":"AAEA,OAAO,EAAS,IAAI,EAA6B,MAAM,kBAAkB,CAAC;AAG1E,MAAM,MAAM,oBAAoB,GAAG,QAAQ,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAC3J,MAAM,MAAM,qBAAqB,GAAG,oBAAoB,GAAG,QAAQ,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAC1F,MAAM,MAAM,6BAA6B,GAAG,qBAAqB,GAAG,QAAQ,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAE3G,wBAAsB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,IAAI,CAAC,CAAC,EAAE,QAAQ,EAAE,oBAAoB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAWvK;AAED,wBAAsB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,IAAI,CAAC,CAAC,EAAE,YAAY,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAM3J;AAED;;;;;;GAMG;AACH,wBAAsB,0BAA0B,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,qBAAqB,GAAG,QAAQ,CAAC;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAWzP;AAED,0EAA0E;AAC1E,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,6BAA6B,EAAE,CAAC,CAA0O;AACtV,4EAA4E;AAC5E,wBAAsB,0BAA0B,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,IAAI,CAAC,CAAC,EAAE,QAAQ,EAAE,oBAAoB,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,qBAAqB,KAAK,OAAO,CAAC,OAAO,CAAC,EAAE,wBAAwB,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC,CAgB/R;AAkBD,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,6BAA6B,GAAG,MAAM,CAA6E"}

package/dist/runtime/storeCoordination.js

@@ -22,6 +22,29 @@ export async function releaseHostRegistration(root, directory, registration) {
     await unlink(target);
     await directory.sync();
 }
+/**
+ * Remove `.host-online-*` markers left by hosts that are provably dead in this
+ * PID namespace. A host only ever removes its own marker on a clean close, so
+ * every crash, kill or container recreate left one behind (148 by 2026-10-05),
+ * and the markers count against the store's directory bound. The opening host,
+ * live owners, other namespaces and anything unreadable are left untouched.
+ */
+export async function pruneDeadHostRegistrations(root, directory, self, liveness) {
+    let pruned = 0;
+    for (const entry of await readdir(root)) {
+        if (!/^\.host-online-[0-9a-f-]{36}\.json$/iu.test(entry) || entry === `.host-online-${self.owner_id}.json`)
+            continue;
+        const owner = await readRegistration(path.join(root, entry)).catch(() => undefined);
+        // This very process is alive by definition, whichever store in it registered the marker.
+        if (owner === undefined || !sameNamespace(owner, self) || (owner.pid === self.pid && owner.process_start === self.process_start && owner.boot_id === self.boot_id) || await liveness({ ...owner, generation: owner.owner_id }).catch(() => true))
+            continue;
+        await unlink(path.join(root, entry)).catch(() => undefined);
+        pruned += 1;
+    }
+    if (pruned > 0)
+        await directory.sync();
+    return pruned;
+}
 /** Admin callers hold their durable offline lease before calling this. */
 export async function listHostRegistrations(root) { const result = []; for (const entry of await readdir(root)) {
     if (/^\.host-online-[0-9a-f-]{36}\.json$/iu.test(entry))

package/dist/runtime/taskClock.d.ts

@@ -0,0 +1,42 @@
+export declare const TASK_CLOCK_ENV = "NOOPOLIS_TASK_CLOCK";
+export declare const TASK_CLOCK_VERSION = "noopolis.task-clock.v1";
+export declare const TASK_CLOCK_MIN_MS = 0;
+export declare const TASK_CLOCK_MAX_MS = 253402300799999;
+export declare function validTaskInstant(value: unknown): value is number;
+export declare function assertTaskInstant(value: number): number;
+export type TaskClock = Readonly<{
+    raw: string;
+    origin: string;
+    anchorEpochMs: number;
+    /** Convert a real epoch timestamp without resetting the shared anchor. */
+    at(realEpochMs: number): number;
+    now(): number;
+}>;
+/** Environment-only contract: no clock callbacks or compiler config in the public API. */
+export declare function readTaskClock(environment?: NodeJS.ProcessEnv): TaskClock | undefined;
+export declare function parseTaskClock(raw: string | undefined): TaskClock | undefined;
+/** The caller installs libfaketime; Daimon derives one process-independent offset. */
+export declare function taskClockChildEnvironment(declared?: NodeJS.ProcessEnv, clock?: Readonly<{
+    raw: string;
+    origin: string;
+    anchorEpochMs: number;
+    /** Convert a real epoch timestamp without resetting the shared anchor. */
+    at(realEpochMs: number): number;
+    now(): number;
+}> | undefined, environment?: NodeJS.ProcessEnv): Record<string, string>;
+/** Inherited environments must not reintroduce another offset owner or loader controls. */
+export declare function taskClockProcessEnvironment(inherited: NodeJS.ProcessEnv, derived?: Record<string, string>): NodeJS.ProcessEnv;
+/** Provider/auth/control processes must never inherit the agent's process clock. */
+export declare function realTimeProcessEnvironment(inherited: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+/** Reject mixed loader lists: unrelated libraries must never ride this exception. */
+export declare function taskClockPreload(value: string | undefined): string | undefined;
+/** Project real delivery/receipt timestamps, never historical dates inside tool payloads. */
+export declare function taskClockTimestamp(realTimestamp: string, clock?: Readonly<{
+    raw: string;
+    origin: string;
+    anchorEpochMs: number;
+    /** Convert a real epoch timestamp without resetting the shared anchor. */
+    at(realEpochMs: number): number;
+    now(): number;
+}> | undefined): string;
+//# sourceMappingURL=taskClock.d.ts.map

package/dist/runtime/taskClock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"taskClock.d.ts","sourceRoot":"","sources":["../../src/runtime/taskClock.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,cAAc,wBAAwB,CAAC;AACpD,eAAO,MAAM,kBAAkB,2BAA2B,CAAC;AAC3D,eAAO,MAAM,iBAAiB,IAAI,CAAC;AACnC,eAAO,MAAM,iBAAiB,kBAAsB,CAAC;AAErD,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAEhE;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAGvD;AAED,MAAM,MAAM,SAAS,GAAG,QAAQ,CAAC;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,0EAA0E;IAC1E,EAAE,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAAC;IAChC,GAAG,IAAI,MAAM,CAAC;CACf,CAAC,CAAC;AAEH,0FAA0F;AAC1F,wBAAgB,aAAa,CAAC,WAAW,GAAE,MAAM,CAAC,UAAwB,GAAG,SAAS,GAAG,SAAS,CAEjG;AAED,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAc7E;AAED,sFAAsF;AACtF,wBAAgB,yBAAyB,CACvC,QAAQ,GAAE,MAAM,CAAC,UAAe,EAAE,KAAK;SA/BlC,MAAM;YACH,MAAM;mBACC,MAAM;IACrB,0EAA0E;oBAC1D,MAAM,GAAG,MAAM;WACxB,MAAM;cA0B4C,EAAE,WAAW,GAAE,MAAM,CAAC,UAAwB,GACtG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAqBxB;AAED,2FAA2F;AAC3F,wBAAgB,2BAA2B,CACzC,SAAS,EAAE,MAAM,CAAC,UAAU,EAAE,OAAO,yBAA8B,GAClE,MAAM,CAAC,UAAU,CAGnB;AAMD,oFAAoF;AACpF,wBAAgB,0BAA0B,CAAC,SAAS,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAG1F;AAED,qFAAqF;AACrF,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAG9E;AAED,6FAA6F;AAC7F,wBAAgB,kBAAkB,CAAC,aAAa,EAAE,MAAM,EAAE,KAAK;SAhFxD,MAAM;YACH,MAAM;mBACC,MAAM;IACrB,0EAA0E;oBAC1D,MAAM,GAAG,MAAM;WACxB,MAAM;cA2EkE,GAAG,MAAM,CAEzF"}

package/dist/runtime/taskClock.js

@@ -0,0 +1,102 @@
+export const TASK_CLOCK_ENV = "NOOPOLIS_TASK_CLOCK";
+export const TASK_CLOCK_VERSION = "noopolis.task-clock.v1";
+export const TASK_CLOCK_MIN_MS = 0;
+export const TASK_CLOCK_MAX_MS = 253_402_300_799_999;
+export function validTaskInstant(value) {
+    return typeof value === "number" && Number.isSafeInteger(value) && value >= TASK_CLOCK_MIN_MS && value <= TASK_CLOCK_MAX_MS;
+}
+export function assertTaskInstant(value) {
+    if (!validTaskInstant(value))
+        throw invalid("task instant must be within 1970-01-01T00:00:00.000Z .. 9999-12-31T23:59:59.999Z");
+    return value;
+}
+/** Environment-only contract: no clock callbacks or compiler config in the public API. */
+export function readTaskClock(environment = process.env) {
+    return parseTaskClock(environment[TASK_CLOCK_ENV]);
+}
+export function parseTaskClock(raw) {
+    if (raw === undefined)
+        return undefined;
+    let value;
+    try {
+        value = JSON.parse(raw);
+    }
+    catch {
+        throw invalid("must be valid JSON");
+    }
+    if (value === null || typeof value !== "object" || Array.isArray(value))
+        throw invalid("must be an object");
+    const fields = value;
+    if (Object.keys(fields).sort().join() !== "anchorEpochMs,origin,version")
+        throw invalid("requires exactly version, origin, anchorEpochMs (no unknown fields)");
+    if (fields.version !== TASK_CLOCK_VERSION)
+        throw invalid(`version must be ${TASK_CLOCK_VERSION}`);
+    if (typeof fields.origin !== "string" || !validInstant(fields.origin))
+        throw invalid("origin must be a valid ISO-8601 instant with Z or an explicit offset");
+    if (typeof fields.anchorEpochMs !== "number" || !Number.isSafeInteger(fields.anchorEpochMs))
+        throw invalid("anchorEpochMs must be a safe integer");
+    const origin = fields.origin, anchorEpochMs = fields.anchorEpochMs, originMs = Date.parse(origin);
+    assertTaskInstant(originMs);
+    const at = (realEpochMs) => assertTaskInstant(originMs + (realEpochMs - anchorEpochMs));
+    return Object.freeze({ raw, origin, anchorEpochMs, at, now: () => at(Date.now()) });
+}
+/** The caller installs libfaketime; Daimon derives one process-independent offset. */
+export function taskClockChildEnvironment(declared = {}, clock = readTaskClock(), environment = process.env) {
+    if (clock === undefined)
+        return {};
+    for (const name of Object.keys(declared)) {
+        if (declared[name] !== undefined && clockVariable(name))
+            throw invalid(`declared child environment conflicts with ${name}`);
+    }
+    // Integer arithmetic keeps every millisecond even at the safe-integer anchor limits.
+    const offset = BigInt(Date.parse(clock.origin)) - BigInt(clock.anchorEpochMs);
+    const magnitude = offset < 0n ? -offset : offset;
+    const fraction = magnitude % 1000n;
+    const seconds = `${offset < 0n ? "-" : "+"}${magnitude / 1000n}${fraction === 0n ? "" : `.${String(fraction).padStart(3, "0")}`}`;
+    const preload = taskClockPreload(environment.LD_PRELOAD);
+    if (preload === undefined)
+        throw invalid("process clock startup probe requires caller-provided LD_PRELOAD naming libfaketime*.so*; refusing clocked execution");
+    return {
+        // The child process clock owns the offset; Mneme and nested consumers use Date.now().
+        // libfaketime's relative format defaults to seconds; an `s` suffix is not supported.
+        FAKETIME: seconds,
+        FAKETIME_DONT_FAKE_MONOTONIC: "1",
+        // libfaketime parses decimal fractions using the process locale.
+        LC_ALL: "C",
+        LD_PRELOAD: preload
+    };
+}
+/** Inherited environments must not reintroduce another offset owner or loader controls. */
+export function taskClockProcessEnvironment(inherited, derived = taskClockChildEnvironment()) {
+    if (Object.keys(derived).length === 0)
+        return inherited;
+    return { ...Object.fromEntries(Object.entries(inherited).filter(([name]) => !clockVariable(name))), ...derived };
+}
+function clockVariable(name) {
+    return /^(?:LD_PRELOAD$|DYLD_|FAKETIME|NOOPOLIS_TASK_CLOCK$|MNEME_CLOCK_)/u.test(name);
+}
+/** Provider/auth/control processes must never inherit the agent's process clock. */
+export function realTimeProcessEnvironment(inherited) {
+    if (readTaskClock() === undefined)
+        return inherited;
+    return Object.fromEntries(Object.entries(inherited).filter(([name]) => !clockVariable(name)));
+}
+/** Reject mixed loader lists: unrelated libraries must never ride this exception. */
+export function taskClockPreload(value) {
+    const libraries = value?.split(/[\s:]+/u).filter(Boolean);
+    return libraries?.length && libraries.every((library) => /^libfaketime[^/]*\.so[^/]*$/u.test(library.split("/").at(-1))) ? value : undefined;
+}
+/** Project real delivery/receipt timestamps, never historical dates inside tool payloads. */
+export function taskClockTimestamp(realTimestamp, clock = readTaskClock()) {
+    return clock === undefined ? realTimestamp : new Date(clock.at(Date.parse(realTimestamp))).toISOString();
+}
+function invalid(reason) { return new Error(`${TASK_CLOCK_ENV}: ${reason}`); }
+function validInstant(value) {
+    const match = /^(\d{4})-(\d{2})-(\d{2})T([01]\d|2[0-3]):([0-5]\d):([0-5]\d)(?:\.\d+)?(?:Z|[+-](?:[01]\d|2[0-3]):?[0-5]\d)$/u.exec(value);
+    if (match === null || !Number.isFinite(Date.parse(value)))
+        return false;
+    const year = Number(match[1]), month = Number(match[2]), day = Number(match[3]);
+    const leap = year % 4 === 0 && (year % 100 !== 0 || year % 400 === 0);
+    const days = [31, leap ? 29 : 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
+    return month >= 1 && month <= 12 && day >= 1 && day <= days[month - 1];
+}

package/dist/runtime/taskClockProcess.d.ts

@@ -0,0 +1,17 @@
+import childProcess from "node:child_process";
+import { type TaskClock } from "./taskClock.js";
+export type { ChildProcess } from "node:child_process";
+/** @internal Synchronous injection seam; never runtime configuration. */
+export type TaskClockProcessProbe = (command: string, args: readonly string[], environment: NodeJS.ProcessEnv) => string;
+/** @internal Isolate simulated probes between tests. */
+export declare function resetTaskClockProcessForTest(): void;
+/** Shared child-launch boundary, including SDK transports and Pi's spawn hook.
+ * Keep the synchronous spawn API: only the first launch blocks for the bounded probes.
+ * Every launch derives a fresh environment; only successful interposition is memoized.
+ */
+export declare function readyTaskClockEnvironment(environment: NodeJS.ProcessEnv, clock?: TaskClock | undefined, probe?: TaskClockProcessProbe): NodeJS.ProcessEnv;
+/** Only agent-facing tool/server children cross the shifted readiness gate. */
+export declare const spawn: typeof childProcess.spawn;
+/** Engine CLIs and operational helpers stay real; no libfaketime probe runs here. */
+export declare const spawnRealTime: typeof childProcess.spawn;
+//# sourceMappingURL=taskClockProcess.d.ts.map

package/dist/runtime/taskClockProcess.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"taskClockProcess.d.ts","sourceRoot":"","sources":["../../src/runtime/taskClockProcess.ts"],"names":[],"mappings":"AAAA,OAAO,YAAmC,MAAM,oBAAoB,CAAC;AACrE,OAAO,EAAqG,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEnJ,YAAY,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,yEAAyE;AACzE,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,UAAU,KAAK,MAAM,CAAC;AAGzH,wDAAwD;AACxD,wBAAgB,4BAA4B,IAAI,IAAI,CAAsB;AAS1E;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,WAAW,EAAE,MAAM,CAAC,UAAU,EAAE,KAAK,GAAE,SAAS,GAAG,SAA2B,EAAE,KAAK,GAAE,qBAAiC,GACvH,MAAM,CAAC,UAAU,CAyBnB;AAED,+EAA+E;AAC/E,eAAO,MAAM,KAAK,EAAE,OAAO,YAAY,CAAC,KAIT,CAAC;AAEhC,qFAAqF;AACrF,eAAO,MAAM,aAAa,EAAE,OAAO,YAAY,CAAC,KAIjB,CAAC"}

package/dist/runtime/taskClockProcess.js

@@ -0,0 +1,58 @@
+import childProcess from "node:child_process";
+import { readTaskClock, realTimeProcessEnvironment, taskClockChildEnvironment, taskClockProcessEnvironment } from "./taskClock.js";
+const verified = new Set();
+/** @internal Isolate simulated probes between tests. */
+export function resetTaskClockProcessForTest() { verified.clear(); }
+const dateProbe = (command, args, env) => {
+    const result = childProcess.spawnSync(command, [...args], { env, encoding: "utf8", timeout: 5000, killSignal: "SIGKILL", maxBuffer: 1024 });
+    // Loaders can ignore a missing library and still exit zero, including at zero offset.
+    if (result.error || result.status !== 0 || result.stderr?.trim())
+        throw result.error ?? new Error("date/libfaketime emitted a startup diagnostic");
+    return result.stdout;
+};
+/** Shared child-launch boundary, including SDK transports and Pi's spawn hook.
+ * Keep the synchronous spawn API: only the first launch blocks for the bounded probes.
+ * Every launch derives a fresh environment; only successful interposition is memoized.
+ */
+export function readyTaskClockEnvironment(environment, clock = readTaskClock(), probe = dateProbe) {
+    if (clock === undefined)
+        return environment;
+    const refuse = (reason) => new Error(`NOOPOLIS_TASK_CLOCK: process clock startup probe ${reason}; refusing clocked execution`);
+    if (process.platform !== "linux")
+        throw refuse("requires Linux libfaketime interposition");
+    const derived = taskClockChildEnvironment({}, clock);
+    const env = taskClockProcessEnvironment(environment, derived);
+    clock.now(); // A cached process clock never permits reads outside the supported calendar.
+    const key = JSON.stringify([process.pid, process.platform, derived.LD_PRELOAD, derived.FAKETIME]);
+    if (verified.has(key))
+        return env;
+    for (const sentinel of [true, false]) {
+        let output;
+        try {
+            // Absolute path: engine-specific PATHs need not contain system utilities.
+            output = probe("/bin/date", ["-u", "+%s"], sentinel ? { ...env, FAKETIME: "-31536000" } : env);
+        }
+        catch (cause) {
+            throw new Error(refuse("could not run date -u +%s (date/libfaketime missing or unusable)").message, { cause });
+        }
+        const seconds = Number(output.trim());
+        const expected = sentinel ? Date.now() - 31_536_000_000 : clock.now();
+        if (!/^-?\d+$/u.test(output.trim()) || !Number.isSafeInteger(seconds) || Math.abs(seconds * 1000 - expected) > 5000) {
+            throw refuse(`did not observe ${sentinel ? "sentinel offset" : "task time"} within ±5 seconds (check libfaketime and its offset)`);
+        }
+    }
+    verified.add(key);
+    return env;
+}
+/** Only agent-facing tool/server children cross the shifted readiness gate. */
+export const spawn = ((command, args, options) => {
+    const argv = Array.isArray(args) ? args : [];
+    const settings = (Array.isArray(args) ? options : args ?? options);
+    return childProcess.spawn(command, argv, { ...settings, env: readyTaskClockEnvironment(settings?.env ?? process.env) });
+});
+/** Engine CLIs and operational helpers stay real; no libfaketime probe runs here. */
+export const spawnRealTime = ((command, args, options) => {
+    const argv = Array.isArray(args) ? args : [];
+    const settings = (Array.isArray(args) ? options : args ?? options);
+    return childProcess.spawn(command, argv, { ...settings, env: realTimeProcessEnvironment(settings?.env ?? process.env) });
+});

package/dist/runtime/turnRequestLedger.d.ts

@@ -123,11 +123,6 @@ export type GrokTurnRequestEntry = Readonly<{
  * field is not.
  */
 export declare const renderGrokTurnRequestLines: (entry: GrokTurnRequestEntry) => string;
-/**
- * Append already-rendered, newline-terminated ledger lines in one write, with the
- * same rotation and file mode as both ledgers. Advisory: never rejects. The
- * broker uses it to append the exact bytes it sealed into a turn record.
- */
 export declare const recordLedgerLines: (file: string, lines: string) => Promise<boolean>;
 /** Advisory and never rejects, like {@link recordTurnRequests}; an empty turn writes nothing. */
 export declare const recordGrokTurnRequests: (file: string, entry: GrokTurnRequestEntry) => Promise<boolean>;

package/dist/runtime/turnRequestLedger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"turnRequestLedger.d.ts","sourceRoot":"","sources":["../../src/runtime/turnRequestLedger.ts"],"names":[],"mappings":"AAGA,OAAO,EAA4B,KAAK,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC9F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAGlE;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,2BAA2B,EAAG,kCAA2C,CAAC;AAEvF;;;GAGG;AACH,eAAO,MAAM,mBAAmB;;;;;;CAMtB,CAAC;AAEX;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B,EAAG,kCAA2C,CAAC;AAExF,eAAO,MAAM,4BAA4B,GAAI,cAAa,MAAM,CAAC,UAAwB,KAAG,MAG3F,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG,QAAQ,CAAC;IACtC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,gEAAgE;IAChE,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACvC,EAAE,CAAC,EAAE,MAAM,CAAC;CACb,CAAC,CAAC;AAIH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,sBAAsB,GAAI,OAAO,gBAAgB,KAAG,MAqBhE,CAAC;AASF,0FAA0F;AAC1F;;;;GAIG;AACH;;;;GAIG;AACH,MAAM,MAAM,eAAe,GAAG,QAAQ,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,QAAQ,GAAG,UAAU,GAAG,WAAW,CAAC;IAAC,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC,CAAC;AACvQ;;;;GAIG;AACH,MAAM,MAAM,oBAAoB,GAAG,QAAQ,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,eAAe,CAAC;IAAC,QAAQ,EAAE,SAAS,eAAe,EAAE,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAE/M;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,0BAA0B,GAAI,OAAO,oBAAoB,KAAG,MAuBxE,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,GAAU,MAAM,MAAM,EAAE,OAAO,MAAM,KAAG,OAAO,CAAC,OAAO,CAGpF,CAAC;AAEF,iGAAiG;AACjG,eAAO,MAAM,sBAAsB,GAAU,MAAM,MAAM,EAAE,OAAO,oBAAoB,KAAG,OAAO,CAAC,OAAO,CAGvG,CAAC;AA4BF;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB,GAAU,MAAM,MAAM,EAAE,OAAO,gBAAgB,KAAG,OAAO,CAAC,OAAO,CAU/F,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,uBAAuB,GAAU,OAAO,QAAQ,CAAC;IAC5D,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC,KAAG,OAAO,CAAC,OAAO,CAiBnB,CAAC"}
+{"version":3,"file":"turnRequestLedger.d.ts","sourceRoot":"","sources":["../../src/runtime/turnRequestLedger.ts"],"names":[],"mappings":"AAIA,OAAO,EAA4B,KAAK,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC9F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAGlE;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,2BAA2B,EAAG,kCAA2C,CAAC;AAEvF;;;GAGG;AACH,eAAO,MAAM,mBAAmB;;;;;;CAMtB,CAAC;AAEX;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B,EAAG,kCAA2C,CAAC;AAExF,eAAO,MAAM,4BAA4B,GAAI,cAAa,MAAM,CAAC,UAAwB,KAAG,MAG3F,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG,QAAQ,CAAC;IACtC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,gEAAgE;IAChE,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACvC,EAAE,CAAC,EAAE,MAAM,CAAC;CACb,CAAC,CAAC;AAIH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,sBAAsB,GAAI,OAAO,gBAAgB,KAAG,MAqBhE,CAAC;AASF,0FAA0F;AAC1F;;;;GAIG;AACH;;;;GAIG;AACH,MAAM,MAAM,eAAe,GAAG,QAAQ,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,QAAQ,GAAG,UAAU,GAAG,WAAW,CAAC;IAAC,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC,CAAC;AACvQ;;;;GAIG;AACH,MAAM,MAAM,oBAAoB,GAAG,QAAQ,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,eAAe,CAAC;IAAC,QAAQ,EAAE,SAAS,eAAe,EAAE,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAE/M;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,0BAA0B,GAAI,OAAO,oBAAoB,KAAG,MAuBxE,CAAC;AASF,eAAO,MAAM,iBAAiB,GAAU,MAAM,MAAM,EAAE,OAAO,MAAM,KAAG,OAAO,CAAC,OAAO,CAWpF,CAAC;AAEF,iGAAiG;AACjG,eAAO,MAAM,sBAAsB,GAAU,MAAM,MAAM,EAAE,OAAO,oBAAoB,KAAG,OAAO,CAAC,OAAO,CAGvG,CAAC;AAoBF;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB,GAAU,MAAM,MAAM,EAAE,OAAO,gBAAgB,KAAG,OAAO,CAAC,OAAO,CAQ/F,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,uBAAuB,GAAU,OAAO,QAAQ,CAAC;IAC5D,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC,KAAG,OAAO,CAAC,OAAO,CAiBnB,CAAC"}

package/dist/runtime/turnRequestLedger.js

@@ -1,3 +1,4 @@
+import path from "node:path";
 import { constants } from "node:fs";
 import { open, rename, stat } from "node:fs/promises";
 import { readCodexRolloutRequests } from "../pi/codexRolloutUsage.js";
@@ -138,16 +139,29 @@ export const renderGrokTurnRequestLines = (entry) => {
  * same rotation and file mode as both ledgers. Advisory: never rejects. The
  * broker uses it to append the exact bytes it sealed into a turn record.
  */
+const ledgerWrites = new Map();
 export const recordLedgerLines = async (file, lines) => {
     if (lines.length === 0)
         return false;
+    const key = path.resolve(file);
+    const previous = ledgerWrites.get(key) ?? Promise.resolve(true);
+    const pending = previous.then(async () => {
+        try {
+            await rotate(key);
+            await appendLines(key, lines);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    });
+    ledgerWrites.set(key, pending);
     try {
-        await rotate(file);
-        await appendLines(file, lines);
-        return true;
+        return await pending;
     }
-    catch {
-        return false;
+    finally {
+        if (ledgerWrites.get(key) === pending)
+            ledgerWrites.delete(key);
     }
 };
 /** Advisory and never rejects, like {@link recordTurnRequests}; an empty turn writes nothing. */
@@ -155,9 +169,7 @@ export const recordGrokTurnRequests = async (file, entry) => {
     if (entry.requests.length === 0)
         return false;
     try {
-        await rotate(file);
-        await appendLines(file, renderGrokTurnRequestLines(entry));
-        return true;
+        return await recordLedgerLines(file, renderGrokTurnRequestLines(entry));
     }
     catch {
         return false;
@@ -174,16 +186,8 @@ const rotate = async (file) => {
     if (size >= TURN_USAGE_ROTATE_BYTES)
         await rename(file, `${file}.1`);
 };
-/**
- * One `write(2)` for the whole wake's rows.
- *
- * Turns for different agents run concurrently inside the single broker process.
- * `O_APPEND` makes a single sub-page write atomic against them, so a wake's rows
- * are contiguous and never interleaved with another wake's — which matters more
- * here than in the per-wake ledger, because a row only means something beside
- * the other rows of its own thread. A wake with enough requests to exceed a page
- * is still append-ordered per line; interleaving would cost grouping, not
- * correctness, since every row carries its own thread id.
+/** Rotation and all writes are serialized per canonical path in this broker process.
+ * The realm lease excludes another broker. Independent paths remain concurrent.
  */
 const appendLines = async (file, lines) => {
     const bytes = Buffer.from(lines, "utf8");
@@ -209,9 +213,7 @@ export const recordTurnRequests = async (file, entry) => {
     if (entry.requests.length === 0)
         return false;
     try {
-        await rotate(file);
-        await appendLines(file, renderTurnRequestLines(entry));
-        return true;
+        return await recordLedgerLines(file, renderTurnRequestLines(entry));
     }
     catch {
         /* advisory: instrumentation never fails a wake that published */