@nowcrew/daemon 0.5.30 → 0.5.31

package/README.md

@@ -138,12 +138,23 @@ Useful environment controls:
 ```text
 CREW_RUNTIME_SAFE=1
 CREW_EXECUTION_MAX_PROMPT_BYTES=256000
-CREW_EXECUTION_MAX_TIMEOUT_MS=3600000
+CREW_EXECUTION_MAX_TIMEOUT_MS=10800000
 CREW_EXECUTION_MAX_EVENT_BYTES=64000
 CREW_MAX_PARALLEL=4
 CREW_EXECUTION_MAX_QUEUED_PER_AGENT=32
+CREW_EXECUTION_MAX_PARALLEL_TOTAL=4
+CREW_EXECUTION_MAX_QUEUED_TOTAL=128
+CREW_EXECUTION_MAX_STARTING_TOTAL=1
+CREW_EXECUTION_MAX_STARTING_PER_RUNTIME=1
+CREW_EXECUTION_START_GAP_MS=3000
+CREW_EXECUTION_STARTUP_TIMEOUT_MS=60000
 ```
 
+`MAX_PARALLEL_TOTAL` is the machine-wide process cap shared by protocol-v1 and legacy work.
+Runtime startup is a separate FIFO gate: by default only one Claude, Codex, or Kimi process may be
+initializing at a time, and launches are spaced by three seconds. A process leaves the startup gate
+only after its runtime-specific ready event; startup timeout cancels the owned process tree.
+
 Local policy can reduce server-requested access and limits; it cannot grant more access than requested.
 Provider credentials and configured environment are prepared locally and never carried in execution
 control frames.
@@ -152,6 +163,7 @@ control frames.
 
 - `src/serve.ts`: connection, negotiation, routing, sync, and legacy boundary.
 - `src/execution-runner.ts`: spec admission and lifecycle reporting.
+- `src/shared-execution-slots.ts` and `src/runtime-startup-gate.ts`: machine concurrency and startup FIFO.
 - `src/local-executor.ts` and `src/execution-supervisor.ts`: runtime process boundary.
 - `src/execution-journal.ts`: crash-safe local execution facts.
 - `src/runner.ts`: protocol-0 compatibility runner.

package/dist/config.js

@@ -7,10 +7,16 @@ import { detectDaemonLang, translateDaemon } from "./i18n.js";
 import { resolveAgentsRoot } from "./computer-profile.js";
 export const DEFAULT_EXECUTION_LIMITS = Object.freeze({
     maxPromptBytes: 256_000,
-    maxTimeoutMs: 3_600_000,
+    maxTimeoutMs: 3 * 60 * 60_000,
     maxEventBytes: 64_000,
     maxParallelPerAgent: 4,
     maxQueuedPerAgent: 32,
+    maxParallelTotal: 4,
+    maxQueuedTotal: 128,
+    maxStartingTotal: 1,
+    maxStartingPerRuntime: 1,
+    startupGapMs: 3_000,
+    startupTimeoutMs: 60_000,
 });
 // Fits the largest mandatory v1 lifecycle envelope (UUID + timestamps + outcome facts) with margin.
 export const MIN_EXECUTION_EVENT_BYTES = 512;
@@ -62,6 +68,12 @@ export function loadConfig(env = process.env) {
         maxEventBytes: integerEnvAtLeast(env, "CREW_EXECUTION_MAX_EVENT_BYTES", DEFAULT_EXECUTION_LIMITS.maxEventBytes, MIN_EXECUTION_EVENT_BYTES),
         maxParallelPerAgent: positiveIntegerEnv(env, "CREW_MAX_PARALLEL", DEFAULT_EXECUTION_LIMITS.maxParallelPerAgent),
         maxQueuedPerAgent: positiveIntegerEnv(env, "CREW_EXECUTION_MAX_QUEUED_PER_AGENT", DEFAULT_EXECUTION_LIMITS.maxQueuedPerAgent),
+        maxParallelTotal: positiveIntegerEnv(env, "CREW_EXECUTION_MAX_PARALLEL_TOTAL", DEFAULT_EXECUTION_LIMITS.maxParallelTotal),
+        maxQueuedTotal: positiveIntegerEnv(env, "CREW_EXECUTION_MAX_QUEUED_TOTAL", DEFAULT_EXECUTION_LIMITS.maxQueuedTotal),
+        maxStartingTotal: positiveIntegerEnv(env, "CREW_EXECUTION_MAX_STARTING_TOTAL", DEFAULT_EXECUTION_LIMITS.maxStartingTotal),
+        maxStartingPerRuntime: positiveIntegerEnv(env, "CREW_EXECUTION_MAX_STARTING_PER_RUNTIME", DEFAULT_EXECUTION_LIMITS.maxStartingPerRuntime),
+        startupGapMs: positiveIntegerEnv(env, "CREW_EXECUTION_START_GAP_MS", DEFAULT_EXECUTION_LIMITS.startupGapMs),
+        startupTimeoutMs: positiveIntegerEnv(env, "CREW_EXECUTION_STARTUP_TIMEOUT_MS", DEFAULT_EXECUTION_LIMITS.startupTimeoutMs),
     });
     return {
         serverUrl,

package/dist/execution-journal.js

@@ -8,6 +8,7 @@ export { JournalLockedError, JournalLockCorruptionError } from "./execution-jour
 const ExecutionIdSchema = z.string().uuid();
 const TimestampSchema = z.string().datetime({ offset: true });
 const RuntimeSchema = z.enum(["claude", "codex", "kimi"]);
+const RUNTIME_READY_SUFFIX = ".runtime-ready";
 const RawJournalEntrySchema = z.object({
     executionId: ExecutionIdSchema,
     specHash: z.string().min(1),
@@ -21,6 +22,8 @@ const RawJournalEntrySchema = z.object({
     resumed: z.boolean(),
     acceptedAt: TimestampSchema,
     processStartedAt: TimestampSchema.nullable(),
+    // Stored in a non-JSON sidecar so older strict journal readers can still roll back.
+    runtimeReadyAt: TimestampSchema.nullable().default(null),
     processIdentity: z.string().min(1).refine((value) => value.trim().length > 0).nullable(),
     // Optional for journals written before execution permission persistence was introduced.
     effectivePermission: EffectivePermissionSchema.nullable().optional(),
@@ -35,6 +38,9 @@ export const JournalEntrySchema = RawJournalEntrySchema.superRefine((entry, ctx)
         if (entry.processStartedAt !== null) {
             issue("accepted entry cannot have processStartedAt", "processStartedAt");
         }
+        if (entry.runtimeReadyAt !== null) {
+            issue("accepted entry cannot have runtimeReadyAt", "runtimeReadyAt");
+        }
         if (entry.processIdentity !== null)
             issue("accepted entry cannot have processIdentity", "processIdentity");
         if (entry.completion !== null)
@@ -290,6 +296,7 @@ export function createExecutionJournal(agentsRoot, options = {}) {
         throw new RangeError("maxEntries must be an integer");
     let initialized = false;
     const recordPath = (executionId) => join(directory, `${executionId}.json`);
+    const runtimeReadyPath = (executionId) => join(directory, `${executionId}${RUNTIME_READY_SUFFIX}`);
     const parseRecord = (path, raw) => {
         try {
             const entry = JournalEntrySchema.parse(JSON.parse(raw));
@@ -303,10 +310,30 @@ export function createExecutionJournal(agentsRoot, options = {}) {
             throw new JournalCorruptionError(path, error);
         }
     };
+    const readRuntimeReadyAt = async (executionId, path) => {
+        try {
+            return TimestampSchema.parse((await readFile(runtimeReadyPath(executionId), "utf8")).trim());
+        }
+        catch (error) {
+            if (isMissingFile(error))
+                return null;
+            throw new JournalCorruptionError(path, error);
+        }
+    };
+    const readRecordPath = async (path) => {
+        const entry = parseRecord(path, await readFile(path, "utf8"));
+        const runtimeReadyAt = await readRuntimeReadyAt(entry.executionId, path);
+        try {
+            return JournalEntrySchema.parse({ ...entry, runtimeReadyAt });
+        }
+        catch (error) {
+            throw new JournalCorruptionError(path, error);
+        }
+    };
     const readRecord = async (executionId) => {
         const path = recordPath(executionId);
         try {
-            return parseRecord(path, await readFile(path, "utf8"));
+            return await readRecordPath(path);
         }
         catch (error) {
             if (isMissingFile(error))
@@ -321,7 +348,7 @@ export function createExecutionJournal(agentsRoot, options = {}) {
         const entries = [];
         for (const name of names) {
             const path = join(directory, name);
-            entries.push(parseRecord(path, await readFile(path, "utf8")));
+            entries.push(await readRecordPath(path));
         }
         return entries;
     };
@@ -385,13 +412,49 @@ export function createExecutionJournal(agentsRoot, options = {}) {
         await fsyncDirectory(directory);
         return diskEntry;
     };
+    const writeRuntimeReadyAt = async (executionId, runtimeReadyAt) => {
+        const finalPath = runtimeReadyPath(executionId);
+        if (runtimeReadyAt === null) {
+            try {
+                await unlink(finalPath);
+                await fsyncDirectory(directory);
+            }
+            catch (error) {
+                if (!isMissingFile(error))
+                    throw error;
+            }
+            return;
+        }
+        const temporaryPath = `${finalPath}.tmp`;
+        let handle = null;
+        try {
+            handle = await open(temporaryPath, "w", 0o600);
+            await handle.writeFile(`${runtimeReadyAt}\n`, "utf8");
+            await handle.sync();
+            await handle.close();
+            handle = null;
+            await rename(temporaryPath, finalPath);
+            await fsyncFinalFile(finalPath);
+            await fsyncDirectory(directory);
+        }
+        catch (error) {
+            if (handle !== null)
+                await handle.close().catch(() => undefined);
+            await rm(temporaryPath, { force: true }).catch(() => undefined);
+            throw error;
+        }
+    };
     const writeRecord = async (entry) => {
         const validated = JournalEntrySchema.parse(entry);
+        const { runtimeReadyAt, ...diskEntry } = validated;
         const temporaryPath = join(directory, `${entry.executionId}.tmp`);
         let handle = null;
         try {
+            // Persist the sidecar first. A crash before the JSON rename can expose a
+            // ready timestamp early, but can never lose an already-observed ready event.
+            await writeRuntimeReadyAt(entry.executionId, runtimeReadyAt);
             handle = await open(temporaryPath, "w", 0o600);
-            await handle.writeFile(`${JSON.stringify(validated, null, 2)}\n`, "utf8");
+            await handle.writeFile(`${JSON.stringify(diskEntry, null, 2)}\n`, "utf8");
             await handle.sync();
             await handle.close();
             handle = null;
@@ -420,6 +483,7 @@ export function createExecutionJournal(agentsRoot, options = {}) {
         const toDelete = new Set([...expired, ...overLimit].map((entry) => entry.executionId));
         for (const executionId of toDelete) {
             await unlink(recordPath(executionId));
+            await rm(runtimeReadyPath(executionId), { force: true });
         }
         if (toDelete.size > 0)
             await fsyncDirectory(directory);
@@ -433,6 +497,13 @@ export function createExecutionJournal(agentsRoot, options = {}) {
         for (const name of names.filter((candidate) => candidate.endsWith(".tmp"))) {
             await rm(join(directory, name), { force: true });
         }
+        const records = new Set(names.filter((name) => name.endsWith(".json"))
+            .map((name) => basename(name, ".json")));
+        for (const name of names.filter((candidate) => candidate.endsWith(RUNTIME_READY_SUFFIX))) {
+            const executionId = name.slice(0, -RUNTIME_READY_SUFFIX.length);
+            if (!records.has(executionId))
+                await rm(join(directory, name), { force: true });
+        }
         await pruneInternal();
         initialized = true;
     };
@@ -448,8 +519,8 @@ export function createExecutionJournal(agentsRoot, options = {}) {
         return entry;
     };
     const interruptedCompletion = (entry) => {
-        const startedAt = entry.state === "running" && entry.processStartedAt !== null
-            ? entry.processStartedAt
+        const startedAt = entry.state === "running" && entry.runtimeReadyAt !== null
+            ? entry.runtimeReadyAt
             : entry.acceptedAt;
         return ExecutionCompletedSchema.parse({
             type: "execution:completed",
@@ -551,6 +622,7 @@ export function createExecutionJournal(agentsRoot, options = {}) {
                     resumed: recoveryFacts.resumed ?? false,
                     acceptedAt: timestamp,
                     processStartedAt: null,
+                    runtimeReadyAt: null,
                     processIdentity: null,
                     effectivePermission: recoveryFacts.effectivePermission ?? null,
                 });
@@ -618,6 +690,25 @@ export function createExecutionJournal(agentsRoot, options = {}) {
                 }
             });
         },
+        markRuntimeReady: async (executionId, runtimeReadyAt) => {
+            validateExecutionId(executionId);
+            TimestampSchema.parse(runtimeReadyAt);
+            return serialized(async () => {
+                const entry = await requireRecord(executionId);
+                if (entry.state !== "running") {
+                    throw new JournalTransitionError(`Cannot mark ${entry.state} execution runtime-ready`);
+                }
+                if (entry.runtimeReadyAt !== null)
+                    return confirmDurable(entry);
+                const updated = JournalEntrySchema.parse({
+                    ...entry,
+                    runtimeReadyAt,
+                    updatedAt: now().toISOString(),
+                });
+                await writeRecord(updated);
+                return updated;
+            });
+        },
         complete: async (executionId, completionInput) => {
             validateExecutionId(executionId);
             const completion = ExecutionCompletedSchema.parse(completionInput);

package/dist/execution-protocol.js

@@ -121,6 +121,7 @@ export const ExecutionStartSchema = z.object({
         channelId: z.string().min(1),
         threadId: z.string().min(1).optional(),
         wakeMessageId: z.string().min(1).optional(),
+        scheduledRunId: ExecutionIdSchema.optional(),
         externalResponseSessionId: ExecutionIdSchema.optional(),
         answerStream: z.boolean().optional(),
         attachments: z.array(ExecutionAttachmentSchema).max(20).optional(),

package/dist/execution-runner.js

@@ -217,18 +217,26 @@ function admission(spec, config, dependencies, at) {
     }
     if (!Number.isInteger(dependencies.facts.activeForAgent)
         || !Number.isInteger(dependencies.facts.queuedForAgent)
+        || !Number.isInteger(dependencies.facts.activeTotal)
+        || !Number.isInteger(dependencies.facts.queuedTotal)
         || dependencies.facts.activeForAgent < 0
-        || dependencies.facts.queuedForAgent < 0) {
+        || dependencies.facts.queuedForAgent < 0
+        || dependencies.facts.activeTotal < 0
+        || dependencies.facts.queuedTotal < 0) {
         return { rejected: rejection(spec.executionId, "invalid_spec", "Invalid local resource facts", at) };
     }
+    const agentAtCapacity = dependencies.facts.activeForAgent >= config.executionLimits.maxParallelPerAgent;
+    const machineAtCapacity = dependencies.facts.activeTotal >= config.executionLimits.maxParallelTotal;
     const slotInvalid = dependencies.slot?.state === "ready"
-        ? dependencies.facts.activeForAgent >= config.executionLimits.maxParallelPerAgent
+        ? agentAtCapacity || machineAtCapacity
         : dependencies.slot?.state === "queued"
-            ? dependencies.facts.activeForAgent < config.executionLimits.maxParallelPerAgent
-                || dependencies.facts.queuedForAgent >= config.executionLimits.maxQueuedPerAgent
+            ? dependencies.facts.queuedForAgent >= config.executionLimits.maxQueuedPerAgent
+                || dependencies.facts.queuedTotal >= config.executionLimits.maxQueuedTotal
             : false;
-    if (slotInvalid || (dependencies.slot === undefined && (dependencies.facts.activeForAgent >= config.executionLimits.maxParallelPerAgent
-        || dependencies.facts.queuedForAgent >= config.executionLimits.maxQueuedPerAgent))) {
+    if (slotInvalid || (dependencies.slot === undefined && (agentAtCapacity
+        || machineAtCapacity
+        || dependencies.facts.queuedForAgent >= config.executionLimits.maxQueuedPerAgent
+        || dependencies.facts.queuedTotal >= config.executionLimits.maxQueuedTotal))) {
         return { rejected: rejection(spec.executionId, "resource_limit", "Local execution capacity is exhausted", at) };
     }
     const permission = effectivePermission(spec, config);
@@ -306,12 +314,12 @@ export async function runExecution(config, input, dependencies) {
             effectivePermission: replayPermission,
             at: replay.acceptedAt,
         }), config.executionLimits.maxEventBytes), bestEffortTimeoutMs);
-        if (replay.state === "running" && replay.processStartedAt !== null) {
+        if (replay.state === "running" && replay.runtimeReadyAt !== null) {
             await reportBestEffort(dependencies.report, boundExecutionFrame(DaemonToServerExecutionFrameSchema.parse({
                 type: "execution:started",
                 protocolVersion: 1,
                 executionId: spec.executionId,
-                at: replay.processStartedAt,
+                at: replay.runtimeReadyAt,
             }), config.executionLimits.maxEventBytes), bestEffortTimeoutMs);
         }
         return { kind: "existing", entry: replay };
@@ -344,12 +352,12 @@ export async function runExecution(config, input, dependencies) {
             effectivePermission: accepted.effectivePermission ?? permission,
             at: accepted.acceptedAt,
         }), config.executionLimits.maxEventBytes), bestEffortTimeoutMs);
-        if (accepted.state === "running" && accepted.processStartedAt !== null) {
+        if (accepted.state === "running" && accepted.runtimeReadyAt !== null) {
             await reportBestEffort(dependencies.report, boundExecutionFrame(DaemonToServerExecutionFrameSchema.parse({
                 type: "execution:started",
                 protocolVersion: 1,
                 executionId: spec.executionId,
-                at: accepted.processStartedAt,
+                at: accepted.runtimeReadyAt,
             }), config.executionLimits.maxEventBytes), bestEffortTimeoutMs);
         }
         return { kind: "existing", entry: accepted };
@@ -376,6 +384,7 @@ export async function runExecution(config, input, dependencies) {
         await Promise.all([...launchAttempts]);
     };
     let startedAt = accepted.acceptedAt;
+    let runtimeCancel = null;
     let timeout;
     let timedOut = false;
     let completion;
@@ -396,6 +405,33 @@ export async function runExecution(config, input, dependencies) {
         let consoleSequence = 0;
         let externalOutputSequence = 0;
         const callbacks = {
+            onRuntimeReady: async () => {
+                if (dependencies.cancellation?.isRequested())
+                    return;
+                const ready = await dependencies.journal.markRuntimeReady(spec.executionId, now().toISOString());
+                if (ready.runtimeReadyAt === null) {
+                    throw new Error(`Execution ${spec.executionId} runtime readiness was not persisted`);
+                }
+                startedAt = ready.runtimeReadyAt;
+                await reportBestEffort(dependencies.report, boundExecutionFrame(DaemonToServerExecutionFrameSchema.parse({
+                    type: "execution:started",
+                    protocolVersion: 1,
+                    executionId: spec.executionId,
+                    at: startedAt,
+                }), config.executionLimits.maxEventBytes), bestEffortTimeoutMs);
+                const cancel = runtimeCancel;
+                if (cancel !== null && !dependencies.cancellation?.isRequested()) {
+                    timeout = setTimeout(() => {
+                        timedOut = true;
+                        try {
+                            void cancel().catch(rejectCancellationFailure);
+                        }
+                        catch (error) {
+                            rejectCancellationFailure(error);
+                        }
+                    }, effectiveTimeoutMs);
+                }
+            },
             ...(spec.reporting.streamActivity ? {
                 onActivity: (activity) => {
                     const frame = DaemonToServerExecutionFrameSchema.parse({
@@ -453,6 +489,10 @@ export async function runExecution(config, input, dependencies) {
         };
         const localDependencies = {
             ...(dependencies.cancellation === undefined ? {} : { cancellation: dependencies.cancellation }),
+            ...(dependencies.startupGate === undefined ? {} : { startupGate: dependencies.startupGate }),
+            ...(dependencies.startupTimeoutMs === undefined
+                ? {}
+                : { startupTimeoutMs: dependencies.startupTimeoutMs }),
             launchRuntime: async (request) => {
                 if (launchClosed || dependencies.cancellation?.isRequested())
                     throw new ExecutionCancelledError();
@@ -463,7 +503,7 @@ export async function runExecution(config, input, dependencies) {
                     const processStartedAt = now().toISOString();
                     const launchControl = { cancel: null };
                     const guarded = await dependencies.journal.startGuarded(spec.executionId, processStartedAt, () => startSupervisor(supervisorLaunch(request)), {
-                        beforeRelease: ({ entry, handle, abort }) => {
+                        beforeRelease: ({ handle, abort }) => {
                             supervisorState.active = handle;
                             let stopPromise = null;
                             let releaseStarted = false;
@@ -481,7 +521,6 @@ export async function runExecution(config, input, dependencies) {
                             launchControl.cancel = () => stopOnce(releaseStarted ? handle.cancel : abort);
                             supervisorState.abortOnce = () => stopOnce(abort);
                             dependencies.cancellation?.register(launchControl.cancel);
-                            startedAt = entry.processStartedAt ?? processStartedAt;
                             if (dependencies.cancellation?.isRequested()) {
                                 return dependencies.cancellation.waitForStop().then(() => {
                                     throw new ExecutionCancelledError();
@@ -497,23 +536,7 @@ export async function runExecution(config, input, dependencies) {
                         throw new Error("Execution launch cancellation gate was not installed");
                     }
                     const installedCancel = launchControl.cancel;
-                    await reportBestEffort(dependencies.report, boundExecutionFrame(DaemonToServerExecutionFrameSchema.parse({
-                        type: "execution:started",
-                        protocolVersion: 1,
-                        executionId: spec.executionId,
-                        at: startedAt,
-                    }), config.executionLimits.maxEventBytes), bestEffortTimeoutMs);
-                    if (!dependencies.cancellation?.isRequested()) {
-                        timeout = setTimeout(() => {
-                            timedOut = true;
-                            try {
-                                void installedCancel().catch(rejectCancellationFailure);
-                            }
-                            catch (error) {
-                                rejectCancellationFailure(error);
-                            }
-                        }, effectiveTimeoutMs);
-                    }
+                    runtimeCancel = installedCancel;
                     return { ...guarded.handle, cancel: installedCancel };
                 }
                 finally {

package/dist/host-execution-coordinator.js

@@ -0,0 +1,241 @@
+import { homedir } from "node:os";
+import { join, resolve } from "node:path";
+import { mkdir, open, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { randomUUID } from "node:crypto";
+import { defaultProcessController } from "./execution-journal.js";
+import { createJournalLease, createJournalLeaseRegistry, JournalLockedError, } from "./execution-journal-lock.js";
+const HOST_EXECUTION_SLOT_COUNT = 4;
+const HOST_STARTUP_GAP_MS = 3_000;
+const RETRY_MS = 50;
+export function defaultHostExecutionCoordinatorRoot(userHome = homedir()) {
+    // Deliberately independent of CREW_DAEMON_HOME and agentsRoot: every profile
+    // owned by this OS user must share the same physical-compute safety boundary.
+    return resolve(userHome, ".crew", "daemon", "compute-execution");
+}
+async function syncDirectory(path) {
+    if (process.platform === "win32")
+        return;
+    const handle = await open(path, "r");
+    try {
+        await handle.sync();
+    }
+    finally {
+        await handle.close();
+    }
+}
+async function leaseFor(directory) {
+    await mkdir(directory, { recursive: true, mode: 0o700 });
+    const lease = createJournalLease({
+        directory,
+        currentPid: process.pid,
+        captureCurrentIdentity: async () => {
+            const identity = await defaultProcessController.inspectIdentity(process.pid);
+            if (identity === null)
+                throw new Error("current process identity is absent");
+            return identity;
+        },
+        inspectIdentity: (pid) => defaultProcessController.inspectIdentity(pid),
+        syncDirectory,
+        // A separate registry is intentional: reservations in one process must
+        // compete for the same slot instead of attaching to one re-entrant lease.
+        registry: createJournalLeaseRegistry(),
+    });
+    try {
+        await lease.acquire();
+        return lease;
+    }
+    catch (error) {
+        if (error instanceof JournalLockedError)
+            return null;
+        throw error;
+    }
+}
+function reservation(prerequisite, acquire) {
+    let released = false;
+    let granted = false;
+    let owned = null;
+    let releasePromise = null;
+    let cancelPrerequisite;
+    const prerequisiteCancelled = new Promise((resolveCancelled) => {
+        cancelPrerequisite = () => resolveCancelled(false);
+    });
+    const acquisition = Promise.race([
+        prerequisite.then(() => true),
+        prerequisiteCancelled,
+    ]).then(async (shouldAcquire) => {
+        if (!shouldAcquire)
+            return null;
+        const lease = await acquire(() => released);
+        if (lease === null)
+            return null;
+        if (released) {
+            await lease.close();
+            return null;
+        }
+        owned = lease;
+        granted = true;
+        return lease;
+    });
+    const neverReady = new Promise(() => { });
+    const ready = acquisition.then((lease) => lease === null ? neverReady : undefined);
+    void ready.catch(() => undefined);
+    return {
+        ready,
+        isQueued: () => !granted && !released,
+        release: () => {
+            if (releasePromise !== null)
+                return releasePromise;
+            released = true;
+            cancelPrerequisite();
+            releasePromise = acquisition.then(async () => { if (owned !== null)
+                await owned.close(); });
+            void releasePromise.catch(() => undefined);
+            return releasePromise;
+        },
+    };
+}
+async function writeLaunchTimestamp(path, value) {
+    const temporary = `${path}.${randomUUID()}.tmp`;
+    try {
+        await writeFile(temporary, `${value}\n`, { encoding: "utf8", mode: 0o600, flag: "wx" });
+        await rename(temporary, path);
+    }
+    finally {
+        await rm(temporary, { force: true });
+    }
+}
+export function createHostExecutionCoordinator(options = {}) {
+    const root = resolve(options.root ?? defaultHostExecutionCoordinatorRoot());
+    const executionSlots = options.executionSlots ?? HOST_EXECUTION_SLOT_COUNT;
+    const startupGapMs = options.startupGapMs ?? HOST_STARTUP_GAP_MS;
+    const retryMs = options.retryMs ?? RETRY_MS;
+    const now = options.now ?? Date.now;
+    const wait = options.wait ?? ((milliseconds) => new Promise((resolveWait) => setTimeout(resolveWait, milliseconds)));
+    const pendingReleases = new Set();
+    if (!Number.isSafeInteger(executionSlots) || executionSlots <= 0) {
+        throw new RangeError("executionSlots must be a positive safe integer");
+    }
+    if (!Number.isFinite(startupGapMs) || startupGapMs < 0) {
+        throw new RangeError("startupGapMs must be a nonnegative finite number");
+    }
+    if (!Number.isFinite(retryMs) || retryMs <= 0) {
+        throw new RangeError("retryMs must be a positive finite number");
+    }
+    const acquireExecution = async (released) => {
+        let offset = 0;
+        while (!released()) {
+            for (let step = 0; step < executionSlots; step += 1) {
+                const slot = (offset + step) % executionSlots;
+                const lease = await leaseFor(join(root, "slots", String(slot)));
+                if (lease !== null)
+                    return lease;
+            }
+            offset = (offset + 1) % executionSlots;
+            await wait(retryMs);
+        }
+        return null;
+    };
+    const acquireStartup = async (released) => {
+        while (!released()) {
+            const directory = join(root, "startup");
+            const lease = await leaseFor(directory);
+            if (lease === null) {
+                await wait(retryMs);
+                continue;
+            }
+            const timestampPath = join(directory, "last-launch-at");
+            let previous = Number.NEGATIVE_INFINITY;
+            try {
+                previous = Number.parseInt(await readFile(timestampPath, "utf8"), 10);
+                if (!Number.isFinite(previous))
+                    previous = Number.NEGATIVE_INFINITY;
+            }
+            catch (error) {
+                if (!(error instanceof Error && "code" in error && error.code === "ENOENT")) {
+                    await lease.close();
+                    throw error;
+                }
+            }
+            const delay = Math.max(0, previous + startupGapMs - now());
+            if (delay > 0)
+                await wait(delay);
+            if (released()) {
+                await lease.close();
+                return null;
+            }
+            await writeLaunchTimestamp(timestampPath, now());
+            return lease;
+        }
+        return null;
+    };
+    const tracked = (entry) => {
+        let trackedRelease = null;
+        return {
+            ...entry,
+            release: () => {
+                if (trackedRelease !== null)
+                    return trackedRelease;
+                trackedRelease = entry.release();
+                pendingReleases.add(trackedRelease);
+                void trackedRelease.then(() => pendingReleases.delete(trackedRelease), () => pendingReleases.delete(trackedRelease));
+                return trackedRelease;
+            },
+        };
+    };
+    return {
+        reserveExecution: (prerequisite) => tracked(reservation(prerequisite, acquireExecution)),
+        reserveStartup: (prerequisite) => tracked(reservation(prerequisite, acquireStartup)),
+        drain: async () => {
+            while (pendingReleases.size > 0)
+                await Promise.all([...pendingReleases]);
+        },
+    };
+}
+export function hostCoordinatedSlotManager(local, host) {
+    return {
+        reserve: (handle, kind) => {
+            const localReservation = local.reserve(handle, kind);
+            if (!localReservation.accepted)
+                return localReservation;
+            const hostReservation = host.reserveExecution(localReservation.ready);
+            let released = false;
+            return {
+                ...localReservation,
+                // File ownership is asynchronous, so accepted work is conservatively
+                // reported queued until it owns both its local and host-wide slot.
+                state: "queued",
+                ready: hostReservation.ready,
+                isQueued: hostReservation.isQueued,
+                release: () => {
+                    if (released)
+                        return;
+                    released = true;
+                    void hostReservation.release();
+                    localReservation.release();
+                },
+            };
+        },
+        snapshot: local.snapshot,
+    };
+}
+export function hostCoordinatedStartupGate(local, host) {
+    return {
+        reserve: (runtime) => {
+            const localReservation = local.reserve(runtime);
+            const hostReservation = host.reserveStartup(localReservation.ready);
+            let released = false;
+            return {
+                ready: hostReservation.ready,
+                isQueued: hostReservation.isQueued,
+                release: () => {
+                    if (released)
+                        return;
+                    released = true;
+                    void hostReservation.release();
+                    localReservation.release();
+                },
+            };
+        },
+        snapshot: local.snapshot,
+    };
+}