@orkestrel/process 0.0.7 → 0.0.9

package/dist/src/server/index.js

@@ -6,8 +6,8 @@ import { platform } from "node:process";
 import { boundsOf, holds, isNonEmptyString, isNonNegativeInteger, isString } from "@orkestrel/contract";
 import { PROCESS_BACKLOG, PROCESS_CONFIRMATION, PROCESS_DRAIN, PROCESS_EVIDENCE, PROCESS_GRACE, PROCESS_OUTPUT, PROCESS_PATHEXT, PROCESS_TIMER, ProcessError, createDuplicateError, createExecuteError, createInvalidError, createProtocolError } from "../core/index.js";
 import { createInterface } from "node:readline";
-import { StringDecoder } from "node:string_decoder";
 import { Emitter } from "@orkestrel/emitter";
+import { StringDecoder } from "node:string_decoder";
 //#region src/server/helpers.ts
 /**
 * Trims a buffer to at most `limit` trailing bytes without splitting a UTF-8 sequence.
@@ -41,9 +41,12 @@ function trimTail(bytes, limit) {
 * Trims a buffer to at most `limit` leading bytes without splitting a UTF-8 sequence.
 *
 * @remarks
-* Keeps the head — the captured start of a one-shot run's output. When the cut point lands inside
-* a multibyte sequence, the end retreats to the sequence's start so the retained bytes always end
-* on a code-point boundary and decode without a replacement character.
+* Keeps the head — the captured start of a one-shot run's output. The end retreats only when a
+* sequence genuinely spans the cut: the byte at `limit` carries the continuation bit pattern, and a
+* lead byte within the preceding three bytes declares a length that reaches it. The retained bytes
+* then end on a code-point boundary and decode without a replacement character. A byte at `limit`
+* that carries the continuation pattern without such a lead byte is invalid UTF-8 rather than a
+* split sequence, so the full `limit` survives instead of a valid byte being dropped for it.
 *
 * @param bytes - The accumulated bytes
 * @param limit - The maximum retained byte count
@@ -57,13 +60,50 @@ function trimTail(bytes, limit) {
 function trimHead(bytes, limit) {
 	const buffer = Buffer.isBuffer(bytes) ? bytes : Buffer.from(bytes);
 	if (buffer.byteLength <= limit) return buffer;
-	let end = limit;
-	while (end > 0) {
-		const byte = buffer[end];
-		if (byte === void 0 || (byte & 192) !== 128) break;
-		end -= 1;
+	const excluded = buffer[limit];
+	if (excluded === void 0 || (excluded & 192) !== 128) return Buffer.from(buffer.subarray(0, limit));
+	const floor = Math.max(0, limit - 3);
+	let start = limit - 1;
+	while (start >= floor) {
+		const lead = buffer[start];
+		if (lead !== void 0 && (lead & 192) !== 128) {
+			let span = 1;
+			if ((lead & 224) === 192) span = 2;
+			else if ((lead & 240) === 224) span = 3;
+			else if ((lead & 248) === 240) span = 4;
+			if (start + span > limit) return Buffer.from(buffer.subarray(0, start));
+			break;
+		}
+		start -= 1;
 	}
-	return Buffer.from(buffer.subarray(0, end));
+	return Buffer.from(buffer.subarray(0, limit));
+}
+/**
+* Bounds one delivered stream chunk to the bytes a capture still has room for.
+*
+* @remarks
+* A chunk that is not a buffer contributes nothing and reports `undefined` rather than throwing,
+* because a stream `data` listener receives an `unknown` payload. The cut is byte-exact and might
+* land inside a multibyte sequence, because {@link buildExecuteResult} performs the single
+* code-point-boundary trim over the whole capture rather than over each chunk. Give the capture one
+* byte more room than its limit, so that final trim can read the first excluded byte and retreat off
+* a split sequence. A chunk that fits its room is returned as the delivered buffer itself rather
+* than a copy, because a capture appending it copies again and never writes through it; a chunk that
+* overruns its room returns a copy of the bytes that fit. Treat the return as read-only either way.
+*
+* @param chunk - The delivered chunk, ignored when it is not a buffer
+* @param room - The bytes the capture still accepts
+* @returns The bytes to retain, or `undefined` when the chunk contributes none
+*
+* @example
+* ```ts
+* captureChunk(Buffer.from('hello'), 3) // <Buffer 68 65 6c>
+* ```
+*/
+function captureChunk(chunk, room) {
+	if (!Buffer.isBuffer(chunk) || room <= 0) return void 0;
+	if (chunk.byteLength <= room) return chunk;
+	return Buffer.from(chunk.subarray(0, room));
 }
 /**
 * Takes one owned frozen snapshot of a caller's command.
@@ -691,135 +731,424 @@ function buildExecuteResult(input) {
 		truncated: input.truncated
 	});
 }
-//#endregion
-//#region src/server/Process.ts
 /**
-* Supervises one child while keeping every observation channel aligned at termination.
+* Runs one command to completion, buffering its output, and settles with the outcome.
 *
 * @remarks
-* The child's ending and the supervision's ending are distinct. `pid`, `code`, and `signal` read
-* the host child directly, so they expose native exit as soon as the host records it. `settled`,
-* `exit`, `evidence`, and `lines` reach one terminal moment after the read channels close or the
-* bounded `drain` window cuts them off. That window is armed by the child's native exit and by a
-* termination this package initiated, so every way a child can end reaches the moment. The terminal
-* routine freezes `evidence` and ends `lines` before it destroys stdout, stderr, or the emitter, so
-* the push channel never disappears while a pull channel can still change or wait indefinitely.
+* The executable is resolved through {@link buildSpawn}, so no run uses a shell. On a POSIX host the
+* child is detached, which is what lets its whole process group be terminated. Standard output and
+* error are each byte-bounded by `limit` (default {@link PROCESS_OUTPUT}) and `truncated` reports
+* whether either stream exceeded it. Each capture keeps one byte beyond `limit`, so the single
+* code-point-boundary trim in {@link buildExecuteResult} reads the first excluded byte and never
+* delivers a split multibyte sequence. A positive `timeout` and an aborting `signal` both terminate the
+* child through the same bounded stop, and only the earliest is recorded: a timeout reports
+* `expired` and an abort reports `aborted`, never both. After termination the outcome is awaited for
+* a bounded window, so a descendant holding the child's stdio cannot keep the run pending. That bound
+* covers a terminated run alone: a run with no `timeout` and no `signal` settles on stdio completion
+* rather than on process exit, so a descendant that inherited the child's stdio holds the run open
+* after the child itself has gone. Give such a run a `timeout`. The child's `environment` merges over
+* the parent unless the command is `isolated`, then `options.environment` on top, and `options.input`
+* overrides `command.input`. A host fault while writing that input terminates the run by design and
+* marks its result failed; a strict rejection carries the host fault as its cause. This differs
+* from `Process` constructor input, whose package-initiated input phase stays quiet. Unless `strict`
+* is `false`, a failed run rejects with a {@link ProcessError} carrying the {@link ExecuteResult};
+* {@link createExecuteError} constructs every rejection outside the input-fault door. An invalid
+* option or command string rejects before the child is spawned, because an async function cannot
+* throw synchronously.
 *
-* Standard output is framed through `readline` into a single-consumer stream. Lines already framed
-* and queued remain available through the terminal moment, while bytes arriving after a requested
-* termination may be cut off. Standard error is forwarded through the live `stderr` event and
-* retained as a byte-bounded raw tail until that same moment. `stop` ends the child tree and the
-* observation surfaces. `destroy` performs that stop and then destroys the emitter after the
-* frozen terminal state exists.
+* @param command - The executable, arguments, and optional environment and input
+* @param options - Working directory, timeout, grace, signal, capture limit, and failure delivery
+* @returns The settled run outcome
+* @throws A {@link ProcessError} coded `invalid` for a malformed option, command string, or batch-bound argument, or one carrying the {@link ExecuteResult} when the run failed and `strict` is not `false`
 *
 * @example
 * ```ts
-* import { Process } from '@orkestrel/process/server'
-*
-* const child = new Process({
-* 	command: { file: 'node', arguments: ['--version'] },
-* 	workspace: process.cwd(),
-* })
-* const exit = await child.exit
-* await child.destroy()
+* const result = await execute({ file: 'git', arguments: ['status'] }, { workspace: process.cwd() })
 * ```
 */
-var Process = class {
-	#emitter;
-	#child;
-	#reader;
-	#grace;
-	#drain;
-	#evidence;
-	#backlog;
-	#delivery;
-	#decoder = new StringDecoder("utf8");
-	#exit = Promise.withResolvers();
-	#lines;
-	#queue = [];
-	#waiters = [];
-	#signal;
-	#abort;
-	#writes = /* @__PURE__ */ new Map();
-	#tail = Buffer.alloc(0);
-	#head = 0;
-	#pending = 0;
-	#requested = false;
-	#paused = false;
-	#truncated = false;
-	#stopping = false;
-	#settled = false;
-	#ended = false;
-	#input = 0;
-	#failure;
-	#waiting;
-	#termination;
-	#ending;
-	/**
-	* Spawn one child process and begin stream capture.
-	*
-	* @param options - Command, workspace, termination, capture, stdin, and observation settings
-	* @throws A {@link ProcessError} coded `invalid` when an option or command string is malformed
-	*/
-	constructor(options) {
-		const source = options.command;
-		const workspace = options.workspace;
-		const grace = options.grace;
-		const drain = options.drain;
-		const evidence = options.evidence;
-		const backlog = options.backlog;
-		const delivery = options.delivery;
-		const writable = options.writable;
-		const signal = options.signal;
-		const on = options.on;
-		const error = options.error;
-		const command = snapshotCommand(source);
-		const input = command.input;
-		validateCommand(command);
-		validateWorkspace(workspace);
-		validateTimer(grace, "option 'grace'");
-		validateTimer(drain, "option 'drain'");
-		validateTimer(delivery, "option 'delivery'");
-		validateBytes(evidence, "option 'evidence'", 0);
-		validateBytes(backlog, "option 'backlog'", 1);
-		this.#emitter = new Emitter({
-			...on === void 0 ? {} : { on },
-			...error === void 0 ? {} : { error }
-		});
-		this.#grace = grace ?? PROCESS_GRACE;
-		this.#drain = drain ?? PROCESS_DRAIN;
-		this.#evidence = evidence ?? PROCESS_EVIDENCE;
-		this.#backlog = backlog ?? PROCESS_BACKLOG;
-		this.#delivery = delivery ?? 0;
-		this.#signal = signal;
-		this.#lines = Object.freeze({ [Symbol.asyncIterator]: this.#iterate.bind(this) });
-		const childEnvironment = mergeEnvironment(command.isolated === true, command.environment);
-		const plan = buildSpawn(command, {
-			workspace,
-			environment: childEnvironment
+async function execute(command, options) {
+	const snapshot = snapshotCommand(command);
+	const optionEnvironment = options?.environment;
+	const optionWorkspace = options?.workspace;
+	const optionInput = options?.input;
+	const optionTimeout = options?.timeout;
+	const optionGrace = options?.grace;
+	const optionSignal = options?.signal;
+	const optionStrict = options?.strict;
+	const optionLimit = options?.limit;
+	validateCommand(snapshot);
+	validateEnvironment(optionEnvironment);
+	validateWorkspace(optionWorkspace);
+	validateTimer(optionTimeout, "option 'timeout'");
+	validateTimer(optionGrace, "option 'grace'");
+	validateBytes(optionLimit, "option 'limit'", 0);
+	const limit = optionLimit ?? PROCESS_OUTPUT;
+	const grace = optionGrace ?? PROCESS_GRACE;
+	const timeout = optionTimeout ?? 0;
+	const strict = optionStrict ?? true;
+	const text = optionInput ?? snapshot.input;
+	const line = formatCommand(snapshot);
+	const workspace = optionWorkspace ?? process.cwd();
+	const environment = mergeEnvironment(snapshot.isolated === true, snapshot.environment, optionEnvironment);
+	const plan = buildSpawn(snapshot, {
+		workspace,
+		environment
+	});
+	const settled = Promise.withResolvers();
+	const terminate = new AbortController();
+	const cleanup = new AbortController();
+	const finish = new AbortController();
+	const inputFailure = new AbortController();
+	const outChunks = [];
+	const errChunks = [];
+	let spawned = false;
+	let expired = false;
+	let aborted = false;
+	let outRetained = 0;
+	let errRetained = 0;
+	let cause;
+	let timeoutTimer;
+	let confirmTimer;
+	const child = spawn(plan.file, [...plan.arguments], {
+		cwd: workspace,
+		detached: process.platform !== "win32",
+		env: environment,
+		stdio: [
+			"pipe",
+			"pipe",
+			"pipe"
+		],
+		windowsHide: true,
+		windowsVerbatimArguments: plan.verbatim
+	});
+	finish.signal.addEventListener("abort", () => {
+		clearTimeout(timeoutTimer);
+		clearTimeout(confirmTimer);
+		cleanup.abort();
+		settled.resolve(buildExecuteResult({
+			command: line,
+			stdout: Buffer.concat(outChunks),
+			stderr: Buffer.concat(errChunks),
+			code: child.exitCode,
+			signal: child.signalCode,
+			expired,
+			aborted,
+			truncated: outRetained > limit || errRetained > limit,
+			limit,
+			...cause === void 0 ? {} : { cause }
+		}));
+	}, { once: true });
+	terminate.signal.addEventListener("abort", () => {
+		if (finish.signal.aborted) return;
+		clearTimeout(timeoutTimer);
+		cleanup.abort();
+		stopChild(child, grace, PROCESS_CONFIRMATION).then(() => {
+			if (finish.signal.aborted) return;
+			confirmTimer = setTimeout(() => finish.abort(), PROCESS_CONFIRMATION);
 		});
-		this.#child = spawn(plan.file, [...plan.arguments], {
-			cwd: workspace,
-			detached: process.platform !== "win32",
-			env: childEnvironment,
-			stdio: [
-				"pipe",
-				"pipe",
-				"pipe"
-			],
-			windowsHide: true,
-			windowsVerbatimArguments: plan.verbatim
+	}, { once: true });
+	inputFailure.signal.addEventListener("abort", () => {
+		if (finish.signal.aborted) return;
+		cause = inputFailure.signal.reason;
+		terminate.abort();
+	}, { once: true });
+	child.stdin.on("error", (error) => inputFailure.abort(error));
+	child.stdout.on("data", (chunk) => {
+		const captured = captureChunk(chunk, limit + 1 - outRetained);
+		if (captured === void 0) return;
+		outRetained += captured.byteLength;
+		outChunks.push(captured);
+	});
+	child.stderr.on("data", (chunk) => {
+		const captured = captureChunk(chunk, limit + 1 - errRetained);
+		if (captured === void 0) return;
+		errRetained += captured.byteLength;
+		errChunks.push(captured);
+	});
+	child.once("spawn", () => {
+		spawned = true;
+	});
+	child.once("error", (error) => {
+		if (spawned) return;
+		cause = error;
+		finish.abort();
+	});
+	child.once("close", () => finish.abort());
+	if (text !== void 0) child.stdin.write(text, (error) => {
+		if (error !== void 0 && error !== null) inputFailure.abort(error);
+	});
+	child.stdin.end();
+	if (timeout > 0) timeoutTimer = setTimeout(() => {
+		expired = true;
+		terminate.abort();
+	}, timeout);
+	if (optionSignal !== void 0) {
+		optionSignal.addEventListener("abort", () => {
+			aborted = true;
+			terminate.abort();
+		}, {
+			once: true,
+			signal: cleanup.signal
 		});
-		this.#reader = createInterface({
-			input: this.#child.stdout,
-			crlfDelay: Infinity
+		if (optionSignal.aborted) {
+			aborted = true;
+			terminate.abort();
+		}
+	}
+	const result = await settled.promise;
+	if (result.failed && strict) {
+		if (cause !== void 0 && cause === inputFailure.signal.reason) throw new ProcessError(`Command '${result.command}' failed while writing standard input`, {
+			code: "input",
+			context: {
+				command: result.command,
+				code: result.code,
+				signal: result.signal
+			},
+			cause: inputFailure.signal.reason,
+			result
 		});
-		this.#reader.on("line", this.#push.bind(this));
-		this.#reader.once("close", this.#finish.bind(this));
-		this.#child.once("error", (cause) => this.#emitter.emit("error", cause));
+		throw createExecuteError(result, cause);
+	}
+	return result;
+}
+/**
+* Runs one command to completion synchronously, buffering its output, and returns the outcome.
+*
+* @remarks
+* The synchronous counterpart of {@link execute}, spawned through the same resolver and never through a
+* shell. The host offers no cooperative termination window and no in-flight cancellation, so this
+* contract carries neither. A positive `timeout` ends only the root process and can leave
+* descendants running; use {@link execute} or {@link Process} when timeout must terminate the tree. A
+* timeout and an output overflow both end the root with `SIGKILL`: an overflow reports `truncated`
+* and `failed` together and trims the partial output to `limit`, where {@link execute} keeps reading and
+* reports `truncated` without failing. The environment and input follow the same merge as
+* {@link execute}. Unless `strict` is `false`, a failed run throws a {@link createExecuteError}
+* carrying the {@link ExecuteResult}.
+*
+* @param command - The executable, arguments, and optional environment and input
+* @param options - Working directory, timeout, capture limit, and failure delivery
+* @returns The run outcome
+* @throws A {@link ProcessError} coded `invalid` for a malformed option, command string, or batch-bound argument, or one carrying the {@link ExecuteResult} when the run failed and `strict` is not `false`
+*
+* @example
+* ```ts
+* const result = executeSync({ file: 'git', arguments: ['--version'] }, { strict: false })
+* ```
+*/
+function executeSync(command, options) {
+	const snapshot = snapshotCommand(command);
+	const optionEnvironment = options?.environment;
+	const optionWorkspace = options?.workspace;
+	const optionInput = options?.input;
+	const optionTimeout = options?.timeout;
+	const optionStrict = options?.strict;
+	const optionLimit = options?.limit;
+	validateCommand(snapshot);
+	validateEnvironment(optionEnvironment);
+	validateWorkspace(optionWorkspace);
+	validateTimer(optionTimeout, "option 'timeout'");
+	validateBytes(optionLimit, "option 'limit'", 0);
+	const limit = optionLimit ?? PROCESS_OUTPUT;
+	const timeout = optionTimeout ?? 0;
+	const strict = optionStrict ?? true;
+	const text = optionInput ?? snapshot.input;
+	const line = formatCommand(snapshot);
+	const workspace = optionWorkspace ?? process.cwd();
+	const environment = mergeEnvironment(snapshot.isolated === true, snapshot.environment, optionEnvironment);
+	const plan = buildSpawn(snapshot, {
+		workspace,
+		environment
+	});
+	const outcome = spawnSync(plan.file, [...plan.arguments], {
+		cwd: workspace,
+		env: environment,
+		encoding: "buffer",
+		maxBuffer: limit,
+		killSignal: "SIGKILL",
+		windowsHide: true,
+		windowsVerbatimArguments: plan.verbatim,
+		...text !== void 0 ? { input: Buffer.from(text) } : {},
+		...timeout > 0 ? { timeout } : {}
+	});
+	const error = outcome.error;
+	const fault = error !== void 0 && "code" in error && isString(error.code) ? error.code : "";
+	const result = buildExecuteResult({
+		command: line,
+		stdout: Buffer.isBuffer(outcome.stdout) ? outcome.stdout : Buffer.alloc(0),
+		stderr: Buffer.isBuffer(outcome.stderr) ? outcome.stderr : Buffer.alloc(0),
+		code: outcome.status,
+		signal: outcome.signal,
+		expired: fault === "ETIMEDOUT",
+		aborted: false,
+		truncated: fault === "ENOBUFS",
+		limit,
+		...error === void 0 ? {} : { cause: error }
+	});
+	if (result.failed && strict) throw createExecuteError(result, error);
+	return result;
+}
+/**
+* Spawns one command as a detached process and returns without waiting for it.
+*
+* @remarks
+* The child owns no stdio and is unreferenced, so it outlives this process and nothing here observes
+* its outcome. The error listener is attached before the child is unreferenced, so a post-spawn host
+* fault is swallowed rather than crashing the caller; an invalid command is refused before anything
+* is spawned.
+*
+* @param command - The executable, arguments, and optional environment
+* @param options - The working directory the detached child starts in
+* @returns Nothing
+* @throws A {@link ProcessError} coded `invalid` when the working directory or a command string is malformed
+*
+* @example
+* ```ts
+* detach({ file: 'node', arguments: ['daemon.js'] }, { workspace: process.cwd() })
+* ```
+*/
+function detach(command, options) {
+	const snapshot = snapshotCommand(command);
+	const optionWorkspace = options?.workspace;
+	validateCommand(snapshot);
+	validateWorkspace(optionWorkspace);
+	const workspace = optionWorkspace ?? process.cwd();
+	const environment = mergeEnvironment(snapshot.isolated === true, snapshot.environment);
+	const plan = buildSpawn(snapshot, {
+		workspace,
+		environment
+	});
+	const child = spawn(plan.file, [...plan.arguments], {
+		cwd: workspace,
+		detached: true,
+		env: environment,
+		stdio: "ignore",
+		windowsHide: true,
+		windowsVerbatimArguments: plan.verbatim
+	});
+	child.once("error", () => void 0);
+	child.unref();
+}
+//#endregion
+//#region src/server/Supervisor.ts
+/**
+* Supervises one child process and reports each lifecycle moment to the face composing it.
+*
+* @remarks
+* This is the engine every supervised-child face shares. It owns the eager spawn, the byte-bounded
+* stderr tail and its decoded chunks, the standard-input channel and its bounded confirmation, the
+* termination sequence, and the progression from the child's native exit through the bounded `drain`
+* window to one terminal moment. It owns no output framing and no observation surface: a face
+* attaches its own consumer to `stdout`, frames bytes however its contract promises, and owns the
+* emitter and event map its consumers subscribe to.
+*
+* The child's ending and the supervision's ending are distinct. `pid`, `code`, and `signal` read the
+* host child directly, so they expose native exit as soon as the host records it, and `ending`
+* settles at that same moment. `settled`, `exit`, and `evidence` reach one terminal moment after the
+* read channels close or the bounded `drain` window cuts them off. That window is armed by the
+* child's native exit and by a termination this package initiated, so every way a child can end
+* reaches the moment. The terminal routine hands the face its `close` and `terminal` moments before
+* it destroys stdout and stderr, so a face's own pull surfaces are final while its read ends still
+* exist.
+*
+* The face is a set of callbacks rather than an emitter, because each face publishes a different
+* event map over the same moments. `chunk` and `fault` carry the live stderr text and the child or
+* channel faults, `relieve` reports that a termination began so the face can release whatever
+* backpressure it holds, `close` ends the face's read pipeline at the terminal moment, `terminal`
+* carries the frozen {@link ProcessExit}, and `teardown` releases the face's own surface after the
+* termination completes. `relieve` is optional because a face that never pauses the child's output
+* holds no backpressure to release, and a face with nothing to do there would otherwise declare an
+* empty method to say so.
+*/
+var Supervisor = class {
+	#chunk;
+	#fault;
+	#relieve;
+	#close;
+	#terminal;
+	#teardown;
+	#child;
+	#grace;
+	#drain;
+	#evidence;
+	#delivery;
+	#decoder = new StringDecoder("utf8");
+	#exit = Promise.withResolvers();
+	#ending = Promise.withResolvers();
+	#signal;
+	#abort;
+	#writes = /* @__PURE__ */ new Map();
+	#tail = Buffer.alloc(0);
+	#stopping = false;
+	#settled = false;
+	#input = 0;
+	#failure;
+	#waiting;
+	#closure;
+	#termination;
+	#destruction;
+	/**
+	* Spawn one child process and begin standard-error capture.
+	*
+	* @remarks
+	* The face's callbacks are captured before anything is read or spawned, so the first moment the
+	* child can produce already has somewhere to go. `options` supplies the command, workspace,
+	* termination, capture, and standard-input settings; a face's own settings, such as an output
+	* retention bound, are read and validated by that face before it constructs this engine, so an
+	* invalid one refuses construction while nothing has been spawned.
+	*
+	* @param options - Command, workspace, termination, capture, and stdin settings
+	* @param face - The composing face's callbacks for each lifecycle moment
+	* @throws A {@link ProcessError} coded `invalid` when an option or command string is malformed
+	*/
+	constructor(options, face) {
+		this.#chunk = face.chunk;
+		this.#fault = face.fault;
+		this.#relieve = face.relieve;
+		this.#close = face.close;
+		this.#terminal = face.terminal;
+		this.#teardown = face.teardown;
+		const source = options.command;
+		const workspace = options.workspace;
+		const grace = options.grace;
+		const drain = options.drain;
+		const evidence = options.evidence;
+		const delivery = options.delivery;
+		const writable = options.writable;
+		const signal = options.signal;
+		const command = snapshotCommand(source);
+		const input = command.input;
+		validateCommand(command);
+		validateWorkspace(workspace);
+		validateTimer(grace, "option 'grace'");
+		validateTimer(drain, "option 'drain'");
+		validateTimer(delivery, "option 'delivery'");
+		validateBytes(evidence, "option 'evidence'", 0);
+		this.#grace = grace ?? PROCESS_GRACE;
+		this.#drain = drain ?? PROCESS_DRAIN;
+		this.#evidence = evidence ?? PROCESS_EVIDENCE;
+		this.#delivery = delivery ?? 0;
+		this.#signal = signal;
+		const childEnvironment = mergeEnvironment(command.isolated === true, command.environment);
+		const plan = buildSpawn(command, {
+			workspace,
+			environment: childEnvironment
+		});
+		this.#child = spawn(plan.file, [...plan.arguments], {
+			cwd: workspace,
+			detached: process.platform !== "win32",
+			env: childEnvironment,
+			stdio: [
+				"pipe",
+				"pipe",
+				"pipe"
+			],
+			windowsHide: true,
+			windowsVerbatimArguments: plan.verbatim
+		});
+		this.#child.once("error", this.#fault);
 		this.#child.once("exit", this.#expire.bind(this));
-		this.#child.once("close", this.#close.bind(this));
-		this.#child.stdin.on("error", (cause) => this.#failInputStream(cause));
+		this.#child.once("close", this.#complete.bind(this));
+		this.#child.stdin.on("error", this.#failInputStream.bind(this));
 		this.#child.stderr.on("data", this.#retain.bind(this));
 		if (input !== void 0) {
 			this.#input += 1;
@@ -835,6 +1164,10 @@ var Process = class {
 			if (signal.aborted) this.stop();
 		}
 	}
+	/** The child's standard-output stream, for the composing face to attach its own consumer to. */
+	get stdout() {
+		return this.#child.stdout;
+	}
 	/** The host process id, fixed when construction returns, or `undefined` when the spawn produced none. */
 	get pid() {
 		return this.#child.pid;
@@ -847,22 +1180,10 @@ var Process = class {
 	get signal() {
 		return this.#child.signalCode;
 	}
-	/** The typed lifecycle observation surface. */
-	get emitter() {
-		return this.#emitter;
-	}
-	/** The captured stdout lines, in arrival order, ending after queued lines at the terminal moment. */
-	get lines() {
-		return this.#lines;
-	}
 	/** The decoded byte-bounded stderr tail, frozen at the terminal moment. */
 	get evidence() {
 		return this.#tail.toString("utf8");
 	}
-	/** True when the `lines` stream omitted output after a retention bound was reached. */
-	get truncated() {
-		return this.#truncated;
-	}
 	/** True after the terminal moment arrived and `exit` settled. */
 	get settled() {
 		return this.#settled;
@@ -871,34 +1192,43 @@ var Process = class {
 	get stopping() {
 		return this.#stopping;
 	}
+	/**
+	* The child's own ending, awaited without the terminal moment's drain window.
+	*
+	* @remarks
+	* Never rejects, and resolves no value: `code` and `signal` carry the terminal facts as soon as
+	* the host records them. It settles at the native exit, and at the terminal moment for a child
+	* whose spawn produced no native exit at all, so it can never outlive the supervision.
+	*/
+	get ending() {
+		return this.#ending.promise;
+	}
 	/** The terminal child state, observed once after stream close or the drain cutoff. */
 	get exit() {
 		return this.#exit.promise;
 	}
 	/**
-	* Write one line to the open standard-input channel.
+	* Writes raw bytes to the open standard-input channel.
 	*
 	* @remarks
-	* Never rejects. `true` means the host accepted the bytes without reporting a fault; it does not
-	* prove that the child read them. An ordinary write settles when the kernel accepts it. Only a
-	* full pipe can hold the write unconfirmed. The `delivery` option can bound that wait, and every
-	* terminal teardown path settles pending writes. On Windows 11 with Node v24.18.1, measured on
-	* 2026-08-21, a child that closes its own file descriptor 0 can leave the parent pipe writable:
-	* the write can settle `true` without a callback error or a stream error while the child remains
-	* alive. After `stop` or `destroy` begins, a later call settles `false`. Version 0.0.4 could settle
-	* that call `true` before teardown destroyed the pipe; returning `false` avoids claiming delivery
-	* for bytes the package is about to discard.
+	* Never rejects, and adds no framing: a face composes whatever terminator its contract promises
+	* before it calls this. `true` means the host accepted the bytes without reporting a fault; it
+	* does not prove that the child read them. An ordinary write settles when the kernel accepts it.
+	* Only a full pipe can hold the write unconfirmed. The `delivery` option can bound that wait, and
+	* every terminal teardown path settles pending writes. After `stop` or `destroy` begins, a later
+	* call settles `false`, because teardown cannot confirm delivery for bytes it is about to
+	* discard.
 	*
-	* @param text - The line text without its trailing newline
+	* @param bytes - The payload to write, already framed by the caller
 	* @returns True when the host accepted the bytes without reporting a fault; false when the channel was closed, destroyed, ended, failed, or remained unconfirmed through `delivery`
 	*/
-	send(text) {
+	deliver(bytes) {
 		const stdin = this.#child.stdin;
 		if (this.#settled || this.#stopping || this.#failure !== void 0 || !stdin.writable) return Promise.resolve(false);
 		const settled = Promise.withResolvers();
 		this.#writes.set(settled, void 0);
 		try {
-			stdin.write(`${text}\n`, this.#confirmWrite.bind(this, settled));
+			stdin.write(bytes, this.#confirmWrite.bind(this, settled));
 		} catch {
 			this.#settleWrite(settled, false);
 			return settled.promise;
@@ -911,6 +1241,28 @@ var Process = class {
 		return settled.promise;
 	}
 	/**
+	* Closes the standard-input channel while leaving the child running.
+	*
+	* @remarks
+	* Never rejects, and terminates nothing: no signal is sent, `stopping` stays false, no drain
+	* window is armed, and the terminal moment does not arrive. The child observes end of input and
+	* decides for itself what to do about it, which is what separates this from `stop`.
+	*
+	* Every call shares one barrier, and it resolves after the host flushes the writes it had already
+	* accepted, or reports that it cannot. A `deliver` after this call resolves `false`, because the
+	* host stops reporting the channel writable the moment it is ended. That same flag keeps the
+	* ended channel quiet for its remaining life, so a later host fault on it settles pending writes
+	* and reaches no face. After `stop` or `destroy` has begun, or after the terminal moment, the
+	* call resolves and changes nothing, because the channel is already being discarded.
+	*
+	* @returns The stable barrier shared by every call
+	*/
+	end() {
+		if (this.#closure !== void 0) return this.#closure;
+		this.#closure = this.#endInput();
+		return this.#closure;
+	}
+	/**
 	* Terminates the child process tree and reaches the terminal observation moment.
 	*
 	* @remarks
@@ -927,7 +1279,7 @@ var Process = class {
 		return this.#termination;
 	}
 	/**
-	* Stops the child and destroys the observation emitter after the terminal state freezes.
+	* Stops the child and releases the composing face after the terminal state freezes.
 	*
 	* @remarks
 	* Always resolves, including when termination was never confirmed. Every call shares one barrier.
@@ -935,95 +1287,22 @@ var Process = class {
 	* @returns The stable barrier shared by every call
 	*/
 	destroy() {
-		if (this.#ending !== void 0) return this.#ending;
-		this.#ending = this.#end();
-		return this.#ending;
+		if (this.#destruction !== void 0) return this.#destruction;
+		this.#destruction = this.#conclude();
+		return this.#destruction;
 	}
-	#iterate() {
-		this.#requested = true;
-		return Object.freeze({ next: this.#next.bind(this) });
+	#retain(chunk) {
+		if (!Buffer.isBuffer(chunk) || this.#settled) return;
+		this.#tail = trimTail(Buffer.concat([this.#tail, chunk]), this.#evidence);
+		const text = this.#decoder.write(chunk);
+		if (text.length > 0) this.#chunk(text);
 	}
-	#next() {
-		const line = this.#take();
-		if (line !== void 0) return Promise.resolve(Object.freeze({
-			done: false,
-			value: line
-		}));
-		if (this.#ended) return Promise.resolve(Object.freeze({
-			done: true,
-			value: void 0
-		}));
-		const waiter = Promise.withResolvers();
-		this.#waiters.push(waiter);
-		return waiter.promise;
-	}
-	#take() {
-		if (this.#head >= this.#queue.length) return void 0;
-		const line = this.#queue[this.#head];
-		this.#queue[this.#head] = "";
-		this.#head += 1;
-		if (this.#head >= this.#queue.length) {
-			this.#queue.length = 0;
-			this.#head = 0;
-		}
-		if (line === void 0) return void 0;
-		this.#pending -= Buffer.byteLength(line) + 1;
-		this.#relieve();
-		return line;
-	}
-	#push(line) {
-		if (this.#ended) return;
-		const waiter = this.#waiters.shift();
-		if (waiter !== void 0) {
-			waiter.resolve(Object.freeze({
-				done: false,
-				value: line
-			}));
-			return;
-		}
-		const bytes = Buffer.byteLength(line) + 1;
-		const limit = this.#stopping ? this.#backlog * 2 : this.#backlog;
-		if ((!this.#requested || this.#stopping) && this.#pending + bytes > limit) {
-			this.#truncated = true;
-			return;
-		}
-		this.#queue.push(line);
-		this.#pending += bytes;
-		this.#restrain();
-	}
-	#restrain() {
-		if (this.#paused || this.#stopping || !this.#requested) return;
-		if (this.#pending < this.#backlog) return;
-		this.#paused = true;
-		this.#reader.pause();
-	}
-	#relieve() {
-		if (!this.#paused || this.#ended) return;
-		if (!this.#stopping && this.#pending > this.#backlog / 2) return;
-		this.#paused = false;
-		this.#reader.resume();
-	}
-	#finish() {
-		if (this.#ended) return;
-		this.#ended = true;
-		this.#paused = false;
-		for (const waiter of this.#waiters) waiter.resolve(Object.freeze({
-			done: true,
-			value: void 0
-		}));
-		this.#waiters.length = 0;
-	}
-	#retain(chunk) {
-		if (!Buffer.isBuffer(chunk) || this.#settled) return;
-		this.#tail = trimTail(Buffer.concat([this.#tail, chunk]), this.#evidence);
-		const text = this.#decoder.write(chunk);
-		if (text.length > 0) this.#emitter.emit("stderr", text);
-	}
-	#close() {
+	#complete() {
 		if (this.#settled) return;
 		this.#settle(true);
 	}
 	#expire() {
+		this.#ending.resolve();
 		if (this.#settled) return;
 		this.#wait();
 	}
@@ -1035,17 +1314,18 @@ var Process = class {
 	}
 	#settle(drained) {
 		const suffix = this.#decoder.end();
-		if (suffix.length > 0) this.#emitter.emit("stderr", suffix);
+		if (suffix.length > 0) this.#chunk(suffix);
 		this.#settled = true;
 		this.#removeAbortListener();
-		this.#reader.close();
+		this.#close();
 		const exit = Object.freeze({
 			code: this.code,
 			signal: this.signal,
 			drained
 		});
 		this.#exit.resolve(exit);
-		this.#emitter.emit("exit", exit);
+		this.#ending.resolve();
+		this.#terminal(exit);
 		this.#child.stdout.destroy();
 		this.#child.stderr.destroy();
 	}
@@ -1066,6 +1346,13 @@ var Process = class {
 	#completeInput() {
 		this.#input -= 1;
 	}
+	#endInput() {
+		const stdin = this.#child.stdin;
+		if (this.#stopping || this.#settled || stdin.writableEnded || stdin.destroyed) return Promise.resolve();
+		const ended = Promise.withResolvers();
+		stdin.end(() => ended.resolve());
+		return ended.promise;
+	}
 	#settleWrite(settled, accepted) {
 		if (!this.#writes.has(settled)) return;
 		const timer = this.#writes.get(settled);
@@ -1077,34 +1364,28 @@ var Process = class {
 		for (const settled of this.#writes.keys()) this.#settleWrite(settled, false);
 	}
 	#failInputStream(cause) {
-		if (this.#child.stdin.writableEnded || this.#input > 0) {
+		if (this.#input > 0) {
 			this.#settleWrites();
 			return;
 		}
 		this.#failInputCallback(cause);
 	}
 	#failInputCallback(cause) {
+		if (this.#child.stdin.writableEnded) {
+			this.#settleWrites();
+			return;
+		}
 		if (this.#failure !== void 0 || this.#stopping) return;
 		this.#failure = cause;
 		this.#settleWrites();
-		this.#emitter.emit("error", new ProcessError("The standard-input channel failed", {
+		this.#fault(new ProcessError("The standard-input channel failed", {
 			code: "protocol",
 			cause
 		}));
 	}
-	#capBacklog() {
-		const limit = this.#backlog * 2;
-		while (this.#pending > limit && this.#queue.length > this.#head) {
-			const line = this.#queue.pop();
-			if (line === void 0) break;
-			this.#pending -= Buffer.byteLength(line) + 1;
-			this.#truncated = true;
-		}
-	}
 	async #kill() {
 		this.#stopping = true;
-		this.#capBacklog();
-		this.#relieve();
+		this.#relieve?.();
 		const confirmed = await stopChild(this.#child, this.#grace, PROCESS_CONFIRMATION);
 		this.#settleWrites();
 		this.#child.stdin.destroy();
@@ -1112,97 +1393,386 @@ var Process = class {
 		if (!this.#settled) this.#settle(false);
 		return confirmed;
 	}
-	async #end() {
+	async #conclude() {
 		await this.stop();
-		this.#emitter.destroy();
+		this.#teardown();
 	}
 };
 //#endregion
-//#region src/server/ProcessManager.ts
+//#region src/server/Process.ts
 /**
-* A keyed registry of live supervised child processes.
+* Supervises one child while keeping every observation channel aligned at termination.
 *
 * @remarks
-* A child launched under an id joins the registry and emits `launch`; when it settles it removes
-* itself and emits `exit`, so `count` and `processes` reflect only live children. The id is reserved
-* before the child is constructed and released when construction throws, so a refused launch never
-* strands its key. Eviction follows the child's own `exit` promise, which no listener can forge, so
-* it lands one microtask after the child's public `exit` event: a listener on that event still sees
-* the child registered. `launch` throws a {@link createDuplicateError} when the id is already live
-* and a {@link createProtocolError} after `destroy` has begun, including when the caller's own option
-* getter begins that teardown mid-construction — a spawn fault surfaces through the returned child's
-* `exit`, never from `launch`. `destroy` awaits every child's own teardown, including the teardown
-* of a child a lost race refused, which destroys each child's observation emitter and leaves every
-* subscription on it silently inert, then destroys the registry emitter last.
+* The child's ending and the supervision's ending are distinct. `pid`, `code`, and `signal` read
+* the host child directly, so they expose native exit as soon as the host records it. `settled`,
+* `exit`, `evidence`, and `lines` reach one terminal moment after the read channels close or the
+* bounded `drain` window cuts them off. That window is armed by the child's native exit and by a
+* termination this package initiated, so every way a child can end reaches the moment. The terminal
+* routine freezes `evidence` and ends `lines` before it destroys stdout, stderr, or the emitter, so
+* the push channel never disappears while a pull channel can still change or wait indefinitely.
+*
+* Standard output is framed through `readline` into a single-consumer stream. Lines already framed
+* and queued remain available through the terminal moment, while bytes arriving after a requested
+* termination may be cut off. Standard error is forwarded through the live `stderr` event and
+* retained as a byte-bounded raw tail until that same moment. `stop` ends the child tree and the
+* observation surfaces. `destroy` performs that stop and then destroys the emitter after the
+* frozen terminal state exists.
 *
 * @example
 * ```ts
-* import { ProcessManager } from '@orkestrel/process/server'
+* import { Process } from '@orkestrel/process/server'
 *
-* const manager = new ProcessManager()
-* const child = manager.launch('build', {
-* 	command: { file: 'node', arguments: ['build.js'] },
+* const child = new Process({
+* 	command: { file: 'node', arguments: ['--version'] },
 * 	workspace: process.cwd(),
 * })
-* await child.exit
-* await manager.destroy()
+* const exit = await child.exit
+* await child.destroy()
 * ```
 */
-var ProcessManager = class {
+var Process = class {
 	#emitter;
-	#children = /* @__PURE__ */ new Map();
-	#ids = /* @__PURE__ */ new Set();
-	#orphans = /* @__PURE__ */ new Set();
-	#destroying = false;
-	#ending;
+	#engine;
+	#reader;
+	#backlog;
+	#lines;
+	#queue = [];
+	#waiters = [];
+	#head = 0;
+	#pending = 0;
+	#requested = false;
+	#paused = false;
+	#truncated = false;
+	#ended = false;
 	/**
-	* Construct a process registry.
+	* Spawn one child process and begin stream capture.
 	*
-	* @param options - Initial fleet-level observation hooks and listener-error handling
+	* @param options - Command, workspace, termination, capture, stdin, and observation settings
+	* @throws A {@link ProcessError} coded `invalid` when an option or command string is malformed
 	*/
 	constructor(options) {
-		const on = options?.on;
-		const error = options?.error;
+		const source = options.command;
+		const workspace = options.workspace;
+		const grace = options.grace;
+		const drain = options.drain;
+		const evidence = options.evidence;
+		const backlog = options.backlog;
+		const delivery = options.delivery;
+		const writable = options.writable;
+		const signal = options.signal;
+		const on = options.on;
+		const error = options.error;
+		const command = snapshotCommand(source);
+		validateCommand(command);
+		validateWorkspace(workspace);
+		validateTimer(grace, "option 'grace'");
+		validateTimer(drain, "option 'drain'");
+		validateTimer(delivery, "option 'delivery'");
+		validateBytes(evidence, "option 'evidence'", 0);
+		validateBytes(backlog, "option 'backlog'", 1);
 		this.#emitter = new Emitter({
 			...on === void 0 ? {} : { on },
 			...error === void 0 ? {} : { error }
 		});
+		this.#backlog = backlog ?? PROCESS_BACKLOG;
+		this.#lines = Object.freeze({ [Symbol.asyncIterator]: this.#iterate.bind(this) });
+		this.#engine = new Supervisor({
+			command,
+			workspace,
+			...grace === void 0 ? {} : { grace },
+			...drain === void 0 ? {} : { drain },
+			...evidence === void 0 ? {} : { evidence },
+			...delivery === void 0 ? {} : { delivery },
+			...writable === void 0 ? {} : { writable },
+			...signal === void 0 ? {} : { signal }
+		}, {
+			chunk: this.#reportStderr.bind(this),
+			fault: this.#reportFault.bind(this),
+			relieve: this.#releaseBackpressure.bind(this),
+			close: this.#closeReader.bind(this),
+			terminal: this.#reportExit.bind(this),
+			teardown: this.#emitter.destroy.bind(this.#emitter)
+		});
+		this.#reader = createInterface({
+			input: this.#engine.stdout,
+			crlfDelay: Infinity
+		});
+		this.#reader.on("line", this.#push.bind(this));
+		this.#reader.once("close", this.#finish.bind(this));
 	}
-	/** The typed fleet-level observation surface. */
+	/** The host process id, fixed when construction returns, or `undefined` when the spawn produced none. */
+	get pid() {
+		return this.#engine.pid;
+	}
+	/** The exit code the host recorded, or `null` while the child has not exited and when a signal ended it. */
+	get code() {
+		return this.#engine.code;
+	}
+	/** The terminating signal name the host recorded, or `null` while the child has not exited and when it exited on its own. */
+	get signal() {
+		return this.#engine.signal;
+	}
+	/** The typed lifecycle observation surface. */
 	get emitter() {
 		return this.#emitter;
 	}
-	/** The number of live children. */
-	get count() {
-		return this.#children.size;
+	/** The captured stdout lines, in arrival order, ending after queued lines at the terminal moment. */
+	get lines() {
+		return this.#lines;
+	}
+	/** The decoded byte-bounded stderr tail, frozen at the terminal moment. */
+	get evidence() {
+		return this.#engine.evidence;
+	}
+	/** True when the `lines` stream omitted output after a retention bound was reached. */
+	get truncated() {
+		return this.#truncated;
+	}
+	/** True after the terminal moment arrived and `exit` settled. */
+	get settled() {
+		return this.#engine.settled;
+	}
+	/** True after termination began, including after the terminal moment. */
+	get stopping() {
+		return this.#engine.stopping;
+	}
+	/** The terminal child state, observed once after stream close or the drain cutoff. */
+	get exit() {
+		return this.#engine.exit;
 	}
 	/**
-	* The live child under `id`, or `undefined` when none is.
+	* Write one line to the open standard-input channel.
 	*
-	* @param id - The registry key
-	* @returns The child, or `undefined`
+	* @remarks
+	* Never rejects. `true` means the host accepted the bytes without reporting a fault; it does not
+	* prove that the child read them. An ordinary write settles when the kernel accepts it. Only a
+	* full pipe can hold the write unconfirmed. The `delivery` option can bound that wait, and every
+	* terminal teardown path settles pending writes. On Windows 11 with Node v24.18.1, measured on
+	* 2026-08-21, a child that closes its own file descriptor 0 can leave the parent pipe writable:
+	* the write can settle `true` without a callback error or a stream error while the child remains
+	* alive. After `stop` or `destroy` begins, a later call settles `false`. Version 0.0.4 could settle
+	* that call `true` before teardown destroyed the pipe; returning `false` avoids claiming delivery
+	* for bytes the package is about to discard.
+	*
+	* @param text - The line text without its trailing newline
+	* @returns True when the host accepted the bytes without reporting a fault; false when the channel was closed, destroyed, ended, failed, or remained unconfirmed through `delivery`
 	*/
-	process(id) {
-		return this.#children.get(id);
+	send(text) {
+		return this.#engine.deliver(Buffer.from(`${text}\n`, "utf8"));
 	}
 	/**
-	* A snapshot of every live child.
+	* Terminates the child process tree and reaches the terminal observation moment.
 	*
-	* @returns The live children in launch order
+	* @remarks
+	* Never rejects, and every call shares one termination. After the termination sequence returns,
+	* confirmed or not, it waits at most `drain` for the read channels to close, then cuts them off
+	* and settles `exit` when they remain open. A cutoff reached before the native exit reports the
+	* `code` and `signal` the host had recorded by then, which is `null` for a child still running.
+	*
+	* @returns True when the child's native exit was observed; false when the confirmation deadline elapsed without it
 	*/
-	processes() {
-		return [...this.#children.values()];
+	stop() {
+		return this.#engine.stop();
 	}
 	/**
-	* Spawn and register one child under `id`.
+	* Stops the child and destroys the observation emitter after the terminal state freezes.
 	*
 	* @remarks
-	* {@link Process} reads every option before it spawns, so a caller's own option getter runs while
-	* nothing has started and a throw from one strands no process. A getter that begins `destroy`
-	* without throwing is the one remaining race: the child is already spawned, so the launch is
-	* refused with a {@link createProtocolError} and that child is destroyed rather than adopted, its
-	* teardown bounded by `grace` plus the confirmation window. The `protocol` refusal throws
-	* synchronously, and the `destroy` barrier covers that teardown, so the refused child reaches its
+	* Always resolves, including when termination was never confirmed. Every call shares one barrier.
+	*
+	* @returns The stable barrier shared by every call
+	*/
+	destroy() {
+		return this.#engine.destroy();
+	}
+	#iterate() {
+		this.#requested = true;
+		return Object.freeze({ next: this.#next.bind(this) });
+	}
+	#next() {
+		const line = this.#take();
+		if (line !== void 0) return Promise.resolve(Object.freeze({
+			done: false,
+			value: line
+		}));
+		if (this.#ended) return Promise.resolve(Object.freeze({
+			done: true,
+			value: void 0
+		}));
+		const waiter = Promise.withResolvers();
+		this.#waiters.push(waiter);
+		return waiter.promise;
+	}
+	#take() {
+		if (this.#head >= this.#queue.length) return void 0;
+		const line = this.#queue[this.#head];
+		this.#queue[this.#head] = "";
+		this.#head += 1;
+		if (this.#head >= this.#queue.length) {
+			this.#queue.length = 0;
+			this.#head = 0;
+		}
+		if (line === void 0) return void 0;
+		this.#pending -= Buffer.byteLength(line) + 1;
+		this.#relieve();
+		return line;
+	}
+	#push(line) {
+		if (this.#ended) return;
+		const waiter = this.#waiters.shift();
+		if (waiter !== void 0) {
+			waiter.resolve(Object.freeze({
+				done: false,
+				value: line
+			}));
+			return;
+		}
+		const bytes = Buffer.byteLength(line) + 1;
+		const stopping = this.#engine.stopping;
+		const limit = stopping ? this.#backlog * 2 : this.#backlog;
+		if ((!this.#requested || stopping) && this.#pending + bytes > limit) {
+			this.#truncated = true;
+			return;
+		}
+		this.#queue.push(line);
+		this.#pending += bytes;
+		this.#restrain();
+	}
+	#restrain() {
+		if (this.#paused || this.#engine.stopping || !this.#requested) return;
+		if (this.#pending < this.#backlog) return;
+		this.#paused = true;
+		this.#reader.pause();
+	}
+	#relieve() {
+		if (!this.#paused || this.#ended) return;
+		if (!this.#engine.stopping && this.#pending > this.#backlog / 2) return;
+		this.#paused = false;
+		this.#reader.resume();
+	}
+	#finish() {
+		if (this.#ended) return;
+		this.#ended = true;
+		this.#paused = false;
+		for (const waiter of this.#waiters) waiter.resolve(Object.freeze({
+			done: true,
+			value: void 0
+		}));
+		this.#waiters.length = 0;
+	}
+	#reportStderr(chunk) {
+		this.#emitter.emit("stderr", chunk);
+	}
+	#reportFault(cause) {
+		this.#emitter.emit("error", cause);
+	}
+	#reportExit(exit) {
+		this.#emitter.emit("exit", exit);
+	}
+	#closeReader() {
+		this.#reader.close();
+	}
+	#releaseBackpressure() {
+		this.#capBacklog();
+		this.#relieve();
+	}
+	#capBacklog() {
+		const limit = this.#backlog * 2;
+		while (this.#pending > limit && this.#queue.length > this.#head) {
+			const line = this.#queue.pop();
+			if (line === void 0) break;
+			this.#pending -= Buffer.byteLength(line) + 1;
+			this.#truncated = true;
+		}
+	}
+};
+//#endregion
+//#region src/server/ProcessManager.ts
+/**
+* A keyed registry of live supervised child processes.
+*
+* @remarks
+* A child launched under an id joins the registry and emits `launch`; when it settles it removes
+* itself and emits `exit`, so `count` and `processes` reflect only live children. The id is reserved
+* before the child is constructed and released when construction throws, so a refused launch never
+* strands its key. Eviction follows the child's own `exit` promise, which no listener can forge, so
+* it lands one microtask after the child's public `exit` event: a listener on that event still sees
+* the child registered. `launch` throws a {@link createDuplicateError} when the id is already live
+* and a {@link createProtocolError} after `destroy` has begun, including when the caller's own option
+* getter begins that teardown mid-construction — a spawn fault surfaces through the returned child's
+* `exit`, never from `launch`. `destroy` awaits every child's own teardown, including the teardown
+* of a child a lost race refused, which destroys each child's observation emitter and leaves every
+* subscription on it silently inert, then destroys the registry emitter last.
+*
+* @example
+* ```ts
+* import { ProcessManager } from '@orkestrel/process/server'
+*
+* const manager = new ProcessManager()
+* const child = manager.launch('build', {
+* 	command: { file: 'node', arguments: ['build.js'] },
+* 	workspace: process.cwd(),
+* })
+* await child.exit
+* await manager.destroy()
+* ```
+*/
+var ProcessManager = class {
+	#emitter;
+	#children = /* @__PURE__ */ new Map();
+	#ids = /* @__PURE__ */ new Set();
+	#orphans = /* @__PURE__ */ new Set();
+	#destroying = false;
+	#ending;
+	/**
+	* Construct a process registry.
+	*
+	* @param options - Initial fleet-level observation hooks and listener-error handling
+	*/
+	constructor(options) {
+		const on = options?.on;
+		const error = options?.error;
+		this.#emitter = new Emitter({
+			...on === void 0 ? {} : { on },
+			...error === void 0 ? {} : { error }
+		});
+	}
+	/** The typed fleet-level observation surface. */
+	get emitter() {
+		return this.#emitter;
+	}
+	/** The number of live children. */
+	get count() {
+		return this.#children.size;
+	}
+	/**
+	* The live child under `id`, or `undefined` when none is.
+	*
+	* @param id - The registry key
+	* @returns The child, or `undefined`
+	*/
+	process(id) {
+		return this.#children.get(id);
+	}
+	/**
+	* A snapshot of every live child.
+	*
+	* @returns The live children in launch order
+	*/
+	processes() {
+		return [...this.#children.values()];
+	}
+	/**
+	* Spawn and register one child under `id`.
+	*
+	* @remarks
+	* {@link Process} reads every option before it spawns, so a caller's own option getter runs while
+	* nothing has started and a throw from one strands no process. A getter that begins `destroy`
+	* without throwing is the one remaining race: the child is already spawned, so the launch is
+	* refused with a {@link createProtocolError} and that child is destroyed rather than adopted, its
+	* teardown bounded by `grace` plus the confirmation window. The `protocol` refusal throws
+	* synchronously, and the `destroy` barrier covers that teardown, so the refused child reaches its
 	* terminal moment before the barrier resolves.
 	*
 	* @param id - The registry key, unique among live children
@@ -1285,381 +1855,243 @@ var ProcessManager = class {
 	}
 };
 //#endregion
-//#region src/server/factories.ts
+//#region src/server/Session.ts
 /**
-* Creates one supervised child process.
+* Supervises one child and publishes its standard output as raw bytes.
 *
-* @param options - Command, workspace, termination, evidence, stdin, and observation settings
-* @returns The launched {@link ProcessInterface}
+* @remarks
+* This is the transport face of the supervision engine `Process` also composes. It frames nothing,
+* retains nothing, and decodes nothing on the output side: every chunk the host delivers becomes one
+* `stdout` event carrying that chunk's bytes, in arrival order, so a consumer speaking a
+* length-prefixed or delimiter-framed protocol reads exactly what the child wrote and frames it
+* itself. Standard error is decoded and forwarded as `stderr`, with the same byte-bounded `evidence`
+* tail a `Process` retains, because a diagnostic stream is read rather than parsed.
+*
+* Each emitted chunk is this session's own copy, and a plain `Uint8Array` rather than the host buffer
+* the read produced, so a consumer keeps it, mutates it, concatenates it, and reads its whole backing
+* buffer without reaching memory the host still manages and without depending on a host type.
+*
+* The standard-input channel is open from the spawn, and `end` closes it without terminating
+* anything. That is the member a cooperative protocol reaches for: the child observes end of input
+* and exits on its own, which `ending` reports. `stop` and `destroy` remain the terminations, and
+* `exit` remains the terminal moment — the native exit plus at most `drain` while a descendant holds
+* the inherited read ends.
 *
 * @example
 * ```ts
-* import { createProcess } from '@orkestrel/process/server'
+* import { Session } from '@orkestrel/process/server'
 *
-* const child = createProcess({
-* 	command: { file: 'node', arguments: ['--version'] },
+* const session = new Session({
+* 	command: { file: 'node', arguments: ['-e', 'process.stdin.pipe(process.stdout)'] },
 * 	workspace: process.cwd(),
-* 	grace: 5000,
 * })
 * ```
 */
-function createProcess(options) {
-	return new Process(options);
-}
-/**
-* Creates one keyed registry of supervised child processes.
-*
-* @param options - Initial fleet-level observation hooks and listener-error handling
-* @returns The {@link ProcessManagerInterface} registry
-*
-* @example
-* ```ts
-* import { createProcessManager } from '@orkestrel/process/server'
-*
-* const manager = createProcessManager()
-* ```
-*/
-function createProcessManager(options) {
-	return new ProcessManager(options);
-}
-//#endregion
-//#region src/server/Retention.ts
-/**
-* Accumulates byte totals while retaining a bounded stream head.
-*
-* @example
-* ```ts
-* const retention = new Retention()
-* retention.retain(Buffer.from('hello'), 3)?.toString('utf8') // 'hel'
-* retention.retained // 3
-* ```
-*/
-var Retention = class {
-	#delivered = 0;
-	#retained = 0;
-	/** The bytes delivered by the stream. */
-	get delivered() {
-		return this.#delivered;
-	}
-	/** The bytes retained from the stream head. */
-	get retained() {
-		return this.#retained;
-	}
+var Session = class {
+	#emitter;
+	#engine;
+	#output;
 	/**
-	* Retains a delivered chunk within a byte limit.
+	* Spawn one child process and begin byte capture.
 	*
-	* @param chunk - The delivered chunk, ignored when it is not a buffer
-	* @param limit - The maximum retained byte count
-	* @returns The retained slice, or `undefined` when the chunk contributes no retained bytes
+	* @param options - Command, workspace, termination, evidence, stdin, and observation settings
+	* @throws A {@link ProcessError} coded `invalid` when an option or command string is malformed
 	*/
-	retain(chunk, limit) {
-		if (!Buffer.isBuffer(chunk)) return void 0;
-		this.#delivered += chunk.byteLength;
-		const room = limit - this.#retained;
-		if (room <= 0) return void 0;
-		const slice = chunk.byteLength <= room ? chunk : Buffer.from(chunk.subarray(0, room));
-		this.#retained += slice.byteLength;
-		return slice;
+	constructor(options) {
+		const command = options.command;
+		const workspace = options.workspace;
+		const grace = options.grace;
+		const drain = options.drain;
+		const evidence = options.evidence;
+		const delivery = options.delivery;
+		const signal = options.signal;
+		const on = options.on;
+		const error = options.error;
+		this.#emitter = new Emitter({
+			...on === void 0 ? {} : { on },
+			...error === void 0 ? {} : { error }
+		});
+		this.#output = this.#publish.bind(this);
+		this.#engine = new Supervisor({
+			command,
+			workspace,
+			writable: true,
+			...grace === void 0 ? {} : { grace },
+			...drain === void 0 ? {} : { drain },
+			...evidence === void 0 ? {} : { evidence },
+			...delivery === void 0 ? {} : { delivery },
+			...signal === void 0 ? {} : { signal }
+		}, {
+			chunk: this.#reportStderr.bind(this),
+			fault: this.#reportFault.bind(this),
+			close: this.#closeOutput.bind(this),
+			terminal: this.#reportExit.bind(this),
+			teardown: this.#emitter.destroy.bind(this.#emitter)
+		});
+		this.#engine.stdout.on("data", this.#output);
 	}
-};
-//#endregion
-//#region src/server/execution/execute.ts
-/**
-* Runs one command to completion, buffering its output, and settles with the outcome.
-*
-* @remarks
-* The executable is resolved through {@link buildSpawn}, so no run uses a shell. On a POSIX host the
-* child is detached, which is what lets its whole process group be terminated. Standard output and
-* error are each byte-bounded by `limit` (default {@link PROCESS_OUTPUT}) and `truncated` reports
-* whether either stream exceeded it. A positive `timeout` and an aborting `signal` both terminate the
-* child through the same bounded stop, and only the earliest is recorded: a timeout reports
-* `expired` and an abort reports `aborted`, never both. After termination the outcome is awaited for
-* a bounded window, so a descendant holding the child's stdio cannot keep the run pending. That bound
-* covers a terminated run alone: a run with no `timeout` and no `signal` settles on stdio completion
-* rather than on process exit, so a descendant that inherited the child's stdio holds the run open
-* after the child itself has gone. Give such a run a `timeout`. The child's `environment` merges over
-* the parent unless the command is `isolated`, then `options.environment` on top, and `options.input`
-* overrides `command.input`. A host fault while writing that input terminates the run by design and
-* marks its result failed; a strict rejection carries the host fault as its cause. This differs
-* from `Process` constructor input, whose package-initiated input phase stays quiet. Unless `strict`
-* is `false`, a failed run rejects with a {@link ProcessError} carrying the {@link ExecuteResult};
-* {@link createExecuteError} constructs every rejection outside the input-fault door. An invalid
-* option or command string rejects before the child is spawned, because an async function cannot
-* throw synchronously.
+	/** The host process id, fixed when construction returns, or `undefined` when the spawn produced none. */
+	get pid() {
+		return this.#engine.pid;
+	}
+	/** The exit code the host recorded, or `null` while the child has not exited and when a signal ended it. */
+	get code() {
+		return this.#engine.code;
+	}
+	/** The terminating signal name the host recorded, or `null` while the child has not exited and when it exited on its own. */
+	get signal() {
+		return this.#engine.signal;
+	}
+	/** The typed lifecycle observation surface. */
+	get emitter() {
+		return this.#emitter;
+	}
+	/** The decoded byte-bounded stderr tail, frozen at the terminal moment. */
+	get evidence() {
+		return this.#engine.evidence;
+	}
+	/** True after the terminal moment arrived and `exit` settled. */
+	get settled() {
+		return this.#engine.settled;
+	}
+	/** True after termination began, including after the terminal moment. `end` never turns it true. */
+	get stopping() {
+		return this.#engine.stopping;
+	}
+	/** The child's own ending, awaited without the terminal moment's drain window. */
+	get ending() {
+		return this.#engine.ending;
+	}
+	/** The terminal child state, observed once after stream close or the drain cutoff. */
+	get exit() {
+		return this.#engine.exit;
+	}
+	/**
+	* Writes raw bytes to the open standard-input channel.
+	*
+	* @remarks
+	* Never rejects, and appends no terminator: the child receives exactly these bytes. `true` means
+	* the host accepted them without reporting a fault; it does not prove that the child read them.
+	* The channel can queue the payload, so treat the array as owned by the channel until the
+	* returned promise settles.
+	*
+	* @param bytes - The payload to write, already framed by the caller
+	* @returns True when the host accepted the bytes without reporting a fault; false when the channel was closed, destroyed, ended, failed, or remained unconfirmed through `delivery`
+	*/
+	write(bytes) {
+		return this.#engine.deliver(bytes);
+	}
+	/**
+	* Closes the standard-input channel and leaves the child running.
+	*
+	* @remarks
+	* Never rejects and terminates nothing: `stopping` stays false and the terminal moment does not
+	* arrive. Every call shares one barrier, which resolves after the host flushes the writes it had
+	* already accepted. A later `write` resolves `false`.
+	*
+	* @returns The stable barrier shared by every call
+	*/
+	end() {
+		return this.#engine.end();
+	}
+	/**
+	* Terminates the child process tree and reaches the terminal observation moment.
+	*
+	* @remarks
+	* Never rejects, and every call shares one termination bounded by `grace` and `drain`.
+	*
+	* @returns True when the child's native exit was observed; false when the confirmation deadline elapsed without it
+	*/
+	stop() {
+		return this.#engine.stop();
+	}
+	/**
+	* Stops the child and destroys the observation emitter after the terminal state freezes.
+	*
+	* @remarks
+	* Always resolves, including when termination was never confirmed. Every call shares one barrier.
+	*
+	* @returns The stable barrier shared by every call
+	*/
+	destroy() {
+		return this.#engine.destroy();
+	}
+	#publish(chunk) {
+		if (!Buffer.isBuffer(chunk) || this.#engine.settled) return;
+		this.#emitter.emit("stdout", new Uint8Array(chunk));
+	}
+	#reportStderr(chunk) {
+		this.#emitter.emit("stderr", chunk);
+	}
+	#reportFault(cause) {
+		this.#emitter.emit("error", cause);
+	}
+	#reportExit(exit) {
+		this.#emitter.emit("exit", exit);
+	}
+	#closeOutput() {
+		this.#engine.stdout.off("data", this.#output);
+	}
+};
+//#endregion
+//#region src/server/factories.ts
+/**
+* Creates one supervised child process.
 *
-* @param command - The executable, arguments, and optional environment and input
-* @param options - Working directory, timeout, grace, signal, capture limit, and failure delivery
-* @returns The settled run outcome
-* @throws A {@link ProcessError} coded `invalid` for a malformed option, command string, or batch-bound argument, or one carrying the {@link ExecuteResult} when the run failed and `strict` is not `false`
+* @param options - Command, workspace, termination, evidence, stdin, and observation settings
+* @returns The launched {@link ProcessInterface}
 *
 * @example
 * ```ts
-* const result = await execute({ file: 'git', arguments: ['status'] }, { workspace: process.cwd() })
+* import { createProcess } from '@orkestrel/process/server'
+*
+* const child = createProcess({
+* 	command: { file: 'node', arguments: ['--version'] },
+* 	workspace: process.cwd(),
+* 	grace: 5000,
+* })
 * ```
 */
-async function execute(command, options) {
-	const snapshot = snapshotCommand(command);
-	const optionEnvironment = options?.environment;
-	const optionWorkspace = options?.workspace;
-	const optionInput = options?.input;
-	const optionTimeout = options?.timeout;
-	const optionGrace = options?.grace;
-	const optionSignal = options?.signal;
-	const optionStrict = options?.strict;
-	const optionLimit = options?.limit;
-	validateCommand(snapshot);
-	validateEnvironment(optionEnvironment);
-	validateWorkspace(optionWorkspace);
-	validateTimer(optionTimeout, "option 'timeout'");
-	validateTimer(optionGrace, "option 'grace'");
-	validateBytes(optionLimit, "option 'limit'", 0);
-	const limit = optionLimit ?? PROCESS_OUTPUT;
-	const grace = optionGrace ?? PROCESS_GRACE;
-	const timeout = optionTimeout ?? 0;
-	const strict = optionStrict ?? true;
-	const text = optionInput ?? snapshot.input;
-	const line = formatCommand(snapshot);
-	const workspace = optionWorkspace ?? process.cwd();
-	const environment = mergeEnvironment(snapshot.isolated === true, snapshot.environment, optionEnvironment);
-	const plan = buildSpawn(snapshot, {
-		workspace,
-		environment
-	});
-	const settled = Promise.withResolvers();
-	const terminate = new AbortController();
-	const cleanup = new AbortController();
-	const finish = new AbortController();
-	const inputFailure = new AbortController();
-	const outChunks = [];
-	const errChunks = [];
-	const outRetention = new Retention();
-	const errRetention = new Retention();
-	let spawned = false;
-	let expired = false;
-	let aborted = false;
-	let cause;
-	let timeoutTimer;
-	let confirmTimer;
-	const child = spawn(plan.file, [...plan.arguments], {
-		cwd: workspace,
-		detached: process.platform !== "win32",
-		env: environment,
-		stdio: [
-			"pipe",
-			"pipe",
-			"pipe"
-		],
-		windowsHide: true,
-		windowsVerbatimArguments: plan.verbatim
-	});
-	finish.signal.addEventListener("abort", () => {
-		clearTimeout(timeoutTimer);
-		clearTimeout(confirmTimer);
-		cleanup.abort();
-		settled.resolve(buildExecuteResult({
-			command: line,
-			stdout: Buffer.concat(outChunks),
-			stderr: Buffer.concat(errChunks),
-			code: child.exitCode,
-			signal: child.signalCode,
-			expired,
-			aborted,
-			truncated: outRetention.delivered > limit || errRetention.delivered > limit,
-			limit,
-			...cause === void 0 ? {} : { cause }
-		}));
-	}, { once: true });
-	terminate.signal.addEventListener("abort", () => {
-		if (finish.signal.aborted) return;
-		clearTimeout(timeoutTimer);
-		cleanup.abort();
-		stopChild(child, grace, PROCESS_CONFIRMATION).then(() => {
-			if (finish.signal.aborted) return;
-			confirmTimer = setTimeout(() => finish.abort(), PROCESS_CONFIRMATION);
-		});
-	}, { once: true });
-	inputFailure.signal.addEventListener("abort", () => {
-		if (finish.signal.aborted) return;
-		cause = inputFailure.signal.reason;
-		terminate.abort();
-	}, { once: true });
-	child.stdin.on("error", (error) => inputFailure.abort(error));
-	child.stdout.on("data", (chunk) => {
-		const retained = outRetention.retain(chunk, limit);
-		if (retained !== void 0) outChunks.push(retained);
-	});
-	child.stderr.on("data", (chunk) => {
-		const retained = errRetention.retain(chunk, limit);
-		if (retained !== void 0) errChunks.push(retained);
-	});
-	child.once("spawn", () => {
-		spawned = true;
-	});
-	child.once("error", (error) => {
-		if (spawned) return;
-		cause = error;
-		finish.abort();
-	});
-	child.once("close", () => finish.abort());
-	if (text !== void 0) child.stdin.write(text, (error) => {
-		if (error !== void 0 && error !== null) inputFailure.abort(error);
-	});
-	child.stdin.end();
-	if (timeout > 0) timeoutTimer = setTimeout(() => {
-		expired = true;
-		terminate.abort();
-	}, timeout);
-	if (optionSignal !== void 0) {
-		optionSignal.addEventListener("abort", () => {
-			aborted = true;
-			terminate.abort();
-		}, {
-			once: true,
-			signal: cleanup.signal
-		});
-		if (optionSignal.aborted) {
-			aborted = true;
-			terminate.abort();
-		}
-	}
-	const result = await settled.promise;
-	if (result.failed && strict) {
-		if (cause !== void 0 && cause === inputFailure.signal.reason) throw new ProcessError(`Command '${result.command}' failed while writing standard input`, {
-			code: "input",
-			context: {
-				command: result.command,
-				code: result.code,
-				signal: result.signal
-			},
-			cause: inputFailure.signal.reason,
-			result
-		});
-		throw createExecuteError(result, cause);
-	}
-	return result;
+function createProcess(options) {
+	return new Process(options);
 }
-//#endregion
-//#region src/server/execution/executeSync.ts
 /**
-* Runs one command to completion synchronously, buffering its output, and returns the outcome.
-*
-* @remarks
-* The synchronous counterpart of {@link execute}, spawned through the same resolver and never through a
-* shell. The host offers no cooperative termination window and no in-flight cancellation, so this
-* contract carries neither. A positive `timeout` ends only the root process and can leave
-* descendants running; use {@link execute} or {@link Process} when timeout must terminate the tree. A
-* timeout and an output overflow both end the root with `SIGKILL`: an overflow reports `truncated`
-* and `failed` together and trims the partial output to `limit`, where {@link execute} keeps reading and
-* reports `truncated` without failing. The environment and input follow the same merge as
-* {@link execute}. Unless `strict` is `false`, a failed run throws a {@link createExecuteError}
-* carrying the {@link ExecuteResult}.
+* Creates one raw byte session over a supervised child process.
 *
-* @param command - The executable, arguments, and optional environment and input
-* @param options - Working directory, timeout, capture limit, and failure delivery
-* @returns The run outcome
-* @throws A {@link ProcessError} coded `invalid` for a malformed option, command string, or batch-bound argument, or one carrying the {@link ExecuteResult} when the run failed and `strict` is not `false`
+* @param options - Command, workspace, termination, evidence, stdin, and observation settings
+* @returns The launched {@link SessionInterface}
 *
 * @example
 * ```ts
-* const result = executeSync({ file: 'git', arguments: ['--version'] }, { strict: false })
+* import { createSession } from '@orkestrel/process/server'
+*
+* const session = createSession({
+* 	command: { file: 'node', arguments: ['server.js', '--stdio'] },
+* 	workspace: process.cwd(),
+* 	grace: 5000,
+* })
 * ```
 */
-function executeSync(command, options) {
-	const snapshot = snapshotCommand(command);
-	const optionEnvironment = options?.environment;
-	const optionWorkspace = options?.workspace;
-	const optionInput = options?.input;
-	const optionTimeout = options?.timeout;
-	const optionStrict = options?.strict;
-	const optionLimit = options?.limit;
-	validateCommand(snapshot);
-	validateEnvironment(optionEnvironment);
-	validateWorkspace(optionWorkspace);
-	validateTimer(optionTimeout, "option 'timeout'");
-	validateBytes(optionLimit, "option 'limit'", 0);
-	const limit = optionLimit ?? PROCESS_OUTPUT;
-	const timeout = optionTimeout ?? 0;
-	const strict = optionStrict ?? true;
-	const text = optionInput ?? snapshot.input;
-	const line = formatCommand(snapshot);
-	const workspace = optionWorkspace ?? process.cwd();
-	const environment = mergeEnvironment(snapshot.isolated === true, snapshot.environment, optionEnvironment);
-	const plan = buildSpawn(snapshot, {
-		workspace,
-		environment
-	});
-	const outcome = spawnSync(plan.file, [...plan.arguments], {
-		cwd: workspace,
-		env: environment,
-		encoding: "buffer",
-		maxBuffer: limit,
-		killSignal: "SIGKILL",
-		windowsHide: true,
-		windowsVerbatimArguments: plan.verbatim,
-		...text !== void 0 ? { input: Buffer.from(text) } : {},
-		...timeout > 0 ? { timeout } : {}
-	});
-	const error = outcome.error;
-	const fault = error !== void 0 && "code" in error && isString(error.code) ? error.code : "";
-	const result = buildExecuteResult({
-		command: line,
-		stdout: Buffer.isBuffer(outcome.stdout) ? outcome.stdout : Buffer.alloc(0),
-		stderr: Buffer.isBuffer(outcome.stderr) ? outcome.stderr : Buffer.alloc(0),
-		code: outcome.status,
-		signal: outcome.signal,
-		expired: fault === "ETIMEDOUT",
-		aborted: false,
-		truncated: fault === "ENOBUFS",
-		limit,
-		...error === void 0 ? {} : { cause: error }
-	});
-	if (result.failed && strict) throw createExecuteError(result, error);
-	return result;
+function createSession(options) {
+	return new Session(options);
 }
-//#endregion
-//#region src/server/execution/detach.ts
 /**
-* Spawns one command as a detached process and returns without waiting for it.
-*
-* @remarks
-* The child owns no stdio and is unreferenced, so it outlives this process and nothing here observes
-* its outcome. The error listener is attached before the child is unreferenced, so a post-spawn host
-* fault is swallowed rather than crashing the caller; an invalid command is refused before anything
-* is spawned.
+* Creates one keyed registry of supervised child processes.
 *
-* @param command - The executable, arguments, and optional environment
-* @param options - The working directory the detached child starts in
-* @returns Nothing
-* @throws A {@link ProcessError} coded `invalid` when the working directory or a command string is malformed
+* @param options - Initial fleet-level observation hooks and listener-error handling
+* @returns The {@link ProcessManagerInterface} registry
 *
 * @example
 * ```ts
-* detach({ file: 'node', arguments: ['daemon.js'] }, { workspace: process.cwd() })
+* import { createProcessManager } from '@orkestrel/process/server'
+*
+* const manager = createProcessManager()
 * ```
 */
-function detach(command, options) {
-	const snapshot = snapshotCommand(command);
-	const optionWorkspace = options?.workspace;
-	validateCommand(snapshot);
-	validateWorkspace(optionWorkspace);
-	const workspace = optionWorkspace ?? process.cwd();
-	const environment = mergeEnvironment(snapshot.isolated === true, snapshot.environment);
-	const plan = buildSpawn(snapshot, {
-		workspace,
-		environment
-	});
-	const child = spawn(plan.file, [...plan.arguments], {
-		cwd: workspace,
-		detached: true,
-		env: environment,
-		stdio: "ignore",
-		windowsHide: true,
-		windowsVerbatimArguments: plan.verbatim
-	});
-	child.once("error", () => void 0);
-	child.unref();
+function createProcessManager(options) {
+	return new ProcessManager(options);
 }
 //#endregion
-export { Process, ProcessManager, Retention, buildExecutableCandidates, buildExecuteResult, buildPlatformSpawn, buildSpawn, createProcess, createProcessManager, detach, execute, executeSync, formatCommand, isExited, isFile, killProcess, killTree, mergeEnvironment, mergePlatformEnvironment, quoteArgument, readPlatformVariable, readVariable, resolveExecutable, snapshotCommand, stopChild, trimHead, trimTail, validateBytes, validateCommand, validateEnvironment, validateText, validateTimer, validateWorkspace, waitForClose, waitForExit };
+export { Process, ProcessManager, Session, buildExecutableCandidates, buildExecuteResult, buildPlatformSpawn, buildSpawn, captureChunk, createProcess, createProcessManager, createSession, detach, execute, executeSync, formatCommand, isExited, isFile, killProcess, killTree, mergeEnvironment, mergePlatformEnvironment, quoteArgument, readPlatformVariable, readVariable, resolveExecutable, snapshotCommand, stopChild, trimHead, trimTail, validateBytes, validateCommand, validateEnvironment, validateText, validateTimer, validateWorkspace, waitForClose, waitForExit };
 
 //# sourceMappingURL=index.js.map