@parcha/pi-durable-disk 0.1.0-beta.12 → 0.1.0-beta.13

package/dist/hosts/local-host.js

@@ -299,6 +299,11 @@ export function localHost(opts = {}) {
                 return;
             if (h.mode === "child") {
                 const pid = Number(h.pid);
+                // A handle comes back from run.json with whatever was written there, and stop signals its pid as a group: only a
+                // real process, then. A pid of 1 or below names a group (`kill(-0)` is this supervisor's own, `kill(-1)` every
+                // process it may signal), and without start ticks nothing tells a reused pid from the instance.
+                if (!Number.isInteger(pid) || pid <= 1 || typeof h.startTicks !== "number")
+                    return;
                 const alive = () => procStartTicks(pid) === h.startTicks;
                 if (!alive())
                     return;

package/dist/index.d.ts

@@ -7,6 +7,7 @@ export * from "./fork.js";
 export * from "./hosts/daytona.js";
 export * from "./hosts/docker.js";
 export * from "./hosts/local-host.js";
+export * from "./local-run.js";
 export * from "./park.js";
 export * from "./run.js";
 export * from "./serve.js";

package/dist/index.js

@@ -8,6 +8,7 @@ export * from "./fork.js";
 export * from "./hosts/daytona.js";
 export * from "./hosts/docker.js";
 export * from "./hosts/local-host.js";
+export * from "./local-run.js";
 export * from "./park.js";
 export * from "./run.js";
 export * from "./serve.js";

package/dist/lease.d.ts

@@ -3,5 +3,5 @@ export type { LeaseOptions, OpenRunLeaseOptions, OpenStep, ReleaseStep, RunClaim
 export * from "./errors.js";
 export { assertPragmas, Fence, FencedDatabase, openArchilStore, PROFILE_PRAGMAS, StoreBusyError, StoreFencedError, StorePragmaError } from "./store.js";
 export type { ArchilStore, OpenOptions, PragmaMismatch, Profile } from "./store.js";
-export type { ArchilHost, Claim, RunRef } from "./claim.js";
-export type { RunHolder, RunRecord, RunStatus } from "./status.js";
+export type { AcquireOptions, ArchilHost, Claim, RunRef, Unmounted } from "./claim.js";
+export type { ClaimDir, PersistRecord, RunHolder, RunRecord, RunStatus } from "./status.js";

package/dist/lease.js

@@ -1,6 +1,6 @@
 // The narrow entry (`@parcha/pi-durable-disk/lease`) for a host that owns its own pi-durable Harness and store connections: the
 // claim's lifecycle without the supervisor, the host drivers, the CLI or the app contract. Importing it must not pull those
-// in (test/lease.test.ts bundles it and checks); a name added here is part of that promise.
+// in (test/lease-entry.test.ts bundles it and checks); a name added here is part of that promise.
 export { EXIT_DATAERR, EXIT_SOFTWARE, LeaseLapsedError, openRunLease, OWNER_LOCK, RunError, StoreBehindSealError, storeHead, STORE_FILE } from "./run.js";
 export * from "./errors.js";
 export { assertPragmas, Fence, FencedDatabase, openArchilStore, PROFILE_PRAGMAS, StoreBusyError, StoreFencedError, StorePragmaError } from "./store.js";

package/dist/local-run.d.ts

@@ -0,0 +1,10 @@
+import type { AcquireOptions, Claim } from "./claim.js";
+import { type ClaimDir } from "./status.js";
+export interface LocalRun {
+    /** Takes the claim: the directory, made when it is missing. */
+    readonly acquire: (options: AcquireOptions) => Promise<Claim>;
+    /** Holds the directory open as the run's root; a local directory is not an Archil mount, so its type is not checked. */
+    readonly claimDir: (root: string) => Promise<ClaimDir>;
+}
+/** `openDurableRun`'s `acquire` and `claimDir` for a run in `root`, a directory on this machine. */
+export declare function localRun(root: string): LocalRun;

package/dist/local-run.js

@@ -0,0 +1,63 @@
+// A run on a plain local directory, for one machine: the claim is the directory itself. Nothing mounts and nothing is
+// delegated, so nothing but this machine's owner lock stands between two processes and the run: it is for a laptop, a CI
+// job or a test, never for a directory another machine can reach.
+//
+//   const run = await openDurableRun(ref, { ...localRun("/var/runs/run-1"), harness: { models, registry } });
+//
+// No mount token is needed (`acquire` is replaced). The claim's barrier does not sync the files the agent wrote: the
+// store's own commits are made durable by SQLite, and work/ is the operating system's to flush; a power loss can lose what
+// it had not written yet. It refuses once the claim is fenced, as a mount's does.
+//
+// Linux only, for now: the run's root is held open through /proc/self/fd (openClaimDir), and the default environment
+// (`archilEnv`) confines commands with `setpriv` (util-linux) and the file tools through /proc/self/fd. macOS has neither.
+import { mkdir } from "node:fs/promises";
+import { join, resolve } from "node:path";
+import { FencedError } from "./errors.js";
+import { openClaimDir } from "./status.js";
+/** `openDurableRun`'s `acquire` and `claimDir` for a run in `root`, a directory on this machine. */
+export function localRun(root) {
+    const dir = resolve(root);
+    return {
+        acquire: async ({ ref }) => {
+            await mkdir(dir, { recursive: true });
+            return new LocalClaim(ref, dir);
+        },
+        claimDir: (at) => openClaimDir(at, { fstype: null }),
+    };
+}
+class LocalClaim {
+    ref;
+    disk;
+    root;
+    work;
+    store;
+    /** `<root>/commands`: a local run has no unit cgroup, so the next open ends the commands a killed one left running. */
+    commands;
+    reused = false;
+    stray = null;
+    forced = false;
+    timings = { mountMs: 0, verifyMs: 0 };
+    #fence;
+    constructor(ref, root) {
+        this.ref = ref;
+        this.disk = ref.disk;
+        this.root = root;
+        this.work = join(root, "work");
+        this.store = join(root, "store");
+        this.commands = join(root, "commands");
+    }
+    get fenced() {
+        return this.#fence !== undefined;
+    }
+    markFenced(cause) {
+        this.#fence ??= { cause };
+    }
+    async barrier() {
+        if (this.#fence)
+            throw new FencedError(`${this.root} is fenced; nothing is retried on it`, { cause: this.#fence.cause });
+        return { ms: 0 };
+    }
+    async release() {
+        return { via: "none" };
+    }
+}

package/dist/park.d.ts

@@ -26,9 +26,10 @@ export type BusyState = {
 };
 /**
  * The deadline of a task that is only sleeping: `until` in pi's retry phase (generation and compaction), `pollAt` in
- * its deferred poll phase. This is pi-durable 1.0.4's internal checkpoint shape (harness/generation.js, compaction.js),
- * read here and nowhere else. Any other shape is no deadline, which counts as busy, so a pi that changes the shape keeps
- * instances up rather than parking them mid-work. pi#10325 asks for this as a contract.
+ * its deferred poll phase. This is pi-durable's internal checkpoint shape, the same in 1.0.4 and 1.1.0
+ * (harness/generation.js, compaction.js), read here and nowhere else. Any other shape is no deadline, which counts as
+ * busy, so a pi that changes the shape keeps instances up rather than parking them mid-work. pi#10325 asks for this as
+ * a contract.
  */
 export declare function waitDeadline(checkpoint: JsonValue | undefined): number | undefined;
 /**

package/dist/park.js

@@ -27,9 +27,10 @@ export function leaseParkTarget(lease, harness, context = BACKGROUND_CONTEXT) {
 export const LOCAL_PARK_THRESHOLD_MS = 60_000;
 /**
  * The deadline of a task that is only sleeping: `until` in pi's retry phase (generation and compaction), `pollAt` in
- * its deferred poll phase. This is pi-durable 1.0.4's internal checkpoint shape (harness/generation.js, compaction.js),
- * read here and nowhere else. Any other shape is no deadline, which counts as busy, so a pi that changes the shape keeps
- * instances up rather than parking them mid-work. pi#10325 asks for this as a contract.
+ * its deferred poll phase. This is pi-durable's internal checkpoint shape, the same in 1.0.4 and 1.1.0
+ * (harness/generation.js, compaction.js), read here and nowhere else. Any other shape is no deadline, which counts as
+ * busy, so a pi that changes the shape keeps instances up rather than parking them mid-work. pi#10325 asks for this as
+ * a contract.
  */
 export function waitDeadline(checkpoint) {
     if (typeof checkpoint !== "object" || checkpoint === null || Array.isArray(checkpoint))

package/dist/run.d.ts

@@ -1,6 +1,6 @@
 import type { Context, JsonValue } from "@earendil-works/chord";
 import { Harness } from "@earendil-works/pi-durable";
-import type { HarnessOptions, Storage, ToolRegistration } from "@earendil-works/pi-durable";
+import type { HarnessOptions, Seq, Storage, ToolRegistration } from "@earendil-works/pi-durable";
 import type { SqliteDatabase, SqliteExecutor } from "@earendil-works/pi-durable/storage/sqlite";
 import { type AcquireOptions, type ArchilHost, type Claim, type RunRef } from "./claim.js";
 import { FencedError, PdaError } from "./errors.js";
@@ -57,11 +57,15 @@ export interface LeaseOptions {
     /** How often the self-fence timer looks; default 1 s. */
     readonly checkMs?: number;
 }
-export type OpenStep = "acquire" | "owner-lock" | "run.json" | "heartbeat" | "layout" | "store" | "seal" | "harness" | "live" | "resume";
+export type OpenStep = "acquire" | "owner-lock" | "run.json" | "heartbeat" | "layout" | "commands" | "store" | "seal" | "harness" | "live" | "before-resume" | "resume";
 export type ReleaseStep = "close" | "cleanup" | "barrier" | "seal" | "unlock" | "unmount";
 export interface OpenRunLeaseOptions {
-    /** The mount token from the host driver (reusable, 24 h); travels only on the archil wrapper's stdin, never in an environment. */
-    readonly mountToken: string;
+    /**
+     * The mount token from the host driver (reusable, 24 h); travels only on the archil wrapper's stdin, never in an
+     * environment. Required to mount an Archil disk (the default `acquire`); a run whose `acquire` is replaced (a local
+     * directory: `localRun`) needs none, and its `acquire` is handed an empty token.
+     */
+    readonly mountToken?: string;
     /** Default /mnt/archil. */
     readonly mountRoot?: string;
     /** Mount with `--force`: the takeover fallback when the supervisor could not revoke. */
@@ -110,7 +114,35 @@ export interface OpenDurableRunOptions<Tool extends ToolRegistration = ToolRegis
     readonly env?: (claim: Claim) => RunEnv;
     /** Wraps the raw database inside the store's fence (instrumentation, fault injection). */
     readonly decorateStore?: (database: SqliteDatabase) => SqliteDatabase;
+    /**
+     * Awaited once the Harness is open (its registry installed) and the run is live, before the Harness resumes: no
+     * resumed task takes a step until it settles, and what it admits (a submission, a write) is committed before anything
+     * a resumed task's steps commit. A host reconciles here what a resumed tool depends on (a browser, a mount). A rejection
+     * fails the open as any step does (`before-resume`), and the claim is released.
+     */
+    readonly beforeResume?: (run: BeforeResume) => void | Promise<void>;
+}
+/**
+ * What `beforeResume` sees: the open Harness, not yet resumed, the open's context, the incarnation it belongs to, and the
+ * store the Harness was opened over with its head (a recorder snapshots every document at `head` here).
+ */
+export interface BeforeResume {
+    readonly harness: Harness;
+    readonly context: Context;
+    readonly generation: number;
+    readonly record: RunRecord;
+    readonly claim: RunClaim;
+    /** The store the Harness was opened over, read-only: four reads on an object of their own, and no way to a write. */
+    readonly storage: StoreReads;
+    /**
+     * The store's last committed sequence once the Harness is open, read just before the hook runs. Until the hook commits
+     * something, the store's current state is its state at `head`: a document that keeps no history (`latest`, and session
+     * and task documents) reads only at "current", a `rewindable` one at `head` too.
+     */
+    readonly head: Seq;
 }
+/** The reads of a store that `beforeResume` gets. */
+export type StoreReads = Pick<Storage, "scanConversations" | "scanTasks" | "scanDocuments" | "document">;
 /** The claim as the app sees it: paths, the fenced flag, and a barrier whose failure fences the run. */
 export interface RunClaim {
     readonly ref: RunRef;
@@ -228,12 +260,12 @@ export interface StoreHeadSource {
     readonly file: string;
 }
 /**
- * The last sequence the store committed: the one read of pi's internal schema in this package. pi-durable 1.0.4's
- * public `Storage` has no head query, and the seal check must run before `Harness.open` can commit (its recovery commit
- * would reuse a lost sequence number). pi's SqliteStorage gives each commit `durable_metadata.next_seq` and stores the
- * successor in the same transaction, so the head is `next_seq - 1`. The query only reads. A store without that table,
- * row or column fails closed (STORE_HEAD_UNREADABLE), so a pi whose schema moved never skips the check silently;
- * a unit test pins the read to the sequence pi's commits return.
+ * The last sequence the store committed: the one read of pi's internal schema in this package. pi-durable's public
+ * `Storage` has no head query (1.0.4 and 1.1.0), and the seal check must run before `Harness.open` can commit (its
+ * recovery commit would reuse a lost sequence number). pi's SqliteStorage gives each commit `durable_metadata.next_seq`
+ * and stores the successor in the same transaction, so the head is `next_seq - 1`. The query only reads. A store
+ * without that table, row or column fails closed (STORE_HEAD_UNREADABLE), so a pi whose schema moved never skips the
+ * check silently; a unit test pins the read to the sequence pi's commits return.
  *
  * `database` is the store's fence-aware facade (`FencedDatabase`), which turns an I/O-class error into a fence; through
  * a raw connection such an error would read as STORE_HEAD_UNREADABLE.

package/dist/run.js

@@ -10,6 +10,7 @@ import { DatabaseSync } from "node:sqlite";
 import { BACKGROUND_CONTEXT } from "@earendil-works/chord/context";
 import { Harness } from "@earendil-works/pi-durable";
 import { acquire } from "./claim.js";
+import { reapOrRefuse } from "./commands.js";
 import { archilEnv } from "./env.js";
 import { EXIT_FENCED, FencedError, HeldError, ownWriteFenced, PdaError } from "./errors.js";
 import { openArchilStore } from "./store.js";
@@ -59,6 +60,18 @@ export class LeaseLapsedError extends FencedError {
         this.by = by;
     }
 }
+/**
+ * `storage`'s four reads on a frozen object that holds nothing else: no `commit` or `mintId` on it, and no reference to
+ * `storage` a cast could reach.
+ */
+function storeReads(storage) {
+    return Object.freeze({
+        scanConversations: (...args) => storage.scanConversations(...args),
+        scanTasks: (...args) => storage.scanTasks(...args),
+        scanDocuments: (...args) => storage.scanDocuments(...args),
+        document: (...args) => storage.document(...args),
+    });
+}
 /** Locks this process holds. A collected DatabaseSync closes its file, which would drop the lock without a word. */
 const heldLocks = new Set();
 const SQLITE_BUSY = 5;
@@ -119,12 +132,12 @@ export function takeOwnerLock(root) {
     };
 }
 /**
- * The last sequence the store committed: the one read of pi's internal schema in this package. pi-durable 1.0.4's
- * public `Storage` has no head query, and the seal check must run before `Harness.open` can commit (its recovery commit
- * would reuse a lost sequence number). pi's SqliteStorage gives each commit `durable_metadata.next_seq` and stores the
- * successor in the same transaction, so the head is `next_seq - 1`. The query only reads. A store without that table,
- * row or column fails closed (STORE_HEAD_UNREADABLE), so a pi whose schema moved never skips the check silently;
- * a unit test pins the read to the sequence pi's commits return.
+ * The last sequence the store committed: the one read of pi's internal schema in this package. pi-durable's public
+ * `Storage` has no head query (1.0.4 and 1.1.0), and the seal check must run before `Harness.open` can commit (its
+ * recovery commit would reuse a lost sequence number). pi's SqliteStorage gives each commit `durable_metadata.next_seq`
+ * and stores the successor in the same transaction, so the head is `next_seq - 1`. The query only reads. A store
+ * without that table, row or column fails closed (STORE_HEAD_UNREADABLE), so a pi whose schema moved never skips the
+ * check silently; a unit test pins the read to the sequence pi's commits return.
  *
  * `database` is the store's fence-aware facade (`FencedDatabase`), which turns an I/O-class error into a fence; through
  * a raw connection such an error would read as STORE_HEAD_UNREADABLE.
@@ -605,9 +618,12 @@ async function openLease(ref, options, step) {
     catch (error) {
         throw new RunError("INVALID_ARGUMENT", `holder ${JSON.stringify(options.holder)}: ${error.message}`, { cause: error });
     }
+    if (options.acquire === undefined && !options.mountToken) {
+        throw new RunError("INVALID_ARGUMENT", "mountToken is required to mount an Archil disk; a run on a local directory passes localRun(root) instead");
+    }
     const claim = await step("acquire", () => (options.acquire ?? acquire)({
         ref,
-        token: options.mountToken,
+        token: options.mountToken ?? "",
         ...(options.mountRoot === undefined ? {} : { mountRoot: options.mountRoot }),
         ...(options.force === undefined ? {} : { force: options.force }),
         ...(options.host === undefined ? {} : { host: options.host }),
@@ -680,6 +696,15 @@ class Run {
         const storage = lease.observe(this.#store.storage);
         this.#harness = await step("harness", () => Harness.open(storage, { ...this.#options.harness, env: this.env }, this.#context));
         await step("live", () => lease.live());
+        const before = this.#options.beforeResume;
+        if (before) {
+            // The storage the Harness was opened over (the lease observes its commits), and its head now: nothing commits
+            // between the open and the hook, since the Harness has not resumed.
+            await step("before-resume", async () => {
+                const head = (await storeHead(this.#store));
+                await before({ harness: this.#harness, context: this.#context, generation: lease.generation, record: lease.record, claim: lease.claim, storage: storeReads(storage), head });
+            });
+        }
         await step("resume", () => this.#harness.resume());
     }
     /** Undo a failed open: close what this layer opened, then the lease's own undo. */
@@ -735,6 +760,13 @@ export async function openDurableRun(ref, options) {
     let env;
     const lease = await openLease(ref, { ...options, context, cleanup: (c) => env?.cleanup(c) ?? Promise.resolve() }, step);
     try {
+        // A claim that records its commands (a local run's): end what a killed incarnation left running, now that the owner
+        // lock is held and before the Harness opens, so no command of it still writes in work/ once the run resumes.
+        const commands = lease.rawClaim.commands;
+        // A process of a killed incarnation that outlives its SIGKILL refuses the open (HeldError, 76): the run never resumes
+        // beside it, and its record stays for the next open.
+        if (commands !== undefined)
+            await step("commands", () => reapOrRefuse(commands));
         env = (options.env ?? ((c) => archilEnv(c)))(lease.rawClaim);
     }
     catch (error) {

package/dist/supervise.d.ts

@@ -330,9 +330,9 @@ export declare function checkHost(options: CheckOptions): Promise<CheckReport>;
 /**
  * Delete a run's directory tree over S3. A tree with a delegation on it, even an orphaned one, is not deleted: S3
  * DeleteObjects leaves its objects in place and reports no error, and the run id would later reopen with its old
- * store. So: revoke every delegation on the subtree, delete the files, then the directory markers deepest first (a
- * directory with children refuses), then list the prefix. Anything left is RUN_TREE_NOT_DELETED; a non-empty prefix is
- * never reported as deleted.
+ * store. So: revoke every delegation on the subtree and its holders' private directories, delete the files, then the
+ * directory markers deepest first (a directory with children refuses), then list the prefix. Anything left is
+ * RUN_TREE_NOT_DELETED; a non-empty prefix is never reported as deleted.
  */
 export declare function deleteRunTree(control: CheckControl, id: string): Promise<{
     objects: number;

package/dist/supervise.js

@@ -6,7 +6,7 @@
 import { open } from "node:fs/promises";
 import { hostname } from "node:os";
 import { join } from "node:path";
-import { acquire, createRunDir, findDelegations, matchDelegations, pathlessResolver, mintMountToken, MOUNT_TOKEN_TTL, parseTokenNickname, removeMountToken, runPath, unmountClaim, } from "./claim.js";
+import { acquire, createRunDir, findDelegations, matchDelegations, pathlessResolver, revokeBestEffort, revokeCompanions, mintMountToken, MOUNT_TOKEN_TTL, parseTokenNickname, removeMountToken, runPath, unmountClaim, } from "./claim.js";
 import { FencedError, HeldError, PdaError } from "./errors.js";
 import { parseRunRecord, RUN_JSON } from "./status.js";
 export const CONTROL_TIMEOUT_MS = 10_000;
@@ -106,7 +106,7 @@ export async function ensureRunning(ref, host, options) {
     }
     // A due wake still goes through the delegation check: an instance that wrote `sleeping` and died before releasing
     // left a held or orphaned delegation, which a plain start would hit (76) on every tick.
-    const held = await listHeld(opts.control, ref.id, opts.pathless);
+    const { held, all } = await listHeld(opts.control, ref.id, opts.pathless);
     // A start in flight: the instance has not written run.json at its generation yet (it may not even have mounted).
     // Revoking it or starting a second one would fence what was just started.
     const baseGraceMs = opts.startGraceMs ?? leaseExpiryMs;
@@ -144,7 +144,7 @@ export async function ensureRunning(ref, host, options) {
         const inFlight = await starting();
         if (inFlight)
             return inFlight;
-        await revokeListed(opts.control, ref.id, held);
+        await revokeListed(opts.control, ref.id, held, all);
         return start("orphaned", held);
     }
     if (held.some((d) => d.isPending && !d.isOrphaned))
@@ -157,7 +157,7 @@ export async function ensureRunning(ref, host, options) {
     if (inFlight)
         return inFlight;
     const stonith = status?.holder ? await stopHolder(host, status.holder, opts.stonithTimeoutMs ?? STONITH_TIMEOUT_MS) : { outcome: "no-holder" };
-    await revokeListed(opts.control, ref.id, held);
+    await revokeListed(opts.control, ref.id, held, all);
     return start("lease-expired", held, stonith);
 }
 /**
@@ -219,9 +219,11 @@ async function ensureRunDir(control, id, owner) {
     await createRunDir(control, id, owner);
     return true;
 }
+/** The run's delegations (`matchDelegations`), and the listing they came from. */
 async function listHeld(control, id, resolve) {
     try {
-        return await findDelegations(control, id, resolve);
+        const all = await control.listDelegations();
+        return { held: await matchDelegations(all, id, resolve ?? pathlessResolver(control)), all };
     }
     catch (err) {
         throw new SuperviseError("CONTROL_API_FAILED", `listing delegations on ${runPath(id)} failed`, { cause: err });
@@ -231,18 +233,20 @@ const sameDelegation = (a, b) => a.clientId === b.clientId && a.inodeId === b.in
 /**
  * Revoke exactly the delegations the decision was made on, never a fresh listing: a racing supervisor may have started
  * a new holder since, and that one is not ours to judge. A revoke that fails is fine only if the delegation is gone.
+ * Then the same clients' private directories (`revokeCompanions`): those clients are gone or fenced.
  */
-async function revokeListed(control, id, held) {
+async function revokeListed(control, id, held, all) {
     for (const d of held) {
         try {
             await control.revokeDelegation({ clientId: d.clientId, inodeId: d.inodeId });
         }
         catch (err) {
-            const still = await listHeld(control, id).then((now) => now.some((n) => sameDelegation(n, d)));
+            const still = await listHeld(control, id).then((now) => now.held.some((n) => sameDelegation(n, d)));
             if (still)
                 throw new SuperviseError("CONTROL_API_FAILED", `revoking ${runPath(id)} (client ${d.clientId}) failed`, { cause: err });
         }
     }
+    await revokeCompanions(control, held, all);
 }
 function settleWithin(promise, ms) {
     return new Promise((resolve) => {
@@ -501,15 +505,13 @@ export async function checkHost(options) {
 /**
  * Delete a run's directory tree over S3. A tree with a delegation on it, even an orphaned one, is not deleted: S3
  * DeleteObjects leaves its objects in place and reports no error, and the run id would later reopen with its old
- * store. So: revoke every delegation on the subtree, delete the files, then the directory markers deepest first (a
- * directory with children refuses), then list the prefix. Anything left is RUN_TREE_NOT_DELETED; a non-empty prefix is
- * never reported as deleted.
+ * store. So: revoke every delegation on the subtree and its holders' private directories, delete the files, then the
+ * directory markers deepest first (a directory with children refuses), then list the prefix. Anything left is
+ * RUN_TREE_NOT_DELETED; a non-empty prefix is never reported as deleted.
  */
 export async function deleteRunTree(control, id) {
     const prefix = `${runPath(id)}/`;
-    const held = await findDelegations(control, id);
-    for (const d of held)
-        await control.revokeDelegation({ clientId: d.clientId, inodeId: d.inodeId }).catch(() => { });
+    const held = await revokeBestEffort(control, id);
     const keys = (await control.listObjects(prefix, { recursive: true })).objects.map((o) => o.key);
     const dirs = [...new Set([...keys.filter((k) => k.endsWith("/")), prefix])];
     const depth = (k) => k.split("/").length;

package/dist/watchdog.js

@@ -60,7 +60,7 @@ function sweep(instance, options = {}) {
     if (!Number.isInteger(pid) || pid <= 0 || pid === instance) continue;
     const child = stat(proc, pid);
     if (child === undefined || child.ppid !== instance) continue;
-    targets.add(child.pgrp === own.pgrp || child.pgrp <= 0 ? pid : -child.pgrp);
+    targets.add(child.pgrp === own.pgrp || child.pgrp <= 1 ? pid : -child.pgrp);
   }
   if (options.ownCgroup) {
     for (const pid of cgroupPids(instance, proc, options.sys ?? "/sys/fs/cgroup")) if (pid !== instance && pid > 0) targets.add(pid);
@@ -110,7 +110,9 @@ export class LeaseWatchdog {
         Atomics.store(this.#shared, SLOT_BEAT, options.beatNs);
         Atomics.store(this.#shared, SLOT_LIMIT, BigInt(Math.round(options.limitMs * 1e6)));
         const data = { buffer, checkMs: options.checkMs, instance: process.pid, ownCgroup: options.ownCgroup === true };
-        this.#worker = new Worker(WORKER_SOURCE, { eval: true, workerData: data });
+        // No inherited Node flags: the source is self-contained CommonJS and needs none of the host's, and some would make Node
+        // read it as ESM (`--input-type=module`, a host running inline ESM through -e or stdin), where `require` is undefined.
+        this.#worker = new Worker(WORKER_SOURCE, { eval: true, workerData: data, execArgv: [] });
         this.#worker.unref();
     }
     /** A heartbeat write that started at `startNs` succeeded. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@parcha/pi-durable-disk",
-  "version": "0.1.0-beta.12",
+  "version": "0.1.0-beta.13",
   "description": "A durable pi host on a network disk (Archil): one owner per run, a fence, durable commits, and a supervisor.",
   "keywords": [
     "pi",
@@ -49,7 +49,7 @@
     "build": "rm -rf dist && tsc -p tsconfig.build.json && node scripts/rewrite-dts.mjs dist",
     "prepack": "npm run build",
     "typecheck": "tsc --noEmit && tsc --noEmit -p examples",
-    "test": "node --test 'test/*.test.ts'",
+    "test": "node --test --test-timeout=240000 'test/*.test.ts' 'test/examples/*.test.ts'",
     "test:acceptance": "node --test --test-concurrency=1 'test/acceptance/*.test.ts'",
     "test:live": "node --test --test-concurrency=1 'test/live/*.test.ts'",
     "test:live:claim": "node --test --test-concurrency=1 test/live/claim.live.test.ts",
@@ -62,16 +62,16 @@
     "verify:tarball": "node scripts/verify-tarball.mjs"
   },
   "peerDependencies": {
-    "@earendil-works/chord": "~1.0.4",
-    "@earendil-works/pi-durable": "~1.0.4"
+    "@earendil-works/chord": ">=1.0.4 <1.3.0",
+    "@earendil-works/pi-durable": ">=1.0.4 <1.3.0"
   },
   "dependencies": {
     "disk": "1.7.0"
   },
   "devDependencies": {
-    "@earendil-works/chord": "1.0.4",
-    "@earendil-works/pi-ai": "1.0.4",
-    "@earendil-works/pi-durable": "1.0.4"
+    "@earendil-works/chord": "1.1.0",
+    "@earendil-works/pi-ai": "1.1.0",
+    "@earendil-works/pi-durable": "1.1.0"
   },
   "repository": {
     "type": "git",