@promptctl/cc-candybar 1.17.2 → 1.17.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@promptctl/cc-candybar",
-  "version": "1.17.2",
+  "version": "1.17.4",
   "description": "Statusline renderer for Claude Code — a JSON5-configurable DSL with daemon-cached data sources, byte-clean palette-aware composition, and OSC8 click verbs.",
   "type": "module",
   "main": "./dist/index.mjs",
@@ -91,10 +91,10 @@
     "mobx": "^6.15.0"
   },
   "optionalDependencies": {
-    "@promptctl/cc-candybar-darwin-arm64": "1.17.2",
-    "@promptctl/cc-candybar-darwin-x64": "1.17.2",
-    "@promptctl/cc-candybar-linux-x64": "1.17.2",
-    "@promptctl/cc-candybar-linux-arm64": "1.17.2"
+    "@promptctl/cc-candybar-darwin-arm64": "1.17.4",
+    "@promptctl/cc-candybar-darwin-x64": "1.17.4",
+    "@promptctl/cc-candybar-linux-x64": "1.17.4",
+    "@promptctl/cc-candybar-linux-arm64": "1.17.4"
   },
   "pnpm": {
     "supportedArchitectures": {

package/src/daemon/acquire.ts

@@ -1,8 +1,14 @@
 import fs from "node:fs";
 import net from "node:net";
+import path from "node:path";
 import { launchDetachedSync } from "../proc/launch";
 import process from "node:process";
-import { socketPath, spawnLockPath, daemonDir } from "./paths";
+import {
+  socketPath,
+  spawnLockPath,
+  spawnCooldownPath,
+  daemonDir,
+} from "./paths";
 
 // [LAW:single-enforcer] One primitive per runtime that owns the entire
 // "obtain a daemon" verb. Every spawn site in the Node runtime now flows
@@ -133,6 +139,28 @@ async function spawnAndWaitForReady(
   outerDeadline: number,
   reasonSuffix: string,
 ): Promise<ObtainResult> {
+  const readyDeadline = Math.min(
+    Date.now() + spawnReadyTimeoutMs,
+    outerDeadline,
+  );
+
+  // [LAW:dataflow-not-control-flow] The spawn-rate bound is consulted as data,
+  // not a mode. If a spawn was attempted within SPAWN_COOLDOWN_MS, one is
+  // already in flight — do NOT add another Node process; wait for the in-flight
+  // boot. This keeps obtainDaemon under the same global rate cap as the kick
+  // path, so the rate bound holds for EVERY spawn site [LAW:one-source-of-truth].
+  if (!claimSpawnCooldown()) {
+    // [LAW:no-silent-failure] This failure's cause is the cooldown gate, not the
+    // lock path we arrived through — so it does NOT inherit reasonSuffix (which
+    // tags lock-held vs lock-fallback *spawn* provenance). We never spawned here.
+    return (await pollUntilReady(connectTimeoutMs, readyDeadline))
+      ? { kind: "attached" }
+      : {
+          kind: "failed",
+          reason: "spawn on cooldown; no daemon became ready during the wait",
+        };
+  }
+
   // [LAW:no-defensive-null-guards] obtainDaemon is typed Promise<ObtainResult>.
   // A synchronous throw from child_process.spawn (ENOENT, invalid options)
   // must become a typed failure, not a rejected promise.
@@ -151,20 +179,27 @@ async function spawnAndWaitForReady(
       reason: `spawn returned false${reasonSuffix}`,
     };
   }
-  const readyDeadline = Math.min(
-    Date.now() + spawnReadyTimeoutMs,
-    outerDeadline,
-  );
+  return (await pollUntilReady(connectTimeoutMs, readyDeadline))
+    ? { kind: "started" }
+    : {
+        kind: "failed",
+        reason: `daemon did not bind in time${reasonSuffix}`,
+      };
+}
+
+// Poll the socket until a daemon answers or the deadline elapses. Shared by the
+// spawn path (→ "started") and the cooldown-blocked wait path (→ "attached"):
+// both need "did a daemon come up in time", they differ only in how they label
+// the outcome.
+async function pollUntilReady(
+  connectTimeoutMs: number,
+  readyDeadline: number,
+): Promise<boolean> {
   while (Date.now() < readyDeadline) {
-    if (await canConnect(socketPath(), connectTimeoutMs)) {
-      return { kind: "started" };
-    }
+    if (await canConnect(socketPath(), connectTimeoutMs)) return true;
     await sleep(20);
   }
-  return {
-    kind: "failed",
-    reason: `daemon did not bind in time${reasonSuffix}`,
-  };
+  return false;
 }
 
 // Synchronous fire-and-forget kick — used for "daemon-miss" recovery where
@@ -214,7 +249,7 @@ export function obtainDaemonKick(opts: { spawn?: () => boolean } = {}): void {
       process.stderr.write(
         `cc-candybar: spawn-lock held ${ageMs}ms (likely crashed holder) — spawning unlocked\n`,
       );
-      safeSpawn(spawnFn);
+      cooldownGatedSpawn(spawnFn);
     }
     return;
   }
@@ -222,16 +257,26 @@ export function obtainDaemonKick(opts: { spawn?: () => boolean } = {}): void {
     process.stderr.write(
       `cc-candybar: spawn-lock unavailable (${lock.reason}) — spawning unlocked\n`,
     );
-    safeSpawn(spawnFn);
+    cooldownGatedSpawn(spawnFn);
     return;
   }
   try {
-    safeSpawn(spawnFn);
+    cooldownGatedSpawn(spawnFn);
   } finally {
     releaseSpawnLock();
   }
 }
 
+// [LAW:single-enforcer] Every kick spawn site routes through here, so the
+// spawn-rate bound is applied at exactly one boundary — mirror of Rust's
+// spawn_daemon_rate_limited. On cooldown we do nothing: a spawn was attempted
+// within SPAWN_COOLDOWN_MS and is likely still booting; the kick is
+// fire-and-forget, so "already in flight" is a complete answer.
+function cooldownGatedSpawn(spawnFn: () => boolean): void {
+  if (!claimSpawnCooldown()) return;
+  safeSpawn(spawnFn);
+}
+
 function spawnLockAgeMs(): number | null {
   try {
     const st = fs.statSync(spawnLockPath());
@@ -260,6 +305,93 @@ function safeSpawn(spawnFn: () => boolean): void {
   }
 }
 
+// ─── Spawn cooldown (shared spawn-RATE bound) ────────────────────────────────
+//
+// [LAW:one-source-of-truth] spawn.lock dedups spawns at one INSTANT; the
+// cooldown bounds them over TIME. Without it, the Rust kick — which releases
+// spawn.lock milliseconds after forking, before the 0.5-3s Node boot window —
+// re-spawns on every render tick during an outage (spawn rate ≈ tick rate:
+// dozens/sec, process-table exhaustion). One file's mtime records the last spawn
+// ATTEMPT; both runtimes consult it. The constant and filename are mirrored TS↔
+// Rust (scripts/check-protocol.mjs). Worst case with the bound: ~20 spawns/min
+// globally, each of which exits cleanly via the sibling socket-lease defenses.
+// Exported for the boundary unit tests (test/daemon-acquire.test.ts), which pin
+// the window arithmetic against the exact constant the same way the Rust unit
+// tests do — so a TS↔Rust decision divergence at a boundary is caught even
+// though check-protocol only diffs the constant's value.
+export const SPAWN_COOLDOWN_MS = 3_000;
+
+// [LAW:effects-at-boundaries] The window arithmetic — the subtle part: a
+// future-mtime garbage record (beyond the stale-lock window) must not pin the
+// cooldown forever, while a small negative age is just ms-truncation of
+// Date.now() against the higher-precision fs mtime and still counts as a
+// just-recorded attempt — is a pure function of the record's age, extracted from
+// the fs read so it is unit-tested without touching the filesystem. Mirrors the
+// Rust cooldown_decision. `null` age (missing/unreadable file) allows (first
+// spawn); the mtime IS the timestamp, so "unparseable timestamp" is
+// unrepresentable by construction.
+export type CooldownDecision =
+  | { kind: "allow" }
+  | { kind: "allow-future-garbage"; futureMs: number }
+  | { kind: "deny" };
+
+export function cooldownDecision(ageMs: number | null): CooldownDecision {
+  if (ageMs === null) return { kind: "allow" };
+  if (ageMs < -STALE_LOCK_MS)
+    return { kind: "allow-future-garbage", futureMs: -ageMs };
+  if (ageMs < SPAWN_COOLDOWN_MS) return { kind: "deny" };
+  return { kind: "allow" };
+}
+
+// [LAW:single-enforcer] The sole authority on daemon-spawn RATE. Returns true —
+// and RECORDS the attempt (updating spawn.cooldown's mtime to now) — when a
+// spawn is permitted; false when an attempt was recorded within
+// SPAWN_COOLDOWN_MS. Recording-on-grant (BEFORE the caller spawns) is
+// load-bearing: a spawn that then throws or returns false still counts against
+// the rate, so a broken binary is not retried in a tight loop. A future-mtime
+// garbage record warns loudly and falls toward ALLOWING the spawn
+// [LAW:no-silent-failure].
+function claimSpawnCooldown(): boolean {
+  const path = spawnCooldownPath();
+  const decision = cooldownDecision(cooldownAgeMs(path));
+  if (decision.kind === "deny") return false;
+  if (decision.kind === "allow-future-garbage") {
+    process.stderr.write(
+      `cc-candybar: spawn.cooldown mtime is ${decision.futureMs}ms in the future — ignoring and spawning\n`,
+    );
+  }
+  recordSpawnAttempt(path);
+  return true;
+}
+
+function cooldownAgeMs(path: string): number | null {
+  try {
+    return Date.now() - fs.statSync(path).mtimeMs;
+  } catch {
+    return null;
+  }
+}
+
+function recordSpawnAttempt(filePath: string): void {
+  // [LAW:composability] Self-sufficient — ensure the state dir exists rather
+  // than leaning on an ambient ensureStateDir() precondition, so any spawn site
+  // routing through claimSpawnCooldown records correctly (mirrors Rust's
+  // record_spawn_attempt). Content is human-diagnostic only; the mtime is the
+  // authority. A write failure means no cooldown recorded — worst case one extra
+  // spawn, which bind() arbitrates — but surface it loudly rather than silently
+  // un-bound the rate [LAW:no-silent-failure].
+  try {
+    fs.mkdirSync(path.dirname(filePath), { recursive: true });
+    fs.writeFileSync(filePath, `${process.pid} ${Date.now()}\n`, {
+      mode: 0o600,
+    });
+  } catch (e) {
+    process.stderr.write(
+      `cc-candybar: could not record spawn.cooldown: ${(e as Error).message}\n`,
+    );
+  }
+}
+
 // ─── Spawn-lock (Node side) ──────────────────────────────────────────────────
 //
 // O_EXLOCK / fcntl(F_SETLK) aren't reliably exposed across Node platforms, so
@@ -274,7 +406,9 @@ function safeSpawn(spawnFn: () => boolean): void {
 // lock is a thundering-herd optimization, so a missed dedup just means one
 // extra Node process eats a bind() race and exits.
 
-const STALE_LOCK_MS = 10_000;
+// Exported for the cooldownDecision boundary tests. Mirrored TS↔Rust (diffed by
+// check-protocol) since both runtimes apply it to the same spawn.cooldown file.
+export const STALE_LOCK_MS = 10_000;
 
 let heldLock: { fd: number; path: string } | null = null;
 

package/src/daemon/paths.ts

@@ -146,6 +146,17 @@ export function spawnLockPath(): string {
   return path.join(stateDir(), "spawn.lock");
 }
 
+// [LAW:one-source-of-truth] The spawn-RATE bound (as distinct from spawn.lock's
+// instantaneous dedup) is anchored to one file's mtime beside spawn.lock: the
+// time of the last daemon-spawn ATTEMPT. Both runtimes gate on the SAME file, so
+// the filename is mirrored TS↔Rust (rust-client/src/main.rs SPAWN_COOLDOWN_FILE)
+// and diffed by scripts/check-protocol.mjs — a drift would silently split the
+// rate bound in two.
+const SPAWN_COOLDOWN_FILE = "spawn.cooldown";
+export function spawnCooldownPath(): string {
+  return path.join(stateDir(), SPAWN_COOLDOWN_FILE);
+}
+
 export function logPath(): string {
   return path.join(stateDir(), "daemon.log");
 }

package/src/daemon/process-fingerprint.ts

@@ -0,0 +1,135 @@
+import { launchSync, type LaunchOpts, type LaunchResult } from "../proc/launch";
+
+// ─── Process start-time fingerprint ──────────────────────────────────────────
+//
+// [FRAMING:representation] A bare pid is an under-constrained identity: the
+// kernel recycles pids, so "a process with pid 989 exists" does NOT prove "989
+// is the same process that wrote this lease". A crashed daemon whose pid the OS
+// later hands to an unrelated long-lived process reads `alive` on every
+// subsequent start, so no daemon ever comes up (brandon-daemon-lifecycle-2b3.4
+// RESIDUAL 1 — the inverse of the socket-theft storm). The kernel ALSO stamps
+// each process with a start-time it never rewinds within that pid's life;
+// (pid, start-time) is the pair that actually IS a process identity, so a
+// recycled pid is provably a DIFFERENT process (different start-time).
+//
+// [LAW:one-source-of-truth] The authority is the kernel's process identity, not
+// a bare pid. `ps -o lstart=` exposes the start-time on every Unix we ship to
+// (darwin + linux). The reported token is treated as OPAQUE — compared by string
+// equality, never parsed — so there is no date-format representation to drift
+// [FRAMING:representation]: a producer/consumer parse mismatch is unrepresentable
+// when neither side parses. That opaque-equality invariant holds ONLY if the
+// GENERATOR is deterministic. `ps -o lstart=` is strftime-formatted (locale) via
+// `localtime()` (timezone), so the SAME process renders different tokens across a
+// locale change OR a timezone change (TZ env, DST, tzdata update). We pin BOTH on
+// the `ps` subprocess — `LC_ALL=C` (dominates any ambient LC_TIME/LC_ALL) and
+// `TZ=UTC` — so the token is a locale- and timezone-invariant UTC rendering of
+// the start instant, and equality is sound.
+
+// A read of a pid's kernel start-time. Only TWO outcomes, because nothing
+// derivable from a `ps` exit code can SOUNDLY prove a process is dead — a
+// non-zero exit means "no start-time to report", which conflates a genuinely
+// absent pid with an access failure (hardened `/proc`/`hidepid`, a
+// permission-denied read of a live process). A `gone` state produced from that
+// would be an over-claim ([LAW:types-are-the-program]) that could false-dead a
+// live owner and reclaim its socket. So:
+//   start       — the pid is live and this is its start-time token (the ONLY
+//                 thing `ps` can assert soundly: it printed a row).
+//   unavailable — `ps` reported no start-time (absent OR unreadable OR errored).
+//                 Callers defer to kill(pid,0), the sound liveness test, which
+//                 correctly reclaims a truly-dead pid and spares a live one.
+// The fingerprint's unique contribution is the `start`+mismatch case (a recycled
+// pid whose live start-time differs from the lease); everything else falls back
+// to kill, no worse than before the fingerprint existed.
+export type StartTimeRead =
+  | { kind: "start"; token: string }
+  | { kind: "unavailable"; detail: string };
+
+// The subprocess boundary, injected so the parse/branch logic is exercised by
+// input enumeration with a fake launcher while the real path runs the real `ps`.
+export type Launcher = (opts: LaunchOpts) => LaunchResult;
+
+// [LAW:effects-at-boundaries][LAW:single-enforcer] The sole effect (spawning
+// `ps`) goes through the one subprocess enforcer, `launchSync`. The ONLY sound
+// signal `ps` gives is a printed start-time row (a live pid we could read);
+// [LAW:no-silent-failure] every other outcome — absent pid, access failure,
+// spawn-error, timeout — is `unavailable`, deferring the alive/dead call to
+// kill(pid,0) rather than risk declaring a live owner dead from a `ps` exit
+// code that cannot distinguish "gone" from "cannot read".
+export function readStartTime(
+  pid: number,
+  launch: Launcher = launchSync,
+): StartTimeRead {
+  const res = launch({
+    bin: "ps",
+    args: ["-o", "lstart=", "-p", String(pid)],
+    category: "process-fingerprint",
+    timeoutMs: 2000,
+    // [FRAMING:representation] Pin BOTH locale and timezone so the token is
+    // deterministic across daemons — the writer and reader must render the same
+    // process identically for opaque string equality to be sound. LC_ALL=C fixes
+    // the strftime format; TZ=UTC fixes localtime(), so DST / TZ / tzdata changes
+    // can't make one live process render two different start-time strings.
+    env: { ...process.env, LC_ALL: "C", TZ: "UTC" },
+  });
+  if (res.ok) {
+    const token = res.stdout.trim();
+    if (token.length > 0) return { kind: "start", token };
+    // Exit 0 with empty output is anomalous (a live pid always lists) — don't
+    // mint an empty-string fingerprint; defer to kill.
+    return { kind: "unavailable", detail: "ps produced no start-time" };
+  }
+  const detail =
+    res.reason === "spawn-error"
+      ? (res.error ?? "ps spawn failed")
+      : `ps ${res.reason} (exit ${res.exitCode})`;
+  return { kind: "unavailable", detail };
+}
+
+export interface LivenessDeps {
+  readStartTime: (pid: number) => StartTimeRead;
+  pidAlive: (pid: number) => boolean;
+}
+
+// [LAW:dataflow-not-control-flow] The liveness verdict is a pure fold over the
+// start-time read + the lease's recorded token. Full input space:
+//   read=start + token matches lease   → true  (same process still alive)
+//   read=start + token differs         → false (a DIFFERENT process holds the
+//                                        pid — a recycle, or a restarted daemon)
+//   read=unavailable                   → kill(pid,0) fallback (the sound
+//                                        alive/dead test: a truly-dead pid →
+//                                        false → reclaim; a live pid ps couldn't
+//                                        read → true → spared)
+//   lease token = null (unfingerprinted at write, e.g. a host without `ps`) →
+//                                        kill(pid,0) fallback for the same reason
+//
+// [LAW:no-silent-failure] Only the `start`+mismatch case comes from the
+// fingerprint; every ambiguous `ps` outcome defers to kill, so the DANGEROUS
+// direction (declaring a live daemon dead → stealing its socket, the storm this
+// epic fights) never happens merely because `ps` could not answer. The only
+// thing forfeited when `ps` cannot answer is detecting a recycled pid.
+export function sameLiveProcess(
+  pid: number,
+  leaseToken: string | null,
+  deps: LivenessDeps,
+): boolean {
+  if (leaseToken === null) return deps.pidAlive(pid);
+  const read = deps.readStartTime(pid);
+  switch (read.kind) {
+    case "start":
+      return read.token === leaseToken;
+    case "unavailable":
+      return deps.pidAlive(pid);
+  }
+}
+
+// Read THIS process's own start-time to stamp into its lease. `unavailable`
+// (no `ps`) collapses to `null` — the lease records "unfingerprinted", and every
+// reader of it falls back to kill(pid,0) via sameLiveProcess. A dead result is
+// impossible for our own live pid; if it somehow occurs we also record null.
+export function readOwnStartTime(
+  pid: number,
+  read: (pid: number) => StartTimeRead = readStartTime,
+): string | null {
+  const r = read(pid);
+  return r.kind === "start" ? r.token : null;
+}

package/src/daemon/server.ts

@@ -22,6 +22,11 @@ import {
   readSocketIdentity,
   type SocketIdentity,
 } from "./socket-ownership";
+import {
+  readStartTime,
+  readOwnStartTime,
+  sameLiveProcess,
+} from "./process-fingerprint";
 import { dlog, closeLog } from "./log";
 import {
   PROTOCOL_VERSION,
@@ -127,8 +132,16 @@ const BIN_CHECK_INTERVAL_MS = 60 * 1000;
 // connection. Any uncaught error exits non-zero; the next client obtains a
 // fresh daemon via obtainDaemonKick() (fire-and-forget caller) or
 // obtainDaemon() (caller waits for readiness) in src/daemon/acquire.ts.
+// [LAW:one-source-of-truth] Our own kernel start-time, read once at startup and
+// stamped into our lease so a future daemon's arbitration can prove whether our
+// pid still names THIS process or a recycled ghost (process-fingerprint.ts).
+// null when this host cannot fingerprint (no `ps`) — readers then fall back to
+// kill(pid,0), no worse than before the fingerprint existed.
+let myStartTime: string | null = null;
+
 export function runDaemon(): void {
   fs.mkdirSync(daemonDir(), { recursive: true });
+  myStartTime = readOwnStartTime(process.pid);
   // [LAW:single-enforcer] Verify the socket parent is uid==me + mode 0700 +
   // not a symlink before we bind. Without this check, a same-host attacker
   // could pre-create the predictable `/tmp/cc-candybar-<uid>` directory and
@@ -236,7 +249,11 @@ function handleAddressInUse(server: net.Server, sockPath: string): void {
   // [LAW:one-source-of-truth] Derive the lease from the SAME sockPath threaded
   // through unlink + rebind below, not the re-derived global — one identity
   // source for the whole arbitration.
-  const decision = arbitrateSocket(readLease(leasePathFor(sockPath)), pidAlive);
+  const decision = arbitrateSocket(
+    readLease(leasePathFor(sockPath)),
+    (pid, startTime) =>
+      sameLiveProcess(pid, startTime, { readStartTime, pidAlive }),
+  );
   if (decision.kind === "attach-and-exit") {
     dlog("info", `EADDRINUSE: ${decision.reason} — exiting`);
     process.exit(0);
@@ -280,20 +297,19 @@ function onListening(sockPath: string): void {
   // the FD yields no path-comparable identity. stat(path), taken as close to the
   // bind as possible, is the only path-comparable truth available.
   //
-  // [FRAMING:representation] Be honest about the ONE window this capture cannot
-  // close. It catches an absent/unreadable path (below): we could not form a
-  // fingerprint, so we have no proof of ownership and exit toward the SAFE
-  // direction (a false-displaced daemon just lets whoever holds the path serve —
-  // no orphan) WITHOUT writing a lease that would stomp a thief's. It does NOT
-  // catch a path that is present but already holds a THIEF's socket — if a second
-  // daemon completed its full EADDRINUSE → read-lease → unlink → rebind cycle in
-  // the single event-loop tick between bind() and this 'listening' callback, we
-  // fingerprint the thief's identity and the self-check reads `owned` forever
-  // (the orphan this module exists to kill). That race is irreducible at this
-  // layer (no race-free handle on our own socket's path-identity exists) and
-  // vanishingly narrow; fully closing it needs the lock-based liveness the epic
-  // deferred (a flock/start-time fingerprint) — the same residual sibling .1's
-  // arbitrateSocket documents for its false-alive direction.
+  // [FRAMING:representation] This inode capture still cannot close the capture
+  // race on its own: if a second daemon completed its full EADDRINUSE →
+  // read-lease → unlink → rebind cycle in the single event-loop tick between
+  // bind() and this 'listening' callback, we stat the path and capture the
+  // THIEF's inode as "ours". No race-free handle on our own socket's path
+  // identity exists (an AF_UNIX listener's fstat is a different namespace's
+  // inode), so the captured inode cannot be made trustworthy. But that is no
+  // longer the immortal orphan it was (brandon-daemon-lifecycle-2b3.4 RESIDUAL
+  // 2): the ownership self-check now ALSO requires the lease to still name us,
+  // and a real thief writes its own pid into the lease — so a displaced daemon
+  // drains within a bounded number of intervals instead of reading `owned`
+  // forever (see checkOwnership). The absent/unreadable case below still exits
+  // toward the SAFE direction without writing a lease that would stomp a thief's.
   const boundRead = readSocketIdentity(sockPath);
   if (boundRead.kind !== "present") {
     dlog(
@@ -330,15 +346,20 @@ function onListening(sockPath: string): void {
 // --- socket-ownership self-check ---
 //
 // [LAW:single-enforcer] The sole enforcer of "serving implies owning the socket
-// path over time" (brandon-daemon-lifecycle-2b3.2). Periodically re-stats the
-// path; if its kernel identity no longer matches what we bound, we were
-// displaced (its socket unlinked + rebound by a reclaimer) and drain through the
-// SAME shutdown funnel as signals, the RSS backstop, and the watchdog — no
-// parallel exit path.
+// path over time" (brandon-daemon-lifecycle-2b3.2). Each interval it re-reads
+// BOTH representations a displacer can touch — the path's kernel identity (still
+// the inode we bound?) and the lease (still names our pid?) — and drains through
+// the SAME shutdown funnel as signals, the RSS backstop, and the watchdog on
+// either mismatch. The lease arm closes the capture race (RESIDUAL 2): a thief
+// that stole our socket inside the bind→listening tick, which the inode arm
+// cannot see because we captured the thief's inode, is caught the moment the
+// thief writes its own pid into the lease. No parallel exit path.
 function armOwnershipWatch(sockPath: string, bound: SocketIdentity): void {
   makeOwnershipWatch({
     bound,
+    myPid: process.pid,
     readIdentity: () => readSocketIdentity(sockPath),
+    readLease: () => readLease(leasePathFor(sockPath)),
     shutdown: (code) => shutdown(code),
     log: dlog,
   }).arm();
@@ -418,7 +439,7 @@ function writeLeaseFile(sockPath: string): void {
     pid: process.pid,
     version: PROTOCOL_VERSION,
     binPath: process.argv[1],
-    startedAt: new Date().toISOString(),
+    startTime: myStartTime,
   });
   if (reason !== null) dlog("warn", `lease write failed: ${reason}`);
 }