@quickchatai/quickreview 0.0.0-stage → 1.1.0

package/dist/src/workersupervisor.js

@@ -0,0 +1,1206 @@
+// The WorkerSupervisor: the daemon's end of the per-round worker.
+//
+// One Node process serves one round of one PR (src/botworker.ts). This module
+// starts it, watches it and ends it:
+//
+//   - SPAWN. `node dist/src/botworker.js --command <id> --mode round|answer`, in
+//     a process group of its own, with the command's capability on an inherited
+//     fd (stdio[3]) and a small env built from an ALLOWLIST. No GitHub credential
+//     of any name is in it (GITHUB_TOKEN_ENVS, from packages/pi-plugin/src/envstrip.ts, so this
+//     module never imports src/engine/), and the capability is on the fd only.
+//   - LISTEN. It serves `worker.spec` and the worker's events over the IPC socket
+//     (src/ipc/server.ts). A request or event is accepted only for the command's
+//     live generation (the claim's attempt count); a worker from an earlier
+//     generation is refused, and its capability is dead anyway.
+//   - WATCH. The worker's heartbeats (`progress` events) are its liveness; the
+//     deadlines tolerate the 0.7-2.5 s a wave's session creation blocks its event
+//     loop (tests/cpu-gate: staggered grants will shorten it, not remove it). A
+//     worker is ended when it stops talking, when a stage runs over, or at its
+//     wall clock: SIGTERM to the group, SIGKILL after the grace.
+//   - LEASE. A file per session (src/workerlease.ts) names the leader's pid, pgid,
+//     start time and the boot/container id, fenced by an owner token. Pids and
+//     pgids repeat in a recreated container, so the daemon's boot signals a
+//     leased group only when the leader still has the recorded start time in the
+//     recorded boot and container.
+//   - WRITE. This module is the single writer of session_commands rows for a
+//     worker-hosted PR: it creates them, claims them, marks them started on the
+//     worker's `accepted`, finishes them from the exit, and requeues a round whose
+//     worker died. The one-active index (`session_commands_one_active`) gives one
+//     worker per session; a second spawn is refused before the row is claimed.
+//   - BREAKER (src/workerbreaker.ts). Every exit is counted: a worker that
+//     served its round resets its PR's count; a non-zero exit, a `failed` event or
+//     a deadline kill adds one. Two in a row park the PR (no further spawn, a
+//     `worker_crash_loop` anomaly, the last error in status.json); failures on three
+//     PRs within 15 minutes drain the bot. A drained bot or a parked PR starts no
+//     worker, of any mode: `launch` refuses and `launchPending` skips. An end by the
+//     daemon's own stop or by the operator is not a failure.
+//   - CONTROL. `control` forwards the operator's steer and follow-up to the
+//     round's worker over its own connection and answers with the worker's ack
+//     (queued, handled or refused); `abortRound` and the recovery `fence` ask the
+//     worker to abort and, when it has not gone within the grace period, SIGKILL its
+//     group (a lease the process table no longer confirms is never signalled).
+//   - TAKEOVER LEASE (src/takeover.ts). While the operator holds a PR's
+//     session no worker starts for it, of any mode (`hostGate`): the command waits
+//     as it does behind a drain, and the lease is freed only once the takeover pi
+//     is confirmed gone. The lease is granted only when no worker command is active.
+//   - HOSTED COMMANDS. A round the debug round runs in interactive pi
+//     (src/debuground.ts) has no worker process, but its row is still this module's to
+//     write: the debug manager asks for the claim, the start mark and the settlement
+//     (`claimHosted`, `markHostedStarted`, `settleHosted`).
+//   - RESTART. On a daemon restart every leased group is killed and its round is
+//     requeued under the same command id (`recover`), so the fresh worker resumes
+//     the JSONL and continues instead of sending the order again.
+//
+// The session host over it is src/worker-session-host.ts: the SessionHooks
+// the daemon's state machine speaks, served by this supervisor.
+import { spawn as nodeSpawn } from "node:child_process";
+import { createHash, randomUUID } from "node:crypto";
+import { closeSync, mkdirSync, openSync, renameSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { GITHUB_TOKEN_ENVS } from "@quickchatai/pi-quickreview/src/envstrip.js";
+import { createCapabilityFd, ipcEnv, stdioWithCapability, } from "./ipc/capability.js";
+import { IpcError, } from "./ipc/protocol.js";
+import { CONTROL_ACK_OP, controlText, parseControlAck, } from "./ipc/control.js";
+import { ghReadOps } from "./ghread.js";
+import { permitOps } from "./ipc/permits.js";
+import { WAKES_ACK_OP, WAKES_TAKE_OP, WORKER_SPEC_OP, parseWorkerSpec, } from "./ipc/workerspec.js";
+import { DEFAULT_ANSWER_CAP_USD, DEFAULT_ANSWER_TIMEOUT_S } from "./config.js";
+import { operatorMayPost } from "./operatormessage.js";
+import { postOps } from "./postops.js";
+import { messagePayload, verifiedPayload } from "./session-command-payload.js";
+import { DEFAULT_WORKER_LOG_LIMITS, rotateWorkerLogs, workerLogPath, } from "./workerlog.js";
+import { WorkerBreaker } from "./workerbreaker.js";
+import { WorkerLeases, judgeLease, killLease, realProc, sendSignal, } from "./workerlease.js";
+/** The env names a worker process may inherit from the daemon. Everything else is
+ * dropped, whatever the daemon's own env holds: a worker carries the daemon's
+ * locale, path and proxies, the tool-uid split the image arranged (the worker
+ * reads them to run the model's tools under it), and nothing that is a secret. */
+export const WORKER_ENV_ALLOW = [
+    "PATH",
+    "HOME",
+    "LANG",
+    "LC_ALL",
+    "LC_CTYPE",
+    "TZ",
+    "TMPDIR",
+    "TERM",
+    "NODE_EXTRA_CA_CERTS",
+    "SSL_CERT_FILE",
+    "SSL_CERT_DIR",
+    "HTTP_PROXY",
+    "HTTPS_PROXY",
+    "NO_PROXY",
+    "http_proxy",
+    "https_proxy",
+    "no_proxy",
+    "PI_CODING_AGENT_DIR",
+    // The separate tool uid (packages/pi-plugin/src/engine/tooluid.ts TOOL_UID_ENVS; named here
+    // because the daemon never imports src/engine/).
+    "QCR_TOOL_UID",
+    "QCR_TOOL_GID",
+    "QCR_TOOL_UID_REQUIRED",
+    "QCR_ALLOW_SHARED_TOOL_UID",
+    // The bot's setid helper, which the worker reaches the tool uid through
+    // (tooluid.ts setidHelperOf): a path, no secret.
+    "QCR_SETPRIV_BIN",
+];
+export const DEFAULT_WORKER_LIMITS = {
+    readyMs: 120_000,
+    acceptMs: 120_000,
+    heartbeatMs: 15_000,
+    missedBeats: 4,
+    stallAllowanceMs: 5_000,
+    wallGraceMs: 30_000,
+    killGraceMs: 10_000,
+    abortGraceMs: 5_000,
+    controlAckMs: 5_000,
+    maxRequeues: 3,
+    tickMs: 1_000,
+    fenceWaitMs: 15_000,
+};
+/** How long, once silent, a worker has before it is ended. */
+export const staleAfterMs = (heartbeatMs, l) => l.missedBeats * heartbeatMs + l.stallAllowanceMs;
+/**
+ * The exit decides the row. Exit 0 is a served round (a verdict may or may not
+ * have been written: that is the round's own business). A worker that failed in
+ * a way a fresh one would repeat (a refused login, a turn that ran out of time or
+ * money, a bad payload) fails the command; one that was lost (killed, crashed,
+ * its daemon went away) hands the round to a fresh worker, which resumes the
+ * JSONL. Ended for its wall clock, or by the operator: failed, not retried. Ended
+ * by a recovery fence: left as it is, for the caller that fenced it.
+ */
+export function decideOutcome(x) {
+    if (x.spawnError !== undefined)
+        return { kind: "failed", reason: `could not start the worker: ${x.spawnError}` };
+    if (x.killedFor === "wall_clock")
+        return { kind: "failed", reason: "the worker ran past its wall clock and was ended" };
+    if (x.killedFor === "fence")
+        return { kind: "leave" };
+    if (x.killedFor === "operator")
+        return { kind: "failed", reason: "the worker was ended by the operator" };
+    if (x.killedFor !== undefined)
+        return { kind: "requeue", reason: `the worker was ended: ${x.killedFor}` };
+    if (x.code === 0)
+        return { kind: "acked" };
+    if (x.code !== null && x.code >= 1 && x.code <= 6)
+        return { kind: "failed", reason: x.failedReason ?? `the worker exited ${x.code}` };
+    return {
+        kind: "requeue",
+        reason: x.signal ? `the worker died of ${x.signal}` : `the worker exited ${x.code}`,
+    };
+}
+/** The env of one worker process: the allowlisted part of the daemon's env, the
+ * daemon's explicit additions, and the IPC names (the fd NUMBER, never the
+ * capability). A GitHub credential is dropped last, by name, so no addition can
+ * carry one in. */
+export function workerProcessEnv(parent, extra, ipc) {
+    const env = {};
+    for (const name of WORKER_ENV_ALLOW) {
+        const value = parent[name];
+        if (value !== undefined && value !== "")
+            env[name] = value;
+    }
+    for (const [name, value] of Object.entries(extra))
+        if (!name.startsWith("QCR_IPC_"))
+            env[name] = value;
+    Object.assign(env, ipc);
+    for (const name of GITHUB_TOKEN_ENVS)
+        delete env[name];
+    return env;
+}
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+export class WorkerLaunchError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "WorkerLaunchError";
+    }
+}
+export class WorkerSupervisor {
+    deps;
+    limits;
+    leases;
+    /** The crash-loop breaker: also the question every host asks before a spawn. */
+    breaker;
+    byCommand = new Map();
+    bySession = new Map();
+    /** Sessions with a launch under way: the second spawn is refused before any await. */
+    launching = new Set();
+    spawnFn;
+    proc;
+    signal;
+    now;
+    log;
+    timer = null;
+    stopping = false;
+    constructor(deps) {
+        this.deps = deps;
+        this.limits = { ...DEFAULT_WORKER_LIMITS, ...deps.limits };
+        this.leases = new WorkerLeases(join(deps.runDir, "workers"));
+        this.spawnFn = deps.spawn ?? nodeSpawn;
+        this.proc = deps.proc ?? realProc;
+        this.signal = deps.signal ?? sendSignal;
+        this.now = deps.now ?? Date.now;
+        this.log = deps.log ?? (() => { });
+        this.breaker = new WorkerBreaker(deps.store, {
+            ...(deps.breaker ? { limits: deps.breaker } : {}),
+            now: this.now,
+            log: this.log,
+        });
+        deps.permits?.attach(deps.capabilities);
+    }
+    // ---- what the IPC server asks the daemon ---------------------------------
+    /** The server's view of a command, read fresh for every request. `active` is
+     * true only while THIS supervisor holds a live worker for the row, so a worker
+     * that outlived its row (or its supervisor) is refused as inactive; the
+     * generation is the live worker's, so an earlier one is refused as stale. */
+    lookup = (commandId) => {
+        const row = this.deps.store.getSessionCommand(commandId);
+        if (!row)
+            return null;
+        const rec = this.byCommand.get(commandId);
+        const live = rec !== undefined &&
+            !rec.settled &&
+            row.status === "running" &&
+            row.owner_token === rec.token;
+        const facts = this.deps.facts?.(row) ?? {};
+        const answer = row.kind === "answer";
+        const state = {
+            pr: row.pr,
+            generation: rec?.generation ?? row.attempt,
+            active: live,
+            // An answer worker posts only when the operator marked its message, and
+            // the daemon's word for that is the payload it dispatched.
+            may_post: answer ? rec?.mayPost === true : facts.may_post === true,
+            lease: facts.lease ?? "none",
+        };
+        if (answer)
+            state.answer = true;
+        return state;
+    };
+    /** The ops the daemon serves a worker: its spec, its post ops, and
+     * its held wakes. */
+    ops() {
+        const ops = {
+            [WORKER_SPEC_OP]: {
+                roles: ["worker"],
+                handle: (ctx) => {
+                    const rec = this.byCommand.get(ctx.commandId);
+                    if (!rec || rec.settled || rec.generation !== ctx.generation)
+                        throw new IpcError("command_inactive", "no live worker for this command");
+                    return rec.spec;
+                },
+            },
+        };
+        ops[CONTROL_ACK_OP] = {
+            roles: ["worker"],
+            handle: (ctx, body) => {
+                const ack = parseControlAck(body);
+                const rec = this.byCommand.get(ctx.commandId);
+                // An ack for a control nobody waits for any more is not an error.
+                rec?.controls.get(ack.id)?.(ack);
+                return {};
+            },
+        };
+        if (this.deps.post)
+            Object.assign(ops, postOps(this.deps.post));
+        if (this.deps.ghRead)
+            Object.assign(ops, ghReadOps({ reader: this.deps.ghRead, log: this.log }));
+        if (this.deps.permits)
+            Object.assign(ops, permitOps(this.deps.permits));
+        const wakes = this.deps.wakes;
+        if (wakes) {
+            ops[WAKES_TAKE_OP] = {
+                roles: ["worker"],
+                handle: (ctx) => ({ batches: wakes.take(ctx) }),
+            };
+            ops[WAKES_ACK_OP] = {
+                roles: ["worker"],
+                handle: (ctx, body) => {
+                    const id = body?.id;
+                    if (typeof id !== "string" || id === "")
+                        throw new IpcError("bad_request", "wakes.ack: `id` must be a string");
+                    wakes.ack(ctx, id);
+                    return {};
+                },
+            };
+        }
+        return ops;
+    }
+    /** The worker's events. Any event is a sign of life; `accepted` is the row's
+     * start; the rest is kept for the exit and handed to the observer. */
+    onEvent = (ctx, kind, body) => {
+        const rec = this.byCommand.get(ctx.commandId);
+        if (!rec || rec.settled || rec.generation !== ctx.generation)
+            return;
+        const t = this.now();
+        rec.lastSeen = t;
+        const b = (typeof body === "object" && body !== null ? body : {});
+        switch (kind) {
+            case "ready":
+                rec.readyAt = t;
+                if (typeof b["session_id"] === "string")
+                    rec.sessionId = b["session_id"];
+                break;
+            case "accepted":
+                if (rec.acceptedAt === undefined) {
+                    rec.acceptedAt = t;
+                    this.deps.store.markSessionCommandStarted(rec.row.id, rec.token, this.iso(this.hardDeadline(rec)));
+                }
+                break;
+            case "verdict_written":
+                rec.verdictWritten = true;
+                break;
+            case "posted":
+                rec.posted++;
+                break;
+            case "failed":
+                if (typeof b["reason"] === "string")
+                    rec.failedReason = b["reason"].slice(0, 500);
+                break;
+            case "done":
+                rec.report = b;
+                break;
+            default:
+                break;
+        }
+        try {
+            this.deps.observe?.({
+                kind,
+                command_id: rec.row.id,
+                pr: rec.row.pr,
+                session: rec.row.session,
+                mode: rec.mode,
+                generation: rec.generation,
+                body,
+            });
+        }
+        catch (e) {
+            this.log(`worker observer failed: ${String(e)}`);
+        }
+    };
+    // ---- the single writer of session_commands -------------------------------
+    /** Create a worker-hosted command: the saved payload and its row. The inject
+     * path is a name only (`worker:<id>`): no bridge reads it. Refused while the
+     * session has work owed, and for a round that is no longer running. */
+    submit(input) {
+        const { store } = this.deps;
+        const session = `pr-${input.pr}`;
+        const blocking = store.blockingSessionCommand(session);
+        if (blocking)
+            throw new Error(`session command ${blocking.id} is ${blocking.status}`);
+        if (input.kind === "round" && input.round_no !== null) {
+            const status = store.roundStatus(input.pr, input.round_no);
+            if (status !== undefined && status !== "running")
+                throw new Error(`round ${input.round_no} of #${input.pr} is ${status}; not submitting its order`);
+        }
+        const id = randomUUID();
+        const payload = messagePayload(input.payload);
+        const payloadPath = join(this.deps.payloadDir, `${id}.md`);
+        mkdirSync(dirname(payloadPath), { recursive: true });
+        const tmp = `${payloadPath}.tmp-${process.pid}`;
+        writeFileSync(tmp, payload);
+        renameSync(tmp, payloadPath);
+        return store.createSessionCommand({
+            id,
+            pr: input.pr,
+            session,
+            kind: input.kind,
+            round_no: input.round_no,
+            payload_sha256: createHash("sha256").update(payload).digest("hex"),
+            payload_path: payloadPath,
+            inject_path: `worker:${id}`,
+            next_check_at: this.iso(this.now() + this.limits.readyMs),
+        });
+    }
+    /** Start a worker for a pending command. Refused (a `WorkerLaunchError`) when
+     * the session already has a worker, a lease held by a live process, or a login
+     * rewrite that does not end; the row is left as it was. */
+    async launch(commandId) {
+        if (this.stopping)
+            throw new WorkerLaunchError("the supervisor is stopping");
+        const first = this.deps.store.getSessionCommand(commandId);
+        if (!first)
+            throw new WorkerLaunchError(`no such command: ${commandId}`);
+        const session = first.session;
+        this.mayStart(first);
+        if (this.bySession.has(session) || this.launching.has(session))
+            throw new WorkerLaunchError(`${session} already has a worker`);
+        this.launching.add(session);
+        try {
+            return await this.launchHeld(commandId, session);
+        }
+        finally {
+            this.launching.delete(session);
+        }
+    }
+    /** Launch every pending command whose session has no worker, oldest first. */
+    async launchPending() {
+        const out = [];
+        for (const row of this.deps.store.activeSessionCommands()) {
+            if (row.status !== "pending" || row.kind === "legacy")
+                continue;
+            if (this.bySession.has(row.session) || this.launching.has(row.session))
+                continue;
+            // An answer is started the moment it is submitted or not at all: one still
+            // pending here was left by a daemon that went away. The operator asks again.
+            if (row.kind === "answer") {
+                this.deps.store.cancelAnswerCommand(row.id, "not started before the daemon stopped; ask again");
+                continue;
+            }
+            // A drained bot or a parked PR starts nothing; the command waits, and the
+            // refusal is not logged every pass.
+            if (!this.breaker.gate(row.pr).ok)
+                continue;
+            if (this.deps.hostGate?.(row.pr))
+                continue; // a takeover holds the session: the command waits
+            try {
+                out.push(await this.launch(row.id));
+            }
+            catch (e) {
+                this.log(`worker launch for ${row.id} failed: ${String(e)}`);
+                this.deps.store.logEvent("worker_launch_refused", row.pr, {
+                    command_id: row.id,
+                    error: String(e).slice(0, 300),
+                });
+            }
+        }
+        return out;
+    }
+    /** The no of the breaker (a drained bot, a parked PR: no worker of any mode; the
+     * debug round asks `breaker.gate` itself) and of the host lease (a PR under a
+     * takeover). The row is left as it was. */
+    mayStart(row) {
+        const verdict = this.breaker.gate(row.pr);
+        if (!verdict.ok)
+            throw new WorkerLaunchError(verdict.reason);
+        // A takeover holds the PR's session: two writers must never append to its JSONL.
+        const held = this.deps.hostGate?.(row.pr);
+        if (held)
+            throw new WorkerLaunchError(held);
+    }
+    async launchHeld(commandId, session) {
+        const { store, capabilities } = this.deps;
+        const gate = this.deps.loginGate;
+        if (gate?.paused() && !(await gate.whenResumed(this.deps.loginWaitMs ?? 30_000)))
+            throw new WorkerLaunchError("a login holds the refresher paused: not starting a worker");
+        if (this.stopping)
+            throw new WorkerLaunchError("the supervisor is stopping");
+        const row = store.getSessionCommand(commandId);
+        if (!row || row.status !== "pending" || row.kind === "legacy")
+            throw new WorkerLaunchError(`command ${commandId} is not a pending worker command`);
+        this.mayStart(row); // a login wait or a failing neighbour may have drained the bot meanwhile
+        // A lease still held by a live worker of ours (another daemon, a worker the
+        // boot could not kill) refuses the spawn; one that names nothing is cleared.
+        const held = this.leases.read(session);
+        if (held !== undefined) {
+            const verdict = held === null ? { kind: "dead" } : judgeLease(held, this.proc);
+            if (verdict.kind === "group" || verdict.kind === "members")
+                throw new WorkerLaunchError(`${session} has a live worker (lease of ${held?.command_id})`);
+            this.leases.forget(session);
+        }
+        // A wake outside a round is the PR's main session carrying on, so it runs as a
+        // round worker does; only an operator's message to an idle PR is an answer.
+        const mode = row.kind === "answer" ? "answer" : "round";
+        const payload = verifiedPayload(row, "the command's payload");
+        if (!payload.ok) {
+            if (row.kind === "answer")
+                store.cancelAnswerCommand(row.id, payload.why);
+            else
+                store.failPendingSessionCommand(row.id, payload.why);
+            throw new WorkerLaunchError(payload.why);
+        }
+        const mayPost = mode === "answer" && operatorMayPost(payload.payload.toString("utf8"));
+        const spec = this.checkedSpec(row, mode, mayPost);
+        const token = WorkerLeases.newToken();
+        const t0 = this.now();
+        const hardDeadline = t0 + spec.wall_clock_ms + this.limits.wallGraceMs + this.limits.killGraceMs;
+        const claimed = store.claimSessionCommand(row.id, token, this.iso(hardDeadline));
+        if (!claimed)
+            throw new WorkerLaunchError(`command ${commandId} was claimed by another`);
+        const generation = claimed.attempt;
+        const lease = {
+            v: 1,
+            owner_token: token,
+            command_id: row.id,
+            session,
+            pr: row.pr,
+            generation,
+            pid: null,
+            pgid: null,
+            start_time: null,
+            boot_id: this.proc.bootId(),
+            command: `botworker --command ${row.id} --mode ${mode}`,
+            created_at: new Date(t0).toISOString(),
+        };
+        let capFd = -1;
+        let logFd = -1;
+        let leased = false;
+        let child;
+        try {
+            this.leases.create(lease);
+            leased = true;
+            const capability = capabilities.mint(row.id);
+            // In run/caps, never run/ itself: run/ is the socket's dir, which the tool
+            // uid must still traverse (0710) when the model's tools run as another uid.
+            capFd = createCapabilityFd(join(this.deps.runDir, "caps"), capability);
+            mkdirSync(this.deps.logDir, { recursive: true });
+            rotateWorkerLogs(this.deps.logDir, row.id, t0, {
+                ...DEFAULT_WORKER_LOG_LIMITS,
+                ...this.deps.logLimits,
+            });
+            logFd = openSync(workerLogPath(this.deps.logDir, row.id), "a", 0o600);
+            const env = workerProcessEnv(this.deps.parentEnv ?? process.env, this.deps.extraEnv ?? {}, ipcEnv({ socketPath: this.deps.socketPath, commandId: row.id, generation }));
+            child = this.spawnFn(this.deps.nodeBin ?? process.execPath, [this.deps.workerMain, "--command", row.id, "--mode", mode], {
+                cwd: spec.root,
+                env,
+                detached: true,
+                stdio: stdioWithCapability(["ignore", logFd, logFd], capFd),
+            });
+        }
+        catch (e) {
+            this.abandon(row.id, token, session, leased, `could not start the worker: ${String(e)}`);
+            throw new WorkerLaunchError(`could not start the worker: ${String(e)}`);
+        }
+        finally {
+            if (capFd >= 0)
+                closeSync(capFd); // the child holds its own copy
+            if (logFd >= 0)
+                closeSync(logFd);
+        }
+        const pid = child.pid;
+        const identity = pid === undefined ? undefined : this.proc.identity(pid);
+        if (pid !== undefined)
+            this.leases.update(session, token, {
+                pid,
+                pgid: identity?.pgid ?? pid,
+                start_time: identity?.start ?? null,
+            });
+        let finish = () => { };
+        const done = new Promise((resolve) => (finish = resolve));
+        const rec = {
+            row: claimed,
+            spec,
+            mode,
+            token,
+            generation,
+            child,
+            lease: { ...lease, pid: pid ?? null, pgid: pid ?? null, start_time: identity?.start ?? null },
+            spawnedAt: t0,
+            wallDeadline: t0 + spec.wall_clock_ms + this.limits.wallGraceMs,
+            staleMs: staleAfterMs(spec.heartbeat_ms ?? this.limits.heartbeatMs, this.limits),
+            lastSeen: t0,
+            readyAt: undefined,
+            acceptedAt: undefined,
+            sessionId: undefined,
+            verdictWritten: false,
+            posted: 0,
+            failedReason: undefined,
+            spawnError: undefined,
+            report: undefined,
+            mayPost,
+            killedFor: undefined,
+            killTimer: undefined,
+            controls: new Map(),
+            forceKilled: false,
+            settled: false,
+            done,
+            finish,
+        };
+        this.byCommand.set(row.id, rec);
+        this.bySession.set(session, rec);
+        child.once("exit", (code, signal) => void this.settle(rec, code, signal));
+        child.once("error", (e) => {
+            if (pid === undefined) {
+                rec.spawnError = e.message;
+                void this.settle(rec, null, null);
+            }
+            else
+                this.log(`worker ${row.id}: ${e.message}`);
+        });
+        store.logEvent("worker_spawned", row.pr, {
+            command_id: row.id,
+            mode,
+            generation,
+            pid: pid ?? null,
+        });
+        return { command_id: row.id, session, pid: pid ?? -1, generation };
+    }
+    /** The spec as the worker will read it: from the builder, checked against the
+     * row (a spec for another command, PR or payload is a bug, not a request), with
+     * no GitHub credential, no IPC name, and the beat interval filled in. */
+    checkedSpec(row, mode, mayPost) {
+        const built = this.deps.buildSpec(row, mode);
+        const env = {};
+        for (const [name, value] of Object.entries(built.env)) {
+            if (name.startsWith("QCR_IPC_"))
+                throw new WorkerLaunchError(`the spec's env names ${name}: the IPC names are the supervisor's`);
+            if (!GITHUB_TOKEN_ENVS.includes(name))
+                env[name] = value;
+        }
+        // An answer is a short worker with caps of its own: the builder's round budget,
+        // its planned wave and its lens dir do not apply, and the may-post mark is the
+        // daemon's own reading of the payload, whatever the builder put.
+        const answer = mode === "answer"
+            ? {
+                wall_clock_ms: this.deps.answer?.timeoutMs ?? Math.round(DEFAULT_ANSWER_TIMEOUT_S * 1000),
+                cap_usd: this.deps.answer?.capUsd ?? DEFAULT_ANSWER_CAP_USD,
+                planned_wave: false,
+                may_post: mayPost,
+                // The newest round's live log is where a viewer following the PR looks.
+                ...(this.newestRound(row.pr) !== undefined
+                    ? { live_round: this.newestRound(row.pr) }
+                    : {}),
+            }
+            : {};
+        const spec = parseWorkerSpec(JSON.parse(JSON.stringify({
+            ...built,
+            ...answer,
+            env,
+            heartbeat_ms: built.heartbeat_ms ?? this.limits.heartbeatMs,
+        })));
+        if (spec.command_id !== row.id ||
+            spec.pr !== row.pr ||
+            spec.session !== row.session ||
+            spec.mode !== mode ||
+            spec.payload_path !== row.payload_path ||
+            spec.payload_sha256 !== row.payload_sha256)
+            throw new WorkerLaunchError("the spec is not for this command");
+        return spec;
+    }
+    newestRound(pr) {
+        return this.deps.store.roundsFor(pr).at(-1)?.round_no;
+    }
+    /** Undo a launch that never produced a process. */
+    abandon(id, token, session, leased, why) {
+        this.deps.capabilities.revoke(id);
+        if (leased)
+            this.leases.remove(session, token);
+        this.finishFailed(id, token, why);
+    }
+    // ---- commands another host runs ---------------------------------
+    /** A round order claimed for a host that is no worker process of ours: the debug
+     * round's interactive pi (src/debuground.ts). The supervisor stays the single writer
+     * of the rows, so the host asks for the claim, the start mark and the settlement
+     * here. `ownerToken` is the host's lease token; the row follows it as a worker's
+     * follows its spawn's. Undefined when another claimed the row first. */
+    claimHosted(commandId, ownerToken, nextCheckAt) {
+        return this.deps.store.claimSessionCommand(commandId, ownerToken, nextCheckAt);
+    }
+    /** The hosted round's order reached its session: the row is started. */
+    markHostedStarted(commandId, ownerToken, nextCheckAt) {
+        return this.deps.store.markSessionCommandStarted(commandId, ownerToken, nextCheckAt);
+    }
+    /**
+     * The hosted command's host is gone (confirmed by the caller). Served: the round's
+     * verdict was committed, so the row is acked. Otherwise the row goes back to
+     * `pending` for a worker, which resumes the session and continues, or
+     * fails once the requeues are spent or its round has ended. Nothing counts against
+     * the PR's crash-loop breaker: a person ended it.
+     */
+    settleHosted(commandId, ownerToken, outcome) {
+        const { store } = this.deps;
+        const row = store.getSessionCommand(commandId);
+        if (!row || row.status !== "running" || row.owner_token !== ownerToken)
+            return "gone";
+        if (outcome.served) {
+            store.markSessionCommandStarted(commandId, ownerToken, this.iso(this.now()));
+            if (store.finishSessionCommand(commandId, ownerToken, "acked"))
+                return "acked";
+        }
+        const reason = outcome.served ? "the round could not be marked served" : outcome.reason;
+        return this.requeueOrFail(commandId, ownerToken, reason) ? "requeued" : "failed";
+    }
+    // ---- watching ------------------------------------------------------------
+    /** Begin the periodic `tick`. */
+    start() {
+        if (this.timer)
+            return;
+        this.timer = setInterval(() => this.tick(), this.limits.tickMs);
+        this.timer.unref();
+        this.deps.permits?.start(this.lookup);
+    }
+    /** One pass of the deadlines. Pure of I/O but for the signals it sends. */
+    tick() {
+        const t = this.now();
+        for (const rec of [...this.byCommand.values()]) {
+            if (rec.settled || rec.killedFor !== undefined)
+                continue;
+            if (t >= rec.wallDeadline)
+                this.end(rec, "wall_clock");
+            else if (rec.readyAt === undefined) {
+                if (t - rec.spawnedAt > this.limits.readyMs)
+                    this.end(rec, "stage_ready");
+            }
+            else if (rec.acceptedAt === undefined && t - rec.readyAt > this.limits.acceptMs)
+                this.end(rec, "stage_accept");
+            else if (t - rec.lastSeen > rec.staleMs)
+                this.end(rec, "heartbeat_lost");
+        }
+    }
+    /** End one worker's group (TERM, then KILL after the grace). The row follows
+     * the exit: an operator's end fails it, a lost worker requeues it. */
+    kill(commandId, why = "operator") {
+        const rec = this.byCommand.get(commandId);
+        if (!rec || rec.settled)
+            return false;
+        this.end(rec, why);
+        return true;
+    }
+    end(rec, why) {
+        if (rec.settled || rec.killedFor !== undefined)
+            return;
+        rec.killedFor = why;
+        this.log(`ending worker ${rec.row.id} (${why})`);
+        this.deps.store.logEvent("worker_ending", rec.row.pr, { command_id: rec.row.id, why });
+        this.signalGroup(rec, "SIGTERM");
+        rec.killTimer = setTimeout(() => {
+            if (!rec.settled)
+                this.signalGroup(rec, "SIGKILL");
+        }, this.limits.killGraceMs);
+        rec.killTimer.unref();
+    }
+    /** Signal the live child's group. Safe by construction: the child has not been
+     * reaped, so its pid cannot belong to anyone else. */
+    signalGroup(rec, sig) {
+        const pid = rec.child.pid;
+        if (pid === undefined)
+            return;
+        if (this.signal(-pid, sig) === "denied")
+            this.log(`worker ${rec.row.id}: ${sig} to the group was refused`);
+    }
+    async settle(rec, code, signal) {
+        if (rec.settled)
+            return;
+        rec.settled = true;
+        if (rec.killTimer)
+            clearTimeout(rec.killTimer);
+        for (const [id, resolve] of [...rec.controls])
+            resolve({ id, ack: "refused", reason: "the worker ended" });
+        const { store } = this.deps;
+        let survivors = false;
+        try {
+            // The leader is gone; whatever it left in its group goes with it.
+            const leftovers = await killLease(rec.lease, {
+                proc: this.proc,
+                signal: this.signal,
+                graceMs: 0,
+                pollMs: 10,
+            });
+            if (leftovers.verdict === "members")
+                this.log(`worker ${rec.row.id}: left members in its group; ended`);
+            if (leftovers.survivors) {
+                survivors = true;
+                this.log(`worker ${rec.row.id}: group members survived the kill`);
+            }
+            this.deps.capabilities.revoke(rec.row.id);
+            const outcome = decideOutcome({
+                code,
+                signal,
+                killedFor: rec.killedFor,
+                failedReason: rec.failedReason,
+                spawnError: rec.spawnError,
+            });
+            this.apply(rec, outcome);
+            store.logEvent("worker_exited", rec.row.pr, {
+                command_id: rec.row.id,
+                generation: rec.generation,
+                code,
+                signal,
+                outcome: outcome.kind,
+                ...(outcome.kind === "acked" || outcome.kind === "leave" ? {} : { reason: outcome.reason }),
+                verdict_written: rec.verdictWritten,
+                posted: rec.posted,
+            });
+            this.count(rec, outcome, code);
+            this.tell(rec, outcome, code, signal);
+        }
+        catch (e) {
+            this.log(`settling worker ${rec.row.id} failed: ${String(e)}`);
+        }
+        finally {
+            // A lease whose group members survived stays: it is what keeps a successor
+            // from launching beside them (launchHeld) until the process table shows them gone.
+            if (!survivors)
+                this.leases.remove(rec.row.session, rec.token);
+            this.byCommand.delete(rec.row.id);
+            if (this.bySession.get(rec.row.session) === rec)
+                this.bySession.delete(rec.row.session);
+            rec.finish();
+        }
+    }
+    /** Tell the breaker how the worker ended. A served round is a success; a
+     * non-zero exit, a `failed` event or a deadline kill is a failure; the daemon's
+     * own stop, the operator's end and a recovery fence are neither. A PR parked by this failure has
+     * no round to retry, so a requeue it just got is failed instead. */
+    count(rec, outcome, code) {
+        const { pr } = rec.row;
+        // An answer is the operator's chat, not the PR's round: its failures do not park
+        // the PR or feed the drain, and its success must not hide a round's crash loop.
+        if (rec.mode === "answer")
+            return;
+        // A fenced worker was ended by the caller, who owns the row's fate: not a worker failure.
+        if (rec.killedFor === "shutdown" || rec.killedFor === "operator" || outcome.kind === "leave")
+            return;
+        if (outcome.kind === "acked" && rec.failedReason === undefined) {
+            this.breaker.success(pr);
+            return;
+        }
+        const error = rec.failedReason ??
+            (outcome.kind === "acked"
+                ? `the worker reported a failure and exited ${code}`
+                : outcome.reason);
+        const res = this.breaker.failure(pr, rec.row.id, error);
+        if (res.parked && outcome.kind === "requeue")
+            this.deps.store.failPendingSessionCommand(rec.row.id, `PR #${pr} is parked after ${res.failures} consecutive worker failures: ${error}`.slice(0, 500));
+    }
+    /** Hand the host that submitted the command what the worker came to. */
+    tell(rec, outcome, code, signal) {
+        if (!this.deps.settled)
+            return;
+        try {
+            this.deps.settled({
+                command_id: rec.row.id,
+                pr: rec.row.pr,
+                session: rec.row.session,
+                mode: rec.mode,
+                kind: rec.row.kind,
+                outcome: outcome.kind,
+                reason: outcome.kind === "failed" || outcome.kind === "requeue"
+                    ? (rec.failedReason ?? outcome.reason)
+                    : undefined,
+                code,
+                signal,
+                report: rec.report,
+                posted: rec.posted,
+                verdict_written: rec.verdictWritten,
+                may_post: rec.mayPost,
+            });
+        }
+        catch (e) {
+            this.log(`worker settled hook failed: ${String(e)}`);
+        }
+    }
+    apply(rec, outcome) {
+        const { store } = this.deps;
+        const id = rec.row.id;
+        if (outcome.kind === "leave")
+            return;
+        if (outcome.kind === "acked") {
+            // An exit 0 is the round served, whether or not `accepted` got through.
+            store.markSessionCommandStarted(id, rec.token, this.iso(this.now()));
+            store.finishSessionCommand(id, rec.token, "acked");
+        }
+        else if (outcome.kind === "failed") {
+            this.finishFailed(id, rec.token, outcome.reason);
+        }
+        else {
+            this.requeueOrFail(id, rec.token, outcome.reason);
+        }
+    }
+    /** Hand the command to a fresh worker, or fail it once the requeues are spent
+     * (or its round has ended meanwhile). */
+    requeueOrFail(id, token, reason) {
+        const { store } = this.deps;
+        const row = store.getSessionCommand(id);
+        if (!row || row.status !== "running")
+            return false;
+        // A lost answer worker is not replayed: the operator is told (the reply file
+        // says the worker was lost) and asks again if they still want the answer.
+        if (row.kind === "answer") {
+            store.cancelAnswerCommand(id, reason);
+            return false;
+        }
+        if (row.recovery_attempts >= this.limits.maxRequeues) {
+            this.failRow(row, token, `${reason}; requeued ${row.recovery_attempts} times already`);
+            return false;
+        }
+        if (store.requeueWorkerCommand(id, token, this.iso(this.now())))
+            return true;
+        this.failRow(row, token, `${reason}; its round is no longer running`);
+        return false;
+    }
+    failRow(row, token, why) {
+        const { store } = this.deps;
+        if (token !== null)
+            this.finishFailed(row.id, token, why);
+        else {
+            store.failActiveSessionCommand(row.id, why);
+            this.endAnswer(row.id, why);
+        }
+    }
+    /** The row's `failed`, except that an answer command never ends failed: a failed
+     * non-round command is owed work that blocks the PR's next round, and an
+     * operator's message owes nothing (`cancelAnswerCommand`). */
+    finishFailed(id, token, why) {
+        const done = this.deps.store.finishSessionCommand(id, token, "failed", why);
+        if (done)
+            this.endAnswer(id, why);
+        return done;
+    }
+    endAnswer(id, why) {
+        if (this.deps.store.getSessionCommand(id)?.kind === "answer")
+            this.deps.store.cancelAnswerCommand(id, why);
+    }
+    // ---- restart -------------------------------------------------------------
+    /**
+     * The daemon's boot: no worker of a previous daemon is wanted. Every
+     * leased group is killed (only when the leader still has the lease's start time
+     * in the lease's boot/container), the leases are removed, and every command a
+     * dead worker held is handed back to `pending` under its own id, so the fresh
+     * worker resumes the JSONL and continues. A command whose group could not be
+     * ended is failed, not requeued: two workers must never serve one session.
+     * Run before any `launch`.
+     */
+    async recover() {
+        const result = { killed: [], stale: [], requeued: [], failed: [] };
+        const unkillable = new Set();
+        const entries = this.leases.list();
+        await Promise.all(entries.map(async ({ session, lease }) => {
+            if (lease === null) {
+                this.leases.forget(session);
+                result.stale.push(session);
+                return;
+            }
+            const out = await killLease(lease, {
+                proc: this.proc,
+                signal: this.signal,
+                graceMs: this.limits.killGraceMs,
+            });
+            if (out.verdict === "group" || out.verdict === "members")
+                result.killed.push(session);
+            else
+                result.stale.push(session);
+            if (out.survivors)
+                unkillable.add(lease.command_id);
+            else
+                this.leases.forget(session);
+            this.deps.store.logEvent("worker_lease_recovered", lease.pr, {
+                command_id: lease.command_id,
+                verdict: out.verdict,
+                killed: out.killed,
+                denied: out.denied,
+                survivors: out.survivors,
+            });
+        }));
+        for (const row of this.deps.store.activeSessionCommands()) {
+            if (row.status !== "running" || this.byCommand.has(row.id))
+                continue;
+            if (unkillable.has(row.id)) {
+                const why = "the previous worker's group could not be ended";
+                this.failRow(row, null, why);
+                this.tellLostAnswer(row, why);
+                result.failed.push(row.id);
+            }
+            else if (this.requeueOrFail(row.id, null, "the daemon restarted"))
+                result.requeued.push(row.id);
+            else {
+                this.tellLostAnswer(row, "the daemon restarted");
+                result.failed.push(row.id);
+            }
+        }
+        return result;
+    }
+    /** An answer command a restart cancelled has no worker to settle it: tell the
+     * `settled` hook, which owes the operator the result file it advertised. */
+    tellLostAnswer(row, reason) {
+        if (row.kind !== "answer" || !this.deps.settled)
+            return;
+        const payload = verifiedPayload(row, "the command's payload");
+        try {
+            this.deps.settled({
+                command_id: row.id,
+                pr: row.pr,
+                session: row.session,
+                mode: "answer",
+                kind: row.kind,
+                outcome: "failed",
+                reason: `the worker was lost: ${reason}`,
+                code: null,
+                signal: null,
+                report: undefined,
+                posted: 0,
+                verdict_written: false,
+                may_post: payload.ok && operatorMayPost(payload.payload.toString("utf8")),
+            });
+        }
+        catch (e) {
+            this.log(`worker settled hook failed: ${String(e)}`);
+        }
+    }
+    /** The daemon is going down: end every worker; their commands requeue. */
+    async stop() {
+        this.stopping = true;
+        if (this.timer)
+            clearInterval(this.timer);
+        this.timer = null;
+        this.deps.permits?.stop();
+        const live = [...this.byCommand.values()];
+        for (const rec of live)
+            this.end(rec, "shutdown");
+        await Promise.all(live.map((rec) => rec.done));
+    }
+    // ---- the session host's questions -----------------------------------
+    /**
+     * Does a worker of this session run? Ours (a live child, or a launch under way),
+     * or one a lease file still names that the process table confirms. The host's
+     * liveness answer: a lease alone never says "alive", since pids repeat.
+     */
+    runs(session) {
+        if (this.bySession.has(session) || this.launching.has(session))
+            return true;
+        const held = this.leases.read(session);
+        if (!held)
+            return false;
+        const verdict = judgeLease(held, this.proc);
+        return verdict.kind === "group" || verdict.kind === "members";
+    }
+    /**
+     * End the session's worker and answer only once it is proven gone: true when no
+     * worker of the session runs (it had none, or its exit has been reaped), false
+     * when it outlived `fenceWaitMs`. The command's row is left as it is (`fence`):
+     * the caller fenced the session to decide the row itself. A launch that is
+     * still under way is waited out first, so a worker cannot start behind the fence.
+     */
+    async fence(session) {
+        // Real time, not the injected clock: this waits on processes.
+        const end = Date.now() + this.limits.fenceWaitMs;
+        while (this.launching.has(session) && Date.now() < end)
+            await sleep(5);
+        const rec = this.bySession.get(session);
+        if (rec) {
+            // Abort first (the worker stops its session and the passes it started, and
+            // exits); the group is sent SIGKILL when that has not happened in the grace.
+            this.startAbort(rec, "fence");
+            await this.exited(rec, Math.max(0, end - Date.now()));
+        }
+        else {
+            // No child of ours, but a lease may still name a group (a worker the boot
+            // could not end, another daemon's). It is killed only while its leader still
+            // has the lease's start time in the lease's boot and container (judgeLease):
+            // a recycled pid or pgid is a stranger's and is left alone.
+            const held = this.leases.read(session);
+            if (held) {
+                const out = await killLease(held, {
+                    proc: this.proc,
+                    signal: this.signal,
+                    graceMs: 0,
+                    pollMs: 10,
+                });
+                if (!out.survivors)
+                    this.leases.forget(session);
+            }
+        }
+        return !this.runs(session);
+    }
+    /**
+     * Hand a command whose worker has been fenced and is gone back to `pending`
+     * under the same id, for a fresh worker (`launch`) to resume. The CAS is on the
+     * attempt the caller read, so a row that moved since is not replayed.
+     */
+    replay(commandId, expectedAttempt) {
+        return this.deps.store.retrySessionCommandAfterFence(commandId, expectedAttempt, this.iso(this.now() + this.limits.readyMs));
+    }
+    // ---- the operator's controls ---------------------------------------
+    /** The PR's worker, if it can be controlled: running, past `ready`, and not
+     * already on its way out. A refusal says why. */
+    controllable(pr) {
+        const rec = this.bySession.get(`pr-${pr}`);
+        if (!rec || rec.settled)
+            return `no worker is running for #${pr}`;
+        if (rec.killedFor !== undefined)
+            return `the worker of #${pr} is ending`;
+        if (rec.readyAt === undefined)
+            return `the worker of #${pr} has not opened its session yet`;
+        return rec;
+    }
+    /** Push `kind` to the worker and say when its ack comes: null when the worker
+     * is not reachable, the ack otherwise (a settled worker acks `refused`). */
+    forward(rec, kind, text, waitMs) {
+        const id = randomUUID();
+        let timer;
+        const ack = new Promise((resolve) => {
+            rec.controls.set(id, (a) => resolve(a));
+            timer = setTimeout(() => resolve(null), waitMs);
+            timer.unref();
+        }).finally(() => {
+            clearTimeout(timer);
+            rec.controls.delete(id);
+        });
+        const sent = this.deps.push?.(rec.row.id, kind, {
+            id,
+            ...(text !== undefined ? { text } : {}),
+        });
+        if (!sent)
+            rec.controls.get(id)?.({ id, ack: "refused", reason: "the worker is not connected" });
+        return { sent: sent ?? 0, ack, id };
+    }
+    /**
+     * Forward the operator's steer or follow-up to the PR's running worker and answer
+     * with the worker's word: `queued` (the session has it and acts when its turn
+     * allows), `handled` (it acted now), or a refusal with the reason. The text is
+     * validated here as well as by the command's schema. A worker that does not answer
+     * in `controlAckMs` is reported unacknowledged, never as delivered.
+     */
+    async control(pr, kind, text) {
+        let checked;
+        try {
+            checked = controlText(text);
+        }
+        catch (e) {
+            return { ok: false, reason: e instanceof Error ? e.message : String(e) };
+        }
+        if (!this.deps.push)
+            return { ok: false, reason: "this daemon cannot reach its workers" };
+        const rec = this.controllable(pr);
+        if (typeof rec === "string")
+            return { ok: false, reason: rec };
+        const { ack } = this.forward(rec, kind, checked, this.limits.controlAckMs);
+        const got = await ack;
+        if (got === null)
+            return { ok: false, reason: `the worker of #${pr} did not answer; check the session` };
+        if (got.ack === "refused")
+            return { ok: false, reason: got.reason ?? `the worker of #${pr} refused it` };
+        return { ok: true, ack: got.ack, command_id: rec.row.id };
+    }
+    /**
+     * The operator's abort-round: ask the worker to stop its session (and the lens
+     * passes it started) and end. The command's row fails as ended by the operator
+     * (`decideOutcome`). A worker that has not exited within `abortGraceMs`, or that
+     * cannot be reached, has its group sent SIGKILL.
+     */
+    async abortRound(pr) {
+        const rec = this.bySession.get(`pr-${pr}`);
+        if (!rec || rec.settled)
+            return { ok: false, reason: `no worker is running for #${pr}` };
+        if (rec.killedFor !== undefined)
+            return { ok: true, ack: "handled", command_id: rec.row.id, killed: rec.forceKilled };
+        const { ack, sent } = this.startAbort(rec, "operator");
+        // An ack ends the wait. So does the exit. No ack in the grace period (or a worker
+        // that could not be asked) means the SIGKILL is due: wait for it to land.
+        const got = sent > 0 ? await Promise.race([ack, rec.done]) : null;
+        if (got === null || got === undefined)
+            await this.exited(rec, this.limits.fenceWaitMs);
+        return { ok: true, ack: "handled", command_id: rec.row.id, killed: rec.forceKilled };
+    }
+    /** Resolve when `rec` has been reaped or after `ms`, whichever is first. */
+    async exited(rec, ms) {
+        let timer;
+        await Promise.race([
+            rec.done,
+            new Promise((resolve) => {
+                timer = setTimeout(resolve, ms);
+                timer.unref();
+            }),
+        ]);
+        clearTimeout(timer);
+    }
+    /** Ask `rec`'s worker to abort and arm the SIGKILL of its group for when it has
+     * not exited in the grace period (at once, when it cannot be asked). The row
+     * follows the exit as `why` says. */
+    startAbort(rec, why) {
+        const fresh = rec.killedFor === undefined;
+        if (fresh) {
+            rec.killedFor = why;
+            this.log(`aborting worker ${rec.row.id} (${why})`);
+            this.deps.store.logEvent("worker_ending", rec.row.pr, { command_id: rec.row.id, why });
+        }
+        const { sent, ack } = this.forward(rec, "abort", undefined, this.limits.abortGraceMs);
+        if (fresh) {
+            rec.killTimer = setTimeout(() => {
+                if (rec.settled)
+                    return;
+                rec.forceKilled = true;
+                this.log(`worker ${rec.row.id} did not stop on abort: SIGKILL to its group`);
+                this.signalGroup(rec, "SIGKILL");
+            }, sent > 0 ? this.limits.abortGraceMs : 0);
+            rec.killTimer.unref();
+        }
+        return { ack, sent };
+    }
+    // ---- views ---------------------------------------------------------------
+    isLive(session) {
+        return this.bySession.has(session);
+    }
+    workers() {
+        const t = this.now();
+        return [...this.byCommand.values()].map((rec) => ({
+            command_id: rec.row.id,
+            pr: rec.row.pr,
+            session: rec.row.session,
+            mode: rec.mode,
+            pid: rec.child.pid ?? -1,
+            generation: rec.generation,
+            stage: rec.readyAt === undefined ? "starting" : rec.acceptedAt === undefined ? "ready" : "running",
+            age_ms: t - rec.spawnedAt,
+            silent_ms: t - rec.lastSeen,
+            ending: rec.killedFor ?? null,
+        }));
+    }
+    hardDeadline(rec) {
+        return rec.wallDeadline + this.limits.killGraceMs;
+    }
+    iso(ms) {
+        return new Date(ms).toISOString();
+    }
+}
+//# sourceMappingURL=workersupervisor.js.map