@quolu/lattice 0.63.2 → 0.63.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@quolu/lattice",
-  "version": "0.63.2",
+  "version": "0.63.4",
   "description": "Schedulability compiler for multi-agent development: observe real code boundaries, refactor the conflicting seam, recompile the plan for parallel execution",
   "author": {
     "name": "Quo / クオ at kitepon.dev",

package/src/runtime-control-store.mjs

@@ -319,6 +319,15 @@ async function replaceCanonical({ pathname, expectedBytes, value, validator, cra
   }
 }
 
+/**
+ * control-events.jsonを書く他module（gate storeのatomic commit）が、このstoreのappendと
+ * 同じper-directory直列化を共有するための入口。同一process内で書き手が2つの規律に
+ * 分かれると、appendがcommitの読みと置換の間へ挟まり偽のcommitted prefix衝突になる。
+ */
+export function withControlJournalMutation(runDir, mutation) {
+  return enqueue(path.resolve(runDir), mutation);
+}
+
 function enqueue(runDir, mutation) {
   const previous = mutationQueues.get(runDir) ?? Promise.resolve();
   const result = previous.then(mutation);

package/src/runtime-direct-os-observer.mjs

@@ -1,14 +1,12 @@
-import { execFile } from 'node:child_process';
 import { lstat, realpath } from 'node:fs/promises';
 import path from 'node:path';
-import { promisify } from 'node:util';
 
 import { digestArtifact } from './artifact-contracts.mjs';
 import { selfDigest } from './runtime-contracts.mjs';
 import { validateProcessStartIdentity } from './runtime-controller-protocol.mjs';
 import { captureWorktreeDiff } from './runtime-diff-observer.mjs';
+import { observePsSnapshot } from './runtime-os-observation.mjs';
 
-const execFileAsync = promisify(execFile);
 const GIT_SHA1 = /^[0-9a-f]{40}$/;
 const SHA256 = /^[0-9a-f]{64}$/;
 
@@ -70,10 +68,7 @@ function validateResolvedBinding(value) {
 
 async function runPsSnapshot() {
   try {
-    const { stdout } = await execFileAsync('/bin/ps', [
-      '-axo', 'pid=,ppid=,pgid=,state=,lstart=',
-    ], { encoding: 'utf8', maxBuffer: 8 * 1024 * 1024 });
-    return stdout;
+    return await observePsSnapshot();
   } catch (error) {
     fail(`ps観測失敗: ${error?.code ?? error?.message ?? 'unknown'}`);
   }

package/src/runtime-gate-store.mjs

@@ -4,6 +4,7 @@ import { lstat, mkdir, open, readFile, rename, unlink } from 'node:fs/promises';
 import path from 'node:path';
 
 import { canonicalizeArtifact } from './artifact-contracts.mjs';
+import { withControlJournalMutation } from './runtime-control-store.mjs';
 import { selfDigest } from './runtime-contracts.mjs';
 
 const SHA256 = /^[0-9a-f]{64}$/;
@@ -407,9 +408,17 @@ async function commitBuilt({ runDir, built, crashInjector, controlEventsPath = n
 }
 
 export async function commitRuntimeGateActivation(options) {
-  const built = await buildCommit(options);
-  return commitBuilt({ runDir: options.runDir, built, crashInjector: options.crashInjector,
-    controlEventsPath: options.controlEventsPath ?? null });
+  // control journalの読み(buildCommit)と置換(commitBuilt)の間へ、同一process内の
+  // control store appendが挟まると、committed prefix検査が偽のGATE_COMMIT_CONFLICTに
+  // なる（2026-08-22 CI負荷下で実被弾: managed recompileのepoch activationへdaemonの
+  // 並行appendが割り込んだ）。appendと同じper-directory直列化を共有して排除する。
+  // 別process間の競合検査は従来どおりprefix比較が持つ。
+  const eventsPath = options.controlEventsPath ?? path.join(options.runDir, 'control-events.json');
+  return withControlJournalMutation(path.dirname(eventsPath), async () => {
+    const built = await buildCommit(options);
+    return commitBuilt({ runDir: options.runDir, built, crashInjector: options.crashInjector,
+      controlEventsPath: options.controlEventsPath ?? null });
+  });
 }
 
 export async function recoverRuntimeGateCommit(options) {

package/src/runtime-managed-supervisor.mjs

@@ -10,6 +10,7 @@ import { selfDigest } from './runtime-contracts.mjs';
 import { captureWorktreeDiff } from './runtime-diff-observer.mjs';
 import { pidsOwningSocketPath, socketPathsOwnedByPid } from './runtime-socket-owner.mjs';
 import { createDirectOsProcessObserver as createDirectOsProcessObserverV2 } from './runtime-direct-os-observer.mjs';
+import { observeExecutablePath, observeStartIdentityRaw, osObservationEnvironment } from './runtime-os-observation.mjs';
 import {
   armStagedWriteLease,
   createControllerBootstrap,
@@ -59,14 +60,11 @@ export async function observeManagedProcessStartIdentity(pid) {
   }
   let startedIdentity;
   try {
-    const executable = process.platform === 'win32' ? 'powershell.exe' : '/bin/ps';
-    const args = process.platform === 'win32'
-      ? ['-NoProfile', '-NonInteractive', '-Command',
-        `[System.Diagnostics.Process]::GetProcessById(${pid}).StartTime.ToUniversalTime().Ticks`]
-      : ['-o', 'lstart=', '-p', String(pid)];
-    const { stdout } = await execFileAsync(executable, args, { encoding: 'utf8' });
-    startedIdentity = stdout.trim();
-  } catch { fail('ADAPTER_CONTROLLER_UNAVAILABLE', `process start identity観測失敗: ${pid}`); }
+    startedIdentity = await observeStartIdentityRaw(pid);
+  } catch (error) {
+    const cause = String(error?.stderr ?? '').trim() || error?.message || 'unknown';
+    fail('ADAPTER_CONTROLLER_UNAVAILABLE', `process start identity観測失敗: pid=${pid}, 観測コマンドの失敗=${cause}`);
+  }
   if (!startedIdentity) fail('ADAPTER_CONTROLLER_UNAVAILABLE', `process不在: ${pid}`);
   const identity = { schema: 'lattice.process_start_identity.v1', platform: process.platform, pid, started_identity: startedIdentity, identity_digest: '' };
   identity.identity_digest = selfDigest(identity, 'identity_digest');
@@ -109,18 +107,10 @@ export async function observeProcessExecutablePath(pid) {
   if (!Number.isSafeInteger(pid) || pid < 1) {
     fail('ADAPTER_BINARY_IDENTITY_MISMATCH', 'exec後image PID不正');
   }
-  if (process.platform === 'linux') {
-    return realpath(`/proc/${pid}/exe`);
-  }
-  if (process.platform === 'darwin') {
-    const { stdout } = await execFileAsync(
-      '/bin/ps',
-      ['-o', 'comm=', '-p', String(pid)],
-      { encoding: 'utf8' },
-    );
-    return realpath(stdout.trim());
+  if (process.platform !== 'linux' && process.platform !== 'darwin') {
+    fail('ADAPTER_BINARY_IDENTITY_MISMATCH', `exec後image path観測未対応platform: ${process.platform}`);
   }
-  fail('ADAPTER_BINARY_IDENTITY_MISMATCH', `exec後image path観測未対応platform: ${process.platform}`);
+  return observeExecutablePath(pid);
 }
 
 /** storeが解決したimmutable bindingからprocess/worktree/checkpointをDirect OSで再観測する。 */
@@ -170,7 +160,7 @@ export function createDirectOsProcessObserver({ resolveObservationBinding }) {
     let observedIdentity = resolved.process_start_identity;
     let processGroupId = resolved.process_group_id;
     try {
-      const { stdout } = await execFileAsync('/bin/ps', ['-o', 'lstart=,pgid=,state=', '-p', String(resolved.process_pid)], { encoding: 'utf8' });
+      const { stdout } = await execFileAsync('/bin/ps', ['-o', 'lstart=,pgid=,state=', '-p', String(resolved.process_pid)], { encoding: 'utf8', env: osObservationEnvironment() });
       const line = stdout.trim();
       if (line) {
         const match = line.match(/^(.*\d{4})\s+(\d+)\s+(\S+)$/);
@@ -188,7 +178,7 @@ export function createDirectOsProcessObserver({ resolveObservationBinding }) {
     }
     if (!['stopped', 'exited'].includes(processState)) fail('HOLD_ACKS_INCOMPLETE', 'executor processがquiescedでない');
     try {
-      const { stdout: groupStdout } = await execFileAsync('/bin/ps', ['-o', 'pid=,state=', '-g', String(resolved.process_group_id)], { encoding: 'utf8' });
+      const { stdout: groupStdout } = await execFileAsync('/bin/ps', ['-o', 'pid=,state=', '-g', String(resolved.process_group_id)], { encoding: 'utf8', env: osObservationEnvironment() });
       for (const line of groupStdout.trim().split('\n').filter(Boolean)) {
         const match = line.trim().match(/^(\d+)\s+(\S+)$/);
         if (!match || (!match[2].startsWith('T') && !match[2].startsWith('Z'))) fail('HOLD_ACKS_INCOMPLETE', 'process group childがquiescedでない');
@@ -1011,8 +1001,33 @@ async function activateManagedSupervisorController({ repoRoot, runDir, runId, ad
         fail('ADAPTER_LAUNCH_INVALID', 'existing endpoint ownerが一意でない');
       }
     }
-    const handshake = await exchangeControllerHandshake({ socketPath: handshakeConnectPath, runId,
-      supervisorSessionNonce, controllerSocketRef, timeoutMs });
+    // socket fileの出現はbindの証拠でありlistenの証拠ではない。負荷下ではcontrollerが
+    // bindとlistenの間でpreemptされ、fileを見て接続した一回だけECONNREFUSEDになる
+    // （2026-08-22 CI負荷下で実被弾）。起動したchildに限り、listen受理までを起動待ちに
+    // 含めてdeadline内はECONNREFUSEDだけを待ち直す。死んだcontrollerはexitCode検査が、
+    // 起動しないcontrollerはdeadlineが従来どおり落とす。既存endpoint（child無し）は
+    // owner検証済みのlistener前提なので単発のまま。
+    const handshakeDeadline = Date.now() + timeoutMs;
+    let handshake;
+    for (;;) {
+      try {
+        handshake = await exchangeControllerHandshake({ socketPath: handshakeConnectPath, runId,
+          supervisorSessionNonce, controllerSocketRef, timeoutMs });
+        break;
+      } catch (error) {
+        const listenPending = child !== null && error instanceof ManagedRuntimeError
+          && ['ECONNREFUSED', 'ENOENT'].some((code) => String(error.message).includes(code))
+          && Date.now() < handshakeDeadline;
+        if (!listenPending) throw error;
+        if (child.exitCode !== null) {
+          fail(
+            'ADAPTER_CONTROLLER_UNAVAILABLE',
+            `controller exited: ${child.exitCode}${childStderr ? `: ${childStderr.trim()}` : ''}`,
+          );
+        }
+        await new Promise((resolve) => setTimeout(resolve, 20));
+      }
+    }
     const controllerDescriptor = handshake.descriptor;
     if (controllerDescriptor.adapter_kind !== adapterKind || controllerDescriptor.socket_ref !== controllerSocketRef
       || controllerDescriptor.capabilities.capabilities_digest !== launch.capabilities_digest

package/src/runtime-multi-epoch-store.mjs

@@ -490,18 +490,11 @@ export async function activateEpochOneStore({
     }
   }
 
-  const meta = {
-    schema: 'lattice.run_meta.v2',
-    run_id: normalizedMeta.run_id,
-    executor_adapter: normalizedMeta.executor_adapter,
-    run_event_schema: 'lattice.run_event.v1',
-    control_event_schema: 'lattice.runtime_control_event.v1',
-    epoch_bundle_schema: 'lattice.runtime_epoch_bundle.v1',
-    created_plan_digest: compileArtifact.plan.plan_digest,
-  };
-  meta.meta_digest = digestArtifact(meta);
-  await replaceDurableJson(runDir, 'run-meta.json', meta);
-
+  // pointerをmetaより先に書く。読み手はmeta v2を見てからpointerを読むので、逆順だと
+  // 2書き込みの間にmeta v2だけが見え、並行するreaderがINVALID_RUN_STORE
+  // （committed epoch pointerを読めない）で落ちる（2026-08-22 CI負荷下で実被弾）。
+  // この順ならmeta v2の可視がpointer実在を含意し、途中crashはmeta v1のまま
+  // （余剰のpointerはlegacy読取りに影響せず、再activationが置換する）。
   const pointer = {
     schema: 'lattice.committed_epoch_pointer.v1',
     run_id: normalizedMeta.run_id,
@@ -513,6 +506,18 @@ export async function activateEpochOneStore({
   };
   pointer.pointer_digest = digestArtifact(pointer);
   await replaceDurableJson(runDir, 'committed-epoch.json', pointer);
+
+  const meta = {
+    schema: 'lattice.run_meta.v2',
+    run_id: normalizedMeta.run_id,
+    executor_adapter: normalizedMeta.executor_adapter,
+    run_event_schema: 'lattice.run_event.v1',
+    control_event_schema: 'lattice.runtime_control_event.v1',
+    epoch_bundle_schema: 'lattice.runtime_epoch_bundle.v1',
+    created_plan_digest: compileArtifact.plan.plan_digest,
+  };
+  meta.meta_digest = digestArtifact(meta);
+  await replaceDurableJson(runDir, 'run-meta.json', meta);
   return { bundle, meta, pointer };
 }
 

package/src/runtime-os-observation.mjs

@@ -0,0 +1,58 @@
+import { execFile } from 'node:child_process';
+import { realpath } from 'node:fs/promises';
+import { promisify } from 'node:util';
+
+const execFileAsync = promisify(execFile);
+
+// OS観測はobserverのlocaleへ依存させない。psのlstart書式（LC_TIME）と非ASCII argvの
+// エスケープ有無（LC_CTYPE）はlocaleで変わり、同じprocessでも観測者ごとにidentity digestが
+// 割れる（2026-08-22 実測: 席fileと席自身の観測でWORKER_IDENTITY_MISMATCH）。
+//
+// 既知の限界: Linuxの`LC_ALL=C`は非ASCIIバイトを`?`へ非可逆に潰すため、非ASCII部分だけが
+// 違うargvの識別力はLinuxでは落ちる（観測者間の一致は保たれる——潰れた`?`は誰が観測しても
+// 同じ`?`になるので、locale不一致によるdigest分裂は防げる）。darwinの`ps`はvisエスケープで
+// 非ASCIIを可逆に表現するため、この劣化は起きない。
+export function osObservationEnvironment() { return { ...process.env, LC_ALL: 'C' }; }
+
+/** processのstart identity（darwin/linuxはps lstart、win32はPowerShell StartTime Ticks）の生文字列を返す。 */
+export async function observeStartIdentityRaw(pid) {
+  const executable = process.platform === 'win32' ? 'powershell.exe' : '/bin/ps';
+  const args = process.platform === 'win32'
+    ? ['-NoProfile', '-NonInteractive', '-Command',
+      `[System.Diagnostics.Process]::GetProcessById(${pid}).StartTime.ToUniversalTime().Ticks`]
+    : ['-o', 'lstart=', '-p', String(pid)];
+  const { stdout } = await execFileAsync(executable, args, { encoding: 'utf8', env: osObservationEnvironment() });
+  return stdout.trim();
+}
+
+/** processのargv（`ps -o command=`）の生文字列を返す。 */
+export async function observeArgv(pid) {
+  const { stdout } = await execFileAsync('/bin/ps', ['-o', 'command=', '-p', String(pid)], { encoding: 'utf8', env: osObservationEnvironment() });
+  return stdout.trim();
+}
+
+/** processのprocess group id（`ps -o pgid=`）の生文字列を返す。 */
+export async function observePgid(pid) {
+  const { stdout } = await execFileAsync('/bin/ps', ['-o', 'pgid=', '-p', String(pid)], { encoding: 'utf8', env: osObservationEnvironment() });
+  return stdout.trim();
+}
+
+/** 全processの`pid=,ppid=,pgid=,state=,lstart=`スナップショットの生stdoutを返す。 */
+export async function observePsSnapshot() {
+  const { stdout } = await execFileAsync('/bin/ps', [
+    '-axo', 'pid=,ppid=,pgid=,state=,lstart=',
+  ], { encoding: 'utf8', maxBuffer: 8 * 1024 * 1024, env: osObservationEnvironment() });
+  return stdout;
+}
+
+/**
+ * 実行中processの実行imageのcanonical pathを観測する。linuxは`/proc/<pid>/exe`、
+ * darwinは`ps -o comm=`の結果をrealpathで正規化する。
+ */
+export async function observeExecutablePath(pid) {
+  if (process.platform === 'linux') {
+    return realpath(`/proc/${pid}/exe`);
+  }
+  const { stdout } = await execFileAsync('/bin/ps', ['-o', 'comm=', '-p', String(pid)], { encoding: 'utf8', env: osObservationEnvironment() });
+  return realpath(stdout.trim());
+}

package/src/runtime-pull-intake.mjs

@@ -1,11 +1,10 @@
-import { execFile, spawn } from 'node:child_process';
+import { spawn } from 'node:child_process';
 import { createHash, randomUUID } from 'node:crypto';
 import { constants as fsConstants } from 'node:fs';
 import {
   lstat, mkdir, mkdtemp, open, readFile, readdir, realpath, rename, rm, writeFile,
 } from 'node:fs/promises';
 import path from 'node:path';
-import { promisify } from 'node:util';
 
 import { canonicalizeArtifact, digestArtifact } from './artifact-contracts.mjs';
 import { validateExpectedWorkerProcess } from './runtime-controller-protocol.mjs';
@@ -13,6 +12,7 @@ import { classifyObservedDiff } from './runtime-decision-verifier.mjs';
 import { captureWorktreeDiff, detectCheckpointFindings } from './runtime-diff-observer.mjs';
 import { acquireRuntimeLifecycleLock } from './runtime-lifecycle-lock.mjs';
 import { observeManagedProcessStartIdentity } from './runtime-managed-supervisor.mjs';
+import { observeArgv, observePgid } from './runtime-os-observation.mjs';
 import { deliverWorkerSignal, observeWindowsWorkerProcess } from './runtime-windows-process.mjs';
 import { ensureScriptedWorktree } from './runtime-scripted-worktree.mjs';
 import {
@@ -33,7 +33,6 @@ const SHA1 = /^[0-9a-f]{40}$/u;
 const SHA256 = /^[0-9a-f]{64}$/u;
 const TIMESTAMP = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/u;
 const MAX_FILE_BYTES = 8_388_608;
-const execFileAsync = promisify(execFile);
 
 export class PullRunError extends Error {
   constructor(code, message, detail) {
@@ -755,17 +754,19 @@ export async function intakePullTask({ repoRoot, runDir, taskId, environment = p
       const updated = project(current.events, current.meta).intakes
         .find((entry) => entry.task_id === taskId);
       if (updated.worker && intervention.state === 'hold' && !updated.worker.stopped) {
-        await signalAttachedWorker(updated, 'SIGSTOP');
-        current = await appendEvent(runDir, current, buildEvent({
-          events: current.events, meta: current.meta, kind: 'worker_stopped', taskId,
-          payload: { reason: intervention.reason },
-        }));
+        if (await signalAttachedWorker(updated, 'SIGSTOP')) {
+          current = await appendEvent(runDir, current, buildEvent({
+            events: current.events, meta: current.meta, kind: 'worker_stopped', taskId,
+            payload: { reason: intervention.reason },
+          }));
+        }
       } else if (updated.worker?.stopped && intervention.state === 'none') {
-        await signalAttachedWorker(updated, 'SIGCONT');
-        current = await appendEvent(runDir, current, buildEvent({
-          events: current.events, meta: current.meta, kind: 'worker_resumed', taskId,
-          payload: { released_by: 'intake_refresh' },
-        }));
+        if (await signalAttachedWorker(updated, 'SIGCONT')) {
+          current = await appendEvent(runDir, current, buildEvent({
+            events: current.events, meta: current.meta, kind: 'worker_resumed', taskId,
+            payload: { released_by: 'intake_refresh' },
+          }));
+        }
       }
       state = project(current.events, current.meta);
       const result = { schema: 'lattice.pull_intake_result.v1', outcome: 'intaked',
@@ -922,10 +923,10 @@ async function observeProcessBinding(pid) {
     };
   }
   const processStartIdentity = await observeManagedProcessStartIdentity(pid);
-  const { stdout: pgidOut } = await execFileAsync('/bin/ps', ['-o', 'pgid=', '-p', String(pid)], { encoding: 'utf8' });
-  const { stdout: argvOut } = await execFileAsync('/bin/ps', ['-o', 'command=', '-p', String(pid)], { encoding: 'utf8' });
-  const processGroupId = Number(pgidOut.trim());
-  const argv = argvOut.trim();
+  const pgidOut = await observePgid(pid);
+  const argvOut = await observeArgv(pid);
+  const processGroupId = Number(pgidOut);
+  const argv = argvOut;
   const expected = { pid, process_group_id: processGroupId, process_start_identity: processStartIdentity };
   if (!validateExpectedWorkerProcess(expected) || argv.length === 0) {
     fail('WORKER_IDENTITY_MISMATCH', 'worker process identityを完全観測できない');
@@ -937,16 +938,26 @@ async function observeProcessBinding(pid) {
   };
 }
 
+// signal前の再認証は不変量（pid + lstart）だけで行う。argvはTUIがプロセスタイトルを
+// 書き換えると変わり、pgidもprocess自身が変えられる——可変量を照合に使うと、生きている
+// 正当なworkerへsignalできなくなり、detach/release/holdの全経路が恒久停止する。
+// pid + lstart が同じなら同一process instanceであり、誤配は起きない。
+// 不在（ESRCH）とpid再利用（lstart不一致）は「配達先がもう居ない」＝falseで返し、
+// 観測自体の失敗だけを失敗として扱う。
 async function signalAttachedWorker(intake, signal) {
   if (intake.worker === null) return false;
+  try { process.kill(intake.worker.pid, 0); }
+  catch (error) { if (error?.code === 'ESRCH') return false; }
   let observed;
   try { observed = await observeProcessBinding(intake.worker.pid); }
-  catch { fail('WORKER_IDENTITY_MISMATCH', 'signal前にworkerを再認証できない'); }
+  catch {
+    try { process.kill(intake.worker.pid, 0); }
+    catch (error) { if (error?.code === 'ESRCH') return false; }
+    fail('WORKER_IDENTITY_MISMATCH', 'signal前にworkerを再認証できない');
+  }
   if (observed.process_start_identity.identity_digest
-      !== intake.worker.process_start_identity.identity_digest
-    || observed.argv_digest !== intake.worker.argv_digest
-    || observed.process_group_id !== intake.worker.process_group_id) {
-    fail('WORKER_IDENTITY_MISMATCH', 'signal前のlstart/argv/pgidがattach bindingと一致しない');
+      !== intake.worker.process_start_identity.identity_digest) {
+    return false;
   }
   try { deliverWorkerSignal(intake.worker.pid, signal); }
   catch { fail('WORKER_SIGNAL_FAILED', `workerへ${signal}を送れない`); }
@@ -994,8 +1005,10 @@ export async function attachPullWorker({ runDir, taskId, input, environment = pr
       fail('WORKER_ALREADY_ATTACHED', `同じworkerは複数active intakeへattachできない: ${occupied.task_id}`);
     }
     if (occupied && occupied.intervention.state === 'hold') {
-      if (occupied.worker.stopped) {
-        await signalAttachedWorker(occupied, 'SIGCONT');
+      const resumed = occupied.worker.stopped
+        ? await signalAttachedWorker(occupied, 'SIGCONT')
+        : false;
+      if (resumed) {
         current = await appendEvent(runDir, current, buildEvent({
           events: current.events, meta: current.meta, kind: 'worker_resumed',
           taskId: occupied.task_id, payload: { released_by: 'stale_hold_reattach' },
@@ -1004,7 +1017,7 @@ export async function attachPullWorker({ runDir, taskId, input, environment = pr
       current = await appendEvent(runDir, current, buildEvent({
         events: current.events, meta: current.meta, kind: 'worker_detached',
         taskId: occupied.task_id,
-        payload: { detached_by: actor, pid: occupied.worker.pid, resumed: occupied.worker.stopped },
+        payload: { detached_by: actor, pid: occupied.worker.pid, resumed },
       }));
       state = project(current.events, current.meta);
     }
@@ -1023,11 +1036,12 @@ export async function attachPullWorker({ runDir, taskId, input, environment = pr
     }
     const refreshed = state.intakes.find((entry) => entry.task_id === taskId);
     if (refreshed.intervention.state === 'hold' && !refreshed.worker.stopped) {
-      await signalAttachedWorker(refreshed, 'SIGSTOP');
-      current = await appendEvent(runDir, current, buildEvent({
-        events: current.events, meta: current.meta, kind: 'worker_stopped', taskId,
-        payload: { reason: refreshed.intervention.reason },
-      }));
+      if (await signalAttachedWorker(refreshed, 'SIGSTOP')) {
+        current = await appendEvent(runDir, current, buildEvent({
+          events: current.events, meta: current.meta, kind: 'worker_stopped', taskId,
+          payload: { reason: refreshed.intervention.reason },
+        }));
+      }
     }
     const result = { schema: 'lattice.pull_worker_attach_result.v1', outcome: 'attached',
       task_id: taskId, pid: input.pid, stopped: project(current.events, current.meta)
@@ -1049,7 +1063,7 @@ export async function attachPullWorker({ runDir, taskId, input, environment = pr
  * never verifiable and the hold was permanent.
  *
  * Authorization is process identity, not the actor: `signalAttachedWorker`
- * re-verifies lstart/argv/pgid against the recorded binding before signalling,
+ * re-verifies pid+lstart against the recorded binding before signalling,
  * which is strictly stronger than an env-derived actor claim (env vars are
  * trivially settable; a process's start identity is not). See
  * `optionalActorFromEnvironment` for why the seat's own identity cannot be the
@@ -1074,9 +1088,10 @@ export async function detachPullWorker({ runDir, taskId, environment = process.e
     // Resume before unbinding. Once the binding is gone nothing in this store can
     // name that pid again, so a worker left stopped here would be unreachable by
     // any future command — the same one-way door, one step further along.
-    const resumed = intake.worker.stopped;
+    const resumed = intake.worker.stopped
+      ? await signalAttachedWorker(intake, 'SIGCONT')
+      : false;
     if (resumed) {
-      await signalAttachedWorker(intake, 'SIGCONT');
       current = await appendEvent(runDir, current, buildEvent({
         events: current.events, meta: current.meta, kind: 'worker_resumed', taskId,
         payload: { released_by: 'worker_detach' },
@@ -1220,11 +1235,12 @@ export async function acceptPullTask({ repoRoot, runDir, taskId, environment = p
         const stoppedIntake = project(current.events, current.meta).intakes
           .find((entry) => entry.task_id === affectedTaskId);
         if (stoppedIntake.worker && !stoppedIntake.worker.stopped) {
-          await signalAttachedWorker(stoppedIntake, 'SIGSTOP');
-          current = await appendEvent(runDir, current, buildEvent({
-            events: current.events, meta: current.meta, kind: 'worker_stopped', taskId: affectedTaskId,
-            payload: { reason: 'runtime_conflict' },
-          }));
+          if (await signalAttachedWorker(stoppedIntake, 'SIGSTOP')) {
+            current = await appendEvent(runDir, current, buildEvent({
+              events: current.events, meta: current.meta, kind: 'worker_stopped', taskId: affectedTaskId,
+              payload: { reason: 'runtime_conflict' },
+            }));
+          }
         }
       }
       fail('RUNTIME_CONFLICT_HOLD', 'observed diffがruntime conflictを生成した', { findings });
@@ -1236,11 +1252,12 @@ export async function acceptPullTask({ repoRoot, runDir, taskId, environment = p
       const resumed = project(current.events, current.meta).intakes
         .find((entry) => entry.task_id === taskId);
       if (resumed.worker?.stopped) {
-        await signalAttachedWorker(resumed, 'SIGCONT');
-        current = await appendEvent(runDir, current, buildEvent({
-          events: current.events, meta: current.meta, kind: 'worker_resumed', taskId,
-          payload: { released_by_empty_findings: true },
-        }));
+        if (await signalAttachedWorker(resumed, 'SIGCONT')) {
+          current = await appendEvent(runDir, current, buildEvent({
+            events: current.events, meta: current.meta, kind: 'worker_resumed', taskId,
+            payload: { released_by_empty_findings: true },
+          }));
+        }
       }
     }
     current = await appendEvent(runDir, current, buildEvent({
@@ -1265,11 +1282,12 @@ export async function acceptPullTask({ repoRoot, runDir, taskId, environment = p
       const resumed = project(current.events, current.meta).intakes
         .find((entry) => entry.task_id === waiting.task_id);
       if (resumed.worker?.stopped) {
-        await signalAttachedWorker(resumed, 'SIGCONT');
-        current = await appendEvent(runDir, current, buildEvent({
-          events: current.events, meta: current.meta, kind: 'worker_resumed', taskId: waiting.task_id,
-          payload: { released_by_accepted_task: taskId },
-        }));
+        if (await signalAttachedWorker(resumed, 'SIGCONT')) {
+          current = await appendEvent(runDir, current, buildEvent({
+            events: current.events, meta: current.meta, kind: 'worker_resumed', taskId: waiting.task_id,
+            payload: { released_by_accepted_task: taskId },
+          }));
+        }
       }
     }
     state = project(current.events, current.meta);
@@ -1293,11 +1311,12 @@ export async function acceptPullTask({ repoRoot, runDir, taskId, environment = p
       const resumed = project(current.events, current.meta).intakes
         .find((entry) => entry.task_id === waiting.task_id);
       if (resumed.worker?.stopped) {
-        await signalAttachedWorker(resumed, 'SIGCONT');
-        current = await appendEvent(runDir, current, buildEvent({
-          events: current.events, meta: current.meta, kind: 'worker_resumed', taskId: waiting.task_id,
-          payload: { released_by_accepted_task: taskId },
-        }));
+        if (await signalAttachedWorker(resumed, 'SIGCONT')) {
+          current = await appendEvent(runDir, current, buildEvent({
+            events: current.events, meta: current.meta, kind: 'worker_resumed', taskId: waiting.task_id,
+            payload: { released_by_accepted_task: taskId },
+          }));
+        }
       }
     }
     const result = { schema: 'lattice.pull_accept_result.v1', outcome: 'accepted',

package/src/runtime-work-order-controller.mjs

@@ -1,6 +1,5 @@
 import net from 'node:net';
 import { createHash, randomBytes } from 'node:crypto';
-import { execFile } from 'node:child_process';
 import { constants as fsConstants, readFileSync } from 'node:fs';
 import {
   chmod,
@@ -13,7 +12,6 @@ import {
   rm,
 } from 'node:fs/promises';
 import path from 'node:path';
-import { promisify } from 'node:util';
 
 import { canonicalizeArtifact, digestArtifact } from './artifact-contracts.mjs';
 import {
@@ -32,6 +30,7 @@ import {
 import { captureWorktreeDiff } from './runtime-diff-observer.mjs';
 import { validateSupervisorWriteGate } from './runtime-gate-store.mjs';
 import { observeManagedProcessStartIdentity } from './runtime-managed-supervisor.mjs';
+import { observePsSnapshot } from './runtime-os-observation.mjs';
 import {
   scriptedWorktreeId as workOrderWorktreeId,
   scriptedWorktreePath as workOrderWorktreePath,
@@ -45,7 +44,6 @@ import {
 const MAX_DOCUMENT_BYTES = 8_388_608;
 const SHA256 = /^[0-9a-f]{64}$/u;
 const ID = /^[0-9A-Za-z](?:[0-9A-Za-z._-]{0,127})$/u;
-const execFileAsync = promisify(execFile);
 const REQUEST_SCHEMA_TO_OPERATION = Object.freeze(Object.fromEntries([
   ['lattice.adapter_dispatch_request.v1', 'dispatch'],
   ['lattice.adapter_observe_request.v1', 'observe'],
@@ -328,12 +326,7 @@ function quiescedState(rawState) {
 async function observeWorkerProcessTree(pid, { requireDescendantsInRootGroup = true } = {}) {
   let stdout;
   try {
-    ({ stdout } = await execFileAsync('/bin/ps', [
-      '-axo', 'pid=,ppid=,pgid=,state=,lstart=',
-    ], {
-      encoding: 'utf8',
-      maxBuffer: 8 * 1024 * 1024,
-    }));
+    stdout = await observePsSnapshot();
   } catch { fail('WORK_ORDER_REPORT_INVALID', 'worker_pidをOS観測できない'); }
   const records = new Map();
   for (const rawLine of stdout.split('\n')) {