@sentropic/h2a-runtime 0.98.4 → 0.98.6

package/dist/native-terminal/fault-counters.js

@@ -0,0 +1,46 @@
+/**
+ * Named fault counters for supervision. Every fault-tolerant site in the
+ * native terminal host bumps its own named counter so an operator can see
+ * WHAT is being absorbed and how often — fault containment must never be
+ * silent. The contained sites are:
+ *
+ * - the host log sink (`crash-safe-log.ts`): stderr write failures;
+ * - the pty `onData` guard (`host.ts`);
+ * - the pty `onExit` guard (`host.ts`);
+ * - the pty DSR reply write (`host.ts`);
+ * - socket connection errors and client frame destroys (`server.ts`);
+ * - the net.Server listener handler (`server.ts`), per classification;
+ * - bounded respawn abandonment (`supervisor.ts`);
+ * - the process-level diagnostic writes (`process.ts`).
+ *
+ * Counters are per-process; supervision reads them through
+ * `hostFaultCounters()` (tests, an attached debugger, a future ping op).
+ */
+export const HOST_FAULT_COUNTERS = {
+    // The four contractual R7.5 supervision counters (h2a_host_*), one per
+    // NAMED fault site of the spec.
+    hostSocketConnectionErrors: "h2a_host_socket_conn_errors",
+    hostClientFrameDestroys: "h2a_host_client_frame_destroys",
+    hostPtyWriteBreaks: "h2a_host_pty_write_breaks",
+    hostPtyCallbackFailures: "h2a_host_pty_callback_failures",
+    // Per-site distinct counters kept for finer supervision.
+    hostLogStderrSyncWriteFailed: "host-log.stderr-sync-write-failed",
+    hostLogStderrStreamError: "host-log.stderr-stream-error",
+    ptyDataCallbackContained: "pty.data-callback-contained",
+    ptyExitCallbackContained: "pty.exit-callback-contained",
+    serverListenerErrorRecoverable: "server.listener-error-recoverable",
+    serverListenerErrorExhausted: "server.listener-error-exhausted",
+    serverListenerErrorUnusable: "server.listener-error-unusable",
+    serverListenerErrorUnknown: "server.listener-error-unknown",
+    supervisorRespawnAbandoned: "supervisor.respawn-abandoned",
+    processShutdownWriteFailed: "process.shutdown-write-failed",
+    processFatalWriteFailed: "process.fatal-write-failed",
+};
+const counts = new Map();
+export function recordHostFault(counter) {
+    counts.set(counter, (counts.get(counter) ?? 0) + 1);
+}
+export function hostFaultCounters() {
+    return Object.fromEntries(counts);
+}
+//# sourceMappingURL=fault-counters.js.map

package/dist/native-terminal/fault-counters.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fault-counters.js","sourceRoot":"","sources":["../../src/native-terminal/fault-counters.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,uEAAuE;IACvE,gCAAgC;IAChC,0BAA0B,EAAE,6BAA6B;IACzD,uBAAuB,EAAE,gCAAgC;IACzD,kBAAkB,EAAE,2BAA2B;IAC/C,uBAAuB,EAAE,gCAAgC;IACzD,yDAAyD;IACzD,4BAA4B,EAAE,mCAAmC;IACjE,wBAAwB,EAAE,8BAA8B;IACxD,wBAAwB,EAAE,6BAA6B;IACvD,wBAAwB,EAAE,6BAA6B;IACvD,8BAA8B,EAAE,mCAAmC;IACnE,4BAA4B,EAAE,iCAAiC;IAC/D,2BAA2B,EAAE,gCAAgC;IAC7D,0BAA0B,EAAE,+BAA+B;IAC3D,0BAA0B,EAAE,8BAA8B;IAC1D,0BAA0B,EAAE,+BAA+B;IAC3D,uBAAuB,EAAE,4BAA4B;CAC7C,CAAC;AAEX,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;AAEzC,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,iBAAiB;IAC/B,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;AACpC,CAAC"}

package/dist/native-terminal/host.d.ts

@@ -82,8 +82,13 @@ export declare const H2A_SESSION_TOKEN_ENV_VAR = "H2A_SESSION_TOKEN";
  *  - This enumeration runs ONLY on the leader-absent path (never on every
  *    reap), keeping it rare in practice — the fast leader-start-time check
  *    above it covers the common case.
+ *
+ * `procRoot` is injected ONLY by tests: a /proc-shaped view that contains
+ * exactly the processes a test started (the enumeration is the confinement
+ * boundary — the stat/environ reads stay real). Production always reads the
+ * real `/proc`.
  */
-export declare function groupCarriesSessionToken(pgid: number, expectedToken: string): boolean;
+export declare function groupCarriesSessionToken(pgid: number, expectedToken: string, procRoot?: string): boolean;
 /**
  * True iff two CONSECUTIVE censuses of `pgid` both positively show the SAME,
  * non-empty set of members and every one of them is a ZOMBIE down to its last
@@ -169,6 +174,16 @@ export type NativeTerminalExit = Readonly<{
 export type NativeTerminalSessionStatus = "running" | "stopping" | "exited";
 /** The provenance of an exclusive controller, used only for human-input safety. */
 export type NativeTerminalControllerActivity = "human" | "automation";
+export type NativeTerminalControllerIdentity = Readonly<{
+    pid: number | null;
+    tty: string;
+    since: string;
+}>;
+export type NativeTerminalControllerOptions = Readonly<{
+    takeover?: boolean;
+    pid?: number;
+    tty?: string;
+}>;
 export type NativeTerminalSessionState = Readonly<{
     id: string;
     generation: string;
@@ -180,11 +195,12 @@ export type NativeTerminalSessionState = Readonly<{
     stopSignal: string | null;
     /**
      * Whether a controller currently holds this session's exclusive input lease.
-     * Deliberately a BOOLEAN: consumers (restore visibility) only need to know
-     * that a controlling terminal exists, never who it is — the controller id
-     * stays private to the host.
+     * Restore consumers need only this boolean. Attach rescue also exposes the
+     * holder's diagnostic identity and epoch, never its input lease.
      */
     controlled: boolean;
+    controllerEpoch?: number;
+    controller?: NativeTerminalControllerIdentity | null;
     /**
      * Most recent human controller/input activity, in epoch milliseconds. A
      * missing value means an older host did not provide the safety signal and
@@ -391,7 +407,7 @@ export declare class NativeTerminalHost {
     state(id: string): NativeTerminalSessionState;
     readOutput(id: string, afterSeq: number): NativeTerminalReplay;
     attachObserver(id: string): NativeTerminalObserverAttachment;
-    acquireController(id: string, controllerId: string, activity?: NativeTerminalControllerActivity): NativeTerminalControllerLease;
+    acquireController(id: string, controllerId: string, activity?: NativeTerminalControllerActivity, options?: NativeTerminalControllerOptions): NativeTerminalControllerLease;
     /**
      * Atomically acquire automation input only when no human activity is recent.
      * This runs entirely in the host's serialized request handler: a human

package/dist/native-terminal/host.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"host.d.ts","sourceRoot":"","sources":["../../src/native-terminal/host.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAa,UAAU,EAAE,MAAM,WAAW,CAAC;AAQvD,OAAO,EAML,KAAK,uBAAuB,EAC7B,MAAM,gBAAgB,CAAC;AAIxB,OAAO,EAEL,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,EACvB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAIL,KAAK,wBAAwB,EAC9B,MAAM,eAAe,CAAC;AAEvB;;;;;;GAMG;AACH,MAAM,MAAM,gCAAgC,GAAG;IAC7C,oFAAoF;IACpF,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,wBAAwB,GAAG,IAAI,CAAC;IAChE,wEAAwE;IACxE,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IACpC,8EAA8E;IAC9E,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;CACrC,CAAC;AAMF;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,EAAE,gCA6CrC,CAAC;AAMF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAmBpE;AAED,oFAAoF;AACpF,eAAO,MAAM,yBAAyB,sBAAsB,CAAC;AA4D7D;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAKrF;AAqKD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,EACZ,QAAQ,GAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAW,GAC1C,OAAO,CAWT;AAcD,wEAAwE;AACxE,MAAM,MAAM,6BAA6B,GAAG,OAAO,GAAG,MAAM,GAAG,cAAc,CAAC;AAE9E;;;;;GAKG;AACH,MAAM,MAAM,4BAA4B,GAAG,CACzC,KAAK,EAAE,uBAAuB,KAC3B,6BAA6B,CAAC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,eAAO,MAAM,qBAAqB,EAAE,4BAMnC,CAAC;AAMF;;mFAEmF;AACnF,eAAO,MAAM,qCAAqC,QAAS,CAAC;AAQ5D,MAAM,MAAM,kBAAkB,GAAG,QAAQ,CAAC;IACxC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC,CAAC;AAEH,MAAM,MAAM,2BAA2B,GAAG,SAAS,GAAG,UAAU,GAAG,QAAQ,CAAC;AAE5E,mFAAmF;AACnF,MAAM,MAAM,gCAAgC,GAAG,OAAO,GAAG,YAAY,CAAC;AAEtE,MAAM,MAAM,0BAA0B,GAAG,QAAQ,CAAC;IAChD,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,2BAA2B,CAAC;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,kBAAkB,GAAG,IAAI,CAAC;IAChC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B;;;;;OAKG;IACH,UAAU,EAAE,OAAO,CAAC;IACpB;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACrC,CAAC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,QAAQ,CAAC;IAC1C,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,aAAa,CAAC,mBAAmB,CAAC,CAAC;IAC3C,GAAG,EAAE,iBAAiB,GAAG,IAAI,CAAC;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B,CAAC,CAAC;AAEH,MAAM,MAAM,gCAAgC,GAAG,QAAQ,CAAC;IACtD,IAAI,EAAE,UAAU,CAAC;IACjB,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;CACzB,CAAC,CAAC;AAEH,MAAM,MAAM,6BAA6B,GAAG,QAAQ,CAAC;IACnD,IAAI,EAAE,YAAY,CAAC;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;CACf,CAAC,CAAC;AAEH,MAAM,MAAM,6BAA6B,GAAG,QAAQ,CAAC;IACnD,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;CACzB,CAAC,CAAC;AAEH,MAAM,MAAM,2BAA2B,GAAG,QAAQ,CAAC;IACjD,8EAA8E;IAC9E,WAAW,CAAC,EAAE,QAAQ,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACpE,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,MAAM,8BAA8B,GACtC,eAAe,GACf,4BAA4B,GAC5B,UAAU;AACZ;;;;;;GAMG;GACD,YAAY;AACd;;;;;;;;;GASG;GACD,eAAe,GACf,uBAAuB,CAAC;AAE5B;0EAC0E;AAC1E,MAAM,MAAM,uBAAuB,GAAG,QAAQ,CAAC;IAC7C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC,CAAC;AAaH,MAAM,MAAM,yBAAyB,GAAG,QAAQ,CAC5C;IACE,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,SAAS,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,8BAA8B,CAAC;CACxC,GACD;IACE,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,QAAQ,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB,GACD;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,gBAAgB,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CACnF,CAAC;AAyBF,qBAAa,kBAAkB;;gBA2BjB,OAAO,EAAE;QACnB,UAAU,EAAE,MAAM,CAAC;QACnB,qBAAqB,EAAE,MAAM,CAAC;QAC9B,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,OAAO,EAAE,UAAU,CAAC;QACpB,8EAA8E;QAC9E,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB;;;;;WAKG;QACH,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,uEAAuE;QACvE,MAAM,CAAC,EAAE,gCAAgC,CAAC;QAC1C,6EAA6E;QAC7E,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;QAC7B,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B,uBAAuB,CAAC,EAAE,MAAM,CAAC;QACjC;;;4EAGoE;QACpE,mBAAmB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;QAC1D;;sEAE8D;QAC9D,oBAAoB,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,KAAK,OAAO,CAAC;QACxE;;;iEAGyD;QACzD,kBAAkB,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;QAC/C;;;;2CAImC;QACnC,SAAS,CAAC,EAAE,MAAM,uBAAuB,CAAC;KAC3C;IAuDD,IAAI,UAAU,IAAI,MAAM,CAEvB;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,IAAI,iBAAiB,IAAI,QAAQ,CAAC;QAChC,QAAQ,EAAE,MAAM,CAAC;QACjB,SAAS,EAAE,MAAM,CAAC;QAClB,YAAY,EAAE,MAAM,CAAC;QACrB,oBAAoB,EAAE,MAAM,CAAC;QAC7B,gBAAgB,EAAE,MAAM,CAAC;QACzB,aAAa,EAAE,MAAM,CAAC;QACtB,WAAW,EAAE,MAAM,CAAC;QACpB,YAAY,EAAE,MAAM,CAAC;KACtB,CAAC,CAED;IAED,MAAM,CAAC,OAAO,EAAE,2BAA2B,GAAG,0BAA0B;IA0JxE,IAAI,IAAI,aAAa,CAAC,0BAA0B,CAAC;IAMjD,KAAK,CAAC,EAAE,EAAE,MAAM,GAAG,0BAA0B;IAI7C,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,oBAAoB;IAU9D,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,gCAAgC;IAW5D,iBAAiB,CACf,EAAE,EAAE,MAAM,EACV,YAAY,EAAE,MAAM,EACpB,QAAQ,GAAE,gCAA0C,GACnD,6BAA6B;IA8BhC;;;;OAIG;IACH,0CAA0C,CACxC,EAAE,EAAE,MAAM,EACV,YAAY,EAAE,MAAM,EACpB,gBAAgB,EAAE,MAAM,GACvB,6BAA6B;IA2BhC,iBAAiB,CACf,KAAK,EAAE,6BAA6B,GACnC,6BAA6B;IAYhC,KAAK,CAAC,KAAK,EAAE,6BAA6B,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI;IAS/D,MAAM,CACJ,KAAK,EAAE,6BAA6B,EACpC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,IAAI;IAYP,IAAI,CACF,KAAK,EAAE,6BAA6B,EACpC,MAAM,GAAE,wBAAoC,GAC3C,0BAA0B;IAgB7B;;;;;;;;;OASG;IACH,iBAAiB,CACf,EAAE,EAAE,MAAM,EACV,kBAAkB,EAAE,MAAM,EAC1B,mBAAmB,EAAE,MAAM,EAC3B,MAAM,GAAE,wBAAoC,GAC3C,0BAA0B;IA0B7B,OAAO,CACL,MAAM,GAAE,wBAAoC,GAC3C,aAAa,CAAC,0BAA0B,CAAC;IAiB5C;;;;;;;;;OASG;IACG,YAAY,CAChB,MAAM,GAAE,wBAAoC,GAC3C,OAAO,CAAC,aAAa,CAAC,0BAA0B,CAAC,CAAC;IA4CrD;;;;;;;;;;;;;;;;;;;;OAoBG;IACG,UAAU,CACd,SAAS,EAAE,MAAM,EACjB,MAAM,GAAE,wBAAoC,EAC5C,YAAY,CAAC,EAAE,MAAM,EACrB,QAAQ,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,GACjC,OAAO,CAAC,yBAAyB,CAAC;CA+nBtC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,MAAM,8BAA8B,GAAG,QAAQ,CACjD;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,QAAQ,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACjG;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,gBAAgB,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE;AAC3G;;;;;;;;;;;;;;;;GAgBG;GACD;IACE,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,aAAa,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,kBAAkB,CAAC,EAAE,IAAI,CAAC;CAC3B,GACD;IACE,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,cAAc,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,8BAA8B,CAAC;CACxC;AACH;;;;;;;;;GASG;GACD;IACE,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,sBAAsB,CAAC;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AACH;;;;;;;;;;;;GAYG;GACD;IACE,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,uBAAuB,CAAC;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AACH;;;;;;GAMG;GACD;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,qBAAqB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACpE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,eAAe,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAChE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,sBAAsB,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACvE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,kBAAkB,CAAA;CAAE,CACpD,CAAC;AAEF,oDAAoD;AACpD,MAAM,MAAM,8BAA8B,GAAG,QAAQ,CACjD;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACrC;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,QAAQ,EAAE,aAAa,CAAC,8BAA8B,CAAC,CAAA;CAAE,CACnF,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,wBAAsB,wBAAwB,CAAC,OAAO,GAAE;IACtD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,wBAAwB,CAAC;IAClC,gFAAgF;IAChF,UAAU,CAAC,EAAE,4BAA4B,CAAC;IAC1C;;;;;0EAKsE;IACtE,IAAI,CAAC,EAAE,CACL,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,wBAAwB,EAChC,QAAQ,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,KAC/B,OAAO,CAAC,yBAAyB,CAAC,CAAC;IACxC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACzB,GAAG,OAAO,CAAC,8BAA8B,CAAC,CAwS/C"}
+{"version":3,"file":"host.d.ts","sourceRoot":"","sources":["../../src/native-terminal/host.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAa,UAAU,EAAE,MAAM,WAAW,CAAC;AAQvD,OAAO,EAML,KAAK,uBAAuB,EAC7B,MAAM,gBAAgB,CAAC;AAIxB,OAAO,EAEL,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,EACvB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAIL,KAAK,wBAAwB,EAC9B,MAAM,eAAe,CAAC;AAEvB;;;;;;GAMG;AACH,MAAM,MAAM,gCAAgC,GAAG;IAC7C,oFAAoF;IACpF,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,wBAAwB,GAAG,IAAI,CAAC;IAChE,wEAAwE;IACxE,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IACpC,8EAA8E;IAC9E,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;CACrC,CAAC;AAMF;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,EAAE,gCA6CrC,CAAC;AAMF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAmBpE;AAED,oFAAoF;AACpF,eAAO,MAAM,yBAAyB,sBAAsB,CAAC;AA4D7D;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,MAAM,EACZ,aAAa,EAAE,MAAM,EACrB,QAAQ,SAAU,GACjB,OAAO,CAKT;AAqKD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,EACZ,QAAQ,GAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAW,GAC1C,OAAO,CAWT;AAcD,wEAAwE;AACxE,MAAM,MAAM,6BAA6B,GAAG,OAAO,GAAG,MAAM,GAAG,cAAc,CAAC;AAE9E;;;;;GAKG;AACH,MAAM,MAAM,4BAA4B,GAAG,CACzC,KAAK,EAAE,uBAAuB,KAC3B,6BAA6B,CAAC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,eAAO,MAAM,qBAAqB,EAAE,4BAMnC,CAAC;AAMF;;mFAEmF;AACnF,eAAO,MAAM,qCAAqC,QAAS,CAAC;AAQ5D,MAAM,MAAM,kBAAkB,GAAG,QAAQ,CAAC;IACxC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC,CAAC;AAEH,MAAM,MAAM,2BAA2B,GAAG,SAAS,GAAG,UAAU,GAAG,QAAQ,CAAC;AAE5E,mFAAmF;AACnF,MAAM,MAAM,gCAAgC,GAAG,OAAO,GAAG,YAAY,CAAC;AAEtE,MAAM,MAAM,gCAAgC,GAAG,QAAQ,CAAC;IACtD,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;CACf,CAAC,CAAC;AAEH,MAAM,MAAM,+BAA+B,GAAG,QAAQ,CAAC;IACrD,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,CAAC,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,QAAQ,CAAC;IAChD,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,2BAA2B,CAAC;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,kBAAkB,GAAG,IAAI,CAAC;IAChC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B;;;;OAIG;IACH,UAAU,EAAE,OAAO,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,UAAU,CAAC,EAAE,gCAAgC,GAAG,IAAI,CAAC;IACrD;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACrC,CAAC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,QAAQ,CAAC;IAC1C,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,aAAa,CAAC,mBAAmB,CAAC,CAAC;IAC3C,GAAG,EAAE,iBAAiB,GAAG,IAAI,CAAC;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B,CAAC,CAAC;AAEH,MAAM,MAAM,gCAAgC,GAAG,QAAQ,CAAC;IACtD,IAAI,EAAE,UAAU,CAAC;IACjB,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;CACzB,CAAC,CAAC;AAEH,MAAM,MAAM,6BAA6B,GAAG,QAAQ,CAAC;IACnD,IAAI,EAAE,YAAY,CAAC;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;CACf,CAAC,CAAC;AAEH,MAAM,MAAM,6BAA6B,GAAG,QAAQ,CAAC;IACnD,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;CACzB,CAAC,CAAC;AAEH,MAAM,MAAM,2BAA2B,GAAG,QAAQ,CAAC;IACjD,8EAA8E;IAC9E,WAAW,CAAC,EAAE,QAAQ,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACpE,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,MAAM,8BAA8B,GACtC,eAAe,GACf,4BAA4B,GAC5B,UAAU;AACZ;;;;;;GAMG;GACD,YAAY;AACd;;;;;;;;;GASG;GACD,eAAe,GACf,uBAAuB,CAAC;AAE5B;0EAC0E;AAC1E,MAAM,MAAM,uBAAuB,GAAG,QAAQ,CAAC;IAC7C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC,CAAC;AAaH,MAAM,MAAM,yBAAyB,GAAG,QAAQ,CAC5C;IACE,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,SAAS,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,8BAA8B,CAAC;CACxC,GACD;IACE,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,QAAQ,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB,GACD;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,gBAAgB,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CACnF,CAAC;AA0BF,qBAAa,kBAAkB;;gBA2BjB,OAAO,EAAE;QACnB,UAAU,EAAE,MAAM,CAAC;QACnB,qBAAqB,EAAE,MAAM,CAAC;QAC9B,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,OAAO,EAAE,UAAU,CAAC;QACpB,8EAA8E;QAC9E,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB;;;;;WAKG;QACH,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,uEAAuE;QACvE,MAAM,CAAC,EAAE,gCAAgC,CAAC;QAC1C,6EAA6E;QAC7E,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;QAC7B,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B,uBAAuB,CAAC,EAAE,MAAM,CAAC;QACjC;;;4EAGoE;QACpE,mBAAmB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;QAC1D;;sEAE8D;QAC9D,oBAAoB,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,KAAK,OAAO,CAAC;QACxE;;;iEAGyD;QACzD,kBAAkB,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;QAC/C;;;;2CAImC;QACnC,SAAS,CAAC,EAAE,MAAM,uBAAuB,CAAC;KAC3C;IA0DD,IAAI,UAAU,IAAI,MAAM,CAEvB;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,IAAI,iBAAiB,IAAI,QAAQ,CAAC;QAChC,QAAQ,EAAE,MAAM,CAAC;QACjB,SAAS,EAAE,MAAM,CAAC;QAClB,YAAY,EAAE,MAAM,CAAC;QACrB,oBAAoB,EAAE,MAAM,CAAC;QAC7B,gBAAgB,EAAE,MAAM,CAAC;QACzB,aAAa,EAAE,MAAM,CAAC;QACtB,WAAW,EAAE,MAAM,CAAC;QACpB,YAAY,EAAE,MAAM,CAAC;KACtB,CAAC,CAED;IAED,MAAM,CAAC,OAAO,EAAE,2BAA2B,GAAG,0BAA0B;IA+LxE,IAAI,IAAI,aAAa,CAAC,0BAA0B,CAAC;IAMjD,KAAK,CAAC,EAAE,EAAE,MAAM,GAAG,0BAA0B;IAI7C,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,oBAAoB;IAU9D,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,gCAAgC;IAW5D,iBAAiB,CACf,EAAE,EAAE,MAAM,EACV,YAAY,EAAE,MAAM,EACpB,QAAQ,GAAE,gCAA0C,EACpD,OAAO,GAAE,+BAAoC,GAC5C,6BAA6B;IAwChC;;;;OAIG;IACH,0CAA0C,CACxC,EAAE,EAAE,MAAM,EACV,YAAY,EAAE,MAAM,EACpB,gBAAgB,EAAE,MAAM,GACvB,6BAA6B;IA2BhC,iBAAiB,CACf,KAAK,EAAE,6BAA6B,GACnC,6BAA6B;IAYhC,KAAK,CAAC,KAAK,EAAE,6BAA6B,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI;IAS/D,MAAM,CACJ,KAAK,EAAE,6BAA6B,EACpC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,IAAI;IAYP,IAAI,CACF,KAAK,EAAE,6BAA6B,EACpC,MAAM,GAAE,wBAAoC,GAC3C,0BAA0B;IAgB7B;;;;;;;;;OASG;IACH,iBAAiB,CACf,EAAE,EAAE,MAAM,EACV,kBAAkB,EAAE,MAAM,EAC1B,mBAAmB,EAAE,MAAM,EAC3B,MAAM,GAAE,wBAAoC,GAC3C,0BAA0B;IA0B7B,OAAO,CACL,MAAM,GAAE,wBAAoC,GAC3C,aAAa,CAAC,0BAA0B,CAAC;IAiB5C;;;;;;;;;OASG;IACG,YAAY,CAChB,MAAM,GAAE,wBAAoC,GAC3C,OAAO,CAAC,aAAa,CAAC,0BAA0B,CAAC,CAAC;IA4CrD;;;;;;;;;;;;;;;;;;;;OAoBG;IACG,UAAU,CACd,SAAS,EAAE,MAAM,EACjB,MAAM,GAAE,wBAAoC,EAC5C,YAAY,CAAC,EAAE,MAAM,EACrB,QAAQ,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,GACjC,OAAO,CAAC,yBAAyB,CAAC;CAmqBtC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,MAAM,8BAA8B,GAAG,QAAQ,CACjD;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,QAAQ,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACjG;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,gBAAgB,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE;AAC3G;;;;;;;;;;;;;;;;GAgBG;GACD;IACE,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,aAAa,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,kBAAkB,CAAC,EAAE,IAAI,CAAC;CAC3B,GACD;IACE,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,cAAc,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,8BAA8B,CAAC;CACxC;AACH;;;;;;;;;GASG;GACD;IACE,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,sBAAsB,CAAC;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AACH;;;;;;;;;;;;GAYG;GACD;IACE,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,uBAAuB,CAAC;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AACH;;;;;;GAMG;GACD;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,qBAAqB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACpE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,eAAe,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAChE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,sBAAsB,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACvE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,kBAAkB,CAAA;CAAE,CACpD,CAAC;AAEF,oDAAoD;AACpD,MAAM,MAAM,8BAA8B,GAAG,QAAQ,CACjD;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACrC;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,QAAQ,EAAE,aAAa,CAAC,8BAA8B,CAAC,CAAA;CAAE,CACnF,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,wBAAsB,wBAAwB,CAAC,OAAO,GAAE;IACtD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,wBAAwB,CAAC;IAClC,gFAAgF;IAChF,UAAU,CAAC,EAAE,4BAA4B,CAAC;IAC1C;;;;;0EAKsE;IACtE,IAAI,CAAC,EAAE,CACL,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,wBAAwB,EAChC,QAAQ,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,KAC/B,OAAO,CAAC,yBAAyB,CAAC,CAAC;IACxC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACzB,GAAG,OAAO,CAAC,8BAA8B,CAAC,CAwS/C"}

package/dist/native-terminal/host.js

@@ -1,6 +1,8 @@
 import { readFileSync, readdirSync } from "node:fs";
 import { randomUUID } from "node:crypto";
-import { resolve } from "node:path";
+import { join, resolve } from "node:path";
+import { writeHostLogLine } from "./crash-safe-log.js";
+import { HOST_FAULT_COUNTERS, recordHostFault } from "./fault-counters.js";
 // Durable session identity (incl. pgid) lives in the single registry store by
 // design — one local store per the owner's durable-state direction (see the
 // longer rationale on `persistNativeTerminalPgid`/`readNativeTerminalPgid` in
@@ -155,12 +157,12 @@ export const H2A_SESSION_TOKEN_ENV_VAR = "H2A_SESSION_TOKEN";
  * process that exits mid-scan is silently skipped, never treated as a parse
  * failure.
  */
-function listProcessGroupMemberPids(pgid) {
+function listProcessGroupMemberPids(pgid, procRoot = "/proc") {
     if (process.platform !== "linux")
         return [];
     let names;
     try {
-        names = readdirSync("/proc");
+        names = readdirSync(procRoot);
     }
     catch {
         return [];
@@ -170,7 +172,7 @@ function listProcessGroupMemberPids(pgid) {
         if (!/^\d+$/.test(name))
             continue;
         try {
-            const raw = readFileSync(`/proc/${name}/stat`, "utf8");
+            const raw = readFileSync(join(procRoot, name, "stat"), "utf8");
             const commandEnd = raw.lastIndexOf(")");
             const fields = raw.slice(commandEnd + 2).split(" ");
             if (Number(fields[2]) === pgid)
@@ -189,11 +191,11 @@ function listProcessGroupMemberPids(pgid) {
  * escaping to worry about). Returns undefined on ANY read/parse failure or
  * a non-Linux platform — same "never guess" contract as `readProcessStartTime`.
  */
-function readProcessSessionToken(pid) {
+function readProcessSessionToken(pid, procRoot = "/proc") {
     if (process.platform !== "linux")
         return undefined;
     try {
-        const raw = readFileSync(`/proc/${pid}/environ`, "utf8");
+        const raw = readFileSync(join(procRoot, String(pid), "environ"), "utf8");
         const prefix = `${H2A_SESSION_TOKEN_ENV_VAR}=`;
         for (const entry of raw.split("\0")) {
             if (entry.startsWith(prefix))
@@ -225,10 +227,15 @@ function readProcessSessionToken(pid) {
  *  - This enumeration runs ONLY on the leader-absent path (never on every
  *    reap), keeping it rare in practice — the fast leader-start-time check
  *    above it covers the common case.
+ *
+ * `procRoot` is injected ONLY by tests: a /proc-shaped view that contains
+ * exactly the processes a test started (the enumeration is the confinement
+ * boundary — the stat/environ reads stay real). Production always reads the
+ * real `/proc`.
  */
-export function groupCarriesSessionToken(pgid, expectedToken) {
-    for (const pid of listProcessGroupMemberPids(pgid)) {
-        if (readProcessSessionToken(pid) === expectedToken)
+export function groupCarriesSessionToken(pgid, expectedToken, procRoot = "/proc") {
+    for (const pid of listProcessGroupMemberPids(pgid, procRoot)) {
+        if (readProcessSessionToken(pid, procRoot) === expectedToken)
             return true;
     }
     return false;
@@ -587,7 +594,10 @@ export class NativeTerminalHost {
         this.#log =
             options.log ??
                 ((line) => {
-                    process.stderr.write(`[h2a-pty-host] ${line}\n`);
+                    // The default sink must be crash-safe: a plain `process.stderr.write`
+                    // here reproduces the suspected mechanism of the 2026-10-10/11
+                    // crash-loop (async EPIPE, unhandled `error`, uncaughtException).
+                    writeHostLogLine(line);
                 });
         this.#forceKillTimeoutMs =
             options.forceKillTimeoutMs ?? NATIVE_TERMINAL_FORCE_KILL_TIMEOUT_MS;
@@ -719,6 +729,7 @@ export class NativeTerminalHost {
             stopSignal: null,
             controllerId: null,
             controllerActivity: null,
+            controllerIdentity: null,
             controllerEpoch: 0,
             lastHumanActivityAt: null,
         };
@@ -728,48 +739,88 @@ export class NativeTerminalHost {
         let dsrTail = "";
         const resetRelay = new TerminalResetRelay((data) => { record.replay.append(data); }, () => record.replay.resetSequence());
         record.dataSubscription = record.pty.onData((data) => {
-            if (record.exit !== null || data.length === 0)
-                return;
-            resetRelay.feed(data);
-            // Answer Device Status Report cursor queries (ESC[6n) like a real
-            // terminal/tmux: TUIs that require a cursor-position report (muse
-            // aborts with "cursor position could not be read" without it).
-            const window = dsrTail + data;
-            dsrTail = window.slice(-3);
-            const queries = window.split("\x1b[6n").length - 1;
-            for (let i = 0; i < queries; i++) {
+            try {
+                if (record.exit !== null || data.length === 0)
+                    return;
+                resetRelay.feed(data);
+                // Answer Device Status Report cursor queries (ESC[6n) like a real
+                // terminal/tmux: TUIs that require a cursor-position report (muse
+                // aborts with "cursor position could not be read" without it).
+                const window = dsrTail + data;
+                dsrTail = window.slice(-3);
+                const queries = window.split("\x1b[6n").length - 1;
+                for (let i = 0; i < queries; i++) {
+                    try {
+                        record.pty.write("\x1b[1;1R");
+                    }
+                    catch {
+                        // R7.5 named exemption: expected transport failure, potentially
+                        // high volume. Count it instead of logging every failed reply.
+                        recordHostFault(HOST_FAULT_COUNTERS.hostPtyWriteBreaks);
+                        break;
+                    }
+                }
+            }
+            catch (error) {
+                // node-pty delivers this callback on the event loop shared with every
+                // other session; a faulty one must cost at most this session's output
+                // relay, never the host. Dispose the subscription so the faulty
+                // callback stops firing on every chunk.
+                recordHostFault(HOST_FAULT_COUNTERS.ptyDataCallbackContained);
+                record.dataSubscription?.dispose();
+                this.#reportSessionCallbackFailure("data", record, error);
+            }
+        });
+        record.exitSubscription = record.pty.onExit((event) => {
+            try {
+                if (record.exit !== null)
+                    return;
+                resetRelay.flush();
+                // A durable row exists to make this session reapable after THIS host
+                // dies. Once the group is confirmed empty the row can no longer make
+                // anything reapable — it is a stale record that a later host death would
+                // re-examine against whatever holds that pgid NUMBER by then. Drop it
+                // on POSITIVE proof only (see `#pruneDurableRowIfGroupEmpty`), and OFF
+                // this callback: this is node-pty's own synchronous exit callback on the
+                // host's event loop (see `#schedulePruneOfExitedSession`).
+                this.#schedulePruneOfExitedSession(record, "its pty exited");
+                const exit = {
+                    exitCode: event.exitCode,
+                };
+                if (event.signal !== undefined)
+                    exit.signal = event.signal;
+                record.exit = Object.freeze(exit);
+                record.status = "exited";
+                this.#invalidateController(record);
+                record.dataSubscription?.dispose();
+                record.exitSubscription?.dispose();
+            }
+            catch (error) {
+                // Same shared event loop as the data callback; a faulty exit callback
+                // must not take the host down. Settle the record from the parts of
+                // the event that remain readable so the session cannot linger as
+                // "running" with a dead pty, then dispose both subscriptions.
+                const exit = { exitCode: -1 };
                 try {
-                    record.pty.write("\x1b[1;1R");
+                    exit.exitCode = event.exitCode;
+                    if (event.signal !== undefined)
+                        exit.signal = event.signal;
                 }
                 catch {
-                    // Child already gone; nothing left to answer.
-                    break;
+                    // The event's own fields are unreadable; -1 records that the exit
+                    // was observed but its code was not.
+                }
+                if (record.exit === null) {
+                    record.exit = Object.freeze(exit);
+                    record.status = "exited";
+                    this.#invalidateController(record);
                 }
+                record.dataSubscription?.dispose();
+                record.exitSubscription?.dispose();
+                recordHostFault(HOST_FAULT_COUNTERS.ptyExitCallbackContained);
+                this.#reportSessionCallbackFailure("exit", record, error);
             }
         });
-        record.exitSubscription = record.pty.onExit((event) => {
-            if (record.exit !== null)
-                return;
-            resetRelay.flush();
-            // A durable row exists to make this session reapable after THIS host
-            // dies. Once the group is confirmed empty the row can no longer make
-            // anything reapable — it is a stale record that a later host death would
-            // re-examine against whatever holds that pgid NUMBER by then. Drop it
-            // on POSITIVE proof only (see `#pruneDurableRowIfGroupEmpty`), and OFF
-            // this callback: this is node-pty's own synchronous exit callback on the
-            // host's event loop (see `#schedulePruneOfExitedSession`).
-            this.#schedulePruneOfExitedSession(record, "its pty exited");
-            const exit = {
-                exitCode: event.exitCode,
-            };
-            if (event.signal !== undefined)
-                exit.signal = event.signal;
-            record.exit = Object.freeze(exit);
-            record.status = "exited";
-            this.#invalidateController(record);
-            record.dataSubscription?.dispose();
-            record.exitSubscription?.dispose();
-        });
         return this.#snapshot(record);
     }
     list() {
@@ -797,21 +848,31 @@ export class NativeTerminalHost {
             controllerEpoch: record.controllerEpoch,
         });
     }
-    acquireController(id, controllerId, activity = "human") {
+    acquireController(id, controllerId, activity = "human", options = {}) {
         const record = this.#requireControllableSession(id);
         if (controllerId.trim().length === 0 ||
             controllerId.length > NATIVE_TERMINAL_MAX_IDENTIFIER_CHARS) {
             throw new RangeError(`terminal controller id must contain 1-${NATIVE_TERMINAL_MAX_IDENTIFIER_CHARS} characters`);
         }
-        if (record.controllerId !== null) {
-            throw new Error(`terminal session already has a controller: ${id}`);
-        }
         if (activity !== "human" && activity !== "automation") {
             throw new TypeError("terminal controller activity must be human or automation");
         }
+        if (options.pid !== undefined && (!Number.isSafeInteger(options.pid) || options.pid <= 0)) {
+            throw new TypeError("terminal controller pid must be a positive safe integer");
+        }
+        if (options.tty !== undefined && (options.tty.length === 0 || options.tty.length > 256 || /[\p{Cc}\p{Cf}]/u.test(options.tty))) {
+            throw new TypeError("terminal controller tty must be a printable name of 1-256 characters");
+        }
+        if (record.controllerId !== null && options.takeover !== true) {
+            const holder = record.controllerIdentity;
+            throw new Error(`terminal session already has a controller: ${id}; pid=${holder?.pid ?? "unknown"} tty=${holder?.tty ?? "unknown"} since=${holder?.since ?? "unknown"}; use h2a attach ${id.replace(/^h2a-/, "")} --takeover to detach it`);
+        }
+        // Serialized with the lease grant: old input and disconnect cleanup are
+        // fenced by the new epoch, even if the previous attach is still exiting.
         record.controllerEpoch += 1;
         record.controllerId = controllerId;
         record.controllerActivity = activity;
+        record.controllerIdentity = Object.freeze({ pid: options.pid ?? null, tty: options.tty ?? "unknown", since: new Date().toISOString() });
         if (activity === "human")
             record.lastHumanActivityAt = Date.now();
         return Object.freeze({
@@ -1184,66 +1245,10 @@ export class NativeTerminalHost {
      *       states.
      */
     #verifyGroupLeaderIdentity(pgid, persistedLeaderStartTime, persistedGroupToken, sessionId, frame = {}) {
-        // FRAME CHECK, before any pid-based comparison. Every proof below compares a
-        // number persisted earlier with a number read now, and that is meaningful
-        // only while both were taken in the same pid namespace and after the same
-        // boot (see proc-identity.ts). A row that records a frame which does not
-        // match this reader's is unusable in BOTH directions: a start-time mismatch
-        // would be read as "recycled" (pruning the row and releasing the socket on a
-        // proof that does not hold), and a coincidental MATCH would authorize a
-        // group SIGKILL at a group this row never described. Refuse, blocking, which
-        // is the behaviour that predates the `recycled` outcome.
-        //
-        // ONE mismatch is different, and is separated out below: same pid namespace,
-        // different BOOT, same MACHINE. That is not an absence of proof, it is the
-        // strongest proof available — a reboot ends every process of the boot
-        // before it — so it prunes instead of blocking. It is still a refusal:
-        // nothing is signalled, because an unrelated live group may hold the pgid
-        // number by now.
         const anchoredFrame = frame.pidNamespace !== undefined && frame.bootId !== undefined;
-        if (frame.pidNamespace !== undefined || frame.bootId !== undefined) {
-            const current = this.#readFrame();
-            // The boot proof is admissible only inside ONE pid space, KNOWN on both
-            // sides: a pid resolved in another namespace is a different process, and
-            // an unknown namespace on either side is no statement at all.
-            const sameKnownPidNamespace = frame.pidNamespace !== undefined &&
-                current.pidNamespace !== undefined &&
-                frame.pidNamespace === current.pidNamespace;
-            // ...and only on ONE machine, KNOWN on both sides. The init pid
-            // namespace has the same inode on every kernel and boot ids are random
-            // per boot, so "same namespace, different boot" is ALSO what a row written
-            // by another machine sharing this registry looks like — a machine whose
-            // group may be alive right now. Only the machine id tells the two apart.
-            const sameKnownMachine = frame.machineId !== undefined &&
-                current.machineId !== undefined &&
-                frame.machineId === current.machineId;
-            const differentKnownBoot = frame.bootId !== undefined &&
-                current.bootId !== undefined &&
-                frame.bootId !== current.bootId;
-            if (sameKnownPidNamespace && sameKnownMachine && differentKnownBoot) {
-                // PROOF, not an absence of one: a reboot ends every process of the
-                // boot before it, so every process this row describes has ended. The
-                // pgid NUMBER may be held by an unrelated live group now, which is
-                // exactly why nothing is signalled here and why no diagnostic may
-                // point anyone at it.
-                this.#pgidGuardCounters.staleBoot += 1;
-                this.#log(`NOT signalling process group pgid=${pgid} for session ${sessionId}: this row was written at boot ${String(frame.bootId)} and this reader is at boot ${String(current.bootId)}, in the same pid namespace ${String(current.pidNamespace)} on the same machine ${String(current.machineId)} — the reboot ENDED every process this row describes, so its group is PROVEN gone. The number pgid=${pgid} may belong to an unrelated live group now and must NOT be killed. cause=stale-boot sessionId=${sessionId} pgid=${pgid}`);
-                return { proceed: false, cause: "stale-boot" };
-            }
-            if (frame.pidNamespace !== current.pidNamespace ||
-                frame.bootId !== current.bootId) {
-                // Says WHY nothing could be proven, because the two shapes call for
-                // different checks by whoever reads this: a boot change that only lacks
-                // the machine proof is either a reboot of this machine or another
-                // machine; anything else is another (or an unknown) pid space.
-                const why = sameKnownPidNamespace && differentKnownBoot
-                    ? `a different boot in the same pid namespace inode is what a previous boot of THIS machine looks like, but also what ANOTHER machine sharing this registry looks like, and the machine ids that would tell them apart are ${frame.machineId === undefined || current.machineId === undefined ? "not known on both sides" : "DIFFERENT"}`
-                    : "no pid or start-time on it can be re-proven here";
-                this.#pgidGuardCounters.foreignFrame += 1;
-                this.#log(`REFUSING to act on process group pgid=${pgid} for session ${sessionId}: this row records pid namespace ${String(frame.pidNamespace)}, boot ${String(frame.bootId)} and machine ${String(frame.machineId)}, but this reader is in pid namespace ${String(current.pidNamespace)} at boot ${String(current.bootId)} on machine ${String(current.machineId)} — ${why}. Inspecting pgid=${pgid} HERE proves nothing about this row. PROCESSES MAY SURVIVE UNCOLLECTED. cause=foreign-frame sessionId=${sessionId} pgid=${pgid}`);
-                return { proceed: false, cause: "foreign-frame" };
-            }
-        }
+        const frameRefusal = this.#verifyGroupFrame(pgid, sessionId, frame);
+        if (frameRefusal)
+            return { proceed: false, cause: frameRefusal };
         const currentStartTime = this.#readLeaderStartTime(pgid);
         if (currentStartTime !== undefined) {
             if (persistedLeaderStartTime === undefined) {
@@ -1306,6 +1311,68 @@ export class NativeTerminalHost {
         this.#log(`REFUSING to kill process group pgid=${pgid} for session ${sessionId}: the group leader is UNREADABLE and no surviving member carries the persisted session token — cannot positively prove this group's identity. PROCESSES MAY SURVIVE UNCOLLECTED. cause=membership-unprovable sessionId=${sessionId} pgid=${pgid}`);
         return { proceed: false, cause: "membership-unprovable" };
     }
+    #verifyGroupFrame(pgid, sessionId, frame) {
+        // FRAME CHECK, before any pid-based comparison. Every proof below compares a
+        // number persisted earlier with a number read now, and that is meaningful
+        // only while both were taken in the same pid namespace and after the same
+        // boot (see proc-identity.ts). A row that records a frame which does not
+        // match this reader's is unusable in BOTH directions: a start-time mismatch
+        // would be read as "recycled" (pruning the row and releasing the socket on a
+        // proof that does not hold), and a coincidental MATCH would authorize a
+        // group SIGKILL at a group this row never described. Refuse, blocking, which
+        // is the behaviour that predates the `recycled` outcome.
+        //
+        // ONE mismatch is different, and is separated out below: same pid namespace,
+        // different BOOT, same MACHINE. That is not an absence of proof, it is the
+        // strongest proof available — a reboot ends every process of the boot
+        // before it — so it prunes instead of blocking. It is still a refusal:
+        // nothing is signalled, because an unrelated live group may hold the pgid
+        // number by now.
+        if (frame.pidNamespace !== undefined || frame.bootId !== undefined) {
+            const current = this.#readFrame();
+            // The boot proof is admissible only inside ONE pid space, KNOWN on both
+            // sides: a pid resolved in another namespace is a different process, and
+            // an unknown namespace on either side is no statement at all.
+            const sameKnownPidNamespace = frame.pidNamespace !== undefined &&
+                current.pidNamespace !== undefined &&
+                frame.pidNamespace === current.pidNamespace;
+            // ...and only on ONE machine, KNOWN on both sides. The init pid
+            // namespace has the same inode on every kernel and boot ids are random
+            // per boot, so "same namespace, different boot" is ALSO what a row written
+            // by another machine sharing this registry looks like — a machine whose
+            // group may be alive right now. Only the machine id tells the two apart.
+            const sameKnownMachine = frame.machineId !== undefined &&
+                current.machineId !== undefined &&
+                frame.machineId === current.machineId;
+            const differentKnownBoot = frame.bootId !== undefined &&
+                current.bootId !== undefined &&
+                frame.bootId !== current.bootId;
+            if (sameKnownPidNamespace && sameKnownMachine && differentKnownBoot) {
+                // PROOF, not an absence of one: a reboot ends every process of the
+                // boot before it, so every process this row describes has ended. The
+                // pgid NUMBER may be held by an unrelated live group now, which is
+                // exactly why nothing is signalled here and why no diagnostic may
+                // point anyone at it.
+                this.#pgidGuardCounters.staleBoot += 1;
+                this.#log(`NOT signalling process group pgid=${pgid} for session ${sessionId}: this row was written at boot ${String(frame.bootId)} and this reader is at boot ${String(current.bootId)}, in the same pid namespace ${String(current.pidNamespace)} on the same machine ${String(current.machineId)} — the reboot ENDED every process this row describes, so its group is PROVEN gone. The number pgid=${pgid} may belong to an unrelated live group now and must NOT be killed. cause=stale-boot sessionId=${sessionId} pgid=${pgid}`);
+                return "stale-boot";
+            }
+            if (frame.pidNamespace !== current.pidNamespace ||
+                frame.bootId !== current.bootId) {
+                // Says WHY nothing could be proven, because the two shapes call for
+                // different checks by whoever reads this: a boot change that only lacks
+                // the machine proof is either a reboot of this machine or another
+                // machine; anything else is another (or an unknown) pid space.
+                const why = sameKnownPidNamespace && differentKnownBoot
+                    ? `a different boot in the same pid namespace inode is what a previous boot of THIS machine looks like, but also what ANOTHER machine sharing this registry looks like, and the machine ids that would tell them apart are ${frame.machineId === undefined || current.machineId === undefined ? "not known on both sides" : "DIFFERENT"}`
+                    : "no pid or start-time on it can be re-proven here";
+                this.#pgidGuardCounters.foreignFrame += 1;
+                this.#log(`REFUSING to act on process group pgid=${pgid} for session ${sessionId}: this row records pid namespace ${String(frame.pidNamespace)}, boot ${String(frame.bootId)} and machine ${String(frame.machineId)}, but this reader is in pid namespace ${String(current.pidNamespace)} at boot ${String(current.bootId)} on machine ${String(current.machineId)} — ${why}. Inspecting pgid=${pgid} HERE proves nothing about this row. PROCESSES MAY SURVIVE UNCOLLECTED. cause=foreign-frame sessionId=${sessionId} pgid=${pgid}`);
+                return "foreign-frame";
+            }
+        }
+        return undefined;
+    }
     /**
      * Core of both `forceStopAll` and `reapOrphan`: emit the group signal from
      * the parent, then poll `isGroupAlive` (never a fixed sleep-and-hope) until
@@ -1334,6 +1401,13 @@ export class NativeTerminalHost {
             this.#log(`skipping group-kill proof for pgid=${pgid} (${label}): process groups are not supported on ${process.platform}`);
             return { status: "dead", elapsedMs: 0 };
         }
+        // A group number has meaning only in the recorded frame. Even a
+        // signal-zero probe in another namespace may inspect an unrelated group.
+        if (verify) {
+            const refusal = this.#verifyGroupFrame(pgid, verify.sessionId, verify.persistedFrame);
+            if (refusal)
+                return { status: "refused", cause: refusal };
+        }
         if (!this.#reaper.isGroupAlive(pgid)) {
             // The group-leader-identity guard exists to protect a LIVE process
             // about to be signalled from an innocent kill. A group the OS already
@@ -1518,8 +1592,25 @@ export class NativeTerminalHost {
             return;
         record.controllerId = null;
         record.controllerActivity = null;
+        record.controllerIdentity = null;
         record.controllerEpoch += 1;
     }
+    /**
+     * Report a contained pty-callback failure WITHOUT being able to throw: the
+     * caller is the catch block that keeps the host alive, and a failing log
+     * sink must not re-arm the very crash the guard just contained. The default
+     * sink is itself crash-safe (`crash-safe-log.ts`); an injected sink that
+     * throws is swallowed here for the same reason.
+     */
+    #reportSessionCallbackFailure(kind, record, error) {
+        recordHostFault(HOST_FAULT_COUNTERS.hostPtyCallbackFailures);
+        try {
+            this.#log(`contained a faulty pty ${kind} callback for terminal session ${record.id} (pgid=${record.pty.pgid}): ${String(error)}`);
+        }
+        catch {
+            // The log sink itself is failing; containment is the priority.
+        }
+    }
     #snapshot(record) {
         return Object.freeze({
             id: record.id,
@@ -1531,6 +1622,8 @@ export class NativeTerminalHost {
             exit: record.exit,
             stopSignal: record.stopSignal,
             controlled: record.controllerId !== null,
+            controllerEpoch: record.controllerEpoch,
+            controller: record.controllerIdentity,
             lastHumanActivityAt: record.lastHumanActivityAt,
         });
     }