@telora/daemon 0.22.146 → 0.22.169

package/dist/shell/daemon-instance.d.ts

@@ -0,0 +1,176 @@
+import type { AgentSession } from '../types/index.js';
+/** The parts of a parsed instance id. */
+export interface DaemonInstance {
+    hostname: string;
+    pid: number;
+    /** Kernel start time of the daemon pid; null when the platform cannot supply one. */
+    startIdentity: string | null;
+}
+/**
+ * This daemon instance's id. Stamped onto every session it creates, and the
+ * identity its own crash recovery compares against.
+ */
+export declare function daemonInstanceId(): string;
+/** Reset the memo. Test seam only -- a daemon's identity never changes in life. */
+export declare function resetDaemonInstanceIdCache(): void;
+/**
+ * Parse an instance id, or null when it is absent or malformed. A row written
+ * by a daemon predating this column parses to null and is treated as
+ * unattributable -- never as "gone".
+ */
+export declare function parseDaemonInstanceId(id: string | null | undefined): DaemonInstance | null;
+/**
+ * What a session row's owning instance is doing now.
+ *
+ * - `self`        -- this daemon owns it. Never reap: the team is ours and live.
+ * - `peer_alive`  -- another daemon instance on this host is still running. Its
+ *                    sessions are its business; reaping them is the defect.
+ * - `gone`        -- the owning instance is not running. Its teams stopped with
+ *                    it, so its rows are safe to close.
+ * - `unknown`     -- no id, a malformed id, or an id from another host whose pid
+ *                    we cannot probe. FAILS SAFE: not reaped.
+ */
+export type InstanceLiveness = 'self' | 'peer_alive' | 'gone' | 'unknown';
+/** Probes `classifyOwningInstance` reaches, injectable for tests. */
+export interface InstanceProbeDeps {
+    selfId: string;
+    selfHostname: string;
+    isProcessAlive: (pid: number) => boolean;
+    readStartIdentity: (pid: number) => string | null;
+}
+/** Real probes against this host. */
+export declare function defaultInstanceProbes(): InstanceProbeDeps;
+/**
+ * Classify the instance that owns a session row.
+ *
+ * Every branch that is not `gone` leaves the row alone, because only `gone` is
+ * positive evidence that the team the row represents has stopped. Recovery
+ * would rather leave a stale row than falsify a live one: a stale `running` row
+ * is visible and self-correcting on the next sweep, whereas a live session
+ * marked `failed` silently tells every reader -- including "is this worktree
+ * being written?" -- that a running team is not there.
+ */
+export declare function classifyOwningInstance(instanceId: string | null | undefined, deps: InstanceProbeDeps): InstanceLiveness;
+/**
+ * What the SESSION's own process is doing -- the second proof, about the team
+ * rather than the daemon that spawned it.
+ *
+ * - `alive`               -- this session's recorded lead is still running.
+ * - `stopped`             -- it is not: gone, or its pid was recycled onto an
+ *                            unrelated process.
+ * - `no_process_recorded` -- the host's lead record is readable and names no
+ *                            lead for this session, so none was ever spawned.
+ * - `unprovable`          -- nothing can be shown: the record could not be read,
+ *                            or it names a process whose identity cannot be
+ *                            verified (a reservation, a pid with no recorded or
+ *                            no readable start identity). An anonymous live pid
+ *                            is NOT an alive team.
+ */
+export type SessionProcessLiveness = 'alive' | 'stopped' | 'no_process_recorded' | 'unprovable';
+/** Process probes for the session-liveness check, injectable for tests. */
+export interface SessionProcessProbes {
+    isProcessAlive: (pid: number) => boolean;
+    isProcessGroupAlive: (pgid: number) => boolean;
+    readStartIdentity: (pid: number) => string | null;
+    /**
+     * The host's durable lead records by session id, or null when they cannot be
+     * read. Null is UNKNOWN, never "nothing is running".
+     */
+    leadRecordsBySession: () => Map<string, {
+        pid: number;
+        startIdentity?: string;
+        pending?: true;
+    }> | null;
+}
+/**
+ * Real probes against this host. The lead-record read is memoized PER PROBE
+ * OBJECT: a sweep classifying many rows reads the file once, and every row in
+ * that sweep is judged against the same snapshot rather than a record that may
+ * change between rows.
+ */
+export declare function defaultSessionProcessProbes(): SessionProcessProbes;
+/**
+ * What this record's process is doing: running, gone, or not decidable.
+ *
+ * The third answer is the one that was missing. A live pid ALONE does not
+ * identify our lead, so treating "alive" as proof let an identity-less record
+ * -- or one whose identity could not be read -- nominate whatever process
+ * happens to hold that number as the session's writer. That is how a stale row
+ * keeps reading `running` and invents a writer for a quiescent worktree.
+ *
+ * So: alive AND verifiably ours -> `alive`. Provably absent -> `gone`. Anything
+ * in between -- no recorded identity, an unreadable live identity, a pid we
+ * cannot probe -- is `indeterminate`, and each caller applies its OWN safe
+ * direction to it rather than inheriting one that only suits recovery.
+ */
+export type RecordedProcessState = 'alive' | 'gone' | 'indeterminate';
+export declare function classifyRecordedProcess(record: {
+    pid: number;
+    startIdentity?: string;
+    pending?: true;
+}, probes: SessionProcessProbes): RecordedProcessState;
+/**
+ * Classify the session's own process, from the host's DURABLE LEAD RECORD rather
+ * than from the session row's pid.
+ *
+ * The row's pid cannot answer this, for two reasons found in review:
+ *
+ * 1. It arrives TOO LATE. `launchLeadProcess` spawns the detached lead and
+ *    records it, and only afterwards does `spawnTeamProcess` persist
+ *    `{ status: 'running', pid }`. A hard kill or a failed API write in that
+ *    window leaves a `starting` row with a null pid AND a live team. Reading
+ *    that as "no process was spawned" closes a row whose team is running.
+ *
+ * 2. It is UNVERIFIABLE. A bare pid says nothing about WHICH process holds it
+ *    now, so an unrelated process that recycled the number would keep a stale
+ *    row `running` -- and `isWorktreeBeingWritten` would report a writer that
+ *    does not exist.
+ *
+ * The lead record fixes both: it is written BEFORE the row's pid, and it carries
+ * the spawn-time start identity. Its absence is only evidence when the record
+ * itself is readable; an unreadable record is `unprovable`, never `stopped`.
+ */
+export declare function classifySessionProcess(sessionId: string, probes: SessionProcessProbes): SessionProcessLiveness;
+/**
+ * Split the scoped candidates into the ones recovery may close and the ones it
+ * must leave alone, with the reason it spared each group.
+ *
+ * TWO proofs are required, and a row is closed only when both agree.
+ *
+ * 1. Its OWNER is gone. The host scope answers "whose machine", but a machine
+ *    is not an owner: two daemon instances share a host. Our own live session,
+ *    a peer instance still running, an unattributable or remote id -- all spared.
+ *
+ * 2. Its own PROCESS is gone. A dead owner does NOT imply a stopped team: team
+ *    leads are spawned detached and survive a hard-killed daemon, and the boot
+ *    reap that ends them is best-effort by design (a missing or malformed
+ *    pidfile yields no entries; a failed kill is swallowed). So a live team
+ *    whose daemon was `kill -9`ed reaches this pass, and closing its row is
+ *    exactly the falsification the criterion forbids.
+ *
+ * The asymmetry is deliberate. A stale `running` row is visible and the next
+ * sweep re-examines it. A LIVE session marked `failed` is invisible and wrong:
+ * it tells every reader -- the dashboard, and `isWorktreeBeingWritten` -- that a
+ * running team is not there, which is how a worktree under active write comes to
+ * read as quiescent. This pass never kills anything to make its own proof true;
+ * ending a surviving orphan belongs to the identity-verified reap paths
+ * (`reapAndClearWorkerPidfile`, the untracked-lead sweep), and once they do, the
+ * next sweep reads the process as stopped and closes the row.
+ */
+export declare function partitionReapableSessions(sessions: readonly AgentSession[], probes: InstanceProbeDeps, processProbes?: SessionProcessProbes): {
+    reapable: AgentSession[];
+    spared: Map<string, string[]>;
+};
+/** Where the two probe families come from; real host probes when unsupplied. */
+export interface RecoveryProbeSource {
+    instanceProbes?: () => InstanceProbeDeps;
+    sessionProcessProbes?: () => SessionProcessProbes;
+}
+/**
+ * The subset of `sessions` crash recovery may close, logging what it spared and
+ * why. The one call recovery makes: everything it returns has a provably
+ * stopped owner, and everything it withheld is named in the log rather than
+ * silently dropped.
+ */
+export declare function reconcileOwnedSessions(sessions: readonly AgentSession[], probeSource?: RecoveryProbeSource): AgentSession[];
+//# sourceMappingURL=daemon-instance.d.ts.map

package/dist/shell/daemon-instance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"daemon-instance.d.ts","sourceRoot":"","sources":["../../src/shell/daemon-instance.ts"],"names":[],"mappings":"AAyCA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAQtD,yCAAyC;AACzC,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,qFAAqF;IACrF,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAQD;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CAMzC;AAED,mFAAmF;AACnF,wBAAgB,0BAA0B,IAAI,IAAI,CAEjD;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,cAAc,GAAG,IAAI,CAY1F;AAED;;;;;;;;;;GAUG;AACH,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,YAAY,GAAG,MAAM,GAAG,SAAS,CAAC;AAE1E,qEAAqE;AACrE,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IACzC,iBAAiB,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;CACnD;AAED,qCAAqC;AACrC,wBAAgB,qBAAqB,IAAI,iBAAiB,CAOzD;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACrC,IAAI,EAAE,iBAAiB,GACtB,gBAAgB,CAsBlB;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,sBAAsB,GAAG,OAAO,GAAG,SAAS,GAAG,qBAAqB,GAAG,YAAY,CAAC;AAEhG,2EAA2E;AAC3E,MAAM,WAAW,oBAAoB;IACnC,cAAc,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IACzC,mBAAmB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IAC/C,iBAAiB,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IAClD;;;OAGG;IACH,oBAAoB,EAAE,MAAM,GAAG,CAAC,MAAM,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,IAAI,CAAA;KAAE,CAAC,GAAG,IAAI,CAAC;CACzG;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,IAAI,oBAAoB,CAWlE;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,oBAAoB,GAAG,OAAO,GAAG,MAAM,GAAG,eAAe,CAAC;AAEtE,wBAAgB,uBAAuB,CACrC,MAAM,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,IAAI,CAAA;CAAE,EAC/D,MAAM,EAAE,oBAAoB,GAC3B,oBAAoB,CAiBtB;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,oBAAoB,GAC3B,sBAAsB,CAUxB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,SAAS,YAAY,EAAE,EACjC,MAAM,EAAE,iBAAiB,EACzB,aAAa,GAAE,oBAAoD,GAClE;IAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;IAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;CAAE,CAqC7D;AAED,gFAAgF;AAChF,MAAM,WAAW,mBAAmB;IAClC,cAAc,CAAC,EAAE,MAAM,iBAAiB,CAAC;IACzC,oBAAoB,CAAC,EAAE,MAAM,oBAAoB,CAAC;CACnD;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,SAAS,YAAY,EAAE,EACjC,WAAW,GAAE,mBAAwB,GACpC,YAAY,EAAE,CAUhB"}

package/dist/shell/daemon-instance.js

@@ -0,0 +1,281 @@
+// PINNED-BY-BEGIN (generated by gen:pinned-by -- do not hand-edit; checked by lint:pinned-by)
+// Pinned by: packages/daemon/src/queries/session-create-ownership.test.ts,
+//   packages/daemon/src/shell/crash-recovery-session-scope.test.ts,
+//   packages/daemon/src/shell/daemon-instance.test.ts, packages/daemon/src/worktree/worktree-state.test.ts
+// PINNED-BY-END
+/**
+ * Daemon INSTANCE identity -- which running daemon owns a session row.
+ *
+ * `daemon_hostname` answers "which machine", which is enough to keep one host's
+ * crash recovery off another host's live work. It is NOT enough to separate two
+ * daemon instances on the SAME host and product: to that scope they are the
+ * same owner, so one's recovery sweep would mark the other's running sessions
+ * failed. It is also not enough to answer the question recovery actually has to
+ * answer before it writes `failed` -- has the team this row represents actually
+ * stopped? -- because a hostname says nothing about liveness.
+ *
+ * An instance id is `<hostname>:<pid>:<startIdentity>`:
+ *
+ *  - `pid` is the daemon process, comparable on its own host.
+ *  - `startIdentity` is the kernel's start time for that pid (/proc stat field
+ *    22 on Linux). It makes the id PID-REUSE SAFE: a new process that happens
+ *    to land on a dead daemon's pid has a different start time, so it is not
+ *    mistaken for the instance that owned those rows.
+ *
+ * The id is therefore the thing crash recovery can probe: "is the daemon that
+ * wrote this row still running?" A row whose owner is alive, or whose owner
+ * cannot be determined, is left alone.
+ *
+ * A dead owner is NOT on its own proof that the row's team stopped. Team leads
+ * are spawned DETACHED, so they survive a hard-killed daemon; the boot reap
+ * that ends them (`reapAndClearWorkerPidfile`, unified-shell) is explicitly
+ * best-effort -- a missing or malformed pidfile yields no entries and a failed
+ * kill is swallowed. So the destructive pass needs a SECOND proof, about the
+ * session's own process: `classifySessionProcess`. Both must agree before a row
+ * is closed.
+ *
+ * @module shell/daemon-instance
+ */
+import { hostname } from 'node:os';
+import { createLogger } from './log.js';
+import { isProcessAlive } from '../spawn/liveness.js';
+import { readProcessStartIdentity, isProcessGroupAlive } from '../spawn/process-group-kill.js';
+import { readLeadRecordsBySession } from './worker-pidfile.js';
+const log = createLogger({ module: 'daemon-instance' });
+/** Separator between instance-id parts. Hostnames cannot contain ':'. */
+const SEP = ':';
+/** Memoized so every read within one daemon run returns the same identity. */
+let cachedId = null;
+/**
+ * This daemon instance's id. Stamped onto every session it creates, and the
+ * identity its own crash recovery compares against.
+ */
+export function daemonInstanceId() {
+    if (cachedId === null) {
+        const start = readProcessStartIdentity(process.pid);
+        cachedId = [hostname(), String(process.pid), start ?? 'unknown'].join(SEP);
+    }
+    return cachedId;
+}
+/** Reset the memo. Test seam only -- a daemon's identity never changes in life. */
+export function resetDaemonInstanceIdCache() {
+    cachedId = null;
+}
+/**
+ * Parse an instance id, or null when it is absent or malformed. A row written
+ * by a daemon predating this column parses to null and is treated as
+ * unattributable -- never as "gone".
+ */
+export function parseDaemonInstanceId(id) {
+    if (typeof id !== 'string' || id.length === 0)
+        return null;
+    const parts = id.split(SEP);
+    if (parts.length !== 3)
+        return null;
+    const [host, pidText, start] = parts;
+    if (!host || !pidText)
+        return null;
+    // STRICT: Number.parseInt('200junk') is 200, which would have us probe an
+    // unintended pid on the strength of a malformed id. Require all digits.
+    if (!/^[0-9]+$/.test(pidText))
+        return null;
+    const pid = Number.parseInt(pidText, 10);
+    if (!Number.isInteger(pid) || pid <= 0)
+        return null;
+    return { hostname: host, pid, startIdentity: start === 'unknown' ? null : (start ?? null) };
+}
+/** Real probes against this host. */
+export function defaultInstanceProbes() {
+    return {
+        selfId: daemonInstanceId(),
+        selfHostname: hostname(),
+        isProcessAlive,
+        readStartIdentity: readProcessStartIdentity,
+    };
+}
+/**
+ * Classify the instance that owns a session row.
+ *
+ * Every branch that is not `gone` leaves the row alone, because only `gone` is
+ * positive evidence that the team the row represents has stopped. Recovery
+ * would rather leave a stale row than falsify a live one: a stale `running` row
+ * is visible and self-correcting on the next sweep, whereas a live session
+ * marked `failed` silently tells every reader -- including "is this worktree
+ * being written?" -- that a running team is not there.
+ */
+export function classifyOwningInstance(instanceId, deps) {
+    if (instanceId === deps.selfId)
+        return 'self';
+    const parsed = parseDaemonInstanceId(instanceId);
+    if (parsed === null)
+        return 'unknown';
+    // A pid from another machine is not a pid we can probe. The host scope should
+    // already have excluded it; if one arrives anyway, it is unknown, not gone.
+    if (parsed.hostname !== deps.selfHostname)
+        return 'unknown';
+    if (!deps.isProcessAlive(parsed.pid))
+        return 'gone';
+    // The pid is alive -- but is it the SAME process, or a reused pid? A start
+    // identity that disagrees means the original instance died and its pid was
+    // recycled, so the owner IS gone.
+    const liveStart = deps.readStartIdentity(parsed.pid);
+    if (parsed.startIdentity !== null && liveStart !== null && parsed.startIdentity !== liveStart) {
+        return 'gone';
+    }
+    // Alive, and nothing contradicts that it is the owner. Leave it.
+    return 'peer_alive';
+}
+/**
+ * Real probes against this host. The lead-record read is memoized PER PROBE
+ * OBJECT: a sweep classifying many rows reads the file once, and every row in
+ * that sweep is judged against the same snapshot rather than a record that may
+ * change between rows.
+ */
+export function defaultSessionProcessProbes() {
+    let cached;
+    return {
+        isProcessAlive,
+        isProcessGroupAlive,
+        readStartIdentity: readProcessStartIdentity,
+        leadRecordsBySession: () => {
+            if (cached === undefined)
+                cached = readLeadRecordsBySession();
+            return cached;
+        },
+    };
+}
+export function classifyRecordedProcess(record, probes) {
+    // A RESERVATION: the record exists because a spawn was about to happen. It
+    // names no pid yet, so nothing about it is decidable.
+    if (record.pending)
+        return 'indeterminate';
+    const { pid } = record;
+    if (!Number.isInteger(pid) || pid <= 1)
+        return 'indeterminate';
+    // A lead may be detached (its pid is a pgid) or the in-process teammate (not a
+    // group leader, only the bare pid answers) -- the same ambiguity
+    // spawn/lifecycle.ts handles when it signals a worker. Ask both.
+    if (!probes.isProcessGroupAlive(pid) && !probes.isProcessAlive(pid))
+        return 'gone';
+    // Alive -- but is it the SAME process? Only a matching start identity settles
+    // that. Without one recorded, or without one readable now, the pid is alive
+    // and anonymous: it may be our lead or may be anything the OS put there.
+    if (!record.startIdentity)
+        return 'indeterminate';
+    const live = probes.readStartIdentity(pid);
+    if (live === null)
+        return 'indeterminate';
+    return live === record.startIdentity ? 'alive' : 'gone';
+}
+/**
+ * Classify the session's own process, from the host's DURABLE LEAD RECORD rather
+ * than from the session row's pid.
+ *
+ * The row's pid cannot answer this, for two reasons found in review:
+ *
+ * 1. It arrives TOO LATE. `launchLeadProcess` spawns the detached lead and
+ *    records it, and only afterwards does `spawnTeamProcess` persist
+ *    `{ status: 'running', pid }`. A hard kill or a failed API write in that
+ *    window leaves a `starting` row with a null pid AND a live team. Reading
+ *    that as "no process was spawned" closes a row whose team is running.
+ *
+ * 2. It is UNVERIFIABLE. A bare pid says nothing about WHICH process holds it
+ *    now, so an unrelated process that recycled the number would keep a stale
+ *    row `running` -- and `isWorktreeBeingWritten` would report a writer that
+ *    does not exist.
+ *
+ * The lead record fixes both: it is written BEFORE the row's pid, and it carries
+ * the spawn-time start identity. Its absence is only evidence when the record
+ * itself is readable; an unreadable record is `unprovable`, never `stopped`.
+ */
+export function classifySessionProcess(sessionId, probes) {
+    const records = probes.leadRecordsBySession();
+    if (records === null)
+        return 'unprovable';
+    const record = records.get(sessionId);
+    if (record === undefined)
+        return 'no_process_recorded';
+    switch (classifyRecordedProcess(record, probes)) {
+        case 'alive': return 'alive';
+        case 'gone': return 'stopped';
+        default: return 'unprovable';
+    }
+}
+/**
+ * Split the scoped candidates into the ones recovery may close and the ones it
+ * must leave alone, with the reason it spared each group.
+ *
+ * TWO proofs are required, and a row is closed only when both agree.
+ *
+ * 1. Its OWNER is gone. The host scope answers "whose machine", but a machine
+ *    is not an owner: two daemon instances share a host. Our own live session,
+ *    a peer instance still running, an unattributable or remote id -- all spared.
+ *
+ * 2. Its own PROCESS is gone. A dead owner does NOT imply a stopped team: team
+ *    leads are spawned detached and survive a hard-killed daemon, and the boot
+ *    reap that ends them is best-effort by design (a missing or malformed
+ *    pidfile yields no entries; a failed kill is swallowed). So a live team
+ *    whose daemon was `kill -9`ed reaches this pass, and closing its row is
+ *    exactly the falsification the criterion forbids.
+ *
+ * The asymmetry is deliberate. A stale `running` row is visible and the next
+ * sweep re-examines it. A LIVE session marked `failed` is invisible and wrong:
+ * it tells every reader -- the dashboard, and `isWorktreeBeingWritten` -- that a
+ * running team is not there, which is how a worktree under active write comes to
+ * read as quiescent. This pass never kills anything to make its own proof true;
+ * ending a surviving orphan belongs to the identity-verified reap paths
+ * (`reapAndClearWorkerPidfile`, the untracked-lead sweep), and once they do, the
+ * next sweep reads the process as stopped and closes the row.
+ */
+export function partitionReapableSessions(sessions, probes, processProbes = defaultSessionProcessProbes()) {
+    const reapable = [];
+    const spared = new Map();
+    const spare = (reason, id) => {
+        const ids = spared.get(reason) ?? [];
+        ids.push(id);
+        spared.set(reason, ids);
+    };
+    for (const session of sessions) {
+        const owner = classifyOwningInstance(session.daemon_instance_id, probes);
+        if (owner === 'self') {
+            spare('owned by THIS running daemon', session.id);
+            continue;
+        }
+        if (owner === 'peer_alive') {
+            spare('owned by another daemon instance still running on this host', session.id);
+            continue;
+        }
+        if (owner === 'unknown') {
+            spare('owning daemon instance not identifiable -- cannot prove it stopped', session.id);
+            continue;
+        }
+        // owner === 'gone'. Now the second proof: did its team stop with it?
+        switch (classifySessionProcess(session.id, processProbes)) {
+            case 'stopped':
+            case 'no_process_recorded':
+                reapable.push(session);
+                break;
+            case 'alive':
+                spare("the session's own lead is still running -- a detached team outlived its daemon", session.id);
+                break;
+            case 'unprovable':
+                spare('the host lead record is unreadable -- cannot prove the team stopped', session.id);
+                break;
+        }
+    }
+    return { reapable, spared };
+}
+/**
+ * The subset of `sessions` crash recovery may close, logging what it spared and
+ * why. The one call recovery makes: everything it returns has a provably
+ * stopped owner, and everything it withheld is named in the log rather than
+ * silently dropped.
+ */
+export function reconcileOwnedSessions(sessions, probeSource = {}) {
+    const { reapable, spared } = partitionReapableSessions(sessions, (probeSource.instanceProbes ?? defaultInstanceProbes)(), (probeSource.sessionProcessProbes ?? defaultSessionProcessProbes)());
+    for (const [why, ids] of spared) {
+        log.info(`[crash-recovery] Leaving ${ids.length} session(s) alone (${why}): ${ids.join(', ')}`);
+    }
+    return reapable;
+}
+//# sourceMappingURL=daemon-instance.js.map

package/dist/shell/daemon-instance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"daemon-instance.js","sourceRoot":"","sources":["../../src/shell/daemon-instance.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,2EAA2E;AAC3E,oEAAoE;AACpE,2GAA2G;AAC3G,gBAAgB;AAEhB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxC,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAC/F,OAAO,EAAE,wBAAwB,EAAuB,MAAM,qBAAqB,CAAC;AAEpF,MAAM,GAAG,GAAG,YAAY,CAAC,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC;AAUxD,yEAAyE;AACzE,MAAM,GAAG,GAAG,GAAG,CAAC;AAEhB,8EAA8E;AAC9E,IAAI,QAAQ,GAAkB,IAAI,CAAC;AAEnC;;;GAGG;AACH,MAAM,UAAU,gBAAgB;IAC9B,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,wBAAwB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACpD,QAAQ,GAAG,CAAC,QAAQ,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,KAAK,IAAI,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,0BAA0B;IACxC,QAAQ,GAAG,IAAI,CAAC;AAClB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,EAA6B;IACjE,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3D,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,GAAG,KAAK,CAAC;IACrC,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IACnC,0EAA0E;IAC1E,wEAAwE;IACxE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,aAAa,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,EAAE,CAAC;AAC9F,CAAC;AAuBD,qCAAqC;AACrC,MAAM,UAAU,qBAAqB;IACnC,OAAO;QACL,MAAM,EAAE,gBAAgB,EAAE;QAC1B,YAAY,EAAE,QAAQ,EAAE;QACxB,cAAc;QACd,iBAAiB,EAAE,wBAAwB;KAC5C,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CACpC,UAAqC,EACrC,IAAuB;IAEvB,IAAI,UAAU,KAAK,IAAI,CAAC,MAAM;QAAE,OAAO,MAAM,CAAC;IAE9C,MAAM,MAAM,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC;IACjD,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAEtC,8EAA8E;IAC9E,4EAA4E;IAC5E,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,CAAC,YAAY;QAAE,OAAO,SAAS,CAAC;IAE5D,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC;IAEpD,2EAA2E;IAC3E,2EAA2E;IAC3E,kCAAkC;IAClC,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACrD,IAAI,MAAM,CAAC,aAAa,KAAK,IAAI,IAAI,SAAS,KAAK,IAAI,IAAI,MAAM,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QAC9F,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,iEAAiE;IACjE,OAAO,YAAY,CAAC;AACtB,CAAC;AA+BD;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B;IACzC,IAAI,MAAsD,CAAC;IAC3D,OAAO;QACL,cAAc;QACd,mBAAmB;QACnB,iBAAiB,EAAE,wBAAwB;QAC3C,oBAAoB,EAAE,GAAG,EAAE;YACzB,IAAI,MAAM,KAAK,SAAS;gBAAE,MAAM,GAAG,wBAAwB,EAAE,CAAC;YAC9D,OAAO,MAAM,CAAC;QAChB,CAAC;KACF,CAAC;AACJ,CAAC;AAkBD,MAAM,UAAU,uBAAuB,CACrC,MAA+D,EAC/D,MAA4B;IAE5B,2EAA2E;IAC3E,sDAAsD;IACtD,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,eAAe,CAAC;IAC3C,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;IACvB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;QAAE,OAAO,eAAe,CAAC;IAC/D,+EAA+E;IAC/E,iEAAiE;IACjE,iEAAiE;IACjE,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC;IACnF,8EAA8E;IAC9E,4EAA4E;IAC5E,yEAAyE;IACzE,IAAI,CAAC,MAAM,CAAC,aAAa;QAAE,OAAO,eAAe,CAAC;IAClD,MAAM,IAAI,GAAG,MAAM,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAC3C,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,eAAe,CAAC;IAC1C,OAAO,IAAI,KAAK,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;AAC1D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,sBAAsB,CACpC,SAAiB,EACjB,MAA4B;IAE5B,MAAM,OAAO,GAAG,MAAM,CAAC,oBAAoB,EAAE,CAAC;IAC9C,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,YAAY,CAAC;IAC1C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACtC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,qBAAqB,CAAC;IACvD,QAAQ,uBAAuB,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;QAChD,KAAK,OAAO,CAAC,CAAC,OAAO,OAAO,CAAC;QAC7B,KAAK,MAAM,CAAC,CAAC,OAAO,SAAS,CAAC;QAC9B,OAAO,CAAC,CAAC,OAAO,YAAY,CAAC;IAC/B,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,yBAAyB,CACvC,QAAiC,EACjC,MAAyB,EACzB,gBAAsC,2BAA2B,EAAE;IAEnE,MAAM,QAAQ,GAAmB,EAAE,CAAC;IACpC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC3C,MAAM,KAAK,GAAG,CAAC,MAAc,EAAE,EAAU,EAAE,EAAE;QAC3C,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACrC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACb,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC1B,CAAC,CAAC;IACF,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,sBAAsB,CAAC,OAAO,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC;QACzE,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;YACrB,KAAK,CAAC,8BAA8B,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;YAClD,SAAS;QACX,CAAC;QACD,IAAI,KAAK,KAAK,YAAY,EAAE,CAAC;YAC3B,KAAK,CAAC,6DAA6D,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;YACjF,SAAS;QACX,CAAC;QACD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,KAAK,CAAC,oEAAoE,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;YACxF,SAAS;QACX,CAAC;QACD,qEAAqE;QACrE,QAAQ,sBAAsB,CAAC,OAAO,CAAC,EAAE,EAAE,aAAa,CAAC,EAAE,CAAC;YAC1D,KAAK,SAAS,CAAC;YACf,KAAK,qBAAqB;gBACxB,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBACvB,MAAM;YACR,KAAK,OAAO;gBACV,KAAK,CAAC,gFAAgF,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;gBACpG,MAAM;YACR,KAAK,YAAY;gBACf,KAAK,CAAC,qEAAqE,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;gBACzF,MAAM;QACV,CAAC;IACH,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;AAC9B,CAAC;AAQD;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACpC,QAAiC,EACjC,cAAmC,EAAE;IAErC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,yBAAyB,CACpD,QAAQ,EACR,CAAC,WAAW,CAAC,cAAc,IAAI,qBAAqB,CAAC,EAAE,EACvD,CAAC,WAAW,CAAC,oBAAoB,IAAI,2BAA2B,CAAC,EAAE,CACpE,CAAC;IACF,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,EAAE,CAAC;QAChC,GAAG,CAAC,IAAI,CAAC,4BAA4B,GAAG,CAAC,MAAM,sBAAsB,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/shell/graceful-shutdown.d.ts

@@ -19,7 +19,18 @@ export interface GracefulShutdownDeps {
     /** Floor for the reap budget when the engine drain overran the stop budget. */
     reapMinBudgetMs: number;
     reapWorkerFleet: (budgetMs: number) => Promise<unknown>;
-    clearWorkerPidfile: () => void;
+    /**
+     * Finalize this host's worker-ownership records: drop what is CONFIRMED GONE,
+     * keep the rest. The reap above is bounded and best-effort, so a survivor must
+     * keep its record for the next boot reap rather than being erased here.
+     *
+     * OPTIONAL, and that is the point: the shell used to pass this, which made
+     * "which function the shutdown clears with" a fact about the shell's source
+     * rather than about any run. The default is the production boundary
+     * (shell/shutdown-ownership.ts), so no caller chooses it and a test that omits
+     * it drives exactly what a real SIGTERM drives.
+     */
+    finalizeWorkerOwnership?: () => unknown;
     stopCircuitWedgeWatcher: () => void;
     stopOtlpReceiver: () => Promise<void>;
     stopTelemetryWriter: () => Promise<void>;

package/dist/shell/graceful-shutdown.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"graceful-shutdown.d.ts","sourceRoot":"","sources":["../../src/shell/graceful-shutdown.ts"],"names":[],"mappings":"AAmCA,OAAO,EAAuD,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAK1G,0CAA0C;AAC1C,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,IAAI,IAAI,CAAC;IACb,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAED,oFAAoF;AACpF,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC;IACvC,QAAQ,EAAE;QAAE,QAAQ,IAAI,IAAI,CAAA;KAAE,CAAC;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,wGAAwG;IACxG,aAAa,EAAE,MAAM,OAAO,CAAC;IAC7B,sFAAsF;IACtF,iBAAiB,EAAE,MAAM,CAAC;IAC1B,+EAA+E;IAC/E,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACxD,kBAAkB,EAAE,MAAM,IAAI,CAAC;IAC/B,uBAAuB,EAAE,MAAM,IAAI,CAAC;IACpC,gBAAgB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,mBAAmB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC,iBAAiB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,aAAa,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,IAAI,CAAC;IACnC,gBAAgB,EAAE,MAAM,IAAI,CAAC;IAC7B,cAAc,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,IAAI,CAAC;IAC9C,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,kDAAkD;IAClD,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC/B;AAMD,oEAAoE;AACpE,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,oBAAoB,GAAG,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAoFpG;AAED,+CAA+C;AAC/C,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,mFAAmF;IACnF,QAAQ,EAAE,CAAC,QAAQ,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9D,eAAe,CAAC,EAAE,MAAM,WAAW,GAAG,IAAI,CAAC;IAC3C,gBAAgB,CAAC,EAAE,MAAM,IAAI,CAAC;IAC9B,0DAA0D;IAC1D,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,QAAQ,GAAG,SAAS,EAAE,OAAO,EAAE,MAAM,IAAI,KAAK,IAAI,CAAC;CACxE;AAED,wEAAwE;AACxE,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,cAAc,GAAG,IAAI,CA0B9D"}
+{"version":3,"file":"graceful-shutdown.d.ts","sourceRoot":"","sources":["../../src/shell/graceful-shutdown.ts"],"names":[],"mappings":"AAoCA,OAAO,EAAuD,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAM1G,0CAA0C;AAC1C,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,IAAI,IAAI,CAAC;IACb,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAED,oFAAoF;AACpF,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC;IACvC,QAAQ,EAAE;QAAE,QAAQ,IAAI,IAAI,CAAA;KAAE,CAAC;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,wGAAwG;IACxG,aAAa,EAAE,MAAM,OAAO,CAAC;IAC7B,sFAAsF;IACtF,iBAAiB,EAAE,MAAM,CAAC;IAC1B,+EAA+E;IAC/E,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACxD;;;;;;;;;;OAUG;IACH,uBAAuB,CAAC,EAAE,MAAM,OAAO,CAAC;IACxC,uBAAuB,EAAE,MAAM,IAAI,CAAC;IACpC,gBAAgB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,mBAAmB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC,iBAAiB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,aAAa,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,IAAI,CAAC;IACnC,gBAAgB,EAAE,MAAM,IAAI,CAAC;IAC7B,cAAc,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,IAAI,CAAC;IAC9C,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,kDAAkD;IAClD,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC/B;AAMD,oEAAoE;AACpE,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,oBAAoB,GAAG,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAqFpG;AAED,+CAA+C;AAC/C,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,mFAAmF;IACnF,QAAQ,EAAE,CAAC,QAAQ,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9D,eAAe,CAAC,EAAE,MAAM,WAAW,GAAG,IAAI,CAAC;IAC3C,gBAAgB,CAAC,EAAE,MAAM,IAAI,CAAC;IAC9B,0DAA0D;IAC1D,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,QAAQ,GAAG,SAAS,EAAE,OAAO,EAAE,MAAM,IAAI,KAAK,IAAI,CAAC;CACxE;AAED,wEAAwE;AACxE,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,cAAc,GAAG,IAAI,CA0B9D"}

package/dist/shell/graceful-shutdown.js

@@ -1,5 +1,6 @@
 // PINNED-BY-BEGIN (generated by gen:pinned-by -- do not hand-edit; checked by lint:pinned-by)
-// Pinned by: packages/daemon/src/shell/graceful-shutdown.test.ts
+// Pinned by: packages/daemon/src/shell/graceful-shutdown.test.ts,
+//   packages/daemon/src/shell/shutdown-ownership-wiring.test.ts
 // PINNED-BY-END
 /**
  * The unified daemon's graceful shutdown and the stop signals that run it.
@@ -33,6 +34,7 @@ import { daemonExitCode, isDaemonFailStopRequested } from './fail-stop.js';
 import { setDaemonShuttingDown } from './shutdown-state.js';
 import { clearStopRequest, decideStopAction, readStopRequest } from './stop-request.js';
 import { createLogger } from './log.js';
+import { finalizeWorkerOwnership } from './shutdown-ownership.js';
 const log = createLogger({ module: 'telemetry' });
 function message(err) {
     return err instanceof Error ? err.message : String(err);
@@ -93,9 +95,10 @@ export function createGracefulShutdown(deps) {
         catch (err) {
             log.warn(`[reap] Worker-fleet reap failed: ${message(err)}`);
         }
-        // The fleet is reaped -- clear the persisted lead pidfile so neither the CLI
-        // nor the next boot acts on now-dead pids.
-        deps.clearWorkerPidfile();
+        // The fleet is reaped -- drop the record of every worker CONFIRMED gone, so
+        // neither the CLI nor the next boot acts on a dead pid, and KEEP the record
+        // of anything that outlived the bounded reap so the next boot still can.
+        (deps.finalizeWorkerOwnership ?? (() => finalizeWorkerOwnership('graceful shutdown')))();
         // Phase 2.5: Stop telemetry capture (flush remaining buffered rows, close
         // the OTLP receiver socket) and tear down the Lacuna sidecar (SIGTERM).
         deps.stopCircuitWedgeWatcher();

package/dist/shell/graceful-shutdown.js.map

@@ -1 +1 @@
-{"version":3,"file":"graceful-shutdown.js","sourceRoot":"","sources":["../../src/shell/graceful-shutdown.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,iEAAiE;AACjE,gBAAgB;AAEhB;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,cAAc,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AAC3E,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,eAAe,EAAoB,MAAM,mBAAmB,CAAC;AAC1G,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAExC,MAAM,GAAG,GAAG,YAAY,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;AAkClD,SAAS,OAAO,CAAC,GAAY;IAC3B,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAC1D,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,sBAAsB,CAAC,IAA0B;IAC/D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACjC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACjE,OAAO,KAAK,EAAE,MAAc,EAAiB,EAAE;QAC7C,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE;YAAE,OAAO;QAClC,qBAAqB,EAAE,CAAC;QAExB,2EAA2E;QAC3E,0EAA0E;QAC1E,2EAA2E;QAC3E,iDAAiD;QACjD,MAAM,cAAc,GAAG,GAAG,EAAE,CAAC;QAC7B,GAAG,CAAC,IAAI,CAAC,cAAc,MAAM,+BAA+B,CAAC,CAAC;QAE9D,4DAA4D;QAC5D,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;QAEzB,sDAAsD;QACtD,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAClC,IAAI,CAAC;gBACH,MAAM,CAAC,IAAI,EAAE,CAAC;gBACd,GAAG,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,8BAA8B,CAAC,CAAC;YAC1D,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,wBAAwB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAClE,CAAC;QACH,CAAC;QAED,gEAAgE;QAChE,MAAM,eAAe,GAAG,MAAM,OAAO,CAAC,UAAU,CAC9C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;YAChC,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC;gBACxB,GAAG,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,qBAAqB,CAAC,CAAC;YACjD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,4BAA4B,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACtE,CAAC;QACH,CAAC,CAAC,CACH,CAAC;QACF,eAAe,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE;YACpC,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;gBACjC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,IAAI,SAAS,gCAAgC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC1G,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,0EAA0E;QAC1E,4EAA4E;QAC5E,yEAAyE;QACzE,8EAA8E;QAC9E,8EAA8E;QAC9E,8EAA8E;QAC9E,wEAAwE;QACxE,8EAA8E;QAC9E,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,iBAAiB,GAAG,CAAC,GAAG,EAAE,GAAG,cAAc,CAAC,CAAC,CAAC;QACvG,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CAAC,oCAAoC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,6EAA6E;QAC7E,2CAA2C;QAC3C,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAE1B,0EAA0E;QAC1E,wEAAwE;QACxE,IAAI,CAAC,uBAAuB,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC9B,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACnC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CAAC,0BAA0B,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACrD,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACjC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CAAC,mCAAmC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC9D,CAAC;QAED,mFAAmF;QACnF,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC;QACvB,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACxB,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACtC,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAC9B,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC;IACzB,CAAC,CAAC;AACJ,CAAC;AAaD,wEAAwE;AACxE,MAAM,UAAU,mBAAmB,CAAC,IAAoB;IACtD,MAAM,IAAI,GAAG,IAAI,CAAC,eAAe,IAAI,CAAC,GAAG,EAAE,CAAC,eAAe,EAAE,CAAC,CAAC;IAC/D,MAAM,KAAK,GAAG,IAAI,CAAC,gBAAgB,IAAI,CAAC,GAAG,EAAE,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAClE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,GAAG,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1F,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,MAAM,YAAY,GAAG,CAAC,MAAc,EAAQ,EAAE;QAC5C,MAAM,OAAO,GAAG,IAAI,EAAE,CAAC;QACvB,KAAK,EAAE,CAAC;QACR,MAAM,QAAQ,GAAG,yBAAyB,EAAE,CAAC;QAC7C,IAAI,QAAQ,IAAI,gBAAgB,CAAC,MAAM,EAAE,OAAO,EAAE,YAAY,CAAC,KAAK,WAAW,EAAE,CAAC;YAChF,IAAI,QAAQ,IAAI,OAAO,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC1C,GAAG,CAAC,IAAI,CAAC,sGAAsG,CAAC,CAAC;YACnH,CAAC;iBAAM,IAAI,YAAY,EAAE,CAAC;gBACxB,GAAG,CAAC,IAAI,CAAC,4EAA4E,CAAC,CAAC;YACzF,CAAC;YACD,KAAK,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC3B,OAAO;QACT,CAAC;QACD,YAAY,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YAChE,GAAG,CAAC,KAAK,CAAC,8CAA8C,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;YAC7F,KAAK,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC7B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IACF,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC;IACjD,QAAQ,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC;AACrD,CAAC"}
+{"version":3,"file":"graceful-shutdown.js","sourceRoot":"","sources":["../../src/shell/graceful-shutdown.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,kEAAkE;AAClE,gEAAgE;AAChE,gBAAgB;AAEhB;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,cAAc,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AAC3E,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,eAAe,EAAoB,MAAM,mBAAmB,CAAC;AAC1G,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxC,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAElE,MAAM,GAAG,GAAG,YAAY,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;AA6ClD,SAAS,OAAO,CAAC,GAAY;IAC3B,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAC1D,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,sBAAsB,CAAC,IAA0B;IAC/D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACjC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACjE,OAAO,KAAK,EAAE,MAAc,EAAiB,EAAE;QAC7C,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE;YAAE,OAAO;QAClC,qBAAqB,EAAE,CAAC;QAExB,2EAA2E;QAC3E,0EAA0E;QAC1E,2EAA2E;QAC3E,iDAAiD;QACjD,MAAM,cAAc,GAAG,GAAG,EAAE,CAAC;QAC7B,GAAG,CAAC,IAAI,CAAC,cAAc,MAAM,+BAA+B,CAAC,CAAC;QAE9D,4DAA4D;QAC5D,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;QAEzB,sDAAsD;QACtD,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAClC,IAAI,CAAC;gBACH,MAAM,CAAC,IAAI,EAAE,CAAC;gBACd,GAAG,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,8BAA8B,CAAC,CAAC;YAC1D,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,wBAAwB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAClE,CAAC;QACH,CAAC;QAED,gEAAgE;QAChE,MAAM,eAAe,GAAG,MAAM,OAAO,CAAC,UAAU,CAC9C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;YAChC,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC;gBACxB,GAAG,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,qBAAqB,CAAC,CAAC;YACjD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,4BAA4B,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACtE,CAAC;QACH,CAAC,CAAC,CACH,CAAC;QACF,eAAe,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE;YACpC,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;gBACjC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,IAAI,SAAS,gCAAgC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC1G,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,0EAA0E;QAC1E,4EAA4E;QAC5E,yEAAyE;QACzE,8EAA8E;QAC9E,8EAA8E;QAC9E,8EAA8E;QAC9E,wEAAwE;QACxE,8EAA8E;QAC9E,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,iBAAiB,GAAG,CAAC,GAAG,EAAE,GAAG,cAAc,CAAC,CAAC,CAAC;QACvG,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CAAC,oCAAoC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,4EAA4E;QAC5E,4EAA4E;QAC5E,yEAAyE;QACzE,CAAC,IAAI,CAAC,uBAAuB,IAAI,CAAC,GAAG,EAAE,CAAC,uBAAuB,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,CAAC;QAEzF,0EAA0E;QAC1E,wEAAwE;QACxE,IAAI,CAAC,uBAAuB,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC9B,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACnC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CAAC,0BAA0B,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACrD,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACjC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CAAC,mCAAmC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC9D,CAAC;QAED,mFAAmF;QACnF,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC;QACvB,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACxB,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACtC,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAC9B,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC;IACzB,CAAC,CAAC;AACJ,CAAC;AAaD,wEAAwE;AACxE,MAAM,UAAU,mBAAmB,CAAC,IAAoB;IACtD,MAAM,IAAI,GAAG,IAAI,CAAC,eAAe,IAAI,CAAC,GAAG,EAAE,CAAC,eAAe,EAAE,CAAC,CAAC;IAC/D,MAAM,KAAK,GAAG,IAAI,CAAC,gBAAgB,IAAI,CAAC,GAAG,EAAE,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAClE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,GAAG,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1F,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,MAAM,YAAY,GAAG,CAAC,MAAc,EAAQ,EAAE;QAC5C,MAAM,OAAO,GAAG,IAAI,EAAE,CAAC;QACvB,KAAK,EAAE,CAAC;QACR,MAAM,QAAQ,GAAG,yBAAyB,EAAE,CAAC;QAC7C,IAAI,QAAQ,IAAI,gBAAgB,CAAC,MAAM,EAAE,OAAO,EAAE,YAAY,CAAC,KAAK,WAAW,EAAE,CAAC;YAChF,IAAI,QAAQ,IAAI,OAAO,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC1C,GAAG,CAAC,IAAI,CAAC,sGAAsG,CAAC,CAAC;YACnH,CAAC;iBAAM,IAAI,YAAY,EAAE,CAAC;gBACxB,GAAG,CAAC,IAAI,CAAC,4EAA4E,CAAC,CAAC;YACzF,CAAC;YACD,KAAK,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC3B,OAAO;QACT,CAAC;QACD,YAAY,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YAChE,GAAG,CAAC,KAAK,CAAC,8CAA8C,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;YAC7F,KAAK,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC7B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IACF,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC;IACjD,QAAQ,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC;AACrD,CAAC"}

package/dist/shell/shutdown-ownership.d.ts

@@ -0,0 +1,34 @@
+/**
+ * The ONE place a shutdown finalizes this host's worker-ownership records.
+ *
+ * The daemon has two shutdowns. The graceful one (shell/graceful-shutdown.ts)
+ * runs on SIGINT/SIGTERM; the auto-update one (`shutdownForUpdate` in
+ * shell/unified-shell.ts) runs before the re-exec. Both must leave the pidfile in
+ * the same state, and for the same reason: `reapWorkerFleet` is BOUNDED and
+ * best-effort, so a worker that outlived SIGKILL, one that could not be
+ * signalled, and a reservation whose spawn is in flight all survive it. Erasing
+ * the file here erases the record of exactly those -- right before the next boot
+ * reap, or the re-exec'd daemon, would have acted on them.
+ *
+ * Both paths used to reach for that themselves, and each could reach for the
+ * WRONG function: they called the unconditional `clearWorkerPidfile`, and the
+ * fix -- passing `clearWorkerPidfileIfAllGone` instead -- left the choice in
+ * place at two call sites, testable only by reading the source to see which
+ * name was written there. So the choice is gone: this is the only ownership
+ * finalization either path can perform, the graceful sequence takes it by
+ * default rather than as an injected dep, and worker-pidfile.ts no longer
+ * exports an unconditional clear for a call site to pick up.
+ *
+ * @module shell/shutdown-ownership
+ */
+import { type WorkerPidEntry } from './worker-pidfile.js';
+/**
+ * Drop the ownership records of every worker CONFIRMED gone, keep the rest.
+ *
+ * `context` names the shutdown for the log. Returns the survivors kept on disk,
+ * so a caller (and a test) can see what this host is still claiming. Never
+ * throws: a shutdown step that cannot finalize ownership must not prevent the
+ * rest of the teardown, and an unreadable record is kept, not declared empty.
+ */
+export declare function finalizeWorkerOwnership(context: string): WorkerPidEntry[];
+//# sourceMappingURL=shutdown-ownership.d.ts.map

package/dist/shell/shutdown-ownership.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shutdown-ownership.d.ts","sourceRoot":"","sources":["../../src/shell/shutdown-ownership.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAA+B,KAAK,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAKvF;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,cAAc,EAAE,CAWzE"}

package/dist/shell/shutdown-ownership.js

@@ -0,0 +1,51 @@
+// PINNED-BY-BEGIN (generated by gen:pinned-by -- do not hand-edit; checked by lint:pinned-by)
+// Pinned by: packages/daemon/src/shell/shutdown-ownership-wiring.test.ts
+// PINNED-BY-END
+/**
+ * The ONE place a shutdown finalizes this host's worker-ownership records.
+ *
+ * The daemon has two shutdowns. The graceful one (shell/graceful-shutdown.ts)
+ * runs on SIGINT/SIGTERM; the auto-update one (`shutdownForUpdate` in
+ * shell/unified-shell.ts) runs before the re-exec. Both must leave the pidfile in
+ * the same state, and for the same reason: `reapWorkerFleet` is BOUNDED and
+ * best-effort, so a worker that outlived SIGKILL, one that could not be
+ * signalled, and a reservation whose spawn is in flight all survive it. Erasing
+ * the file here erases the record of exactly those -- right before the next boot
+ * reap, or the re-exec'd daemon, would have acted on them.
+ *
+ * Both paths used to reach for that themselves, and each could reach for the
+ * WRONG function: they called the unconditional `clearWorkerPidfile`, and the
+ * fix -- passing `clearWorkerPidfileIfAllGone` instead -- left the choice in
+ * place at two call sites, testable only by reading the source to see which
+ * name was written there. So the choice is gone: this is the only ownership
+ * finalization either path can perform, the graceful sequence takes it by
+ * default rather than as an injected dep, and worker-pidfile.ts no longer
+ * exports an unconditional clear for a call site to pick up.
+ *
+ * @module shell/shutdown-ownership
+ */
+import { clearWorkerPidfileIfAllGone } from './worker-pidfile.js';
+import { createLogger } from './log.js';
+const log = createLogger({ module: 'shutdown-ownership' });
+/**
+ * Drop the ownership records of every worker CONFIRMED gone, keep the rest.
+ *
+ * `context` names the shutdown for the log. Returns the survivors kept on disk,
+ * so a caller (and a test) can see what this host is still claiming. Never
+ * throws: a shutdown step that cannot finalize ownership must not prevent the
+ * rest of the teardown, and an unreadable record is kept, not declared empty.
+ */
+export function finalizeWorkerOwnership(context) {
+    try {
+        const survivors = clearWorkerPidfileIfAllGone();
+        if (survivors.length > 0) {
+            log.info(`[${context}] ${survivors.length} worker record(s) kept for the next boot reap`);
+        }
+        return survivors;
+    }
+    catch (err) {
+        log.warn(`[${context}] could not finalize worker ownership: ${err?.message ?? String(err)}`);
+        return [];
+    }
+}
+//# sourceMappingURL=shutdown-ownership.js.map