@telora/daemon 0.22.181 → 0.22.189

package/dist/shell/daemon-instance.js

@@ -3,128 +3,15 @@
 //   packages/daemon/src/shell/crash-recovery-session-scope.test.ts,
 //   packages/daemon/src/shell/daemon-instance.test.ts, packages/daemon/src/worktree/worktree-state.test.ts
 // PINNED-BY-END
-/**
- * Daemon INSTANCE identity -- which running daemon owns a session row.
- *
- * `daemon_hostname` answers "which machine", which is enough to keep one host's
- * crash recovery off another host's live work. It is NOT enough to separate two
- * daemon instances on the SAME host and product: to that scope they are the
- * same owner, so one's recovery sweep would mark the other's running sessions
- * failed. It is also not enough to answer the question recovery actually has to
- * answer before it writes `failed` -- has the team this row represents actually
- * stopped? -- because a hostname says nothing about liveness.
- *
- * An instance id is `<hostname>:<pid>:<startIdentity>`:
- *
- *  - `pid` is the daemon process, comparable on its own host.
- *  - `startIdentity` is the kernel's start time for that pid (/proc stat field
- *    22 on Linux). It makes the id PID-REUSE SAFE: a new process that happens
- *    to land on a dead daemon's pid has a different start time, so it is not
- *    mistaken for the instance that owned those rows.
- *
- * The id is therefore the thing crash recovery can probe: "is the daemon that
- * wrote this row still running?" A row whose owner is alive, or whose owner
- * cannot be determined, is left alone.
- *
- * A dead owner is NOT on its own proof that the row's team stopped. Team leads
- * are spawned DETACHED, so they survive a hard-killed daemon; the boot reap
- * that ends them (`reapAndClearWorkerPidfile`, unified-shell) is explicitly
- * best-effort -- a missing or malformed pidfile yields no entries and a failed
- * kill is swallowed. So the destructive pass needs a SECOND proof, about the
- * session's own process: `classifySessionProcess`. Both must agree before a row
- * is closed.
- *
- * @module shell/daemon-instance
- */
-import { hostname } from 'node:os';
 import { createLogger } from './log.js';
 import { isProcessAlive } from '../spawn/liveness.js';
 import { readProcessStartIdentity, isProcessGroupAlive } from '../spawn/process-group-kill.js';
 import { readLeadRecordsBySession } from './worker-pidfile.js';
+import { classifyOwningInstance, defaultInstanceProbes, isReservationInFlight, } from './instance-liveness.js';
+// The identity half, re-exported so none of this module's importers move. The
+// DEFINING module is instance-liveness.ts; new code should import from there.
+export { daemonInstanceId, resetDaemonInstanceIdCache, parseDaemonInstanceId, defaultInstanceProbes, classifyOwningInstance, isReservationInFlight, } from './instance-liveness.js';
 const log = createLogger({ module: 'daemon-instance' });
-/** Separator between instance-id parts. Hostnames cannot contain ':'. */
-const SEP = ':';
-/** Memoized so every read within one daemon run returns the same identity. */
-let cachedId = null;
-/**
- * This daemon instance's id. Stamped onto every session it creates, and the
- * identity its own crash recovery compares against.
- */
-export function daemonInstanceId() {
-    if (cachedId === null) {
-        const start = readProcessStartIdentity(process.pid);
-        cachedId = [hostname(), String(process.pid), start ?? 'unknown'].join(SEP);
-    }
-    return cachedId;
-}
-/** Reset the memo. Test seam only -- a daemon's identity never changes in life. */
-export function resetDaemonInstanceIdCache() {
-    cachedId = null;
-}
-/**
- * Parse an instance id, or null when it is absent or malformed. A row written
- * by a daemon predating this column parses to null and is treated as
- * unattributable -- never as "gone".
- */
-export function parseDaemonInstanceId(id) {
-    if (typeof id !== 'string' || id.length === 0)
-        return null;
-    const parts = id.split(SEP);
-    if (parts.length !== 3)
-        return null;
-    const [host, pidText, start] = parts;
-    if (!host || !pidText)
-        return null;
-    // STRICT: Number.parseInt('200junk') is 200, which would have us probe an
-    // unintended pid on the strength of a malformed id. Require all digits.
-    if (!/^[0-9]+$/.test(pidText))
-        return null;
-    const pid = Number.parseInt(pidText, 10);
-    if (!Number.isInteger(pid) || pid <= 0)
-        return null;
-    return { hostname: host, pid, startIdentity: start === 'unknown' ? null : (start ?? null) };
-}
-/** Real probes against this host. */
-export function defaultInstanceProbes() {
-    return {
-        selfId: daemonInstanceId(),
-        selfHostname: hostname(),
-        isProcessAlive,
-        readStartIdentity: readProcessStartIdentity,
-    };
-}
-/**
- * Classify the instance that owns a session row.
- *
- * Every branch that is not `gone` leaves the row alone, because only `gone` is
- * positive evidence that the team the row represents has stopped. Recovery
- * would rather leave a stale row than falsify a live one: a stale `running` row
- * is visible and self-correcting on the next sweep, whereas a live session
- * marked `failed` silently tells every reader -- including "is this worktree
- * being written?" -- that a running team is not there.
- */
-export function classifyOwningInstance(instanceId, deps) {
-    if (instanceId === deps.selfId)
-        return 'self';
-    const parsed = parseDaemonInstanceId(instanceId);
-    if (parsed === null)
-        return 'unknown';
-    // A pid from another machine is not a pid we can probe. The host scope should
-    // already have excluded it; if one arrives anyway, it is unknown, not gone.
-    if (parsed.hostname !== deps.selfHostname)
-        return 'unknown';
-    if (!deps.isProcessAlive(parsed.pid))
-        return 'gone';
-    // The pid is alive -- but is it the SAME process, or a reused pid? A start
-    // identity that disagrees means the original instance died and its pid was
-    // recycled, so the owner IS gone.
-    const liveStart = deps.readStartIdentity(parsed.pid);
-    if (parsed.startIdentity !== null && liveStart !== null && parsed.startIdentity !== liveStart) {
-        return 'gone';
-    }
-    // Alive, and nothing contradicts that it is the owner. Leave it.
-    return 'peer_alive';
-}
 /**
  * Real probes against this host. The lead-record read is memoized PER PROBE
  * OBJECT: a sweep classifying many rows reads the file once, and every row in
@@ -142,13 +29,21 @@ export function defaultSessionProcessProbes() {
                 cached = readLeadRecordsBySession();
             return cached;
         },
+        // Bound to the real host probes. This is the DEFAULT the mars-shaped
+        // stranded reservation is judged by, not only an injected test seam.
+        reservationInFlight: (reservedBy) => isReservationInFlight(reservedBy),
     };
 }
 export function classifyRecordedProcess(record, probes) {
-    // A RESERVATION: the record exists because a spawn was about to happen. It
-    // names no pid yet, so nothing about it is decidable.
-    if (record.pending)
-        return 'indeterminate';
+    // A RESERVATION: the record exists because a spawn was about to happen, so it
+    // names no pid. Nothing about the PROCESS is decidable -- but whether anything
+    // ever will be is, and that is what `reservedBy` answers. A reservation whose
+    // reserving instance is still running (or cannot be attributed at all) is in
+    // flight and stays `indeterminate`; one whose instance is provably gone is
+    // stranded, will never be resolved by anyone, and reads `gone`.
+    if (record.pending) {
+        return probes.reservationInFlight(record.reservedBy) ? 'indeterminate' : 'gone';
+    }
     const { pid } = record;
     if (!Number.isInteger(pid) || pid <= 1)
         return 'indeterminate';

package/dist/shell/daemon-instance.js.map

@@ -1 +1 @@
-{"version":3,"file":"daemon-instance.js","sourceRoot":"","sources":["../../src/shell/daemon-instance.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,2EAA2E;AAC3E,oEAAoE;AACpE,2GAA2G;AAC3G,gBAAgB;AAEhB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxC,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAC/F,OAAO,EAAE,wBAAwB,EAAuB,MAAM,qBAAqB,CAAC;AAEpF,MAAM,GAAG,GAAG,YAAY,CAAC,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC;AAUxD,yEAAyE;AACzE,MAAM,GAAG,GAAG,GAAG,CAAC;AAEhB,8EAA8E;AAC9E,IAAI,QAAQ,GAAkB,IAAI,CAAC;AAEnC;;;GAGG;AACH,MAAM,UAAU,gBAAgB;IAC9B,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,wBAAwB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACpD,QAAQ,GAAG,CAAC,QAAQ,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,KAAK,IAAI,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,0BAA0B;IACxC,QAAQ,GAAG,IAAI,CAAC;AAClB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,EAA6B;IACjE,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3D,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,GAAG,KAAK,CAAC;IACrC,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IACnC,0EAA0E;IAC1E,wEAAwE;IACxE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,aAAa,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,EAAE,CAAC;AAC9F,CAAC;AAuBD,qCAAqC;AACrC,MAAM,UAAU,qBAAqB;IACnC,OAAO;QACL,MAAM,EAAE,gBAAgB,EAAE;QAC1B,YAAY,EAAE,QAAQ,EAAE;QACxB,cAAc;QACd,iBAAiB,EAAE,wBAAwB;KAC5C,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CACpC,UAAqC,EACrC,IAAuB;IAEvB,IAAI,UAAU,KAAK,IAAI,CAAC,MAAM;QAAE,OAAO,MAAM,CAAC;IAE9C,MAAM,MAAM,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC;IACjD,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAEtC,8EAA8E;IAC9E,4EAA4E;IAC5E,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,CAAC,YAAY;QAAE,OAAO,SAAS,CAAC;IAE5D,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC;IAEpD,2EAA2E;IAC3E,2EAA2E;IAC3E,kCAAkC;IAClC,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACrD,IAAI,MAAM,CAAC,aAAa,KAAK,IAAI,IAAI,SAAS,KAAK,IAAI,IAAI,MAAM,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QAC9F,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,iEAAiE;IACjE,OAAO,YAAY,CAAC;AACtB,CAAC;AA+BD;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B;IACzC,IAAI,MAAsD,CAAC;IAC3D,OAAO;QACL,cAAc;QACd,mBAAmB;QACnB,iBAAiB,EAAE,wBAAwB;QAC3C,oBAAoB,EAAE,GAAG,EAAE;YACzB,IAAI,MAAM,KAAK,SAAS;gBAAE,MAAM,GAAG,wBAAwB,EAAE,CAAC;YAC9D,OAAO,MAAM,CAAC;QAChB,CAAC;KACF,CAAC;AACJ,CAAC;AAkBD,MAAM,UAAU,uBAAuB,CACrC,MAA+D,EAC/D,MAA4B;IAE5B,2EAA2E;IAC3E,sDAAsD;IACtD,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,eAAe,CAAC;IAC3C,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;IACvB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;QAAE,OAAO,eAAe,CAAC;IAC/D,+EAA+E;IAC/E,iEAAiE;IACjE,iEAAiE;IACjE,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC;IACnF,8EAA8E;IAC9E,4EAA4E;IAC5E,yEAAyE;IACzE,IAAI,CAAC,MAAM,CAAC,aAAa;QAAE,OAAO,eAAe,CAAC;IAClD,MAAM,IAAI,GAAG,MAAM,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAC3C,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,eAAe,CAAC;IAC1C,OAAO,IAAI,KAAK,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;AAC1D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,sBAAsB,CACpC,SAAiB,EACjB,MAA4B;IAE5B,MAAM,OAAO,GAAG,MAAM,CAAC,oBAAoB,EAAE,CAAC;IAC9C,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,YAAY,CAAC;IAC1C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACtC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,qBAAqB,CAAC;IACvD,QAAQ,uBAAuB,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;QAChD,KAAK,OAAO,CAAC,CAAC,OAAO,OAAO,CAAC;QAC7B,KAAK,MAAM,CAAC,CAAC,OAAO,SAAS,CAAC;QAC9B,OAAO,CAAC,CAAC,OAAO,YAAY,CAAC;IAC/B,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,yBAAyB,CACvC,QAAiC,EACjC,MAAyB,EACzB,gBAAsC,2BAA2B,EAAE;IAEnE,MAAM,QAAQ,GAAmB,EAAE,CAAC;IACpC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC3C,MAAM,KAAK,GAAG,CAAC,MAAc,EAAE,EAAU,EAAE,EAAE;QAC3C,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACrC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACb,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC1B,CAAC,CAAC;IACF,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,sBAAsB,CAAC,OAAO,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC;QACzE,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;YACrB,KAAK,CAAC,8BAA8B,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;YAClD,SAAS;QACX,CAAC;QACD,IAAI,KAAK,KAAK,YAAY,EAAE,CAAC;YAC3B,KAAK,CAAC,6DAA6D,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;YACjF,SAAS;QACX,CAAC;QACD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,KAAK,CAAC,oEAAoE,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;YACxF,SAAS;QACX,CAAC;QACD,qEAAqE;QACrE,QAAQ,sBAAsB,CAAC,OAAO,CAAC,EAAE,EAAE,aAAa,CAAC,EAAE,CAAC;YAC1D,KAAK,SAAS,CAAC;YACf,KAAK,qBAAqB;gBACxB,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBACvB,MAAM;YACR,KAAK,OAAO;gBACV,KAAK,CAAC,gFAAgF,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;gBACpG,MAAM;YACR,KAAK,YAAY;gBACf,KAAK,CAAC,qEAAqE,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;gBACzF,MAAM;QACV,CAAC;IACH,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;AAC9B,CAAC;AAQD;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACpC,QAAiC,EACjC,cAAmC,EAAE;IAErC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,yBAAyB,CACpD,QAAQ,EACR,CAAC,WAAW,CAAC,cAAc,IAAI,qBAAqB,CAAC,EAAE,EACvD,CAAC,WAAW,CAAC,oBAAoB,IAAI,2BAA2B,CAAC,EAAE,CACpE,CAAC;IACF,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,EAAE,CAAC;QAChC,GAAG,CAAC,IAAI,CAAC,4BAA4B,GAAG,CAAC,MAAM,sBAAsB,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}
+{"version":3,"file":"daemon-instance.js","sourceRoot":"","sources":["../../src/shell/daemon-instance.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,2EAA2E;AAC3E,oEAAoE;AACpE,2GAA2G;AAC3G,gBAAgB;AA6BhB,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxC,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAC/F,OAAO,EAAE,wBAAwB,EAAuB,MAAM,qBAAqB,CAAC;AACpF,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,qBAAqB,GAEtB,MAAM,wBAAwB,CAAC;AAEhC,8EAA8E;AAC9E,8EAA8E;AAC9E,OAAO,EACL,gBAAgB,EAChB,0BAA0B,EAC1B,qBAAqB,EACrB,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,wBAAwB,CAAC;AAOhC,MAAM,GAAG,GAAG,YAAY,CAAC,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC;AAyDxD;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B;IACzC,IAAI,MAAsD,CAAC;IAC3D,OAAO;QACL,cAAc;QACd,mBAAmB;QACnB,iBAAiB,EAAE,wBAAwB;QAC3C,oBAAoB,EAAE,GAAG,EAAE;YACzB,IAAI,MAAM,KAAK,SAAS;gBAAE,MAAM,GAAG,wBAAwB,EAAE,CAAC;YAC9D,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,qEAAqE;QACrE,qEAAqE;QACrE,mBAAmB,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,qBAAqB,CAAC,UAAU,CAAC;KACvE,CAAC;AACJ,CAAC;AAmCD,MAAM,UAAU,uBAAuB,CACrC,MAAuB,EACvB,MAA4B;IAE5B,8EAA8E;IAC9E,+EAA+E;IAC/E,8EAA8E;IAC9E,6EAA6E;IAC7E,2EAA2E;IAC3E,gEAAgE;IAChE,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,OAAO,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC;IAClF,CAAC;IACD,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;IACvB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;QAAE,OAAO,eAAe,CAAC;IAC/D,+EAA+E;IAC/E,iEAAiE;IACjE,iEAAiE;IACjE,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC;IACnF,8EAA8E;IAC9E,4EAA4E;IAC5E,yEAAyE;IACzE,IAAI,CAAC,MAAM,CAAC,aAAa;QAAE,OAAO,eAAe,CAAC;IAClD,MAAM,IAAI,GAAG,MAAM,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAC3C,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,eAAe,CAAC;IAC1C,OAAO,IAAI,KAAK,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;AAC1D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,sBAAsB,CACpC,SAAiB,EACjB,MAA4B;IAE5B,MAAM,OAAO,GAAG,MAAM,CAAC,oBAAoB,EAAE,CAAC;IAC9C,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,YAAY,CAAC;IAC1C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACtC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,qBAAqB,CAAC;IACvD,QAAQ,uBAAuB,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;QAChD,KAAK,OAAO,CAAC,CAAC,OAAO,OAAO,CAAC;QAC7B,KAAK,MAAM,CAAC,CAAC,OAAO,SAAS,CAAC;QAC9B,OAAO,CAAC,CAAC,OAAO,YAAY,CAAC;IAC/B,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,yBAAyB,CACvC,QAAiC,EACjC,MAAyB,EACzB,gBAAsC,2BAA2B,EAAE;IAEnE,MAAM,QAAQ,GAAmB,EAAE,CAAC;IACpC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC3C,MAAM,KAAK,GAAG,CAAC,MAAc,EAAE,EAAU,EAAE,EAAE;QAC3C,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACrC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACb,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC1B,CAAC,CAAC;IACF,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,sBAAsB,CAAC,OAAO,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC;QACzE,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;YACrB,KAAK,CAAC,8BAA8B,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;YAClD,SAAS;QACX,CAAC;QACD,IAAI,KAAK,KAAK,YAAY,EAAE,CAAC;YAC3B,KAAK,CAAC,6DAA6D,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;YACjF,SAAS;QACX,CAAC;QACD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,KAAK,CAAC,oEAAoE,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;YACxF,SAAS;QACX,CAAC;QACD,qEAAqE;QACrE,QAAQ,sBAAsB,CAAC,OAAO,CAAC,EAAE,EAAE,aAAa,CAAC,EAAE,CAAC;YAC1D,KAAK,SAAS,CAAC;YACf,KAAK,qBAAqB;gBACxB,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBACvB,MAAM;YACR,KAAK,OAAO;gBACV,KAAK,CAAC,gFAAgF,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;gBACpG,MAAM;YACR,KAAK,YAAY;gBACf,KAAK,CAAC,qEAAqE,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;gBACzF,MAAM;QACV,CAAC;IACH,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;AAC9B,CAAC;AAQD;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACpC,QAAiC,EACjC,cAAmC,EAAE;IAErC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,yBAAyB,CACpD,QAAQ,EACR,CAAC,WAAW,CAAC,cAAc,IAAI,qBAAqB,CAAC,EAAE,EACvD,CAAC,WAAW,CAAC,oBAAoB,IAAI,2BAA2B,CAAC,EAAE,CACpE,CAAC;IACF,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,EAAE,CAAC;QAChC,GAAG,CAAC,IAAI,CAAC,4BAA4B,GAAG,CAAC,MAAM,sBAAsB,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/shell/health-events.js

@@ -1,5 +1,5 @@
 // PINNED-BY-BEGIN (generated by gen:pinned-by -- do not hand-edit; checked by lint:pinned-by)
-// Pinned by: none -- no test imports this module directly (baselined; see lint:pinned-by)
+// Pinned by: packages/daemon/src/shell/schema-version-gate.test.ts
 // PINNED-BY-END
 /**
  * Daemon-local seam over daemon-core's healthEvents buffer.

package/dist/shell/health-events.js.map

@@ -1 +1 @@
-{"version":3,"file":"health-events.js","sourceRoot":"","sources":["../../src/shell/health-events.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,0FAA0F;AAC1F,gBAAgB;AAEhB;;;;;;;GAOG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"health-events.js","sourceRoot":"","sources":["../../src/shell/health-events.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,mEAAmE;AACnE,gBAAgB;AAEhB;;;;;;;GAOG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/shell/instance-liveness.d.ts

@@ -0,0 +1,112 @@
+/** The parts of a parsed instance id. */
+export interface DaemonInstance {
+    hostname: string;
+    pid: number;
+    /** Kernel start time of the daemon pid; null when the platform cannot supply one. */
+    startIdentity: string | null;
+}
+/**
+ * This daemon instance's id. Stamped onto every session it creates, onto every
+ * lead-record RESERVATION it makes, and the identity its own crash recovery
+ * compares against.
+ */
+export declare function daemonInstanceId(): string;
+/** Reset the memo. Test seam only -- a daemon's identity never changes in life. */
+export declare function resetDaemonInstanceIdCache(): void;
+/**
+ * Parse an instance id, or null when it is absent or malformed. A row written
+ * by a daemon predating this column parses to null and is treated as
+ * unattributable -- never as "gone".
+ */
+export declare function parseDaemonInstanceId(id: string | null | undefined): DaemonInstance | null;
+/**
+ * What a session row's owning instance is doing now.
+ *
+ * - `self`        -- this daemon owns it. Never reap: the team is ours and live.
+ * - `peer_alive`  -- another daemon instance on this host is still running. Its
+ *                    sessions are its business; reaping them is the defect.
+ * - `gone`        -- the owning instance is not running. Its teams stopped with
+ *                    it, so its rows are safe to close.
+ * - `unknown`     -- no id, a malformed id, or an id from another host whose pid
+ *                    we cannot probe. FAILS SAFE: not reaped.
+ */
+export type InstanceLiveness = 'self' | 'peer_alive' | 'gone' | 'unknown';
+/** Probes `classifyOwningInstance` reaches, injectable for tests. */
+export interface InstanceProbeDeps {
+    selfId: string;
+    selfHostname: string;
+    isProcessAlive: (pid: number) => boolean;
+    readStartIdentity: (pid: number) => string | null;
+}
+/** Real probes against this host. */
+export declare function defaultInstanceProbes(): InstanceProbeDeps;
+/**
+ * Classify the instance that owns a session row.
+ *
+ * Every branch that is not `gone` leaves the row alone, because only `gone` is
+ * positive evidence that the team the row represents has stopped. Recovery
+ * would rather leave a stale row than falsify a live one: a stale `running` row
+ * is visible and self-correcting on the next sweep, whereas a live session
+ * marked `failed` silently tells every reader -- including "is this worktree
+ * being written?" -- that a running team is not there.
+ */
+export declare function classifyOwningInstance(instanceId: string | null | undefined, deps: InstanceProbeDeps): InstanceLiveness;
+/**
+ * Is a lead-record RESERVATION still in flight?
+ *
+ * This is the ONE definition of the rule `reserveLeadRecord` has stated in a
+ * comment since the field was added: "a reservation is 'in flight' only while
+ * the instance that made it is still running; once that instance is provably
+ * gone nothing will ever resolve it, and it must not hold a worktree open
+ * forever." Two judgements read it -- the retention filter
+ * (`recordedLeadStillRunning`, so the reap and boot passes retire a stranded
+ * reservation) and the session verdict (`classifyRecordedProcess`, so a live
+ * daemon's sweeps stop answering `unprovable` about it forever) -- and both
+ * reach it through an injectable dep defaulting here, so there is no second
+ * copy of the rule to drift.
+ *
+ * DIRECTION OF FAILURE. Absent or empty `reservedBy` is IN FLIGHT. A reservation
+ * written by a daemon predating the field names nobody, and retiring a record on
+ * a guess is the one move this module refuses everywhere: unattributable is not
+ * gone. Of the four classifications only `gone` retires; `self`, `peer_alive`
+ * and `unknown` (a malformed id, or an id from a host whose pids we cannot
+ * probe) all read as in flight.
+ *
+ * THE OBJECTION, AND WHY `gone` IS NEVERTHELESS THE RIGHT VERDICT.
+ * `docs/DECISIONS.md` (2026-09-21) records the consideration this
+ * implementation has to answer: expiring a reservation because its reserving
+ * instance is gone converts "unprovable" into "nothing was spawned", which is
+ * the inference this module refuses everywhere else -- a lead is spawned
+ * DETACHED and can outlive the daemon that reserved it, and dropping its only
+ * record would make it unnameable by the force-stop and next-boot reaps.
+ *
+ * The answer is that a reservation is ALREADY unnameable by every kill path, so
+ * retiring it costs no reaper anything. Three independent guards see to that,
+ * and each is there on purpose:
+ *
+ *  1. It carries `PENDING_PID` (0). `reapPersistedWorkerGroups` skips every
+ *     `pending` entry outright, before any liveness probe -- `kill(-0, ...)`
+ *     signals the CALLER's own process group, which is the daemon.
+ *  2. `readWorkerPidfile`, the reader every pid-consuming pass goes through,
+ *     FILTERS reservations out, so the untracked-lead sweep never sees one.
+ *  3. Even if it did, that sweep's `unverifiedReason` refuses to signal any
+ *     entry with no `startIdentity`, and a reservation has none.
+ *
+ * So retaining the row buys no kill capability. What retention DOES buy is the
+ * claim "we do not know" -- and once the reserving instance is gone that claim
+ * can never improve: nothing will ever write the pid, resolve the reservation or
+ * release it, so the session it names stays paralysed for good (session-health
+ * skips it `unprovable_process`, abandoned-merge recovery refuses to restore its
+ * worktree, and the worktree write signal answers `provable: false`). A detached
+ * lead that really did survive the window is equally unnameable whether the row
+ * is kept or dropped, because its pid was never written. No capability lost,
+ * permanent paralysis ended: that asymmetry is what makes `gone` correct here
+ * and not elsewhere.
+ *
+ * Note what this does NOT do: it never retires a reservation of a LIVE instance.
+ * `launchLeadProcess` refuses a spawn whose record could not be reserved, so
+ * deleting a running daemon's reservation would reopen the very pre-spawn window
+ * the reservation exists to close.
+ */
+export declare function isReservationInFlight(reservedBy: string | undefined, deps?: InstanceProbeDeps): boolean;
+//# sourceMappingURL=instance-liveness.d.ts.map

package/dist/shell/instance-liveness.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"instance-liveness.d.ts","sourceRoot":"","sources":["../../src/shell/instance-liveness.ts"],"names":[],"mappings":"AAgDA,yCAAyC;AACzC,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,qFAAqF;IACrF,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAQD;;;;GAIG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CAMzC;AAED,mFAAmF;AACnF,wBAAgB,0BAA0B,IAAI,IAAI,CAEjD;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,cAAc,GAAG,IAAI,CAY1F;AAED;;;;;;;;;;GAUG;AACH,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,YAAY,GAAG,MAAM,GAAG,SAAS,CAAC;AAE1E,qEAAqE;AACrE,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IACzC,iBAAiB,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;CACnD;AAED,qCAAqC;AACrC,wBAAgB,qBAAqB,IAAI,iBAAiB,CAOzD;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACrC,IAAI,EAAE,iBAAiB,GACtB,gBAAgB,CAsBlB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AACH,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,IAAI,GAAE,iBAA2C,GAChD,OAAO,CAoBT"}

package/dist/shell/instance-liveness.js

@@ -0,0 +1,205 @@
+// PINNED-BY-BEGIN (generated by gen:pinned-by -- do not hand-edit; checked by lint:pinned-by)
+// Pinned by: packages/daemon/src/shell/daemon-instance.test.ts,
+//   packages/daemon/src/shell/worker-pidfile.test.ts
+// PINNED-BY-END
+/**
+ * Daemon instance IDENTITY and its liveness -- the leaf half of
+ * shell/daemon-instance.ts.
+ *
+ * `daemon_hostname` answers "which machine", which is enough to keep one host's
+ * crash recovery off another host's live work. It is NOT enough to separate two
+ * daemon instances on the SAME host and product: to that scope they are the
+ * same owner, so one's recovery sweep would mark the other's running sessions
+ * failed. It is also not enough to answer the question recovery actually has to
+ * answer before it writes `failed` -- has the team this row represents actually
+ * stopped? -- because a hostname says nothing about liveness.
+ *
+ * An instance id is `<hostname>:<pid>:<startIdentity>`:
+ *
+ *  - `pid` is the daemon process, comparable on its own host.
+ *  - `startIdentity` is the kernel's start time for that pid (/proc stat field
+ *    22 on Linux). It makes the id PID-REUSE SAFE: a new process that happens
+ *    to land on a dead daemon's pid has a different start time, so it is not
+ *    mistaken for the instance that owned those rows.
+ *
+ * WHY THIS IS ITS OWN MODULE. It was the first half of `daemon-instance.ts`,
+ * which also holds the SESSION-process half and therefore imports
+ * `shell/worker-pidfile.ts` (`readLeadRecordsBySession`, `WorkerPidEntry`).
+ * That import is one-directional, so `worker-pidfile.ts` could not ask the
+ * identity question back -- and asking it is exactly what a reservation's
+ * `reservedBy` field needs (see {@link isReservationInFlight}). Splitting the
+ * identity half down here inverts nothing and duplicates nothing: this module's
+ * imports stop at node:os, the logger and the two process probes, none of which
+ * reach the pidfile.
+ *
+ * @module shell/instance-liveness
+ */
+import { hostname } from 'node:os';
+import { createLogger } from './log.js';
+import { isProcessAlive } from '../spawn/liveness.js';
+import { readProcessStartIdentity } from '../spawn/process-group-kill.js';
+// Kept so this module owns a logger of its own rather than borrowing one across
+// the split; the identity probes themselves are silent by design (they are read
+// in tight sweeps and their verdicts are logged by the callers that act on them).
+const log = createLogger({ module: 'instance-liveness' });
+/** Separator between instance-id parts. Hostnames cannot contain ':'. */
+const SEP = ':';
+/** Memoized so every read within one daemon run returns the same identity. */
+let cachedId = null;
+/**
+ * This daemon instance's id. Stamped onto every session it creates, onto every
+ * lead-record RESERVATION it makes, and the identity its own crash recovery
+ * compares against.
+ */
+export function daemonInstanceId() {
+    if (cachedId === null) {
+        const start = readProcessStartIdentity(process.pid);
+        cachedId = [hostname(), String(process.pid), start ?? 'unknown'].join(SEP);
+    }
+    return cachedId;
+}
+/** Reset the memo. Test seam only -- a daemon's identity never changes in life. */
+export function resetDaemonInstanceIdCache() {
+    cachedId = null;
+}
+/**
+ * Parse an instance id, or null when it is absent or malformed. A row written
+ * by a daemon predating this column parses to null and is treated as
+ * unattributable -- never as "gone".
+ */
+export function parseDaemonInstanceId(id) {
+    if (typeof id !== 'string' || id.length === 0)
+        return null;
+    const parts = id.split(SEP);
+    if (parts.length !== 3)
+        return null;
+    const [host, pidText, start] = parts;
+    if (!host || !pidText)
+        return null;
+    // STRICT: Number.parseInt('200junk') is 200, which would have us probe an
+    // unintended pid on the strength of a malformed id. Require all digits.
+    if (!/^[0-9]+$/.test(pidText))
+        return null;
+    const pid = Number.parseInt(pidText, 10);
+    if (!Number.isInteger(pid) || pid <= 0)
+        return null;
+    return { hostname: host, pid, startIdentity: start === 'unknown' ? null : (start ?? null) };
+}
+/** Real probes against this host. */
+export function defaultInstanceProbes() {
+    return {
+        selfId: daemonInstanceId(),
+        selfHostname: hostname(),
+        isProcessAlive,
+        readStartIdentity: readProcessStartIdentity,
+    };
+}
+/**
+ * Classify the instance that owns a session row.
+ *
+ * Every branch that is not `gone` leaves the row alone, because only `gone` is
+ * positive evidence that the team the row represents has stopped. Recovery
+ * would rather leave a stale row than falsify a live one: a stale `running` row
+ * is visible and self-correcting on the next sweep, whereas a live session
+ * marked `failed` silently tells every reader -- including "is this worktree
+ * being written?" -- that a running team is not there.
+ */
+export function classifyOwningInstance(instanceId, deps) {
+    if (instanceId === deps.selfId)
+        return 'self';
+    const parsed = parseDaemonInstanceId(instanceId);
+    if (parsed === null)
+        return 'unknown';
+    // A pid from another machine is not a pid we can probe. The host scope should
+    // already have excluded it; if one arrives anyway, it is unknown, not gone.
+    if (parsed.hostname !== deps.selfHostname)
+        return 'unknown';
+    if (!deps.isProcessAlive(parsed.pid))
+        return 'gone';
+    // The pid is alive -- but is it the SAME process, or a reused pid? A start
+    // identity that disagrees means the original instance died and its pid was
+    // recycled, so the owner IS gone.
+    const liveStart = deps.readStartIdentity(parsed.pid);
+    if (parsed.startIdentity !== null && liveStart !== null && parsed.startIdentity !== liveStart) {
+        return 'gone';
+    }
+    // Alive, and nothing contradicts that it is the owner. Leave it.
+    return 'peer_alive';
+}
+/**
+ * Is a lead-record RESERVATION still in flight?
+ *
+ * This is the ONE definition of the rule `reserveLeadRecord` has stated in a
+ * comment since the field was added: "a reservation is 'in flight' only while
+ * the instance that made it is still running; once that instance is provably
+ * gone nothing will ever resolve it, and it must not hold a worktree open
+ * forever." Two judgements read it -- the retention filter
+ * (`recordedLeadStillRunning`, so the reap and boot passes retire a stranded
+ * reservation) and the session verdict (`classifyRecordedProcess`, so a live
+ * daemon's sweeps stop answering `unprovable` about it forever) -- and both
+ * reach it through an injectable dep defaulting here, so there is no second
+ * copy of the rule to drift.
+ *
+ * DIRECTION OF FAILURE. Absent or empty `reservedBy` is IN FLIGHT. A reservation
+ * written by a daemon predating the field names nobody, and retiring a record on
+ * a guess is the one move this module refuses everywhere: unattributable is not
+ * gone. Of the four classifications only `gone` retires; `self`, `peer_alive`
+ * and `unknown` (a malformed id, or an id from a host whose pids we cannot
+ * probe) all read as in flight.
+ *
+ * THE OBJECTION, AND WHY `gone` IS NEVERTHELESS THE RIGHT VERDICT.
+ * `docs/DECISIONS.md` (2026-09-21) records the consideration this
+ * implementation has to answer: expiring a reservation because its reserving
+ * instance is gone converts "unprovable" into "nothing was spawned", which is
+ * the inference this module refuses everywhere else -- a lead is spawned
+ * DETACHED and can outlive the daemon that reserved it, and dropping its only
+ * record would make it unnameable by the force-stop and next-boot reaps.
+ *
+ * The answer is that a reservation is ALREADY unnameable by every kill path, so
+ * retiring it costs no reaper anything. Three independent guards see to that,
+ * and each is there on purpose:
+ *
+ *  1. It carries `PENDING_PID` (0). `reapPersistedWorkerGroups` skips every
+ *     `pending` entry outright, before any liveness probe -- `kill(-0, ...)`
+ *     signals the CALLER's own process group, which is the daemon.
+ *  2. `readWorkerPidfile`, the reader every pid-consuming pass goes through,
+ *     FILTERS reservations out, so the untracked-lead sweep never sees one.
+ *  3. Even if it did, that sweep's `unverifiedReason` refuses to signal any
+ *     entry with no `startIdentity`, and a reservation has none.
+ *
+ * So retaining the row buys no kill capability. What retention DOES buy is the
+ * claim "we do not know" -- and once the reserving instance is gone that claim
+ * can never improve: nothing will ever write the pid, resolve the reservation or
+ * release it, so the session it names stays paralysed for good (session-health
+ * skips it `unprovable_process`, abandoned-merge recovery refuses to restore its
+ * worktree, and the worktree write signal answers `provable: false`). A detached
+ * lead that really did survive the window is equally unnameable whether the row
+ * is kept or dropped, because its pid was never written. No capability lost,
+ * permanent paralysis ended: that asymmetry is what makes `gone` correct here
+ * and not elsewhere.
+ *
+ * Note what this does NOT do: it never retires a reservation of a LIVE instance.
+ * `launchLeadProcess` refuses a spawn whose record could not be reserved, so
+ * deleting a running daemon's reservation would reopen the very pre-spawn window
+ * the reservation exists to close.
+ */
+export function isReservationInFlight(reservedBy, deps = defaultInstanceProbes()) {
+    if (reservedBy === undefined || reservedBy.length === 0) {
+        // Unattributable. Nothing to probe, so nothing is proved -- keep it.
+        //
+        // Deliberately EXPLICIT even though it is redundant by construction:
+        // `classifyOwningInstance` would also answer 'unknown' here (an absent or
+        // empty id parses to null). Stating it at the site the rule is about means
+        // the safe direction for the field this function exists to read does not
+        // depend on how the parser happens to treat an empty string.
+        return true;
+    }
+    const owner = classifyOwningInstance(reservedBy, deps);
+    if (owner === 'gone') {
+        log.info(`[instance-liveness] reservation made by ${reservedBy} is stranded -- ` +
+            'that daemon instance is provably gone, so nothing will ever resolve it');
+        return false;
+    }
+    return true;
+}
+//# sourceMappingURL=instance-liveness.js.map

package/dist/shell/instance-liveness.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"instance-liveness.js","sourceRoot":"","sources":["../../src/shell/instance-liveness.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,gEAAgE;AAChE,qDAAqD;AACrD,gBAAgB;AAEhB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxC,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AAE1E,gFAAgF;AAChF,gFAAgF;AAChF,kFAAkF;AAClF,MAAM,GAAG,GAAG,YAAY,CAAC,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC;AAU1D,yEAAyE;AACzE,MAAM,GAAG,GAAG,GAAG,CAAC;AAEhB,8EAA8E;AAC9E,IAAI,QAAQ,GAAkB,IAAI,CAAC;AAEnC;;;;GAIG;AACH,MAAM,UAAU,gBAAgB;IAC9B,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,wBAAwB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACpD,QAAQ,GAAG,CAAC,QAAQ,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,KAAK,IAAI,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,0BAA0B;IACxC,QAAQ,GAAG,IAAI,CAAC;AAClB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,EAA6B;IACjE,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3D,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,GAAG,KAAK,CAAC;IACrC,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IACnC,0EAA0E;IAC1E,wEAAwE;IACxE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,aAAa,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,EAAE,CAAC;AAC9F,CAAC;AAuBD,qCAAqC;AACrC,MAAM,UAAU,qBAAqB;IACnC,OAAO;QACL,MAAM,EAAE,gBAAgB,EAAE;QAC1B,YAAY,EAAE,QAAQ,EAAE;QACxB,cAAc;QACd,iBAAiB,EAAE,wBAAwB;KAC5C,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CACpC,UAAqC,EACrC,IAAuB;IAEvB,IAAI,UAAU,KAAK,IAAI,CAAC,MAAM;QAAE,OAAO,MAAM,CAAC;IAE9C,MAAM,MAAM,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC;IACjD,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAEtC,8EAA8E;IAC9E,4EAA4E;IAC5E,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,CAAC,YAAY;QAAE,OAAO,SAAS,CAAC;IAE5D,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC;IAEpD,2EAA2E;IAC3E,2EAA2E;IAC3E,kCAAkC;IAClC,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACrD,IAAI,MAAM,CAAC,aAAa,KAAK,IAAI,IAAI,SAAS,KAAK,IAAI,IAAI,MAAM,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QAC9F,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,iEAAiE;IACjE,OAAO,YAAY,CAAC;AACtB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AACH,MAAM,UAAU,qBAAqB,CACnC,UAA8B,EAC9B,OAA0B,qBAAqB,EAAE;IAEjD,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxD,qEAAqE;QACrE,EAAE;QACF,qEAAqE;QACrE,0EAA0E;QAC1E,2EAA2E;QAC3E,yEAAyE;QACzE,6DAA6D;QAC7D,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,KAAK,GAAG,sBAAsB,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IACvD,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QACrB,GAAG,CAAC,IAAI,CACN,2CAA2C,UAAU,kBAAkB;YACvE,wEAAwE,CACzE,CAAC;QACF,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/shell/schema-version-gate.d.ts

@@ -9,6 +9,16 @@ export interface SchemaGateResult {
     applied: string[];
     /** Expected ∖ applied after the final ledger read. Empty when ok. */
     missing: string[];
+    /**
+     * Applied ∖ expected after the final ledger read: migrations the LIVE DB
+     * carries that this daemon build does not know about -- i.e. this daemon is
+     * OLDER than the schema it is about to arm against.
+     *
+     * Reported and recorded, never gated on: see the "IT IS A REPORT, NOT A
+     * GATE" note in the module header. A non-empty value leaves `ok`,
+     * `classification` and `attempts` untouched.
+     */
+    unknownApplied: string[];
     ok: boolean;
     /**
      * Classification of the initial missing set:
@@ -90,6 +100,16 @@ export declare function parseMigrationTimestamp(version: string): number;
  * or an unparseable timestamp), which cannot be a recoverable deploy tail.
  */
 export declare function classifyMissing(missing: string[], applied: string[], cfg: TransientToleranceConfig): Exclude<GapClassification, 'ok'>;
+/**
+ * The reverse set: `applied` ∖ `expected` -- migration versions the live DB
+ * carries that this daemon build does not know about. Preserves the ledger's
+ * own order so the newest unknown versions read last, as they do in the
+ * ledger.
+ *
+ * Exported so the reverse direction is testable on its own, and so a later
+ * caller can ask the question without re-deriving the set difference.
+ */
+export declare function computeUnknownApplied(expected: string[], applied: string[]): string[];
 export interface CheckSchemaVersionDeps {
     mode?: SchemaGateMode;
     getExpected?: () => string[];
@@ -104,5 +124,7 @@ export interface CheckSchemaVersionDeps {
     log?: (msg: string) => void;
 }
 export declare function checkSchemaVersion(deps?: CheckSchemaVersionDeps): Promise<SchemaGateResult>;
+/** Health-event code for "this daemon is older than the schema it arms against". */
+export declare const DAEMON_BEHIND_DB_CODE = "schema.daemon_behind_db";
 export declare function reportSchemaGateResult(result: SchemaGateResult): void;
 //# sourceMappingURL=schema-version-gate.d.ts.map

package/dist/shell/schema-version-gate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema-version-gate.d.ts","sourceRoot":"","sources":["../../src/shell/schema-version-gate.ts"],"names":[],"mappings":"AA0CA,MAAM,MAAM,cAAc,GAAG,WAAW,GAAG,MAAM,GAAG,KAAK,CAAC;AAE1D,sEAAsE;AACtE,MAAM,MAAM,iBAAiB,GAAG,IAAI,GAAG,WAAW,GAAG,OAAO,CAAC;AAE7D,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,cAAc,CAAC;IACrB,+EAA+E;IAC/E,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,uEAAuE;IACvE,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,qEAAqE;IACrE,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,EAAE,EAAE,OAAO,CAAC;IACZ;;;;;;;OAOG;IACH,cAAc,EAAE,iBAAiB,CAAC;IAClC,6EAA6E;IAC7E,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,cAAc,CAO1F;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAItD;AAMD;;;GAGG;AACH,MAAM,WAAW,wBAAwB;IACvC,6EAA6E;IAC7E,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;;OAMG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB,wEAAwE;IACxE,cAAc,EAAE,MAAM,CAAC;IACvB,8DAA8D;IAC9D,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,eAAO,MAAM,2BAA2B,EAAE,wBAKzC,CAAC;AAMF;;;;;;;;;GASG;AACH,wBAAgB,+BAA+B,CAC7C,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,wBAAwB,CAQ1B;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAK/D;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,MAAM,EAAE,EACjB,OAAO,EAAE,MAAM,EAAE,EACjB,GAAG,EAAE,wBAAwB,GAC5B,OAAO,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAclC;AASD,MAAM,WAAW,sBAAsB;IACrC,IAAI,CAAC,EAAE,cAAc,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,MAAM,EAAE,CAAC;IAC7B,UAAU,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACrC,iEAAiE;IACjE,kBAAkB,CAAC,EAAE,wBAAwB,CAAC;IAC9C,wDAAwD;IACxD,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,+DAA+D;IAC/D,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,wEAAwE;IACxE,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B;AAED,wBAAsB,kBAAkB,CAAC,IAAI,GAAE,sBAA2B,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAgErG;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,gBAAgB,GAAG,IAAI,CA8BrE"}
+{"version":3,"file":"schema-version-gate.d.ts","sourceRoot":"","sources":["../../src/shell/schema-version-gate.ts"],"names":[],"mappings":"AA4DA,MAAM,MAAM,cAAc,GAAG,WAAW,GAAG,MAAM,GAAG,KAAK,CAAC;AAE1D,sEAAsE;AACtE,MAAM,MAAM,iBAAiB,GAAG,IAAI,GAAG,WAAW,GAAG,OAAO,CAAC;AAE7D,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,cAAc,CAAC;IACrB,+EAA+E;IAC/E,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,uEAAuE;IACvE,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,qEAAqE;IACrE,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB;;;;;;;;OAQG;IACH,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,EAAE,EAAE,OAAO,CAAC;IACZ;;;;;;;OAOG;IACH,cAAc,EAAE,iBAAiB,CAAC;IAClC,6EAA6E;IAC7E,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,cAAc,CAO1F;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAItD;AAMD;;;GAGG;AACH,MAAM,WAAW,wBAAwB;IACvC,6EAA6E;IAC7E,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;;OAMG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB,wEAAwE;IACxE,cAAc,EAAE,MAAM,CAAC;IACvB,8DAA8D;IAC9D,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,eAAO,MAAM,2BAA2B,EAAE,wBAKzC,CAAC;AAMF;;;;;;;;;GASG;AACH,wBAAgB,+BAA+B,CAC7C,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,wBAAwB,CAQ1B;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAK/D;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,MAAM,EAAE,EACjB,OAAO,EAAE,MAAM,EAAE,EACjB,GAAG,EAAE,wBAAwB,GAC5B,OAAO,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAclC;AAOD;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAGrF;AAID,MAAM,WAAW,sBAAsB;IACrC,IAAI,CAAC,EAAE,cAAc,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,MAAM,EAAE,CAAC;IAC7B,UAAU,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACrC,iEAAiE;IACjE,kBAAkB,CAAC,EAAE,wBAAwB,CAAC;IAC9C,wDAAwD;IACxD,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,+DAA+D;IAC/D,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,wEAAwE;IACxE,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B;AAED,wBAAsB,kBAAkB,CAAC,IAAI,GAAE,sBAA2B,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAuFrG;AAED,oFAAoF;AACpF,eAAO,MAAM,qBAAqB,4BAA4B,CAAC;AA4D/D,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,gBAAgB,GAAG,IAAI,CA+BrE"}