@telora/daemon 0.22.239 → 0.22.289

package/dist/daemon-state/instance-liveness.d.ts

@@ -0,0 +1,89 @@
+/**
+ * What a session row's owning instance is doing now.
+ *
+ * - `self`        -- this daemon owns it. Never reap: the team is ours and live.
+ * - `peer_alive`  -- another daemon instance on this host is still running. Its
+ *                    sessions are its business; reaping them is the defect.
+ * - `gone`        -- the owning instance is not running. Its teams stopped with
+ *                    it, so its rows are safe to close.
+ * - `unknown`     -- no id, a malformed id, or an id from another host whose pid
+ *                    we cannot probe. FAILS SAFE: not reaped.
+ */
+export type InstanceLiveness = 'self' | 'peer_alive' | 'gone' | 'unknown';
+/** Probes `classifyOwningInstance` reaches. The host binding is built at the composition root (composition/execution-process-context.ts). */
+export interface InstanceProbeDeps {
+    selfId: string;
+    selfHostname: string;
+    isProcessAlive: (pid: number) => boolean;
+    readStartIdentity: (pid: number) => string | null;
+}
+/**
+ * Classify the instance that owns a session row.
+ *
+ * Every branch that is not `gone` leaves the row alone, because only `gone` is
+ * positive evidence that the team the row represents has stopped. Recovery
+ * would rather leave a stale row than falsify a live one: a stale `running` row
+ * is visible and self-correcting on the next sweep, whereas a live session
+ * marked `failed` silently tells every reader -- including "is this worktree
+ * being written?" -- that a running team is not there.
+ */
+export declare function classifyOwningInstance(instanceId: string | null | undefined, deps: InstanceProbeDeps): InstanceLiveness;
+/**
+ * Is a lead-record RESERVATION still in flight?
+ *
+ * This is the ONE definition of the rule `reserveLeadRecord` has stated in a
+ * comment since the field was added: "a reservation is 'in flight' only while
+ * the instance that made it is still running; once that instance is provably
+ * gone nothing will ever resolve it, and it must not hold a worktree open
+ * forever." Two judgements read it -- the retention filter
+ * (`recordedLeadStillRunning`, so the reap and boot passes retire a stranded
+ * reservation) and the session verdict (`classifyRecordedProcess`, so a live
+ * daemon's sweeps stop answering `unprovable` about it forever) -- and both
+ * reach it through an injectable dep defaulting here, so there is no second
+ * copy of the rule to drift.
+ *
+ * DIRECTION OF FAILURE. Absent or empty `reservedBy` is IN FLIGHT. A reservation
+ * written by a daemon predating the field names nobody, and retiring a record on
+ * a guess is the one move this module refuses everywhere: unattributable is not
+ * gone. Of the four classifications only `gone` retires; `self`, `peer_alive`
+ * and `unknown` (a malformed id, or an id from a host whose pids we cannot
+ * probe) all read as in flight.
+ *
+ * THE OBJECTION, AND WHY `gone` IS NEVERTHELESS THE RIGHT VERDICT.
+ * `docs/DECISIONS.md` (2026-09-21) records the consideration this
+ * implementation has to answer: expiring a reservation because its reserving
+ * instance is gone converts "unprovable" into "nothing was spawned", which is
+ * the inference this module refuses everywhere else -- a lead is spawned
+ * DETACHED and can outlive the daemon that reserved it, and dropping its only
+ * record would make it unnameable by the force-stop and next-boot reaps.
+ *
+ * The answer is that a reservation is ALREADY unnameable by every kill path, so
+ * retiring it costs no reaper anything. Three independent guards see to that,
+ * and each is there on purpose:
+ *
+ *  1. It carries `PENDING_PID` (0). `reapPersistedWorkerGroups` skips every
+ *     `pending` entry outright, before any liveness probe -- `kill(-0, ...)`
+ *     signals the CALLER's own process group, which is the daemon.
+ *  2. `readWorkerPidfile`, the reader every pid-consuming pass goes through,
+ *     FILTERS reservations out, so the untracked-lead sweep never sees one.
+ *  3. Even if it did, that sweep's `unverifiedReason` refuses to signal any
+ *     entry with no `startIdentity`, and a reservation has none.
+ *
+ * So retaining the row buys no kill capability. What retention DOES buy is the
+ * claim "we do not know" -- and once the reserving instance is gone that claim
+ * can never improve: nothing will ever write the pid, resolve the reservation or
+ * release it, so the session it names stays paralysed for good (session-health
+ * skips it `unprovable_process`, abandoned-merge recovery refuses to restore its
+ * worktree, and the worktree write signal answers `provable: false`). A detached
+ * lead that really did survive the window is equally unnameable whether the row
+ * is kept or dropped, because its pid was never written. No capability lost,
+ * permanent paralysis ended: that asymmetry is what makes `gone` correct here
+ * and not elsewhere.
+ *
+ * Note what this does NOT do: it never retires a reservation of a LIVE instance.
+ * `launchLeadProcess` refuses a spawn whose record could not be reserved, so
+ * deleting a running daemon's reservation would reopen the very pre-spawn window
+ * the reservation exists to close.
+ */
+export declare function isReservationInFlight(reservedBy: string | undefined, deps: InstanceProbeDeps): boolean;
+//# sourceMappingURL=instance-liveness.d.ts.map

package/dist/daemon-state/instance-liveness.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"instance-liveness.d.ts","sourceRoot":"","sources":["../../src/daemon-state/instance-liveness.ts"],"names":[],"mappings":"AA2CA;;;;;;;;;;GAUG;AACH,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,YAAY,GAAG,MAAM,GAAG,SAAS,CAAC;AAE1E,6IAA6I;AAC7I,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IACzC,iBAAiB,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;CACnD;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACrC,IAAI,EAAE,iBAAiB,GACtB,gBAAgB,CAsBlB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AACH,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAoBT"}

package/dist/daemon-state/instance-liveness.js

@@ -0,0 +1,148 @@
+// PINNED-BY-BEGIN (generated by gen:pinned-by -- do not hand-edit; checked by lint:pinned-by)
+// Pinned by: packages/daemon/src/daemon-state/daemon-instance.test.ts,
+//   packages/daemon/src/focus/crash-recovery-session-scope.test.ts
+// PINNED-BY-END
+/**
+ * Daemon instance LIVENESS -- the leaf half of daemon-state/daemon-instance.ts.
+ *
+ * `daemon_hostname` answers "which machine", which is enough to keep one host's
+ * crash recovery off another host's live work. It is NOT enough to separate two
+ * daemon instances on the SAME host and product: to that scope they are the
+ * same owner, so one's recovery sweep would mark the other's running sessions
+ * failed. It is also not enough to answer the question recovery actually has to
+ * answer before it writes `failed` -- has the team this row represents actually
+ * stopped? -- because a hostname says nothing about liveness.
+ *
+ * The instance id itself (`<hostname>:<pid>:<startIdentity>`, pid-reuse safe)
+ * is named and parsed in daemon-state/process-identity.ts; this module asks
+ * whether the instance behind an id is still running.
+ *
+ * WHY THIS IS ITS OWN MODULE. `daemon-instance.ts` holds the SESSION-process
+ * half and therefore imports `daemon-state/worker-pidfile.ts`
+ * (`readLeadRecordsBySession`, `WorkerPidEntry`). That import is
+ * one-directional, so `worker-pidfile.ts` could not ask the liveness question
+ * back from there -- and asking it is exactly what a reservation's
+ * `reservedBy` field needs (see {@link isReservationInFlight}). Keeping the
+ * liveness half down here inverts nothing and duplicates nothing: this module's
+ * imports stop at the logger and the identity module, neither of which reaches
+ * the pidfile.
+ *
+ * History: docs/daemon/history-team-lifecycle.md (daemon-state/instance-liveness.ts).
+ *
+ * @module daemon-state/instance-liveness
+ */
+import { createLogger } from '../log/daemon-log.js';
+import { parseDaemonInstanceId } from './process-identity.js';
+// Kept so this module owns a logger of its own rather than borrowing one across
+// the split; the identity probes themselves are silent by design (they are read
+// in tight sweeps and their verdicts are logged by the callers that act on them).
+const log = createLogger({ module: 'instance-liveness' });
+/**
+ * Classify the instance that owns a session row.
+ *
+ * Every branch that is not `gone` leaves the row alone, because only `gone` is
+ * positive evidence that the team the row represents has stopped. Recovery
+ * would rather leave a stale row than falsify a live one: a stale `running` row
+ * is visible and self-correcting on the next sweep, whereas a live session
+ * marked `failed` silently tells every reader -- including "is this worktree
+ * being written?" -- that a running team is not there.
+ */
+export function classifyOwningInstance(instanceId, deps) {
+    if (instanceId === deps.selfId)
+        return 'self';
+    const parsed = parseDaemonInstanceId(instanceId);
+    if (parsed === null)
+        return 'unknown';
+    // A pid from another machine is not a pid we can probe. The host scope should
+    // already have excluded it; if one arrives anyway, it is unknown, not gone.
+    if (parsed.hostname !== deps.selfHostname)
+        return 'unknown';
+    if (!deps.isProcessAlive(parsed.pid))
+        return 'gone';
+    // The pid is alive -- but is it the SAME process, or a reused pid? A start
+    // identity that disagrees means the original instance died and its pid was
+    // recycled, so the owner IS gone.
+    const liveStart = deps.readStartIdentity(parsed.pid);
+    if (parsed.startIdentity !== null && liveStart !== null && parsed.startIdentity !== liveStart) {
+        return 'gone';
+    }
+    // Alive, and nothing contradicts that it is the owner. Leave it.
+    return 'peer_alive';
+}
+/**
+ * Is a lead-record RESERVATION still in flight?
+ *
+ * This is the ONE definition of the rule `reserveLeadRecord` has stated in a
+ * comment since the field was added: "a reservation is 'in flight' only while
+ * the instance that made it is still running; once that instance is provably
+ * gone nothing will ever resolve it, and it must not hold a worktree open
+ * forever." Two judgements read it -- the retention filter
+ * (`recordedLeadStillRunning`, so the reap and boot passes retire a stranded
+ * reservation) and the session verdict (`classifyRecordedProcess`, so a live
+ * daemon's sweeps stop answering `unprovable` about it forever) -- and both
+ * reach it through an injectable dep defaulting here, so there is no second
+ * copy of the rule to drift.
+ *
+ * DIRECTION OF FAILURE. Absent or empty `reservedBy` is IN FLIGHT. A reservation
+ * written by a daemon predating the field names nobody, and retiring a record on
+ * a guess is the one move this module refuses everywhere: unattributable is not
+ * gone. Of the four classifications only `gone` retires; `self`, `peer_alive`
+ * and `unknown` (a malformed id, or an id from a host whose pids we cannot
+ * probe) all read as in flight.
+ *
+ * THE OBJECTION, AND WHY `gone` IS NEVERTHELESS THE RIGHT VERDICT.
+ * `docs/DECISIONS.md` (2026-09-21) records the consideration this
+ * implementation has to answer: expiring a reservation because its reserving
+ * instance is gone converts "unprovable" into "nothing was spawned", which is
+ * the inference this module refuses everywhere else -- a lead is spawned
+ * DETACHED and can outlive the daemon that reserved it, and dropping its only
+ * record would make it unnameable by the force-stop and next-boot reaps.
+ *
+ * The answer is that a reservation is ALREADY unnameable by every kill path, so
+ * retiring it costs no reaper anything. Three independent guards see to that,
+ * and each is there on purpose:
+ *
+ *  1. It carries `PENDING_PID` (0). `reapPersistedWorkerGroups` skips every
+ *     `pending` entry outright, before any liveness probe -- `kill(-0, ...)`
+ *     signals the CALLER's own process group, which is the daemon.
+ *  2. `readWorkerPidfile`, the reader every pid-consuming pass goes through,
+ *     FILTERS reservations out, so the untracked-lead sweep never sees one.
+ *  3. Even if it did, that sweep's `unverifiedReason` refuses to signal any
+ *     entry with no `startIdentity`, and a reservation has none.
+ *
+ * So retaining the row buys no kill capability. What retention DOES buy is the
+ * claim "we do not know" -- and once the reserving instance is gone that claim
+ * can never improve: nothing will ever write the pid, resolve the reservation or
+ * release it, so the session it names stays paralysed for good (session-health
+ * skips it `unprovable_process`, abandoned-merge recovery refuses to restore its
+ * worktree, and the worktree write signal answers `provable: false`). A detached
+ * lead that really did survive the window is equally unnameable whether the row
+ * is kept or dropped, because its pid was never written. No capability lost,
+ * permanent paralysis ended: that asymmetry is what makes `gone` correct here
+ * and not elsewhere.
+ *
+ * Note what this does NOT do: it never retires a reservation of a LIVE instance.
+ * `launchLeadProcess` refuses a spawn whose record could not be reserved, so
+ * deleting a running daemon's reservation would reopen the very pre-spawn window
+ * the reservation exists to close.
+ */
+export function isReservationInFlight(reservedBy, deps) {
+    if (reservedBy === undefined || reservedBy.length === 0) {
+        // Unattributable. Nothing to probe, so nothing is proved -- keep it.
+        //
+        // Deliberately EXPLICIT even though it is redundant by construction:
+        // `classifyOwningInstance` would also answer 'unknown' here (an absent or
+        // empty id parses to null). Stating it at the site the rule is about means
+        // the safe direction for the field this function exists to read does not
+        // depend on how the parser happens to treat an empty string.
+        return true;
+    }
+    const owner = classifyOwningInstance(reservedBy, deps);
+    if (owner === 'gone') {
+        log.info(`[instance-liveness] reservation made by ${reservedBy} is stranded -- ` +
+            'that daemon instance is provably gone, so nothing will ever resolve it');
+        return false;
+    }
+    return true;
+}
+//# sourceMappingURL=instance-liveness.js.map

package/dist/daemon-state/instance-liveness.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"instance-liveness.js","sourceRoot":"","sources":["../../src/daemon-state/instance-liveness.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,uEAAuE;AACvE,mEAAmE;AACnE,gBAAgB;AAEhB;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAE9D,gFAAgF;AAChF,gFAAgF;AAChF,kFAAkF;AAClF,MAAM,GAAG,GAAG,YAAY,CAAC,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC;AAuB1D;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CACpC,UAAqC,EACrC,IAAuB;IAEvB,IAAI,UAAU,KAAK,IAAI,CAAC,MAAM;QAAE,OAAO,MAAM,CAAC;IAE9C,MAAM,MAAM,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC;IACjD,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAEtC,8EAA8E;IAC9E,4EAA4E;IAC5E,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,CAAC,YAAY;QAAE,OAAO,SAAS,CAAC;IAE5D,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC;IAEpD,2EAA2E;IAC3E,2EAA2E;IAC3E,kCAAkC;IAClC,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACrD,IAAI,MAAM,CAAC,aAAa,KAAK,IAAI,IAAI,SAAS,KAAK,IAAI,IAAI,MAAM,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QAC9F,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,iEAAiE;IACjE,OAAO,YAAY,CAAC;AACtB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AACH,MAAM,UAAU,qBAAqB,CACnC,UAA8B,EAC9B,IAAuB;IAEvB,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxD,qEAAqE;QACrE,EAAE;QACF,qEAAqE;QACrE,0EAA0E;QAC1E,2EAA2E;QAC3E,yEAAyE;QACzE,6DAA6D;QAC7D,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,KAAK,GAAG,sBAAsB,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IACvD,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QACrB,GAAG,CAAC,IAAI,CACN,2CAA2C,UAAU,kBAAkB;YACvE,wEAAwE,CACzE,CAAC;QACF,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/daemon-state/intake-control.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"intake-control.d.ts","sourceRoot":"","sources":["../../src/daemon-state/intake-control.ts"],"names":[],"mappings":"AA4BA;;;GAGG;AACH,wBAAgB,iBAAiB,IAAI,IAAI,CAOxC;AAED,kFAAkF;AAClF,wBAAgB,qBAAqB,IAAI,IAAI,CAI5C;AAED,kEAAkE;AAClE,wBAAgB,gBAAgB,IAAI,OAAO,CAE1C;AAED,0CAA0C;AAC1C,wBAAgB,8BAA8B,IAAI,IAAI,CAErD"}

package/dist/daemon-state/intake-control.js

@@ -0,0 +1,50 @@
+// PINNED-BY-BEGIN (generated by gen:pinned-by -- do not hand-edit; checked by lint:pinned-by)
+// Pinned by: packages/daemon/src/daemon-state/intake-control.test.ts,
+//   packages/daemon/src/focus/heartbeat-draining-status.test.ts
+// PINNED-BY-END
+import { createLogger } from '../log/daemon-log.js';
+const log = createLogger({ module: 'auto-update' });
+/**
+ * Intake control for safe-seam auto-update.
+ *
+ * When a newer version has been pending past a staleness threshold while the
+ * daemon stays continuously busy (delivery C), the updater DRAINS intake: it
+ * stops accepting new focus teams so the current batch becomes the safe seam.
+ * In-flight work is never killed -- the running team finishes, and the resulting
+ * batch boundary lets the pending update apply.
+ *
+ * This is a tiny shared flag module so the auto-update controller (which arms
+ * the drain) and the focus poller (which gates new spawns on it) do not import each
+ * other -- avoiding an import cycle.
+ *
+ * The flag affects ONLY new-focus intake; it never aborts a running team and is
+ * a no-op for the routine (idle) update path.
+ */
+let draining = false;
+/**
+ * Arm the drain: new focus teams stop being spawned. Idempotent. Logs once on
+ * the false->true transition so the operator sees the seam being created.
+ */
+export function armDrainForUpdate() {
+    if (draining)
+        return;
+    draining = true;
+    log.info('[auto-update] Draining intake for a pending update: no new focus teams will spawn; ' +
+        'the update applies at the next batch boundary (in-flight work is not interrupted).');
+}
+/** Release the drain: normal intake resumes. Idempotent. Logs once on release. */
+export function releaseDrainForUpdate() {
+    if (!draining)
+        return;
+    draining = false;
+    log.info('Intake drain released; normal focus intake resumed.');
+}
+/** True when intake is currently drained for a pending update. */
+export function isIntakeDraining() {
+    return draining;
+}
+/** Test-only reset of the module flag. */
+export function __resetIntakeControlForTesting() {
+    draining = false;
+}
+//# sourceMappingURL=intake-control.js.map

package/dist/daemon-state/intake-control.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"intake-control.js","sourceRoot":"","sources":["../../src/daemon-state/intake-control.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,sEAAsE;AACtE,gEAAgE;AAChE,gBAAgB;AAGhB,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEpD,MAAM,GAAG,GAAG,YAAY,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;AACpD;;;;;;;;;;;;;;;GAeG;AAEH,IAAI,QAAQ,GAAG,KAAK,CAAC;AAErB;;;GAGG;AACH,MAAM,UAAU,iBAAiB;IAC/B,IAAI,QAAQ;QAAE,OAAO;IACrB,QAAQ,GAAG,IAAI,CAAC;IAChB,GAAG,CAAC,IAAI,CACN,qFAAqF;QACnF,oFAAoF,CACvF,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,qBAAqB;IACnC,IAAI,CAAC,QAAQ;QAAE,OAAO;IACtB,QAAQ,GAAG,KAAK,CAAC;IACjB,GAAG,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAC;AAClE,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,gBAAgB;IAC9B,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,0CAA0C;AAC1C,MAAM,UAAU,8BAA8B;IAC5C,QAAQ,GAAG,KAAK,CAAC;AACnB,CAAC"}

package/dist/daemon-state/lead-process-ownership.d.ts

@@ -0,0 +1,108 @@
+/**
+ * Which agent processes this daemon owns, and ending the ones no team does.
+ *
+ * Every team lead the daemon spawns is recorded -- pid, process group (== pid,
+ * the lead is spawned detached), start identity, focus and session -- both on
+ * its FocusTeamState and in the persisted worker pidfile (daemon-state/worker-pidfile).
+ * The running daemon reads that record, not only the boot reap and
+ * `stop --force`, so it can:
+ *
+ *   - end a team's whole process group at cleanup (`ensureTeamProcessGroupGone`),
+ *   - verify a recorded pid still names the process it spawned, and
+ *   - (spawn/untracked-lead-sweep.ts) end a focus's previous lead before a new
+ *     spawn supersedes it, and any live lead it spawned that no team tracks.
+ *
+ * A recorded pid is signalled only when its identity is verified: the live
+ * process's start identity equals the one recorded at spawn. A pid that was
+ * reused by an unrelated process, or an entry with no recorded identity, is
+ * never signalled. A lead that has already exited is safe to group-signal: the
+ * kernel does not reuse a pid while a process group of that id still has
+ * members, so a live group with that id is the lead's own stragglers.
+ *
+ * Owner of a team's `leadProcess` sub-record (types/focus-team-state.ts,
+ * TEAM_STATE_OWNERS): leadPid, leadStartIdentity, leadStdin and mcpProxy are
+ * written only here, through the writers below.
+ */
+import type { ChildProcess } from 'node:child_process';
+import type { Writable } from 'node:stream';
+import type { FocusTeamState } from '../types/index.js';
+import type { CodexMcpProxyHandle } from '../types/codex-mcp-proxy.js';
+import type { WorkerPidEntry } from './worker-pidfile.js';
+import { type ProcessGroupKillOptions, type ProcessGroupKillResult } from './process-group-kill.js';
+/**
+ * The ownership passes' collaborators: the pidfile record IO, the tracked-pid
+ * and start-identity reads, the group probe, the kill ladder and the clock. Every
+ * one is bound at the composition root (composition/execution-process-context.ts
+ * buildLeadOwnershipDeps); a test passes its own.
+ */
+export interface LeadOwnershipDeps {
+    readEntries: () => WorkerPidEntry[];
+    /** Persist one ownership record. */
+    recordEntry: (entry: WorkerPidEntry) => boolean;
+    removeEntry: (pid: number) => void;
+    /** Pids a live team or one-shot worker currently owns. */
+    trackedPids: () => Set<number>;
+    readStartIdentity: (pid: number) => string | null;
+    /** True while any non-zombie member of the group is alive. */
+    isGroupAlive: (pgid: number) => boolean;
+    terminate: (pgid: number, opts: ProcessGroupKillOptions) => Promise<ProcessGroupKillResult>;
+    now: () => number;
+    /** SIGTERM-to-SIGKILL grace for the team-cleanup kill. Defaults to PROCESS_GROUP_GRACE_MS. */
+    graceMs?: number;
+}
+/** Every pid a live team (lead) or registered one-shot worker owns right now. */
+export declare function currentlyTrackedPids(): Set<number>;
+/** Attach a freshly spawned lead's pid and stdin to its team. */
+export declare function attachLeadProcess(team: FocusTeamState, lead: {
+    pid: number | null;
+    stdin: Writable | null;
+}): void;
+/** Drop the team's handle on its lead's stdin (closed, or the lead exited). */
+export declare function detachLeadStdin(team: FocusTeamState): void;
+/** Attach (or clear, with null) the local-model translating MCP proxy the lead runs through. */
+export declare function setMcpProxy(team: FocusTeamState, proxy: CodexMcpProxyHandle | null): void;
+/**
+ * Take the team's MCP proxy for closing: returns it and nulls the field, so a
+ * second teardown path finds nothing to close. Returns null (writing nothing)
+ * when no proxy is engaged.
+ */
+export declare function detachMcpProxy(team: FocusTeamState): CodexMcpProxyHandle | null;
+/**
+ * Record a freshly spawned lead: its start identity on the team state, and its
+ * ownership record in the pidfile. Returns whether the record landed -- the
+ * launch REFUSES to leave a lead running that it could not record. The record
+ * is NOT dropped when the lead closes -- the lead's children can outlive it -- only once its whole process
+ * group is confirmed gone (`ensureTeamProcessGroupGone`, or the untracked-process
+ * sweep, which prunes a record whose group is already gone).
+ */
+export declare function recordLeadProcess(proc: ChildProcess, teamState: FocusTeamState, sessionId: string, deps: Pick<LeadOwnershipDeps, 'recordEntry' | 'readStartIdentity'>): boolean;
+/**
+ * True when the team's lead pid now names a DIFFERENT live process (pid reuse):
+ * a start identity was recorded at spawn and the live one differs. A gone lead
+ * (null live identity) or an unrecorded identity is not a mismatch.
+ */
+export declare function leadPidReused(team: Pick<FocusTeamState, 'leadPid' | 'leadStartIdentity'>, readStartIdentity: (pid: number) => string | null): boolean;
+/** Whether a team's process tree is confirmed gone, and why (or why not). */
+export interface TeamProcessTreeVerdict {
+    /** True only when no process of this team's group is observed alive. */
+    gone: boolean;
+    detail: string;
+    /** The termination result, when the group was signalled. */
+    result: ProcessGroupKillResult | null;
+}
+/**
+ * The team-cleanup guarantee: after a team's lead has closed, end anything left
+ * in its process group (subagents, MCP children, or a lead that closed its
+ * stdio but did not exit) within the grace, SIGKILL stragglers, and CONFIRM the
+ * group is gone.
+ *
+ * Signals only a group whose lead was really spawned (a start identity was
+ * recorded), whose pid no other live team now owns, and which was not reused.
+ * Absence is confirmed only by observation: a group that survived SIGKILL, could
+ * not be signalled, or could not be verified is reported `gone: false` and its
+ * ownership record is KEPT -- so the untracked-process sweep keeps acting on it --
+ * with the failure logged. Only a confirmed-gone tree discharges the record.
+ * Never throws.
+ */
+export declare function ensureTeamProcessGroupGone(teamState: FocusTeamState, context: string, deps: LeadOwnershipDeps): Promise<TeamProcessTreeVerdict>;
+//# sourceMappingURL=lead-process-ownership.d.ts.map

package/dist/daemon-state/lead-process-ownership.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lead-process-ownership.d.ts","sourceRoot":"","sources":["../../src/daemon-state/lead-process-ownership.ts"],"names":[],"mappings":"AAcA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,KAAK,EAAE,cAAc,EAAsB,MAAM,mBAAmB,CAAC;AAC5E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAGvE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAGL,KAAK,uBAAuB,EAC5B,KAAK,sBAAsB,EAC5B,MAAM,yBAAyB,CAAC;AAKjC;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,MAAM,cAAc,EAAE,CAAC;IACpC,oCAAoC;IACpC,WAAW,EAAE,CAAC,KAAK,EAAE,cAAc,KAAK,OAAO,CAAC;IAChD,WAAW,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IACnC,0DAA0D;IAC1D,WAAW,EAAE,MAAM,GAAG,CAAC,MAAM,CAAC,CAAC;IAC/B,iBAAiB,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IAClD,8DAA8D;IAC9D,YAAY,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IACxC,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,uBAAuB,KAAK,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC5F,GAAG,EAAE,MAAM,MAAM,CAAC;IAClB,8FAA8F;IAC9F,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,iFAAiF;AACjF,wBAAgB,oBAAoB,IAAI,GAAG,CAAC,MAAM,CAAC,CAOlD;AAED,iEAAiE;AACjE,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE;IAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,KAAK,EAAE,QAAQ,GAAG,IAAI,CAAA;CAAE,GAAG,IAAI,CAIlH;AAED,+EAA+E;AAC/E,wBAAgB,eAAe,CAAC,IAAI,EAAE,cAAc,GAAG,IAAI,CAG1D;AAED,gGAAgG;AAChG,wBAAgB,WAAW,CAAC,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,mBAAmB,GAAG,IAAI,GAAG,IAAI,CAGzF;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,cAAc,GAAG,mBAAmB,GAAG,IAAI,CAK/E;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,YAAY,EAClB,SAAS,EAAE,cAAc,EACzB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,IAAI,CAAC,iBAAiB,EAAE,aAAa,GAAG,mBAAmB,CAAC,GACjE,OAAO,CAaT;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAC3B,IAAI,EAAE,IAAI,CAAC,cAAc,EAAE,SAAS,GAAG,mBAAmB,CAAC,EAC3D,iBAAiB,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,GAChD,OAAO,CAIT;AAED,6EAA6E;AAC7E,MAAM,WAAW,sBAAsB;IACrC,wEAAwE;IACxE,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,4DAA4D;IAC5D,MAAM,EAAE,sBAAsB,GAAG,IAAI,CAAC;CACvC;AA4BD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,0BAA0B,CAC9C,SAAS,EAAE,cAAc,EACzB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC,sBAAsB,CAAC,CAajC"}

package/dist/daemon-state/lead-process-ownership.js

@@ -0,0 +1,145 @@
+// PINNED-BY-BEGIN (generated by gen:pinned-by -- do not hand-edit; checked by lint:pinned-by)
+// Pinned by: packages/daemon/src/completion/team-teardown/team-teardown-kills-process-group.test.ts,
+//   packages/daemon/src/daemon-state/lead-process-ownership.test.ts,
+//   packages/daemon/src/focus/session-process-reap.test.ts,
+//   packages/daemon/src/spawn/directive-mid-delivery-death.test.ts,
+//   packages/daemon/src/spawn/directive-reoffer.test.ts,
+//   packages/daemon/src/spawn/directive-undelivered-record.test.ts,
+//   packages/daemon/src/spawn/lead-launch.test.ts,
+//   packages/daemon/src/spawn/resume-failure-sigterm-exclusion.test.ts,
+//   packages/daemon/src/spawn/spawn-and-acknowledge.test.ts,
+//   packages/daemon/src/spawn/spawn-team-process-ownership.test.ts,
+//   packages/daemon/src/spawn/untracked-lead-sweep.test.ts
+// PINNED-BY-END
+import { getActiveTeams } from './focus-team-state.js';
+import { listTrackedWorkers } from './worker-registry.js';
+import { PROCESS_GROUP_GRACE_MS, processGroupEnded, } from './process-group-kill.js';
+import { createLogger } from '../log/daemon-log.js';
+const log = createLogger({ module: 'lead-process-ownership' });
+/** Every pid a live team (lead) or registered one-shot worker owns right now. */
+export function currentlyTrackedPids() {
+    const pids = new Set();
+    for (const team of getActiveTeams().values()) {
+        if (typeof team.leadPid === 'number')
+            pids.add(team.leadPid);
+    }
+    for (const worker of listTrackedWorkers())
+        pids.add(worker.pid);
+    return pids;
+}
+/** Attach a freshly spawned lead's pid and stdin to its team. */
+export function attachLeadProcess(team, lead) {
+    const leadProcess = team;
+    leadProcess.leadPid = lead.pid;
+    leadProcess.leadStdin = lead.stdin;
+}
+/** Drop the team's handle on its lead's stdin (closed, or the lead exited). */
+export function detachLeadStdin(team) {
+    const leadProcess = team;
+    leadProcess.leadStdin = null;
+}
+/** Attach (or clear, with null) the local-model translating MCP proxy the lead runs through. */
+export function setMcpProxy(team, proxy) {
+    const leadProcess = team;
+    leadProcess.mcpProxy = proxy;
+}
+/**
+ * Take the team's MCP proxy for closing: returns it and nulls the field, so a
+ * second teardown path finds nothing to close. Returns null (writing nothing)
+ * when no proxy is engaged.
+ */
+export function detachMcpProxy(team) {
+    const proxy = team.mcpProxy;
+    if (!proxy)
+        return null;
+    setMcpProxy(team, null);
+    return proxy;
+}
+/**
+ * Record a freshly spawned lead: its start identity on the team state, and its
+ * ownership record in the pidfile. Returns whether the record landed -- the
+ * launch REFUSES to leave a lead running that it could not record. The record
+ * is NOT dropped when the lead closes -- the lead's children can outlive it -- only once its whole process
+ * group is confirmed gone (`ensureTeamProcessGroupGone`, or the untracked-process
+ * sweep, which prunes a record whose group is already gone).
+ */
+export function recordLeadProcess(proc, teamState, sessionId, deps) {
+    if (typeof proc.pid !== 'number')
+        return false;
+    const leadPid = proc.pid;
+    const startIdentity = deps.readStartIdentity(leadPid);
+    const leadProcess = teamState;
+    leadProcess.leadStartIdentity = startIdentity;
+    const entry = {
+        pid: leadPid, label: teamState.focusName, focusId: teamState.focusId, sessionId, recordedAt: Date.now(),
+    };
+    if (startIdentity !== null)
+        entry.startIdentity = startIdentity;
+    // Whether the record LANDED is the caller's business: a live lead this host
+    // cannot name is one no later pass can prove stopped.
+    return deps.recordEntry(entry);
+}
+/**
+ * True when the team's lead pid now names a DIFFERENT live process (pid reuse):
+ * a start identity was recorded at spawn and the live one differs. A gone lead
+ * (null live identity) or an unrecorded identity is not a mismatch.
+ */
+export function leadPidReused(team, readStartIdentity) {
+    if (team.leadPid == null || team.leadStartIdentity == null)
+        return false;
+    const live = readStartIdentity(team.leadPid);
+    return live !== null && live !== team.leadStartIdentity;
+}
+async function resolveTeamProcessTree(teamState, context, d, graceMs) {
+    const pid = teamState.leadPid;
+    const verdict = (gone, detail, result = null) => ({ gone, detail, result });
+    if (pid == null)
+        return verdict(true, 'no lead process was spawned');
+    if (!Number.isInteger(pid) || pid <= 1)
+        return verdict(false, `lead pid ${pid} is not a signallable process group`);
+    // The kernel does not reuse an id a process group still holds, so a pid now
+    // owned by another team's lead, or reused by an unrelated process, means
+    // nothing of THIS team's group remains.
+    const ownedByAnotherTeam = [...getActiveTeams().values()].some((t) => t !== teamState && t.leadPid === pid);
+    if (ownedByAnotherTeam || leadPidReused(teamState, d.readStartIdentity)) {
+        return verdict(true, `pid ${pid} now belongs to another process, so no process of this team's group remains`);
+    }
+    if (teamState.leadStartIdentity == null) {
+        if (!d.isGroupAlive(pid))
+            return verdict(true, `process group ${pid} is already gone`);
+        return verdict(false, `no spawn identity was recorded for pid ${pid}, so its live process group cannot be verified as this team's and was not signalled`);
+    }
+    const result = await d.terminate(pid, { label: teamState.focusName, context, graceMs });
+    if (processGroupEnded(result))
+        return verdict(true, `process group ${pid} ${result.outcome}`, result);
+    return verdict(false, `process group ${pid} ${result.outcome}${result.detail ? ` (${result.detail})` : ''}`, result);
+}
+/**
+ * The team-cleanup guarantee: after a team's lead has closed, end anything left
+ * in its process group (subagents, MCP children, or a lead that closed its
+ * stdio but did not exit) within the grace, SIGKILL stragglers, and CONFIRM the
+ * group is gone.
+ *
+ * Signals only a group whose lead was really spawned (a start identity was
+ * recorded), whose pid no other live team now owns, and which was not reused.
+ * Absence is confirmed only by observation: a group that survived SIGKILL, could
+ * not be signalled, or could not be verified is reported `gone: false` and its
+ * ownership record is KEPT -- so the untracked-process sweep keeps acting on it --
+ * with the failure logged. Only a confirmed-gone tree discharges the record.
+ * Never throws.
+ */
+export async function ensureTeamProcessGroupGone(teamState, context, deps) {
+    const verdict = await resolveTeamProcessTree(teamState, context, deps, deps.graceMs ?? PROCESS_GROUP_GRACE_MS);
+    const pid = teamState.leadPid;
+    if (verdict.gone) {
+        if (pid != null)
+            deps.removeEntry(pid);
+        log.debug(`[process-kill] ${context}: "${teamState.focusName}" process tree confirmed gone -- ${verdict.detail}`);
+    }
+    else {
+        log.error(`[process-kill] ${context}: "${teamState.focusName}" process tree NOT confirmed gone -- ${verdict.detail}; ` +
+            'its ownership record is kept for the untracked-process sweep');
+    }
+    return verdict;
+}
+//# sourceMappingURL=lead-process-ownership.js.map

package/dist/daemon-state/lead-process-ownership.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lead-process-ownership.js","sourceRoot":"","sources":["../../src/daemon-state/lead-process-ownership.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,qGAAqG;AACrG,qEAAqE;AACrE,4DAA4D;AAC5D,oEAAoE;AACpE,yDAAyD;AACzD,oEAAoE;AACpE,mDAAmD;AACnD,wEAAwE;AACxE,6DAA6D;AAC7D,oEAAoE;AACpE,2DAA2D;AAC3D,gBAAgB;AAgChB,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE1D,OAAO,EACL,sBAAsB,EACtB,iBAAiB,GAGlB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEpD,MAAM,GAAG,GAAG,YAAY,CAAC,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC,CAAC;AAwB/D,iFAAiF;AACjF,MAAM,UAAU,oBAAoB;IAClC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC;QAC7C,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ;YAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/D,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,kBAAkB,EAAE;QAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAChE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,iBAAiB,CAAC,IAAoB,EAAE,IAAoD;IAC1G,MAAM,WAAW,GAAsC,IAAI,CAAC;IAC5D,WAAW,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC;IAC/B,WAAW,CAAC,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC;AACrC,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,eAAe,CAAC,IAAoB;IAClD,MAAM,WAAW,GAAsC,IAAI,CAAC;IAC5D,WAAW,CAAC,SAAS,GAAG,IAAI,CAAC;AAC/B,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,WAAW,CAAC,IAAoB,EAAE,KAAiC;IACjF,MAAM,WAAW,GAAsC,IAAI,CAAC;IAC5D,WAAW,CAAC,QAAQ,GAAG,KAAK,CAAC;AAC/B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,IAAoB;IACjD,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC;IAC5B,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACxB,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAC/B,IAAkB,EAClB,SAAyB,EACzB,SAAiB,EACjB,IAAkE;IAElE,IAAI,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC;IACzB,MAAM,aAAa,GAAG,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACtD,MAAM,WAAW,GAAsC,SAAS,CAAC;IACjE,WAAW,CAAC,iBAAiB,GAAG,aAAa,CAAC;IAC9C,MAAM,KAAK,GAAmB;QAC5B,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE;KACxG,CAAC;IACF,IAAI,aAAa,KAAK,IAAI;QAAE,KAAK,CAAC,aAAa,GAAG,aAAa,CAAC;IAChE,4EAA4E;IAC5E,sDAAsD;IACtD,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;AACjC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAC3B,IAA2D,EAC3D,iBAAiD;IAEjD,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,IAAI,IAAI,CAAC,iBAAiB,IAAI,IAAI;QAAE,OAAO,KAAK,CAAC;IACzE,MAAM,IAAI,GAAG,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC7C,OAAO,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI,CAAC,iBAAiB,CAAC;AAC1D,CAAC;AAWD,KAAK,UAAU,sBAAsB,CACnC,SAAyB,EACzB,OAAe,EACf,CAAoB,EACpB,OAAe;IAEf,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC;IAC9B,MAAM,OAAO,GAAG,CAAC,IAAa,EAAE,MAAc,EAAE,SAAwC,IAAI,EAA0B,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACpJ,IAAI,GAAG,IAAI,IAAI;QAAE,OAAO,OAAO,CAAC,IAAI,EAAE,6BAA6B,CAAC,CAAC;IACrE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;QAAE,OAAO,OAAO,CAAC,KAAK,EAAE,YAAY,GAAG,qCAAqC,CAAC,CAAC;IACpH,4EAA4E;IAC5E,yEAAyE;IACzE,wCAAwC;IACxC,MAAM,kBAAkB,GAAG,CAAC,GAAG,cAAc,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,OAAO,KAAK,GAAG,CAAC,CAAC;IAC5G,IAAI,kBAAkB,IAAI,aAAa,CAAC,SAAS,EAAE,CAAC,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACxE,OAAO,OAAO,CAAC,IAAI,EAAE,OAAO,GAAG,6EAA6E,CAAC,CAAC;IAChH,CAAC;IACD,IAAI,SAAS,CAAC,iBAAiB,IAAI,IAAI,EAAE,CAAC;QACxC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC;YAAE,OAAO,OAAO,CAAC,IAAI,EAAE,iBAAiB,GAAG,kBAAkB,CAAC,CAAC;QACvF,OAAO,OAAO,CAAC,KAAK,EAAE,0CAA0C,GAAG,qFAAqF,CAAC,CAAC;IAC5J,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,SAAS,CAAC,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IACxF,IAAI,iBAAiB,CAAC,MAAM,CAAC;QAAE,OAAO,OAAO,CAAC,IAAI,EAAE,iBAAiB,GAAG,IAAI,MAAM,CAAC,OAAO,EAAE,EAAE,MAAM,CAAC,CAAC;IACtG,OAAO,OAAO,CAAC,KAAK,EAAE,iBAAiB,GAAG,IAAI,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;AACvH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,SAAyB,EACzB,OAAe,EACf,IAAuB;IAEvB,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,IAAI,sBAAsB,CAAC,CAAC;IAC/G,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC;IAC9B,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,IAAI,GAAG,IAAI,IAAI;YAAE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACvC,GAAG,CAAC,KAAK,CAAC,kBAAkB,OAAO,MAAM,SAAS,CAAC,SAAS,oCAAoC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACpH,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,KAAK,CACP,kBAAkB,OAAO,MAAM,SAAS,CAAC,SAAS,wCAAwC,OAAO,CAAC,MAAM,IAAI;YAC5G,8DAA8D,CAC/D,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/daemon-state/narrations.d.ts

@@ -0,0 +1,7 @@
+/** Update the narration for a focus. Called by the ActivityTracker callback. */
+export declare function setNarration(focusId: string, text: string): void;
+/** Clear the narration for a focus (called when its team shuts down). */
+export declare function clearNarration(focusId: string): void;
+/** The current narrations keyed by focus id, or null when there are none. */
+export declare function narrationSnapshot(): Record<string, string> | null;
+//# sourceMappingURL=narrations.d.ts.map

package/dist/daemon-state/narrations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"narrations.d.ts","sourceRoot":"","sources":["../../src/daemon-state/narrations.ts"],"names":[],"mappings":"AAgBA,gFAAgF;AAChF,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAEhE;AAED,yEAAyE;AACzE,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAEpD;AAED,6EAA6E;AAC7E,wBAAgB,iBAAiB,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAEjE"}

package/dist/daemon-state/narrations.js

@@ -0,0 +1,26 @@
+// PINNED-BY-BEGIN (generated by gen:pinned-by -- do not hand-edit; checked by lint:pinned-by)
+// Pinned by: packages/daemon/src/focus/heartbeat-team-liveness-phases.test.ts
+// PINNED-BY-END
+/**
+ * Team-lead narration store (in-memory only).
+ *
+ * Focus ID -> the latest narration text the focus's team lead emitted. The
+ * spawn path's activity tracker writes it, team teardown clears it, and the
+ * heartbeat publishes the whole map as `metadata.narrations`. A leaf: it imports
+ * nothing, so the writers (spawn, completion) and the reader (the heartbeat)
+ * share it without reaching into one another.
+ */
+const narrations = new Map();
+/** Update the narration for a focus. Called by the ActivityTracker callback. */
+export function setNarration(focusId, text) {
+    narrations.set(focusId, text);
+}
+/** Clear the narration for a focus (called when its team shuts down). */
+export function clearNarration(focusId) {
+    narrations.delete(focusId);
+}
+/** The current narrations keyed by focus id, or null when there are none. */
+export function narrationSnapshot() {
+    return narrations.size > 0 ? Object.fromEntries(narrations) : null;
+}
+//# sourceMappingURL=narrations.js.map

package/dist/daemon-state/narrations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"narrations.js","sourceRoot":"","sources":["../../src/daemon-state/narrations.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,8EAA8E;AAC9E,gBAAgB;AAEhB;;;;;;;;GAQG;AAEH,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;AAE7C,gFAAgF;AAChF,MAAM,UAAU,YAAY,CAAC,OAAe,EAAE,IAAY;IACxD,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;AAChC,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,cAAc,CAAC,OAAe;IAC5C,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAC7B,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,iBAAiB;IAC/B,OAAO,UAAU,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACrE,CAAC"}