@tinycloud/operations 0.5.0-beta.5 → 0.5.0-beta.7

package/dist/cli-runtime.cjs

@@ -4109,10 +4109,10 @@ function evaluateOperationAuthority(granted, required, resolveSpace2) {
   const canonicalRequired = canonicalizeOperationCapabilities(required, resolveSpace2);
   const missing = [];
   for (const requested of canonicalRequired) {
-    const covered = canonicalGranted.some(
-      (candidate) => candidate.service === requested.service && operationSpacesEqual(candidate.space, requested.space) && isCapabilitySubset([requested], [candidate]).subset
+    const sameScope = canonicalGranted.filter(
+      (candidate) => candidate.service === requested.service && operationSpacesEqual(candidate.space, requested.space)
     );
-    if (!covered) missing.push(requested);
+    if (!isCapabilitySubset([requested], sameScope).subset) missing.push(requested);
   }
   return {
     satisfied: missing.length === 0,
@@ -4235,9 +4235,161 @@ var init_authority = __esm({
 
 // src/state.ts
 function processWideContext(key) {
-  var _a3;
+  var _a4;
   const registry = globalThis;
-  return registry[_a3 = Symbol.for(key)] ?? (registry[_a3] = new import_node_async_hooks.AsyncLocalStorage());
+  return registry[_a4 = Symbol.for(key)] ?? (registry[_a4] = new import_node_async_hooks.AsyncLocalStorage());
+}
+function processOrigin() {
+  if (cachedProcessOrigin !== void 0) return cachedProcessOrigin;
+  if (process.platform !== "linux") return cachedProcessOrigin = null;
+  try {
+    const bootId = (0, import_node_fs.readFileSync)("/proc/sys/kernel/random/boot_id", "utf8").trim();
+    const pidNamespace = (0, import_node_fs.readlinkSync)("/proc/self/ns/pid");
+    const processStat = (0, import_node_fs.readFileSync)("/proc/self/stat", "utf8");
+    const closingParen = processStat.lastIndexOf(") ");
+    const processStartTime = closingParen < 0 ? void 0 : processStat.slice(closingParen + 2).trim().split(/\s+/)[19];
+    if (!/^[0-9a-f-]{36}$/.test(bootId) || !/^pid:\[[0-9]+\]$/.test(pidNamespace) || !processStartTime || !/^[0-9]+$/.test(processStartTime)) {
+      return cachedProcessOrigin = null;
+    }
+    return cachedProcessOrigin = { bootId, pidNamespace, processStartTime };
+  } catch {
+    return cachedProcessOrigin = null;
+  }
+}
+function processOwner(liveness) {
+  return { instanceId: processInstanceId, ...processOrigin(), ...liveness ? { liveness: liveness.record } : {} };
+}
+function socketDirectory(name) {
+  const match = LIVENESS_SOCKET.exec(name);
+  return match ? `${match[1]}-${match[2]}` : null;
+}
+async function pinDirectory(directory) {
+  const handle = await (0, import_promises.open)(directory, "r");
+  try {
+    const { dev, ino } = await handle.stat({ bigint: true });
+    return {
+      identity: `${dev.toString(16)}-${ino.toString(16)}`,
+      path: (name) => `/proc/self/fd/${handle.fd}/${name}`,
+      close: () => handle.close()
+    };
+  } catch (error) {
+    await handle.close();
+    throw error;
+  }
+}
+async function bindLiveness(directory) {
+  if (!processOrigin()) return null;
+  let pinned;
+  try {
+    pinned = await pinDirectory(directory);
+  } catch {
+    return null;
+  }
+  const socket = `.live-${pinned.identity}-${(0, import_node_crypto.randomUUID)()}`;
+  const server = (0, import_node_net.createServer)((connection) => connection.destroy());
+  let bound = false;
+  try {
+    await new Promise((resolve2, reject) => {
+      server.once("error", reject);
+      server.listen({ path: pinned.path(`${socket}.new`), exclusive: true }, () => {
+        server.off("error", reject);
+        resolve2();
+      });
+    });
+    bound = true;
+    server.on("error", () => void 0);
+    server.unref();
+    await (0, import_promises.rename)(pinned.path(`${socket}.new`), pinned.path(socket));
+    const stats = await (0, import_promises.lstat)(pinned.path(socket), { bigint: true });
+    if (!stats.isSocket()) throw new Error(`${socket} is not a socket`);
+    await waitForTestBarrier(TEST_LOCK_LIVENESS_BARRIER_DIR, (0, import_node_path.basename)(directory));
+    return { record: { socket, dev: String(stats.dev), ino: String(stats.ino) }, path: (0, import_node_path.join)(directory, socket), server };
+  } catch {
+    if (bound) {
+      server.close();
+      for (const name of [`${socket}.new`, socket]) await (0, import_promises.unlink)(pinned.path(name)).catch(() => void 0);
+    }
+    return null;
+  } finally {
+    await pinned.close();
+  }
+}
+async function ensureLiveness(acquisition) {
+  if (acquisition.held === void 0) acquisition.held = await bindLiveness(acquisition.directory);
+  return acquisition.held;
+}
+async function closeLiveness(held) {
+  held.server.close();
+  await (0, import_promises.unlink)(held.path).catch(() => void 0);
+}
+function parseLiveness(value) {
+  if (typeof value !== "object" || value === null) return null;
+  const { socket, dev, ino } = value;
+  const name = typeof socket === "string" ? LIVENESS_SOCKET.exec(socket) : null;
+  return name !== null && name[3] === void 0 && typeof dev === "string" && /^[0-9]+$/.test(dev) && typeof ino === "string" && /^[0-9]+$/.test(ino) ? { socket: name[0], dev, ino } : null;
+}
+async function controlIn(pinned, acquisition) {
+  const own = await ensureLiveness(acquisition);
+  if (!own || socketDirectory(own.record.socket) !== pinned.identity) return null;
+  const stats = await (0, import_promises.lstat)(pinned.path(own.record.socket), { bigint: true }).catch(() => null);
+  return stats?.isSocket() && String(stats.dev) === own.record.dev && String(stats.ino) === own.record.ino ? own : null;
+}
+async function tryConnect(path) {
+  return new Promise((resolve2) => {
+    const probe = (0, import_node_net.connect)({ path });
+    const settle = (outcome) => {
+      clearTimeout(timer);
+      probe.destroy();
+      resolve2(outcome);
+    };
+    const timer = setTimeout(() => settle("other"), LIVENESS_PROBE_TIMEOUT_MS);
+    probe.once("connect", () => settle("connected"));
+    probe.once("error", (error) => settle(isErrno(error, "ECONNREFUSED") ? "refused" : "other"));
+  });
+}
+async function kernelRefuses(pinned, name, control) {
+  if (process.versions.bun !== void 0) return false;
+  return await tryConnect(pinned.path(name)) === "refused" && await tryConnect(pinned.path(control.record.socket)) === "connected";
+}
+async function probeLiveness(liveness, acquisition) {
+  let pinned;
+  try {
+    pinned = await pinDirectory(acquisition.directory);
+  } catch {
+    return "unknown";
+  }
+  try {
+    if (socketDirectory(liveness.socket) !== pinned.identity) return "unknown";
+    const control = await controlIn(pinned, acquisition);
+    if (!control) return "unknown";
+    let stats;
+    try {
+      stats = await (0, import_promises.lstat)(pinned.path(liveness.socket), { bigint: true });
+    } catch (error) {
+      return isErrno(error, "ENOENT") ? "gone" : "unknown";
+    }
+    if (!stats.isSocket() || String(stats.dev) !== liveness.dev || String(stats.ino) !== liveness.ino) return "unknown";
+    return await kernelRefuses(pinned, liveness.socket, control) ? "refused" : "unknown";
+  } finally {
+    await pinned.close();
+  }
+}
+async function sweepLiveness(acquisition) {
+  if (process.versions.bun !== void 0 || !acquisition.held) return;
+  const pinned = await pinDirectory(acquisition.directory);
+  try {
+    const control = await controlIn(pinned, acquisition);
+    if (!control) return;
+    for (const name of await (0, import_promises.readdir)(pinned.path("."))) {
+      if (name === control.record.socket || socketDirectory(name) !== pinned.identity) continue;
+      const stats = await (0, import_promises.lstat)(pinned.path(name)).catch(() => null);
+      if (stats?.isSocket() && await kernelRefuses(pinned, name, control)) {
+        await (0, import_promises.unlink)(pinned.path(name)).catch(() => void 0);
+      }
+    }
+  } finally {
+    await pinned.close();
+  }
 }
 function tinycloudHomePath() {
   const home = invocationStateRoot.getStore() ?? process.env.TC_HOME ?? process.env.HOME ?? process.env.USERPROFILE ?? (0, import_node_os.homedir)();
@@ -4414,7 +4566,18 @@ async function acquireProfileLock(profile, options) {
       if (path !== directory || !isErrno(error, "ENOENT")) throw error;
     });
   }
-  const { turn, firstWaitedTurn } = await acquireTurn(profile, turnDirectory, deadline);
+  const liveness = { directory: turnDirectory, held: void 0 };
+  const closeAcquisitionLiveness = async () => {
+    if (liveness.held) await closeLiveness(liveness.held);
+  };
+  let taken;
+  try {
+    taken = await acquireTurn(profile, turnDirectory, deadline, liveness);
+  } catch (error) {
+    await closeAcquisitionLiveness();
+    throw error;
+  }
+  const { turn, firstWaitedTurn } = taken;
   try {
     if (options.requireProfile && !await exists(profileConfigPath(profile))) {
       await (0, import_promises.rmdir)(directory).catch(() => void 0);
@@ -4424,7 +4587,7 @@ async function acquireProfileLock(profile, options) {
     const deletedWhileWaiting = typeof deletion?.slot === "number" && deletion.slot >= firstWaitedTurn;
     while (true) {
       const token = (0, import_node_crypto.randomUUID)();
-      if (await publishProfileLock(profile, lockPath, token, options.requireProfile === true)) {
+      if (await publishProfileLock(profile, lockPath, token, options.requireProfile === true, liveness.held ?? null)) {
         return {
           deletedWhileWaiting,
           turnSlot: turn.slot,
@@ -4432,17 +4595,19 @@ async function acquireProfileLock(profile, options) {
             try {
               await releaseProfileLock(profile, lockPath, token);
             } finally {
-              await releaseTurn(profile, turn);
+              await releaseTurn(profile, turn, liveness);
+              await closeAcquisitionLiveness();
             }
           }
         };
       }
       await signalTestLockContention(profile);
-      if (await recoverStaleLock(profile, lockPath, staleAfterMs)) continue;
+      if (await recoverStaleLock(profile, lockPath, liveness, staleAfterMs)) continue;
       await waitOrTimeOut(profile, deadline);
     }
   } catch (error) {
-    await releaseTurn(profile, turn);
+    await releaseTurn(profile, turn, liveness);
+    await closeAcquisitionLiveness();
     throw error;
   }
 }
@@ -4455,7 +4620,7 @@ async function waitOrTimeOut(profile, deadline, detail) {
   checkDeadline(profile, deadline, detail);
   await sleep(Math.min(deadline.retryMs, deadline.timeoutMs - (Date.now() - deadline.startedAt)));
 }
-async function acquireTurn(profile, directory, deadline) {
+async function acquireTurn(profile, directory, deadline, liveness) {
   let firstWaitedTurn;
   let problem;
   const damaged = (what) => `The turn lock ${directory} ${what}, so no process can take it. If no tc or MCP process is using profile "${profile}", remove that directory.`;
@@ -4480,13 +4645,13 @@ async function acquireTurn(profile, directory, deadline) {
     }
     firstWaitedTurn ?? (firstWaitedTurn = latest.done ? latest.slot + 1 : latest.slot);
     if (latest.held && latest.done) {
-      const turn = await takeTurn(profile, directory, latest);
+      const turn = await takeTurn(profile, directory, latest, await ensureLiveness(liveness));
       if (turn !== null) return { turn, firstWaitedTurn };
       await waitOrTimeOut(profile, deadline);
     } else if (latest.done) {
       problem = damaged(`ends with turn ${latest.slot}, which was never granted`);
       await waitOrTimeOut(profile, deadline, problem);
-    } else if (latest.pid === process.pid ? relinquishedTurns.has(latest.token) : !isProcessAlive(latest.pid)) {
+    } else if (latest.pid === process.pid && relinquishedTurns.has(latest.token) || !await isRecordedProcessAlive(latest, liveness)) {
       await waitForTestBarrier(TEST_LOCK_TURN_SETTLE_BARRIER_DIR, profile);
       await settleAbandonedTurn(directory, latest);
       relinquishedTurns.delete(latest.token);
@@ -4531,6 +4696,7 @@ async function readTurn(directory, slot) {
   const done = await exists((0, import_node_path.join)(path, `${owner.token}.done`));
   const held = await exists((0, import_node_path.join)(path, `${owner.token}.held`));
   return {
+    ...owner,
     slot,
     token: owner.token,
     pid: owner.pid,
@@ -4544,11 +4710,11 @@ async function isFinishedTurn(directory, slot, token) {
   if (turn === "damaged") throw new Error(`Turn ${slot} of the turn lock ${directory} is unreadable.`);
   return turn !== null && turn.token === token && turn.held && turn.done;
 }
-async function takeTurn(profile, directory, latest) {
+async function takeTurn(profile, directory, latest, liveness) {
   const token = (0, import_node_crypto.randomUUID)();
   const slot = latest.slot + 1;
   const path = (0, import_node_path.join)(directory, String(slot));
-  const owner = { pid: process.pid, createdAt: (/* @__PURE__ */ new Date()).toISOString(), token, after: latest.token };
+  const owner = { pid: process.pid, createdAt: (/* @__PURE__ */ new Date()).toISOString(), token, after: latest.token, ...processOwner(liveness) };
   let published = false;
   try {
     published = await publishDirectory(
@@ -4602,7 +4768,7 @@ async function markTurn(path, token, kind) {
 }
 async function createTurnDirectory(directory) {
   const token = (0, import_node_crypto.randomUUID)();
-  const owner = { pid: process.pid, createdAt: (/* @__PURE__ */ new Date()).toISOString(), token, after: null };
+  const owner = { pid: process.pid, createdAt: (/* @__PURE__ */ new Date()).toISOString(), token, after: null, ...processOwner(null) };
   await publishDirectory((0, import_node_path.join)((0, import_node_path.dirname)(directory), `.stage-${(0, import_node_path.basename)(directory)}-${process.pid}-${token}`), directory, {
     "0/owner.json": `${JSON.stringify(owner, null, 2)}
 `,
@@ -4626,31 +4792,39 @@ async function publishDirectory(stage, target, files, beforeRename) {
     await (0, import_promises.rm)(stage, { recursive: true, force: true }).catch(() => void 0);
   }
 }
-async function releaseTurn(profile, turn) {
+async function releaseTurn(profile, turn, liveness) {
   try {
     await markTurn((0, import_node_path.join)(turn.directory, String(turn.slot)), turn.token, "done");
   } catch {
     settleOwnTurn(turn.directory, turn.slot, turn.token);
     return;
   }
-  await collectTurns(profile, turn).catch(() => void 0);
+  await collectTurns(profile, turn, liveness).catch(() => void 0);
 }
-function isAbandonedTurnEntry(name) {
+async function isAbandonedTurnEntry(directory, name, liveness) {
   if (name.startsWith(".trash-")) return true;
   const writer = /^\.(?:stage|deleted\.json)[-.]([0-9]+)[-.]/.exec(name)?.[1];
-  return writer !== void 0 && !isProcessAlive(Number(writer));
+  if (writer === void 0) return false;
+  if (Number(writer) !== process.pid) return !await isRecordedProcessAlive({ pid: Number(writer) }, liveness);
+  return name.startsWith(".stage-") && await isStagedOwnerGone((0, import_node_path.join)(directory, name, "owner.json"), liveness);
 }
-function isAbandonedTurnDirectoryStage(name) {
+async function isAbandonedTurnDirectoryStage(directory, name, liveness) {
   const writer = /^\.stage-.+-([0-9]+)-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.exec(name)?.[1];
-  return writer !== void 0 && !isProcessAlive(Number(writer));
+  if (writer === void 0) return false;
+  if (Number(writer) !== process.pid) return !await isRecordedProcessAlive({ pid: Number(writer) }, liveness);
+  return isStagedOwnerGone((0, import_node_path.join)(directory, name, "0", "owner.json"), liveness);
 }
-async function collectTurns(profile, turn) {
+async function isStagedOwnerGone(recordPath, liveness) {
+  const owner = await readJson(recordPath).catch(() => null);
+  return typeof owner === "object" && owner !== null && owner.pid === process.pid && !await isRecordedProcessAlive(owner, liveness);
+}
+async function collectTurns(profile, turn, liveness) {
   for (const [directory, abandoned] of [
     [turn.directory, isAbandonedTurnEntry],
     [(0, import_node_path.dirname)(turn.directory), isAbandonedTurnDirectoryStage]
   ]) {
-    for (const name of (await (0, import_promises.readdir)(directory)).filter(abandoned)) {
-      await (0, import_promises.rm)((0, import_node_path.join)(directory, name), { recursive: true, force: true }).catch(() => void 0);
+    for (const name of await (0, import_promises.readdir)(directory)) {
+      if (await abandoned(directory, name, liveness)) await (0, import_promises.rm)((0, import_node_path.join)(directory, name), { recursive: true, force: true }).catch(() => void 0);
     }
   }
   const older = (await (0, import_promises.readdir)(turn.directory)).filter((name) => TURN.test(name)).map(Number).filter((slot) => slot < turn.slot).sort((left, right) => left - right);
@@ -4668,8 +4842,9 @@ async function collectTurns(profile, turn) {
       await (0, import_promises.rm)(trash, { recursive: true, force: true }).catch(() => void 0);
     }
   }
+  await sweepLiveness(liveness);
 }
-async function publishProfileLock(profile, lockPath, token, requireProfile) {
+async function publishProfileLock(profile, lockPath, token, requireProfile, liveness) {
   try {
     await (0, import_promises.mkdir)(lockPath, { mode: PRIVATE_DIR_MODE });
   } catch (error) {
@@ -4682,7 +4857,7 @@ async function publishProfileLock(profile, lockPath, token, requireProfile) {
   await waitForTestBarrier(TEST_LOCK_PUBLISH_BARRIER_DIR, profile);
   const ownerPath = (0, import_node_path.join)(lockPath, "owner.json");
   const staged = (0, import_node_path.join)((0, import_node_path.dirname)(lockPath), `.lock-owner-${token}.tmp`);
-  const owner = `${JSON.stringify({ pid: process.pid, createdAt: (/* @__PURE__ */ new Date()).toISOString(), token }, null, 2)}
+  const owner = `${JSON.stringify({ pid: process.pid, createdAt: (/* @__PURE__ */ new Date()).toISOString(), token, ...processOwner(liveness) }, null, 2)}
 `;
   try {
     await (0, import_promises.writeFile)(staged, owner, { encoding: "utf8", mode: PRIVATE_FILE_MODE, flag: "wx" });
@@ -4726,7 +4901,7 @@ async function signalTestLockContention(profile) {
   await (0, import_promises.writeFile)(signalPath, `${profile}
 `, { encoding: "utf8", flag: "wx" }).catch(() => void 0);
 }
-async function recoverOwnerlessLock(profile, lockPath, staleAfterMs) {
+async function recoverOwnerlessLock(profile, lockPath, liveness, staleAfterMs) {
   let aged;
   try {
     const { mtimeMs } = await (0, import_promises.stat)(lockPath);
@@ -4743,7 +4918,7 @@ async function recoverOwnerlessLock(profile, lockPath, staleAfterMs) {
     if (!onlyOrphanedClaims && (!aged || recoveryFenced(checkedAt, staleAfterMs))) return false;
     for (const name of entries.filter((entry) => RECOVERY_CLAIM.test(entry))) {
       const claimPath = (0, import_node_path.join)(lockPath, name);
-      if (await hasLiveRecoveryOwner(claimPath)) {
+      if (await hasLiveRecoveryOwner(claimPath, liveness)) {
         if (!await exists((0, import_node_path.join)(lockPath, "owner.json"))) await (0, import_promises.rename)(claimPath, (0, import_node_path.join)(lockPath, "owner.json"));
         return false;
       }
@@ -4759,7 +4934,7 @@ async function recoverOwnerlessLock(profile, lockPath, staleAfterMs) {
   await removeAgedOwnerFiles(lockPath, staleAfterMs);
   return true;
 }
-async function hasLiveRecoveryOwner(claimPath) {
+async function hasLiveRecoveryOwner(claimPath, liveness) {
   let contents;
   try {
     contents = await (0, import_promises.readFile)(claimPath, "utf8");
@@ -4773,8 +4948,8 @@ async function hasLiveRecoveryOwner(claimPath) {
   } catch {
     return false;
   }
-  const pid = typeof owner === "object" && owner !== null && "pid" in owner ? owner.pid : null;
-  return typeof pid === "number" && Number.isInteger(pid) && pid > 0 && isProcessAlive(pid);
+  const record = typeof owner === "object" && owner !== null && "pid" in owner ? owner : null;
+  return typeof record?.pid === "number" && Number.isInteger(record.pid) && record.pid > 0 && await isRecordedProcessAlive(record, liveness);
 }
 function recoveryFenced(since, staleAfterMs) {
   return performance.now() - since >= staleAfterMs / 2;
@@ -4788,11 +4963,11 @@ async function removeAgedOwnerFiles(lockPath, staleAfterMs) {
     if (aged) await (0, import_promises.rm)(path, { force: true }).catch(() => void 0);
   }
 }
-async function recoverStaleLock(profile, lockPath, staleAfterMs) {
+async function recoverStaleLock(profile, lockPath, liveness, staleAfterMs) {
   const ownerPath = (0, import_node_path.join)(lockPath, "owner.json");
   const observed = await (0, import_promises.readFile)(ownerPath, "utf8").catch(() => null);
-  if (observed === null) return recoverOwnerlessLock(profile, lockPath, staleAfterMs);
-  if (!await isAbandonedOwner(observed, ownerPath, staleAfterMs)) return false;
+  if (observed === null) return recoverOwnerlessLock(profile, lockPath, liveness, staleAfterMs);
+  if (!await isAbandonedOwner(observed, ownerPath, liveness, staleAfterMs)) return false;
   await waitForTestBarrier(TEST_LOCK_RECOVERY_BARRIER_DIR, profile);
   const claimPath = (0, import_node_path.join)(lockPath, `.recover-${(0, import_node_crypto.randomUUID)()}.json`);
   let moved = false;
@@ -4828,7 +5003,7 @@ async function recoverStaleLock(profile, lockPath, staleAfterMs) {
   await removeAgedOwnerFiles(lockPath, staleAfterMs);
   return true;
 }
-async function isAbandonedOwner(observed, ownerPath, staleAfterMs) {
+async function isAbandonedOwner(observed, ownerPath, liveness, staleAfterMs) {
   let owner;
   try {
     owner = JSON.parse(observed);
@@ -4836,7 +5011,7 @@ async function isAbandonedOwner(observed, ownerPath, staleAfterMs) {
     owner = null;
   }
   if (typeof owner === "object" && owner !== null && "pid" in owner) {
-    return isStaleOwner(owner, staleAfterMs);
+    return isStaleOwner(owner, liveness, staleAfterMs);
   }
   const modifiedAt = await (0, import_promises.stat)(ownerPath).then(({ mtimeMs }) => mtimeMs, () => Number.NaN);
   return Date.now() - modifiedAt >= staleAfterMs;
@@ -4858,14 +5033,14 @@ async function waitForTestBarrier(environmentName, profile) {
     }
   }
 }
-function isStaleOwner(owner, staleAfterMs) {
+async function isStaleOwner(owner, liveness, staleAfterMs) {
   const now = Date.now();
   const createdAt = typeof owner?.createdAt === "string" ? Date.parse(owner.createdAt) : Number.NaN;
   if (!Number.isFinite(createdAt) || now - createdAt < staleAfterMs) return false;
   if (typeof owner?.pid !== "number" || !Number.isInteger(owner.pid) || owner.pid <= 0) {
     return false;
   }
-  return !isProcessAlive(owner.pid);
+  return !await isRecordedProcessAlive(owner, liveness);
 }
 async function exists(path) {
   try {
@@ -4876,13 +5051,22 @@ async function exists(path) {
     throw error;
   }
 }
-function isProcessAlive(pid) {
+async function isRecordedProcessAlive(owner, acquisition) {
+  const pid = owner.pid;
+  if (typeof pid !== "number" || !Number.isInteger(pid) || pid <= 0) return true;
   try {
     process.kill(pid, 0);
-    return true;
   } catch (error) {
     return !isErrno(error, "ESRCH");
   }
+  if (pid !== process.pid || typeof owner.instanceId !== "string" || !/^[0-9a-f]{8}-(?:[0-9a-f]{4}-){3}[0-9a-f]{12}$/.test(owner.instanceId) || owner.instanceId === processInstanceId) return true;
+  const origin = processOrigin();
+  if (!origin || owner.bootId !== origin.bootId || typeof owner.pidNamespace !== "string" || !/^pid:\[[0-9]+\]$/.test(owner.pidNamespace)) return true;
+  if (owner.pidNamespace === origin.pidNamespace) {
+    return typeof owner.processStartTime !== "string" || !/^[0-9]+$/.test(owner.processStartTime) || owner.processStartTime === origin.processStartTime;
+  }
+  const liveness = parseLiveness(owner.liveness);
+  return liveness === null || await probeLiveness(liveness, acquisition) === "unknown";
 }
 function validateProfileName(profile) {
   if (!profile || profile === "." || profile === ".." || profile.includes("/") || profile.includes("\\") || profile.includes("\0")) {
@@ -4896,13 +5080,15 @@ function isErrno(error, code) {
 function sleep(milliseconds) {
   return new Promise((resolve2) => setTimeout(resolve2, milliseconds));
 }
-var import_node_crypto, import_node_async_hooks, import_promises, import_node_os, import_node_path, DEFAULT_PROFILE, DEFAULT_LOCK_TIMEOUT_MS, DEFAULT_LOCK_RETRY_MS, DEFAULT_STALE_LOCK_MS, TEST_LOCK_CONTENTION_SIGNAL_PATH, PRIVATE_FILE_MODE, PRIVATE_DIR_MODE, TEST_LOCK_RECOVERY_BARRIER_DIR, TEST_LOCK_OWNERLESS_BARRIER_DIR, TEST_LOCK_PUBLISH_BARRIER_DIR, TEST_LOCK_RELEASE_BARRIER_DIR, TEST_LOCK_CLAIM_BARRIER_DIR, TEST_LOCK_CLAIMED_BARRIER_DIR, TEST_LOCK_VERIFIED_BARRIER_DIR, TEST_LOCK_MOVED_BARRIER_DIR, TEST_LOCK_TURN_PUBLISH_BARRIER_DIR, TEST_LOCK_TURN_SETTLE_BARRIER_DIR, TEST_LOCK_TURN_COLLECT_BARRIER_DIR, invocationStateRoot, heldProfileLocks, ProfileLockTimeoutError, ProfileDeletedError, TURN, _a2, relinquishedTurns, MARKER_RETRY_DELAYS_MS, SETTLE_RETRY_MS, SETTLE_RETRIES, NO_HARD_LINK_ERRORS, ABANDONED_CLAIM, RECOVERY_CLAIM, STAGED_OWNER;
+var import_node_crypto, import_node_async_hooks, import_node_fs, import_promises, import_node_net, import_node_os, import_node_path, DEFAULT_PROFILE, DEFAULT_LOCK_TIMEOUT_MS, DEFAULT_LOCK_RETRY_MS, DEFAULT_STALE_LOCK_MS, TEST_LOCK_CONTENTION_SIGNAL_PATH, PRIVATE_FILE_MODE, PRIVATE_DIR_MODE, TEST_LOCK_RECOVERY_BARRIER_DIR, TEST_LOCK_OWNERLESS_BARRIER_DIR, TEST_LOCK_PUBLISH_BARRIER_DIR, TEST_LOCK_RELEASE_BARRIER_DIR, TEST_LOCK_CLAIM_BARRIER_DIR, TEST_LOCK_CLAIMED_BARRIER_DIR, TEST_LOCK_VERIFIED_BARRIER_DIR, TEST_LOCK_MOVED_BARRIER_DIR, TEST_LOCK_TURN_PUBLISH_BARRIER_DIR, TEST_LOCK_TURN_SETTLE_BARRIER_DIR, TEST_LOCK_TURN_COLLECT_BARRIER_DIR, TEST_LOCK_LIVENESS_BARRIER_DIR, invocationStateRoot, heldProfileLocks, _a2, processInstanceId, cachedProcessOrigin, LIVENESS_SOCKET, LIVENESS_PROBE_TIMEOUT_MS, ProfileLockTimeoutError, ProfileDeletedError, TURN, _a3, relinquishedTurns, MARKER_RETRY_DELAYS_MS, SETTLE_RETRY_MS, SETTLE_RETRIES, NO_HARD_LINK_ERRORS, ABANDONED_CLAIM, RECOVERY_CLAIM, STAGED_OWNER;
 var init_state = __esm({
   "src/state.ts"() {
     "use strict";
     import_node_crypto = require("crypto");
     import_node_async_hooks = require("async_hooks");
+    import_node_fs = require("fs");
     import_promises = require("fs/promises");
+    import_node_net = require("net");
     import_node_os = require("os");
     import_node_path = require("path");
     DEFAULT_PROFILE = "default";
@@ -4923,8 +5109,12 @@ var init_state = __esm({
     TEST_LOCK_TURN_PUBLISH_BARRIER_DIR = "TC_TEST_PROFILE_LOCK_TURN_PUBLISH_BARRIER_DIR";
     TEST_LOCK_TURN_SETTLE_BARRIER_DIR = "TC_TEST_PROFILE_LOCK_TURN_SETTLE_BARRIER_DIR";
     TEST_LOCK_TURN_COLLECT_BARRIER_DIR = "TC_TEST_PROFILE_LOCK_TURN_COLLECT_BARRIER_DIR";
+    TEST_LOCK_LIVENESS_BARRIER_DIR = "TC_TEST_PROFILE_LOCK_LIVENESS_BARRIER_DIR";
     invocationStateRoot = processWideContext("tinycloud.operations.invocationStateRoot.v1");
     heldProfileLocks = processWideContext("tinycloud.operations.heldProfileLocks.v2");
+    processInstanceId = globalThis[_a2 = /* @__PURE__ */ Symbol.for("tinycloud.operations.profileLockInstance.v1")] ?? (globalThis[_a2] = (0, import_node_crypto.randomUUID)());
+    LIVENESS_SOCKET = /^\.live-([0-9a-f]+)-([0-9a-f]+)-[0-9a-f]{8}-(?:[0-9a-f]{4}-){3}[0-9a-f]{12}(\.new)?$/;
+    LIVENESS_PROBE_TIMEOUT_MS = 1e3;
     ProfileLockTimeoutError = class extends Error {
       /** `detail` names the cause when it is not simply another process holding the lock. */
       constructor(profile, timeoutMs, detail) {
@@ -4941,7 +5131,7 @@ var init_state = __esm({
       }
     };
     TURN = /^(?:0|[1-9][0-9]*)$/;
-    relinquishedTurns = globalThis[_a2 = /* @__PURE__ */ Symbol.for("tinycloud.operations.relinquishedProfileTurns.v1")] ?? (globalThis[_a2] = /* @__PURE__ */ new Set());
+    relinquishedTurns = globalThis[_a3 = /* @__PURE__ */ Symbol.for("tinycloud.operations.relinquishedProfileTurns.v1")] ?? (globalThis[_a3] = /* @__PURE__ */ new Set());
     MARKER_RETRY_DELAYS_MS = [10, 50, 250];
     SETTLE_RETRY_MS = 1e3;
     SETTLE_RETRIES = 300;