@vellumai/assistant 0.10.9 → 0.10.10-dev.202607162206.d08e98e

package/src/runtime/routes/publish-routes.ts

@@ -16,7 +16,6 @@ import { z } from "zod";
 import {
   getApp,
   getAppDirPath,
-  isMultifileApp,
   resolveEffectiveAppHtml,
 } from "../../apps/app-store.js";
 import {
@@ -45,23 +44,21 @@ async function handlePublish({ pathParams }: RouteHandlerArgs) {
     throw new NotFoundError(`App not found: ${appId}`);
   }
 
-  // Compile multi-file apps if needed (same pattern as handleOpenApp)
-  if (isMultifileApp(app)) {
-    const appDir = getAppDirPath(appId);
-    const distIndex = join(appDir, "dist", "index.html");
-    if (!existsSync(distIndex)) {
-      const result = await compileApp(appDir);
-      if (!result.ok) {
-        log.warn(
-          { appId, errors: result.errors },
-          "Auto-compile failed before publish",
-        );
-        return {
-          success: false,
-          errorCode: "compile_failed",
-          error: `App failed to compile: ${result.errors?.join("; ") ?? "unknown error"}`,
-        };
-      }
+  // Compile if needed (same pattern as handleOpenApp)
+  const appDir = getAppDirPath(appId);
+  const distIndex = join(appDir, "dist", "index.html");
+  if (!existsSync(distIndex)) {
+    const result = await compileApp(appDir);
+    if (!result.ok) {
+      log.warn(
+        { appId, errors: result.errors },
+        "Auto-compile failed before publish",
+      );
+      return {
+        success: false,
+        errorCode: "compile_failed",
+        error: `App failed to compile: ${result.errors?.join("; ") ?? "unknown error"}`,
+      };
     }
   }
 

package/src/runtime/routes/schedule-worker-routes.ts

@@ -14,6 +14,7 @@ import { z } from "zod";
 import {
   probeScheduleWorker,
   ScheduleWorkerSpawnError,
+  setScheduleWorkerAdministrativelyStopped,
   spawnScheduleWorkerProcess,
   stopScheduleWorkerProcess,
 } from "../../schedule/worker-control.js";
@@ -59,6 +60,10 @@ async function startScheduleWorker() {
     throw new InternalError(message);
   }
 
+  // A successful start clears any prior operator stop so the watchdog resumes
+  // supervising the worker.
+  setScheduleWorkerAdministrativelyStopped(false);
+
   return {
     pid: result.pid,
     alreadyRunning: result.alreadyRunning,
@@ -80,6 +85,10 @@ function stopScheduleWorker() {
     throw new InternalError(message);
   }
 
+  // Mark as administratively stopped so the liveness watchdog does not respawn
+  // the worker the operator just told it to stop (cleared by start / restart).
+  setScheduleWorkerAdministrativelyStopped(true);
+
   return {
     workerWasRunning: before.status === "running",
     ...(before.pid != null ? { pid: before.pid } : {}),

package/src/runtime/routes/secret-routes.ts

@@ -26,6 +26,7 @@ import { clearEmbeddingBackendCache } from "../../persistence/embeddings/embeddi
 import { maybeReseedCapabilitiesAfterManagedCredential } from "../../plugins/defaults/memory/v2/memory-v2-startup.js";
 import { validateAnthropicApiKey } from "../../providers/anthropic/client.js";
 import { validateAtlasCloudApiKey } from "../../providers/atlascloud/client.js";
+import { validateBasetenApiKey } from "../../providers/baseten/client.js";
 import { validateGeminiApiKey } from "../../providers/gemini/client.js";
 import { validateMinimaxApiKey } from "../../providers/minimax/client.js";
 import { validateOpenAIApiKey } from "../../providers/openai/client.js";
@@ -216,6 +217,15 @@ async function handleAddSecret({ body }: RouteHandlerArgs) {
           );
           return { success: false, error: validation.reason };
         }
+      } else if (name === "baseten") {
+        const validation = await validateBasetenApiKey(value);
+        if (!validation.valid) {
+          log.warn(
+            { provider: name, reason: validation.reason },
+            "API key validation failed",
+          );
+          return { success: false, error: validation.reason };
+        }
       }
 
       const stored = await setSecureKeyAsync(

package/src/runtime/routes/telemetry-routes.ts

@@ -2,16 +2,26 @@
  * Route handlers for telemetry lifecycle events.
  *
  * POST /v1/telemetry/lifecycle — record a lifecycle event (app_open, hatch).
- * POST /v1/telemetry/onboarding-research — record the settled result of an
- * onboarding "research me" web-search turn.
+ * POST /v1/telemetry/ingest — record any outbox-backed telemetry event by its
+ * wire `type` + `fields`.
  */
 
 import { z } from "zod";
 
-import { recordOnboardingResearchEvent } from "../../onboarding/onboarding-research-events-store.js";
 import { recordLifecycleEvent } from "../../persistence/lifecycle-events-store.js";
+import { recordTelemetryOutboxEvent } from "../../telemetry/telemetry-events-outbox.js";
+import {
+  getWireFieldsSchema,
+  getWireSchemaForType,
+} from "../../telemetry/telemetry-wire-validation.js";
+import type {
+  OutboxTelemetryEventName,
+  TelemetryEvent,
+} from "../../telemetry/types.js";
+import { OUTBOX_TELEMETRY_EVENT_NAMES } from "../../telemetry/types.js";
 import { getUsageTelemetryReporter } from "../../telemetry/usage-telemetry-reporter.js";
 import { getLogger } from "../../util/logger.js";
+import { APP_VERSION } from "../../version.js";
 import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
 import { BadRequestError } from "./errors.js";
 import type { RouteDefinition, RouteHandlerArgs } from "./types.js";
@@ -20,25 +30,58 @@ const log = getLogger("telemetry-routes");
 
 const VALID_EVENT_NAMES = new Set(["app_open", "hatch"]);
 
-const onboardingResearchClaimSchema = z.object({
-  claim: z.string(),
-  confidence: z.enum(["confident", "maybe", "guessing"]),
-  sources: z.array(z.string()),
-});
-
-const onboardingResearchSuggestionSchema = z.object({
-  suggestion: z.string(),
-  prompt: z.string(),
-});
-
-const onboardingResearchRequestSchema = z.object({
-  conversation_id: z.string().nullable(),
-  status: z.enum(["done", "error"]),
-  claims: z.array(onboardingResearchClaimSchema),
-  suggestions: z.array(onboardingResearchSuggestionSchema),
-  plugins: z.array(z.string()),
-  installed_plugins: z.array(z.string()),
-});
+const ingestDaemonEventIdSchema = z
+  .string()
+  .min(1)
+  .max(128)
+  .optional()
+  .describe(
+    "Optional collapse key: rows sharing an id collapse downstream " +
+      "(e.g. a retried report). Defaults to a fresh per-row id.",
+  );
+
+/**
+ * One request variant per outbox-backed type: `{ type, fields, daemon_event_id? }`
+ * where `fields` is the wire schema for that type minus the daemon-stamped base
+ * fields. Throws at module load if an outbox name has no wire schema (an
+ * impossible drift between the outbox name list and the wire contract).
+ */
+function buildIngestVariant(name: OutboxTelemetryEventName) {
+  const fields = getWireFieldsSchema(name);
+  if (!fields) {
+    throw new Error(`No wire schema for outbox telemetry type "${name}".`);
+  }
+  return z.object({
+    type: z.literal(name),
+    fields: fields.describe(
+      "Wire event fields, excluding the daemon-stamped base fields " +
+        "(type, daemon_event_id, recorded_at, assistant_version).",
+    ),
+    daemon_event_id: ingestDaemonEventIdSchema,
+  });
+}
+
+/**
+ * Request shape for `POST /v1/telemetry/ingest`: a discriminated union over
+ * every outbox-backed event type, each carrying that type's wire `fields`.
+ * Derived from the wire contract, so the generated SDK body is strongly typed
+ * and stays in sync as the wire schemas evolve.
+ */
+const telemetryIngestRequestSchema = z.discriminatedUnion(
+  "type",
+  // `.map` widens to `ZodObject[]`, but `discriminatedUnion` wants a non-empty
+  // tuple. The outbox name list is non-empty, and the RUNTIME schema (not this
+  // static type) is what codegen introspects, so the cast doesn't affect the
+  // emitted OpenAPI/SDK types.
+  OUTBOX_TELEMETRY_EVENT_NAMES.map(buildIngestVariant) as [
+    ReturnType<typeof buildIngestVariant>,
+    ...ReturnType<typeof buildIngestVariant>[],
+  ],
+);
+
+/** Placeholder id satisfying the wire schema's `daemon_event_id` bound during
+ * the up-front validation pass; the real id is stamped at record time. */
+const VALIDATION_PROBE_DAEMON_EVENT_ID = "validation-probe";
 
 function handleRecordLifecycleEvent({ body }: RouteHandlerArgs) {
   const eventName = body?.event_name as string | undefined;
@@ -62,31 +105,85 @@ async function handleTelemetryFlush() {
   if (!reporter) {
     return { flushed: false, reason: "disabled" };
   }
-  await reporter.flush();
-  return { flushed: true };
+  return reporter.flush();
 }
 
-function handleRecordOnboardingResearchEvent({ body }: RouteHandlerArgs) {
-  const parsed = onboardingResearchRequestSchema.safeParse(body);
+/**
+ * Record any outbox-backed telemetry event reported by a client. This is the
+ * generic bridge that exposes the daemon's in-process `recordTelemetryEvent`
+ * recorder to clients over HTTP/IPC — for events the client observes and the
+ * daemon can't detect on its own (e.g. `onboarding_research`).
+ *
+ * Three guarantees before a row lands:
+ *   1. `type` must be an outbox-backed event and `fields` must match that
+ *      type's wire shape — both enforced by the discriminated-union parse. The
+ *      watermark types (`turn`, `llm_usage`, `tool_executed`) are excluded
+ *      structurally: they aren't outbox-backed, so they have no variant.
+ *   2. The assembled event must additionally pass the full wire schema for the
+ *      byte-bound superRefines the request `fields` schema drops (oversize
+ *      claims/suggestions).
+ *   3. Consent is enforced by {@link recordTelemetryOutboxEvent} (the
+ *      `share_analytics` gate), same as every daemon-internal emitter.
+ *
+ * An optional `daemon_event_id` lets the client supply a collapse key (e.g. a
+ * refresh-retried report reusing a conversation-scoped id); it defaults to the
+ * fresh row id. A `conversation_id` field on the event is threaded into the
+ * outbox row's dedicated column so pending rows redact on conversation deletion
+ * via the indexed delete.
+ */
+function handleTelemetryIngest({ body }: RouteHandlerArgs) {
+  const parsed = telemetryIngestRequestSchema.safeParse(body);
   if (!parsed.success) {
     throw new BadRequestError(parsed.error.message);
   }
+  const { type, fields, daemon_event_id: daemonEventId } = parsed.data;
 
-  const event = recordOnboardingResearchEvent({
-    conversationId: parsed.data.conversation_id,
-    status: parsed.data.status,
-    claims: parsed.data.claims,
-    suggestions: parsed.data.suggestions,
-    plugins: parsed.data.plugins,
-    installedPlugins: parsed.data.installed_plugins,
+  // `type` matched a union variant (an outbox-backed event), so a wire schema
+  // is guaranteed — its absence is an invariant breach, not a client error.
+  const wireSchema = getWireSchemaForType(type);
+  if (!wireSchema) {
+    throw new Error(`No wire schema registered for outbox type "${type}".`);
+  }
+
+  // Re-validate the assembled event against the full wire schema for the
+  // byte-bound superRefines the request `fields` schema drops. Up front (with
+  // placeholder base values) so an oversize payload 400s regardless of consent.
+  // The `.trim()`-transformed parse output is discarded: `fields` are recorded
+  // verbatim, matching pre-flush validation's non-mutating contract.
+  const validation = wireSchema.safeParse({
+    ...fields,
+    type,
+    daemon_event_id: daemonEventId ?? VALIDATION_PROBE_DAEMON_EVENT_ID,
+    recorded_at: 0,
+    assistant_version: APP_VERSION,
   });
+  if (!validation.success) {
+    throw new BadRequestError(validation.error.message);
+  }
+
+  const conversationId =
+    "conversation_id" in fields && typeof fields.conversation_id === "string"
+      ? fields.conversation_id
+      : null;
+
+  const event = recordTelemetryOutboxEvent(
+    type,
+    (id, createdAt): TelemetryEvent =>
+      // Base fields stamped after the spread so a `fields` payload carrying a
+      // base key can never override the daemon's stamp.
+      ({
+        ...fields,
+        type,
+        daemon_event_id: daemonEventId ?? id,
+        recorded_at: createdAt,
+        assistant_version: APP_VERSION,
+      }) as TelemetryEvent,
+    { conversationId },
+  );
   if (!event) {
     return { skipped: true };
   }
-  log.info(
-    { eventId: event.id, claimCount: parsed.data.claims.length },
-    "Recorded onboarding-research event",
-  );
+  log.info({ type, eventId: event.id }, "Recorded client telemetry event");
 
   return { id: event.id };
 }
@@ -134,7 +231,14 @@ export const ROUTES: RouteDefinition[] = [
       "Force-flush the telemetry events owned by the assistant process (turn events) to the platform. Other event types are flushed on their own cycle by the resource monitor process.",
     tags: ["telemetry"],
     responseBody: z.union([
-      z.object({ flushed: z.literal(true) }),
+      z.object({
+        flushed: z.literal(true),
+        sent: z.number().describe("Events POSTed to the platform"),
+        persisted: z.number().describe("Events the platform confirmed written"),
+        dropped: z
+          .number()
+          .describe("Events that did not land (sent - persisted)"),
+      }),
       z.object({
         flushed: z.literal(false),
         reason: z.string(),
@@ -143,28 +247,28 @@ export const ROUTES: RouteDefinition[] = [
     handler: handleTelemetryFlush,
   },
   {
-    operationId: "telemetry_onboarding_research",
-    endpoint: "telemetry/onboarding-research",
+    operationId: "telemetry_ingest",
+    endpoint: "telemetry/ingest",
     method: "POST",
     policy: {
       requiredScopes: ["settings.write"],
       allowedPrincipalTypes: ACTOR_PRINCIPALS,
     },
-    summary: "Record onboarding-research event",
+    summary: "Record an outbox-backed telemetry event",
     description:
-      'Record the settled result of an onboarding "research me" web-search turn (claims, suggestions, and plugin picks). Client-orchestrated: the web client reports this once it has observed the turn complete. Gated on share_diagnostics consent (in addition to share_analytics) since the payload carries the model\'s raw inferred claims about the user.',
+      "Record any outbox-backed telemetry event by its wire `type` + `fields`. For events a client observes and the daemon can't detect on its own (e.g. onboarding_research). The type must be an outbox-backed event — the watermark types (turn, llm_usage, tool_executed) have no variant — and the payload must pass the platform wire schema. Gated on share_analytics consent like every other outbox-backed event; the platform re-checks the owner's consent server-side at ingest.",
     tags: ["telemetry"],
-    requestBody: onboardingResearchRequestSchema,
+    requestBody: telemetryIngestRequestSchema,
     responseBody: z.union([
       z.object({ id: z.string().describe("Event ID") }),
       z.object({
         skipped: z
           .literal(true)
           .describe(
-            "Event skipped: usage data collection or diagnostics consent is disabled/ineligible",
+            "Event skipped: usage data collection is disabled or the telemetry database is unavailable",
           ),
       }),
     ]),
-    handler: handleRecordOnboardingResearchEvent,
+    handler: handleTelemetryIngest,
   },
 ];

package/src/schedule/__tests__/schedule-timezone.test.ts

@@ -0,0 +1,101 @@
+import { afterEach, describe, expect, mock, test } from "bun:test";
+
+let mockUi: {
+  userTimezone?: string | null;
+  detectedTimezone?: string | null;
+} = {};
+
+mock.module("../../config/loader.js", () => ({
+  getConfigReadOnly: () => ({ ui: mockUi }),
+}));
+
+const { resolveScheduleTimezone, expressionCarriesOwnTimezone } =
+  await import("../schedule-timezone.js");
+
+afterEach(() => {
+  mockUi = {};
+});
+
+describe("resolveScheduleTimezone", () => {
+  test("an explicit value wins and is canonicalized", () => {
+    mockUi = { userTimezone: "America/New_York" };
+    expect(resolveScheduleTimezone("America/Los_Angeles")).toBe(
+      "America/Los_Angeles",
+    );
+  });
+
+  test("falls back to the configured user timezone (beats detected)", () => {
+    mockUi = {
+      userTimezone: "America/New_York",
+      detectedTimezone: "America/Chicago",
+    };
+    expect(resolveScheduleTimezone(null)).toBe("America/New_York");
+  });
+
+  test("falls back to the detected timezone when no user timezone is set", () => {
+    mockUi = { detectedTimezone: "America/Chicago" };
+    expect(resolveScheduleTimezone(undefined)).toBe("America/Chicago");
+  });
+
+  test("returns null when nothing is known (host-local is preserved)", () => {
+    mockUi = {};
+    expect(resolveScheduleTimezone(null)).toBeNull();
+  });
+
+  test("ignores an invalid explicit value and falls back", () => {
+    mockUi = { userTimezone: "America/New_York" };
+    expect(resolveScheduleTimezone("Not/AZone")).toBe("America/New_York");
+  });
+});
+
+describe("expressionCarriesOwnTimezone", () => {
+  test("cron never carries its own zone", () => {
+    expect(expressionCarriesOwnTimezone("cron", "30 8 * * *")).toBe(false);
+  });
+
+  test("a plain RRULE does not carry its own zone", () => {
+    expect(expressionCarriesOwnTimezone("rrule", "FREQ=DAILY;BYHOUR=8")).toBe(
+      false,
+    );
+  });
+
+  test("an RRULE with embedded DTSTART;TZID carries its own zone (not clobbered)", () => {
+    expect(
+      expressionCarriesOwnTimezone(
+        "rrule",
+        "DTSTART;TZID=America/Chicago:20240101T083000\nRRULE:FREQ=DAILY",
+      ),
+    ).toBe(true);
+  });
+
+  test("an RRULE with a Z-anchored UTC DTSTART carries its own zone", () => {
+    expect(
+      expressionCarriesOwnTimezone(
+        "rrule",
+        "DTSTART:20240101T083000Z\nRRULE:FREQ=DAILY",
+      ),
+    ).toBe(true);
+  });
+
+  test("an RRULE set-construct is treated as carrying its own zone", () => {
+    // rrulestr does not thread a caller-supplied tzid into a constructed
+    // RRuleSet, so resolving a zone for a set-construct would not change firing;
+    // we therefore leave the timezone field alone for these.
+    expect(
+      expressionCarriesOwnTimezone(
+        "rrule",
+        "RRULE:FREQ=DAILY\nRDATE:20240101T083000",
+      ),
+    ).toBe(true);
+  });
+
+  // Deeper guarantee behind the set-construct exclusion above: the recurrence
+  // engine's computeNextRunAt must not shift when a set-construct expression is
+  // given an explicit timezone (proving the field genuinely has no effect, so a
+  // future rrule upgrade that changes this is caught). Convert to a real test
+  // when a set-construct fixture with a known epoch is added.
+  test.todo(
+    "computeNextRunAt is unaffected by an explicit tz on a set-construct expression",
+    () => {},
+  );
+});

package/src/schedule/__tests__/worker-watchdog.test.ts

@@ -0,0 +1,209 @@
+import { describe, expect, test } from "bun:test";
+
+import {
+  createWorkerSupervisor,
+  type WorkerProcessStatus,
+} from "../../util/worker-process.js";
+
+const RUNNING: WorkerProcessStatus = { status: "running", pid: 100 };
+const NOT_RUNNING: WorkerProcessStatus = { status: "not_running" };
+
+describe("createWorkerSupervisor", () => {
+  test("does not respawn a running worker", async () => {
+    let respawns = 0;
+    const sup = createWorkerSupervisor({
+      label: "t",
+      probe: () => RUNNING,
+      respawn: async () => {
+        respawns++;
+        return { pid: 1, alreadyRunning: false };
+      },
+    });
+
+    await sup.ensureAlive();
+
+    expect(respawns).toBe(0);
+  });
+
+  test("respawns a dead worker and fires onRespawn with the pid", async () => {
+    let respawns = 0;
+    let respawnedPid: number | undefined;
+    const sup = createWorkerSupervisor({
+      label: "t",
+      probe: () => NOT_RUNNING,
+      respawn: async () => {
+        respawns++;
+        return { pid: 42, alreadyRunning: false };
+      },
+      onRespawn: (pid) => {
+        respawnedPid = pid;
+      },
+    });
+
+    await sup.ensureAlive();
+
+    expect(respawns).toBe(1);
+    expect(respawnedPid).toBe(42);
+  });
+
+  test("does not fire onRespawn when the worker was already running", async () => {
+    let onRespawnCalls = 0;
+    const sup = createWorkerSupervisor({
+      label: "t",
+      probe: () => NOT_RUNNING,
+      respawn: async () => ({ pid: 42, alreadyRunning: true }),
+      onRespawn: () => {
+        onRespawnCalls++;
+      },
+    });
+
+    await sup.ensureAlive();
+
+    expect(onRespawnCalls).toBe(0);
+  });
+
+  test("backs off after a failed respawn and skips attempts within the window", async () => {
+    let respawns = 0;
+    const sup = createWorkerSupervisor({
+      label: "t",
+      probe: () => NOT_RUNNING,
+      respawn: async () => {
+        respawns++;
+        throw new Error("spawn failed");
+      },
+      minBackoffMs: 1000,
+      maxBackoffMs: 10_000,
+    });
+
+    await sup.ensureAlive(0); // attempt 1 fails → nextAttemptAt = 1000
+    expect(respawns).toBe(1);
+    await sup.ensureAlive(500); // within backoff → skipped
+    expect(respawns).toBe(1);
+    await sup.ensureAlive(1500); // past backoff → attempt 2
+    expect(respawns).toBe(2);
+  });
+
+  test("fires onPersistentFailure exactly once at the threshold", async () => {
+    let persistentCalls = 0;
+    const sup = createWorkerSupervisor({
+      label: "t",
+      probe: () => NOT_RUNNING,
+      respawn: async () => {
+        throw new Error("nope");
+      },
+      minBackoffMs: 1,
+      maxBackoffMs: 1,
+      persistentFailureThreshold: 3,
+      onPersistentFailure: () => {
+        persistentCalls++;
+      },
+    });
+
+    await sup.ensureAlive(0); // fail 1
+    await sup.ensureAlive(10); // fail 2
+    await sup.ensureAlive(20); // fail 3 → fires
+    await sup.ensureAlive(30); // fail 4 → no additional fire
+
+    expect(persistentCalls).toBe(1);
+  });
+
+  test("a later successful respawn resets the failure counters", async () => {
+    let mode: "fail" | "ok" = "fail";
+    let persistentCalls = 0;
+    const sup = createWorkerSupervisor({
+      label: "t",
+      probe: () => NOT_RUNNING,
+      respawn: async () => {
+        if (mode === "fail") {
+          throw new Error("nope");
+        }
+        return { pid: 7, alreadyRunning: false };
+      },
+      minBackoffMs: 1,
+      maxBackoffMs: 1,
+      persistentFailureThreshold: 2,
+      onPersistentFailure: () => {
+        persistentCalls++;
+      },
+    });
+
+    await sup.ensureAlive(0); // fail 1
+    mode = "ok";
+    await sup.ensureAlive(10); // success → resets counter
+    mode = "fail";
+    await sup.ensureAlive(20); // fail 1 again (counter was reset)
+
+    expect(persistentCalls).toBe(0);
+  });
+
+  test("does not respawn while suppressed (operator stop)", async () => {
+    let respawns = 0;
+    let suppressed = true;
+    const sup = createWorkerSupervisor({
+      label: "t",
+      probe: () => NOT_RUNNING,
+      respawn: async () => {
+        respawns++;
+        return { pid: 1, alreadyRunning: false };
+      },
+      isSuppressed: () => suppressed,
+    });
+
+    await sup.ensureAlive();
+    expect(respawns).toBe(0);
+
+    suppressed = false;
+    await sup.ensureAlive();
+    expect(respawns).toBe(1);
+  });
+
+  test("dispose mid-respawn kills the child that resolves after disposal", async () => {
+    let releaseRespawn: () => void = () => {};
+    const respawnGate = new Promise<void>((resolve) => {
+      releaseRespawn = resolve;
+    });
+    let killedPid: number | undefined;
+    const sup = createWorkerSupervisor({
+      label: "t",
+      probe: () => NOT_RUNNING,
+      respawn: async () => {
+        await respawnGate;
+        return { pid: 99, alreadyRunning: false };
+      },
+      killChild: (pid) => {
+        killedPid = pid;
+      },
+    });
+
+    const inflight = sup.ensureAlive(); // starts respawn, awaits the gate
+    sup.dispose(); // dispose while the respawn is in flight
+    releaseRespawn(); // respawn resolves now
+    await inflight;
+
+    expect(killedPid).toBe(99);
+  });
+
+  test("concurrent ensureAlive calls do not double-spawn", async () => {
+    let respawns = 0;
+    let releaseRespawn: () => void = () => {};
+    const gate = new Promise<void>((resolve) => {
+      releaseRespawn = resolve;
+    });
+    const sup = createWorkerSupervisor({
+      label: "t",
+      probe: () => NOT_RUNNING,
+      respawn: async () => {
+        respawns++;
+        await gate;
+        return { pid: 1, alreadyRunning: false };
+      },
+    });
+
+    const a = sup.ensureAlive();
+    const b = sup.ensureAlive(); // skipped by the inFlight guard
+    releaseRespawn();
+    await Promise.all([a, b]);
+
+    expect(respawns).toBe(1);
+  });
+});