@volter/supercode-health 0.1.19 → 0.1.21

package/lib/drift.mjs

@@ -43,34 +43,48 @@ async function runningInodes(pids) {
 /** `ps`'s start time (`lstart`, as `Tue Oct  6 12:09:42 2026`) in ms, or NaN. */
 const startedMs = (lstart) => Date.parse(String(lstart).trim().replace(/\s+/g, ' ').replace(/^\w{3} /, ''));
 
-/**
- * The running supercode processes (on macOS and Linux) whose install file was written after they started:
- * `[{ pid, command, file, startedAt, installedAt }]`, newest install first. `rows` (ps lines, for a reading without
- * ps) is `pid lstart(5 words) command`.
- */
-export async function staleSupercode({ rows = null } = {}) {
-  const lines = rows ?? String((await run('ps', ['-A', '-ww', '-o', 'pid=,lstart=,command='], { timeoutMs: 10_000 })).stdout ?? '').split('\n');
-  const found = [];
+/** The supercode install processes among `lines` (`pid [ppid tpgid] lstart(5 words) command`), each with the file it runs. */
+function installProcesses(lines, withParent) {
+  const shape = withParent ? /^\s*(\d+)\s+(\d+)\s+(-?\d+)\s+(\w{3}\s+\w{3}\s+\d+\s+[\d:]+\s+\d{4})\s+(.*)$/u : /^\s*(\d+)()()\s+(\w{3}\s+\w{3}\s+\d+\s+[\d:]+\s+\d{4})\s+(.*)$/u;
+  const table = new Map(), found = [];
   for (const line of lines) {
-    const match = /^\s*(\d+)\s+(\w{3}\s+\w{3}\s+\d+\s+[\d:]+\s+\d{4})\s+(.*)$/u.exec(line);
+    const match = shape.exec(line);
     if (!match) continue;
-    const [, pid, lstart, command] = match;
+    const [, pid, ppid, tty, lstart, command] = match;
+    // on a terminal: its terminal has a foreground group (none reads 0 or -1); asking ps the terminal's name costs 0.3 s
+    const row = { pid: Number(pid), ppid: withParent ? Number(ppid) : null, tty: withParent && Number(tty) > 0, lstart, command };
+    table.set(row.pid, row);
     const program = ran(command);
-    if (program) found.push({ pid: Number(pid), lstart, command, ...program });
+    if (program) found.push({ ...row, ...program });
   }
-  // a native is read by the inode it runs, where lsof says it: the strongest reading (a ctime also moves on a chmod)
-  const inodes = rows ? new Map() : await runningInodes(found.filter((row) => row.native).map((row) => row.pid));
-  const stale = [];
-  for (const { pid, lstart, command, file } of found) {
+  return { table, found };
+}
+
+/** Each of `found` with whether the file it runs was replaced after it started, and when that file was last written.
+ *  A native is read by the inode it runs, where lsof says it: the strongest reading (a ctime also moves on a chmod). */
+function judged(found, inodes) {
+  const rows = [];
+  for (const { pid, ppid, tty, lstart, command, file } of found) {
     const started = startedMs(lstart);
     let stat;
     try { stat = statSync(file); } catch { continue; } // a file gone is a removed install, said elsewhere
     const installed = stat.ctimeMs;
-    if (inodes.has(pid)) {
-      if (inodes.get(pid) === stat.ino) continue;
-    } else if (Number.isNaN(started) || installed <= started + 1000) continue; // ps says a start to the second
-    stale.push({ pid: Number(pid), command: command.slice(0, 200), file, startedAt: new Date(started).toISOString(), installedAt: new Date(installed).toISOString() });
+    const stale = inodes.has(pid) ? inodes.get(pid) !== stat.ino : !(Number.isNaN(started) || installed <= started + 1000); // ps says a start to the second
+    rows.push({ pid, ppid, tty, command: command.slice(0, 200), file, startedAt: Number.isNaN(started) ? null : new Date(started).toISOString(), installedAt: new Date(installed).toISOString(), stale });
   }
+  return rows;
+}
+
+/**
+ * The running supercode processes (on macOS and Linux) whose install file was written after they started:
+ * `[{ pid, command, file, startedAt, installedAt }]`, newest install first. `rows` (ps lines, for a reading without
+ * ps) is `pid lstart(5 words) command`.
+ */
+export async function staleSupercode({ rows = null } = {}) {
+  const lines = rows ?? String((await run('ps', ['-A', '-ww', '-o', 'pid=,lstart=,command='], { timeoutMs: 10_000 })).stdout ?? '').split('\n');
+  const { found } = installProcesses(lines, false);
+  const inodes = rows ? new Map() : await runningInodes(found.filter((row) => row.native).map((row) => row.pid));
+  const stale = judged(found, inodes).filter((row) => row.stale).map(({ pid, command, file, startedAt, installedAt }) => ({ pid, command, file, startedAt, installedAt }));
   return moved(stale).sort((a, b) => b.installedAt.localeCompare(a.installedAt));
 }
 
@@ -114,3 +128,122 @@ export function pinnedHomes({ home = null } = {}) {
   }
   return pinned;
 }
+
+/** The service each process is one of, by pid, where the service manager says it: launchd's label for the processes it
+ *  started (this user's domain: one `launchctl list`), a systemd unit from the process's own cgroup. Empty where
+ *  neither answers. */
+async function serviceLabels(pids) {
+  const labels = new Map();
+  if (process.platform === 'darwin') {
+    const listed = await run('/bin/launchctl', ['list'], { timeoutMs: 3000 }).catch(() => null);
+    for (const line of String(listed?.stdout ?? '').split('\n')) {
+      const row = /^(\d+)\s+\S+\s+(\S+)$/u.exec(line);
+      if (row) labels.set(Number(row[1]), `launchd ${row[2]}`);
+    }
+  } else if (process.platform === 'linux') {
+    for (const pid of pids) {
+      try {
+        const unit = readFileSync(`/proc/${pid}/cgroup`, 'utf8').trim().split('\n').pop().split('/').pop();
+        if (unit.endsWith('.service') && !/^user@\d+\.service$/u.test(unit)) labels.set(pid, `systemd ${unit}`);
+      } catch { /* gone, or not ours to read */ }
+    }
+  }
+  return labels;
+}
+
+/**
+ * Every process and every supercode install process of this machine, for the readings that need who started what:
+ * `{ table: Map(pid → { pid, ppid, tty, lstart, command }), running: [{ pid, ppid, tty, command, file, startedAt,
+ * installedAt, stale }], labels: Map(pid → 'launchd <label>' | 'systemd <unit>') }`. `stale` is staleSupercode's reading: the file
+ * the process runs, in the install it runs from, was replaced after it started. `lines` and `labels` stand in for ps
+ * and the service manager (a recorded listing: `pid ppid tpgid lstart command`).
+ */
+export async function supercodeProcesses({ lines = null, labels = null } = {}) {
+  const listed = lines ? null : await run('ps', ['-A', '-ww', '-o', 'pid=,ppid=,tpgid=,lstart=,command='], { timeoutMs: 10_000 });
+  const { table, found } = installProcesses(lines ?? String(listed.stdout ?? '').split('\n'), true);
+  const [inodes, services] = await Promise.all([
+    lines ? new Map() : runningInodes(found.filter((row) => row.native).map((row) => row.pid)),
+    labels ?? serviceLabels(found.map((row) => row.pid).concat(found.map((row) => row.ppid))),
+  ]);
+  const rows = judged(found, inodes);
+  const still = new Set(moved(rows.filter((row) => row.stale)).map((row) => row.pid));
+  return { table, running: rows.map((row) => ({ ...row, stale: row.stale && still.has(row.pid) })), labels: services };
+}
+
+const wordsOf = (command) => String(command ?? '').split(/\s+/u).filter(Boolean);
+const base = (word) => String(word ?? '').split('/').pop();
+/** The script node runs, or the program itself: what a process is, whatever started it. */
+const scriptOf = (command) => { const words = wordsOf(command); return /(^|\/)node$/u.test(words[0] ?? '') ? words.slice(1).find((word) => !word.startsWith('-')) ?? words[0] : words[0]; };
+/** A process as a reading names it: its program and the script it runs, and a `--root` where it has one; never its
+ *  other arguments (a harness's carry a prompt, a command's a path of someone's). */
+function named(command) {
+  const words = wordsOf(command), script = scriptOf(command);
+  const root = words.indexOf('--root');
+  const shown = [base(words[0]), ...(script !== words[0] ? [script] : words[1]?.startsWith('/') ? [words[1]] : [])].join(' ');
+  return `${shown}${root > 0 && words[root + 1] ? ` --root ${words[root + 1]}` : ''}`.slice(0, 240);
+}
+/** What a supercode process does: its script's last two path parts and its verb (the first plain words after it). */
+function doing(command) {
+  const words = wordsOf(command), script = scriptOf(command);
+  const verb = words.slice(words.indexOf(script) + 1).filter((word) => /^[a-z][a-z-]*$/u.test(word)).slice(0, 2).join(' ');
+  return `${script.split('/').slice(-2).join('/')}${verb ? ` ${verb}` : ''}`;
+}
+
+/**
+ * The supercode install processes of a `supercodeProcesses` reading, by what replacing a release asks of each:
+ *
+ * - `helpers`: a process that lives exactly as long as one session and cannot take new code without that session
+ *   starting again (the Codex pane's wrapper, and anything a harness started: its mail MCP server, that server's
+ *   child). Told by where it runs: it is a pane wrapper, or a harness (`sessionPrograms`) or a pane wrapper is above
+ *   it, or it is on a terminal (a pane's or a person's: a harness this list does not name, a command someone runs).
+ *   Running a replaced release is what these do until their session ends; they are counted, never a broken promise.
+ * - `orphans`: a supercode command with no parent left (its parent is the system's first process) that no service
+ *   manager started and that is not the machine's daemon, running longer than `orphanMin`. A stuck command, whatever
+ *   release it runs.
+ * - `services`: every other process running a replaced release: what an install should have restarted (the daemon and
+ *   its children, a board keeper's, another product's service). A process whose parent is one of these too is the same
+ *   service (node and the native it starts). Each names who owns it (the service manager's label of it or of the
+ *   nearest process above it that has one, and its parent), the install its file is in, and since when that file is
+ *   known replaced: `remembered` (`pid:startedAt` → ISO time, a reading before this one) when it is earlier than the
+ *   file's last write, which a later install moves.
+ */
+export function classifyReleaseProcesses({ table, running, labels = new Map() }, { now = Date.now(), sessionPrograms = ['claude', 'codex', 'gemini', 'grok'], daemonPid = null, orphanMin = 30, remembered = {} } = {}) {
+  const isPane = (command) => base(scriptOf(command)) === 'native-codex-pane.mjs';
+  const isHarness = (command) => { const words = wordsOf(command); return sessionPrograms.includes(base(words[0])) || sessionPrograms.includes(base(scriptOf(command))); };
+  const parentless = (row) => { const parent = table.get(row.ppid); return row.ppid === 1 || !parent || base(wordsOf(parent.command)[0]) === 'systemd'; };
+  const above = (row) => { const chain = []; for (let at = table.get(row.ppid), n = 0; at && n < 64; at = table.get(at.ppid), n++) chain.push(at); return chain; };
+  const byPid = new Map(running.map((row) => [row.pid, row]));
+  const kind = new Map();
+  for (const row of running) {
+    if (isPane(row.command) || row.tty || above(row).some((p) => isHarness(p.command) || isPane(p.command))) kind.set(row.pid, 'helper');
+    else if (parentless(row) && !labels.has(row.pid) && row.pid !== daemonPid && row.startedAt && now - Date.parse(row.startedAt) > orphanMin * 60_000) kind.set(row.pid, 'orphan');
+    else if (row.stale) kind.set(row.pid, 'service');
+  }
+  const of = (name) => running.filter((row) => kind.get(row.pid) === name);
+  const helpers = of('helper').filter((row) => row.stale);
+  const orphans = of('orphan').map((row) => ({ pid: row.pid, what: doing(row.command), install: installRoot(row.file), startedAt: row.startedAt, runningMs: now - Date.parse(row.startedAt), stale: row.stale }));
+  const services = new Map();
+  for (const row of of('service')) {
+    let top = row;
+    while (kind.get(top.ppid) === 'service') top = byPid.get(top.ppid);
+    const parent = table.get(top.ppid);
+    const label = labels.get(top.pid) ?? above(top).map((p) => labels.get(p.pid)).find(Boolean) ?? null;
+    const service = services.get(top.pid) ?? { pids: [], what: doing(top.command), owner: [labels.has(top.pid) || !parent || top.ppid === 1 ? null : named(parent.command), label].filter(Boolean).join(', ') || 'no parent and no service manager', install: installRoot(top.file), startedAt: top.startedAt, replacedAt: null };
+    service.pids.push(row.pid);
+    const known = [row.installedAt, remembered[`${row.pid}:${row.startedAt}`]].filter(Boolean).sort()[0];
+    if (!service.replacedAt || known < service.replacedAt) service.replacedAt = known;
+    services.set(top.pid, service);
+  }
+  const listed = [...services.values()].map((service) => ({ ...service, outlivedMs: now - Date.parse(service.replacedAt) })).sort((a, b) => a.replacedAt.localeCompare(b.replacedAt));
+  // what the next reading remembers: every service process's earliest known replacement
+  const remember = {};
+  for (const row of of('service')) { let top = row; while (kind.get(top.ppid) === 'service') top = byPid.get(top.ppid); remember[`${row.pid}:${row.startedAt}`] = services.get(top.pid).replacedAt; }
+  return {
+    helpers: { count: helpers.length, oldest_start: helpers.map((row) => row.startedAt).sort()[0] ?? null, by: tally(helpers.map((row) => doing(row.command))) },
+    orphans, services: listed, remember,
+  };
+}
+
+const tally = (names) => { const counts = {}; for (const name of names) counts[name] = (counts[name] ?? 0) + 1; return counts; };
+/** The install a file is in: the folder that holds the `node_modules` its package was put in. */
+const installRoot = (file) => { const at = file.indexOf('/node_modules/@volter/'); return at > 0 ? file.slice(0, at) : dirname(file); };

package/lib/promises.mjs

@@ -1,7 +1,7 @@
 // The core promises, read live (promises.json is the list). One pass reads every promise at once, each inside its own
 // hard bound, and says of each `true`, `false` or `unknown` with the reading behind it and the milliseconds it took.
 // A pass changes nothing: it reads files, this machine's daemon socket, two process listings, the server's machine
-// list and the installed release's own restart check. Where another program has to be started the reason is beside
+// list, the installed release's own restart check and, on the install's host, two public documents of the npm registry. Where another program has to be started the reason is beside
 // it; nothing here starts a shell to read what a file or a socket answers. No reading carries an environment's values,
 // a credential or a message's text.
 //
@@ -10,6 +10,11 @@
 // zero) and readable there the whole time. The probe (probe.mjs) runs the pass every slow interval and mails a false
 // promise to the `core` addresses on the pass that first reads it false; a release's activation watch runs the same
 // pass once the new daemon serves and compares it with the last pass before it.
+//
+// A pass taken for a release (`since`: when that release's daemon began to serve) counts only what happened under it.
+// A promise that reads an event (a board's last round, a mail's expiry) reads there only events that began at or after
+// `since`: a round that met no daemon while an install restarted it says nothing of the release that came up. Until
+// such an event exists the promise is unknown for that release, never true and never false.
 import { readFileSync, realpathSync, statfsSync, statSync, accessSync, constants } from 'node:fs';
 import { homedir, tmpdir, userInfo } from 'node:os';
 import { delimiter, isAbsolute, join } from 'node:path';
@@ -17,7 +22,7 @@ import { fileURLToPath } from 'node:url';
 import { run } from './run.mjs';
 import { daemonCall, daemonHello } from './mail.mjs';
 import { healthDir, machineName } from './paths.mjs';
-import { staleSupercode } from './drift.mjs';
+import { supercodeProcesses, classifyReleaseProcesses } from './drift.mjs';
 import { harnessMarks } from './markers.mjs';
 
 const json = (file) => { try { return JSON.parse(readFileSync(file, 'utf8')); } catch { return null; } };
@@ -37,10 +42,17 @@ export function promiseList() {
 export const PROMISE_DEFAULTS = Object.freeze({
   mailExpiryMin: 15,       // mail that expired undelivered this recently says delivery is failing now
   staleReleaseHours: 2,    // extrapolated: a service restarts with its install; two hours is past any restart in hand
+  stuckCommandMin: 30,     // extrapolated: no supercode command is known to take this long once its caller is gone (the doors a command waits on are bounded in seconds)
   boardRoundMin: 10,       // extrapolated from a round's own length (about 30 s here) and the maintainer's 5 min line
   diskFreeGB: 5,           // extrapolated: admission's copy of an 800 MB mailbox and an install both need room
   fleetSeenHours: 24,      // a machine silent longer than this is taken to be off, not broken
+  releaseWaitMin: 30,      // measured 2026-10-09/10 over 17 releases: published 2 to 16.5 min after the binary was built, a whole run 16 to 39 min; twice the longest wait
+  releaseReadMin: 5,       // the registry is asked at most this often by one probe
+  releaseWatch: 'board',   // where it is read: 'board' (a machine whose board dispatcher ran in the last 24 h), true, false
+  releasePackage: '@volter/supercode',
+  releaseRegistry: 'https://registry.npmjs.org',
   harnesses: ['codex', 'claude'],
+  sessionPrograms: ['claude', 'codex', 'gemini', 'grok', 'goose', 'opencode', 'openclaw'], // a process under one of these lives as long as its session
   daemonAnswerMs: 6000,    // extrapolated: above the longest step the daemon is known to wait on in one call (a 5 s child)
 });
 
@@ -72,6 +84,94 @@ function installs(name, search) {
   return found;
 }
 
+/** Each service process's earliest known replacement (`pid:startedAt` → ISO time), as this process has read it. */
+const replacedSeen = new Map();
+
+/** The supercode processes by what replacing a release asks of them, read once a pass and shared by the two promises
+ *  that read it. What an earlier pass knew of a service's replacement comes from this process and from the probe's
+ *  snapshot, so it holds across a probe's restart and for a pass taken by hand. */
+function releaseProcesses(context) {
+  context.processes ??= supercodeProcesses().then((reading) => {
+    const kept = json(join(healthDir(context.env), 'latest.json'))?.readings?.promises?.items?.find((item) => item.name === 'no-stale-release')?.detail?.remember ?? {};
+    const remembered = { ...kept };
+    for (const [key, at] of replacedSeen) if (!(remembered[key] <= at)) remembered[key] = at;
+    const daemonPid = json(join(teamsHome(context.env), 'machine.json'))?.pid ?? null;
+    const sorted = classifyReleaseProcesses(reading, { now: context.now, sessionPrograms: context.lines.sessionPrograms, daemonPid, orphanMin: context.lines.stuckCommandMin, remembered });
+    replacedSeen.clear();
+    for (const [key, at] of Object.entries(sorted.remember)) replacedSeen.set(key, at);
+    return sorted;
+  });
+  return context.processes;
+}
+
+/** `a` is a later release than `b` (plain `x.y.z`; a prerelease is read by its numbers). */
+const laterVersion = (a, b) => { const [x, y] = [a, b].map((v) => String(v).split('-')[0].split('.').map(Number)); for (let i = 0; i < 3; i++) if (x[i] !== y[i]) return x[i] > y[i]; return false; };
+
+/**
+ * What the registry shows of a release, judged: `latest` is the version `npm install` of the release's package takes
+ * (the meta package's `latest`; the release workflow publishes it last, only when its checks passed); `built` is the
+ * publish time of each version of the release's binary package (the workflow publishes it under `candidate` once the
+ * build is done, before the checks). A built version later than `latest` is a release that has not reached anyone:
+ * its run is at its checks, or failed there, or stopped. False once the oldest such has waited `waitMin`; measured
+ * from the oldest, so a second failed release behind it does not start the wait again.
+ */
+export function releaseReading({ name, latest, built, now, waitMin }) {
+  const waiting = Object.entries(built ?? {}).filter(([version, at]) => /^\d+\.\d+\.\d+/u.test(version) && typeof at === 'string' && laterVersion(version, latest)).map(([version, at]) => ({ version, built_at: at })).sort((a, b) => a.built_at.localeCompare(b.built_at));
+  const detail = { package: name, latest, waiting, wait_min: waitMin };
+  if (!waiting.length) return yes(`${name}@${latest} is what installs, and no later release is built and waiting`, detail);
+  const since = now - Date.parse(waiting[0].built_at), first = waiting[0], behind = waiting.slice(1).map((w) => w.version);
+  return since > waitMin * 60_000
+    ? no(`${waiting.length} release(s) built and not published: ${waiting.map((w) => w.version).join(', ')}. ${first.version} was built at ${first.built_at}, ${ago(since)} ago (the line is ${waitMin} min: a release that passes its checks is published 2 to 17 min after its build); ${name}@${latest} is still what installs. Its release run failed after the build or is stopped: read the run (gh run list --workflow release.yml)`, detail)
+    : yes(`${name}@${latest} is what installs; ${first.version} was built ${ago(since)} ago and is not published yet${behind.length ? `, with ${behind.join(', ')} behind it` : ''} (the line is ${waitMin} min)`, detail);
+}
+
+/** A registry document, read at most once in `everyMs` by this process and asked again with the tag it came with (an
+ *  unchanged document answers with no body). No credential is sent: a registry that wants one is not read. */
+const registryRead = new Map();
+async function registryJson(url, { everyMs, timeoutMs, now = Date.now() }) {
+  const had = registryRead.get(url);
+  if (had && now - had.at < everyMs) return had.body;
+  const answer = await fetch(url, { headers: { accept: 'application/json', ...(had?.etag ? { 'if-none-match': had.etag } : {}) }, signal: AbortSignal.timeout(timeoutMs) })
+    .catch((error) => { throw new Error(`${new URL(url).host} did not answer within ${timeoutMs / 1000} s (${error.cause?.code ?? error.name})`); });
+  if (answer.status === 304 && had) { had.at = now; return had.body; }
+  if (!answer.ok) throw new Error(`${new URL(url).host} answered ${answer.status} for ${decodeURIComponent(new URL(url).pathname.slice(1))}`);
+  const body = await answer.json();
+  registryRead.set(url, { at: now, etag: answer.headers.get('etag'), body });
+  return body;
+}
+
+/** The board homes of this machine where a dispatcher ended a round in the last `hours`: the install's host is the
+ *  machine that runs its board. */
+function dispatcherHomes(context, hours = 24) {
+  const held = json(join(supercodeHome(context.env), 'board-homes.json')) ?? {};
+  return [...new Set(Object.values(held).filter((value) => typeof value === 'string'))].filter((root) => {
+    const at = Date.parse(json(join(root, 'dispatcher-heartbeat.json'))?.at ?? '');
+    return context.now - at <= hours * 3_600_000;
+  });
+}
+
+/** A kept release's promises that have read true under it (activation time → names), as this process has read them. */
+const releaseHeldSeen = new Map();
+
+/** The promises that have read true under the release activated at `at`: from this process and from the probe's
+ *  snapshot, so it holds across a probe's restart and for a pass taken by hand. */
+function releaseHeld(context, at) {
+  const kept = json(join(healthDir(context.env), 'latest.json'))?.readings?.promises?.items?.find((item) => item.name === 'release-kept')?.detail;
+  return new Set(at == null ? [] : [...(kept?.at_ms === at ? kept.held ?? [] : []), ...(releaseHeldSeen.get(at) ?? [])]);
+}
+
+/** One promise of the list read inside its own bound: past it, or when its probe throws, it is unknown and says so. */
+async function readOne(entry, context) {
+  let timer;
+  const bound = new Promise((resolve) => { timer = setTimeout(() => resolve(unknown(`not read within its ${entry.bound_ms} ms bound`)), entry.bound_ms); });
+  const probe = PROBES[entry.probe];
+  const read = probe ? Promise.resolve().then(() => probe(context)).catch((error) => unknown(`could not be read: ${String(error.message ?? error).split('\n')[0].slice(0, 240)}`))
+    : Promise.resolve(unknown(`this release has no probe named ${entry.probe}`));
+  const result = await Promise.race([read, bound]);
+  clearTimeout(timer);
+  return result;
+}
+
 const PROBES = {
   async server(context) {
     const items = await machineList(context);
@@ -110,7 +210,7 @@ const PROBES = {
     const answer = await daemonCall('harness.v1.mail.expired', {}, { env: context.env, timeoutMs: 1300 });
     if (!Array.isArray(answer?.rows)) return no('the daemon answered its mail door with no list of expiries');
     if (record.mail_ready !== true) return no(`the daemon (pid ${record.pid}) answers and does not serve mail`);
-    const since = context.now - context.lines.mailExpiryMin * 60_000;
+    const since = Math.max(context.now - context.lines.mailExpiryMin * 60_000, context.since ?? 0);
     const recent = answer.rows.filter((row) => Number(row?.expired_at_ms) >= since);
     const reasons = [...new Set(recent.map((row) => String(row.reason ?? 'no reason given').slice(0, 80)))];
     const detail = { pid: record.pid, expired_recently: recent.length, reasons };
@@ -177,37 +277,71 @@ const PROBES = {
       : yes('no terminal window or tmux server carries a child-session mark');
   },
 
+  // What replacing a release asks of a process depends on who started it (drift.mjs classifyReleaseProcesses). A
+  // session's own helpers (its mail MCP server, its Codex pane's wrapper) live as long as the session and are counted;
+  // a service is what an install should have restarted, and is the promise. How long a service has outlived its
+  // release is measured from the earliest reading that found its file replaced, kept from pass to pass (this process's
+  // memory and the last pass in the probe's snapshot): the file's own time moves with every later install, and a
+  // promise measured from it read true again each time another release was installed.
   async stale(context) {
     const line = context.lines.staleReleaseHours * 3_600_000;
-    const stale = await staleSupercode();
-    const over = stale.filter((row) => context.now - Date.parse(row.installedAt) > line);
-    // what each runs, for the name: its program's last two path parts and its verb, never its arguments
-    const named = new Map();
-    for (const row of over) {
-      const words = row.command.split(/\s+/u), node = /(^|\/)node$/u.test(words[0]);
-      const program = (node ? words[1] : words[0]).split('/').slice(-2).join('/');
-      const verb = words.slice(node ? 2 : 1).filter((word) => /^[a-z][a-z-]*$/u.test(word)).slice(0, 2).join(' ');
-      const key = verb ? `${program} ${verb}` : program;
-      named.set(key, (named.get(key) ?? 0) + 1);
+    const { helpers, services, orphans, remember } = await releaseProcesses(context);
+    const over = services.filter((service) => service.outlivedMs > line);
+    const say = (service) => `${service.what} (pid ${service.pids.join(', ')}) of ${service.owner}, from the install at ${service.install}, started ${service.startedAt}, its release replaced at least ${ago(service.outlivedMs)} ago`;
+    const beside = [
+      services.length - over.length ? `${services.length - over.length} service(s) run a release replaced in the last ${context.lines.staleReleaseHours} h` : null,
+      helpers.count ? `${helpers.count} session helper(s) run a replaced release and will until their sessions end (${Object.entries(helpers.by).sort((a, b) => b[1] - a[1]).map(([what, count]) => `${count} ${what}`).join(', ')}; the oldest started ${helpers.oldest_start}): not this promise's` : null,
+    ].filter(Boolean).join('; ');
+    const detail = { services, helpers, stuck: orphans.length, remember };
+    return over.length ? no(`${over.length} service(s) run a release replaced more than ${context.lines.staleReleaseHours} h ago: ${over.map(say).join('; ')}${beside ? `. Beside them: ${beside}` : ''}`, detail)
+      : yes(`no service has outlived its release by ${context.lines.staleReleaseHours} h${beside ? `; ${beside}` : ''}`, detail);
+  },
+
+  // A command whose caller is gone and that still runs: nothing reads its answer and nothing ends it (2026-10-10: a
+  // `teams files put` ran three hours under the system's first process, waiting on a remote daemon that had stopped
+  // answering). It is not a stale release, whichever release it runs, and is said here by itself.
+  async stuck(context) {
+    const { orphans } = await releaseProcesses(context);
+    return orphans.length ? no(`${orphans.length} supercode command(s) have run more than ${context.lines.stuckCommandMin} min with no parent and no service manager: ${orphans.map((o) => `${o.what} (pid ${o.pid}, from ${o.install}, started ${o.startedAt}, ${ago(o.runningMs)} ago)`).join('; ')}`, orphans)
+      : yes(`no supercode command has run more than ${context.lines.stuckCommandMin} min without a parent`);
+  },
+
+  // Two public documents of the npm registry, no credential: the meta package's dist-tags (what installs) and the
+  // binary package's document for this platform (when each version was built). Read where the install's board runs,
+  // unless the config says (`releaseWatch`: true, false, or 'board'): one failed release is one alarm, not one a
+  // machine. Unknown when the registry does not answer; never false for that.
+  async release(context) {
+    const lines = context.lines;
+    if (lines.releaseWatch === false || (lines.releaseWatch !== true && !dispatcherHomes(context).length)) {
+      return yes(`not read on this machine: ${lines.releaseWatch === false ? 'its config turns it off' : 'no board dispatcher ran a round here in the last 24 h, and the install\'s host reads it'}`);
     }
-    const detail = { stale: stale.length, over: over.length, by: Object.fromEntries(named), oldest_start: over.map((row) => row.startedAt).sort()[0] ?? null, pids: over.slice(0, 40).map((row) => row.pid) };
-    return over.length ? no(`${over.length} process(es) still run a release replaced more than ${context.lines.staleReleaseHours} h ago: ${[...named].sort((a, b) => b[1] - a[1]).map(([what, count]) => `${count} ${what}`).join(', ')}; the oldest started ${detail.oldest_start}`, detail)
-      : yes(stale.length ? `${stale.length} process(es) run a release replaced in the last ${context.lines.staleReleaseHours} h, none longer` : 'every supercode process runs the release on disk', detail);
+    const registry = String(lines.releaseRegistry).replace(/\/+$/u, ''), name = lines.releasePackage;
+    const binary = `${name}-cli-${process.platform}-${process.arch}`;
+    const every = { everyMs: lines.releaseReadMin * 60_000, timeoutMs: 4000, now: context.now };
+    const [tags, built] = await Promise.all([
+      registryJson(`${registry}/-/package/${name.replace('/', '%2f')}/dist-tags`, every),
+      registryJson(`${registry}/${binary.replace('/', '%2f')}`, every),
+    ]);
+    if (typeof tags?.latest !== 'string' || !built?.time) return unknown(`${registry} answered no latest for ${name} or no publish times for ${binary}`);
+    return releaseReading({ name, latest: tags.latest, built: built.time, now: context.now, waitMin: lines.releaseWaitMin });
   },
 
   async board(context) {
     const held = json(join(supercodeHome(context.env), 'board-homes.json')) ?? {};
-    const line = context.lines.boardRoundMin * 60_000, rounds = [], broken = [];
+    const line = context.lines.boardRoundMin * 60_000, rounds = [], broken = [], before = [];
     for (const root of new Set(Object.values(held).filter((value) => typeof value === 'string'))) {
       const beat = json(join(root, 'dispatcher-heartbeat.json'));
       if (!beat?.at) continue; // no dispatcher has run a round in this home
       const age = context.now - Date.parse(beat.at);
       const failed = (beat.boards ?? []).reduce((sum, board) => sum + (Number(board.failed) || 0), 0), errors = (beat.errors ?? []).length;
-      rounds.push({ home: root, round: beat.round ?? null, at: beat.at, failed, errors });
+      rounds.push({ home: root, round: beat.round ?? null, began: beat.began ?? null, at: beat.at, failed, errors });
+      // rounds that stopped are false whenever they are read; what a round met is read only of a round begun under `since`
       if (!(age <= line)) broken.push(`${root}: its last round (${beat.round ?? '?'}) ended ${ago(age)} ago`);
+      else if (context.since != null && !(Date.parse(beat.began ?? '') >= context.since)) before.push(`${root}: round ${beat.round ?? '?'} began before the daemon that serves now did`);
       else if (failed || errors) broken.push(`${root}: round ${beat.round ?? '?'} failed ${failed} and raised ${errors} error(s)`);
     }
     if (!rounds.length) return yes('no board dispatcher has run a round on this machine');
+    if (!broken.length && before.length) return unknown(`${before.join('; ')}; no round has begun and ended under it yet`);
     return broken.length ? no(broken.join('; '), rounds) : yes(rounds.map((r) => `${r.home}: round ${r.round ?? '?'} ${ago(context.now - Date.parse(r.at))} ago, failed 0`).join('; '), rounds);
   },
 
@@ -225,6 +359,11 @@ const PROBES = {
       : yes(rows.map((row) => `${row.folder}: ${row.freeGB} GB free`).join('; '), rows);
   },
 
+  // The watch's verdict (activation-watch.mjs) is one pass taken seconds after the daemon served, and is not the last
+  // word on a kept release. A promise it read false there, or could not read yet (a board whose first round under
+  // the release had not ended), is read again here as the watch reads it: under the release's daemon only. False is
+  // the charge; true ends it for this activation, kept from pass to pass (this process's memory and the last pass in
+  // the probe's snapshot) so nothing that fails later under the same release is laid at its activation.
   async activation(context) {
     const verdict = json(join(teamsHome(context.env), 'service', 'last-activation.json'));
     if (!verdict?.state) return yes('no activation is recorded on this machine');
@@ -234,30 +373,47 @@ const PROBES = {
       return no(`${release} was ${verdict.state === 'rolled_back' ? `put back at ${at}; ${verdict.restored?.release ?? 'the release before'} serves` : verdict.state === 'restarted' ? `stopped and started again at ${at}` : `stopped at ${at} and nothing was restored`}: ${verdict.reason ?? verdict.detail ?? 'no reason recorded'}`,
         { state: verdict.state, at_ms: verdict.at_ms ?? null, broken: verdict.promises?.broken ?? [] });
     }
-    const broken = verdict.promises?.broken ?? [];
-    if (broken.length) return no(`${release} was kept at ${at} and broke ${broken.map((b) => b.name).join(', ')}: ${verdict.promises.kept_because ?? 'it was not put back'}`, { state: verdict.state, at_ms: verdict.at_ms ?? null, broken });
-    return yes(`${release} ${verdict.state} at ${at}`);
+    const list = promiseList().promises;
+    const own = (row) => list.find((entry) => entry.name === row.name)?.probe === 'activation';
+    const charged = (verdict.promises?.broken ?? []).filter((row) => !own(row));
+    const awaited = (verdict.promises?.unread ?? []).filter((row) => row.before === 'true' && !own(row));
+    const held = releaseHeld(context, verdict.at_ms ?? null);
+    const under = { ...context, since: verdict.serving_since_ms ?? null };
+    const open = [...charged, ...awaited].filter((row) => !held.has(row.name));
+    const read = await Promise.all(open.map((row) => {
+      const entry = list.find((item) => item.name === row.name);
+      return entry ? readOne(entry, under) : unknown('this release has no promise of that name');
+    }));
+    const broken = [], unread = [];
+    open.forEach((row, i) => {
+      if (read[i].state === 'true') held.add(row.name);
+      else if (read[i].state === 'false') broken.push({ ...row, reading: read[i].reading });
+      else if (charged.includes(row)) broken.push(row); // unread now: what the watch read stands
+      else unread.push(row.name);
+    });
+    releaseHeldSeen.clear();
+    if (verdict.at_ms != null) releaseHeldSeen.set(verdict.at_ms, [...held]);
+    const detail = { state: verdict.state, at_ms: verdict.at_ms ?? null, broken, held: [...held], unread };
+    if (broken.length) return no(`${release} was kept at ${at} and broke ${broken.map((b) => b.name).join(', ')}: ${verdict.promises.kept_because ?? 'it was not put back'}`, detail);
+    const cleared = charged.filter((row) => held.has(row.name)).map((row) => row.name);
+    return yes(`${release} ${verdict.state} at ${at}${cleared.length ? `; ${cleared.join(', ')} read false at its activation and ${cleared.length === 1 ? 'holds' : 'hold'} under it` : ''}${unread.length ? `; ${unread.join(', ')} not read under it yet` : ''}`,
+      charged.length || awaited.length ? detail : undefined);
   },
 };
 
 /**
  * One pass: `{ version, at, machine, ms, items: [{ name, promise, state, reading, detail?, ms, bound_ms, activation }] }`.
  * Every probe runs at once; one that has not answered inside its bound is `unknown` and says so, and the pass ends
- * with the slowest probe. `only` reads some of the list by name.
+ * with the slowest probe. `only` reads some of the list by name. `since` (ms) takes the pass for the release whose
+ * daemon began to serve then: an event that began before it is not read.
  */
-export async function readPromises({ env = process.env, config = {}, machine = null, only = null, now = Date.now() } = {}) {
+export async function readPromises({ env = process.env, config = {}, machine = null, only = null, now = Date.now(), since = null } = {}) {
   const started = performance.now();
-  const context = { env, now, bin: env.SUPERCODE_BIN || 'supercode', machine: machineName(machine || env.SUPERCODE_HEALTH_MACHINE || undefined), lines: { ...PROMISE_DEFAULTS, ...(config.promises ?? {}) }, machines: null };
+  const context = { env, now, since, bin: env.SUPERCODE_BIN || 'supercode', machine: machineName(machine || env.SUPERCODE_HEALTH_MACHINE || undefined), lines: { ...PROMISE_DEFAULTS, ...(config.promises ?? {}) }, machines: null, processes: null };
   const list = promiseList().promises.filter((entry) => !only || only.includes(entry.name));
   const items = await Promise.all(list.map(async (entry) => {
     const t0 = performance.now();
-    let timer;
-    const bound = new Promise((resolve) => { timer = setTimeout(() => resolve(unknown(`not read within its ${entry.bound_ms} ms bound`)), entry.bound_ms); });
-    const probe = PROBES[entry.probe];
-    const read = probe ? Promise.resolve().then(() => probe(context)).catch((error) => unknown(`could not be read: ${String(error.message ?? error).split('\n')[0].slice(0, 240)}`))
-      : Promise.resolve(unknown(`this release has no probe named ${entry.probe}`));
-    const result = await Promise.race([read, bound]);
-    clearTimeout(timer);
+    const result = await readOne(entry, context);
     return { name: entry.name, promise: entry.promise, ...result, ms: Math.round(performance.now() - t0), bound_ms: entry.bound_ms, activation: entry.activation };
   }));
   return { version: 1, at: new Date(now).toISOString(), machine: context.machine, ms: Math.round(performance.now() - started), items };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/supercode-health",
-  "version": "0.1.19",
+  "version": "0.1.21",
   "type": "module",
   "description": "Optional machine pack: a cheap, deterministic probe of a machine's vitals that mails the machine's maintainer when a threshold is crossed. Each feature sits behind its own permission barrier.",
   "license": "MIT",

package/promises.json

@@ -15,13 +15,17 @@
     { "name": "no-harness-marks", "probe": "marks", "bound_ms": 2000, "activation": "report",
       "promise": "No terminal window or tmux server carries a harness's child-session marks, so a session a person starts in one is its own session." },
     { "name": "no-stale-release", "probe": "stale", "bound_ms": 3000, "activation": "report",
-      "promise": "No supercode process has run a release for more than two hours after an install replaced it." },
+      "promise": "No service has run a supercode release for more than two hours after its own install replaced it: the daemon and its children, a board keeper's, another product's. A session's own helpers (its mail MCP server, its Codex pane's wrapper) live as long as the session and are counted, not held to this." },
+    { "name": "no-stuck-command", "probe": "stuck", "bound_ms": 3000, "activation": "report",
+      "promise": "No supercode command has run more than 30 minutes with no parent and no service manager: one that has is stuck, with nothing reading its answer." },
     { "name": "board-round", "probe": "board", "bound_ms": 500, "activation": "report",
       "promise": "Where a board's dispatcher runs, its last round ended in the last ten minutes with nothing failed." },
     { "name": "disk-free", "probe": "disk", "bound_ms": 500, "activation": "report",
       "promise": "The volumes supercode's home, the person's home and the temporary folder are on each have more than 5 GB free." },
-    { "name": "release-kept", "probe": "activation", "bound_ms": 200, "activation": "report",
+    { "name": "release-kept", "probe": "activation", "bound_ms": 7000, "activation": "report",
       "promise": "The last release activated on this machine was kept: it was not put back, and it broke no promise that held before it." },
+    { "name": "release-published", "probe": "release", "bound_ms": 5000, "activation": "report",
+      "promise": "What main last tagged for release is published: no release has been built and waiting more than 30 minutes for the version npm installs to reach it. Read on the install's host, from the public registry." },
     { "name": "fleet-online", "probe": "fleet", "bound_ms": 3000, "activation": "report",
       "promise": "Every other machine enrolled with this server and heard from in the last 24 hours is online now." }
   ]