@volter/supercode-orchestrator 0.5.215 → 0.5.216

package/daemon-control.mjs

@@ -0,0 +1,275 @@
+// Incarnation-bound local lifecycle door. A lease PID is never stop authority.
+import { randomBytes, createHash } from "node:crypto";
+import { chmodSync, readFileSync, realpathSync, unlinkSync } from "node:fs";
+import { createConnection, createServer } from "node:net";
+import { join } from "node:path";
+import { thisHost, LOCK_FILE } from "./lease.mjs";
+
+const LIMIT = 16 * 1024;
+const identityFields = [
+	"pid",
+	"started_at",
+	"root",
+	"host",
+	"boot",
+	"incarnation",
+	"launch_request",
+];
+export const newDaemonIncarnation = () => randomBytes(32).toString("hex");
+export function sameDaemon(a, b) {
+	return (
+		!!a &&
+		!!b &&
+		identityFields.every((key) => (a[key] ?? null) === (b[key] ?? null))
+	);
+}
+function selected(root, lease) {
+	const home = realpathSync(root);
+	const here = thisHost();
+	if (
+		!lease ||
+		!Number.isSafeInteger(lease.pid) ||
+		lease.pid <= 0 ||
+		typeof lease.started_at !== "string" ||
+		lease.root !== home ||
+		lease.host !== here.host ||
+		(lease.boot ?? null) !== here.boot ||
+		typeof lease.incarnation !== "string" ||
+		!/^[a-f0-9]{64}$/.test(lease.incarnation)
+	) {
+		throw new Error(
+			"orchestrator stop refused: lease has no bound local daemon incarnation for this home",
+		);
+	}
+	return home;
+}
+function endpoint(root, lease) {
+	const key = createHash("sha256")
+		.update(root)
+		.update("\0")
+		.update(lease.incarnation)
+		.digest("hex")
+		.slice(0, 24);
+	if (process.platform === "win32")
+		return `\\\\.\\pipe\\supercode-orchestrator-${key}`;
+	const path = join(root, `oc-${key}.sock`);
+	if (Buffer.byteLength(path) > (process.platform === "darwin" ? 103 : 107))
+		throw new Error(
+			"orchestrator control socket path is too long; select a shorter home path",
+		);
+	return path;
+}
+function current(root) {
+	return JSON.parse(readFileSync(join(root, LOCK_FILE), "utf8"));
+}
+
+/** The daemon alone clears its exact issued record while it still holds the home lock. */
+export function clearDaemonLease(root, lease) {
+	if (!sameDaemon(current(root), lease))
+		throw new Error("orchestrator lease changed; replacement record preserved");
+	unlinkSync(join(root, LOCK_FILE));
+}
+
+/** No fallback signal or lease write, including on cancellation or an unknown result. */
+async function requestDaemonControl(
+	root,
+	lease,
+	op,
+	{ signal, timeoutMs = 5000 } = {},
+) {
+	const home = selected(root, lease);
+	if (!sameDaemon(current(home), lease))
+		throw new Error("orchestrator stop refused: selected lease changed");
+	signal?.throwIfAborted();
+	return new Promise((resolve, reject) => {
+		const socket = createConnection(endpoint(home, lease));
+		let bytes = Buffer.alloc(0),
+			sent = false,
+			finished = false;
+		const finish = (error, receipt) => {
+			if (finished) return;
+			finished = true;
+			clearTimeout(timer);
+			signal?.removeEventListener("abort", abort);
+			socket.destroy();
+			if (error)
+				reject(
+					new Error(
+						`orchestrator ${op} ${sent ? "outcome unknown" : "refused before request"} (${lease.incarnation}): ${error.message}`,
+						{ cause: error },
+					),
+				);
+			else resolve(receipt);
+		};
+		const abort = () => finish(signal.reason ?? new Error("cancelled"));
+		const timer = setTimeout(
+			() =>
+				finish(
+					new Error("daemon control deadline expired; no automatic retry"),
+				),
+			timeoutMs,
+		);
+		signal?.addEventListener("abort", abort, { once: true });
+		socket.on("error", (error) => finish(error));
+		socket.on("close", () =>
+			finish(
+				new Error(
+					"daemon control closed without a matching completion receipt",
+				),
+			),
+		);
+		socket.on("connect", () => {
+			try {
+				signal?.throwIfAborted();
+				if (!sameDaemon(current(home), lease))
+					throw new Error("selected lease changed before request");
+				sent = true;
+				socket.write(`${JSON.stringify({ version: 1, op, lease })}\n`);
+			} catch (error) {
+				finish(error);
+			}
+		});
+		socket.on("data", (chunk) => {
+			bytes = Buffer.concat([bytes, chunk]);
+			if (bytes.length > LIMIT)
+				return finish(new Error("oversized daemon control receipt"));
+			const end = bytes.indexOf(10);
+			if (end < 0) return;
+			try {
+				const receipt = JSON.parse(bytes.subarray(0, end).toString("utf8"));
+				if (
+					receipt.version !== 1 ||
+					!sameDaemon(receipt.daemon, lease) ||
+					!(
+						op === "describe"
+							? ["running", "refused"]
+							: ["stopped", "failed", "refused"]
+					).includes(receipt.status) ||
+					!Array.isArray(receipt.errors) ||
+					receipt.errors.some((error) => typeof error !== "string")
+				)
+					throw new Error("invalid daemon control receipt");
+				finish(null, receipt);
+			} catch (error) {
+				finish(error);
+			}
+		});
+	});
+}
+export const requestDaemonStop = (root, lease, options) =>
+	requestDaemonControl(root, lease, "stop", options);
+export const describeDaemon = (root, lease, options) =>
+	requestDaemonControl(root, lease, "describe", options);
+
+/** Separate from the model bridge: its response survives closing that bridge. */
+export async function startDaemonControl({ root, lease, stop, complete }) {
+	const home = selected(root, lease),
+		path = endpoint(home, lease);
+	const sockets = new Map(),
+		tasks = new Set();
+	let closing = null,
+		stopping = false;
+	const server = createServer((socket) => {
+		sockets.set(socket, false);
+		socket.setTimeout(5000, () => socket.destroy());
+		socket.on("error", () => {});
+		socket.on("close", () => sockets.delete(socket));
+		let bytes = Buffer.alloc(0),
+			handled = false;
+		socket.on("data", (chunk) => {
+			if (handled) return;
+			bytes = Buffer.concat([bytes, chunk]);
+			if (bytes.length > LIMIT) {
+				handled = true;
+				socket.destroy();
+				return;
+			}
+			const end = bytes.indexOf(10);
+			if (end < 0) return;
+			handled = true;
+			let request;
+			try {
+				request = JSON.parse(bytes.subarray(0, end).toString("utf8"));
+				// Final admission is synchronous, against this process's immutable issuance
+				// and the home's current record; another PID's liveness never participates.
+				if (
+					closing ||
+					(stopping && request.op === "describe") ||
+					request.version !== 1 ||
+					!["stop", "describe"].includes(request.op) ||
+					!sameDaemon(request.lease, lease) ||
+					!sameDaemon(current(home), lease)
+				)
+					throw new Error(
+						"selected daemon incarnation is not the current home owner",
+					);
+			} catch (error) {
+				socket.end(
+					`${JSON.stringify({ version: 1, daemon: lease, status: "refused", errors: [error.message] })}\n`,
+				);
+				return;
+			}
+			if (request.op === "describe") {
+				socket.end(
+					`${JSON.stringify({ version: 1, daemon: lease, status: "running", errors: [] })}\n`,
+				);
+				return;
+			}
+			sockets.set(socket, true);
+			socket.setTimeout(0);
+			stopping = true;
+			const task = (async () => {
+				const receipt = await stop("control");
+				await new Promise((done) => {
+					if (socket.destroyed) return done();
+					socket.once("close", done);
+					socket.end(`${JSON.stringify(receipt)}\n`, () => {
+						socket.destroy();
+						done();
+					});
+				});
+			})();
+			tasks.add(task);
+			// Completion owns process exit, after every admitted response has flushed.
+			void task
+				.finally(() => {
+					tasks.delete(task);
+					setImmediate(complete);
+				})
+				.catch(() => {});
+		});
+	});
+	await new Promise((resolve, reject) => {
+		server.once("error", reject);
+		server.listen(path, () => {
+			server.removeListener("error", reject);
+			resolve();
+		});
+	});
+	try {
+		if (process.platform !== "win32") chmodSync(path, 0o600);
+	} catch (error) {
+		server.close();
+		throw error;
+	}
+	return {
+		close() {
+			// biome-ignore lint/suspicious/noAssignInExpressions: retain and return the single owned close barrier.
+			return (closing ??= (async () => {
+				const closed = new Promise((resolve, reject) =>
+					server.close((error) => (error ? reject(error) : resolve())),
+				);
+				for (const [socket, admitted] of sockets)
+					if (!admitted) socket.destroy();
+				const results = await Promise.allSettled([...tasks]);
+				await closed;
+				const errors = results
+					.filter((row) => row.status === "rejected")
+					.map((row) => row.reason);
+				if (errors.length)
+					throw new AggregateError(errors, "daemon control completion failed");
+				// net.Server removes its own Unix socket; no unlink of another incarnation.
+			})());
+		},
+	};
+}

package/hermes-locks.mjs

@@ -113,10 +113,13 @@ function writeRecord(file, record, flag) {
   try { writeSync(fd, JSON.stringify(record)); } finally { closeSync(fd); }
 }
 
-/** Release a token's scoped lock this process holds (Hermes's `release_scoped_lock`). */
+/** Release this process's token claim; absence is settled, other failures remain failures. */
 export function releaseTokenLock({ scope, identity, env = process.env }) {
   const file = join(tokenLockDir(env), `${scope}-${scopeHash(identity)}.lock`);
-  try { if (Number(JSON.parse(readFileSync(file, 'utf8')).pid) === process.pid) unlinkSync(file); } catch { /* gone */ }
+  try {
+    if (Number(JSON.parse(readFileSync(file, 'utf8')).pid) !== process.pid) throw new Error('token lock changed owner; retained');
+    unlinkSync(file);
+  } catch (error) { if (error.code !== 'ENOENT') throw error; }
 }
 
 // The flock itself: Node has none, so a small Python child takes it, writes Hermes's record naming
@@ -150,13 +153,20 @@ function holdFileLock(path, home, { python, what, tail }) {
       child = spawn(python, ['-c', HOLDER, path, JSON.stringify(pidRecord(home))], { stdio: ['pipe', 'pipe', 'inherit'] });
     } catch (error) { fail(new Error(`cannot hold ${path}: ${error.message}`)); return; }
     let out = '';
+    const ended = new Promise(resolve => child.once('close', (code, signal) => resolve({ code, signal })));
+    child.stdin.on('error', () => {}); // release joins the actual holder exit below
+    let releasing = null;
     child.on('error', (error) => fail(new Error(`cannot hold ${path} (${python}: ${error.message}); a home is served by one runtime, and this one could not claim it`)));
     child.stdout.on('data', (chunk) => {
       out += chunk;
       if (!out.includes('\n')) return;
       const line = out.split('\n')[0];
       if (line === 'ok') {
-        done({ release: () => { try { child.stdin.end(); } catch { /* gone */ } } });
+        done({ release: () => releasing ??= (async () => {
+          child.stdin.end();
+          const result = await ended;
+          if (result.code !== 0) throw new Error(`lock holder for ${path} exited ${result.code ?? result.signal}`);
+        })() });
       } else {
         let holder = null;
         try { holder = JSON.parse(line.slice('held '.length)); } catch { /* unreadable record */ }

package/index.d.ts

@@ -145,8 +145,8 @@ export type ChatType = 'dm' | 'group' | 'channel' | 'thread';
 
 export interface RuntimeState {
   leases: Record<string, { runtime_id: string; connection: string | null; since: Instant }>;
-  queues: Record<string, { text: string; at: Instant; context_from?: string[] | null; skills?: string[]; job_id?: string }[]>;
-  turns: Record<string, { started_at: Instant; buffer: string }>;
+  queues: Record<string, { text: string; at: Instant; context_from?: string[] | null; skills?: string[]; job_id?: string; webhook_input_id?: string }[]>;
+  turns: Record<string, { started_at: Instant; buffer: string; webhook_input_id?: string }>;
   starting: Record<string, unknown>;
   /** The last worker event per lease (§4.3's inactivity limit). */
   activity: Record<string, Instant>;
@@ -166,6 +166,7 @@ export type WorkerEvent =
   | { kind: 'text'; delta: string }
   /** Any other runtime event (a tool call, reasoning, a turn start): the worker is alive. */
   | { kind: 'activity' }
+  | { kind: 'steer_refused'; text: string; webhook_input_id?: string | null }
   | { kind: 'final'; text: string | null; outcome?: 'completed' | 'error'; message?: string | null }
   | { kind: 'request'; id: string; subject: string; options: RequestOption[] }
   | { kind: 'ended'; reason: string }
@@ -187,7 +188,8 @@ export type OrchestratorEvent =
   | { type: 'worker'; profile: ProfileName; keyString: string; runtime_id: string | null; ev: WorkerEvent; at: Instant }
   | { type: 'adapter'; platform: Platform; state: 'up' | 'down'; error: string | null; at: Instant }
   | { type: 'operator'; verb: string; profile: ProfileName; args: Record<string, unknown>; at: Instant }
-  | { type: 'webhook'; name: string; payload: JsonValue; verified: boolean; at: Instant; event: string | null; delivery_id: string | null }
+  | { type: 'webhook'; name: string; payload: JsonValue; verified: boolean; at: Instant; event: string | null; delivery_id: string | null; admission_id?: string }
+  | { type: 'webhook_refused'; name: string; delivery_id: string | null; admission_id: string; profile?: ProfileName; keyString?: string; handed: boolean; stopping: boolean; at: Instant }
   | { type: 'restart'; at: Instant }
   | { type: 'stopping'; at: Instant };
 
@@ -197,7 +199,8 @@ export type Effect =
   | { type: 'execute_job'; profile: ProfileName; job_id: string; fire_id: string }
   | { type: 'runtime_start'; profile: ProfileName; keyString: string; worker: WorkerSpec; prompt: string | null }
   | { type: 'runtime_close'; profile: ProfileName; keyString: string; lease: RuntimeState['leases'][string] }
-  | { type: 'send_input'; profile: ProfileName; keyString: string; text: string; context_from?: string[] | null; skills?: string[]; job_id?: string }
+  | { type: 'send_input'; profile: ProfileName; keyString: string; text: string; context_from?: string[] | null; skills?: string[]; job_id?: string; webhook_input_id?: string }
+  | { type: 'webhook_input'; admission_id: string; profile: ProfileName; keyString: string; refusal?: string }
   | { type: 'respond'; profile: ProfileName; keyString: string; request_id: string; response: JsonValue }
   | { type: 'deliver'; profile: ProfileName; obligation_id: string }
   | { type: 'write_local'; profile: ProfileName; path: RelPath; text: string }
@@ -288,6 +291,7 @@ export class ChatSdkAdapter implements ChannelAdapter {
   /** The one door from the SDK into the loop: `(thread, message)` -> an `inbound`. */
   handle(thread: unknown, message: unknown): unknown;
   send(target: SurfaceKey, content: { text: string; at?: Instant; reply_to?: string }): Promise<{ ok: true; message_id?: string }>;
+  /** Joins SDK platform/state disconnect and gateway work once; rejects with retained cleanup causes. A failed owner retains its token claim. */
   close(): Promise<void>;
 }
 
@@ -369,6 +373,7 @@ export class Orchestrator {
   readonly effectLog: Effect[];
   readonly webhookPort: number | null;
   start(): Promise<void>;
+  /** Seals webhook ingress before waits; joins admitted processing and retains cleanup failures. */
   stop(): Promise<void>;
   tick(at?: Instant): Promise<Effect[]>;
   drainHosted(): Promise<void>;

package/installed-apps.mjs

@@ -9,11 +9,12 @@ import { delimiter, isAbsolute, join } from 'node:path';
 export const APPS_DIR = 'apps';
 /** The apps this orchestrator can host, by name: what each installs and which adapter it attaches. */
 export const INSTALLABLE_APPS = Object.freeze({
-  'arcs-rooms': { side: 'rh2', module: true, describe: 'arcs-rooms installed module' },
   'orchestration-rh2': { side: 'rh2', module: true, describe: 'orchestration-rh2 installed module' },
   'room-chat': { side: 'rh2', adapter: 'rh2', describe: 'Room chat → orchestrator: a person\'s line in an RH2 Room reaches the agent seated there' },
   // An agent the RH2 organization declares is one participant there: its chat and its call are its own agent principal,
-  // never an automation beside it. One record per agent, bound to its Teams id (`rh2-agent.<name>`, `agentId`).
+  // never an automation beside it. One record per agent per Workplace, bound to its Teams id (`agentId`) and that
+  // Workplace's origin: one installed by hand (`rh2-agent.<profile>`), or one the Agents → Room agents integration
+  // provisioned (`rh2-agent.<agent id>@<host>`, sdk/teams/workplace/agent-credentials.mjs).
   'rh2-agent': { side: 'rh2', adapter: 'rh2', perProfile: true, describe: 'An agent the RH2 organization declares, in its Rooms as its own principal' },
 });
 
@@ -48,19 +49,38 @@ export async function installAgent({ root, origin, organization, principal, toke
   return { ...record, name: `rh2-agent.${profile}`, token: undefined };
 }
 
-/** The rh2-agent record that is the identity of `agentId` (an agent's Teams id, as `apps install rh2-agent --agent`
- * named it), or null. It is found by that id alone, never by a name or profile another agent may share (a later
- * generation of a card's agent, another home's root agent named after the same folder), and only when exactly one
- * record names it. Its file name (`--profile`) is a label. */
-export function installedAgentRecord(root, agentId) {
-  if (typeof agentId !== 'string' || !/^agent_[A-Za-z0-9_-]+$/.test(agentId)) return null;
+/** Every rh2-agent record that is an identity of `agentId` (an agent's Teams id), one per Workplace: found by that id
+ * alone, never by a name or profile another agent may share (a later generation of a card's agent, another home's root
+ * agent named after the same folder). A file name is a label. */
+export function installedAgentRecords(root, agentId) {
+  if (typeof agentId !== 'string' || !/^agent_[A-Za-z0-9_-]+$/.test(agentId)) return [];
   let records;
-  try { records = installedApps(root); } catch { return null; }
+  try { records = installedApps(root); } catch { return []; }
   // the origin install accepted (https, or a loopback for a local RH2), held again wherever the record is used
-  const own = records.filter((record) => record.app === 'rh2-agent' && record.agentId === agentId && record.token && rh2Origin(record.origin));
-  return own.length === 1 ? own[0] : null;
+  return records.filter((record) => record.app === 'rh2-agent' && record.agentId === agentId && record.token && rh2Origin(record.origin))
+    .sort((a, b) => (a.origin < b.origin ? -1 : a.origin > b.origin ? 1 : 0));
 }
 
+/** The rh2-agent record that is the identity of `agentId` on the Workplace at `origin`, or null; with no origin, its one
+ * record, else the one installed by hand (`apps install rh2-agent`), the identity its channel and its sessions' first
+ * Workplace have always been. Only one record may answer: two for one Workplace is none. */
+export function installedAgentRecord(root, agentId, origin = null) {
+  const own = installedAgentRecords(root, agentId);
+  if (origin !== null) {
+    const at = own.filter((record) => record.origin === originOf(origin));
+    return at.length === 1 ? at[0] : null;
+  }
+  if (own.length === 1) return own[0];
+  const byHand = own.filter((record) => !record.provisionedBy);
+  return byHand.length === 1 ? byHand[0] : null;
+}
+
+const originOf = (value) => { try { return new URL(value).origin; } catch { return null; } };
+
+// A record the Agents → Room agents integration provisioned is written by that service (sdk/teams/workplace/
+// agent-credentials.mjs) into this same folder, in this same shape (`provisionedBy` names it), and read here like any.
+
+
 /** Whether `origin` is one an RH2 app may be installed for: https, or a loopback for a local RH2. */
 function rh2Origin(origin) {
   return /^https:\/\/|^http:\/\/(localhost|127\.0\.0\.1)(:|\/|$)/.test(String(origin ?? ''));
@@ -75,9 +95,10 @@ export function rh2Program() {
   return folders.map((folder) => join(folder, 'rh2')).find((file) => existsSync(file)) ?? null;
 }
 
-/** The environment the `rh2` CLI reads to act as an installed agent: its RH2 origin, its organization and its token. */
-export function rh2AgentEnv(record) {
-  return { RH2_BASE_URL: record.origin, RH2_ORGANIZATION: record.organizationId, RH2_SESSION_TOKEN: record.token };
+/** The environment the `rh2` CLI reads to act as an installed agent: its RH2 origin, its organization and its token,
+ * and the home whose records hold its credentials on its other Workplaces (`RH2_AGENT_HOMES`, read per call). */
+export function rh2AgentEnv(record, root = null) {
+  return { RH2_BASE_URL: record.origin, RH2_ORGANIZATION: record.organizationId, RH2_SESSION_TOKEN: record.token, ...(root ? { RH2_AGENT_HOMES: root } : {}) };
 }
 
 /** Exchange an RH2 install code for the installation's token and keep the record. */

package/kanban-worker.mjs

@@ -12,7 +12,7 @@ import { existsSync, statSync } from 'node:fs';
 import { basename, dirname, join, resolve } from 'node:path';
 import { SupercodeHarnessClient } from '@volter/supercode-harness-sdk';
 import { load } from './orchestration.mjs';
-import { INSTRUCTION_ARGUMENTS, activationCwd, activationEnv, declareWorkerHome, sandboxArguments, approvalPolicy, limitArguments, materializePersona, materializeSkills, modelArguments, turnCounter, userHomeArguments, userHomePersona } from './activation.mjs';
+import { INSTRUCTION_ARGUMENTS, activationCwd, activationEnv, declareWorkerHome, modeArguments, approvalPolicy, approvalsReviewer, limitArguments, materializePersona, materializeSkills, modelArguments, turnCounter, userHomeArguments, userHomePersona } from './activation.mjs';
 import { workerRoute } from './worker-route.mjs';
 import { KANBAN_ENV, untrustedServerVerdict, hermesApproval, hermesInstall, memorySnapshot } from './hermes-cli.mjs';
 import { pinnedSkills, taskProtocol } from './board/worker-prompt.mjs';
@@ -95,13 +95,13 @@ async function runTurn({ client, profile, harness, worker, route, root, vault, s
   const reasoning = args.reasoning && harness === 'codex' ? ['-c', `model_reasoning_effort=${JSON.stringify(args.reasoning)}`] : [];
   const launch = {
     program: base.program,
-    arguments: boardGuardArguments(harness, [...(base.arguments ?? []), ...modelArguments(worker), ...route.args, ...(instructions && INSTRUCTION_ARGUMENTS[harness] ? INSTRUCTION_ARGUMENTS[harness](instructions) : []), ...userHomeArguments(profile), ...reasoning, ...sandboxArguments(profile, harness), ...limitArguments(profile, worker, (level, line) => say(line))], { enabled: ['claude-code','codex'].includes(harness), cwd }),
+    arguments: boardGuardArguments(harness, [...(base.arguments ?? []), ...modelArguments(worker), ...route.args, ...(instructions && INSTRUCTION_ARGUMENTS[harness] ? INSTRUCTION_ARGUMENTS[harness](instructions) : []), ...userHomeArguments(profile), ...reasoning, ...modeArguments(profile, harness), ...limitArguments(profile, worker, (level, line) => say(line))], { enabled: ['claude-code','codex'].includes(harness), cwd }),
     env: { ...(base.env ?? {}), ...runEnv },
   };
   declareWorkerHome({ harness, env: launch.env, cwd, log: (_level, line) => say(`hermes-worker: ${line}`) });
   const mount = mountOrchestratorMcp({ root, profile, harness, surfaceKey, launch, vault, task });
-  const policy = approvalPolicy(profile, harness);
-  const runtime = await client.startManagedRuntime({ harness, cwd, launch: mount.launch, ...(mount.mcp_servers ? { mcp_servers: mount.mcp_servers } : {}), ...(policy ? { approval_policy: policy } : {}) });
+  const policy = approvalPolicy(profile, harness), reviewer = approvalsReviewer(profile, harness);
+  const runtime = await client.startManagedRuntime({ harness, cwd, launch: mount.launch, ...(mount.mcp_servers ? { mcp_servers: mount.mcp_servers } : {}), ...(policy ? { approval_policy: policy } : {}), ...(reviewer ? { approvals_reviewer: reviewer } : {}) });
   try { await recordSession(root, task, harness, runtime.handle.runtime_id); } catch (error) { say(`hermes-worker: recording the session on its run: ${error.message}`); }
   let text = '', last = '';
   // `agent.max_turns` for a worker that takes no cap at launch, held as the daemon holds it (loop.mjs `holdTurnLimit`)

package/lease.mjs

@@ -27,7 +27,7 @@ export function pidIsLive(pid) {
   }
 }
 
-/** Whether the lease is this machine's, since this boot. Only such a lease's pid may be signalled. */
+/** Machine/boot observation only. Neither this nor PID liveness grants stop authority. */
 export function leaseIsHere(lease) {
   const here = thisHost();
   if (lease?.host && lease.host !== here.host) return false;