@wenathlan/saddle 2.0.154 → 2.0.155

package/dist/edgelandes.host.js

@@ -1,1089 +0,0 @@
-// # edgelandes.host.ts — the host binary lane executors of the ninety
-// modalities wave, group a: twenty-five planned sandbox modalities
-// wired as honest host-binary execution lanes — the sandbox jails, the
-// container extensions, the runtimes, the screens, the mobile seat, the
-// builds, the ci runners, the network tunnels and the storage daemons
-// the engine host may carry. Every lane follows the spawn pattern of
-// edgelandes.ts: the runtime is probed first (an absent runtime answers
-// the coded HOST_RUNTIME_ABSENT naming the runtime — a lane never fakes
-// a run), the code field lands in a private temp directory, the inputs
-// ride inputs.json through the SADDLE_EDGE_INPUTS env, the runtime
-// spawns under the caller's hard deadline with both streams capped at
-// 256 kb, and the temp directory dies in the finally no matter how the
-// run answered (the owner's law: the lanes act for the system
-// server-side, the visitor browser, gpu, cpu and storage are never
-// touched, and no lane leaves bytes behind on the host). The shared
-// helpers are local on purpose: edgelandes.ts exports its contract
-// pieces only, so this file carries its own spawn, deadline and temp
-// surface — the same law with its own seat. All twenty-five lanes are
-// kind live: the executor exists and drives the runtime when present,
-// exactly like language-ruby rides live though a host may not carry it.
-import { spawn } from "node:child_process";
-import { existsSync } from "node:fs";
-import { copyFile, mkdir, mkdtemp, rm, writeFile } from "node:fs/promises";
-import { createRequire } from "node:module";
-import { connect } from "node:net";
-import { tmpdir } from "node:os";
-import { basename, dirname, join } from "node:path";
-import process from "node:process";
-import { edgelaneerror, probehostbinary } from "./edgelandes.ts";
-/* ════════════════════════════════════════════════════════════════════ */
-/* Section 2: the shared host execution surface — spawn, deadline, temp. */
-/* ════════════════════════════════════════════════════════════════════ */
-/** the per stream capture ceiling: 256 kb of stdout or stderr, the honest
- * bound every host lane reports under. */
-const OUTPUTCAPBYTES = 262144;
-/** spawns one host runtime under a hard deadline, captures both streams
- * (capped), optionally feeds a stdin payload, kills on timeout and
- * answers the coded failures honestly: a missing binary answers
- * HOST_RUNTIME_ABSENT, a nonzero exit answers RUN_EXITED_NONZERO
- * carrying the stderr, a blown deadline answers RUN_DEADLINE_EXCEEDED. */
-function runhostprocess(command, args, options) {
-    return new Promise((resolve, reject) => {
-        // detached makes the child a process group leader: the deadline kill
-        // takes the whole group down (podman spawns conmon and the container
-        // shims that would otherwise outlive the cli and hold the pipes open —
-        // the close event would never fire and the lane would hang past its
-        // own budget)
-        const child = spawn(command, args, {
-            cwd: options.cwd,
-            env: options.env === undefined ? process.env : { ...process.env, ...options.env },
-            stdio: [options.stdin === undefined ? "ignore" : "pipe", "pipe", "pipe"],
-            detached: true,
-        });
-        if (options.stdin !== undefined && child.stdin !== null) {
-            // a payload through /dev/stdin: an early exit must not crash the
-            // engine over a broken pipe, the run answers the exit it got
-            child.stdin.on("error", () => {
-                // the stream error is the child's own honest outcome
-            });
-            child.stdin.end(options.stdin);
-        }
-        const outchunks = [];
-        const errchunks = [];
-        let timedout = false;
-        const makecollector = (chunks) => {
-            let used = 0;
-            return (chunk) => {
-                if (used < OUTPUTCAPBYTES) {
-                    chunks.push(chunk);
-                    used += chunk.byteLength;
-                }
-            };
-        };
-        child.stdout?.on("data", makecollector(outchunks));
-        child.stderr?.on("data", makecollector(errchunks));
-        const timer = setTimeout(() => {
-            timedout = true;
-            try {
-                process.kill(-child.pid, "SIGKILL");
-            }
-            catch {
-                child.kill("SIGKILL");
-            }
-        }, options.deadline);
-        child.on("error", (error) => {
-            clearTimeout(timer);
-            reject(edgelaneerror("HOST_RUNTIME_ABSENT", `the host runtime ${command} is absent: ${errormessage(error)}`));
-        });
-        child.on("close", (code, signal) => {
-            clearTimeout(timer);
-            const stdout = Buffer.concat(outchunks).toString("utf8");
-            const stderr = Buffer.concat(errchunks).toString("utf8");
-            if (timedout) {
-                reject(edgelaneerror("RUN_DEADLINE_EXCEEDED", `the lane exceeded its ${options.deadline} ms deadline and was killed`, {
-                    stderr,
-                }));
-            }
-            else if (code !== 0) {
-                reject(edgelaneerror("RUN_EXITED_NONZERO", `the lane process ${command} exited with code ${code ?? signal}`, {
-                    stderr,
-                }));
-            }
-            else {
-                // the hard cap law: the collector admits chunks under the ceiling
-                // but one large chunk may ride past the line — the joined buffer
-                // truncates to the ceiling so the capture never exceeds it
-                resolve({
-                    stdout: stdout.length > OUTPUTCAPBYTES ? stdout.slice(0, OUTPUTCAPBYTES) : stdout,
-                    stderr: stderr.length > OUTPUTCAPBYTES ? stderr.slice(0, OUTPUTCAPBYTES) : stderr,
-                });
-            }
-        });
-    });
-}
-/** runs fn inside one private temp directory (mkdtemp under the os
- * tmpdir, the saddleedgehost prefix) and removes it no matter how fn
- * answers — the host lanes never leave workspace bytes behind. */
-async function withtempdirhost(fn) {
-    const dir = await mkdtemp(join(tmpdir(), "saddleedgehost"));
-    try {
-        return await fn(dir);
-    }
-    finally {
-        await rm(dir, { recursive: true, force: true });
-    }
-}
-/** writes the run inputs as inputs.json beside the program and answers
- * the env overlay pointing at it (SADDLE_EDGE_INPUTS); host lane
- * programs read their inputs from that file when the caller sent any. */
-async function writeinputsfile(dir, inputs) {
-    if (inputs === undefined)
-        return undefined;
-    const path = join(dir, "inputs.json");
-    await writeFile(path, JSON.stringify(inputs ?? null), "utf8");
-    return { SADDLE_EDGE_INPUTS: path };
-}
-/** writes the code as script.sh inside the private dir and runs one
- * command with the inputs surface and the extra env merged in: the
- * shared recipe of the bash-shaped host lanes. */
-async function runscript(command, args, dir, code, inputs, deadline, extraenv = {}) {
-    await writeFile(join(dir, "script.sh"), code, "utf8");
-    const inputenv = (await writeinputsfile(dir, inputs)) ?? {};
-    const run = await runhostprocess(command, args, { cwd: dir, deadline, env: { ...inputenv, ...extraenv } });
-    return { stdout: run.stdout, stderr: run.stderr };
-}
-/** the safe message of an unknown thrown value (no stack ever rides a lane answer). */
-function errormessage(error) {
-    return error instanceof Error ? error.message : String(error ?? "unknown lane failure");
-}
-/** the coded absence of one host runtime: the lane never fakes a run
- * over a binary the host does not carry — the message names the runtime
- * and the lane, the code rides the machine surface. */
-function absentruntime(laneid, runtime, note = "") {
-    throw edgelaneerror("HOST_RUNTIME_ABSENT", `the host runtime ${runtime} is absent: the lane ${laneid} requires it on PATH${note.length > 0 ? ` ${note}` : ""}`);
-}
-/** whether the engine process runs as root: the chroot and the oci
- * runtimes need the seat for their namespace work, and the lane answers
- * the coded privilege refusal instead of a wrapped errno. */
-function isroot() {
-    return typeof process.getuid === "function" && process.getuid() === 0;
-}
-/** the monotonic lane id counter: deterministic container ids without
- * crypto — the ids only need uniqueness per engine process. */
-let laneidseat = 0;
-function nextlaneid(prefix) {
-    laneidseat += 1;
-    return `${prefix}-${process.pid}-${laneidseat}`;
-}
-/** waits for one loopback tcp port to accept a connection within the
- * budget: the honest readiness probe of the tunnel lanes (a port that
- * never opens answers the deadline refusal, never a fake tunnel). */
-function waitforport(port, budgetms) {
-    return new Promise((resolve) => {
-        const endsat = Date.now() + budgetms;
-        const attempt = () => {
-            if (Date.now() > endsat) {
-                resolve(false);
-                return;
-            }
-            const socket = connect(port, "127.0.0.1");
-            const settle = (answer) => {
-                socket.removeAllListeners();
-                socket.destroy();
-                if (answer) {
-                    resolve(true);
-                    return;
-                }
-                if (Date.now() >= endsat) {
-                    resolve(false);
-                    return;
-                }
-                setTimeout(attempt, 100);
-            };
-            socket.once("connect", () => settle(true));
-            socket.once("error", () => settle(false));
-        };
-        attempt();
-    });
-}
-/** waits for one spawned child to exit within the budget (the daemon
- * teardown of the tunnel lanes; a false answer hands the caller the
- * kill decision). */
-function waitforexit(child, budgetms) {
-    return new Promise((resolve) => {
-        if (child.exitCode !== null || child.signalCode !== null) {
-            resolve(true);
-            return;
-        }
-        let settled = false;
-        const finish = (answer) => {
-            if (settled)
-                return;
-            settled = true;
-            clearTimeout(timer);
-            resolve(answer);
-        };
-        const timer = setTimeout(() => finish(false), budgetms);
-        child.once("exit", () => finish(true));
-    });
-}
-/** probes the docker surface of the host: the binary on PATH or the
- * daemon socket (the same honest seat the engine's docker lane rides). */
-function probedockersurface() {
-    return probehostbinary("docker") || existsSync("/var/run/docker.sock");
-}
-/* ════════════════════════════════════════════════════════════════════ */
-/* Section 3: the sandbox jail lanes — bubblewrap, nsjail and chroot. */
-/* ════════════════════════════════════════════════════════════════════ */
-/** sandbox-bubblewrap: the user-namespace jail lane. The code rides a
- * temp script.sh executed inside bwrap with the host root bound
- * read-only, every namespace unshared and the jail dying with the
- * engine parent — the honest bubblewrap seat this host may carry. */
-async function sandboxbubblewraplane(code, inputs, deadline) {
-    if (!probehostbinary("bwrap")) {
-        absentruntime("sandbox-bubblewrap", "bwrap");
-    }
-    return withtempdirhost((dir) => runscript("bwrap", ["--ro-bind", "/", "/", "--unshare-all", "--die-with-parent", "/bin/bash", "script.sh"], dir, code, inputs, deadline));
-}
-/** sandbox-nsjail: the process jail lane. The lane writes a minimal
- * nsjail config (mode ONCE, the deadline as time_limit, the temp cwd,
- * a read-only root bind and a writable tmpfs scratch) and runs the
- * script through the jail — the config and the script live and die in
- * the private temp dir. */
-async function sandboxnsjaillane(code, inputs, deadline) {
-    if (!probehostbinary("nsjail")) {
-        absentruntime("sandbox-nsjail", "nsjail");
-    }
-    return withtempdirhost(async (dir) => {
-        const config = [
-            "# the saddle edge nsjail lane: one process under the jail, the",
-            "# deadline rides time_limit, the root bind keeps the system visible",
-            "# read-only and the tmpfs at /scratch is the writable seat.",
-            'name: "saddle-edge-nsjail"',
-            "mode: ONCE",
-            `time_limit: ${Math.max(1, Math.ceil(deadline / 1000))}`,
-            `cwd: "${dir}"`,
-            "mount {",
-            '  src: "/"',
-            '  dst: "/"',
-            "  is_bind: true",
-            "}",
-            "mount {",
-            '  dst: "/scratch"',
-            '  fstype: "tmpfs"',
-            "  rw: true",
-            "}",
-            "",
-        ].join("\n");
-        await writeFile(join(dir, "config.nsjail"), config, "utf8");
-        return await runscript("nsjail", ["--config", "config.nsjail", "--", "/bin/bash", "script.sh"], dir, code, inputs, deadline);
-    });
-}
-/** builds the minimal chroot tree: /bin/bash with its ldd dependency
- * set (best effort — fakechroot maps the real filesystem through its
- * preload shim, the copies serve the real chroot seat), the lane script
- * at /script.sh and the inputs at /inputs.json so the jailed program
- * reads them at their in-tree paths. */
-async function buildchroottree(root, code, inputs) {
-    if (!existsSync("/bin/bash")) {
-        throw edgelaneerror("RUNTIME_BUNDLE_UNAVAILABLE", "the lane sandbox-chroot cannot build its tree: /bin/bash is absent from the host (the lane never fakes a root)");
-    }
-    await mkdir(join(root, "bin"), { recursive: true });
-    await mkdir(join(root, "tmp"), { recursive: true });
-    await copyFile("/bin/bash", join(root, "bin", "bash"));
-    try {
-        const deps = await runhostprocess("ldd", ["/bin/bash"], { cwd: root, deadline: 2000 });
-        for (const line of deps.stdout.split("\n")) {
-            for (const token of line.split(/\s+/)) {
-                if (!token.startsWith("/") || !token.includes(".so"))
-                    continue;
-                try {
-                    await mkdir(join(root, dirname(token)), { recursive: true });
-                    await copyFile(token, join(root, token));
-                }
-                catch {
-                    // an optional dependency copy that fails leaves the runtime's
-                    // own honest loader error at run time — the tree never fakes a lib
-                }
-            }
-        }
-    }
-    catch {
-        // ldd absent or failing: the fakechroot seat maps the real fs and
-        // needs no copies, the real chroot seat answers its own loader error
-    }
-    await writeFile(join(root, "script.sh"), code, "utf8");
-    if (inputs !== undefined) {
-        await writeFile(join(root, "inputs.json"), JSON.stringify(inputs ?? null), "utf8");
-    }
-}
-/** sandbox-chroot: the chroot jail lane with the honest privilege law:
- * a real chroot needs root, so a non-root engine requires fakechroot —
- * a host carrying neither root nor fakechroot answers the coded
- * privilege refusal, never a wrapped errno or a fake root. */
-async function sandboxchrootlane(code, inputs, deadline) {
-    const chrootpresent = probehostbinary("chroot");
-    const fakepresent = probehostbinary("fakechroot");
-    if (!chrootpresent && !fakepresent) {
-        absentruntime("sandbox-chroot", "chroot", "(and fakechroot, the unprivileged seat, is absent too)");
-    }
-    if (!fakepresent && !isroot()) {
-        throw edgelaneerror("HOST_PRIVILEGE_REQUIRED", "the lane sandbox-chroot requires root for a real chroot and the host carries no fakechroot (the lane never fakes a root)");
-    }
-    return withtempdirhost(async (dir) => {
-        const tree = join(dir, "root");
-        await buildchroottree(tree, code, inputs);
-        const env = {};
-        if (inputs !== undefined)
-            env.SADDLE_EDGE_INPUTS = "/inputs.json";
-        const command = fakepresent ? "fakechroot" : "chroot";
-        const args = fakepresent ? ["chroot", tree, "/bin/bash", "/script.sh"] : [tree, "/bin/bash", "/script.sh"];
-        const run = await runhostprocess(command, args, { cwd: dir, deadline, env });
-        return { stdout: run.stdout, stderr: run.stderr };
-    });
-}
-/* ════════════════════════════════════════════════════════════════════ */
-/* Section 4: the container extension lanes — podman to ghcr. */
-/* ════════════════════════════════════════════════════════════════════ */
-/** container-podman: the rootless container lane. The script mounts at
- * /work and runs through the busybox image — the pull happens inside
- * the runtime itself under the caller's deadline, the lane never
- * pre-pulls anything outside its own process. */
-async function containerpodmanlane(code, inputs, deadline) {
-    if (!probehostbinary("podman")) {
-        absentruntime("container-podman", "podman");
-    }
-    return withtempdirhost(async (dir) => {
-        await writeFile(join(dir, "script.sh"), code, "utf8");
-        const inputenv = await writeinputsfile(dir, inputs);
-        const env = inputenv === undefined ? undefined : { ...inputenv, SADDLE_EDGE_INPUTS: "/work/inputs.json" };
-        const run = await runhostprocess("podman", [
-            "run",
-            "--rm",
-            "-v",
-            `${dir}:/work`,
-            "-w",
-            "/work",
-            "quay.io/libpod/busybox:latest",
-            "/bin/sh",
-            "/work/script.sh",
-        ], { cwd: dir, deadline, env });
-        return { stdout: run.stdout, stderr: run.stderr };
-    });
-}
-/** container-containerd: the containerd supervisor lane. The code field
- * is the shell command echoed through busybox's /bin/sh inside one
- * containerd task under the native snapshotter — the task id rides the
- * monotonic counter, deterministic without crypto. */
-async function containercontainerdlane(code, inputs, deadline) {
-    if (!probehostbinary("ctr")) {
-        absentruntime("container-containerd", "ctr");
-    }
-    return withtempdirhost(async (dir) => {
-        const inputenv = await writeinputsfile(dir, inputs);
-        const run = await runhostprocess("ctr", [
-            "run",
-            "--rm",
-            "--snapshotter",
-            "native",
-            "docker.io/library/busybox:latest",
-            nextlaneid("saddleedge-ctr"),
-            "/bin/sh",
-            "-c",
-            code,
-        ], { cwd: dir, deadline, env: inputenv });
-        return { stdout: run.stdout, stderr: run.stderr };
-    });
-}
-/** builds one minimal oci bundle for the runc and crun seats: a
- * spec.json (process args /bin/sh -c, cwd /, a PATH env, the pid,
- * network, ipc, uts and mount namespaces, a read-only root) and a
- * rootfs seeded with busybox — without busybox on PATH there is no
- * honest bundle and the lane answers RUNTIME_BUNDLE_UNAVAILABLE. */
-async function buildocibundle(dir, laneid, code) {
-    if (!probehostbinary("busybox")) {
-        throw edgelaneerror("RUNTIME_BUNDLE_UNAVAILABLE", `the lane ${laneid} cannot build its rootfs: busybox is absent from PATH (the lane never fakes a bundle)`);
-    }
-    const bundle = join(dir, "bundle");
-    const rootfs = join(bundle, "rootfs");
-    await mkdir(join(rootfs, "bin"), { recursive: true });
-    await mkdir(join(rootfs, "tmp"), { recursive: true });
-    const seat = await runhostprocess("bash", ["-c", "command -v busybox"], { cwd: dir, deadline: 2000 });
-    const busybox = seat.stdout.trim();
-    await copyFile(busybox, join(rootfs, "bin", "sh"));
-    await copyFile(busybox, join(rootfs, "bin", "busybox"));
-    const spec = {
-        ociVersion: "1.0.2",
-        process: {
-            terminal: false,
-            user: { uid: 0, gid: 0 },
-            args: ["/bin/sh", "-c", code],
-            env: ["PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"],
-            cwd: "/",
-        },
-        root: { path: "rootfs", readonly: true },
-        hostname: "saddleedge",
-        linux: {
-            namespaces: [{ type: "pid" }, { type: "network" }, { type: "ipc" }, { type: "uts" }, { type: "mount" }],
-        },
-    };
-    await writeFile(join(bundle, "spec.json"), `${JSON.stringify(spec, null, 2)}\n`, "utf8");
-    return bundle;
-}
-/** the shared oci runtime seat of container-runc and container-crun:
- * the probe, the root privilege law (the minimal spec carries no user
- * namespace mappings, so the namespace work needs root), the bundle
- * build and the run under the deadline. */
-async function runocilane(laneid, runtime, code, inputs, deadline) {
-    if (!probehostbinary(runtime)) {
-        absentruntime(laneid, runtime);
-    }
-    if (!isroot()) {
-        throw edgelaneerror("HOST_PRIVILEGE_REQUIRED", `the lane ${laneid} requires root to create its ${runtime} namespaces (the lane never fakes a container)`);
-    }
-    return withtempdirhost(async (dir) => {
-        const bundle = await buildocibundle(dir, laneid, code);
-        const inputenv = await writeinputsfile(dir, inputs);
-        const run = await runhostprocess(runtime, ["run", nextlaneid(`saddleedge-${runtime}`)], {
-            cwd: bundle,
-            deadline,
-            env: inputenv,
-        });
-        return { stdout: run.stdout, stderr: run.stderr };
-    });
-}
-/** container-runc: the oci process lane — spec.json plus a busybox
- * rootfs, run by runc under the deadline. */
-async function containerrunclane(code, inputs, deadline) {
-    return runocilane("container-runc", "runc", code, inputs, deadline);
-}
-/** container-crun: the same oci bundle law through the crun runtime. */
-async function containercrunlane(code, inputs, deadline) {
-    return runocilane("container-crun", "crun", code, inputs, deadline);
-}
-/** runs the code through one docker profile: the image and the
- * hardening flags ride the profile args, the script mounts at /work and
- * the inputs ride /work/inputs.json inside the container. */
-async function rundockerprofile(dir, code, inputs, deadline, profileargs) {
-    await writeFile(join(dir, "script.sh"), code, "utf8");
-    const inputenv = await writeinputsfile(dir, inputs);
-    const env = inputenv === undefined ? undefined : { ...inputenv, SADDLE_EDGE_INPUTS: "/work/inputs.json" };
-    const run = await runhostprocess("docker", ["run", "--rm", "-v", `${dir}:/work`, "-w", "/work", ...profileargs, "/bin/bash", "/work/script.sh"], { cwd: dir, deadline, env });
-    return { stdout: run.stdout, stderr: run.stderr };
-}
-/** container-max: the docker max profile — no network, every capability
- * dropped, the pid limit raised to 256 and the memory swap left open:
- * more resources than the lite seat, the same honest spawn law. */
-async function containermaxlane(code, inputs, deadline) {
-    if (!probedockersurface()) {
-        absentruntime("container-max", "docker", "(no docker binary and no /var/run/docker.sock)");
-    }
-    return withtempdirhost((dir) => rundockerprofile(dir, code, inputs, deadline, [
-        "--network",
-        "none",
-        "--cap-drop",
-        "ALL",
-        "--pids-limit",
-        "256",
-        "--memory-swap",
-        "-1",
-        "docker.io/library/bash:5",
-    ]));
-}
-/** container-lite: the docker lite profile — no network, every
- * capability dropped, a read-only root, the pid limit at 64, 256 mb of
- * memory and a tmpfs at /tmp: the tightest honest container seat. */
-async function containerlitelane(code, inputs, deadline) {
-    if (!probedockersurface()) {
-        absentruntime("container-lite", "docker", "(no docker binary and no /var/run/docker.sock)");
-    }
-    return withtempdirhost((dir) => rundockerprofile(dir, code, inputs, deadline, [
-        "--network",
-        "none",
-        "--cap-drop",
-        "ALL",
-        "--read-only",
-        "--pids-limit",
-        "64",
-        "--memory",
-        "256m",
-        "--tmpfs",
-        "/tmp",
-        "docker.io/library/bash:5",
-    ]));
-}
-/** container-ghcr: the immutable ghcr lane. The image rides the inputs
- * field {image, script} — without it the lane runs the distroless
- * default ghcr.io/distroless/cc:latest and echoes the script through
- * the container's /dev/stdin (docker -i): the lane feeds the payload,
- * the image answers what it answers, nothing is faked. */
-async function containerghcrlane(code, inputs, deadline) {
-    if (!probedockersurface()) {
-        absentruntime("container-ghcr", "docker", "(no docker binary and no /var/run/docker.sock)");
-    }
-    return withtempdirhost(async (dir) => {
-        const record = (inputs ?? {});
-        const image = typeof record.image === "string" && record.image.length > 0 ? record.image : "ghcr.io/distroless/cc:latest";
-        const script = typeof record.script === "string" ? record.script : code;
-        const inputenv = await writeinputsfile(dir, inputs);
-        const run = await runhostprocess("docker", ["run", "--rm", "-i", "--network", "none", "--cap-drop", "ALL", "--read-only", "--pull=missing", image], { cwd: dir, deadline, env: inputenv, stdin: script });
-        return { stdout: run.stdout, stderr: run.stderr };
-    });
-}
-/* ════════════════════════════════════════════════════════════════════ */
-/* Section 5: the runtime lanes — the clr and workerd seats. */
-/* ════════════════════════════════════════════════════════════════════ */
-/** runtime-clr: the dotnet lane. When the dotnet-script tool rides the
- * host the program runs as program.csx; otherwise the lane falls back
- * to a minimal net8.0 console csproj whose Program.cs is the code field
- * — both seats spawn under the deadline, the compile answers honestly. */
-async function runtimeclrlane(code, inputs, deadline) {
-    if (!probehostbinary("dotnet")) {
-        absentruntime("runtime-clr", "dotnet");
-    }
-    const scripttool = probehostbinary("dotnet-script");
-    return withtempdirhost(async (dir) => {
-        const inputenv = await writeinputsfile(dir, inputs);
-        if (scripttool) {
-            await writeFile(join(dir, "program.csx"), code, "utf8");
-            const run = await runhostprocess("dotnet", ["script", "program.csx"], { cwd: dir, deadline, env: inputenv });
-            return { stdout: run.stdout, stderr: run.stderr };
-        }
-        await writeFile(join(dir, "Program.cs"), code, "utf8");
-        await writeFile(join(dir, "lane.csproj"), [
-            '<Project Sdk="Microsoft.NET.Sdk">',
-            "  <PropertyGroup>",
-            "    <OutputType>Exe</OutputType>",
-            "    <TargetFramework>net8.0</TargetFramework>",
-            "    <ImplicitUsings>disable</ImplicitUsings>",
-            "    <Nullable>disable</Nullable>",
-            "  </PropertyGroup>",
-            "</Project>",
-            "",
-        ].join("\n"), "utf8");
-        const run = await runhostprocess("dotnet", ["run", "--project", "lane.csproj"], {
-            cwd: dir,
-            deadline,
-            env: inputenv,
-        });
-        return { stdout: run.stdout, stderr: run.stderr };
-    });
-}
-/** runtime-workerd: the cloudflare runtime lane. The lane writes the
- * worker as worker.js plus a minimal capnp config (one loopback http
- * socket, one worker whose module tree is the temp dir, sourceUrl
- * workerd:main) and serves it under the deadline. workerd serve is a
- * server: a healthy worker outlives the run window and answers the
- * honest RUN_DEADLINE_EXCEEDED with its startup logs riding the
- * streams — a broken config answers RUN_EXITED_NONZERO, never a fake. */
-async function runtimeworkerdlane(code, inputs, deadline) {
-    if (!probehostbinary("workerd")) {
-        absentruntime("runtime-workerd", "workerd");
-    }
-    return withtempdirhost(async (dir) => {
-        await writeFile(join(dir, "worker.js"), code, "utf8");
-        await writeFile(join(dir, "workerd.capnp"), [
-            "# the saddle edge lane workerd config: one loopback http socket and",
-            '# one worker whose module tree is this directory (sourceUrl "workerd:main").',
-            'using Workerd = import "/workerd/io/workerd.capnp";',
-            "",
-            "const config :Workerd.Server = (",
-            '  services = [ (name = "main", worker = .mainWorker ) ],',
-            '  sockets = [ (name = "http", address = "127.0.0.1:0", http = (), service = "main" ) ],',
-            ");",
-            "",
-            "const mainWorker :Workerd.Worker = (",
-            '  compatibilityDate = "2024-04-03",',
-            '  sourceUrl = "workerd:main",',
-            '  modules = "./",',
-            ");",
-            "",
-        ].join("\n"), "utf8");
-        const inputenv = await writeinputsfile(dir, inputs);
-        const run = await runhostprocess("workerd", ["serve", "workerd.capnp"], { cwd: dir, deadline, env: inputenv });
-        return { stdout: run.stdout, stderr: run.stderr };
-    });
-}
-/* ════════════════════════════════════════════════════════════════════ */
-/* Section 6: the screen lanes — the virtual displays, never the visitor's. */
-/* ════════════════════════════════════════════════════════════════════ */
-/** screen-xvfb: the virtual x display lane. The script runs under
- * xvfb-run with an auto-picked display and a 1280x800x24 screen — the
- * display is a virtual server the lane spawns and kills, the visitor's
- * screen is never touched (the engine host owns this surface). */
-async function screenxvfblane(code, inputs, deadline) {
-    if (!probehostbinary("xvfb-run")) {
-        absentruntime("screen-xvfb", "xvfb-run");
-    }
-    return withtempdirhost((dir) => runscript("xvfb-run", ["-a", "--server-args=-screen 0 1280x800x24", "/bin/bash", "script.sh"], dir, code, inputs, deadline));
-}
-/** screen-wayland: the headless compositor lane. cage is the first seat
- * (the wlroots headless backend, the runtime dir as the xdg seat so the
- * socket lands inside the private temp dir); weston is the fallback —
- * one bash spawn drives the compositor and the script in sequence, the
- * deadline covers the whole session and the compositor dies with the
- * script. A host carrying neither answers the coded absence. */
-async function screenwaylandlane(code, inputs, deadline) {
-    const cagepresent = probehostbinary("cage");
-    const westonpresent = probehostbinary("weston");
-    if (!cagepresent && !westonpresent) {
-        throw edgelaneerror("HOST_RUNTIME_ABSENT", "the host runtime cage is absent: the lane screen-wayland requires it on PATH (weston, the alternative seat, is absent too)");
-    }
-    return withtempdirhost(async (dir) => {
-        if (cagepresent) {
-            return await runscript("cage", ["--", "/bin/bash", "script.sh"], dir, code, inputs, deadline, {
-                XDG_RUNTIME_DIR: dir,
-                WLR_BACKENDS: "headless",
-            });
-        }
-        await writeFile(join(dir, "script.sh"), code, "utf8");
-        const inputenv = (await writeinputsfile(dir, inputs)) ?? {};
-        const session = [
-            `XDG_RUNTIME_DIR="${dir}" weston --backend=headless-backend.so --socket=wayland-0 >/dev/null 2>&1 &`,
-            "westonpid=$!",
-            "sleep 0.3",
-            `WAYLAND_DISPLAY=wayland-0 XDG_RUNTIME_DIR="${dir}" /bin/bash script.sh`,
-            "status=$?",
-            'kill "$westonpid" 2>/dev/null',
-            'wait "$westonpid" 2>/dev/null',
-            "exit $status",
-        ].join("\n");
-        const run = await runhostprocess("bash", ["-c", session], { cwd: dir, deadline, env: inputenv });
-        return { stdout: run.stdout, stderr: run.stderr };
-    });
-}
-/* ════════════════════════════════════════════════════════════════════ */
-/* Section 7: the mobile lane — the termux seat. */
-/* ════════════════════════════════════════════════════════════════════ */
-/** mobile-termux: the honest mobile lane. A linux engine host never
- * carries termux — the lane answers the coded absence; a termux host
- * (the engine running inside the android sandbox) runs the script
- * through the termux prefix environment (TERMUX_PREFIX with the prefix
- * bin on PATH), the honest emulation-free seat. */
-async function mobiletermuxlane(code, inputs, deadline) {
-    if (!probehostbinary("termux")) {
-        absentruntime("mobile-termux", "termux", "(the termux host prefix exists only inside a termux device host)");
-    }
-    return withtempdirhost(async (dir) => {
-        const record = (inputs ?? {});
-        const prefix = typeof record.termuxprefix === "string" && record.termuxprefix.length > 0
-            ? record.termuxprefix
-            : "/data/data/com.termux/files/usr";
-        const path = process.env.PATH ?? "";
-        return await runscript("bash", ["script.sh"], dir, code, inputs, deadline, {
-            TERMUX_PREFIX: prefix,
-            PATH: `${prefix}/bin:${path}`,
-        });
-    });
-}
-/* ════════════════════════════════════════════════════════════════════ */
-/* Section 8: the build lanes — bazel, buck2 and turborepo. */
-/* ════════════════════════════════════════════════════════════════════ */
-/** build-bazel: the bazel lane. A minimal BUILD file wires the script
- * as one sh_binary and bazel runs it in batch mode with the system and
- * home rc files refused, HOME pointed at the temp dir and the output
- * user root inside it — the build caches the engine host may own are
- * never touched, nothing leaks outside the private dir. */
-async function buildbazellane(code, inputs, deadline) {
-    if (!probehostbinary("bazel")) {
-        absentruntime("build-bazel", "bazel");
-    }
-    return withtempdirhost(async (dir) => {
-        await writeFile(join(dir, "MODULE.bazel"), "", "utf8");
-        await writeFile(join(dir, "BUILD"), 'sh_binary(\n  name = "lane",\n  srcs = ["script.sh"],\n)\n', "utf8");
-        return await runscript("bazel", ["--batch", "--nosystem_rc", "--nohome_rc", `--output_user_root=${join(dir, "out")}`, "run", "//:lane"], dir, code, inputs, deadline, { HOME: dir });
-    });
-}
-/** build-buck: the buck2 lane. A minimal BUCK file wires the script as
- * one sh_binary and buck2 runs it with HOME at the temp dir so the
- * buck caches stay inside the private seat. */
-async function buildbucklane(code, inputs, deadline) {
-    if (!probehostbinary("buck2")) {
-        absentruntime("build-buck", "buck2");
-    }
-    return withtempdirhost(async (dir) => {
-        await writeFile(join(dir, ".buckconfig"), "[repositories]\nroot = .\n", "utf8");
-        await writeFile(join(dir, "BUCK"), 'sh_binary(\n  name = "lane",\n  srcs = ["script.sh"],\n)\n', "utf8");
-        return await runscript("buck2", ["run", "//:lane"], dir, code, inputs, deadline, { HOME: dir });
-    });
-}
-/** the turbo seat: the binary on PATH or the engine module graph's
- * turbo package (the bin shim it ships) — the honest probe answers
- * present only when one of the two seats resolves. */
-function turboseat() {
-    if (probehostbinary("turbo")) {
-        return { present: true, binpath: "turbo", viabinary: true };
-    }
-    try {
-        const resolved = createRequire(import.meta.url).resolve("turbo");
-        let dir = dirname(resolved);
-        while (dir !== dirname(dir)) {
-            if (basename(dir) === "turbo" && basename(dirname(dir)) === "node_modules") {
-                const binpath = join(dir, "bin", "turbo");
-                if (existsSync(binpath)) {
-                    return { present: true, binpath, viabinary: false };
-                }
-            }
-            dir = dirname(dir);
-        }
-    }
-    catch {
-        // the module seat is absent: the binary seat already answered
-    }
-    return { present: false, binpath: "", viabinary: false };
-}
-/** build-turborepo: the turbo lane. A minimal package.json whose build
- * script is the code field plus a minimal turbo.json, then turbo run
- * build — through the binary seat when the host carries it, through the
- * engine module seat's bin shim (spawned under node) when the repo
- * carries turbo only as a dependency. */
-async function buildturborepolane(code, inputs, deadline) {
-    const seat = turboseat();
-    if (!seat.present) {
-        throw edgelaneerror("HOST_RUNTIME_ABSENT", "the host runtime turbo is absent: the lane build-turborepo requires it on PATH (neither the turbo binary nor the engine module seat resolved)");
-    }
-    return withtempdirhost(async (dir) => {
-        const manifest = {
-            name: "saddle-edge-turbo-lane",
-            private: true,
-            version: "0.0.0",
-            scripts: { build: code },
-        };
-        await writeFile(join(dir, "package.json"), `${JSON.stringify(manifest, null, 2)}\n`, "utf8");
-        await writeFile(join(dir, "turbo.json"), `${JSON.stringify({ $schema: "https://turbo.build/schema.json", tasks: { build: { outputs: [] } } }, null, 2)}\n`, "utf8");
-        const inputenv = (await writeinputsfile(dir, inputs)) ?? {};
-        const command = seat.viabinary ? "turbo" : "node";
-        const args = seat.viabinary ? ["run", "build"] : [seat.binpath, "run", "build"];
-        const run = await runhostprocess(command, args, { cwd: dir, deadline, env: { ...inputenv, HOME: dir } });
-        return { stdout: run.stdout, stderr: run.stderr };
-    });
-}
-/* ════════════════════════════════════════════════════════════════════ */
-/* Section 9: the ci runner lanes — the actions and gitlab seats. */
-/* ════════════════════════════════════════════════════════════════════ */
-/** the actions runner root seat: the ACTIONS_RUNNER_ROOT env pointing
- * at a real directory, or the empty string when the host carries none. */
-function actionsrunnerroot() {
-    const root = process.env.ACTIONS_RUNNER_ROOT;
-    return typeof root === "string" && root.length > 0 && existsSync(root) ? root : "";
-}
-/** ci-actions: the github actions runner lane. The probe is the
- * Runner.Listener binary on PATH or the ACTIONS_RUNNER_ROOT directory;
- * when present the lane runs the listener in once mode through its own
- * root and answers its streams — the job the listener pulls answers the
- * configured service, the code and the inputs ride the env surface for
- * the job side to pick up, nothing is faked. */
-async function ciactionslane(code, inputs, deadline) {
-    const root = actionsrunnerroot();
-    if (root.length === 0 && !probehostbinary("Runner.Listener")) {
-        absentruntime("ci-actions", "actions-runner", "(no Runner.Listener on PATH and no ACTIONS_RUNNER_ROOT directory)");
-    }
-    return withtempdirhost(async (dir) => {
-        let runnerroot = root;
-        if (runnerroot.length === 0) {
-            const seat = await runhostprocess("bash", ["-c", "command -v Runner.Listener"], {
-                cwd: dir,
-                deadline: Math.min(deadline, 2000),
-            });
-            runnerroot = dirname(seat.stdout.trim());
-        }
-        await writeFile(join(dir, "script.sh"), code, "utf8");
-        const inputenv = await writeinputsfile(dir, inputs);
-        const run = await runhostprocess("./Runner.Listener", ["run", "--once"], {
-            cwd: runnerroot,
-            deadline,
-            env: inputenv,
-        });
-        return { stdout: run.stdout, stderr: run.stderr };
-    });
-}
-/** ci-gitlab: the gitlab runner lane. The job script rides a minimal
- * .gitlab-ci.yml (one job, one block scalar script) and the runner
- * executes it through `exec docker`; a modern runner that removed the
- * exec command answers RUNTIME_CAPABILITY_ABSENT with the message
- * naming the removal — the runtime exists, the capability is gone. */
-async function cigitlablane(code, inputs, deadline) {
-    if (!probehostbinary("gitlab-runner")) {
-        absentruntime("ci-gitlab", "gitlab-runner");
-    }
-    return withtempdirhost(async (dir) => {
-        const body = code
-            .split("\n")
-            .map((line) => `      ${line}`)
-            .join("\n");
-        await writeFile(join(dir, ".gitlab-ci.yml"), `lane:\n  script:\n    - |\n${body}\n`, "utf8");
-        const inputenv = await writeinputsfile(dir, inputs);
-        try {
-            const run = await runhostprocess("gitlab-runner", ["exec", "docker", "lane"], {
-                cwd: dir,
-                deadline,
-                env: inputenv,
-            });
-            return { stdout: run.stdout, stderr: run.stderr };
-        }
-        catch (error) {
-            const stderr = error.stderr ?? "";
-            if (typeof error.code === "string" && /unknown command/i.test(stderr)) {
-                throw edgelaneerror("RUNTIME_CAPABILITY_ABSENT", "the host runtime gitlab-runner refused the exec command: exec was removed from the modern runners (the lane ci-gitlab requires a runner that still carries exec)", { stderr });
-            }
-            throw error;
-        }
-    });
-}
-/* ════════════════════════════════════════════════════════════════════ */
-/* Section 10: the network tunnel lanes — tor, i2p and wireguard. */
-/* ════════════════════════════════════════════════════════════════════ */
-/** network-tor: the onion lane. The lane starts tor inside the private
- * temp dir (its data directory and logs stay there), waits up to three
- * seconds for the socks port to accept a connection, runs the code as
- * a bash script with ALL_PROXY pointing at the circuit and tears tor
- * down in the finally — no daemon outlives the lane, and a circuit that
- * never opens answers the deadline refusal, never a fake tunnel. */
-async function networktorlane(code, inputs, deadline) {
-    if (!probehostbinary("tor")) {
-        absentruntime("network-tor", "tor");
-    }
-    return withtempdirhost(async (dir) => {
-        const tordata = join(dir, "tordata");
-        await mkdir(tordata, { recursive: true });
-        const daemon = spawn("tor", [
-            "--SocksPort",
-            "9050",
-            "--DataDirectory",
-            tordata,
-            "--ControlPort",
-            "0",
-            "--Log",
-            `notice file ${join(dir, "tor.log")}`,
-        ], { cwd: dir, stdio: "ignore", env: process.env });
-        try {
-            const opened = await waitforport(9050, Math.min(3000, Math.max(250, deadline)));
-            if (!opened) {
-                throw edgelaneerror("RUN_DEADLINE_EXCEEDED", "the tor socks port 9050 never opened within its 3 s wait (the lane network-tor refuses to run a script without the circuit)");
-            }
-            return await runscript("bash", ["script.sh"], dir, code, inputs, deadline, {
-                ALL_PROXY: "socks5://127.0.0.1:9050",
-            });
-        }
-        finally {
-            daemon.kill("SIGTERM");
-            const exited = await waitforexit(daemon, 1500);
-            if (!exited) {
-                daemon.kill("SIGKILL");
-                await waitforexit(daemon, 1500);
-            }
-        }
-    });
-}
-/** network-i2p: the i2p tunnel lane. The runtime seat is the i2prouter
- * binary: when the router console (7657) already answers, the script
- * rides the existing tunnel; otherwise the lane starts the router,
- * waits up to five seconds for the console and runs the script with
- * the i2p proxy env (I2P_PROXY_HOST/I2P_PROXY_PORT at the 4444 http
- * proxy). The router the lane started gets its graceful stop in the
- * finally — a console that never opens answers the deadline refusal. */
-async function networki2plane(code, inputs, deadline) {
-    if (!probehostbinary("i2prouter")) {
-        absentruntime("network-i2p", "i2p", "(the i2prouter binary is absent and the router console 7657 cannot be managed)");
-    }
-    return withtempdirhost(async (dir) => {
-        let startedrouter = false;
-        try {
-            const consoleopen = await waitforport(7657, 300);
-            if (!consoleopen) {
-                await runhostprocess("i2prouter", ["start"], { cwd: dir, deadline: Math.min(deadline, 8000) });
-                startedrouter = true;
-                const opened = await waitforport(7657, Math.min(5000, Math.max(250, deadline)));
-                if (!opened) {
-                    throw edgelaneerror("RUN_DEADLINE_EXCEEDED", "the i2p router console 7657 never opened within its 5 s wait (the lane network-i2p refuses to run a script without the tunnel)");
-                }
-            }
-            return await runscript("bash", ["script.sh"], dir, code, inputs, deadline, {
-                I2P_PROXY_HOST: "127.0.0.1",
-                I2P_PROXY_PORT: "4444",
-            });
-        }
-        finally {
-            if (startedrouter) {
-                try {
-                    await runhostprocess("i2prouter", ["graceful"], { cwd: dir, deadline: Math.min(deadline, 8000) });
-                }
-                catch {
-                    // the graceful stop is the honest best effort: the router owns
-                    // its own daemon lifecycle and answers its own error here
-                }
-            }
-        }
-    });
-}
-/** network-wireguard: the interface handshake lane. An empty code field
- * answers the honest report — the wg show capture plus one wg genkey |
- * wg pubkey pair generation on stdout; a non-empty code field runs as a
- * bash script with the wg tools on PATH, and a script that asks for a
- * wg-quick interface bring-up needs root: a non-root engine answers
- * the coded privilege refusal, never a wrapped errno. */
-async function networkwireguardlane(code, inputs, deadline) {
-    if (!probehostbinary("wg")) {
-        absentruntime("network-wireguard", "wg");
-    }
-    return withtempdirhost(async (dir) => {
-        const inputenv = (await writeinputsfile(dir, inputs)) ?? {};
-        if (code.trim().length === 0) {
-            let report = "";
-            let reporterr = "";
-            try {
-                const show = await runhostprocess("wg", ["show"], { cwd: dir, deadline, env: inputenv });
-                report = show.stdout;
-                reporterr = show.stderr;
-            }
-            catch (error) {
-                // wg show on a host without interfaces or privileges answers
-                // nonzero: the report is informational, the failure rides stderr
-                reporterr = `${errormessage(error)}${error.stderr ?? ""}`;
-            }
-            const pair = await runhostprocess("bash", ["-c", "wg genkey | wg pubkey"], {
-                cwd: dir,
-                deadline,
-                env: inputenv,
-            });
-            return { stdout: `${report}${pair.stdout}`.trim(), stderr: `${reporterr}${pair.stderr}` };
-        }
-        if (code.trimStart().startsWith("wg-quick") && !isroot()) {
-            throw edgelaneerror("HOST_PRIVILEGE_REQUIRED", "the lane network-wireguard requires root to bring a wg-quick interface up (the lane never fakes a handshake)");
-        }
-        await writeFile(join(dir, "script.sh"), code, "utf8");
-        const run = await runhostprocess("bash", ["script.sh"], { cwd: dir, deadline, env: inputenv });
-        return { stdout: run.stdout, stderr: run.stderr };
-    });
-}
-/* ════════════════════════════════════════════════════════════════════ */
-/* Section 11: the storage daemon lanes — the minio and garage clients. */
-/* ════════════════════════════════════════════════════════════════════ */
-/** storage-minio: the minio client lane. The code field is a shell
- * script riding the mc CLI; the inputs {alias, url, accesskey,
- * secretkey} (all optional) derive the MC_HOST_<alias> env so the
- * script addresses the vault — without them mc answers its own honest
- * error and the lane wraps it, never invents a vault. */
-async function storageminiolane(code, inputs, deadline) {
-    if (!probehostbinary("mc")) {
-        absentruntime("storage-minio", "mc");
-    }
-    return withtempdirhost(async (dir) => {
-        const record = (inputs ?? {});
-        const alias = typeof record.alias === "string" && record.alias.length > 0 ? record.alias : "lane";
-        const extraenv = {};
-        if (typeof record.url === "string" && record.url.length > 0) {
-            const accesskey = typeof record.accesskey === "string" ? record.accesskey : "";
-            const secretkey = typeof record.secretkey === "string" ? record.secretkey : "";
-            extraenv[`MC_HOST_${alias}`] = `https://${accesskey}:${secretkey}@${record.url}`;
-        }
-        return await runscript("bash", ["script.sh"], dir, code, inputs, deadline, extraenv);
-    });
-}
-/** storage-garage: the garage client lane. The same script law — the
- * code field rides bash with the garage CLI on PATH, and the inputs
- * {rpchost, rpcsecret} derive the GARAGE_RPC_HOST and
- * GARAGE_RPC_SECRET env when the caller sent them. */
-async function storagegaragelane(code, inputs, deadline) {
-    if (!probehostbinary("garage")) {
-        absentruntime("storage-garage", "garage");
-    }
-    return withtempdirhost(async (dir) => {
-        const record = (inputs ?? {});
-        const extraenv = {};
-        if (typeof record.rpchost === "string" && record.rpchost.length > 0) {
-            extraenv.GARAGE_RPC_HOST = record.rpchost;
-        }
-        if (typeof record.rpcsecret === "string" && record.rpcsecret.length > 0) {
-            extraenv.GARAGE_RPC_SECRET = record.rpcsecret;
-        }
-        return await runscript("bash", ["script.sh"], dir, code, inputs, deadline, extraenv);
-    });
-}
-/* ════════════════════════════════════════════════════════════════════ */
-/* Section 12: the lane table — the specs, the executors, the ids. */
-/* ════════════════════════════════════════════════════════════════════ */
-/** the host lane table of the ninety modalities wave, group a: the
- * twenty-five host binary lanes, every one kind live — the executor
- * exists and drives the runtime when the host carries it. The ids are
- * pinned — the dispatcher merge and the api surface read them exactly. */
-export const hostlanespecs = Object.freeze([
-    { modality: "sandbox-bubblewrap", kind: "live", runtime: "bwrap", present: () => probehostbinary("bwrap") },
-    { modality: "sandbox-nsjail", kind: "live", runtime: "nsjail", present: () => probehostbinary("nsjail") },
-    {
-        modality: "sandbox-chroot",
-        kind: "live",
-        runtime: "chroot",
-        present: () => probehostbinary("chroot") || probehostbinary("fakechroot"),
-    },
-    { modality: "container-podman", kind: "live", runtime: "podman", present: () => probehostbinary("podman") },
-    { modality: "container-containerd", kind: "live", runtime: "ctr", present: () => probehostbinary("ctr") },
-    { modality: "container-runc", kind: "live", runtime: "runc", present: () => probehostbinary("runc") },
-    { modality: "container-crun", kind: "live", runtime: "crun", present: () => probehostbinary("crun") },
-    { modality: "container-max", kind: "live", runtime: "docker", present: probedockersurface },
-    { modality: "container-lite", kind: "live", runtime: "docker", present: probedockersurface },
-    { modality: "container-ghcr", kind: "live", runtime: "docker", present: probedockersurface },
-    { modality: "runtime-clr", kind: "live", runtime: "dotnet", present: () => probehostbinary("dotnet") },
-    { modality: "runtime-workerd", kind: "live", runtime: "workerd", present: () => probehostbinary("workerd") },
-    { modality: "screen-xvfb", kind: "live", runtime: "xvfb-run", present: () => probehostbinary("xvfb-run") },
-    {
-        modality: "screen-wayland",
-        kind: "live",
-        runtime: "cage",
-        present: () => probehostbinary("cage") || probehostbinary("weston"),
-    },
-    { modality: "mobile-termux", kind: "live", runtime: "termux", present: () => probehostbinary("termux") },
-    { modality: "build-bazel", kind: "live", runtime: "bazel", present: () => probehostbinary("bazel") },
-    { modality: "build-buck", kind: "live", runtime: "buck2", present: () => probehostbinary("buck2") },
-    { modality: "build-turborepo", kind: "live", runtime: "turbo", present: () => turboseat().present },
-    {
-        modality: "ci-actions",
-        kind: "live",
-        runtime: "actions-runner",
-        present: () => probehostbinary("Runner.Listener") || actionsrunnerroot().length > 0,
-    },
-    { modality: "ci-gitlab", kind: "live", runtime: "gitlab-runner", present: () => probehostbinary("gitlab-runner") },
-    { modality: "network-tor", kind: "live", runtime: "tor", present: () => probehostbinary("tor") },
-    { modality: "network-i2p", kind: "live", runtime: "i2p", present: () => probehostbinary("i2prouter") },
-    { modality: "network-wireguard", kind: "live", runtime: "wg", present: () => probehostbinary("wg") },
-    { modality: "storage-minio", kind: "live", runtime: "mc", present: () => probehostbinary("mc") },
-    { modality: "storage-garage", kind: "live", runtime: "garage", present: () => probehostbinary("garage") },
-]);
-/** the host lane executor table: one executor per lane id, keyed by the
- * modality id in the same order as the spec table; the dispatch plane
- * refuses to boot over a lane it cannot wire. */
-export const edgelaneexecutorshost = Object.freeze({
-    "sandbox-bubblewrap": sandboxbubblewraplane,
-    "sandbox-nsjail": sandboxnsjaillane,
-    "sandbox-chroot": sandboxchrootlane,
-    "container-podman": containerpodmanlane,
-    "container-containerd": containercontainerdlane,
-    "container-runc": containerrunclane,
-    "container-crun": containercrunlane,
-    "container-max": containermaxlane,
-    "container-lite": containerlitelane,
-    "container-ghcr": containerghcrlane,
-    "runtime-clr": runtimeclrlane,
-    "runtime-workerd": runtimeworkerdlane,
-    "screen-xvfb": screenxvfblane,
-    "screen-wayland": screenwaylandlane,
-    "mobile-termux": mobiletermuxlane,
-    "build-bazel": buildbazellane,
-    "build-buck": buildbucklane,
-    "build-turborepo": buildturborepolane,
-    "ci-actions": ciactionslane,
-    "ci-gitlab": cigitlablane,
-    "network-tor": networktorlane,
-    "network-i2p": networki2plane,
-    "network-wireguard": networkwireguardlane,
-    "storage-minio": storageminiolane,
-    "storage-garage": storagegaragelane,
-});
-/** the host lane ids in the spec order — the pinned contract the
- * dispatcher merge and the api surface read exactly. */
-export const hostlaneids = Object.freeze(hostlanespecs.map((lane) => lane.modality));
-/* the wiring self-check: the host lane table refuses to load over a gap
- * between the specs and the executors (a spec without an executor is a
- * miswired lane, and miswiring must fail loud at boot, never silently
- * at run time). */
-for (const lane of hostlanespecs) {
-    if (edgelaneexecutorshost[lane.modality] === undefined) {
-        throw new Error(`the host lane plane is miswired: no executor for the lane ${lane.modality}`);
-    }
-}
-for (const id of Object.keys(edgelaneexecutorshost)) {
-    if (!hostlaneids.includes(id)) {
-        throw new Error(`the host lane plane is miswired: the executor ${id} carries no spec`);
-    }
-}