@with-logic/elwood 0.1.3 → 0.2.1

package/dist/runtime/shutdown/terminal.js

@@ -0,0 +1,38 @@
+/**
+ * Gives received terminal output a bounded drain before runtime disposal.
+ * Implements PRD §9.4 and C-LIFE-12; direct terminal.dispose() remains immediate.
+ */
+/** The whole drain, however many settle passes it takes, shares this one budget. */
+export const terminalDrainTimeoutMs = 1_000;
+export async function drainAndDisposeTerminal(terminal, pty) {
+    let received = 0;
+    let drainTimer;
+    // Subscribed after the terminal's own listener, so each chunk counted here has
+    // already been handed to the renderer that the next `settled()` pass awaits.
+    const unsubscribe = pty.onData(() => {
+        received += 1;
+    });
+    const quiescent = async () => {
+        // `settled()` covers only output received before it was called. Output that
+        // arrives while that pass is pending would be discarded by disposal, so settle
+        // again until one whole pass completes with nothing new received.
+        for (let settledAt = -1; settledAt !== received;) {
+            settledAt = received;
+            await terminal.settled();
+        }
+    };
+    try {
+        await Promise.race([
+            quiescent(),
+            new Promise((resolve) => {
+                drainTimer = setTimeout(resolve, terminalDrainTimeoutMs);
+            }),
+        ]);
+    }
+    finally {
+        clearTimeout(drainTimer);
+        unsubscribe();
+        terminal.dispose();
+    }
+}
+//# sourceMappingURL=terminal.js.map

package/dist/runtime/shutdown/terminal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"terminal.js","sourceRoot":"","sources":["../../../src/runtime/shutdown/terminal.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAKH,oFAAoF;AACpF,MAAM,CAAC,MAAM,sBAAsB,GAAG,KAAK,CAAC;AAE5C,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,QAAqD,EACrD,GAA+B;IAE/B,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,UAAsC,CAAC;IAC3C,+EAA+E;IAC/E,6EAA6E;IAC7E,MAAM,WAAW,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE;QAClC,QAAQ,IAAI,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,KAAK,IAAmB,EAAE;QAC1C,4EAA4E;QAC5E,+EAA+E;QAC/E,kEAAkE;QAClE,KAAK,IAAI,SAAS,GAAG,CAAC,CAAC,EAAE,SAAS,KAAK,QAAQ,GAAI,CAAC;YAClD,SAAS,GAAG,QAAQ,CAAC;YACrB,MAAM,QAAQ,CAAC,OAAO,EAAE,CAAC;QAC3B,CAAC;IACH,CAAC,CAAC;IACF,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,IAAI,CAAC;YACjB,SAAS,EAAE;YACX,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;gBAC5B,UAAU,GAAG,UAAU,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC;YAC3D,CAAC,CAAC;SACH,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,UAAU,CAAC,CAAC;QACzB,WAAW,EAAE,CAAC;QACd,QAAQ,CAAC,OAAO,EAAE,CAAC;IACrB,CAAC;AACH,CAAC"}

package/dist/runtime/startup/buffer.d.ts

@@ -9,7 +9,7 @@
  *
  * This collector appends only while the startup gate is open and caps the buffer
  * so a chatty CLI cannot balloon it; once `release()` is called (right after the
- * usability check reads it) further chunks are dropped and the retained string is
+ * usability check reads it) further chunks are dropped and the retained bytes are
  * cleared, so no per-session transcript lingers. Implements PRD §9.1 startup
  * usability and §9.4 resource cleanup.
  */

package/dist/runtime/startup/buffer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"buffer.d.ts","sourceRoot":"","sources":["../../../src/runtime/startup/buffer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAuB,KAAK,cAAc,EAAE,MAAM,YAAY,CAAC;AAMtE,MAAM,MAAM,aAAa,GAAG;IAC1B,yEAAyE;IACzE,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACtC,kEAAkE;IAClE,QAAQ,CAAC,IAAI,EAAE,MAAM,MAAM,CAAC;IAC5B,mFAAmF;IACnF,QAAQ,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC;CAC9B,CAAC;AAEF,wBAAgB,mBAAmB,CAAC,GAAG,GAAE,MAA2B,GAAG,aAAa,CAiBnF;AAED;;;;GAIG;AACH,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,cAAc,EACvB,MAAM,EAAE,aAAa,EACrB,IAAI,EAAE,MAAM,OAAO,GAAG,SAAS,GAC9B,OAAO,CAAC,IAAI,CAAC,CAMf"}
+{"version":3,"file":"buffer.d.ts","sourceRoot":"","sources":["../../../src/runtime/startup/buffer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAuB,KAAK,cAAc,EAAE,MAAM,YAAY,CAAC;AAMtE,MAAM,MAAM,aAAa,GAAG;IAC1B,yEAAyE;IACzE,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACtC,kEAAkE;IAClE,QAAQ,CAAC,IAAI,EAAE,MAAM,MAAM,CAAC;IAC5B,mFAAmF;IACnF,QAAQ,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC;CAC9B,CAAC;AAEF,wBAAgB,mBAAmB,CAAC,GAAG,GAAE,MAA2B,GAAG,aAAa,CAwBnF;AAED;;;;GAIG;AACH,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,cAAc,EACvB,MAAM,EAAE,aAAa,EACrB,IAAI,EAAE,MAAM,OAAO,GAAG,SAAS,GAC9B,OAAO,CAAC,IAAI,CAAC,CAMf"}

package/dist/runtime/startup/buffer.js

@@ -9,7 +9,7 @@
  *
  * This collector appends only while the startup gate is open and caps the buffer
  * so a chatty CLI cannot balloon it; once `release()` is called (right after the
- * usability check reads it) further chunks are dropped and the retained string is
+ * usability check reads it) further chunks are dropped and the retained bytes are
  * cleared, so no per-session transcript lingers. Implements PRD §9.1 startup
  * usability and §9.4 resource cleanup.
  */
@@ -18,22 +18,28 @@ import { assertStartupUsable } from "./index.js";
 // than any real startup screen while still bounding a misbehaving CLI.
 const STARTUP_BUFFER_CAP = 64 * 1024;
 export function createStartupBuffer(cap = STARTUP_BUFFER_CAP) {
-    let buffer = "";
+    let buffer = Buffer.alloc(cap);
+    let length = 0;
     let open = true;
     return {
         push(data) {
-            if (!open || buffer.length >= cap)
+            if (!open || length >= cap)
                 return;
-            buffer += data;
-            if (buffer.length > cap)
-                buffer = buffer.slice(0, cap);
+            const remaining = cap - length;
+            // UTF-8 needs at least as many bytes as UTF-16 units. Only measure chunks
+            // already bounded by the remaining capacity; never scan a huge receipt.
+            open = data.length <= remaining && Buffer.byteLength(data, "utf8") <= remaining;
+            // The bounded write stops before an incomplete code point and copies the
+            // prefix into owned storage, without retaining the original chunk string.
+            length += buffer.write(data.slice(0, remaining), length, remaining, "utf8");
         },
         read() {
-            return buffer;
+            return buffer.toString("utf8", 0, length);
         },
         release() {
             open = false;
-            buffer = "";
+            buffer = Buffer.alloc(0);
+            length = 0;
         },
     };
 }

package/dist/runtime/startup/buffer.js.map

@@ -1 +1 @@
-{"version":3,"file":"buffer.js","sourceRoot":"","sources":["../../../src/runtime/startup/buffer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,EAAE,mBAAmB,EAAuB,MAAM,YAAY,CAAC;AAEtE,8EAA8E;AAC9E,uEAAuE;AACvE,MAAM,kBAAkB,GAAG,EAAE,GAAG,IAAI,CAAC;AAWrC,MAAM,UAAU,mBAAmB,CAAC,MAAc,kBAAkB;IAClE,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,IAAI,GAAG,IAAI,CAAC;IAChB,OAAO;QACL,IAAI,CAAC,IAAY;YACf,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,MAAM,IAAI,GAAG;gBAAE,OAAO;YAC1C,MAAM,IAAI,IAAI,CAAC;YACf,IAAI,MAAM,CAAC,MAAM,GAAG,GAAG;gBAAE,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACzD,CAAC;QACD,IAAI;YACF,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,OAAO;YACL,IAAI,GAAG,KAAK,CAAC;YACb,MAAM,GAAG,EAAE,CAAC;QACd,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,OAAuB,EACvB,MAAqB,EACrB,IAA+B;IAE/B,IAAI,CAAC;QACH,MAAM,mBAAmB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC5E,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,OAAO,EAAE,CAAC;IACnB,CAAC;AACH,CAAC"}
+{"version":3,"file":"buffer.js","sourceRoot":"","sources":["../../../src/runtime/startup/buffer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,EAAE,mBAAmB,EAAuB,MAAM,YAAY,CAAC;AAEtE,8EAA8E;AAC9E,uEAAuE;AACvE,MAAM,kBAAkB,GAAG,EAAE,GAAG,IAAI,CAAC;AAWrC,MAAM,UAAU,mBAAmB,CAAC,MAAc,kBAAkB;IAClE,IAAI,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,IAAI,GAAG,IAAI,CAAC;IAChB,OAAO;QACL,IAAI,CAAC,IAAY;YACf,IAAI,CAAC,IAAI,IAAI,MAAM,IAAI,GAAG;gBAAE,OAAO;YACnC,MAAM,SAAS,GAAG,GAAG,GAAG,MAAM,CAAC;YAC/B,0EAA0E;YAC1E,wEAAwE;YACxE,IAAI,GAAG,IAAI,CAAC,MAAM,IAAI,SAAS,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,SAAS,CAAC;YAChF,yEAAyE;YACzE,0EAA0E;YAC1E,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;QAC9E,CAAC;QACD,IAAI;YACF,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO;YACL,IAAI,GAAG,KAAK,CAAC;YACb,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACzB,MAAM,GAAG,CAAC,CAAC;QACb,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,OAAuB,EACvB,MAAqB,EACrB,IAA+B;IAE/B,IAAI,CAAC;QACH,MAAM,mBAAmB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC5E,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,OAAO,EAAE,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/runtime/status-evidence.d.ts

@@ -7,13 +7,17 @@ import type { ElwoodSessionStatus, ElwoodStatusDecision, ElwoodStatusEvidence }
 /** The evidence kinds the engine accepts; the public alias is the source. */
 export type StatusEvidenceKind = ElwoodStatusEvidence;
 export type StatusDecision = ElwoodStatusDecision;
-export declare function decideStatus(from: ElwoodSessionStatus, evidence: StatusEvidenceKind): StatusDecision;
+export type StatusEvidenceContext = {
+    readonly inputBlocked?: boolean;
+    readonly workingVisible?: boolean;
+};
+export declare function decideStatus(from: ElwoodSessionStatus, evidence: StatusEvidenceKind, { inputBlocked, workingVisible }?: StatusEvidenceContext): StatusDecision;
 /** Diagnostics stay bounded; the log is live-only and never persisted. */
 export declare const maxStatusDecisions = 50;
 export type StatusEngineIo = {
     /** Note that the session reached `ready` at least once (idempotent, live-only). */
     readonly onReady: () => void;
-    /** Deliver status/activity events to listeners (a listener throw propagates). */
+    /** Deliver status/activity events; throws propagate outside Claude hook notification scopes. */
     readonly emitStatus: (status: ElwoodSessionStatus) => void;
     readonly queueRunning: () => void;
     readonly queueReady: () => void;
@@ -29,7 +33,7 @@ export declare class SessionStatusEngine {
     constructor(io: StatusEngineIo);
     get status(): ElwoodSessionStatus;
     decisions(): readonly StatusDecision[];
-    submit(kind: StatusEvidenceKind): StatusDecision;
+    submit(kind: StatusEvidenceKind, context?: StatusEvidenceContext): StatusDecision;
     private apply;
 }
 //# sourceMappingURL=status-evidence.d.ts.map

package/dist/runtime/status-evidence.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"status-evidence.d.ts","sourceRoot":"","sources":["../../src/runtime/status-evidence.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,EACV,mBAAmB,EACnB,oBAAoB,EACpB,oBAAoB,EACrB,MAAM,kBAAkB,CAAC;AAG1B,6EAA6E;AAC7E,MAAM,MAAM,kBAAkB,GAAG,oBAAoB,CAAC;AAEtD,MAAM,MAAM,cAAc,GAAG,oBAAoB,CAAC;AAgClD,wBAAgB,YAAY,CAC1B,IAAI,EAAE,mBAAmB,EACzB,QAAQ,EAAE,kBAAkB,GAC3B,cAAc,CAiChB;AAED,0EAA0E;AAC1E,eAAO,MAAM,kBAAkB,KAAK,CAAC;AAErC,MAAM,MAAM,cAAc,GAAG;IAC3B,mFAAmF;IACnF,QAAQ,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC;IAC7B,iFAAiF;IACjF,QAAQ,CAAC,UAAU,EAAE,CAAC,MAAM,EAAE,mBAAmB,KAAK,IAAI,CAAC;IAC3D,QAAQ,CAAC,YAAY,EAAE,MAAM,IAAI,CAAC;IAClC,QAAQ,CAAC,UAAU,EAAE,MAAM,IAAI,CAAC;IAChC,4EAA4E;IAC5E,QAAQ,CAAC,YAAY,EAAE,MAAM,IAAI,CAAC;IAClC,QAAQ,CAAC,UAAU,EAAE,MAAM,IAAI,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC;CAC9B,CAAC;AAEF,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAiB;IACpC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAwB;IAC5C,OAAO,CAAC,OAAO,CAAmC;gBAEtC,EAAE,EAAE,cAAc;IAI9B,IAAI,MAAM,IAAI,mBAAmB,CAEhC;IAED,SAAS,IAAI,SAAS,cAAc,EAAE;IAItC,MAAM,CAAC,IAAI,EAAE,kBAAkB,GAAG,cAAc;IAQhD,OAAO,CAAC,KAAK;CA6Cd"}
+{"version":3,"file":"status-evidence.d.ts","sourceRoot":"","sources":["../../src/runtime/status-evidence.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,EACV,mBAAmB,EACnB,oBAAoB,EACpB,oBAAoB,EACrB,MAAM,kBAAkB,CAAC;AAG1B,6EAA6E;AAC7E,MAAM,MAAM,kBAAkB,GAAG,oBAAoB,CAAC;AAEtD,MAAM,MAAM,cAAc,GAAG,oBAAoB,CAAC;AAgClD,MAAM,MAAM,qBAAqB,GAAG;IAClC,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;CACnC,CAAC;AAEF,wBAAgB,YAAY,CAC1B,IAAI,EAAE,mBAAmB,EACzB,QAAQ,EAAE,kBAAkB,EAC5B,EAAE,YAAoB,EAAE,cAAsB,EAAE,GAAE,qBAA0B,GAC3E,cAAc,CAoChB;AAED,0EAA0E;AAC1E,eAAO,MAAM,kBAAkB,KAAK,CAAC;AAErC,MAAM,MAAM,cAAc,GAAG;IAC3B,mFAAmF;IACnF,QAAQ,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC;IAC7B,gGAAgG;IAChG,QAAQ,CAAC,UAAU,EAAE,CAAC,MAAM,EAAE,mBAAmB,KAAK,IAAI,CAAC;IAC3D,QAAQ,CAAC,YAAY,EAAE,MAAM,IAAI,CAAC;IAClC,QAAQ,CAAC,UAAU,EAAE,MAAM,IAAI,CAAC;IAChC,4EAA4E;IAC5E,QAAQ,CAAC,YAAY,EAAE,MAAM,IAAI,CAAC;IAClC,QAAQ,CAAC,UAAU,EAAE,MAAM,IAAI,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC;CAC9B,CAAC;AAEF,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAiB;IACpC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAwB;IAC5C,OAAO,CAAC,OAAO,CAAmC;gBAEtC,EAAE,EAAE,cAAc;IAI9B,IAAI,MAAM,IAAI,mBAAmB,CAEhC;IAED,SAAS,IAAI,SAAS,cAAc,EAAE;IAItC,MAAM,CAAC,IAAI,EAAE,kBAAkB,EAAE,OAAO,GAAE,qBAA0B,GAAG,cAAc;IAQrF,OAAO,CAAC,KAAK;CA6Cd"}

package/dist/runtime/status-evidence.js

@@ -33,9 +33,13 @@ const requiresLiveSession = new Set([
     "blocking_prompt_shown",
     "blocking_prompt_cleared",
 ]);
-export function decideStatus(from, evidence) {
-    const target = evidenceTargets[evidence];
+export function decideStatus(from, evidence, { inputBlocked = false, workingVisible = false } = {}) {
+    const target = evidence === "blocking_prompt_cleared" && workingVisible
+        ? "running"
+        : evidenceTargets[evidence];
     const ignored = (reason) => ({ evidence, from, to: undefined, reason });
+    if (inputBlocked && target === "ready")
+        return ignored("ignored: a trust gate or closing session holds input");
     // Turn/blocking evidence describes in-session activity; before the session
     // is live (`starting`) it must not fabricate `ready`/`running`/`blocked`.
     if (requiresLiveSession.has(evidence) && !liveStatuses.has(from)) {
@@ -50,12 +54,10 @@ export function decideStatus(from, evidence) {
     if (evidence === "blocking_prompt_shown" && !(from === "running" || from === "ready")) {
         return ignored(`ignored: cannot block from ${from}`);
     }
-    // Initial readiness must not reopen a session that is currently blocked: a
-    // startup dialog (e.g. a trust prompt) can be on screen when the readiness
-    // hook or its deadline fires, and applying `ready` here would drain queued
-    // input into the dialog. Only `blocking_prompt_cleared` may leave `blocked`.
-    if (evidence === "initial_ready" && from === "blocked") {
-        return ignored("ignored: initial_ready must not reopen a blocked session");
+    // Readiness, caller submissions, and turn edges cannot clear a visible human prompt.
+    // Only observed clearance may restore its running or ready state.
+    if (from === "blocked" && liveStatuses.has(target) && evidence !== "blocking_prompt_cleared") {
+        return ignored(`ignored: ${evidence} must not reopen a blocked session`);
     }
     // A cleared blocking prompt only settles a session that was actually
     // blocked; otherwise the clear is stale (the composer resumed on its own).
@@ -82,8 +84,8 @@ export class SessionStatusEngine {
     decisions() {
         return this.log;
     }
-    submit(kind) {
-        const decision = decideStatus(this.current, kind);
+    submit(kind, context = {}) {
+        const decision = decideStatus(this.current, kind, context);
         this.log.push(decision);
         if (this.log.length > maxStatusDecisions)
             this.log.shift();

package/dist/runtime/status-evidence.js.map

@@ -1 +1 @@
-{"version":3,"file":"status-evidence.js","sourceRoot":"","sources":["../../src/runtime/status-evidence.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAM5D,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAOpD,MAAM,eAAe,GAA8D;IACjF,cAAc,EAAE,SAAS;IACzB,aAAa,EAAE,OAAO;IACtB,eAAe,EAAE,OAAO;IACxB,qBAAqB,EAAE,SAAS;IAChC,mBAAmB,EAAE,OAAO;IAC5B,gBAAgB,EAAE,SAAS;IAC3B,qBAAqB,EAAE,SAAS;IAChC,uBAAuB,EAAE,OAAO;IAChC,eAAe,EAAE,QAAQ;IACzB,cAAc,EAAE,SAAS;IACzB,cAAc,EAAE,QAAQ;IACxB,kBAAkB,EAAE,WAAW;CAChC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAqB;IACtD,iBAAiB;IACjB,uBAAuB;IACvB,qBAAqB;IACrB,kBAAkB;IAClB,uBAAuB;IACvB,yBAAyB;CAC1B,CAAC,CAAC;AAEH,MAAM,UAAU,YAAY,CAC1B,IAAyB,EACzB,QAA4B;IAE5B,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,CAAC,MAAc,EAAkB,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;IAChG,2EAA2E;IAC3E,0EAA0E;IAC1E,IAAI,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACjE,OAAO,OAAO,CAAC,YAAY,QAAQ,gCAAgC,IAAI,GAAG,CAAC,CAAC;IAC9E,CAAC;IACD,6EAA6E;IAC7E,8EAA8E;IAC9E,IAAI,QAAQ,KAAK,gBAAgB,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;QACzD,OAAO,OAAO,CAAC,4DAA4D,IAAI,GAAG,CAAC,CAAC;IACtF,CAAC;IACD,0EAA0E;IAC1E,IAAI,QAAQ,KAAK,uBAAuB,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,OAAO,CAAC,EAAE,CAAC;QACtF,OAAO,OAAO,CAAC,8BAA8B,IAAI,EAAE,CAAC,CAAC;IACvD,CAAC;IACD,2EAA2E;IAC3E,2EAA2E;IAC3E,2EAA2E;IAC3E,6EAA6E;IAC7E,IAAI,QAAQ,KAAK,eAAe,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvD,OAAO,OAAO,CAAC,0DAA0D,CAAC,CAAC;IAC7E,CAAC;IACD,qEAAqE;IACrE,2EAA2E;IAC3E,IAAI,QAAQ,KAAK,yBAAyB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACjE,OAAO,OAAO,CAAC,YAAY,IAAI,iBAAiB,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;QACjC,OAAO,OAAO,CAAC,YAAY,IAAI,kBAAkB,MAAM,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,IAAI,WAAW,MAAM,EAAE,EAAE,CAAC;AACrF,CAAC;AAED,0EAA0E;AAC1E,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAerC,MAAM,OAAO,mBAAmB;IACb,EAAE,CAAiB;IACnB,GAAG,GAAqB,EAAE,CAAC;IACpC,OAAO,GAAwB,UAAU,CAAC;IAElD,YAAY,EAAkB;QAC5B,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;IACf,CAAC;IAED,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED,SAAS;QACP,OAAO,IAAI,CAAC,GAAG,CAAC;IAClB,CAAC;IAED,MAAM,CAAC,IAAwB;QAC7B,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAClD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACxB,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,kBAAkB;YAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;QAC3D,IAAI,QAAQ,CAAC,EAAE,KAAK,SAAS;YAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACvD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,KAAK,CAAC,EAAuB;QACnC,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;YACrB,kFAAkF;YAClF,kFAAkF;YAClF,sFAAsF;YACtF,4CAA4C;YAC5C,IAAI,CAAC,OAAO,GAAG,EAAE,CAAC;YAClB,IAAI,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC;YACvB,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YACvB,OAAO;QACT,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,EAAE,CAAC;QAClB,IAAI,EAAE,KAAK,OAAO,EAAE,CAAC;YACnB,yEAAyE;YACzE,6EAA6E;YAC7E,0EAA0E;YAC1E,6EAA6E;YAC7E,iCAAiC;YACjC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC;YAClB,IAAI,CAAC;gBACH,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YACzB,CAAC;oBAAS,CAAC;gBACT,IAAI,CAAC,EAAE,CAAC,UAAU,EAAE,CAAC;YACvB,CAAC;YACD,OAAO;QACT,CAAC;QACD,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;YACrB,+EAA+E;YAC/E,gFAAgF;YAChF,mFAAmF;YACnF,IAAI,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC;YACvB,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YACvB,OAAO;QACT,CAAC;QACD,IAAI,CAAC,EAAE,CAAC,UAAU,EAAE,CAAC;QACrB,iFAAiF;QACjF,sEAAsE;QACtE,iFAAiF;QACjF,2DAA2D;QAC3D,IAAI,CAAC;YACH,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACzB,CAAC;gBAAS,CAAC;YACT,IAAI,EAAE,KAAK,QAAQ;gBAAE,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC;QACzC,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"status-evidence.js","sourceRoot":"","sources":["../../src/runtime/status-evidence.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAM5D,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAOpD,MAAM,eAAe,GAA8D;IACjF,cAAc,EAAE,SAAS;IACzB,aAAa,EAAE,OAAO;IACtB,eAAe,EAAE,OAAO;IACxB,qBAAqB,EAAE,SAAS;IAChC,mBAAmB,EAAE,OAAO;IAC5B,gBAAgB,EAAE,SAAS;IAC3B,qBAAqB,EAAE,SAAS;IAChC,uBAAuB,EAAE,OAAO;IAChC,eAAe,EAAE,QAAQ;IACzB,cAAc,EAAE,SAAS;IACzB,cAAc,EAAE,QAAQ;IACxB,kBAAkB,EAAE,WAAW;CAChC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAqB;IACtD,iBAAiB;IACjB,uBAAuB;IACvB,qBAAqB;IACrB,kBAAkB;IAClB,uBAAuB;IACvB,yBAAyB;CAC1B,CAAC,CAAC;AAOH,MAAM,UAAU,YAAY,CAC1B,IAAyB,EACzB,QAA4B,EAC5B,EAAE,YAAY,GAAG,KAAK,EAAE,cAAc,GAAG,KAAK,KAA4B,EAAE;IAE5E,MAAM,MAAM,GACV,QAAQ,KAAK,yBAAyB,IAAI,cAAc;QACtD,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;IAChC,MAAM,OAAO,GAAG,CAAC,MAAc,EAAkB,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;IAChG,IAAI,YAAY,IAAI,MAAM,KAAK,OAAO;QACpC,OAAO,OAAO,CAAC,sDAAsD,CAAC,CAAC;IACzE,2EAA2E;IAC3E,0EAA0E;IAC1E,IAAI,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACjE,OAAO,OAAO,CAAC,YAAY,QAAQ,gCAAgC,IAAI,GAAG,CAAC,CAAC;IAC9E,CAAC;IACD,6EAA6E;IAC7E,8EAA8E;IAC9E,IAAI,QAAQ,KAAK,gBAAgB,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;QACzD,OAAO,OAAO,CAAC,4DAA4D,IAAI,GAAG,CAAC,CAAC;IACtF,CAAC;IACD,0EAA0E;IAC1E,IAAI,QAAQ,KAAK,uBAAuB,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,OAAO,CAAC,EAAE,CAAC;QACtF,OAAO,OAAO,CAAC,8BAA8B,IAAI,EAAE,CAAC,CAAC;IACvD,CAAC;IACD,qFAAqF;IACrF,kEAAkE;IAClE,IAAI,IAAI,KAAK,SAAS,IAAI,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,QAAQ,KAAK,yBAAyB,EAAE,CAAC;QAC7F,OAAO,OAAO,CAAC,YAAY,QAAQ,oCAAoC,CAAC,CAAC;IAC3E,CAAC;IACD,qEAAqE;IACrE,2EAA2E;IAC3E,IAAI,QAAQ,KAAK,yBAAyB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACjE,OAAO,OAAO,CAAC,YAAY,IAAI,iBAAiB,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;QACjC,OAAO,OAAO,CAAC,YAAY,IAAI,kBAAkB,MAAM,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,IAAI,WAAW,MAAM,EAAE,EAAE,CAAC;AACrF,CAAC;AAED,0EAA0E;AAC1E,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAerC,MAAM,OAAO,mBAAmB;IACb,EAAE,CAAiB;IACnB,GAAG,GAAqB,EAAE,CAAC;IACpC,OAAO,GAAwB,UAAU,CAAC;IAElD,YAAY,EAAkB;QAC5B,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;IACf,CAAC;IAED,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED,SAAS;QACP,OAAO,IAAI,CAAC,GAAG,CAAC;IAClB,CAAC;IAED,MAAM,CAAC,IAAwB,EAAE,UAAiC,EAAE;QAClE,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QAC3D,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACxB,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,kBAAkB;YAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;QAC3D,IAAI,QAAQ,CAAC,EAAE,KAAK,SAAS;YAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACvD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,KAAK,CAAC,EAAuB;QACnC,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;YACrB,kFAAkF;YAClF,kFAAkF;YAClF,sFAAsF;YACtF,4CAA4C;YAC5C,IAAI,CAAC,OAAO,GAAG,EAAE,CAAC;YAClB,IAAI,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC;YACvB,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YACvB,OAAO;QACT,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,EAAE,CAAC;QAClB,IAAI,EAAE,KAAK,OAAO,EAAE,CAAC;YACnB,yEAAyE;YACzE,6EAA6E;YAC7E,0EAA0E;YAC1E,6EAA6E;YAC7E,iCAAiC;YACjC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC;YAClB,IAAI,CAAC;gBACH,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YACzB,CAAC;oBAAS,CAAC;gBACT,IAAI,CAAC,EAAE,CAAC,UAAU,EAAE,CAAC;YACvB,CAAC;YACD,OAAO;QACT,CAAC;QACD,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;YACrB,+EAA+E;YAC/E,gFAAgF;YAChF,mFAAmF;YACnF,IAAI,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC;YACvB,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YACvB,OAAO;QACT,CAAC;QACD,IAAI,CAAC,EAAE,CAAC,UAAU,EAAE,CAAC;QACrB,iFAAiF;QACjF,sEAAsE;QACtE,iFAAiF;QACjF,2DAA2D;QAC3D,IAAI,CAAC;YACH,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACzB,CAAC;gBAAS,CAAC;YACT,IAAI,EAAE,KAAK,QAAQ;gBAAE,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC;QACzC,CAAC;IACH,CAAC;CACF"}

package/dist/runtime/update/lock.d.ts

@@ -8,12 +8,19 @@ export type UpdateLeaseOptions = {
     readonly root?: string;
     readonly pollMs?: number;
     readonly staleMs?: number;
+    readonly waitMs?: number;
+    readonly retainRetryMs?: number;
 };
 export declare function updateLockPath(adapter: UpdateAdapter, root?: string): string;
 /**
  * Runs `update` only for the lease owner. A contender waits until that owner
  * settles and then returns without a duplicate update; callers re-read version
  * state after this resolves. Waiting uses timers, never a blocking filesystem loop.
+ * After 60 seconds by default, a still-active owner rejects with the adapter's
+ * update_failed error and updateReason active_owner; preflight warns and continues.
+ * A lease held by a surviving updater group skips that wait and rejects immediately with
+ * updateReason cleanup_pending, since those groups may outlive any bound worth setting.
+ * Both reasons reach the caller as one `update_active` warning, so neither blocks startup.
  */
 export declare function coordinatedAutoupdate(adapter: UpdateAdapter, update: () => Promise<void>, options?: UpdateLeaseOptions): Promise<void>;
 //# sourceMappingURL=lock.d.ts.map

package/dist/runtime/update/lock.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lock.d.ts","sourceRoot":"","sources":["../../../src/runtime/update/lock.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AASH,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,OAAO,CAAC;AAE/C,MAAM,MAAM,kBAAkB,GAAG;IAC/B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B,CAAC;AAYF,wBAAgB,cAAc,CAAC,OAAO,EAAE,aAAa,EAAE,IAAI,SAAqB,GAAG,MAAM,CAExF;AAED;;;;GAIG;AACH,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,EAC3B,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,IAAI,CAAC,CAmCf"}
+{"version":3,"file":"lock.d.ts","sourceRoot":"","sources":["../../../src/runtime/update/lock.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAoBH,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,OAAO,CAAC;AAE/C,MAAM,MAAM,kBAAkB,GAAG;IAC/B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC,CAAC;AAcF,wBAAgB,cAAc,CAAC,OAAO,EAAE,aAAa,EAAE,IAAI,SAAqB,GAAG,MAAM,CAExF;AAED;;;;;;;;;GASG;AACH,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,EAC3B,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,IAAI,CAAC,CAwEf"}

package/dist/runtime/update/lock.js

@@ -4,14 +4,20 @@
  * one macOS user serialize per-adapter updates and recover a killed owner's lease.
  */
 import { randomUUID } from "node:crypto";
-import { chmod, mkdir, readFile, rename, rmdir, stat, unlink, writeFile } from "node:fs/promises";
+import { chmod, mkdir, opendir, rename, rm, writeFile } from "node:fs/promises";
 import { userInfo } from "node:os";
-import { join } from "node:path";
-import { setTimeout as delay } from "node:timers/promises";
-import { errnoCode } from "../../core/errors.js";
+import { basename, dirname, join } from "node:path";
+import { elwoodError } from "../../core/errors.js";
+import { waitForProbeGroups } from "../probe-cleanup.js";
+import { ownerFile, readOptionalText, releaseLease, retiredLeaseInfix, serializeOwner, unresolvedProbeGroup, } from "./owner.js";
+import { retainLease } from "./retained-lease.js";
+import { pathExists, recoveryPath, waitForOwner } from "./waiting.js";
 const defaultPollMs = 50;
 const defaultStaleMs = 30_000;
-const ownerFile = "owner";
+const maxSweptLeftovers = 8;
+const maxInspectedEntries = 64;
+const defaultWaitMs = 60_000;
+const defaultRetainRetryMs = 1_000;
 function defaultLeaseRoot() {
     const user = userInfo();
     return join(user.homedir, "Library", "Caches", "elwood", `${user.uid}-updates`);
@@ -23,162 +29,137 @@ export function updateLockPath(adapter, root = defaultLeaseRoot()) {
  * Runs `update` only for the lease owner. A contender waits until that owner
  * settles and then returns without a duplicate update; callers re-read version
  * state after this resolves. Waiting uses timers, never a blocking filesystem loop.
+ * After 60 seconds by default, a still-active owner rejects with the adapter's
+ * update_failed error and updateReason active_owner; preflight warns and continues.
+ * A lease held by a surviving updater group skips that wait and rejects immediately with
+ * updateReason cleanup_pending, since those groups may outlive any bound worth setting.
+ * Both reasons reach the caller as one `update_active` warning, so neither blocks startup.
  */
 export async function coordinatedAutoupdate(adapter, update, options = {}) {
     const root = options.root ?? defaultLeaseRoot();
     const path = updateLockPath(adapter, root);
     const pollMs = options.pollMs ?? defaultPollMs;
     const staleMs = options.staleMs ?? defaultStaleMs;
+    // Monotonic: the wait is a promised bound, so a backward system-clock adjustment must
+    // not extend it. `mtime` staleness below stays on the wall clock, which is what it is.
+    const waitUntilMs = performance.now() + (options.waitMs ?? defaultWaitMs);
     await mkdir(root, { recursive: true, mode: 0o700 });
     await chmod(root, 0o700);
     const owner = { pid: process.pid, token: randomUUID() };
     const completion = join(root, `${adapter}.completed`);
-    const priorCompletion = await readCompletion(completion);
+    const priorCompletion = await readOptionalText(completion);
     let observedActive = (await pathExists(path)) || (await pathExists(recoveryPath(path)));
     let recoveredStale = false;
     while (!(await claimLease(path, owner))) {
-        // Losing the claim IS an observation of an active owner. Sampling only before
-        // the loop misses a peer that claimed in the interim, and that contender would
-        // then treat its own later claim as the first attempt and run a duplicate
+        // Losing the claim to an existing lease IS an observation of an active owner; a claim
+        // that failed on its own staging finds no lease below and returns as released. Sampling
+        // only before the loop misses a peer that claimed in the interim, and that contender
+        // would then treat its own later claim as the first attempt and run a duplicate
         // update (PRD §9.2: a contender skips its duplicate attempt).
         observedActive = true;
-        const waited = await waitForOwner(path, pollMs, staleMs);
+        const waited = await waitForOwner(path, pollMs, staleMs, waitUntilMs);
         if (waited === "released")
             return;
+        if (waited === "wait_expired") {
+            throw elwoodError(`${adapter}_update_failed`, "Another updater has not finished.", {
+                updateReason: "active_owner",
+            });
+        }
+        if (waited === "cleanup_pending") {
+            throw elwoodError(`${adapter}_update_failed`, "Another updater's process group has not exited.", { updateReason: "cleanup_pending", cleanupErrorCode: "ETIMEDOUT" });
+        }
         recoveredStale = true;
     }
     if (!recoveredStale &&
-        (observedActive || (await readCompletion(completion)) !== priorCompletion)) {
+        (observedActive || (await readOptionalText(completion)) !== priorCompletion)) {
         await releaseLease(path, owner);
         return;
     }
-    try {
-        await update();
-    }
-    finally {
+    // Started through `Promise.resolve().then` so an updater that throws SYNCHRONOUSLY is a
+    // rejection like any other. Calling `update()` bare would let such a throw escape past
+    // the release below with the lease still held, which is the one failure the lease cannot
+    // absorb: no group survives to hold it, so it would simply stand until the stale bound.
+    const outcome = await Promise.resolve()
+        .then(update)
+        .then(() => undefined, (error) => ({ error }));
+    // An aborted probe's unresolved group is observed once more: only a group still live
+    // after that window keeps the lease, and then the lease outlives this process.
+    const abortedGroupId = unresolvedProbeGroup(outcome?.error);
+    const unfinishedGroupIds = abortedGroupId === undefined ? [] : await waitForProbeGroups([abortedGroupId]);
+    if (unfinishedGroupIds.length === 0) {
         await Promise.allSettled([writeFile(completion, owner.token, { mode: 0o600 })]);
         await releaseLease(path, owner);
     }
+    else {
+        await retainLease(path, owner, unfinishedGroupIds, options.retainRetryMs ?? defaultRetainRetryMs);
+    }
+    if (outcome !== undefined)
+        throw outcome.error;
 }
+/**
+ * Publishes the lease atomically: the owner record is written inside a private staging
+ * directory that is then renamed into place, so no partial or ownerless lease is ever
+ * published. A claimant killed before that rename leaves only its staging directory; one
+ * killed after it leaves a complete lease naming a dead owner, which ordinary stale
+ * recovery removes. `rename` refuses a non-empty destination, which is exactly an
+ * existing lease.
+ */
 async function claimLease(path, owner) {
-    if (await pathExists(recoveryPath(path)))
+    // An existing lease, even an ownerless one left by an older version, is a wait condition:
+    // `rename` would silently replace an empty directory instead of recovering it as stale.
+    if ((await pathExists(recoveryPath(path))) || (await pathExists(path)))
         return false;
+    const staging = `${path}.claim.${randomUUID()}`;
     try {
-        await mkdir(path, { mode: 0o700 });
-    }
-    catch {
-        return false;
-    }
-    try {
-        await writeFile(join(path, ownerFile), serializeOwner(owner), { flag: "wx", mode: 0o600 });
-        if (await pathExists(recoveryPath(path))) {
-            await releaseLease(path, owner);
-            return false;
-        }
-        return true;
+        await mkdir(staging, { mode: 0o700 });
+        await writeFile(join(staging, ownerFile), serializeOwner(owner), { flag: "wx", mode: 0o600 });
+        await rename(staging, path);
     }
     catch {
-        await rmdir(path).catch(() => undefined);
+        await rm(staging, { recursive: true, force: true }).catch(() => undefined);
         return false;
     }
-}
-async function waitForOwner(path, pollMs, staleMs) {
-    for (;;) {
-        let lease;
-        try {
-            lease = await stat(path);
-        }
-        catch {
-            if (await restoreRecovery(path))
-                continue;
-            return "released";
-        }
-        if (Date.now() - lease.mtimeMs >= staleMs) {
-            const recovered = await recoverStaleLease(path);
-            if (recovered === "removed")
-                return "stale_removed";
-            if (recovered === "unrecoverable")
-                return "released";
-        }
-        await delay(pollMs);
-    }
-}
-async function recoverStaleLease(path) {
-    const expected = await readOwner(path);
-    if (expected !== undefined && ownerIsAlive(expected.pid))
-        return "alive";
-    const recovery = recoveryPath(path);
-    try {
-        await rename(path, recovery);
-    }
-    catch {
-        return (await pathExists(recovery)) ? "alive" : "unrecoverable";
-    }
-    const moved = await readOwner(recovery);
-    if (expected?.token !== moved?.token || (moved !== undefined && ownerIsAlive(moved.pid))) {
-        return "unrecoverable";
-    }
-    try {
-        if (moved !== undefined)
-            await unlink(join(recovery, ownerFile));
-        await rmdir(recovery);
-        return "removed";
-    }
-    catch {
-        return "unrecoverable";
-    }
-}
-async function restoreRecovery(path) {
-    try {
-        await rename(recoveryPath(path), path);
-        return true;
-    }
-    catch {
-        return pathExists(path);
-    }
-}
-function recoveryPath(path) {
-    return `${path}.recovery`;
-}
-async function pathExists(path) {
-    try {
-        await stat(path);
-        return true;
-    }
-    catch {
+    if (await pathExists(recoveryPath(path))) {
+        await releaseLease(path, owner);
         return false;
     }
+    await sweepLeaseLeftovers(path);
+    return true;
 }
-async function releaseLease(path, owner) {
-    const current = await readOwner(path);
-    if (current?.token !== owner.token)
-        return;
-    await unlink(join(path, ownerFile)).catch(() => undefined);
-    await rmdir(path).catch(() => undefined);
-}
-/** File contents, or undefined when absent/unreadable (never throws). */
-async function readCompletion(path) {
+/**
+ * Removes this adapter's lease leftovers, of which there are two kinds: `.claim.` staging
+ * left by claimants killed before their publishing rename, and `.released.` directories left
+ * by an owner whose retirement was renamed away but not deleted. Only the lease holder
+ * sweeps: a live contender's staging can no longer win, and losing it merely turns that
+ * contender's failed rename into a missing source. Both kinds share one budget — at most
+ * `maxSweptLeftovers` removals from at most `maxInspectedEntries` entries read — so a pile of
+ * debris delays no single update; later holders finish the job.
+ */
+async function sweepLeaseLeftovers(path) {
+    const root = dirname(path);
+    // Claim staging AND leases already retired by their owner: both are this adapter's debris.
+    const leftovers = [".claim.", retiredLeaseInfix].map((infix) => `${basename(path)}${infix}`);
+    let swept = 0;
+    let inspected = 0;
     try {
-        return await readFile(path, "utf8");
+        // Streamed and bounded in both deletions and entries read: the root is shared with the
+        // other adapter, whose own lease holders sweep its leftovers.
+        for await (const entry of await opendir(root)) {
+            if (leftovers.some((prefix) => entry.name.startsWith(prefix))) {
+                await rm(join(root, entry.name), { recursive: true, force: true }).catch(() => undefined);
+                swept += 1;
+                if (swept === maxSweptLeftovers)
+                    break;
+            }
+            // Counted after the entry is handled, so `maxInspectedEntries` is an upper bound that
+            // is never overshot; a short root or the deletion budget above can stop the scan sooner.
+            inspected += 1;
+            if (inspected === maxInspectedEntries)
+                break;
+        }
     }
     catch {
-        return undefined;
-    }
-}
-async function readOwner(path) {
-    const match = /^(\d+):([0-9a-f-]+)$/.exec((await readCompletion(join(path, ownerFile))) ?? "");
-    return match ? { pid: Number(match[1]), token: match[2] } : undefined;
-}
-function serializeOwner(owner) {
-    return `${owner.pid}:${owner.token}`;
-}
-function ownerIsAlive(pid) {
-    try {
-        process.kill(pid, 0);
-        return true;
-    }
-    catch (error) {
-        return errnoCode(error) !== "ESRCH";
+        // Sweeping is housekeeping: an unreadable root must not stop the lease holder's update.
     }
 }
 //# sourceMappingURL=lock.js.map

package/dist/runtime/update/lock.js.map

@@ -1 +1 @@
-{"version":3,"file":"lock.js","sourceRoot":"","sources":["../../../src/runtime/update/lock.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAClG,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,IAAI,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAUjD,MAAM,aAAa,GAAG,EAAE,CAAC;AACzB,MAAM,cAAc,GAAG,MAAM,CAAC;AAC9B,MAAM,SAAS,GAAG,OAAO,CAAC;AAG1B,SAAS,gBAAgB;IACvB,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAC;IACxB,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,GAAG,UAAU,CAAC,CAAC;AAClF,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,OAAsB,EAAE,IAAI,GAAG,gBAAgB,EAAE;IAC9E,OAAO,IAAI,CAAC,IAAI,EAAE,GAAG,OAAO,OAAO,CAAC,CAAC;AACvC,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAAsB,EACtB,MAA2B,EAC3B,UAA8B,EAAE;IAEhC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,gBAAgB,EAAE,CAAC;IAChD,MAAM,IAAI,GAAG,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,aAAa,CAAC;IAC/C,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,cAAc,CAAC;IAClD,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACpD,MAAM,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACzB,MAAM,KAAK,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,UAAU,EAAE,EAAuB,CAAC;IAC7E,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,GAAG,OAAO,YAAY,CAAC,CAAC;IACtD,MAAM,eAAe,GAAG,MAAM,cAAc,CAAC,UAAU,CAAC,CAAC;IACzD,IAAI,cAAc,GAAG,CAAC,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxF,IAAI,cAAc,GAAG,KAAK,CAAC;IAC3B,OAAO,CAAC,CAAC,MAAM,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;QACxC,8EAA8E;QAC9E,+EAA+E;QAC/E,0EAA0E;QAC1E,8DAA8D;QAC9D,cAAc,GAAG,IAAI,CAAC;QACtB,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QACzD,IAAI,MAAM,KAAK,UAAU;YAAE,OAAO;QAClC,cAAc,GAAG,IAAI,CAAC;IACxB,CAAC;IACD,IACE,CAAC,cAAc;QACf,CAAC,cAAc,IAAI,CAAC,MAAM,cAAc,CAAC,UAAU,CAAC,CAAC,KAAK,eAAe,CAAC,EAC1E,CAAC;QACD,MAAM,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAChC,OAAO;IACT,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,EAAE,CAAC;IACjB,CAAC;YAAS,CAAC;QACT,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;QAChF,MAAM,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAClC,CAAC;AACH,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,IAAY,EAAE,KAAiB;IACvD,IAAI,MAAM,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACvD,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC;QACH,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,cAAc,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3F,IAAI,MAAM,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YACzC,MAAM,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAChC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACzC,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,IAAY,EACZ,MAAc,EACd,OAAe;IAEf,SAAS,CAAC;QACR,IAAI,KAAuC,CAAC;QAC5C,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,MAAM,eAAe,CAAC,IAAI,CAAC;gBAAE,SAAS;YAC1C,OAAO,UAAU,CAAC;QACpB,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,OAAO,IAAI,OAAO,EAAE,CAAC;YAC1C,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,CAAC;YAChD,IAAI,SAAS,KAAK,SAAS;gBAAE,OAAO,eAAe,CAAC;YACpD,IAAI,SAAS,KAAK,eAAe;gBAAE,OAAO,UAAU,CAAC;QACvD,CAAC;QACD,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,IAAY;IAC3C,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,QAAQ,KAAK,SAAS,IAAI,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC;IACzE,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;IAClE,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,CAAC;IACxC,IAAI,QAAQ,EAAE,KAAK,KAAK,KAAK,EAAE,KAAK,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QACzF,OAAO,eAAe,CAAC;IACzB,CAAC;IACD,IAAI,CAAC;QACH,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;QACjE,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC;QACtB,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,eAAe,CAAC;IACzB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,IAAY;IACzC,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;QACvC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,OAAO,GAAG,IAAI,WAAW,CAAC;AAC5B,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,IAAY;IACpC,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,IAAY,EAAE,KAAiB;IACzD,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,OAAO,EAAE,KAAK,KAAK,KAAK,CAAC,KAAK;QAAE,OAAO;IAC3C,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC3D,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;AAC3C,CAAC;AAED,yEAAyE;AACzE,KAAK,UAAU,cAAc,CAAC,IAAY;IACxC,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,IAAY;IACnC,MAAM,KAAK,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/F,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAW,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAClF,CAAC;AAED,SAAS,cAAc,CAAC,KAAiB;IACvC,OAAO,GAAG,KAAK,CAAC,GAAG,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;AACvC,CAAC;AAED,SAAS,YAAY,CAAC,GAAW;IAC/B,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,SAAS,CAAC,KAAK,CAAC,KAAK,OAAO,CAAC;IACtC,CAAC;AACH,CAAC"}
+{"version":3,"file":"lock.js","sourceRoot":"","sources":["../../../src/runtime/update/lock.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAChF,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAEL,SAAS,EACT,gBAAgB,EAChB,YAAY,EACZ,iBAAiB,EACjB,cAAc,EACd,oBAAoB,GACrB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAYtE,MAAM,aAAa,GAAG,EAAE,CAAC;AACzB,MAAM,cAAc,GAAG,MAAM,CAAC;AAC9B,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAC5B,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAC/B,MAAM,aAAa,GAAG,MAAM,CAAC;AAC7B,MAAM,oBAAoB,GAAG,KAAK,CAAC;AAEnC,SAAS,gBAAgB;IACvB,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAC;IACxB,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,GAAG,UAAU,CAAC,CAAC;AAClF,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,OAAsB,EAAE,IAAI,GAAG,gBAAgB,EAAE;IAC9E,OAAO,IAAI,CAAC,IAAI,EAAE,GAAG,OAAO,OAAO,CAAC,CAAC;AACvC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAAsB,EACtB,MAA2B,EAC3B,UAA8B,EAAE;IAEhC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,gBAAgB,EAAE,CAAC;IAChD,MAAM,IAAI,GAAG,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,aAAa,CAAC;IAC/C,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,cAAc,CAAC;IAClD,sFAAsF;IACtF,uFAAuF;IACvF,MAAM,WAAW,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,aAAa,CAAC,CAAC;IAC1E,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACpD,MAAM,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACzB,MAAM,KAAK,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,UAAU,EAAE,EAAuB,CAAC;IAC7E,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,GAAG,OAAO,YAAY,CAAC,CAAC;IACtD,MAAM,eAAe,GAAG,MAAM,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAC3D,IAAI,cAAc,GAAG,CAAC,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxF,IAAI,cAAc,GAAG,KAAK,CAAC;IAC3B,OAAO,CAAC,CAAC,MAAM,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;QACxC,sFAAsF;QACtF,wFAAwF;QACxF,qFAAqF;QACrF,gFAAgF;QAChF,8DAA8D;QAC9D,cAAc,GAAG,IAAI,CAAC;QACtB,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;QACtE,IAAI,MAAM,KAAK,UAAU;YAAE,OAAO;QAClC,IAAI,MAAM,KAAK,cAAc,EAAE,CAAC;YAC9B,MAAM,WAAW,CAAC,GAAG,OAAO,gBAAgB,EAAE,mCAAmC,EAAE;gBACjF,YAAY,EAAE,cAAc;aAC7B,CAAC,CAAC;QACL,CAAC;QACD,IAAI,MAAM,KAAK,iBAAiB,EAAE,CAAC;YACjC,MAAM,WAAW,CACf,GAAG,OAAO,gBAAgB,EAC1B,iDAAiD,EACjD,EAAE,YAAY,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,WAAW,EAAE,CACnE,CAAC;QACJ,CAAC;QACD,cAAc,GAAG,IAAI,CAAC;IACxB,CAAC;IACD,IACE,CAAC,cAAc;QACf,CAAC,cAAc,IAAI,CAAC,MAAM,gBAAgB,CAAC,UAAU,CAAC,CAAC,KAAK,eAAe,CAAC,EAC5E,CAAC;QACD,MAAM,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAChC,OAAO;IACT,CAAC;IACD,wFAAwF;IACxF,uFAAuF;IACvF,yFAAyF;IACzF,wFAAwF;IACxF,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE;SACpC,IAAI,CAAC,MAAM,CAAC;SACZ,IAAI,CACH,GAAG,EAAE,CAAC,SAAS,EACf,CAAC,KAAc,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAChC,CAAC;IACJ,qFAAqF;IACrF,+EAA+E;IAC/E,MAAM,cAAc,GAAG,oBAAoB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC5D,MAAM,kBAAkB,GACtB,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,kBAAkB,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC;IACjF,IAAI,kBAAkB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpC,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;QAChF,MAAM,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAClC,CAAC;SAAM,CAAC;QACN,MAAM,WAAW,CACf,IAAI,EACJ,KAAK,EACL,kBAAkB,EAClB,OAAO,CAAC,aAAa,IAAI,oBAAoB,CAC9C,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,KAAK,SAAS;QAAE,MAAM,OAAO,CAAC,KAAK,CAAC;AACjD,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,UAAU,CAAC,IAAY,EAAE,KAAiB;IACvD,0FAA0F;IAC1F,wFAAwF;IACxF,IAAI,CAAC,MAAM,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACrF,MAAM,OAAO,GAAG,GAAG,IAAI,UAAU,UAAU,EAAE,EAAE,CAAC;IAChD,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACtC,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,cAAc,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9F,MAAM,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC3E,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,MAAM,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACzC,MAAM,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAChC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAChC,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,mBAAmB,CAAC,IAAY;IAC7C,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3B,2FAA2F;IAC3F,MAAM,SAAS,GAAG,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC,CAAC;IAC7F,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,IAAI,CAAC;QACH,uFAAuF;QACvF,8DAA8D;QAC9D,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,MAAM,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9C,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;gBAC9D,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBAC1F,KAAK,IAAI,CAAC,CAAC;gBACX,IAAI,KAAK,KAAK,iBAAiB;oBAAE,MAAM;YACzC,CAAC;YACD,sFAAsF;YACtF,yFAAyF;YACzF,SAAS,IAAI,CAAC,CAAC;YACf,IAAI,SAAS,KAAK,mBAAmB;gBAAE,MAAM;QAC/C,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,wFAAwF;IAC1F,CAAC;AACH,CAAC"}

package/dist/runtime/update/owner.d.ts

@@ -0,0 +1,54 @@
+export declare const ownerFile = "owner";
+/** Marks a lease directory already retired by its owner and awaiting deletion. */
+export declare const retiredLeaseInfix = ".released.";
+/** Prefix of a record being written but not yet committed into the lease. */
+export declare const pendingOwnerPrefix = "owner.next.";
+export type LeaseOwner = {
+    readonly pid: number;
+    readonly token: string;
+    /** Updater process groups that outlived the update callback and still hold the lease. */
+    readonly ownedProcessGroupIds?: readonly number[];
+};
+/** File contents, or undefined when absent/unreadable (never throws). */
+export declare function readOptionalText(path: string): Promise<string | undefined>;
+export declare function readOwner(path: string): Promise<LeaseOwner | undefined>;
+export declare function serializeOwner(owner: LeaseOwner): string;
+/**
+ * Lease liveness, not owner-process liveness. A record naming process groups is held by
+ * those groups alone, so it ends with them rather than with the process that wrote it —
+ * that is what lets an update's surviving children keep the lease past their parent. No
+ * record names groups until something records them, so this is `parentIsAlive` until then.
+ */
+export declare function leaseIsAlive(owner: LeaseOwner): boolean;
+export declare function parentIsAlive(pid: number): boolean;
+/**
+ * The process group an aborted update probe could not confirm gone, taken from its typed
+ * error. A probe that cleaned up after itself names no group and retains no lease.
+ */
+export declare function unresolvedProbeGroup(error: unknown): number | undefined;
+/**
+ * Replaces this generation's owner record, naming the process groups that now hold the
+ * lease. The write lands on a per-write temporary name and is committed by rename, so a
+ * late or concurrent write can neither clobber nor unlink another write's pending record,
+ * and a write that outlives its lease cannot replace a successor generation's record.
+ *
+ * Rejects rather than publishes a record it could not read back. An empty list serializes
+ * to a trailing colon that `readOwner` refuses, which would make the lease unreadable and
+ * so unreleasable; an out-of-range group would either do the same or, for group 1, hold
+ * the lease against every process this user owns. A caller with no valid surviving group
+ * has nothing to retain and should release instead.
+ */
+export declare function retainProbeOwner(path: string, owner: LeaseOwner, processGroupIds: readonly number[]): Promise<void>;
+/**
+ * Retires the lease atomically by renaming it away before deleting it. Removing the record
+ * and then the directory would expose an ownerless lease in between, which a polling
+ * contender recovers as stale and follows with a duplicate update.
+ *
+ * A rename that fails outright must still not leave this owner's lease standing: the owner
+ * is alive, so contenders would read a live pid and wait for an update that already
+ * finished — forever, on that host. The fallback removes the lease where it is instead,
+ * which briefly exposes the ownerless window for that one release. That is the lesser of
+ * the two: a duplicate update is recoverable, an update no one can ever run is not.
+ */
+export declare function releaseLease(path: string, owner: LeaseOwner): Promise<void>;
+//# sourceMappingURL=owner.d.ts.map