@with-logic/elwood 0.2.0 → 0.2.2

package/dist/runtime/update/acquire.js

@@ -0,0 +1,62 @@
+/** Completion-aware acquisition of the global update lease (PRD §9.2, C-PERF-04). */
+import { elwoodError } from "../../core/errors.js";
+import { completionSnapshot, readCompletionGeneration } from "./completion.js";
+import { releaseLease } from "./owner.js";
+import { pathExists, recoveryPath, waitForOwner } from "./waiting.js";
+/** True grants update ownership; false means no update lease acquired. */
+export async function acquireUpdateLease({ adapter, leasePath, owner, completionMarkerPath, pollMs, staleMs, waitUntilMs, claim, }) {
+    const { ownerGeneration: observedGeneration, priorCompletionGeneration, ownerAlreadyCompleted, } = await completionSnapshot(leasePath, completionMarkerPath);
+    const observedGenerations = new Set(observedGeneration === undefined ? [] : [observedGeneration]);
+    let observedActive = observedGeneration !== undefined ||
+        (await pathExists(leasePath)) ||
+        (await pathExists(recoveryPath(leasePath)));
+    let recoveredStale = false;
+    while (!(await claim())) {
+        // Losing the claim to an existing lease IS an observation of an active owner; a claim
+        // that failed on its own staging finds no lease below and returns as released. Sampling
+        // only before the loop misses a peer that claimed in the interim, and that contender
+        // would then treat its own later claim as the first attempt and run a duplicate
+        // update (PRD §9.2: a contender skips its duplicate attempt).
+        observedActive = true;
+        const waited = recoveredWait(adapter, await waitForOwner(leasePath, pollMs, staleMs, waitUntilMs));
+        if (waited === false)
+            return false;
+        if (waited.generation !== undefined)
+            observedGenerations.add(waited.generation);
+        recoveredStale = true;
+    }
+    let currentCompletionGeneration;
+    try {
+        currentCompletionGeneration = await readCompletionGeneration(completionMarkerPath);
+    }
+    catch (error) {
+        await releaseLease(leasePath, owner);
+        throw error;
+    }
+    const observedOwnerCompleted = ownerAlreadyCompleted ||
+        (currentCompletionGeneration !== undefined &&
+            observedGenerations.has(currentCompletionGeneration));
+    const completionAdvanced = currentCompletionGeneration !== priorCompletionGeneration;
+    const unrecoveredContention = !recoveredStale && observedActive;
+    if (observedOwnerCompleted || completionAdvanced || unrecoveredContention) {
+        await releaseLease(leasePath, owner);
+        return false;
+    }
+    return true;
+}
+/** A nonoptional return and no default make future wait variants a compile-time error. */
+function recoveredWait(adapter, result) {
+    switch (result.status) {
+        case "released":
+            return false;
+        case "wait_expired":
+            throw elwoodError(`${adapter}_update_failed`, "Another updater has not finished.", {
+                updateReason: "active_owner",
+            });
+        case "cleanup_pending":
+            throw elwoodError(`${adapter}_update_failed`, "Another updater's process group has not exited.", { updateReason: "cleanup_pending", cleanupErrorCode: "ETIMEDOUT" });
+        case "stale_removed":
+            return result;
+    }
+}
+//# sourceMappingURL=acquire.js.map

package/dist/runtime/update/acquire.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"acquire.js","sourceRoot":"","sources":["../../../src/runtime/update/acquire.ts"],"names":[],"mappings":"AAAA,qFAAqF;AACrF,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAE/E,OAAO,EAAmB,YAAY,EAAE,MAAM,YAAY,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,YAAY,EAAyB,YAAY,EAAE,MAAM,cAAc,CAAC;AAa7F,0EAA0E;AAC1E,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,EACvC,OAAO,EACP,SAAS,EACT,KAAK,EACL,oBAAoB,EACpB,MAAM,EACN,OAAO,EACP,WAAW,EACX,KAAK,GACO;IACZ,MAAM,EACJ,eAAe,EAAE,kBAAkB,EACnC,yBAAyB,EACzB,qBAAqB,GACtB,GAAG,MAAM,kBAAkB,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;IAC9D,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,kBAAkB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC;IAClG,IAAI,cAAc,GAChB,kBAAkB,KAAK,SAAS;QAChC,CAAC,MAAM,UAAU,CAAC,SAAS,CAAC,CAAC;QAC7B,CAAC,MAAM,UAAU,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAC9C,IAAI,cAAc,GAAG,KAAK,CAAC;IAC3B,OAAO,CAAC,CAAC,MAAM,KAAK,EAAE,CAAC,EAAE,CAAC;QACxB,sFAAsF;QACtF,wFAAwF;QACxF,qFAAqF;QACrF,gFAAgF;QAChF,8DAA8D;QAC9D,cAAc,GAAG,IAAI,CAAC;QACtB,MAAM,MAAM,GAAG,aAAa,CAC1B,OAAO,EACP,MAAM,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,CAAC,CAC5D,CAAC;QACF,IAAI,MAAM,KAAK,KAAK;YAAE,OAAO,KAAK,CAAC;QACnC,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS;YAAE,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAChF,cAAc,GAAG,IAAI,CAAC;IACxB,CAAC;IACD,IAAI,2BAA+C,CAAC;IACpD,IAAI,CAAC;QACH,2BAA2B,GAAG,MAAM,wBAAwB,CAAC,oBAAoB,CAAC,CAAC;IACrF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,YAAY,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QACrC,MAAM,KAAK,CAAC;IACd,CAAC;IACD,MAAM,sBAAsB,GAC1B,qBAAqB;QACrB,CAAC,2BAA2B,KAAK,SAAS;YACxC,mBAAmB,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC,CAAC;IAC1D,MAAM,kBAAkB,GAAG,2BAA2B,KAAK,yBAAyB,CAAC;IACrF,MAAM,qBAAqB,GAAG,CAAC,cAAc,IAAI,cAAc,CAAC;IAChE,IAAI,sBAAsB,IAAI,kBAAkB,IAAI,qBAAqB,EAAE,CAAC;QAC1E,MAAM,YAAY,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QACrC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,0FAA0F;AAC1F,SAAS,aAAa,CACpB,OAAsB,EACtB,MAAwB;IAExB,QAAQ,MAAM,CAAC,MAAM,EAAE,CAAC;QACtB,KAAK,UAAU;YACb,OAAO,KAAK,CAAC;QACf,KAAK,cAAc;YACjB,MAAM,WAAW,CAAC,GAAG,OAAO,gBAAgB,EAAE,mCAAmC,EAAE;gBACjF,YAAY,EAAE,cAAc;aAC7B,CAAC,CAAC;QACL,KAAK,iBAAiB;YACpB,MAAM,WAAW,CACf,GAAG,OAAO,gBAAgB,EAC1B,iDAAiD,EACjD,EAAE,YAAY,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,WAAW,EAAE,CACnE,CAAC;QACJ,KAAK,eAAe;YAClB,OAAO,MAAM,CAAC;IAClB,CAAC;AACH,CAAC"}

package/dist/runtime/update/completion.d.ts

@@ -0,0 +1,12 @@
+import { type LeaseOwner } from "./owner.ts";
+/** An unreadable marker is not proof that an update never completed. */
+export declare function readCompletionGeneration(markerPath: string): Promise<string | undefined>;
+/** Opening first pins the baseline inode while subsequent owner and pathname reads interleave. */
+export declare function completionSnapshot(leasePath: string, markerPath: string): Promise<{
+    readonly ownerGeneration: string | undefined;
+    readonly priorCompletionGeneration: string | undefined;
+    readonly ownerAlreadyCompleted: boolean;
+}>;
+/** Never overwrite a pinned marker inode; interrupted staging is owned by the existing lease. */
+export declare function publishCompletionGeneration(leasePath: string, markerPath: string, owner: LeaseOwner): Promise<void>;
+//# sourceMappingURL=completion.d.ts.map

package/dist/runtime/update/completion.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"completion.d.ts","sourceRoot":"","sources":["../../../src/runtime/update/completion.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,KAAK,UAAU,EAAiC,MAAM,YAAY,CAAC;AAE5E,wEAAwE;AACxE,wBAAsB,wBAAwB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAO9F;AAED,kGAAkG;AAClG,wBAAsB,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM;;;;GAmB7E;AAED,iGAAiG;AACjG,wBAAsB,2BAA2B,CAC/C,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,UAAU,GAChB,OAAO,CAAC,IAAI,CAAC,CAQf"}

package/dist/runtime/update/completion.js

@@ -0,0 +1,50 @@
+/** Pin completion snapshots and atomically publish generations (PRD §9.2, C-PERF-04). */
+import { open, readFile, rename, unlink, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+import { errnoCode } from "../../core/errors.js";
+import { pendingOwnerPrefix, readOwner } from "./owner.js";
+/** An unreadable marker is not proof that an update never completed. */
+export async function readCompletionGeneration(markerPath) {
+    try {
+        return await readFile(markerPath, "utf8");
+    }
+    catch (error) {
+        if (errnoCode(error) === "ENOENT")
+            return undefined;
+        throw error;
+    }
+}
+/** Opening first pins the baseline inode while subsequent owner and pathname reads interleave. */
+export async function completionSnapshot(leasePath, markerPath) {
+    const baseline = await open(markerPath, "r").catch((error) => {
+        if (errnoCode(error) === "ENOENT")
+            return undefined;
+        throw error;
+    });
+    try {
+        const ownerGeneration = (await readOwner(leasePath))?.token;
+        const priorCompletionGeneration = await baseline?.readFile("utf8");
+        // Keep this pathname observation before claiming: an observed owner may retire meanwhile.
+        const visibleCompletionGeneration = await readCompletionGeneration(markerPath);
+        return {
+            ownerGeneration,
+            priorCompletionGeneration,
+            ownerAlreadyCompleted: ownerGeneration !== undefined && visibleCompletionGeneration === ownerGeneration,
+        };
+    }
+    finally {
+        await baseline?.close();
+    }
+}
+/** Never overwrite a pinned marker inode; interrupted staging is owned by the existing lease. */
+export async function publishCompletionGeneration(leasePath, markerPath, owner) {
+    const staging = join(leasePath, `${pendingOwnerPrefix}${owner.token}.completed`);
+    try {
+        await writeFile(staging, owner.token, { flag: "wx", mode: 0o600 });
+        await rename(staging, markerPath);
+    }
+    finally {
+        await unlink(staging).catch(() => undefined);
+    }
+}
+//# sourceMappingURL=completion.js.map

package/dist/runtime/update/completion.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"completion.js","sourceRoot":"","sources":["../../../src/runtime/update/completion.ts"],"names":[],"mappings":"AAAA,yFAAyF;AACzF,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAmB,kBAAkB,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5E,wEAAwE;AACxE,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,UAAkB;IAC/D,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACpD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,kGAAkG;AAClG,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,SAAiB,EAAE,UAAkB;IAC5E,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;QACpE,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACpD,MAAM,KAAK,CAAC;IACd,CAAC,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,eAAe,GAAG,CAAC,MAAM,SAAS,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC;QAC5D,MAAM,yBAAyB,GAAG,MAAM,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QACnE,0FAA0F;QAC1F,MAAM,2BAA2B,GAAG,MAAM,wBAAwB,CAAC,UAAU,CAAC,CAAC;QAC/E,OAAO;YACL,eAAe;YACf,yBAAyB;YACzB,qBAAqB,EACnB,eAAe,KAAK,SAAS,IAAI,2BAA2B,KAAK,eAAe;SAC1E,CAAC;IACb,CAAC;YAAS,CAAC;QACT,MAAM,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC1B,CAAC;AACH,CAAC;AAED,iGAAiG;AACjG,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,SAAiB,EACjB,UAAkB,EAClB,KAAiB;IAEjB,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,EAAE,GAAG,kBAAkB,GAAG,KAAK,CAAC,KAAK,YAAY,CAAC,CAAC;IACjF,IAAI,CAAC;QACH,MAAM,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACnE,MAAM,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IACpC,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC/C,CAAC;AACH,CAAC"}

package/dist/runtime/update/lock.d.ts

@@ -16,7 +16,7 @@ export declare function updateLockPath(adapter: UpdateAdapter, root?: string): s
  * Runs `update` only for the lease owner. A contender waits until that owner
  * settles and then returns without a duplicate update; callers re-read version
  * state after this resolves. Waiting uses timers, never a blocking filesystem loop.
- * After 60 seconds by default, a still-active owner rejects with the adapter's
+ * After 165 seconds by default, a still-active owner rejects with the adapter's
  * update_failed error and updateReason active_owner; preflight warns and continues.
  * A lease held by a surviving updater group skips that wait and rejects immediately with
  * updateReason cleanup_pending, since those groups may outlive any bound worth setting.

package/dist/runtime/update/lock.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lock.d.ts","sourceRoot":"","sources":["../../../src/runtime/update/lock.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAoBH,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,OAAO,CAAC;AAE/C,MAAM,MAAM,kBAAkB,GAAG;IAC/B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC,CAAC;AAcF,wBAAgB,cAAc,CAAC,OAAO,EAAE,aAAa,EAAE,IAAI,SAAqB,GAAG,MAAM,CAExF;AAED;;;;;;;;;GASG;AACH,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,EAC3B,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,IAAI,CAAC,CAwEf"}
+{"version":3,"file":"lock.d.ts","sourceRoot":"","sources":["../../../src/runtime/update/lock.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAoBH,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,OAAO,CAAC;AAE/C,MAAM,MAAM,kBAAkB,GAAG;IAC/B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC,CAAC;AAaF,wBAAgB,cAAc,CAAC,OAAO,EAAE,aAAa,EAAE,IAAI,SAAqB,GAAG,MAAM,CAExF;AAED;;;;;;;;;GASG;AACH,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,EAC3B,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,IAAI,CAAC,CAoDf"}

package/dist/runtime/update/lock.js

@@ -7,16 +7,16 @@ import { randomUUID } from "node:crypto";
 import { chmod, mkdir, opendir, rename, rm, writeFile } from "node:fs/promises";
 import { userInfo } from "node:os";
 import { basename, dirname, join } from "node:path";
-import { elwoodError } from "../../core/errors.js";
-import { waitForProbeGroups } from "../probe-cleanup.js";
-import { ownerFile, readOptionalText, releaseLease, retiredLeaseInfix, serializeOwner, unresolvedProbeGroup, } from "./owner.js";
+import { waitForProbeGroups } from "../probe/cleanup.js";
+import { acquireUpdateLease } from "./acquire.js";
+import { publishCompletionGeneration } from "./completion.js";
+import { ownerFile, releaseLease, retiredLeaseInfix, serializeOwner, unresolvedProbeGroup, } from "./owner.js";
 import { retainLease } from "./retained-lease.js";
-import { pathExists, recoveryPath, waitForOwner } from "./waiting.js";
+import { defaultWaitMs, pathExists, recoveryPath } from "./waiting.js";
 const defaultPollMs = 50;
 const defaultStaleMs = 30_000;
 const maxSweptLeftovers = 8;
 const maxInspectedEntries = 64;
-const defaultWaitMs = 60_000;
 const defaultRetainRetryMs = 1_000;
 function defaultLeaseRoot() {
     const user = userInfo();
@@ -29,7 +29,7 @@ export function updateLockPath(adapter, root = defaultLeaseRoot()) {
  * Runs `update` only for the lease owner. A contender waits until that owner
  * settles and then returns without a duplicate update; callers re-read version
  * state after this resolves. Waiting uses timers, never a blocking filesystem loop.
- * After 60 seconds by default, a still-active owner rejects with the adapter's
+ * After 165 seconds by default, a still-active owner rejects with the adapter's
  * update_failed error and updateReason active_owner; preflight warns and continues.
  * A lease held by a surviving updater group skips that wait and rejects immediately with
  * updateReason cleanup_pending, since those groups may outlive any bound worth setting.
@@ -37,7 +37,7 @@ export function updateLockPath(adapter, root = defaultLeaseRoot()) {
  */
 export async function coordinatedAutoupdate(adapter, update, options = {}) {
     const root = options.root ?? defaultLeaseRoot();
-    const path = updateLockPath(adapter, root);
+    const leasePath = updateLockPath(adapter, root);
     const pollMs = options.pollMs ?? defaultPollMs;
     const staleMs = options.staleMs ?? defaultStaleMs;
     // Monotonic: the wait is a promised bound, so a backward system-clock adjustment must
@@ -46,35 +46,18 @@ export async function coordinatedAutoupdate(adapter, update, options = {}) {
     await mkdir(root, { recursive: true, mode: 0o700 });
     await chmod(root, 0o700);
     const owner = { pid: process.pid, token: randomUUID() };
-    const completion = join(root, `${adapter}.completed`);
-    const priorCompletion = await readOptionalText(completion);
-    let observedActive = (await pathExists(path)) || (await pathExists(recoveryPath(path)));
-    let recoveredStale = false;
-    while (!(await claimLease(path, owner))) {
-        // Losing the claim to an existing lease IS an observation of an active owner; a claim
-        // that failed on its own staging finds no lease below and returns as released. Sampling
-        // only before the loop misses a peer that claimed in the interim, and that contender
-        // would then treat its own later claim as the first attempt and run a duplicate
-        // update (PRD §9.2: a contender skips its duplicate attempt).
-        observedActive = true;
-        const waited = await waitForOwner(path, pollMs, staleMs, waitUntilMs);
-        if (waited === "released")
-            return;
-        if (waited === "wait_expired") {
-            throw elwoodError(`${adapter}_update_failed`, "Another updater has not finished.", {
-                updateReason: "active_owner",
-            });
-        }
-        if (waited === "cleanup_pending") {
-            throw elwoodError(`${adapter}_update_failed`, "Another updater's process group has not exited.", { updateReason: "cleanup_pending", cleanupErrorCode: "ETIMEDOUT" });
-        }
-        recoveredStale = true;
-    }
-    if (!recoveredStale &&
-        (observedActive || (await readOptionalText(completion)) !== priorCompletion)) {
-        await releaseLease(path, owner);
+    const completionMarkerPath = join(root, `${adapter}.completed`);
+    if (!(await acquireUpdateLease({
+        adapter,
+        leasePath,
+        owner,
+        completionMarkerPath,
+        pollMs,
+        staleMs,
+        waitUntilMs,
+        claim: () => claimLease(leasePath, owner),
+    })))
         return;
-    }
     // Started through `Promise.resolve().then` so an updater that throws SYNCHRONOUSLY is a
     // rejection like any other. Calling `update()` bare would let such a throw escape past
     // the release below with the lease still held, which is the one failure the lease cannot
@@ -87,11 +70,11 @@ export async function coordinatedAutoupdate(adapter, update, options = {}) {
     const abortedGroupId = unresolvedProbeGroup(outcome?.error);
     const unfinishedGroupIds = abortedGroupId === undefined ? [] : await waitForProbeGroups([abortedGroupId]);
     if (unfinishedGroupIds.length === 0) {
-        await Promise.allSettled([writeFile(completion, owner.token, { mode: 0o600 })]);
-        await releaseLease(path, owner);
+        await Promise.allSettled([publishCompletionGeneration(leasePath, completionMarkerPath, owner)]);
+        await releaseLease(leasePath, owner);
     }
     else {
-        await retainLease(path, owner, unfinishedGroupIds, options.retainRetryMs ?? defaultRetainRetryMs);
+        await retainLease(leasePath, owner, unfinishedGroupIds, options.retainRetryMs ?? defaultRetainRetryMs);
     }
     if (outcome !== undefined)
         throw outcome.error;

package/dist/runtime/update/lock.js.map

@@ -1 +1 @@
-{"version":3,"file":"lock.js","sourceRoot":"","sources":["../../../src/runtime/update/lock.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAChF,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAEL,SAAS,EACT,gBAAgB,EAChB,YAAY,EACZ,iBAAiB,EACjB,cAAc,EACd,oBAAoB,GACrB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAYtE,MAAM,aAAa,GAAG,EAAE,CAAC;AACzB,MAAM,cAAc,GAAG,MAAM,CAAC;AAC9B,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAC5B,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAC/B,MAAM,aAAa,GAAG,MAAM,CAAC;AAC7B,MAAM,oBAAoB,GAAG,KAAK,CAAC;AAEnC,SAAS,gBAAgB;IACvB,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAC;IACxB,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,GAAG,UAAU,CAAC,CAAC;AAClF,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,OAAsB,EAAE,IAAI,GAAG,gBAAgB,EAAE;IAC9E,OAAO,IAAI,CAAC,IAAI,EAAE,GAAG,OAAO,OAAO,CAAC,CAAC;AACvC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAAsB,EACtB,MAA2B,EAC3B,UAA8B,EAAE;IAEhC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,gBAAgB,EAAE,CAAC;IAChD,MAAM,IAAI,GAAG,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,aAAa,CAAC;IAC/C,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,cAAc,CAAC;IAClD,sFAAsF;IACtF,uFAAuF;IACvF,MAAM,WAAW,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,aAAa,CAAC,CAAC;IAC1E,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACpD,MAAM,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACzB,MAAM,KAAK,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,UAAU,EAAE,EAAuB,CAAC;IAC7E,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,GAAG,OAAO,YAAY,CAAC,CAAC;IACtD,MAAM,eAAe,GAAG,MAAM,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAC3D,IAAI,cAAc,GAAG,CAAC,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxF,IAAI,cAAc,GAAG,KAAK,CAAC;IAC3B,OAAO,CAAC,CAAC,MAAM,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;QACxC,sFAAsF;QACtF,wFAAwF;QACxF,qFAAqF;QACrF,gFAAgF;QAChF,8DAA8D;QAC9D,cAAc,GAAG,IAAI,CAAC;QACtB,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;QACtE,IAAI,MAAM,KAAK,UAAU;YAAE,OAAO;QAClC,IAAI,MAAM,KAAK,cAAc,EAAE,CAAC;YAC9B,MAAM,WAAW,CAAC,GAAG,OAAO,gBAAgB,EAAE,mCAAmC,EAAE;gBACjF,YAAY,EAAE,cAAc;aAC7B,CAAC,CAAC;QACL,CAAC;QACD,IAAI,MAAM,KAAK,iBAAiB,EAAE,CAAC;YACjC,MAAM,WAAW,CACf,GAAG,OAAO,gBAAgB,EAC1B,iDAAiD,EACjD,EAAE,YAAY,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,WAAW,EAAE,CACnE,CAAC;QACJ,CAAC;QACD,cAAc,GAAG,IAAI,CAAC;IACxB,CAAC;IACD,IACE,CAAC,cAAc;QACf,CAAC,cAAc,IAAI,CAAC,MAAM,gBAAgB,CAAC,UAAU,CAAC,CAAC,KAAK,eAAe,CAAC,EAC5E,CAAC;QACD,MAAM,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAChC,OAAO;IACT,CAAC;IACD,wFAAwF;IACxF,uFAAuF;IACvF,yFAAyF;IACzF,wFAAwF;IACxF,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE;SACpC,IAAI,CAAC,MAAM,CAAC;SACZ,IAAI,CACH,GAAG,EAAE,CAAC,SAAS,EACf,CAAC,KAAc,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAChC,CAAC;IACJ,qFAAqF;IACrF,+EAA+E;IAC/E,MAAM,cAAc,GAAG,oBAAoB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC5D,MAAM,kBAAkB,GACtB,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,kBAAkB,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC;IACjF,IAAI,kBAAkB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpC,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;QAChF,MAAM,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAClC,CAAC;SAAM,CAAC;QACN,MAAM,WAAW,CACf,IAAI,EACJ,KAAK,EACL,kBAAkB,EAClB,OAAO,CAAC,aAAa,IAAI,oBAAoB,CAC9C,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,KAAK,SAAS;QAAE,MAAM,OAAO,CAAC,KAAK,CAAC;AACjD,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,UAAU,CAAC,IAAY,EAAE,KAAiB;IACvD,0FAA0F;IAC1F,wFAAwF;IACxF,IAAI,CAAC,MAAM,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACrF,MAAM,OAAO,GAAG,GAAG,IAAI,UAAU,UAAU,EAAE,EAAE,CAAC;IAChD,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACtC,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,cAAc,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9F,MAAM,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC3E,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,MAAM,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACzC,MAAM,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAChC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAChC,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,mBAAmB,CAAC,IAAY;IAC7C,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3B,2FAA2F;IAC3F,MAAM,SAAS,GAAG,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC,CAAC;IAC7F,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,IAAI,CAAC;QACH,uFAAuF;QACvF,8DAA8D;QAC9D,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,MAAM,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9C,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;gBAC9D,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBAC1F,KAAK,IAAI,CAAC,CAAC;gBACX,IAAI,KAAK,KAAK,iBAAiB;oBAAE,MAAM;YACzC,CAAC;YACD,sFAAsF;YACtF,yFAAyF;YACzF,SAAS,IAAI,CAAC,CAAC;YACf,IAAI,SAAS,KAAK,mBAAmB;gBAAE,MAAM;QAC/C,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,wFAAwF;IAC1F,CAAC;AACH,CAAC"}
+{"version":3,"file":"lock.js","sourceRoot":"","sources":["../../../src/runtime/update/lock.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAChF,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,2BAA2B,EAAE,MAAM,iBAAiB,CAAC;AAC9D,OAAO,EAEL,SAAS,EACT,YAAY,EACZ,iBAAiB,EACjB,cAAc,EACd,oBAAoB,GACrB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAYvE,MAAM,aAAa,GAAG,EAAE,CAAC;AACzB,MAAM,cAAc,GAAG,MAAM,CAAC;AAC9B,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAC5B,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAC/B,MAAM,oBAAoB,GAAG,KAAK,CAAC;AAEnC,SAAS,gBAAgB;IACvB,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAC;IACxB,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,GAAG,UAAU,CAAC,CAAC;AAClF,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,OAAsB,EAAE,IAAI,GAAG,gBAAgB,EAAE;IAC9E,OAAO,IAAI,CAAC,IAAI,EAAE,GAAG,OAAO,OAAO,CAAC,CAAC;AACvC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAAsB,EACtB,MAA2B,EAC3B,UAA8B,EAAE;IAEhC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,gBAAgB,EAAE,CAAC;IAChD,MAAM,SAAS,GAAG,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,aAAa,CAAC;IAC/C,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,cAAc,CAAC;IAClD,sFAAsF;IACtF,uFAAuF;IACvF,MAAM,WAAW,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,aAAa,CAAC,CAAC;IAC1E,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACpD,MAAM,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACzB,MAAM,KAAK,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,UAAU,EAAE,EAAuB,CAAC;IAC7E,MAAM,oBAAoB,GAAG,IAAI,CAAC,IAAI,EAAE,GAAG,OAAO,YAAY,CAAC,CAAC;IAChE,IACE,CAAC,CAAC,MAAM,kBAAkB,CAAC;QACzB,OAAO;QACP,SAAS;QACT,KAAK;QACL,oBAAoB;QACpB,MAAM;QACN,OAAO;QACP,WAAW;QACX,KAAK,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,SAAS,EAAE,KAAK,CAAC;KAC1C,CAAC,CAAC;QAEH,OAAO;IACT,wFAAwF;IACxF,uFAAuF;IACvF,yFAAyF;IACzF,wFAAwF;IACxF,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE;SACpC,IAAI,CAAC,MAAM,CAAC;SACZ,IAAI,CACH,GAAG,EAAE,CAAC,SAAS,EACf,CAAC,KAAc,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAChC,CAAC;IACJ,qFAAqF;IACrF,+EAA+E;IAC/E,MAAM,cAAc,GAAG,oBAAoB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC5D,MAAM,kBAAkB,GACtB,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,kBAAkB,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC;IACjF,IAAI,kBAAkB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpC,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC,2BAA2B,CAAC,SAAS,EAAE,oBAAoB,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;QAChG,MAAM,YAAY,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACvC,CAAC;SAAM,CAAC;QACN,MAAM,WAAW,CACf,SAAS,EACT,KAAK,EACL,kBAAkB,EAClB,OAAO,CAAC,aAAa,IAAI,oBAAoB,CAC9C,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,KAAK,SAAS;QAAE,MAAM,OAAO,CAAC,KAAK,CAAC;AACjD,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,UAAU,CAAC,IAAY,EAAE,KAAiB;IACvD,0FAA0F;IAC1F,wFAAwF;IACxF,IAAI,CAAC,MAAM,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACrF,MAAM,OAAO,GAAG,GAAG,IAAI,UAAU,UAAU,EAAE,EAAE,CAAC;IAChD,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACtC,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,cAAc,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9F,MAAM,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC3E,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,MAAM,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACzC,MAAM,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAChC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAChC,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,mBAAmB,CAAC,IAAY;IAC7C,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3B,2FAA2F;IAC3F,MAAM,SAAS,GAAG,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC,CAAC;IAC7F,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,IAAI,CAAC;QACH,uFAAuF;QACvF,8DAA8D;QAC9D,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,MAAM,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9C,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;gBAC9D,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBAC1F,KAAK,IAAI,CAAC,CAAC;gBACX,IAAI,KAAK,KAAK,iBAAiB;oBAAE,MAAM;YACzC,CAAC;YACD,sFAAsF;YACtF,yFAAyF;YACzF,SAAS,IAAI,CAAC,CAAC;YACf,IAAI,SAAS,KAAK,mBAAmB;gBAAE,MAAM;QAC/C,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,wFAAwF;IAC1F,CAAC;AACH,CAAC"}

package/dist/runtime/update/once.d.ts

@@ -16,25 +16,28 @@ export type AutoupdateOutcome = {
  * Runs the adapter's update at most once per process; concurrent callers share the single
  * in-flight attempt. NEVER rejects — a throwing `runUpdate` resolves to `{ok:false, error}` so the
  * caller can contain it (warn + continue). The cross-process coordinator invalidates the local
- * version cache whether this process owned the update or waited for a peer.
+ * version cache whether this process owned the update or waited for a peer. The one exception
+ * is test-only: after `resetAutoupdateForTests()`, until a test sets a coordinator, it throws
+ * at once instead of returning.
  */
 export declare function cachedAutoupdate(adapter: UpdateAdapter, runUpdate: () => Promise<void>, afterAttempt?: () => void): Promise<AutoupdateOutcome>;
+/** Settled directory results and retained version-text bounds (C-PERF-02). */
+export declare const maxSettledPreflightDirectoryResults = 32;
+export declare const maxKeptVersionStreamCodeUnits: number;
 /**
- * Reads the adapter's `--version` at most once per process. Concurrent first callers share the
- * single in-flight read; later callers reuse the settled result. A REJECTED read is evicted (not
- * retained), so a transient failure does not poison later callers — they re-attempt. Invalidated
- * after an autoupdate so the post-update version is re-read.
+ * Reads the adapter's `--version` per observed directory. Concurrent callers share the
+ * in-flight read and its outcome. Retain up to 32 successful directory results whose stdout
+ * and stderr each contain at most 65,536 UTF-16 units. Oversized successes are returned
+ * without retention. Rejections and failed probes (nonzero exit, timeout, spawn error) are
+ * not retained, so the next caller after settlement reads again (C-LIFE-11). Every update
+ * attempt invalidates all directory results before callers validate their installed version.
  */
-export declare function cachedVersionRead(adapter: UpdateAdapter, read: () => Promise<CommandResult>): Promise<CommandResult>;
+export declare function cachedVersionRead(adapter: UpdateAdapter, read: () => Promise<CommandResult>, cwd?: string): Promise<CommandResult>;
 export declare function invalidateVersionRead(adapter: UpdateAdapter): void;
-/**
- * Share one in-flight promise per key, but EVICT the entry if it rejects, so a rejected result is
- * never retained/replayed to a later caller (which would poison the process). A successful result
- * stays cached for the process lifetime. This is the general guard against the "cached rejected
- * promise poisons every later caller" class of bug (C-LIFE-11).
- */
-export declare function dedupeInFlight<K, T>(cache: Map<K, Promise<T>>, key: K, run: () => Promise<T>): Promise<T>;
+/** Clears the update attempts, and refuses any further update until a test sets a coordinator. */
 export declare function resetAutoupdateForTests(): void;
+/** Whether an update would be refused: true from a reset until a test sets a coordinator. */
+export declare function updatesRefusedForTests(): boolean;
 export declare function setUpdateCoordinatorForTests(coordinator: typeof coordinatedAutoupdate): void;
 export declare function resetPreflightCacheForTests(): void;
 //# sourceMappingURL=once.d.ts.map

package/dist/runtime/update/once.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"once.d.ts","sourceRoot":"","sources":["../../../src/runtime/update/once.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,qBAAqB,EAAE,KAAK,aAAa,EAAE,MAAM,WAAW,CAAC;AAItE,wFAAwF;AACxF,MAAM,MAAM,iBAAiB,GACzB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;CAAE,GACrB;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;CAAE,CAAC;AAQpD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,aAAa,EACtB,SAAS,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,EAC9B,YAAY,CAAC,EAAE,MAAM,IAAI,GACxB,OAAO,CAAC,iBAAiB,CAAC,CAS5B;AAsBD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,aAAa,EACtB,IAAI,EAAE,MAAM,OAAO,CAAC,aAAa,CAAC,GACjC,OAAO,CAAC,aAAa,CAAC,CAExB;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,aAAa,GAAG,IAAI,CAElE;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,CAAC,EACjC,KAAK,EAAE,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,EACzB,GAAG,EAAE,CAAC,EACN,GAAG,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GACpB,OAAO,CAAC,CAAC,CAAC,CAYZ;AAED,wBAAgB,uBAAuB,IAAI,IAAI,CAG9C;AAED,wBAAgB,4BAA4B,CAAC,WAAW,EAAE,OAAO,qBAAqB,GAAG,IAAI,CAK5F;AAED,wBAAgB,2BAA2B,IAAI,IAAI,CAElD"}
+{"version":3,"file":"once.d.ts","sourceRoot":"","sources":["../../../src/runtime/update/once.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAOH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,qBAAqB,EAAE,KAAK,aAAa,EAAE,MAAM,WAAW,CAAC;AAItE,wFAAwF;AACxF,MAAM,MAAM,iBAAiB,GACzB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;CAAE,GACrB;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;CAAE,CAAC;AAQpD;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,aAAa,EACtB,SAAS,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,EAC9B,YAAY,CAAC,EAAE,MAAM,IAAI,GACxB,OAAO,CAAC,iBAAiB,CAAC,CAS5B;AAkBD,8EAA8E;AAC9E,eAAO,MAAM,mCAAmC,KAAK,CAAC;AACtD,eAAO,MAAM,6BAA6B,QAAY,CAAC;AAgBvD;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,aAAa,EACtB,IAAI,EAAE,MAAM,OAAO,CAAC,aAAa,CAAC,EAClC,GAAG,GAAE,MAAsB,GAC1B,OAAO,CAAC,aAAa,CAAC,CAExB;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,aAAa,GAAG,IAAI,CAElE;AAYD,kGAAkG;AAClG,wBAAgB,uBAAuB,IAAI,IAAI,CAG9C;AAED,6FAA6F;AAC7F,wBAAgB,sBAAsB,IAAI,OAAO,CAEhD;AAED,wBAAgB,4BAA4B,CAAC,WAAW,EAAE,OAAO,qBAAqB,GAAG,IAAI,CAK5F;AAED,wBAAgB,2BAA2B,IAAI,IAAI,CAElD"}

package/dist/runtime/update/once.js

@@ -3,6 +3,7 @@
  * Implements PRD §9.2 fleet-spawn dedupe, version caching, and the best-effort,
  * never-poisoning update contract (C-LIFE-09, C-LIFE-11).
  */
+import { createDirectoryProbeCache, readInDirectory, } from "../probe/directory-key.js";
 import { coordinatedAutoupdate } from "./lock.js";
 let coordinateUpdate = coordinatedAutoupdate;
 // The settled autoupdate outcome per adapter. Every `autoupdate: true` caller awaits the SAME
@@ -14,7 +15,9 @@ const autoupdates = new Map();
  * Runs the adapter's update at most once per process; concurrent callers share the single
  * in-flight attempt. NEVER rejects — a throwing `runUpdate` resolves to `{ok:false, error}` so the
  * caller can contain it (warn + continue). The cross-process coordinator invalidates the local
- * version cache whether this process owned the update or waited for a peer.
+ * version cache whether this process owned the update or waited for a peer. The one exception
+ * is test-only: after `resetAutoupdateForTests()`, until a test sets a coordinator, it throws
+ * at once instead of returning.
  */
 export function cachedAutoupdate(adapter, runUpdate, afterAttempt) {
     const existing = autoupdates.get(adapter);
@@ -36,45 +39,51 @@ function finalizeAutoupdate(adapter, outcome, afterAttempt) {
         return { ok: false, error };
     }
 }
-// The in-flight/settled `--version` read per adapter. Caching the PROMISE (not the value) means N
-// concurrent first spawns share ONE subprocess rather than each starting its own.
-const versionReads = new Map();
+/** Settled directory results and retained version-text bounds (C-PERF-02). */
+export const maxSettledPreflightDirectoryResults = 32;
+export const maxKeptVersionStreamCodeUnits = 64 * 1024;
+/** Retain only successful version results with at most 65,536 UTF-16 units per stream. */
+const isCacheableVersionResult = (result) => result.status === 0 &&
+    result.error === undefined &&
+    result.stdout.length <= maxKeptVersionStreamCodeUnits &&
+    result.stderr.length <= maxKeptVersionStreamCodeUnits;
+// Matching directory reads share a run; retain at most 32 successful directory identities
+// per adapter. Every update attempt invalidates all of that adapter's directory entries.
+const versionReads = {
+    claude: createDirectoryProbeCache(maxSettledPreflightDirectoryResults, isCacheableVersionResult),
+    codex: createDirectoryProbeCache(maxSettledPreflightDirectoryResults, isCacheableVersionResult),
+};
 /**
- * Reads the adapter's `--version` at most once per process. Concurrent first callers share the
- * single in-flight read; later callers reuse the settled result. A REJECTED read is evicted (not
- * retained), so a transient failure does not poison later callers — they re-attempt. Invalidated
- * after an autoupdate so the post-update version is re-read.
+ * Reads the adapter's `--version` per observed directory. Concurrent callers share the
+ * in-flight read and its outcome. Retain up to 32 successful directory results whose stdout
+ * and stderr each contain at most 65,536 UTF-16 units. Oversized successes are returned
+ * without retention. Rejections and failed probes (nonzero exit, timeout, spawn error) are
+ * not retained, so the next caller after settlement reads again (C-LIFE-11). Every update
+ * attempt invalidates all directory results before callers validate their installed version.
  */
-export function cachedVersionRead(adapter, read) {
-    return dedupeInFlight(versionReads, adapter, read);
+export function cachedVersionRead(adapter, read, cwd = process.cwd()) {
+    return readInDirectory(versionReads[adapter], cwd, read);
 }
 export function invalidateVersionRead(adapter) {
-    versionReads.delete(adapter);
+    versionReads[adapter].clear();
 }
 /**
- * Share one in-flight promise per key, but EVICT the entry if it rejects, so a rejected result is
- * never retained/replayed to a later caller (which would poison the process). A successful result
- * stays cached for the process lifetime. This is the general guard against the "cached rejected
- * promise poisons every later caller" class of bug (C-LIFE-11).
+ * Stands in for the coordinator after a reset, until a test sets one. The production coordinator
+ * takes its default root from the passwd database, not `HOME`, so a test's private `HOME` would
+ * not keep it out of the developer's real lease root. It throws rather than rejects: a rejection
+ * would be contained as a best-effort update's warning, and the preflight would carry on.
  */
-export function dedupeInFlight(cache, key, run) {
-    const existing = cache.get(key);
-    if (existing)
-        return existing;
-    const pending = run();
-    cache.set(key, pending);
-    // Evict on rejection so the next caller retries rather than inheriting the failure. Identity-
-    // guarded (only evict if THIS promise is still cached), so a later successful entry is never
-    // clobbered. The `.catch` also keeps the eviction chain from becoming an unhandled rejection.
-    pending.catch(() => {
-        if (cache.get(key) === pending)
-            cache.delete(key);
-    });
-    return pending;
+function refuseRealUpdateRoot() {
+    throw new Error("set a private update root: call setUpdateCoordinatorForTests after the reset");
 }
+/** Clears the update attempts, and refuses any further update until a test sets a coordinator. */
 export function resetAutoupdateForTests() {
     autoupdates.clear();
-    coordinateUpdate = coordinatedAutoupdate;
+    coordinateUpdate = refuseRealUpdateRoot;
+}
+/** Whether an update would be refused: true from a reset until a test sets a coordinator. */
+export function updatesRefusedForTests() {
+    return coordinateUpdate === refuseRealUpdateRoot;
 }
 export function setUpdateCoordinatorForTests(coordinator) {
     // Unit tests provide in-memory command runners and must never contend with a
@@ -83,6 +92,7 @@ export function setUpdateCoordinatorForTests(coordinator) {
     coordinateUpdate = coordinator;
 }
 export function resetPreflightCacheForTests() {
-    versionReads.clear();
+    for (const cache of Object.values(versionReads))
+        cache.clear();
 }
 //# sourceMappingURL=once.js.map

package/dist/runtime/update/once.js.map

@@ -1 +1 @@
-{"version":3,"file":"once.js","sourceRoot":"","sources":["../../../src/runtime/update/once.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,qBAAqB,EAAsB,MAAM,WAAW,CAAC;AAEtE,IAAI,gBAAgB,GAAiC,qBAAqB,CAAC;AAO3E,8FAA8F;AAC9F,yFAAyF;AACzF,iGAAiG;AACjG,iGAAiG;AACjG,MAAM,WAAW,GAAG,IAAI,GAAG,EAA6C,CAAC;AAEzE;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAAsB,EACtB,SAA8B,EAC9B,YAAyB;IAEzB,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,MAAM,OAAO,GAAG,gBAAgB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,IAAI,CACvD,GAAG,EAAE,CAAC,kBAAkB,CAAC,OAAO,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,YAAY,CAAC,EAC7D,CAAC,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC,OAAO,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,YAAY,CAAC,CAC3E,CAAC;IACF,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAClC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,kBAAkB,CACzB,OAAsB,EACtB,OAA0B,EAC1B,YAAyB;IAEzB,IAAI,CAAC;QACH,yEAAyE;QACzE,0EAA0E;QAC1E,qBAAqB,CAAC,OAAO,CAAC,CAAC;QAC/B,YAAY,EAAE,EAAE,CAAC;QACjB,OAAO,OAAO,CAAC;IACjB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC9B,CAAC;AACH,CAAC;AAED,kGAAkG;AAClG,kFAAkF;AAClF,MAAM,YAAY,GAAG,IAAI,GAAG,EAAyC,CAAC;AAEtE;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAAsB,EACtB,IAAkC;IAElC,OAAO,cAAc,CAAC,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,OAAsB;IAC1D,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAC/B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAC5B,KAAyB,EACzB,GAAM,EACN,GAAqB;IAErB,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC;IACtB,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACxB,8FAA8F;IAC9F,6FAA6F;IAC7F,8FAA8F;IAC9F,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE;QACjB,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,OAAO;YAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IACH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,uBAAuB;IACrC,WAAW,CAAC,KAAK,EAAE,CAAC;IACpB,gBAAgB,GAAG,qBAAqB,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,WAAyC;IACpF,6EAA6E;IAC7E,4EAA4E;IAC5E,8DAA8D;IAC9D,gBAAgB,GAAG,WAAW,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,2BAA2B;IACzC,YAAY,CAAC,KAAK,EAAE,CAAC;AACvB,CAAC"}
+{"version":3,"file":"once.js","sourceRoot":"","sources":["../../../src/runtime/update/once.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACL,yBAAyB,EAEzB,eAAe,GAChB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAAE,qBAAqB,EAAsB,MAAM,WAAW,CAAC;AAEtE,IAAI,gBAAgB,GAAiC,qBAAqB,CAAC;AAO3E,8FAA8F;AAC9F,yFAAyF;AACzF,iGAAiG;AACjG,iGAAiG;AACjG,MAAM,WAAW,GAAG,IAAI,GAAG,EAA6C,CAAC;AAEzE;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAAsB,EACtB,SAA8B,EAC9B,YAAyB;IAEzB,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,MAAM,OAAO,GAAG,gBAAgB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,IAAI,CACvD,GAAG,EAAE,CAAC,kBAAkB,CAAC,OAAO,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,YAAY,CAAC,EAC7D,CAAC,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC,OAAO,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,YAAY,CAAC,CAC3E,CAAC;IACF,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAClC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,kBAAkB,CACzB,OAAsB,EACtB,OAA0B,EAC1B,YAAyB;IAEzB,IAAI,CAAC;QACH,yEAAyE;QACzE,0EAA0E;QAC1E,qBAAqB,CAAC,OAAO,CAAC,CAAC;QAC/B,YAAY,EAAE,EAAE,CAAC;QACjB,OAAO,OAAO,CAAC;IACjB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC9B,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,MAAM,mCAAmC,GAAG,EAAE,CAAC;AACtD,MAAM,CAAC,MAAM,6BAA6B,GAAG,EAAE,GAAG,IAAI,CAAC;AAEvD,0FAA0F;AAC1F,MAAM,wBAAwB,GAAG,CAAC,MAAqB,EAAW,EAAE,CAClE,MAAM,CAAC,MAAM,KAAK,CAAC;IACnB,MAAM,CAAC,KAAK,KAAK,SAAS;IAC1B,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,6BAA6B;IACrD,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,6BAA6B,CAAC;AAExD,0FAA0F;AAC1F,yFAAyF;AACzF,MAAM,YAAY,GAA8D;IAC9E,MAAM,EAAE,yBAAyB,CAAC,mCAAmC,EAAE,wBAAwB,CAAC;IAChG,KAAK,EAAE,yBAAyB,CAAC,mCAAmC,EAAE,wBAAwB,CAAC;CAChG,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAAsB,EACtB,IAAkC,EAClC,MAAc,OAAO,CAAC,GAAG,EAAE;IAE3B,OAAO,eAAe,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,OAAsB;IAC1D,YAAY,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,CAAC;AAChC,CAAC;AAED;;;;;GAKG;AACH,SAAS,oBAAoB;IAC3B,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAC;AAClG,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,uBAAuB;IACrC,WAAW,CAAC,KAAK,EAAE,CAAC;IACpB,gBAAgB,GAAG,oBAAoB,CAAC;AAC1C,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,sBAAsB;IACpC,OAAO,gBAAgB,KAAK,oBAAoB,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,WAAyC;IACpF,6EAA6E;IAC7E,4EAA4E;IAC5E,8DAA8D;IAC9D,gBAAgB,GAAG,WAAW,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,2BAA2B;IACzC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC;QAAE,KAAK,CAAC,KAAK,EAAE,CAAC;AACjE,CAAC"}

package/dist/runtime/update/owner.js

@@ -6,7 +6,7 @@ import { randomUUID } from "node:crypto";
 import { readFile, rename, rm, unlink, writeFile } from "node:fs/promises";
 import { join } from "node:path";
 import { ElwoodError, errnoCode } from "../../core/errors.js";
-import { processGroupGone } from "../probe-cleanup.js";
+import { processGroupGone } from "../probe/cleanup.js";
 export const ownerFile = "owner";
 /** Marks a lease directory already retired by its owner and awaiting deletion. */
 export const retiredLeaseInfix = ".released.";

package/dist/runtime/update/retained-lease.js

@@ -4,7 +4,7 @@
  * the lease for the owner host's lifetime.
  */
 import { setTimeout as delay } from "node:timers/promises";
-import { processGroupGone } from "../probe-cleanup.js";
+import { processGroupGone } from "../probe/cleanup.js";
 import { releaseLease, retainProbeOwner } from "./owner.js";
 /**
  * Records the surviving groups as the lease's only holders, so the lease outlives this

package/dist/runtime/update/waiting.d.ts

@@ -1,4 +1,17 @@
-export declare function waitForOwner(path: string, pollMs: number, staleMs: number, waitUntilMs: number): Promise<"released" | "stale_removed" | "wait_expired" | "cleanup_pending">;
+/**
+ * A contender's default wait: longer than an owner can hold the lease while its two probes,
+ * the `--version` read that confirms the CLI exists and then the update, each stay within
+ * their launch and command bounds (§9.2). The margin covers each probe's abort cleanup and
+ * the group observation after it, so a contender never re-reads a version mid-update.
+ */
+export declare const defaultWaitMs: number;
+export type UpdateWaitResult = {
+    readonly status: "released" | "wait_expired" | "cleanup_pending";
+} | {
+    readonly status: "stale_removed";
+    readonly generation: string | undefined;
+};
+export declare function waitForOwner(path: string, pollMs: number, staleMs: number, waitUntilMs: number): Promise<UpdateWaitResult>;
 export declare function recoveryPath(path: string): string;
 export declare function pathExists(path: string): Promise<boolean>;
 //# sourceMappingURL=waiting.d.ts.map

package/dist/runtime/update/waiting.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"waiting.d.ts","sourceRoot":"","sources":["../../../src/runtime/update/waiting.ts"],"names":[],"mappings":"AASA,wBAAsB,YAAY,CAChC,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,UAAU,GAAG,eAAe,GAAG,cAAc,GAAG,iBAAiB,CAAC,CA2B5E;AAuCD,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAO/D"}
+{"version":3,"file":"waiting.d.ts","sourceRoot":"","sources":["../../../src/runtime/update/waiting.ts"],"names":[],"mappings":"AAUA;;;;;GAKG;AACH,eAAO,MAAM,aAAa,QAA8D,CAAC;AAEzF,MAAM,MAAM,gBAAgB,GACxB;IAAE,QAAQ,CAAC,MAAM,EAAE,UAAU,GAAG,cAAc,GAAG,iBAAiB,CAAA;CAAE,GACpE;IAAE,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,CAAC;AAKlF,wBAAsB,YAAY,CAChC,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,gBAAgB,CAAC,CA4B3B;AAuCD,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAO/D"}

package/dist/runtime/update/waiting.js

@@ -5,11 +5,19 @@
 import { opendir, rename, rmdir, stat, unlink } from "node:fs/promises";
 import { join } from "node:path";
 import { setTimeout as delay } from "node:timers/promises";
+import { probeCommandTimeoutMs, probeLaunchTimeoutMs } from "../probe/index.js";
 import { leaseIsAlive, ownerFile, pendingOwnerPrefix, readOwner } from "./owner.js";
+/**
+ * A contender's default wait: longer than an owner can hold the lease while its two probes,
+ * the `--version` read that confirms the CLI exists and then the update, each stay within
+ * their launch and command bounds (§9.2). The margin covers each probe's abort cleanup and
+ * the group observation after it, so a contender never re-reads a version mid-update.
+ */
+export const defaultWaitMs = 2 * (probeLaunchTimeoutMs + probeCommandTimeoutMs) + 15_000;
 export async function waitForOwner(path, pollMs, staleMs, waitUntilMs) {
     for (;;) {
         if (performance.now() >= waitUntilMs)
-            return "wait_expired";
+            return { status: "wait_expired" };
         let lease;
         try {
             lease = await stat(path);
@@ -17,7 +25,7 @@ export async function waitForOwner(path, pollMs, staleMs, waitUntilMs) {
         catch {
             if (await restoreRecovery(path))
                 continue;
-            return "released";
+            return { status: "released" };
         }
         const current = await readOwner(path);
         // Presence of the record only, not proof that any of those groups still runs; the
@@ -26,15 +34,15 @@ export async function waitForOwner(path, pollMs, staleMs, waitUntilMs) {
         // A lease held by a surviving updater group is not worth waiting out: those groups may
         // outlive any bound this contender could set, so it says so and moves on.
         if (hasRecordedProcessGroups && current !== undefined && leaseIsAlive(current))
-            return "cleanup_pending";
+            return { status: "cleanup_pending" };
         // Groups, unlike a parent process, are confirmed gone rather than merely quiet, so a
         // lease whose every group has exited is dead whatever its age says.
         if (hasRecordedProcessGroups || Date.now() - lease.mtimeMs >= staleMs) {
             const recovered = await recoverStaleLease(path);
-            if (recovered === "removed")
-                return "stale_removed";
-            if (recovered === "unrecoverable")
-                return "released";
+            if (recovered.status === "removed")
+                return { status: "stale_removed", generation: recovered.generation };
+            if (recovered.status === "unrecoverable")
+                return { status: "released" };
         }
         await delay(pollMs);
     }
@@ -42,17 +50,17 @@ export async function waitForOwner(path, pollMs, staleMs, waitUntilMs) {
 async function recoverStaleLease(path) {
     const expected = await readOwner(path);
     if (expected !== undefined && leaseIsAlive(expected))
-        return "alive";
+        return { status: "alive" };
     const recovery = recoveryPath(path);
     try {
         await rename(path, recovery);
     }
     catch {
-        return (await pathExists(recovery)) ? "alive" : "unrecoverable";
+        return { status: (await pathExists(recovery)) ? "alive" : "unrecoverable" };
     }
     const moved = await readOwner(recovery);
     if (expected?.token !== moved?.token || (moved !== undefined && leaseIsAlive(moved))) {
-        return "unrecoverable";
+        return { status: "unrecoverable" };
     }
     try {
         if (moved !== undefined)
@@ -65,10 +73,10 @@ async function recoverStaleLease(path) {
             if (entry.name.startsWith(pendingOwnerPrefix))
                 await unlink(join(recovery, entry.name));
         await rmdir(recovery);
-        return "removed";
+        return { status: "removed", generation: moved?.token };
     }
     catch {
-        return "unrecoverable";
+        return { status: "unrecoverable" };
     }
 }
 async function restoreRecovery(path) {