@with-logic/elwood 0.2.1 → 0.2.2

package/dist/runtime/shutdown/detached-sweep/index.js

@@ -0,0 +1,129 @@
+/**
+ * Stops and SIGKILLs every process group a LIVE PTY leader's linked descendants have
+ * moved into, before Elwood kills the leader, but Codex's shared daemon, its updater,
+ * and what they started (below). Implements PRD §5.3 and §9.4 (C-LIFE-10).
+ * Claude and Codex start each hook command with `setsid()`, so a hook in flight at
+ * teardown sits in its own session and process group: the leader-group SIGKILL misses
+ * it, and once the leader dies the hook is reparented to PID 1 and nothing links it to
+ * the session any more. The walk therefore has to happen first. It finds only what is
+ * still linked by parent pid (see `detachedDescendantGroups`).
+ *
+ * A group id read from the table is a snapshot, free for reuse once the group is gone,
+ * and a `kill()` that returns has only sent the SIGSTOP. So the sweep acts only on what
+ * two consecutive reads show (see `rounds.ts`): a group is sent SIGSTOP once a parent of
+ * one of its members is held, read stopped in this read and the one before inside a
+ * group the sweep signaled. The walk succeeds only on a read that converges: it shows
+ * the leader live, leaves no live group unreached, and holds every live member of every
+ * signaled group, the leader's included. A read that shows a signaled group's member
+ * running stops that group again. With no hook in flight that takes two reads; each
+ * level of nesting adds two more. Then the signaled groups are SIGKILLed deepest first
+ * (`kill.ts`). Codex's app-server daemon and its updater loop are shared by every Codex
+ * on the same `CODEX_HOME`, the user's own included, so the walk never descends into
+ * either: neither one nor anything it started is killed (`shared-daemon.ts`). A group it
+ * stopped as its process became one is resumed with SIGCONT, never SIGKILLed, even once
+ * the leader's exit left it under PID 1. (A parent that ignores SIGCHLD would have its
+ * exited children reaped while stopped; the CLIs and hook shells don't.)
+ */
+import { errnoCode } from "../../../core/errors.js";
+import { detachedDescendantGroups } from "../process-table.js";
+import { daemonScope } from "../shared-daemon.js";
+import { SweepFailures } from "./failures.js";
+import { confirmedGone, confirmLiveGroups, killOrResumeSignaledGroups, recordFailedRead, } from "./kill.js";
+import { newSweepState, recordUnconfirmed, restopEscapedGroups, stopAnchoredGroups, sweepOutcome, unheldGroups, unreachedGroups, } from "./rounds.js";
+/**
+ * The whole sweep's deadline. A hook that started a setsid child of its own takes six
+ * reads, and on a loaded host one read can take over half a second (docs/cli-behavior.md).
+ */
+export const DETACHED_SWEEP_BUDGET_MS = 10_000;
+/**
+ * Sweeps `leaderPid`'s detached descendant groups and resolves to the unresolved
+ * failure, or `undefined` once a read converged and every group it signaled was killed,
+ * or resumed as holding Codex's daemon.
+ * The leader's own group is left to the group reap. A leader whose exit was observed
+ * before the sweep, or whose group refuses its SIGSTOP because it already exited (see
+ * `leaderStopFailure`), exited before Elwood signaled it: nothing more is sent and nothing
+ * fails. Otherwise `leaderExited` is read after each table read that does not converge;
+ * a read that converges ends the walk before that check. Once the leader has exited its
+ * pid may be reused, so the sweep stops no further group and never signals the leader's
+ * group again, though it still SIGKILLs the groups it already signaled (resuming any
+ * that hold Codex's daemon).
+ * `onLeaderGroupGone` publishes only whole-group ESRCH or fresh empty-group evidence,
+ * never merely a leader exit notification. These are
+ * failures: a leader's group that refuses its stop, so no descendant group is signaled;
+ * an unreadable table; the deadline passing, or the leader exiting, before a read
+ * converged; a live group that could not be stopped or killed; and a group spared for
+ * Codex's daemon that could not be resumed (a SIGCONT refused but for its being gone).
+ */
+export async function sweepDetachedGroups(leaderPid, ops, leaderExited, budgetMs = DETACHED_SWEEP_BUDGET_MS, onLeaderGroupGone = () => undefined) {
+    if (leaderExited())
+        return undefined;
+    const deadline = performance.now() + budgetMs;
+    const state = newSweepState(new SweepFailures());
+    try {
+        ops.stopGroup(leaderPid);
+    }
+    catch (error) {
+        return leaderStopFailure(error, leaderPid, ops, deadline, state, onLeaderGroupGone);
+    }
+    state.signaledGroupIds.add(leaderPid);
+    state.unheld = [leaderPid];
+    await stopDescendantGroups(leaderPid, ops, leaderExited, deadline, state);
+    await killOrResumeSignaledGroups(ops, state, deadline);
+    return sweepOutcome(state);
+}
+/**
+ * Reads the table round by round until `deadline`, recording into `state`: each read
+ * refreshes `live` and `unheld`, stops again each signaled group with a running member,
+ * then stops the unreached groups a held parent anchors. It returns without a failure
+ * only on a read that converges, so nothing the sweep signaled could have started a
+ * process that read missed. It records a failure against every group not yet confirmed
+ * stopped, and returns, when the table cannot be read, or when the deadline passes or
+ * the leader's exit is observed first.
+ */
+async function stopDescendantGroups(leaderPid, ops, leaderExited, deadline, state) {
+    // Each group the walk stops is a root too: its exit can leave one under PID 1.
+    const scope = daemonScope(state.signaledGroupIds);
+    try {
+        while (true) {
+            const remainingMs = Math.ceil(deadline - performance.now());
+            if (remainingMs <= 0)
+                return recordUnconfirmed(state, "process groups not confirmed stopped by the deadline");
+            const table = await ops.listProcesses(remainingMs, scope);
+            state.latest = table;
+            state.live = detachedDescendantGroups(table, { leaderPid, hostPid: process.pid });
+            state.unheld = unheldGroups(table, state, leaderPid);
+            if (unreachedGroups(state).length === 0 && state.unheld.length === 0)
+                return;
+            if (leaderExited())
+                return recordUnconfirmed(state, "the leader exited before every group was confirmed stopped");
+            restopEscapedGroups(table, ops, state);
+            stopAnchoredGroups(table, ops, state);
+        }
+    }
+    catch (error) {
+        recordUnconfirmed(state, "process table unreadable", error);
+    }
+}
+/**
+ * Judges a refused SIGSTOP of the leader's group. The leader had already exited, so the
+ * sweep has nothing to do, when the group is gone (`ESRCH`), or when macOS refused it
+ * with `EPERM` because only unreaped zombies remain, which a fresh read must then show.
+ * Otherwise the leader could not be stopped, so no descendant group is signaled.
+ */
+async function leaderStopFailure(error, leaderPid, ops, deadline, state, onLeaderGroupGone) {
+    const code = errnoCode(error);
+    if (code === "ESRCH") {
+        onLeaderGroupGone();
+        return undefined;
+    }
+    const confirmation = code === "EPERM" ? await confirmLiveGroups(ops, deadline) : undefined;
+    if (confirmation !== undefined && confirmedGone(confirmation, leaderPid)) {
+        onLeaderGroupGone();
+        return undefined;
+    }
+    state.failures.record("could not stop the leader's group", error, [leaderPid]);
+    if (confirmation !== undefined)
+        recordFailedRead(confirmation, state, [leaderPid]);
+    return state.failures.result();
+}
+//# sourceMappingURL=index.js.map

package/dist/runtime/shutdown/detached-sweep/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/runtime/shutdown/detached-sweep/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAqB,aAAa,EAAE,MAAM,eAAe,CAAC;AACjE,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,0BAA0B,EAC1B,gBAAgB,GACjB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,mBAAmB,EAGnB,kBAAkB,EAClB,YAAY,EACZ,YAAY,EACZ,eAAe,GAChB,MAAM,aAAa,CAAC;AAIrB;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAM,CAAC;AAE/C;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,SAAiB,EACjB,GAAa,EACb,YAA2B,EAC3B,WAAmB,wBAAwB,EAC3C,oBAAgC,GAAG,EAAE,CAAC,SAAS;IAE/C,IAAI,YAAY,EAAE;QAAE,OAAO,SAAS,CAAC;IACrC,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC;IAC9C,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,aAAa,EAAE,CAAC,CAAC;IACjD,IAAI,CAAC;QACH,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,iBAAiB,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,iBAAiB,CAAC,CAAC;IACtF,CAAC;IACD,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACtC,KAAK,CAAC,MAAM,GAAG,CAAC,SAAS,CAAC,CAAC;IAC3B,MAAM,oBAAoB,CAAC,SAAS,EAAE,GAAG,EAAE,YAAY,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC1E,MAAM,0BAA0B,CAAC,GAAG,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;IACvD,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC;AAC7B,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,oBAAoB,CACjC,SAAiB,EACjB,GAAa,EACb,YAA2B,EAC3B,QAAgB,EAChB,KAAiB;IAEjB,+EAA+E;IAC/E,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAClD,IAAI,CAAC;QACH,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC;YAC5D,IAAI,WAAW,IAAI,CAAC;gBAClB,OAAO,iBAAiB,CAAC,KAAK,EAAE,sDAAsD,CAAC,CAAC;YAC1F,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,aAAa,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;YAC1D,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC;YACrB,KAAK,CAAC,IAAI,GAAG,wBAAwB,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;YAClF,KAAK,CAAC,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;YACrD,IAAI,eAAe,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO;YAC7E,IAAI,YAAY,EAAE;gBAChB,OAAO,iBAAiB,CACtB,KAAK,EACL,4DAA4D,CAC7D,CAAC;YACJ,mBAAmB,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;YACvC,kBAAkB,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,iBAAiB,CAAC,KAAK,EAAE,0BAA0B,EAAE,KAAK,CAAC,CAAC;IAC9D,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,iBAAiB,CAC9B,KAAc,EACd,SAAiB,EACjB,GAAa,EACb,QAAgB,EAChB,KAAiB,EACjB,iBAA6B;IAE7B,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAC9B,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACrB,iBAAiB,EAAE,CAAC;QACpB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,YAAY,GAAG,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,iBAAiB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3F,IAAI,YAAY,KAAK,SAAS,IAAI,aAAa,CAAC,YAAY,EAAE,SAAS,CAAC,EAAE,CAAC;QACzE,iBAAiB,EAAE,CAAC;QACpB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,mCAAmC,EAAE,KAAK,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;IAC/E,IAAI,YAAY,KAAK,SAAS;QAAE,gBAAgB,CAAC,YAAY,EAAE,KAAK,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;IACnF,OAAO,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;AACjC,CAAC"}

package/dist/runtime/shutdown/detached-sweep/kill.d.ts

@@ -0,0 +1,37 @@
+/**
+ * The detached sweep's kill pass (PRD §5.3 and §9.4, C-LIFE-10): SIGKILLs every group
+ * the sweep signaled, deepest first, so each group's stopped parent outlives it and
+ * keeps its id held through the signal, except the groups it resumes (below). A failed
+ * kill never skips the rest. macOS refuses a signal to a group whose members are all
+ * unreaped zombies with `EPERM`, and a group can become one between its stop and its
+ * kill. So an `EPERM` is ignored only when a fresh read, inside the sweep's deadline,
+ * succeeds and shows no live member of that group; a read that cannot be had in time,
+ * or fails, leaves it a failure, and a failed read is reported too, after the refusal
+ * (`confirmLiveGroups`).
+ *
+ * A path read can see a process the TUI forked before it `exec`s Codex's daemon, and the
+ * walk can stop its group after the `exec`. A stopped process cannot `exec`, so a group the
+ * latest read shows holding the daemon or its updater, or a process that could still
+ * become one because that read did not show it stopped, is resumed with SIGCONT and
+ * never SIGKILLed (`groupIdsToResume`).
+ */
+import type { SweepOps, SweepState } from "./rounds.ts";
+export declare function killOrResumeSignaledGroups(ops: SweepOps, state: SweepState, deadline: number): Promise<void>;
+/** A fresh read's groups with a live member, or why there is none: no time, or its error. */
+type Confirmation = {
+    readonly kind: "read";
+    readonly live: ReadonlySet<number>;
+} | {
+    readonly kind: "failed";
+    readonly error: unknown;
+} | {
+    readonly kind: "no time";
+};
+/** Takes a fresh read inside `deadline`, to judge a signal refused with `EPERM`. */
+export declare function confirmLiveGroups(ops: SweepOps, deadline: number): Promise<Confirmation>;
+/** Whether `confirmation` is a read that shows no live member of `group`. */
+export declare function confirmedGone(confirmation: Confirmation, group: number): boolean;
+/** Records a confirming read that failed against `groups`, after the refusals it judged. */
+export declare function recordFailedRead(confirmation: Confirmation, state: SweepState, groups: readonly number[]): void;
+export {};
+//# sourceMappingURL=kill.d.ts.map

package/dist/runtime/shutdown/detached-sweep/kill.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kill.d.ts","sourceRoot":"","sources":["../../../../src/runtime/shutdown/detached-sweep/kill.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,OAAO,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAExD,wBAAsB,0BAA0B,CAC9C,GAAG,EAAE,QAAQ,EACb,KAAK,EAAE,UAAU,EACjB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CAuBf;AAcD,6FAA6F;AAC7F,KAAK,YAAY,GACb;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;CAAE,GAC7D;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;CAAE,GACpD;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE,CAAC;AAEjC,oFAAoF;AACpF,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAY9F;AAED,6EAA6E;AAC7E,wBAAgB,aAAa,CAAC,YAAY,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAEhF;AAED,4FAA4F;AAC5F,wBAAgB,gBAAgB,CAC9B,YAAY,EAAE,YAAY,EAC1B,KAAK,EAAE,UAAU,EACjB,MAAM,EAAE,SAAS,MAAM,EAAE,GACxB,IAAI,CAIN"}

package/dist/runtime/shutdown/detached-sweep/kill.js

@@ -0,0 +1,87 @@
+/**
+ * The detached sweep's kill pass (PRD §5.3 and §9.4, C-LIFE-10): SIGKILLs every group
+ * the sweep signaled, deepest first, so each group's stopped parent outlives it and
+ * keeps its id held through the signal, except the groups it resumes (below). A failed
+ * kill never skips the rest. macOS refuses a signal to a group whose members are all
+ * unreaped zombies with `EPERM`, and a group can become one between its stop and its
+ * kill. So an `EPERM` is ignored only when a fresh read, inside the sweep's deadline,
+ * succeeds and shows no live member of that group; a read that cannot be had in time,
+ * or fails, leaves it a failure, and a failed read is reported too, after the refusal
+ * (`confirmLiveGroups`).
+ *
+ * A path read can see a process the TUI forked before it `exec`s Codex's daemon, and the
+ * walk can stop its group after the `exec`. A stopped process cannot `exec`, so a group the
+ * latest read shows holding the daemon or its updater, or a process that could still
+ * become one because that read did not show it stopped, is resumed with SIGCONT and
+ * never SIGKILLed (`groupIdsToResume`).
+ */
+import { errnoCode } from "../../../core/errors.js";
+import { groupIdsToResume } from "../shared-daemon.js";
+export async function killOrResumeSignaledGroups(ops, state, deadline) {
+    const toResume = groupIdsToResume(state.latest);
+    const refused = new Map();
+    for (const group of [...state.signaledDescendantGroupIds].reverse()) {
+        if (toResume.has(group)) {
+            resume(group, ops, state);
+            continue;
+        }
+        try {
+            ops.killGroup(group);
+        }
+        catch (error) {
+            if (errnoCode(error) === "EPERM")
+                refused.set(group, error);
+            else
+                state.failures.record("could not kill a signaled descendant group", error, [group]);
+        }
+    }
+    if (refused.size === 0)
+        return;
+    const confirmation = await confirmLiveGroups(ops, deadline);
+    for (const [group, error] of refused) {
+        if (!confirmedGone(confirmation, group)) {
+            state.failures.record("could not kill a signaled descendant group", error, [group]);
+        }
+    }
+    recordFailedRead(confirmation, state, [...refused.keys()]);
+}
+/** SIGCONTs a group to resume; one already gone (`ESRCH`) needs nothing. */
+function resume(group, ops, state) {
+    try {
+        ops.continueGroup(group);
+    }
+    catch (error) {
+        if (errnoCode(error) === "ESRCH")
+            return;
+        state.failures.record("could not resume a group spared for Codex's shared daemon", error, [
+            group,
+        ]);
+    }
+}
+/** Takes a fresh read inside `deadline`, to judge a signal refused with `EPERM`. */
+export async function confirmLiveGroups(ops, deadline) {
+    const remainingMs = Math.ceil(deadline - performance.now());
+    if (remainingMs <= 0)
+        return { kind: "no time" };
+    try {
+        const table = await ops.listProcesses(remainingMs);
+        return {
+            kind: "read",
+            live: new Set(table.filter((row) => !row.zombie).map((row) => row.pgid)),
+        };
+    }
+    catch (error) {
+        return { kind: "failed", error };
+    }
+}
+/** Whether `confirmation` is a read that shows no live member of `group`. */
+export function confirmedGone(confirmation, group) {
+    return confirmation.kind === "read" && !confirmation.live.has(group);
+}
+/** Records a confirming read that failed against `groups`, after the refusals it judged. */
+export function recordFailedRead(confirmation, state, groups) {
+    if (confirmation.kind === "failed") {
+        state.failures.record("process table unreadable", confirmation.error, groups);
+    }
+}
+//# sourceMappingURL=kill.js.map

package/dist/runtime/shutdown/detached-sweep/kill.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"kill.js","sourceRoot":"","sources":["../../../../src/runtime/shutdown/detached-sweep/kill.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAGvD,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,GAAa,EACb,KAAiB,EACjB,QAAgB;IAEhB,MAAM,QAAQ,GAAG,gBAAgB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAmB,CAAC;IAC3C,KAAK,MAAM,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,0BAA0B,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;QACpE,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACxB,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;YAC1B,SAAS;QACX,CAAC;QACD,IAAI,CAAC;YACH,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,OAAO;gBAAE,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;;gBACvD,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,4CAA4C,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO;IAC/B,MAAM,YAAY,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC5D,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;QACrC,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,KAAK,CAAC,EAAE,CAAC;YACxC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,4CAA4C,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;QACtF,CAAC;IACH,CAAC;IACD,gBAAgB,CAAC,YAAY,EAAE,KAAK,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,4EAA4E;AAC5E,SAAS,MAAM,CAAC,KAAa,EAAE,GAAa,EAAE,KAAiB;IAC7D,IAAI,CAAC;QACH,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,OAAO;YAAE,OAAO;QACzC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,2DAA2D,EAAE,KAAK,EAAE;YACxF,KAAK;SACN,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAQD,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,GAAa,EAAE,QAAgB;IACrE,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC;IAC5D,IAAI,WAAW,IAAI,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IACjD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;QACnD,OAAO;YACL,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;SACzE,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IACnC,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,aAAa,CAAC,YAA0B,EAAE,KAAa;IACrE,OAAO,YAAY,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AACvE,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,gBAAgB,CAC9B,YAA0B,EAC1B,KAAiB,EACjB,MAAyB;IAEzB,IAAI,YAAY,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACnC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,0BAA0B,EAAE,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAChF,CAAC;AACH,CAAC"}

package/dist/runtime/shutdown/detached-sweep/record.d.ts

@@ -0,0 +1,67 @@
+/**
+ * Records a PTY leader's detached descendants while a graceful `stop()` waits for it to
+ * exit (PRD §5.3 and §9.4, C-LIFE-10). A CLI that exits on SIGTERM does not end every
+ * process it started in a group of its own: Codex leaves the shell it runs to snapshot
+ * the user's environment, and whatever the user's profile started from it
+ * (docs/cli-behavior.md). Once the leader exits, those processes are reparented to PID 1
+ * and nothing links them to the session, so the links are read while it lives: the first
+ * read finishes before the SIGTERM is sent, and reads repeat until the leader's exit is
+ * observed. A process is recorded by its pid and start time, which together name one
+ * process (see `ProcessEntry.startedAt`), so a pid reused after the exit is never taken
+ * for it. The leader is held to the same identity: a read that does not show the
+ * leader the first such read showed records nothing, because its pid may already belong
+ * to another process. A leader the read before the SIGTERM does not show had exited
+ * before the stop, leaving nothing linked; one that no read showed after a failed first
+ * read leaves its tree unknown. A process that starts and loses its link between two
+ * reads is not recorded, and a failed read records nothing, so that gap runs to the next
+ * read that succeeds (PRD §5.3).
+ */
+import { type ProcessEntry } from "../process-table.ts";
+import type { SweepOps } from "./rounds.ts";
+/**
+ * Each read's bound, the one before the SIGTERM included: the walk's own deadline. A read
+ * cut short records nothing, and on a loaded host one read, with Codex's daemon path
+ * reads, can take over a second (docs/cli-behavior.md), so a one-second bound there
+ * recorded nothing at all and left the leader's tree unknown. Only a `ps` that never
+ * answers holds the SIGTERM back for the whole bound.
+ */
+export declare const RECORD_READ_MS = 10000;
+/** The detached descendants seen so far, by pid and start time. */
+export declare class DescendantRecord {
+    private readonly identities;
+    /** The leader's identity, from the first read that showed it. */
+    private leader;
+    /**
+     * Whether the leader's tree is known: a read showed the leader live, or the read before
+     * the SIGTERM showed it already gone, with nothing left linked to it. A later read that
+     * does not show the leader says nothing of what it left.
+     */
+    known: boolean;
+    /**
+     * Records every live member of each group, other than the leader's, that holds a
+     * descendant, if `table` shows the leader live as the first such read did. `beforeSignal`
+     * marks the read before the SIGTERM, whose not showing the leader is knowledge too.
+     */
+    observe(table: readonly ProcessEntry[], leaderPid: number, beforeSignal?: boolean): void;
+    /** The pid of each process recorded, whatever it runs now. */
+    get pids(): readonly number[];
+    /**
+     * The rows of `table` that are recorded processes still alive: same pid, same start.
+     * Never Codex's shared daemon, which one may have become by `exec` since it was recorded.
+     */
+    survivors(table: readonly ProcessEntry[]): readonly ProcessEntry[];
+}
+/** A recording in progress. */
+export type DescendantWatch = {
+    /** Settles once the first read has finished, whether or not it succeeded. */
+    readonly firstRead: Promise<void>;
+    /** Stops reading once the read in flight settles, and resolves to the record. */
+    readonly finish: () => Promise<DescendantRecord>;
+};
+/**
+ * Reads the table again and again, with Codex's daemon marked under `leaderPid`, recording
+ * the leader's detached descendants until `finish` is called or `leaderExited` reports the
+ * exit. A failed read records nothing and the next one follows.
+ */
+export declare function watchDescendants(leaderPid: number, ops: Pick<SweepOps, "listProcesses">, leaderExited: () => boolean): DescendantWatch;
+//# sourceMappingURL=record.d.ts.map

package/dist/runtime/shutdown/detached-sweep/record.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"record.d.ts","sourceRoot":"","sources":["../../../../src/runtime/shutdown/detached-sweep/record.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAGL,KAAK,YAAY,EAClB,MAAM,qBAAqB,CAAC;AAG7B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAE5C;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,QAA2B,CAAC;AAEvD,mEAAmE;AACnE,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAqB;IAChD,iEAAiE;IACjE,OAAO,CAAC,MAAM,CAAqB;IACnC;;;;OAIG;IACH,KAAK,UAAS;IAEd;;;;OAIG;IACH,OAAO,CAAC,KAAK,EAAE,SAAS,YAAY,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,UAAQ,GAAG,IAAI;IAmBtF,8DAA8D;IAC9D,IAAI,IAAI,IAAI,SAAS,MAAM,EAAE,CAE5B;IAED;;;OAGG;IACH,SAAS,CAAC,KAAK,EAAE,SAAS,YAAY,EAAE,GAAG,SAAS,YAAY,EAAE;CAInE;AAED,+BAA+B;AAC/B,MAAM,MAAM,eAAe,GAAG;IAC5B,6EAA6E;IAC7E,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAClC,iFAAiF;IACjF,QAAQ,CAAC,MAAM,EAAE,MAAM,OAAO,CAAC,gBAAgB,CAAC,CAAC;CAClD,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE,eAAe,CAAC,EACpC,YAAY,EAAE,MAAM,OAAO,GAC1B,eAAe,CA6BjB"}

package/dist/runtime/shutdown/detached-sweep/record.js

@@ -0,0 +1,111 @@
+/**
+ * Records a PTY leader's detached descendants while a graceful `stop()` waits for it to
+ * exit (PRD §5.3 and §9.4, C-LIFE-10). A CLI that exits on SIGTERM does not end every
+ * process it started in a group of its own: Codex leaves the shell it runs to snapshot
+ * the user's environment, and whatever the user's profile started from it
+ * (docs/cli-behavior.md). Once the leader exits, those processes are reparented to PID 1
+ * and nothing links them to the session, so the links are read while it lives: the first
+ * read finishes before the SIGTERM is sent, and reads repeat until the leader's exit is
+ * observed. A process is recorded by its pid and start time, which together name one
+ * process (see `ProcessEntry.startedAt`), so a pid reused after the exit is never taken
+ * for it. The leader is held to the same identity: a read that does not show the
+ * leader the first such read showed records nothing, because its pid may already belong
+ * to another process. A leader the read before the SIGTERM does not show had exited
+ * before the stop, leaving nothing linked; one that no read showed after a failed first
+ * read leaves its tree unknown. A process that starts and loses its link between two
+ * reads is not recorded, and a failed read records nothing, so that gap runs to the next
+ * read that succeeds (PRD §5.3).
+ */
+import { detachedDescendantGroups, processIdentity as identity, } from "../process-table.js";
+import { daemonScope } from "../shared-daemon.js";
+import { DETACHED_SWEEP_BUDGET_MS } from "./index.js";
+/**
+ * Each read's bound, the one before the SIGTERM included: the walk's own deadline. A read
+ * cut short records nothing, and on a loaded host one read, with Codex's daemon path
+ * reads, can take over a second (docs/cli-behavior.md), so a one-second bound there
+ * recorded nothing at all and left the leader's tree unknown. Only a `ps` that never
+ * answers holds the SIGTERM back for the whole bound.
+ */
+export const RECORD_READ_MS = DETACHED_SWEEP_BUDGET_MS;
+/** The detached descendants seen so far, by pid and start time. */
+export class DescendantRecord {
+    identities = new Set();
+    /** The leader's identity, from the first read that showed it. */
+    leader;
+    /**
+     * Whether the leader's tree is known: a read showed the leader live, or the read before
+     * the SIGTERM showed it already gone, with nothing left linked to it. A later read that
+     * does not show the leader says nothing of what it left.
+     */
+    known = false;
+    /**
+     * Records every live member of each group, other than the leader's, that holds a
+     * descendant, if `table` shows the leader live as the first such read did. `beforeSignal`
+     * marks the read before the SIGTERM, whose not showing the leader is knowledge too.
+     */
+    observe(table, leaderPid, beforeSignal = false) {
+        const leaderRow = table.find((row) => row.pid === leaderPid && !row.zombie);
+        if (leaderRow === undefined) {
+            // Gone before the SIGTERM: nothing is linked to it, and its pid is no one's to follow.
+            if (beforeSignal) {
+                this.known = true;
+                this.leader = "";
+            }
+            return;
+        }
+        this.leader ??= identity(leaderRow);
+        if (identity(leaderRow) !== this.leader)
+            return;
+        this.known = true;
+        const groups = detachedDescendantGroups(table, { leaderPid, hostPid: process.pid });
+        for (const row of table) {
+            if (!row.zombie && groups.has(row.pgid))
+                this.identities.add(identity(row));
+        }
+    }
+    /** The pid of each process recorded, whatever it runs now. */
+    get pids() {
+        return [...this.identities].map((id) => Number.parseInt(id, 10));
+    }
+    /**
+     * The rows of `table` that are recorded processes still alive: same pid, same start.
+     * Never Codex's shared daemon, which one may have become by `exec` since it was recorded.
+     */
+    survivors(table) {
+        const recorded = (row) => this.identities.has(identity(row));
+        return table.filter((row) => !row.zombie && recorded(row) && !row.shared);
+    }
+}
+/**
+ * Reads the table again and again, with Codex's daemon marked under `leaderPid`, recording
+ * the leader's detached descendants until `finish` is called or `leaderExited` reports the
+ * exit. A failed read records nothing and the next one follows.
+ */
+export function watchDescendants(leaderPid, ops, leaderExited) {
+    const record = new DescendantRecord();
+    let watching = true;
+    const scope = daemonScope(new Set([leaderPid]));
+    const readOnce = (beforeSignal = false) => ops.listProcesses(RECORD_READ_MS, scope).then((table) => record.observe(table, leaderPid, beforeSignal), () => undefined);
+    const firstRead = readOnce(true);
+    const finishing = Promise.withResolvers();
+    const reading = (async () => {
+        await firstRead;
+        while (!leaderExited()) {
+            // Lets the exit be observed between reads; a `finish` ends the wait at once.
+            await Promise.race([new Promise((resolve) => setImmediate(resolve)), finishing.promise]);
+            if (!watching || leaderExited())
+                return;
+            await readOnce();
+        }
+    })();
+    return {
+        firstRead,
+        finish: async () => {
+            watching = false;
+            finishing.resolve();
+            await reading;
+            return record;
+        },
+    };
+}
+//# sourceMappingURL=record.js.map

package/dist/runtime/shutdown/detached-sweep/record.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"record.js","sourceRoot":"","sources":["../../../../src/runtime/shutdown/detached-sweep/record.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EACL,wBAAwB,EACxB,eAAe,IAAI,QAAQ,GAE5B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAGtD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,wBAAwB,CAAC;AAEvD,mEAAmE;AACnE,MAAM,OAAO,gBAAgB;IACV,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IAChD,iEAAiE;IACzD,MAAM,CAAqB;IACnC;;;;OAIG;IACH,KAAK,GAAG,KAAK,CAAC;IAEd;;;;OAIG;IACH,OAAO,CAAC,KAA8B,EAAE,SAAiB,EAAE,YAAY,GAAG,KAAK;QAC7E,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5E,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,uFAAuF;YACvF,IAAI,YAAY,EAAE,CAAC;gBACjB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;gBAClB,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC;YACnB,CAAC;YACD,OAAO;QACT,CAAC;QACD,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,SAAS,CAAC,CAAC;QACpC,IAAI,QAAQ,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC,MAAM;YAAE,OAAO;QAChD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,MAAM,MAAM,GAAG,wBAAwB,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QACpF,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;YACxB,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;IAED,8DAA8D;IAC9D,IAAI,IAAI;QACN,OAAO,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IACnE,CAAC;IAED;;;OAGG;IACH,SAAS,CAAC,KAA8B;QACtC,MAAM,QAAQ,GAAG,CAAC,GAAiB,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3E,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5E,CAAC;CACF;AAUD;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC9B,SAAiB,EACjB,GAAoC,EACpC,YAA2B;IAE3B,MAAM,MAAM,GAAG,IAAI,gBAAgB,EAAE,CAAC;IACtC,IAAI,QAAQ,GAAG,IAAI,CAAC;IACpB,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,CAAC,YAAY,GAAG,KAAK,EAAE,EAAE,CACxC,GAAG,CAAC,aAAa,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC,IAAI,CAC3C,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE,YAAY,CAAC,EACzD,GAAG,EAAE,CAAC,SAAS,CAChB,CAAC;IACJ,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,EAAQ,CAAC;IAChD,MAAM,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE;QAC1B,MAAM,SAAS,CAAC;QAChB,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC;YACvB,6EAA6E;YAC7E,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;YACzF,IAAI,CAAC,QAAQ,IAAI,YAAY,EAAE;gBAAE,OAAO;YACxC,MAAM,QAAQ,EAAE,CAAC;QACnB,CAAC;IACH,CAAC,CAAC,EAAE,CAAC;IACL,OAAO;QACL,SAAS;QACT,MAAM,EAAE,KAAK,IAAI,EAAE;YACjB,QAAQ,GAAG,KAAK,CAAC;YACjB,SAAS,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,OAAO,CAAC;YACd,OAAO,MAAM,CAAC;QAChB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/runtime/shutdown/detached-sweep/rounds.d.ts

@@ -0,0 +1,78 @@
+/**
+ * One round of the detached sweep (PRD §5.3 and §9.4, C-LIFE-10): what the latest table
+ * read shows about the groups the sweep has signaled, and which new groups it may stop.
+ * A group is "signaled" once a SIGSTOP to it returned, which says nothing about its
+ * members yet: `kill()` has only sent the signal, and `ps` reads each row at its own
+ * moment, so a process counts as held only when this read AND the one before it showed
+ * it stopped inside a signaled group. A held parent can neither reap an exited child,
+ * which keeps that child's group id from being reused, nor start a process the next
+ * read could miss. A signaled group can still hold a running member: `killpg` signals
+ * the members it finds, so a child forked while it runs can miss the SIGSTOP.
+ */
+import type { ProcessEntry } from "../process-table.ts";
+import type { DaemonScope } from "../shared-daemon.ts";
+import type { FailureReason, SweepFailure, SweepFailures } from "./failures.ts";
+/**
+ * The process operations the sweep drives. Scripted tests inject fakes that signal
+ * nothing; the real-process tests pass OS-backed operations that do.
+ */
+export type SweepOps = {
+    /** SIGSTOPs the process group `pgid`. */
+    readonly stopGroup: (pgid: number) => void;
+    /** SIGKILLs the process group `pgid`; tolerates an already-empty group. */
+    readonly killGroup: (pgid: number) => void;
+    /** SIGCONTs the process group `pgid`: one the sweep stopped but must not kill. */
+    readonly continueGroup: (pgid: number) => void;
+    /** Lists the host process table within `timeoutMs`, marking `shared` rows in `scope`. */
+    readonly listProcesses: (timeoutMs: number, scope?: DaemonScope) => Promise<readonly ProcessEntry[]>;
+};
+export type SweepState = {
+    /** Groups a SIGSTOP returned for, the leader's included: signaled, not yet held. */
+    readonly signaledGroupIds: Set<number>;
+    /**
+     * The descendant groups among them, in the order signaled: SIGKILLed in reverse, but
+     * those the latest read shows holding Codex's daemon, which are resumed (`kill.ts`).
+     */
+    readonly signaledDescendantGroupIds: number[];
+    /** Pids the previous read showed stopped inside a signaled group. */
+    stoppedPidsLastRead: ReadonlySet<number>;
+    /** Groups whose SIGSTOP failed for a reason other than the group being gone. */
+    readonly unstoppable: Map<number, unknown>;
+    /** The live descendant groups in the latest read, each with its parents' rows. */
+    live: ReadonlyMap<number, ReadonlySet<ProcessEntry>>;
+    /** Signaled groups not yet held: see `unheldGroups`, plus any signaled since that read. */
+    unheld: readonly number[];
+    /** The latest table a read returned, by which the kill pass picks the groups to resume. */
+    latest: readonly ProcessEntry[];
+    readonly failures: SweepFailures;
+};
+export declare function newSweepState(failures: SweepFailures): SweepState;
+/** The live groups in the latest read that the sweep has not tried to stop. */
+export declare function unreachedGroups(state: SweepState): number[];
+/** Records `reason` against every group not yet confirmed stopped: unreached or unheld. */
+export declare function recordUnconfirmed(state: SweepState, reason: FailureReason, error?: unknown): void;
+/** The sweep's outcome, once each group a read showed live but no SIGSTOP reached fails. */
+export declare function sweepOutcome(state: SweepState): SweepFailure | undefined;
+/**
+ * The signaled groups this read does not hold: each with a live member that this read
+ * and the one before did not both show stopped, and any leader's own group while this
+ * read does not show the leader live, since its exit leaves descendants out of reach.
+ */
+export declare function unheldGroups(table: readonly ProcessEntry[], state: SweepState, leaderPid?: number): number[];
+/**
+ * Stops each unreached group that a held parent anchors, after noting which rows this
+ * read shows stopped for the NEXT read to rely on.
+ */
+export declare function stopAnchoredGroups(table: readonly ProcessEntry[], ops: SweepOps, state: SweepState): void;
+/**
+ * Sends SIGSTOP again to each signaled group this read shows with a live member that is
+ * not stopped, such as a child forked while the group's first stop went out (it keeps
+ * running until signaled; macOS showed one in 150 stops of a shell forking pipelines,
+ * and a real Claude teardown's login shell had one still running three seconds later).
+ * Each id still names its group: the caller has just seen the leader alive, and a
+ * descendant group stays anchored by the held parent the kill pass relies on too.
+ */
+export declare function restopEscapedGroups(table: readonly ProcessEntry[], ops: SweepOps, state: SweepState): void;
+/** A group that vanished (`ESRCH`) needs nothing; any other refusal is judged at the end. */
+export declare function stopGroup(group: number, ops: SweepOps, state: SweepState): void;
+//# sourceMappingURL=rounds.d.ts.map

package/dist/runtime/shutdown/detached-sweep/rounds.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rounds.d.ts","sourceRoot":"","sources":["../../../../src/runtime/shutdown/detached-sweep/rounds.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAEhF;;;GAGG;AACH,MAAM,MAAM,QAAQ,GAAG;IACrB,yCAAyC;IACzC,QAAQ,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC3C,2EAA2E;IAC3E,QAAQ,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC3C,kFAAkF;IAClF,QAAQ,CAAC,aAAa,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/C,yFAAyF;IACzF,QAAQ,CAAC,aAAa,EAAE,CACtB,SAAS,EAAE,MAAM,EACjB,KAAK,CAAC,EAAE,WAAW,KAChB,OAAO,CAAC,SAAS,YAAY,EAAE,CAAC,CAAC;CACvC,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB,oFAAoF;IACpF,QAAQ,CAAC,gBAAgB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC;;;OAGG;IACH,QAAQ,CAAC,0BAA0B,EAAE,MAAM,EAAE,CAAC;IAC9C,qEAAqE;IACrE,mBAAmB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACzC,gFAAgF;IAChF,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC3C,kFAAkF;IAClF,IAAI,EAAE,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,YAAY,CAAC,CAAC,CAAC;IACrD,2FAA2F;IAC3F,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,2FAA2F;IAC3F,MAAM,EAAE,SAAS,YAAY,EAAE,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;CAClC,CAAC;AAEF,wBAAgB,aAAa,CAAC,QAAQ,EAAE,aAAa,GAAG,UAAU,CAWjE;AAED,+EAA+E;AAC/E,wBAAgB,eAAe,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,EAAE,CAI3D;AAED,2FAA2F;AAC3F,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,CAAC,EAAE,OAAO,GAAG,IAAI,CAEjG;AAED,4FAA4F;AAC5F,wBAAgB,YAAY,CAAC,KAAK,EAAE,UAAU,GAAG,YAAY,GAAG,SAAS,CAMxE;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAC1B,KAAK,EAAE,SAAS,YAAY,EAAE,EAC9B,KAAK,EAAE,UAAU,EACjB,SAAS,CAAC,EAAE,MAAM,GACjB,MAAM,EAAE,CAUV;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,SAAS,YAAY,EAAE,EAC9B,GAAG,EAAE,QAAQ,EACb,KAAK,EAAE,UAAU,GAChB,IAAI,CAWN;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,SAAS,YAAY,EAAE,EAC9B,GAAG,EAAE,QAAQ,EACb,KAAK,EAAE,UAAU,GAChB,IAAI,CAgBN;AAWD,6FAA6F;AAC7F,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,GAAG,IAAI,CAS/E"}