@xioflow/kernel 0.3.0 → 0.5.0

package/dist/supervisor/process-output.d.ts

@@ -0,0 +1,27 @@
+import { ManagedProcessHandle } from '../driver/types.js';
+import { ProcessOperationResult } from '../types.js';
+import { StreamDrainer } from './drainer.js';
+import type { ProcessRunContext, ProcessRunPlan } from './process-run.js';
+export type ExitFacts = {
+    exitCode: number | null;
+    signal: NodeJS.Signals | null;
+};
+export interface OutputCapture {
+    stdout: StreamDrainer;
+    stderr: StreamDrainer;
+    artifactsDir: string;
+    artifactsDirError?: string;
+    callbackError(): string | undefined;
+}
+/** 准备 artifacts 溢出目录，挂上有界排空器；chunk 同时计入输出预算并转发给流订阅者。 */
+export declare function openOutputCapture(ctx: ProcessRunContext, plan: ProcessRunPlan, handle: ManagedProcessHandle): OutputCapture;
+export declare function buildProcessResult(plan: ProcessRunPlan, capture: OutputCapture, facts: {
+    exit: ExitFacts;
+    residualProcessesReaped: boolean;
+    peaks: {
+        peakMemoryBytes: number;
+        peakCpuTimeMs: number;
+    };
+    identityVerification: ProcessOperationResult['identityVerification'];
+}): ProcessOperationResult;
+//# sourceMappingURL=process-output.d.ts.map

package/dist/supervisor/process-output.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"process-output.d.ts","sourceRoot":"","sources":["../../src/supervisor/process-output.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAsB,aAAa,EAAE,MAAM,cAAc,CAAC;AACjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAE1E,MAAM,MAAM,SAAS,GAAG;IAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAA;CAAE,CAAC;AAEnF,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,aAAa,CAAC;IACtB,MAAM,EAAE,aAAa,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,aAAa,IAAI,MAAM,GAAG,SAAS,CAAC;CACrC;AAED,wDAAwD;AACxD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,iBAAiB,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,oBAAoB,GAAG,aAAa,CAuD3H;AAED,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,cAAc,EACpB,OAAO,EAAE,aAAa,EACtB,KAAK,EAAE;IACL,IAAI,EAAE,SAAS,CAAC;IAChB,uBAAuB,EAAE,OAAO,CAAC;IACjC,KAAK,EAAE;QAAE,eAAe,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1D,oBAAoB,EAAE,sBAAsB,CAAC,sBAAsB,CAAC,CAAC;CACtE,GACA,sBAAsB,CAsDxB"}

package/dist/supervisor/process-output.js

@@ -0,0 +1,102 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { setupStreamDrainer } from './drainer.js';
+/** 准备 artifacts 溢出目录，挂上有界排空器；chunk 同时计入输出预算并转发给流订阅者。 */
+export function openOutputCapture(ctx, plan, handle) {
+    const { options, opState } = plan;
+    const artifactsDir = options.artifactsDir || path.join(ctx.domain.domainPath, 'artifacts');
+    let artifactsDirError;
+    if (!fs.existsSync(artifactsDir)) {
+        try {
+            fs.mkdirSync(artifactsDir, { recursive: true });
+        }
+        catch (dirErr) {
+            artifactsDirError = dirErr.message || String(dirErr);
+        }
+    }
+    let totalOutputBytes = 0;
+    const onChunk = (bytes) => {
+        totalOutputBytes += bytes;
+        const budget = options.resourceBudget;
+        if (budget?.enforcement === 'soft' &&
+            budget.maxOutputBytes &&
+            totalOutputBytes > budget.maxOutputBytes &&
+            !opState.terminationReason) {
+            opState.terminationReason = 'output_exceeded';
+            ctx.stop(options.opId, 'output_exceeded', 1000).catch(() => { });
+        }
+    };
+    let streamCallbackError;
+    const forwardChunk = (stream) => (chunk) => {
+        for (const subscriber of opState.streamSubscribers) {
+            try {
+                subscriber(stream, chunk);
+            }
+            catch (err) {
+                streamCallbackError ??= err instanceof Error ? err.message : String(err);
+            }
+        }
+    };
+    const maxBytes = options.maxOutputBytes ?? 10 * 1024 * 1024; // 默认 10MB
+    const drainer = (stream) => setupStreamDrainer(handle[stream], maxBytes, path.join(artifactsDir, `${options.opId}-${stream}.log`), onChunk, forwardChunk(stream), artifactsDirError);
+    return {
+        stdout: drainer('stdout'),
+        stderr: drainer('stderr'),
+        artifactsDir,
+        artifactsDirError,
+        callbackError: () => streamCallbackError,
+    };
+}
+export function buildProcessResult(plan, capture, facts) {
+    const { options, opState } = plan;
+    const stdoutData = capture.stdout.getResult();
+    const stderrData = capture.stderr.getResult();
+    const spillError = stdoutData.spillError || stderrData.spillError || capture.artifactsDirError;
+    const streamCallbackError = capture.callbackError();
+    const isResourceOrTimeoutStopped = opState.timedOut ||
+        opState.terminationReason === 'memory_exceeded' ||
+        opState.terminationReason === 'cpu_exceeded' ||
+        opState.terminationReason === 'pids_exceeded' ||
+        opState.terminationReason === 'output_exceeded';
+    const finalStatus = isResourceOrTimeoutStopped
+        ? 'failed'
+        : opState.cancelRequested
+            ? 'cancelled'
+            : facts.exit.exitCode === 0
+                ? 'succeeded'
+                : 'failed';
+    return {
+        kind: 'process',
+        status: finalStatus,
+        exitCode: facts.exit.exitCode,
+        signal: facts.exit.signal,
+        stdout: stdoutData.content,
+        stderr: stderrData.content,
+        capabilityId: options.capabilityId,
+        confined: plan.confined,
+        confinementDriver: plan.confinementDriverName,
+        isTruncated: stdoutData.isTruncated || stderrData.isTruncated,
+        stdoutTruncated: stdoutData.isTruncated,
+        stderrTruncated: stderrData.isTruncated,
+        stdoutRef: !stdoutData.spillError ? stdoutData.outputRef : undefined,
+        stderrRef: !stderrData.spillError ? stderrData.outputRef : undefined,
+        stdoutBytes: stdoutData.bytesSeen,
+        stderrBytes: stderrData.bytesSeen,
+        stdoutHash: !stdoutData.spillError ? stdoutData.outputHash : undefined,
+        stderrHash: !stderrData.spillError ? stderrData.outputHash : undefined,
+        ...(facts.residualProcessesReaped ? { residualProcessesReaped: true } : {}),
+        ...(streamCallbackError ? { streamCallbackError } : {}),
+        ...(spillError ? { spillError } : {}),
+        ...(stdoutData.spillError ? { stdoutSpillError: stdoutData.spillError } : {}),
+        ...(stderrData.spillError ? { stderrSpillError: stderrData.spillError } : {}),
+        outputRef: (!spillError && (stdoutData.outputRef || stderrData.outputRef)) || undefined,
+        outputHash: (!spillError && (stdoutData.outputHash || stderrData.outputHash)) || undefined,
+        terminationReason: opState.terminationReason || (finalStatus === 'succeeded' ? 'completed' : undefined),
+        peakMemoryBytes: facts.peaks.peakMemoryBytes,
+        cpuTimeMs: facts.peaks.peakCpuTimeMs,
+        identityVerification: facts.identityVerification,
+        durationMs: Date.now() - opState.startTime,
+        completedAt: new Date().toISOString(),
+    };
+}
+//# sourceMappingURL=process-output.js.map

package/dist/supervisor/process-output.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"process-output.js","sourceRoot":"","sources":["../../src/supervisor/process-output.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B,OAAO,EAAE,kBAAkB,EAAiB,MAAM,cAAc,CAAC;AAajE,wDAAwD;AACxD,MAAM,UAAU,iBAAiB,CAAC,GAAsB,EAAE,IAAoB,EAAE,MAA4B;IAC1G,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IAClC,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;IAC3F,IAAI,iBAAqC,CAAC;IAC1C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QACjC,IAAI,CAAC;YACH,EAAE,CAAC,SAAS,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,MAAW,EAAE,CAAC;YACrB,iBAAiB,GAAG,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IAED,IAAI,gBAAgB,GAAG,CAAC,CAAC;IACzB,MAAM,OAAO,GAAG,CAAC,KAAa,EAAE,EAAE;QAChC,gBAAgB,IAAI,KAAK,CAAC;QAC1B,MAAM,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;QACtC,IACE,MAAM,EAAE,WAAW,KAAK,MAAM;YAC9B,MAAM,CAAC,cAAc;YACrB,gBAAgB,GAAG,MAAM,CAAC,cAAc;YACxC,CAAC,OAAO,CAAC,iBAAiB,EAC1B,CAAC;YACD,OAAO,CAAC,iBAAiB,GAAG,iBAAiB,CAAC;YAC9C,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,iBAAiB,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAClE,CAAC;IACH,CAAC,CAAC;IAEF,IAAI,mBAAuC,CAAC;IAC5C,MAAM,YAAY,GAAG,CAAC,MAA2B,EAAE,EAAE,CAAC,CAAC,KAAa,EAAE,EAAE;QACtE,KAAK,MAAM,UAAU,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC;YACnD,IAAI,CAAC;gBACH,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAC5B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,mBAAmB,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC3E,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,QAAQ,GAAG,OAAO,CAAC,cAAc,IAAI,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,UAAU;IACvE,MAAM,OAAO,GAAG,CAAC,MAA2B,EAAE,EAAE,CAC9C,kBAAkB,CAChB,MAAM,CAAC,MAAM,CAAC,EACd,QAAQ,EACR,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,GAAG,OAAO,CAAC,IAAI,IAAI,MAAM,MAAM,CAAC,EACxD,OAAO,EACP,YAAY,CAAC,MAAM,CAAC,EACpB,iBAAiB,CAClB,CAAC;IACJ,OAAO;QACL,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC;QACzB,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC;QACzB,YAAY;QACZ,iBAAiB;QACjB,aAAa,EAAE,GAAG,EAAE,CAAC,mBAAmB;KACzC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,IAAoB,EACpB,OAAsB,EACtB,KAKC;IAED,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IAClC,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;IAC9C,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;IAC9C,MAAM,UAAU,GAAG,UAAU,CAAC,UAAU,IAAI,UAAU,CAAC,UAAU,IAAI,OAAO,CAAC,iBAAiB,CAAC;IAC/F,MAAM,mBAAmB,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IAEpD,MAAM,0BAA0B,GAC9B,OAAO,CAAC,QAAQ;QAChB,OAAO,CAAC,iBAAiB,KAAK,iBAAiB;QAC/C,OAAO,CAAC,iBAAiB,KAAK,cAAc;QAC5C,OAAO,CAAC,iBAAiB,KAAK,eAAe;QAC7C,OAAO,CAAC,iBAAiB,KAAK,iBAAiB,CAAC;IAClD,MAAM,WAAW,GAAG,0BAA0B;QAC5C,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC,OAAO,CAAC,eAAe;YACzB,CAAC,CAAC,WAAW;YACb,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,KAAK,CAAC;gBAC3B,CAAC,CAAC,WAAW;gBACb,CAAC,CAAC,QAAQ,CAAC;IAEb,OAAO;QACL,IAAI,EAAE,SAAS;QACf,MAAM,EAAE,WAAW;QACnB,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ;QAC7B,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM;QACzB,MAAM,EAAE,UAAU,CAAC,OAAO;QAC1B,MAAM,EAAE,UAAU,CAAC,OAAO;QAC1B,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,iBAAiB,EAAE,IAAI,CAAC,qBAAqB;QAC7C,WAAW,EAAE,UAAU,CAAC,WAAW,IAAI,UAAU,CAAC,WAAW;QAC7D,eAAe,EAAE,UAAU,CAAC,WAAW;QACvC,eAAe,EAAE,UAAU,CAAC,WAAW;QACvC,SAAS,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;QACpE,SAAS,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;QACpE,WAAW,EAAE,UAAU,CAAC,SAAS;QACjC,WAAW,EAAE,UAAU,CAAC,SAAS;QACjC,UAAU,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;QACtE,UAAU,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;QACtE,GAAG,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC,CAAC,EAAE,uBAAuB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,UAAU,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,UAAU,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,SAAS,EAAE,CAAC,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,SAAS,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC,IAAI,SAAS;QACvF,UAAU,EAAE,CAAC,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,UAAU,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC,IAAI,SAAS;QAC1F,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,IAAI,CAAC,WAAW,KAAK,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;QACvG,eAAe,EAAE,KAAK,CAAC,KAAK,CAAC,eAAe;QAC5C,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,aAAa;QACpC,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,SAAS;QAC1C,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACtC,CAAC;AACJ,CAAC"}

package/dist/supervisor/process-run.d.ts

@@ -0,0 +1,30 @@
+import { ExecutionDomain } from '../domain.js';
+import { PlatformDriver, StopProcessResult, StructuredCommand } from '../driver/types.js';
+import { Operation, ProcessOperationResult, TerminationReason } from '../types.js';
+import { CapabilityAdmission } from './admission.js';
+import { ActiveOperationState, ExecuteProcessOptions } from './types.js';
+/** 执行期需要回调监督器的能力：停止流水线与在飞表清理都归监督器所有。 */
+export interface ProcessRunContext {
+    domain: ExecutionDomain;
+    driver: PlatformDriver;
+    stop(opId: string, reason: TerminationReason, graceMs: number): Promise<StopProcessResult>;
+    forget(opId: string): void;
+}
+export interface ProcessRunPlan {
+    options: ExecuteProcessOptions;
+    op: Operation;
+    opState: ActiveOperationState;
+    /** 已按写入限制包装后的实际启动命令。 */
+    command: StructuredCommand;
+    confined: boolean;
+    confinementDriverName?: string;
+    capAdmission?: CapabilityAdmission;
+}
+/**
+ * 启动协议：资源仲裁 -> 先持久化意图 -> 请求驱动启动 -> 登记身份并转 active -> 监督运行 -> 记录结果。
+ * 任何出口都会结清 stopResolve 并把操作移出在飞表。
+ */
+export declare function runProcess(ctx: ProcessRunContext, plan: ProcessRunPlan): Promise<ProcessOperationResult>;
+/** 进程启动前被取消：记录 cancelled（evidence: unobserved），不写虚假租约或意图事件。 */
+export declare function cancelBeforeSpawn(domain: ExecutionDomain, options: ExecuteProcessOptions, opState: ActiveOperationState): ProcessOperationResult;
+//# sourceMappingURL=process-run.d.ts.map

package/dist/supervisor/process-run.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"process-run.d.ts","sourceRoot":"","sources":["../../src/supervisor/process-run.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAwB,cAAc,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAChH,OAAO,EAAE,SAAS,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACnF,OAAO,EAAE,mBAAmB,EAAwB,MAAM,gBAAgB,CAAC;AAI3E,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAEzE,wCAAwC;AACxC,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,eAAe,CAAC;IACxB,MAAM,EAAE,cAAc,CAAC;IACvB,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC3F,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,qBAAqB,CAAC;IAC/B,EAAE,EAAE,SAAS,CAAC;IACd,OAAO,EAAE,oBAAoB,CAAC;IAC9B,wBAAwB;IACxB,OAAO,EAAE,iBAAiB,CAAC;IAC3B,QAAQ,EAAE,OAAO,CAAC;IAClB,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,YAAY,CAAC,EAAE,mBAAmB,CAAC;CACpC;AAED;;;GAGG;AACH,wBAAsB,UAAU,CAAC,GAAG,EAAE,iBAAiB,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAyD9G;AAgGD,+DAA+D;AAC/D,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,eAAe,EACvB,OAAO,EAAE,qBAAqB,EAC9B,OAAO,EAAE,oBAAoB,GAC5B,sBAAsB,CA0CxB"}

package/dist/supervisor/process-run.js

@@ -0,0 +1,191 @@
+import { recordCapabilityUsed } from './admission.js';
+import { computeInputFingerprint } from './fingerprint.js';
+import { finalizeOperation, indeterminateResult } from './finalize.js';
+import { superviseActive } from './process-monitor.js';
+/**
+ * 启动协议：资源仲裁 -> 先持久化意图 -> 请求驱动启动 -> 登记身份并转 active -> 监督运行 -> 记录结果。
+ * 任何出口都会结清 stopResolve 并把操作移出在飞表。
+ */
+export async function runProcess(ctx, plan) {
+    const { options, opState } = plan;
+    const cleanups = [];
+    try {
+        // 1. [资源分配与排队等待]
+        await ctx.domain.allocateResourcesWithWait(options.opId, options.requiredResources || [], options.waitTimeoutMs ?? 0, options.resourceBudget, () => opState.cancelRequested === true);
+        if (opState.cancelRequested) {
+            return cancelBeforeSpawn(ctx.domain, options, opState);
+        }
+        // 2. [启动协议步骤 1] 写入 SQLite (status: intent_registered)
+        try {
+            ctx.domain.getStore().registerOperationIntent(plan.op, ctx.domain.domainId);
+            opState.phase = 'intent_registered';
+        }
+        catch (err) {
+            ctx.domain.internalReleaseResources(options.opId, options.requiredResources);
+            throw err;
+        }
+        if (opState.cancelRequested) {
+            return cancelBeforeSpawn(ctx.domain, options, opState);
+        }
+        // 3. [启动协议步骤 2] 请求平台驱动启动
+        opState.phase = 'spawning';
+        let handle;
+        try {
+            handle = await ctx.driver.spawn(plan.command);
+            opState.handle = handle;
+            opState.command = plan.command;
+        }
+        catch (spawnError) {
+            return failSpawn(ctx.domain, plan, spawnError);
+        }
+        // 4. [启动协议步骤 3] 登记执行身份，状态推进为 active
+        await activateOrAbort(ctx, plan, handle);
+        // 5–6. 监督运行、有界排空、结果落盘
+        return await superviseActive(ctx, plan, handle, cleanups);
+    }
+    finally {
+        for (const cleanup of cleanups)
+            cleanup();
+        if (opState.stopResolve) {
+            const resolveFn = opState.stopResolve;
+            opState.stopResolve = undefined;
+            resolveFn({
+                stopped: 'confirmed_stopped',
+                scope: 'direct_child',
+                errorDetails: opState.phase === 'done' ? undefined : 'Operation terminated before process activation',
+            });
+        }
+        ctx.forget(options.opId);
+    }
+}
+/** 启动失败（如可执行文件不存在）：不产生假运行状态，直接失败收尾并释放资源。 */
+function failSpawn(domain, plan, spawnError) {
+    const { options, opState } = plan;
+    opState.phase = 'done';
+    opState.stopResolve?.({ stopped: 'confirmed_stopped', scope: 'direct_child', errorDetails: spawnError?.message });
+    opState.stopResolve = undefined;
+    const message = spawnError?.message || String(spawnError);
+    const failResult = {
+        kind: 'process',
+        status: 'failed',
+        exitCode: 127,
+        signal: null,
+        stdout: '',
+        stderr: message,
+        spawnFailure: message,
+        capabilityId: options.capabilityId,
+        confined: plan.confined,
+        confinementDriver: plan.confinementDriverName,
+        isTruncated: false,
+        identityVerification: 'not_original_process',
+        durationMs: Date.now() - opState.startTime,
+        completedAt: new Date().toISOString(),
+    };
+    return finalizeOperation(domain, options.opId, failResult, { requiredResources: options.requiredResources });
+}
+/**
+ * 登记 active 并放行闸门。登记失败时（N4）进程已存在：先停掉它，再按停止是否确认
+ * 记为 failed 或 indeterminate，最后把原始登记错误抛给调用方，防止产生孤儿进程。
+ */
+async function activateOrAbort(ctx, plan, handle) {
+    const { options, opState } = plan;
+    try {
+        ctx.domain.getStore().updateOperationStatus(options.opId, 'active', handle.identity);
+        opState.phase = 'active';
+        handle.releaseGate?.();
+        if (options.capabilityId && plan.capAdmission) {
+            recordCapabilityUsed(ctx.domain, { runId: options.runId, opId: options.opId, capabilityId: options.capabilityId }, plan.capAdmission);
+        }
+    }
+    catch (statusError) {
+        handle.destroyGate?.();
+        opState.phase = 'stopping';
+        const stopRes = await ctx.driver.terminate(handle.identity, 2000);
+        // 有界等待退出与关闭流，防止管道悬挂
+        await Promise.race([
+            (handle.onRootExit ?? handle.onExit).catch(() => { }),
+            new Promise((resolve) => setTimeout(resolve, 500)),
+        ]);
+        try {
+            handle.stdout.destroy?.();
+            handle.stderr.destroy?.();
+        }
+        catch { }
+        opState.phase = 'done';
+        if (opState.stopResolve) {
+            const resolveFn = opState.stopResolve;
+            opState.stopResolve = undefined;
+            resolveFn(stopRes);
+        }
+        const statusMessage = statusError?.message || String(statusError);
+        if (stopRes.stopped === 'confirmed_stopped') {
+            const failResult = {
+                kind: 'process',
+                status: 'failed',
+                exitCode: null,
+                signal: null,
+                stdout: '',
+                stderr: `Failed to register active status: ${statusMessage}`,
+                spawnFailure: statusMessage,
+                isTruncated: false,
+                identityVerification: 'not_original_process',
+                durationMs: Date.now() - opState.startTime,
+                completedAt: new Date().toISOString(),
+            };
+            finalizeOperation(ctx.domain, options.opId, failResult, { requiredResources: options.requiredResources });
+        }
+        else {
+            const indet = indeterminateResult({
+                reason: `Failed to register active status: ${statusMessage}, and process ${handle.identity.pid} could not be confirmed stopped: ${stopRes.errorDetails || 'residual processes still alive'}`,
+                startTime: opState.startTime,
+            });
+            finalizeOperation(ctx.domain, options.opId, indet, {
+                requiredResources: options.requiredResources,
+                releaseResourceLock: false,
+            });
+        }
+        throw statusError;
+    }
+}
+/** 进程启动前被取消：记录 cancelled（evidence: unobserved），不写虚假租约或意图事件。 */
+export function cancelBeforeSpawn(domain, options, opState) {
+    opState.phase = 'done';
+    const stopRes = { stopped: 'confirmed_stopped', scope: 'direct_child' };
+    opState.stopResolve?.(stopRes);
+    opState.stopResolve = undefined;
+    const cancelResult = {
+        kind: 'process',
+        status: 'cancelled',
+        exitCode: null,
+        signal: null,
+        stdout: '',
+        stderr: '',
+        capabilityId: options.capabilityId,
+        isTruncated: false,
+        terminationReason: 'user_cancelled',
+        evidence: 'unobserved',
+        identityVerification: 'not_original_process',
+        durationMs: Date.now() - opState.startTime,
+        completedAt: new Date().toISOString(),
+    };
+    const stored = domain.getStore().getOperation(options.opId);
+    if (!stored) {
+        // 此时操作是在 waiting_resources 阶段就被取消，尚未获取资源租约，亦未正常注册意图。
+        // 为保证 store 中有该操作记录以便写入 cancelled 结果，直接记录预意图取消操作，
+        // 绝不向 resource_leases 写入虚假租约，亦不产生虚假的 OPERATION_INTENT_REGISTERED 事件。
+        const op = {
+            id: options.opId,
+            runId: options.runId,
+            kind: 'process',
+            name: options.name,
+            inputFingerprint: options.inputFingerprint || computeInputFingerprint(options),
+            requiredResources: options.requiredResources || [],
+            status: 'done',
+        };
+        domain.getStore().recordPreIntentCancelledOperation(op, domain.domainId, cancelResult);
+        domain.internalReleaseResources(options.opId, options.requiredResources);
+        return cancelResult;
+    }
+    return finalizeOperation(domain, options.opId, cancelResult, { requiredResources: options.requiredResources });
+}
+//# sourceMappingURL=process-run.js.map

package/dist/supervisor/process-run.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"process-run.js","sourceRoot":"","sources":["../../src/supervisor/process-run.ts"],"names":[],"mappings":"AAGA,OAAO,EAAuB,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAC3E,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACvE,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAsBvD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAAsB,EAAE,IAAoB;IAC3E,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IAClC,MAAM,QAAQ,GAAsB,EAAE,CAAC;IACvC,IAAI,CAAC;QACH,iBAAiB;QACjB,MAAM,GAAG,CAAC,MAAM,CAAC,yBAAyB,CACxC,OAAO,CAAC,IAAI,EACZ,OAAO,CAAC,iBAAiB,IAAI,EAAE,EAC/B,OAAO,CAAC,aAAa,IAAI,CAAC,EAC1B,OAAO,CAAC,cAAc,EACtB,GAAG,EAAE,CAAC,OAAO,CAAC,eAAe,KAAK,IAAI,CACvC,CAAC;QACF,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;YAC5B,OAAO,iBAAiB,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QACzD,CAAC;QAED,sDAAsD;QACtD,IAAI,CAAC;YACH,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,uBAAuB,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC5E,OAAO,CAAC,KAAK,GAAG,mBAAmB,CAAC;QACtC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,MAAM,CAAC,wBAAwB,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAAC;YAC7E,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;YAC5B,OAAO,iBAAiB,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QACzD,CAAC;QAED,yBAAyB;QACzB,OAAO,CAAC,KAAK,GAAG,UAAU,CAAC;QAC3B,IAAI,MAA4B,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC9C,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC;YACxB,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QACjC,CAAC;QAAC,OAAO,UAAe,EAAE,CAAC;YACzB,OAAO,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;QACjD,CAAC;QAED,oCAAoC;QACpC,MAAM,eAAe,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QAEzC,sBAAsB;QACtB,OAAO,MAAM,eAAe,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC5D,CAAC;YAAS,CAAC;QACT,KAAK,MAAM,OAAO,IAAI,QAAQ;YAAE,OAAO,EAAE,CAAC;QAC1C,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;YACxB,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC;YACtC,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC;YAChC,SAAS,CAAC;gBACR,OAAO,EAAE,mBAAmB;gBAC5B,KAAK,EAAE,cAAc;gBACrB,YAAY,EAAE,OAAO,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,gDAAgD;aACtG,CAAC,CAAC;QACL,CAAC;QACD,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;AACH,CAAC;AAED,4CAA4C;AAC5C,SAAS,SAAS,CAAC,MAAuB,EAAE,IAAoB,EAAE,UAAe;IAC/E,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IAClC,OAAO,CAAC,KAAK,GAAG,MAAM,CAAC;IACvB,OAAO,CAAC,WAAW,EAAE,CAAC,EAAE,OAAO,EAAE,mBAAmB,EAAE,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;IAClH,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC;IAChC,MAAM,OAAO,GAAG,UAAU,EAAE,OAAO,IAAI,MAAM,CAAC,UAAU,CAAC,CAAC;IAC1D,MAAM,UAAU,GAA2B;QACzC,IAAI,EAAE,SAAS;QACf,MAAM,EAAE,QAAQ;QAChB,QAAQ,EAAE,GAAG;QACb,MAAM,EAAE,IAAI;QACZ,MAAM,EAAE,EAAE;QACV,MAAM,EAAE,OAAO;QACf,YAAY,EAAE,OAAO;QACrB,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,iBAAiB,EAAE,IAAI,CAAC,qBAAqB;QAC7C,WAAW,EAAE,KAAK;QAClB,oBAAoB,EAAE,sBAAsB;QAC5C,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,SAAS;QAC1C,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACtC,CAAC;IACF,OAAO,iBAAiB,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC;AAC/G,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,eAAe,CAAC,GAAsB,EAAE,IAAoB,EAAE,MAA4B;IACvG,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IAClC,IAAI,CAAC;QACH,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,qBAAqB,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QACrF,OAAO,CAAC,KAAK,GAAG,QAAQ,CAAC;QACzB,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC;QACvB,IAAI,OAAO,CAAC,YAAY,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YAC9C,oBAAoB,CAClB,GAAG,CAAC,MAAM,EACV,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,EAChF,IAAI,CAAC,YAAY,CAClB,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,WAAgB,EAAE,CAAC;QAC1B,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC;QACvB,OAAO,CAAC,KAAK,GAAG,UAAU,CAAC;QAC3B,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAClE,oBAAoB;QACpB,MAAM,OAAO,CAAC,IAAI,CAAC;YACjB,CAAC,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC;YACpD,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;SACzD,CAAC,CAAC;QACH,IAAI,CAAC;YACF,MAAM,CAAC,MAAc,CAAC,OAAO,EAAE,EAAE,CAAC;YAClC,MAAM,CAAC,MAAc,CAAC,OAAO,EAAE,EAAE,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;QAEV,OAAO,CAAC,KAAK,GAAG,MAAM,CAAC;QACvB,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;YACxB,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC;YACtC,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC;YAChC,SAAS,CAAC,OAAO,CAAC,CAAC;QACrB,CAAC;QAED,MAAM,aAAa,GAAG,WAAW,EAAE,OAAO,IAAI,MAAM,CAAC,WAAW,CAAC,CAAC;QAClE,IAAI,OAAO,CAAC,OAAO,KAAK,mBAAmB,EAAE,CAAC;YAC5C,MAAM,UAAU,GAA2B;gBACzC,IAAI,EAAE,SAAS;gBACf,MAAM,EAAE,QAAQ;gBAChB,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,IAAI;gBACZ,MAAM,EAAE,EAAE;gBACV,MAAM,EAAE,qCAAqC,aAAa,EAAE;gBAC5D,YAAY,EAAE,aAAa;gBAC3B,WAAW,EAAE,KAAK;gBAClB,oBAAoB,EAAE,sBAAsB;gBAC5C,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,SAAS;gBAC1C,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACtC,CAAC;YACF,iBAAiB,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC;QAC5G,CAAC;aAAM,CAAC;YACN,MAAM,KAAK,GAAG,mBAAmB,CAAC;gBAChC,MAAM,EAAE,qCAAqC,aAAa,iBAAiB,MAAM,CAAC,QAAQ,CAAC,GAAG,oCAAoC,OAAO,CAAC,YAAY,IAAI,gCAAgC,EAAE;gBAC5L,SAAS,EAAE,OAAO,CAAC,SAAS;aAC7B,CAAC,CAAC;YACH,iBAAiB,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE;gBACjD,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;gBAC5C,mBAAmB,EAAE,KAAK;aAC3B,CAAC,CAAC;QACL,CAAC;QACD,MAAM,WAAW,CAAC;IACpB,CAAC;AACH,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,iBAAiB,CAC/B,MAAuB,EACvB,OAA8B,EAC9B,OAA6B;IAE7B,OAAO,CAAC,KAAK,GAAG,MAAM,CAAC;IACvB,MAAM,OAAO,GAAsB,EAAE,OAAO,EAAE,mBAAmB,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC;IAC3F,OAAO,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,CAAC;IAC/B,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC;IAEhC,MAAM,YAAY,GAA2B;QAC3C,IAAI,EAAE,SAAS;QACf,MAAM,EAAE,WAAW;QACnB,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,IAAI;QACZ,MAAM,EAAE,EAAE;QACV,MAAM,EAAE,EAAE;QACV,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,WAAW,EAAE,KAAK;QAClB,iBAAiB,EAAE,gBAAgB;QACnC,QAAQ,EAAE,YAAY;QACtB,oBAAoB,EAAE,sBAAsB;QAC5C,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,SAAS;QAC1C,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACtC,CAAC;IAEF,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5D,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,qDAAqD;QACrD,kDAAkD;QAClD,qEAAqE;QACrE,MAAM,EAAE,GAAc;YACpB,EAAE,EAAE,OAAO,CAAC,IAAI;YAChB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,IAAI,uBAAuB,CAAC,OAAO,CAAC;YAC9E,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,IAAI,EAAE;YAClD,MAAM,EAAE,MAAM;SACf,CAAC;QACF,MAAM,CAAC,QAAQ,EAAE,CAAC,iCAAiC,CAAC,EAAE,EAAE,MAAM,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;QACvF,MAAM,CAAC,wBAAwB,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAAC;QACzE,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,OAAO,iBAAiB,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,YAAY,EAAE,EAAE,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC;AACjH,CAAC"}

package/dist/supervisor/replay.d.ts

@@ -0,0 +1,14 @@
+import { ExecutionDomain } from '../domain.js';
+import { ProcessOperationResult } from '../types.js';
+import { ActiveOperationState, ExecuteProcessOptions } from './types.js';
+/**
+ * 在飞操作重放（ARCHITECTURE §3.7 / 契约 #46）：同指纹加入原执行并共享流投影，
+ * 不同指纹抛 OperationIdConflictError。abortSignal 只中止本次等待，不影响原操作。
+ */
+export declare function joinInFlight(domain: ExecutionDomain, inFlight: ActiveOperationState, options: ExecuteProcessOptions, inputFingerprint: string): Promise<ProcessOperationResult>;
+/**
+ * 已持久化操作重放（ARCHITECTURE §3.7 / 契约 #45, #47, #48, #49）。
+ * 返回 undefined 表示该 opId 从未登记，调用方应正常执行。
+ */
+export declare function replayRecorded(domain: ExecutionDomain, options: ExecuteProcessOptions, inputFingerprint: string): ProcessOperationResult | undefined;
+//# sourceMappingURL=replay.d.ts.map

package/dist/supervisor/replay.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"replay.d.ts","sourceRoot":"","sources":["../../src/supervisor/replay.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAA4B,sBAAsB,EAAyB,MAAM,aAAa,CAAC;AACtG,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAEzE;;;GAGG;AACH,wBAAsB,YAAY,CAChC,MAAM,EAAE,eAAe,EACvB,QAAQ,EAAE,oBAAoB,EAC9B,OAAO,EAAE,qBAAqB,EAC9B,gBAAgB,EAAE,MAAM,GACvB,OAAO,CAAC,sBAAsB,CAAC,CAiDjC;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,eAAe,EACvB,OAAO,EAAE,qBAAqB,EAC9B,gBAAgB,EAAE,MAAM,GACvB,sBAAsB,GAAG,SAAS,CA2BpC"}

package/dist/supervisor/replay.js

@@ -0,0 +1,70 @@
+import { OperationIdConflictError, RecoveryRequiredError } from '../types.js';
+/**
+ * 在飞操作重放（ARCHITECTURE §3.7 / 契约 #46）：同指纹加入原执行并共享流投影，
+ * 不同指纹抛 OperationIdConflictError。abortSignal 只中止本次等待，不影响原操作。
+ */
+export async function joinInFlight(domain, inFlight, options, inputFingerprint) {
+    if (inFlight.inputFingerprint !== inputFingerprint) {
+        throw new OperationIdConflictError(options.opId, inFlight.inputFingerprint, inputFingerprint, inFlight.phase, inFlight.runId);
+    }
+    domain.getStore().recordReplay(domain.domainId, options.opId, 'joined', options.runId);
+    const subscriber = options.onStreamChunk;
+    if (subscriber) {
+        inFlight.streamSubscribers.add(subscriber);
+    }
+    const unsubscribe = () => {
+        if (subscriber)
+            inFlight.streamSubscribers.delete(subscriber);
+    };
+    const signal = options.abortSignal;
+    if (!signal) {
+        const res = await inFlight.resultPromise;
+        unsubscribe();
+        return { ...res, replayed: true };
+    }
+    if (signal.aborted) {
+        unsubscribe();
+        throw signal.reason || new Error('Operation wait aborted');
+    }
+    return await new Promise((resolve, reject) => {
+        const onAbort = () => {
+            unsubscribe();
+            reject(signal.reason || new Error('Operation wait aborted'));
+        };
+        signal.addEventListener('abort', onAbort, { once: true });
+        inFlight.resultPromise.then((res) => {
+            signal.removeEventListener('abort', onAbort);
+            unsubscribe();
+            resolve({ ...res, replayed: true });
+        }, (err) => {
+            signal.removeEventListener('abort', onAbort);
+            unsubscribe();
+            reject(err);
+        });
+    });
+}
+/**
+ * 已持久化操作重放（ARCHITECTURE §3.7 / 契约 #45, #47, #48, #49）。
+ * 返回 undefined 表示该 opId 从未登记，调用方应正常执行。
+ */
+export function replayRecorded(domain, options, inputFingerprint) {
+    const existingRecorded = domain.getStore().getOperation(options.opId);
+    if (!existingRecorded)
+        return undefined;
+    if (existingRecorded.inputFingerprint !== inputFingerprint) {
+        throw new OperationIdConflictError(options.opId, existingRecorded.inputFingerprint, inputFingerprint, existingRecorded.status, existingRecorded.runId);
+    }
+    // 未终结状态且不在内存中 → 必须先执行恢复（崩溃残留现场）
+    if (existingRecorded.status !== 'done') {
+        throw new RecoveryRequiredError(options.opId, existingRecorded.status, existingRecorded.runId);
+    }
+    // indeterminate：绝不重跑，原样返回，保留租约；已结清终态返回已持久化结果
+    const kind = existingRecorded.result?.status === 'indeterminate' ? 'indeterminate' : 'recorded';
+    domain.getStore().recordReplay(domain.domainId, options.opId, kind, options.runId);
+    return {
+        ...existingRecorded.result,
+        replayed: true,
+        runId: existingRecorded.runId,
+    };
+}
+//# sourceMappingURL=replay.js.map

package/dist/supervisor/replay.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"replay.js","sourceRoot":"","sources":["../../src/supervisor/replay.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,wBAAwB,EAA0B,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAGtG;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAAuB,EACvB,QAA8B,EAC9B,OAA8B,EAC9B,gBAAwB;IAExB,IAAI,QAAQ,CAAC,gBAAgB,KAAK,gBAAgB,EAAE,CAAC;QACnD,MAAM,IAAI,wBAAwB,CAChC,OAAO,CAAC,IAAI,EACZ,QAAQ,CAAC,gBAAgB,EACzB,gBAAgB,EAChB,QAAQ,CAAC,KAAK,EACd,QAAQ,CAAC,KAAK,CACf,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,QAAQ,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACvF,MAAM,UAAU,GAAG,OAAO,CAAC,aAAa,CAAC;IACzC,IAAI,UAAU,EAAE,CAAC;QACf,QAAQ,CAAC,iBAAiB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC7C,CAAC;IACD,MAAM,WAAW,GAAG,GAAG,EAAE;QACvB,IAAI,UAAU;YAAE,QAAQ,CAAC,iBAAiB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAChE,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IACnC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,aAAc,CAAC;QAC1C,WAAW,EAAE,CAAC;QACd,OAAO,EAAE,GAAG,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACpC,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,WAAW,EAAE,CAAC;QACd,MAAM,MAAM,CAAC,MAAM,IAAI,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,MAAM,IAAI,OAAO,CAAyB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACnE,MAAM,OAAO,GAAG,GAAG,EAAE;YACnB,WAAW,EAAE,CAAC;YACd,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC,CAAC;QAC/D,CAAC,CAAC;QACF,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,QAAQ,CAAC,aAAc,CAAC,IAAI,CAC1B,CAAC,GAAG,EAAE,EAAE;YACN,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC7C,WAAW,EAAE,CAAC;YACd,OAAO,CAAC,EAAE,GAAG,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QACtC,CAAC,EACD,CAAC,GAAG,EAAE,EAAE;YACN,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC7C,WAAW,EAAE,CAAC;YACd,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAC5B,MAAuB,EACvB,OAA8B,EAC9B,gBAAwB;IAExB,MAAM,gBAAgB,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACtE,IAAI,CAAC,gBAAgB;QAAE,OAAO,SAAS,CAAC;IAExC,IAAI,gBAAgB,CAAC,gBAAgB,KAAK,gBAAgB,EAAE,CAAC;QAC3D,MAAM,IAAI,wBAAwB,CAChC,OAAO,CAAC,IAAI,EACZ,gBAAgB,CAAC,gBAAgB,EACjC,gBAAgB,EAChB,gBAAgB,CAAC,MAAM,EACvB,gBAAgB,CAAC,KAAK,CACvB,CAAC;IACJ,CAAC;IAED,gCAAgC;IAChC,IAAI,gBAAgB,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QACvC,MAAM,IAAI,qBAAqB,CAAC,OAAO,CAAC,IAAI,EAAE,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACjG,CAAC;IAED,6CAA6C;IAC7C,MAAM,IAAI,GAAG,gBAAgB,CAAC,MAAM,EAAE,MAAM,KAAK,eAAe,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,UAAU,CAAC;IAChG,MAAM,CAAC,QAAQ,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACnF,OAAO;QACL,GAAG,gBAAgB,CAAC,MAAM;QAC1B,QAAQ,EAAE,IAAI;QACd,KAAK,EAAE,gBAAgB,CAAC,KAAK;KACO,CAAC;AACzC,CAAC"}

package/dist/supervisor/rollback.d.ts

@@ -0,0 +1,8 @@
+import { RollbackOperationResult } from '../types.js';
+import { SnapshotContext } from './snapshot-ops.js';
+import { RollbackOptions } from './types.js';
+/**
+ * 回滚协议 (ARCHITECTURE §3.5 / 契约 #28–#30, #56)
+ */
+export declare function rollback(ctx: SnapshotContext, options: RollbackOptions): Promise<RollbackOperationResult>;
+//# sourceMappingURL=rollback.d.ts.map

package/dist/supervisor/rollback.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rollback.d.ts","sourceRoot":"","sources":["../../src/supervisor/rollback.ts"],"names":[],"mappings":"AAGA,OAAO,EAAoC,uBAAuB,EAAe,MAAM,aAAa,CAAC;AAGrG,OAAO,EAAyC,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAC3F,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAE7C;;GAEG;AACH,wBAAsB,QAAQ,CAAC,GAAG,EAAE,eAAe,EAAE,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,uBAAuB,CAAC,CA0E/G"}

package/dist/supervisor/rollback.js

@@ -0,0 +1,153 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { ResourceConflictError } from '../types.js';
+import { isPathContained } from '../capability/index.js';
+import { activateInternalOperation, sha256Json } from './snapshot-ops.js';
+/**
+ * 回滚协议 (ARCHITECTURE §3.5 / 契约 #28–#30, #56)
+ */
+export async function rollback(ctx, options) {
+    const { domain, snapshotDriver } = ctx;
+    const startTime = Date.now();
+    const snapshot = domain.getStore().getSnapshot(options.snapshotId);
+    if (!snapshot) {
+        throw new Error(`Snapshot not found: ${options.snapshotId}`);
+    }
+    let targetRoots = (options.roots || snapshot.roots).map((r) => path.resolve(r));
+    let capAdmission;
+    if (options.capabilityId) {
+        capAdmission = domain.checkCapabilityAdmission({
+            capabilityId: options.capabilityId,
+            mutationRoots: targetRoots,
+            runId: options.runId,
+            opId: options.opId,
+        });
+        targetRoots = capAdmission.effectiveMutationRoots;
+    }
+    assertRootsQuiescent(domain, targetRoots, options.opId);
+    const op = {
+        id: options.opId,
+        runId: options.runId,
+        kind: 'rollback',
+        name: `rollback:${options.snapshotId}`,
+        inputFingerprint: sha256Json({
+            kind: 'rollback',
+            snapshotId: options.snapshotId,
+            targetRoots,
+            capabilityId: options.capabilityId ?? null,
+        }),
+        requiredResources: targetRoots.map((r) => `workspace:write:${r}`),
+        mutationRoots: targetRoots,
+        capabilityId: options.capabilityId,
+        outputRef: options.snapshotId,
+        timeoutMs: options.timeoutMs,
+        status: 'intent_registered',
+    };
+    activateInternalOperation(domain, op, capAdmission);
+    try {
+        const { unrestoredPaths } = await snapshotDriver.restore(snapshot, { force: options.force });
+        const currentFp = await snapshotDriver.fingerprint(targetRoots, { against: snapshot });
+        const status = currentFp !== snapshot.treeFingerprint ? 'failed' : unrestoredPaths.length > 0 ? 'partial' : 'restored';
+        const { coverage, outOfScopeEffects } = rollbackCoverage(status, () => allEffectsConfinedToRoots(domain, snapshot, targetRoots, options.opId));
+        let result;
+        domain.getStore().transaction(() => {
+            result = {
+                kind: 'rollback',
+                status,
+                snapshotId: options.snapshotId,
+                unrestoredPaths: unrestoredPaths.length > 0 ? unrestoredPaths : undefined,
+                coverage,
+                outOfScopeEffects,
+                capabilityId: options.capabilityId,
+                durationMs: Date.now() - startTime,
+                completedAt: new Date().toISOString(),
+            };
+            domain.getStore().recordOperationResult(options.opId, result);
+            domain.getStore().updateOperationStatus(options.opId, 'done');
+        });
+        domain.internalReleaseResources(options.opId);
+        return result;
+    }
+    catch (err) {
+        domain.internalReleaseResources(options.opId);
+        throw err;
+    }
+}
+/** 同一根目录的两种写资源名（原路径与 realpath），和它们对应的目录。 */
+function rootAliases(root) {
+    let realRoot = root;
+    try {
+        realRoot = fs.realpathSync(root);
+    }
+    catch { }
+    return { root, realRoot, writeRes: `workspace:write:${root}`, writeResReal: `workspace:write:${realRoot}` };
+}
+/**
+ * 前置条件（契约 #30）：目标根目录上不存在 active / stopping / 未裁决 indeterminate 的操作。
+ * 依次检查内存租约、未结清操作、持久化租约（含 indeterminate 保留的租约）。
+ */
+function assertRootsQuiescent(domain, targetRoots, opId) {
+    const aliases = targetRoots.map(rootAliases);
+    for (const a of aliases) {
+        for (const res of [a.writeRes, a.writeResReal]) {
+            if (domain.isResourceLocked(res)) {
+                throw new ResourceConflictError(res, domain.getResourceOwner(res) || 'unknown', opId, 0);
+            }
+        }
+    }
+    for (const op of domain.getStore().getUnfinishedOperations(domain.domainId)) {
+        if (op.id === opId)
+            continue;
+        for (const a of aliases) {
+            const touchesRoot = op.requiredResources.includes(a.writeRes) ||
+                op.requiredResources.includes(a.writeResReal) ||
+                op.mutationRoots?.some((mr) => {
+                    const resolved = path.resolve(mr);
+                    return resolved === a.root || resolved === a.realRoot;
+                });
+            if (touchesRoot) {
+                throw new ResourceConflictError(a.writeRes, op.id, opId, 0);
+            }
+        }
+    }
+    for (const lease of domain.getStore().getPersistedResourceLeases(domain.domainId)) {
+        for (const a of aliases) {
+            if ((lease.resourceId === a.writeRes || lease.resourceId === a.writeResReal) && lease.operationId !== opId) {
+                throw new ResourceConflictError(lease.resourceId, lease.operationId, opId, 0);
+            }
+        }
+    }
+}
+/**
+ * 快照之后的每个已记录操作都在写入限制下运行、且写入范围落在回滚根内，才可声称 complete。
+ * 快照与回滚本身不产生根外副作用。
+ */
+function allEffectsConfinedToRoots(domain, snapshot, targetRoots, rollbackOpId) {
+    const store = domain.getStore();
+    const eventsSince = snapshot.journalSeq !== undefined ? store.getJournalEvents(domain.domainId, snapshot.journalSeq) : [];
+    const opResults = eventsSince.filter((e) => e.type === 'OPERATION_RESULT_RECORDED' && e.operationId !== rollbackOpId);
+    return opResults.every((e) => {
+        const res = e.payload?.result || e.payload;
+        const storedOp = store.getOperation(e.operationId);
+        if (storedOp?.kind === 'snapshot' || storedOp?.kind === 'rollback') {
+            return true;
+        }
+        if (res?.confined !== true) {
+            return false;
+        }
+        const opRoots = storedOp?.mutationRoots || [];
+        if (opRoots.length === 0)
+            return true;
+        return opRoots.every((opr) => targetRoots.some((sr) => isPathContained(sr, opr)));
+    });
+}
+function rollbackCoverage(status, allConfined) {
+    if (status !== 'restored') {
+        return { coverage: status === 'partial' ? 'declared_roots' : 'none', outOfScopeEffects: 'possible' };
+    }
+    if (allConfined()) {
+        return { coverage: 'complete', outOfScopeEffects: 'none_possible' };
+    }
+    return { coverage: 'declared_roots', outOfScopeEffects: 'possible' };
+}
+//# sourceMappingURL=rollback.js.map