@zq-silk/yui 0.15.12 → 0.16.0

package/dist/repository/projectMaintenanceLock.js

@@ -1,7 +1,8 @@
-import { existsSync, mkdirSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { mkdirSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { performance } from "node:perf_hooks";
 import { setTimeout as delay } from "node:timers/promises";
+import { currentFileLockOwner, fileLockOwnerIsLive } from "../core/fileLockOwner.js";
 /**
  * Per-Project maintenance fence.
  *
@@ -87,6 +88,7 @@ export function acquireProjectMaintenanceLock(home, projectId, options = {}) {
 async function acquireWithBudget(home, projectId, budget, firstProject = true) {
     const lock = projectMaintenanceLockPath(home, projectId);
     assertNotCancelled(projectId, budget.signal);
+    const ownerIdentity = currentFileLockOwner();
     mkdirSync(join(home, "locks", "projects"), { recursive: true, mode: 0o700 });
     let firstAttempt = firstProject;
     while (true) {
@@ -99,7 +101,7 @@ async function acquireWithBudget(home, projectId, budget, firstProject = true) {
         firstAttempt = false;
         try {
             mkdirSync(lock, { mode: 0o700 });
-            const ownerIdentity = writeOwnerIdentity(lock);
+            writeOwnerIdentity(lock, ownerIdentity);
             let released = false;
             return () => {
                 if (released)
@@ -134,8 +136,7 @@ async function acquireWithBudget(home, projectId, budget, firstProject = true) {
     }
 }
 /** Write this process's owner identity and return the exact bytes recorded. */
-function writeOwnerIdentity(lock) {
-    const identity = `${process.pid}:${processStartIdentity() ?? ""}`;
+function writeOwnerIdentity(lock, identity = currentFileLockOwner()) {
     writeFileSync(join(lock, "owner"), `${identity}\n`, { mode: 0o600 });
     return identity;
 }
@@ -188,14 +189,17 @@ export async function acquireProjectMaintenanceLocks(home, projectIds, options =
 }
 /**
  * Non-blocking fence check for the Controller: a Project is fenced only
- * while a live process holds its lock. A stale (dead-owner) lock reads as
- * unfenced, so a crashed maintenance process never wedges preparation.
+ * while a live or unverified process holds its lock. Only proven stale owners
+ * read as unfenced; incomplete evidence never authorizes preparation.
  */
 export function isProjectMaintenanceFenced(home, projectId) {
     const lock = projectMaintenanceLockPath(home, projectId);
-    if (!existsSync(lock))
-        return false;
-    return lockOwnerIsAlive(lock);
+    try {
+        return fileLockOwnerIsLive(lock);
+    }
+    catch {
+        return true;
+    }
 }
 /**
  * Reclaim a stale (dead-owner) lock through a crash-safe compare-and-delete
@@ -213,9 +217,8 @@ function reclaimStaleProjectMaintenanceLock(lock) {
     catch (error) {
         if (!isEnoent(error))
             throw error;
-        // Ownerless lock: a crash between mkdir and owner publication. Reclaim
-        // only when the directory is old enough that the creator is not still
-        // initializing; a fresh lock may have its owner file written imminently.
+        // Allow publication its initial grace period; an older missing owner is
+        // diagnosed as unverified below, never treated as a dead creator.
         try {
             if (Date.now() - statSync(lock).mtimeMs < STALE_PROJECT_MAINTENANCE_LOCK_AGE_MS)
                 return;
@@ -236,7 +239,7 @@ function reclaimStaleProjectMaintenanceLock(lock) {
             return;
         throw error;
     }
-    if (expectedOwner !== null && lockOwnerIsAlive(lock))
+    if (fileLockOwnerIsLive(lock))
         return;
     const reclaimLock = `${lock}.reclaim`;
     for (let attempt = 0; attempt < 2; attempt += 1) {
@@ -285,7 +288,7 @@ function reclaimStaleProjectMaintenanceLock(lock) {
             }
             if (currentOwner !== expectedOwner)
                 return;
-            if (currentOwner !== null && lockOwnerIsAlive(lock))
+            if (fileLockOwnerIsLive(lock))
                 return;
             rmSync(lock, { recursive: true, force: true });
         }
@@ -297,70 +300,26 @@ function reclaimStaleProjectMaintenanceLock(lock) {
 }
 /**
  * Reclaim a reclaim-lock directory only when it is provably orphaned: its
- * owner is dead (or unrecorded) AND it is older than the age bound, so a
+ * owner is provably dead AND it is older than the age bound, so a
  * lock whose owner just mkdir'ed but has not written its owner is not stolen.
  * Uses the same PID + start-time identity check as the main fence, so a
  * recycled PID with a different start identity does not keep an orphaned
- * reclaim lock alive. An ownerless (ENOENT owner) lock is still reclaimed;
- * an unreadable owner fails closed (treated as live).
+ * reclaim lock alive. An ownerless or unreadable lock remains unverified.
  * Returns true when it removed the lock (caller retries), false otherwise.
  */
 function reclaimOrphanedReclaimLock(reclaimLock) {
     try {
         if (Date.now() - statSync(reclaimLock).mtimeMs < STALE_PROJECT_MAINTENANCE_LOCK_AGE_MS)
             return false;
-        if (lockOwnerIsAlive(reclaimLock))
+        if (fileLockOwnerIsLive(reclaimLock))
             return false;
         rmSync(reclaimLock, { recursive: true, force: true });
         return true;
     }
     catch (error) {
-        return isEnoent(error);
-    }
-}
-function lockOwnerIsAlive(lock) {
-    let owner;
-    try {
-        owner = readFileSync(join(lock, "owner"), "utf8").trim();
-    }
-    catch (error) {
-        if (error instanceof Error && "code" in error && error.code === "ENOENT")
-            return false;
-        // An unreadable owner file fails closed: treat the fence as held.
-        return true;
-    }
-    const separator = owner.indexOf(":");
-    const pid = Number.parseInt(separator < 0 ? owner : owner.slice(0, separator), 10);
-    if (!Number.isInteger(pid) || pid <= 0)
-        return false;
-    const recordedIdentity = separator < 0 ? "" : owner.slice(separator + 1);
-    // PID + start-time identity: a recycled PID can never match the holder.
-    const currentIdentity = processStartIdentity(pid);
-    if (currentIdentity !== undefined) {
-        return recordedIdentity !== "" && currentIdentity === recordedIdentity;
-    }
-    // Off /proc (non-Linux): fall back to liveness.
-    return processIsAlive(pid);
-}
-/** Linux process start time (clock ticks since boot) for a PID; undefined off /proc. */
-function processStartIdentity(pid = process.pid) {
-    try {
-        const stat = readFileSync(`/proc/${pid}/stat`, "utf8");
-        const close = stat.lastIndexOf(")");
-        const fields = stat.slice(close + 2).split(" ");
-        return fields[19] ?? "0"; // field 22: starttime
-    }
-    catch {
-        return undefined;
-    }
-}
-function processIsAlive(pid) {
-    try {
-        process.kill(pid, 0);
-        return true;
-    }
-    catch (error) {
-        return error instanceof Error && "code" in error && error.code === "EPERM";
+        if (isEnoent(error))
+            return true;
+        throw error;
     }
 }
 function isEnoent(error) {

package/dist/repository/taskBaseFreshness.js

@@ -95,7 +95,7 @@ export async function inspectTaskBaseFreshness(taskId, store, options = {}) {
             baseRef: binding.baseRef,
             baseCommit,
             status,
-            source: tracked?.source ?? (project.remoteUrl === undefined ? "not-applicable" : "compatibility-projection"),
+            source: tracked?.source ?? (project.remoteUrl === undefined ? "not-applicable" : "unknown"),
             workspacePath,
             workspaceClean,
             ...(physicalHead === undefined ? {} : { physicalHead }),

package/dist/repository/taskWorkspaceCoordinator.js

@@ -1,10 +1,10 @@
-import { isDeepStrictEqual } from "node:util";
 import { lstat } from "node:fs/promises";
+import { isDeepStrictEqual } from "node:util";
 import { isArchivePersistenceFailure, recordArchiveCleanup } from "../task/archiveDiagnostics.js";
-import { projectTaskRemoteDeliveryFromStore } from "../commands/taskRemoteDeliveryCommand.js";
-import { WorkItemChangeSetManager } from "../workspace/workItemChangeSetManager.js";
-import { archiveSettlementChecks, archiveExecutionChecks } from "../task/archivePreflight.js";
+import { archiveExecutionChecks, archiveSettlementChecks } from "../task/archivePreflight.js";
+import { projectTaskRemoteDeliveryFromStore } from "../task/remoteDeliveryService.js";
 import { CleanupInspectionError } from "../workspace/cleanupInspection.js";
+import { WorkItemChangeSetManager } from "../workspace/workItemChangeSetManager.js";
 import { hasRuntimeLifecycleWork, runtimeLifecycleTarget } from "../runtime/lifecycleReservation.js";
 import { managedWorkspaceKey } from "../worktree/managedWorkspace.js";
 import { acquireProjectMaintenanceLocks } from "./projectMaintenanceLock.js";
@@ -235,7 +235,7 @@ export class TaskWorkspaceCoordinator {
                 throw new CleanupInspectionError(checks);
             const roleNames = this.store.listRoles(taskId).map(({ name }) => name);
             await this.#stopLiveRoles(taskId, roleNames);
-            await this.runtime.assertTaskPhysicalResourcesReleased?.(task.id);
+            await this.runtime.releaseTaskTerminals(task.id);
             this.#assertTaskArchiveSnapshot(snapshot);
             for (const workspace of laneWorkspaces) {
                 this.#assertTaskArchiveLifecycle(task);
@@ -336,10 +336,7 @@ export class TaskWorkspaceCoordinator {
                 throw new CleanupInspectionError(checks);
             if (!runtimeReleased)
                 throw new Error("One or more Role runtimes could not be safely released.");
-            if (this.runtime.assertTaskPhysicalResourcesReleased === undefined) {
-                throw new Error("Physical resource release inspection is unavailable; workspace references retained.");
-            }
-            await this.runtime.assertTaskPhysicalResourcesReleased(taskId);
+            await this.runtime.releaseTaskTerminals(taskId);
             return "released";
         });
         if (physicalReleased) {
@@ -447,9 +444,7 @@ export class TaskWorkspaceCoordinator {
      * human/Leader has taken responsibility for the outcome.
      */
     #assertNoActiveWorkItemDurableJobs(item) {
-        const jobs = this.store.listDurableJobs?.(item.taskId);
-        if (jobs === undefined)
-            return;
+        const jobs = this.store.listDurableJobs(item.taskId);
         const blocking = jobs.filter((job) => (job.owner.kind === "work-item"
             && job.owner.workItemId === item.id
             && (job.status === "queued"
@@ -470,18 +465,16 @@ export class TaskWorkspaceCoordinator {
     #reviewRoundRoleNames(round) {
         return [
             round.reviewerRoleName,
-            ...(round.executionGroup?.lanes.map(({ roleName }) => roleName) ?? []),
             ...(round.executionGroup?.lanes.map(({ roleName }) => roleName) ?? [])
         ];
     }
     async #stopLiveRoles(taskId, roleNames) {
         const targets = [...new Set(roleNames)];
-        const getActiveRun = this.store.getActiveRun?.bind(this.store);
         for (const roleName of targets) {
-            if (getActiveRun !== undefined && getActiveRun(taskId, roleName) !== null) {
+            if (this.store.getActiveRun(taskId, roleName) !== null) {
                 throw new Error(`Role has an active AgentRun: ${taskId}/${roleName}.`);
             }
-            if (this.store.getWorkMailbox !== undefined && hasRuntimeLifecycleWork(this.store.getWorkMailbox(runtimeLifecycleTarget({ scope: "task", taskId, roleName })))) {
+            if (hasRuntimeLifecycleWork(this.store.getWorkMailbox(runtimeLifecycleTarget({ scope: "task", taskId, roleName })))) {
                 throw new Error(`Role has unsettled runtime lifecycle state: ${taskId}/${roleName}.`);
             }
         }
@@ -498,11 +491,9 @@ export class TaskWorkspaceCoordinator {
         });
         if (live.length > 0)
             await this.runtime.stopTaskRoleSessions(taskId, live);
-        // The aggregate-16 dormant Claude placeholder is the sole exception to
-        // strict workspace-session retirement. The synchronous pane inspection is
-        // performed while holding the Task store transaction so a normal launch
-        // cannot reserve a AgentRun/Session between absence proof and terminalization.
-        if (inspect === undefined || this.store.transaction === undefined)
+        // Recheck exact runtime quiescence under the Task transaction when this
+        // runtime exposes physical panes. Store reads are always authoritative.
+        if (inspect === undefined)
             return;
         this.store.transaction((tx) => {
             const panes = inspect(taskId);
@@ -513,7 +504,7 @@ export class TaskWorkspaceCoordinator {
                 if (tx.getActiveRun(taskId, roleName) !== null) {
                     throw new Error(`Role has an active AgentRun: ${taskId}/${roleName}.`);
                 }
-                if (tx.getWorkMailbox !== undefined && hasRuntimeLifecycleWork(tx.getWorkMailbox(runtimeLifecycleTarget({ scope: "task", taskId, roleName })))) {
+                if (hasRuntimeLifecycleWork(tx.getWorkMailbox(runtimeLifecycleTarget({ scope: "task", taskId, roleName })))) {
                     throw new Error(`Role has unsettled runtime lifecycle state: ${taskId}/${roleName}.`);
                 }
             }

package/dist/repository/taskWorkspacePreparer.js

@@ -1,31 +1,31 @@
-import { lstat, mkdir, readlink, readdir, rm, rmdir, symlink, unlink } from "node:fs/promises";
+import { lstat, mkdir, readdir, readlink, rm, rmdir, symlink, unlink } from "node:fs/promises";
 import { dirname, isAbsolute, join, relative, resolve } from "node:path";
 import { isDeepStrictEqual } from "node:util";
 import { recordArchiveCleanup } from "../task/archiveDiagnostics.js";
+import { enqueueWork } from "../coordination/workMailboxQueue.js";
+import { createTaskEvent } from "../event/taskEvent.js";
 import { retireTaskRoleSessionsForWorkspace, updateRoleAgentSessionStatus } from "../executor/agentExecutor.js";
 import { formatWorkspacePreflightError } from "../executor/workspacePreflightClassification.js";
+import { createProjectResources } from "../resources/projectResourceService.js";
+import { ResourceRegistrar } from "../resources/resourceRegistrar.js";
+import { attachReviewRoundWorkspace, recordReviewWorkspaceDisposition } from "../review/reviewRound.js";
 import { updateRole } from "../role/role.js";
+import { hasRuntimeCleanupObligation, RUNTIME_HOST_DETACH_REQUIRED_REASON, runtimeLifecycleTarget } from "../runtime/lifecycleReservation.js";
 import { taskRoleRuntimeIdentity } from "../runtime/managedCaller.js";
-import { hasRuntimeCleanupObligation, runtimeLifecycleTarget, RUNTIME_HOST_DETACH_REQUIRED_REASON } from "../runtime/lifecycleReservation.js";
-import { taskLocalActor } from "../commands/taskActor.js";
-import { attachReviewRoundWorkspace, recordReviewWorkspaceDisposition } from "../review/reviewRound.js";
+import { managedTaskRoot } from "../storage/homeLayout.js";
 import { StorageConflictError } from "../storage/taskStore.js";
-import { activateTask, bindTaskProjectCommits, bindTaskWorkspaceIdentity, synchronizeTaskProjectCommits, taskOwnsManagedWorkspace } from "../task/task.js";
-import { admitStoredTaskActivation, adoptTaskActivationResources, recordFailedTaskActivation, recordAdoptedTaskActivation } from "../task/taskActivationService.js";
 import { validateDraftTaskForActivation } from "../task/draftPlan.js";
-import { createProjectResources } from "../resources/projectResourceService.js";
-import { createTaskEvent } from "../event/taskEvent.js";
-import { enqueueWork } from "../coordination/workMailboxQueue.js";
-import { createCandidateGitSnapshot, createDirectTaskMainSnapshot, workItemExecutionGroupById, recordWorkItemWorkspaceDisposition } from "../workItem/workItem.js";
+import { activateTask, bindTaskProjectCommits, bindTaskWorkspaceIdentity, synchronizeTaskProjectCommits, taskOwnsManagedWorkspace } from "../task/task.js";
+import { admitStoredTaskActivation, adoptTaskActivationResources, recordAdoptedTaskActivation, recordFailedTaskActivation } from "../task/taskActivationService.js";
+import { taskLocalActor } from "../task/taskAuthority.js";
+import { createCandidateGitSnapshot, createDirectTaskMainSnapshot, recordWorkItemWorkspaceDisposition, workItemExecutionGroupById } from "../workItem/workItem.js";
+import { CleanupInspectionError } from "../workspace/cleanupInspection.js";
 import { createManagedWorkspace, isTaskOwnedWorkspace, managedWorkspaceKey, managedWorktreeName, sameManagedWorkspaceIdentity } from "../worktree/managedWorkspace.js";
 import { NodeGitWorkspace, worktreeIdentity } from "./gitWorkspace.js";
-import { acquireProjectMaintenanceLocks, ProjectMaintenanceLockedError, ProjectMaintenanceLockCancelledError } from "./projectMaintenanceLock.js";
-import { generateTaskWorkspaceIdentity, taskWorkspaceRefSegment, validateTaskWorkspaceIdentity } from "./taskWorkspaceIdentity.js";
-import { ResourceRegistrar } from "../resources/resourceRegistrar.js";
+import { acquireProjectMaintenanceLocks, ProjectMaintenanceLockCancelledError, ProjectMaintenanceLockedError } from "./projectMaintenanceLock.js";
 import { captureTaskBaseProvenance, recordTaskBaseProvenanceEvents } from "./taskBaseFreshness.js";
-import { managedTaskRoot } from "../storage/homeLayout.js";
+import { generateTaskWorkspaceIdentity, taskWorkspaceRefSegment, validateTaskWorkspaceIdentity } from "./taskWorkspaceIdentity.js";
 import { inspectWorkspaceCleanup } from "./workspaceCleanupInspection.js";
-import { CleanupInspectionError } from "../workspace/cleanupInspection.js";
 const MAIN_WORKTREE = "main";
 const LEADER_ROLE = "leader";
 /**
@@ -154,12 +154,16 @@ export class FileTaskWorkspacePreparer {
                         changed: false
                     };
                 }
+                const admission = admitStoredTaskActivation(this.store, task.id);
+                if (admission.disposition === "absent") {
+                    throw new Error(`Task activation request is required: ${task.id}. `
+                        + `Use yui task activation request ${task.id} --request-id <id> --environment <plan> first.`);
+                }
                 const provider = this.store.getTaskRoleSessionSet(task.id, LEADER_ROLE)?.providerBinding;
                 if (provider?.run != null
                     && ["submitting", "accepted", "delivery-unknown"].includes(provider.run.status)) {
                     throw new Error("Planning native input is unsettled; preserve activation intent and retry after its exact terminal.");
                 }
-                const admission = admitStoredTaskActivation(this.store, task.id);
                 if (admission.disposition === "ready")
                     attemptedRequest = admission.request;
                 validateDraftTaskForActivation(this.store, task);
@@ -218,9 +222,8 @@ export class FileTaskWorkspacePreparer {
      * Prepares and adopts the resource configuration an explicit activation
      * request named, before any status change.
      *
-     * A Task with no request keeps the historical behavior: its managed workspace
-     * is the whole environment. A request whose plan is empty and whose Task
-     * binds no Project owns nothing physical, and is reported as workspace-free
+     * A request whose plan is empty and whose Task binds no Project owns nothing
+     * physical, and is reported as workspace-free
      * so activation creates no directory at all.
      *
      * The exact request that was adopted travels with the result, so the later
@@ -229,8 +232,6 @@ export class FileTaskWorkspacePreparer {
      */
     async #adoptActivationEnvironment(task) {
         const admission = admitStoredTaskActivation(this.store, task.id);
-        if (admission.disposition === "absent")
-            return { workspaceFree: false };
         if (admission.disposition !== "ready") {
             throw new Error(`Task activation is not adoptable: ${task.id}/${admission.disposition}`
                 + (admission.disposition === "unavailable" ? ` (${admission.reason})` : "")
@@ -1467,7 +1468,7 @@ export class FileTaskWorkspacePreparer {
             if (round.status !== "pending") {
                 throw new Error(`ReviewRound workspace can only prepare while pending: ${round.id}.`);
             }
-            const taskScope = (round.scope ?? "work-item") === "task";
+            const taskScope = round.scope === "task";
             const item = taskScope || round.workItemId === undefined
                 ? undefined
                 : requireWorkItem(this.store, task.id, round.workItemId);
@@ -1770,7 +1771,7 @@ export class FileTaskWorkspacePreparer {
     async #reassignTaskReviewWorkspace(task, round, reviewer, reviewRoot, frozenEntries) {
         const previous = this.store.listReviewRounds(task.id)
             .filter((candidate) => (candidate.id !== round.id
-            && (candidate.scope ?? "work-item") === "task"
+            && candidate.scope === "task"
             && candidate.reviewerRoleName === round.reviewerRoleName
             && (candidate.status === "completed" || candidate.status === "failed")
             && candidate.workspaceDisposition?.kind !== "removed"
@@ -2128,6 +2129,8 @@ export class FileTaskWorkspacePreparer {
         if (main.owner.type !== "task") {
             throw new Error(`Task main workspace ownership is invalid: ${task.id}.`);
         }
+        if (main.entries.length === 0)
+            return "missing";
         return this.#inspectEntries(task.id, this.#taskSegment(task), MAIN_WORKTREE, main.entries);
     }
     async cleanupTaskForArchive(taskId, disposition = "abandoned") {
@@ -2147,7 +2150,8 @@ export class FileTaskWorkspacePreparer {
         if (main !== null) {
             await this.#assertWorkspaceCleanup(main, disposition);
             assertTaskArchiveState(requireTask(this.store, task.id), task);
-            if (await this.#inspectEntries(task.id, this.#taskSegment(task), MAIN_WORKTREE, main.entries) === "dirty") {
+            // Scratch-only workspaces have no Git entries or Git workspace identity.
+            if (main.entries.length > 0 && await this.#inspectEntries(task.id, this.#taskSegment(task), MAIN_WORKTREE, main.entries) === "dirty") {
                 return {
                     taskId,
                     status: "retained-dirty",
@@ -2228,7 +2232,7 @@ export class FileTaskWorkspacePreparer {
         return integrationWorkspaceRoot(this.home, taskId, integrationId);
     }
     #reviewWorktreeName(round) {
-        return (round.scope ?? "work-item") === "task"
+        return round.scope === "task"
             ? `reviewer-${round.reviewerRoleName}`
             : round.id;
     }

package/dist/repository/workspaceCleanupInspection.js

@@ -1,11 +1,11 @@
-import { dirname, join, relative, isAbsolute } from "node:path";
+import { dirname, isAbsolute, join, relative } from "node:path";
 import { isDeepStrictEqual } from "node:util";
-import { managedWorkspaceKey, managedWorktreeName } from "../worktree/managedWorkspace.js";
-import { WorkItemChangeSetManager } from "../workspace/workItemChangeSetManager.js";
+import { projectTaskRemoteDeliveryFromStore } from "../task/remoteDeliveryService.js";
 import { cleanupCheckFromError } from "../workspace/cleanupInspection.js";
-import { projectTaskRemoteDeliveryFromStore } from "../commands/taskRemoteDeliveryCommand.js";
-import { taskWorkspaceRefSegment } from "./taskWorkspaceIdentity.js";
+import { WorkItemChangeSetManager } from "../workspace/workItemChangeSetManager.js";
+import { managedWorkspaceKey, managedWorktreeName } from "../worktree/managedWorkspace.js";
 import { integrationWorktreeIdentity, worktreeIdentity } from "./gitWorkspace.js";
+import { taskWorkspaceRefSegment } from "./taskWorkspaceIdentity.js";
 /** Current owner facts + the same Git inspection used immediately before removal.
  * No preparation, locks, Git refresh, runtime stop, DB writes or repair.
  */

package/dist/resources/autoResourceGc.js

@@ -10,7 +10,7 @@
  * so every safety guarantee (live-ref re-scan, cleanliness proof, fail-closed
  * sources) applies identically.
  */
-import { applyResourceGc, planResourceGc } from "./resourceGc.js";
+import { applyResourceGc, planResourceGc, readResourceGcState, } from "./resourceGc.js";
 import { resolveResourcesGcAutoQuarantine, resolveResourcesGcMode, resolveResourcesQuarantineTtlHours } from "../config/yuiConfig.js";
 /**
  * Create the Controller's automatic Resource GC hook. The hook self-skips
@@ -25,22 +25,16 @@ export function createResourceAutoGc(options) {
             return { skipped: true, applied: 0, failed: 0, restored: 0 };
         }
         const now = new Date();
-        const projects = store.listProjects();
-        const managedWorkspaces = collectManagedWorkspaces(store);
-        const taskStatusById = collectTaskStatuses(store);
         const input = {
             home,
-            projects,
-            managedWorkspaces,
-            taskStatusById,
+            ...readResourceGcState(store),
             mode: "quarantine",
             now,
             quarantineTtlHours: resolveResourcesQuarantineTtlHours(config.resourcesQuarantineTtlHours),
-            environment,
-            activeWorkspaceOwnerPaths: collectActiveWorkspaceOwnerPaths(store)
+            environment
         };
         const plan = await planResourceGc(input);
-        const result = await applyResourceGc(input, plan);
+        const result = await applyResourceGc(input, plan, store);
         return {
             skipped: false,
             applied: result.applied.length,
@@ -49,70 +43,3 @@ export function createResourceAutoGc(options) {
         };
     };
 }
-/**
- * Run one automatic GC pass. Returns `ran: false` when auto-GC is disabled or
- * the GC mode is not `quarantine`. The pass never purges: permanent deletion
- * is always manual.
- */
-export async function runAutoResourceGc(store, options = {}) {
-    const config = store.getConfig();
-    const autoQuarantine = resolveResourcesGcAutoQuarantine(config.resourcesGcAutoQuarantine);
-    if (!autoQuarantine) {
-        return { ran: false, reason: "auto-quarantine is disabled" };
-    }
-    const gcMode = resolveResourcesGcMode(config.resourcesGcMode);
-    if (gcMode !== "quarantine") {
-        return { ran: false, reason: "resources.gcMode is not quarantine" };
-    }
-    const now = options.now ?? new Date();
-    const home = store.rootDirectory();
-    const projects = store.listProjects();
-    const managedWorkspaces = collectManagedWorkspaces(store);
-    const taskStatusById = collectTaskStatuses(store);
-    const input = {
-        home,
-        projects,
-        managedWorkspaces,
-        taskStatusById,
-        mode: "quarantine",
-        now,
-        quarantineTtlHours: resolveResourcesQuarantineTtlHours(config.resourcesQuarantineTtlHours),
-        activeWorkspaceOwnerPaths: collectActiveWorkspaceOwnerPaths(store)
-    };
-    const plan = await planResourceGc(input);
-    const result = await applyResourceGc(input, plan);
-    return { ran: true, result };
-}
-function collectManagedWorkspaces(store) {
-    const workspaces = [];
-    for (const task of store.listTasks()) {
-        workspaces.push(...store.listManagedWorkspaces(task.id));
-    }
-    return workspaces;
-}
-function collectTaskStatuses(store) {
-    const statuses = new Map();
-    for (const task of store.listTasks()) {
-        statuses.set(task.id, task.status);
-    }
-    return statuses;
-}
-/**
- * Workspace paths claimed by active durable Jobs. An active AgentRun still
- * holds its workspace even after the managed workspace record is gone, so
- * those paths stay protected until the AgentRun finishes.
- */
-function collectActiveWorkspaceOwnerPaths(store) {
-    const paths = [];
-    for (const task of store.listTasks()) {
-        for (const run of store.listRuns(task.id)) {
-            if (run.status !== "active")
-                continue;
-            const workspace = run.workspace;
-            if (workspace === undefined)
-                continue;
-            paths.push(workspace.root, ...workspace.entries.map((entry) => entry.path));
-        }
-    }
-    return paths;
-}

package/dist/resources/liveReferences.js

@@ -112,7 +112,7 @@ export async function scanLiveReferences(input) {
     diagnostics.push(...runtimeClaims.diagnostics);
     const activeReleaseClaims = readActiveReleaseClaims(home);
     diagnostics.push(...activeReleaseClaims.diagnostics);
-    const sessionOwnerClaims = readSessionOwnerClaims(home);
+    const sessionOwnerClaims = readSessionOwnerClaims(input.sessionOwners);
     diagnostics.push(...sessionOwnerClaims.diagnostics);
     for (const claim of [
         ...runtimeClaims.claims,
@@ -231,62 +231,15 @@ function readActiveReleaseClaims(home) {
         });
     }
 }
-/**
- * Read Session owner records (`runtime/session-owners/<pid-startIdentity>.json`). A
- * record whose Provider root is physically alive with a matching start
- * identity protects its runtime root. A dead PID is stale (reconciliation
- * removes those records); an identity conflict or unreadable record fails
- * closed because liveness can no longer be proven.
- */
-function readSessionOwnerClaims(home) {
-    const directory = join(home, "runtime", "session-owners");
-    let entries;
-    try {
-        entries = readdirSync(directory, { withFileTypes: true });
-    }
-    catch (error) {
-        if (error.code === "ENOENT") {
-            return Object.freeze({ claims: Object.freeze([]), diagnostics: Object.freeze([]) });
-        }
-        return Object.freeze({
-            claims: Object.freeze([]),
-            diagnostics: Object.freeze([{
-                    source: "controller",
-                    severity: "error",
-                    message: `session owner records are unreadable: ${error instanceof Error ? error.message : "unknown error"}`
-                }])
-        });
-    }
+/** SQLite supplies durable custody; exact OS generation proves current life.
+ * The same check is used during scanning and under the GC writer fence. */
+export function readSessionOwnerClaims(records) {
     const claims = [];
     const diagnostics = [];
-    for (const entry of entries) {
-        if (!entry.isFile() || !entry.name.endsWith(".json"))
-            continue;
-        const path = join(directory, entry.name);
-        let record;
-        try {
-            record = JSON.parse(readFileSync(path, "utf8"));
-        }
-        catch (error) {
-            diagnostics.push({
-                source: "controller",
-                severity: "error",
-                message: `session owner record is unreadable at ${path}: ${error instanceof Error ? error.message : "unknown error"}`
-            });
-            continue;
-        }
-        const pid = record.providerRoot?.pid;
-        const startIdentity = record.providerRoot?.startIdentity;
-        if (typeof pid !== "number" || pid <= 0 || typeof startIdentity !== "string") {
-            diagnostics.push({
-                source: "controller",
-                severity: "error",
-                message: `session owner record at ${path} has no valid provider root identity`
-            });
-            continue;
-        }
+    for (const record of records) {
+        const { pid, startIdentity } = record.providerRoot;
         if (!isProcessAlive(pid)) {
-            // Dead Provider root: the record is stale; reconciliation removes it.
+            // The normal reconciliation owner releases dead custody records.
             continue;
         }
         const currentIdentity = readLinuxProcessStartIdentity(pid);