harnery 0.42.0 → 0.44.0

package/dist/core/events/v3/support-storage/pack-reader.js

@@ -1,7 +1,9 @@
 import { createHash } from "node:crypto";
-import { constants, createReadStream } from "node:fs";
+import { constants } from "node:fs";
 import { lstat, mkdir, open, realpath, rm, writeFile } from "node:fs/promises";
 import { dirname, isAbsolute, relative, resolve } from "node:path";
+import { Readable } from "node:stream";
+import { finished } from "node:stream/promises";
 import { StringDecoder } from "node:string_decoder";
 import { createGunzip, createInflateRaw } from "node:zlib";
 import { stateDirMode, stateFileMode } from "../../../storage/modes.js";
@@ -44,18 +46,12 @@ async function* streamEventV3SupportPackRecordsForManifest(manifestPath, manifes
             throw new Error("event_v3_support_payload_length_mismatch");
         if (payloadStat.size > bounded.max_payload_bytes)
             throw new Error("event_v3_support_payload_too_large");
-        if ((await hashHandle(payloadPath, payloadHandle)) !== manifest.payload.digest) {
+        if ((await hashHandle(payloadHandle)) !== manifest.payload.digest) {
             throw new Error("event_v3_support_payload_digest_mismatch");
         }
         limits.fault?.("after_payload_digest", payloadPath);
-        await assertCanonicalSingleGzipMember(payloadPath, payloadHandle, payloadStat.size, bounded.max_decompressed_bytes);
+        await assertCanonicalSingleGzipMember(payloadHandle, payloadStat.size, bounded.max_decompressed_bytes);
         const gunzip = createGunzip();
-        const source = createReadStream(payloadPath, {
-            fd: payloadHandle.fd,
-            autoClose: false,
-            start: 0,
-        });
-        source.pipe(gunzip);
         const decoder = new StringDecoder("utf8");
         let pending = "";
         let decompressedBytes = 0;
@@ -64,7 +60,7 @@ async function* streamEventV3SupportPackRecordsForManifest(manifestPath, manifes
         let priorPath;
         const entries = [];
         const seen = new Set();
-        for await (const current of gunzip) {
+        for await (const current of decompressHandle(payloadHandle, 0, gunzip)) {
             const chunk = current;
             decompressedBytes += chunk.length;
             if (decompressedBytes > bounded.max_decompressed_bytes) {
@@ -176,20 +172,51 @@ export async function unpackEventV3SupportPack(manifestPath, destination, limits
         throw error;
     }
 }
-async function hashHandle(path, handle) {
+async function hashHandle(handle) {
     const hash = createHash("sha256");
-    const stream = createReadStream(path, { fd: handle.fd, autoClose: false, start: 0 });
-    for await (const current of stream)
+    for await (const current of handleChunks(handle, 0))
         hash.update(current);
     return `sha256:${hash.digest("hex")}`;
 }
+async function* handleChunks(handle, position) {
+    while (true) {
+        const buffer = Buffer.alloc(64 * 1024);
+        const { bytesRead } = await handle.read(buffer, 0, buffer.length, position);
+        if (bytesRead === 0)
+            return;
+        position += bytesRead;
+        yield buffer.subarray(0, bytesRead);
+    }
+}
+async function* decompressHandle(handle, start, decoder) {
+    const source = Readable.from(handleChunks(handle, start));
+    // Observe failures immediately, then settle source reads before the caller
+    // can close and reuse the verified handle, including on early rejection.
+    const completed = finished(source, { cleanup: true }).then(() => undefined, (error) => error);
+    source.once("error", (error) => decoder.destroy(error));
+    source.pipe(decoder);
+    try {
+        for await (const chunk of decoder)
+            yield chunk;
+        source.unpipe(decoder);
+        source.resume();
+        const error = await completed;
+        if (error)
+            throw error;
+    }
+    finally {
+        source.destroy();
+        decoder.destroy();
+        await completed;
+    }
+}
 async function realDirectory(path) {
     const stat = await lstat(path);
     if (!stat.isDirectory() || stat.isSymbolicLink())
         throw new Error("event_v3_support_pack_root_invalid");
     return realpath(path);
 }
-async function assertCanonicalSingleGzipMember(path, handle, payloadBytes, maximumDecompressedBytes) {
+async function assertCanonicalSingleGzipMember(handle, payloadBytes, maximumDecompressedBytes) {
     if (payloadBytes < 18)
         throw new Error("event_v3_support_gzip_truncated");
     const header = Buffer.alloc(10);
@@ -203,9 +230,8 @@ async function assertCanonicalSingleGzipMember(path, handle, payloadBytes, maxim
         throw new Error("event_v3_support_gzip_header_noncanonical");
     }
     const inflate = createInflateRaw();
-    createReadStream(path, { fd: handle.fd, autoClose: false, start: 10 }).pipe(inflate);
     let decompressed = 0;
-    for await (const current of inflate) {
+    for await (const current of decompressHandle(handle, 10, inflate)) {
         decompressed += current.length;
         if (decompressed > maximumDecompressedBytes) {
             inflate.destroy();

package/dist/core/governor/planning.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"planning.d.ts","sourceRoot":"","sources":["../../../src/core/governor/planning.ts"],"names":[],"mappings":"AAeA,OAAO,EAEL,KAAK,UAAU,EAQhB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAIL,KAAK,mBAAmB,EAUzB,MAAM,iBAAiB,CAAC;AACzB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAYjD,MAAM,WAAW,uBAAuB;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,cAAc,CAAC;IACvB,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,WAAW,GAAG,OAAO,GAAG,aAAa,GAAG,aAAa,CAAC,CAAC;IAChF,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAChC;AAED,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,uBAAuB,GAC7B,OAAO,CAAC,mBAAmB,CAAC,CAsM9B;AAkMD,wBAAgB,yBAAyB,CAAC,KAAK,EAAE;IAC/C,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,cAAc,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GAAG,mBAAmB,CAkHtB;AAED,wBAAgB,0BAA0B,CAAC,KAAK,EAAE;IAChD,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG,mBAAmB,CAYtB;AAED;;;;;;;;gEAQgE;AAChE,wBAAgB,yBAAyB,CAAC,KAAK,EAAE;IAC/C,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,cAAc,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG,mBAAmB,CAoBtB;AAED,wBAAgB,yBAAyB,CAAC,KAAK,EAAE;IAC/C,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,cAAc,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG,mBAAmB,CA4CtB"}
+{"version":3,"file":"planning.d.ts","sourceRoot":"","sources":["../../../src/core/governor/planning.ts"],"names":[],"mappings":"AAeA,OAAO,EAEL,KAAK,UAAU,EAQhB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAIL,KAAK,mBAAmB,EAUzB,MAAM,iBAAiB,CAAC;AACzB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAYjD,MAAM,WAAW,uBAAuB;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,cAAc,CAAC;IACvB,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,WAAW,GAAG,OAAO,GAAG,aAAa,GAAG,aAAa,CAAC,CAAC;IAChF,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAChC;AAED,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,uBAAuB,GAC7B,OAAO,CAAC,mBAAmB,CAAC,CAkN9B;AAkMD,wBAAgB,yBAAyB,CAAC,KAAK,EAAE;IAC/C,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,cAAc,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GAAG,mBAAmB,CAkHtB;AAED,wBAAgB,0BAA0B,CAAC,KAAK,EAAE;IAChD,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG,mBAAmB,CAYtB;AAED;;;;;;;;gEAQgE;AAChE,wBAAgB,yBAAyB,CAAC,KAAK,EAAE;IAC/C,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,cAAc,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG,mBAAmB,CAoBtB;AAED,wBAAgB,yBAAyB,CAAC,KAAK,EAAE;IAC/C,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,cAAc,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG,mBAAmB,CA4CtB"}

package/dist/core/governor/planning.js

@@ -65,6 +65,7 @@ export async function runGovernorPlanner(input) {
             return recovered;
     }
     let proposalWritten = false;
+    let invalidProposal = false;
     try {
         const reviewRunId = reviewWorkflowRunId(request.id);
         const resumingReview = Boolean(resumable &&
@@ -87,7 +88,16 @@ export async function runGovernorPlanner(input) {
                 concurrency: 1,
                 onLog: input.onLog,
             })).result;
-        const proposal = normalizeProposal(request.id, rawProposal, input.record, history.materialized_work_ids.length, request.trigger ?? "recovery", reviewInput ? persistedProposalTimestamp(reviewInput.candidate) : undefined);
+        let proposal;
+        try {
+            proposal = normalizeProposal(request.id, rawProposal, input.record, history.materialized_work_ids.length, request.trigger ?? "recovery", reviewInput ? persistedProposalTimestamp(reviewInput.candidate) : undefined);
+        }
+        catch (error) {
+            // A fresh invalid proposal can consume a replan without aborting the run.
+            // Corrupt persisted review input still requires investigation.
+            invalidProposal = !reviewInput;
+            throw error;
+        }
         if (policy.review) {
             if (proposal.decision === "attention") {
                 appendPlanEvent(coordRoot, input.record.intent.id, request.id, {
@@ -181,6 +191,9 @@ export async function runGovernorPlanner(input) {
             reason: bounded(error.message, "plan failure", MAX_REASON),
             ...(failureClass ? { class: failureClass } : {}),
         });
+        if (invalidProposal) {
+            return outcome(readGovernorPlan(coordRoot, input.record.intent.id, request.id));
+        }
         throw error;
     }
 }

package/dist/core/governor/service-read.d.ts

@@ -1,7 +1,15 @@
-import type { GovernorServiceConfig, GovernorServiceRuntime, GovernorServiceStatus } from "./service.js";
+import { type ProcessGenerationVerdict } from "../agents/state/proc-start.js";
+import type { GovernorServiceBuild, GovernorServiceConfig, GovernorServiceProcessDependencies, GovernorServiceRuntime, GovernorServiceStatus, GovernorServiceStatusRecord } from "./service.js";
+export declare function currentGovernorServiceBuild(): GovernorServiceBuild;
+export declare function governorServiceBuildStatus(record: GovernorServiceStatusRecord | undefined): Pick<GovernorServiceStatus, "running_build" | "installed_build" | "restart_needed" | "build_status">;
+/** An unknown token or process probe cannot establish a running or stopped owner. */
+export declare function observeGovernorServiceProcess(record: Pick<GovernorServiceStatusRecord, "pid" | "host" | "state" | "start_token"> | undefined, dependencies?: GovernorServiceProcessDependencies): {
+    generation: ProcessGenerationVerdict;
+    liveness: GovernorServiceStatus["liveness"];
+};
 export declare function readGovernorServiceConfig(coordRootRaw: string): GovernorServiceConfig;
 export declare function readGovernorServiceRuntime(coordRootRaw: string): GovernorServiceRuntime | undefined;
-export declare function readGovernorServiceStatus(coordRootRaw: string): GovernorServiceStatus;
+export declare function readGovernorServiceStatus(coordRootRaw: string, dependencies?: GovernorServiceProcessDependencies): GovernorServiceStatus;
 export declare function governorServiceLogPath(coordRoot: string): string;
 export interface GovernorServiceLogReadOptions {
     max_bytes?: number;

package/dist/core/governor/service-read.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service-read.d.ts","sourceRoot":"","sources":["../../../src/core/governor/service-read.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EACV,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EAEtB,MAAM,cAAc,CAAC;AAOtB,wBAAgB,yBAAyB,CAAC,YAAY,EAAE,MAAM,GAAG,qBAAqB,CA0BrF;AAED,wBAAgB,0BAA0B,CACxC,YAAY,EAAE,MAAM,GACnB,sBAAsB,GAAG,SAAS,CAgBpC;AAED,wBAAgB,yBAAyB,CAAC,YAAY,EAAE,MAAM,GAAG,qBAAqB,CAkBrF;AAED,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAahE;AAED,MAAM,WAAW,6BAA6B;IAC5C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,4BAA4B;IAC3C,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,gBAAgB,EAAE,MAAM,CAAC;IACzB,SAAS,EAAE,OAAO,CAAC;CACpB;AAeD,wFAAwF;AACxF,wBAAgB,uBAAuB,CACrC,YAAY,EAAE,MAAM,EACpB,OAAO,GAAE,6BAAkC,GAC1C,4BAA4B,CA6D9B"}
+{"version":3,"file":"service-read.d.ts","sourceRoot":"","sources":["../../../src/core/governor/service-read.ts"],"names":[],"mappings":"AAKA,OAAO,EACL,KAAK,wBAAwB,EAE9B,MAAM,+BAA+B,CAAC;AAMvC,OAAO,KAAK,EACV,oBAAoB,EACpB,qBAAqB,EACrB,kCAAkC,EAClC,sBAAsB,EACtB,qBAAqB,EACrB,2BAA2B,EAC5B,MAAM,cAAc,CAAC;AAMtB,wBAAgB,2BAA2B,IAAI,oBAAoB,CAqBlE;AAED,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,2BAA2B,GAAG,SAAS,GAC9C,IAAI,CACL,qBAAqB,EACrB,eAAe,GAAG,iBAAiB,GAAG,gBAAgB,GAAG,cAAc,CACxE,CAgCA;AAED,qFAAqF;AACrF,wBAAgB,6BAA6B,CAC3C,MAAM,EAAE,IAAI,CAAC,2BAA2B,EAAE,KAAK,GAAG,MAAM,GAAG,OAAO,GAAG,aAAa,CAAC,GAAG,SAAS,EAC/F,YAAY,GAAE,kCAAuC,GACpD;IAAE,UAAU,EAAE,wBAAwB,CAAC;IAAC,QAAQ,EAAE,qBAAqB,CAAC,UAAU,CAAC,CAAA;CAAE,CA2BvF;AAOD,wBAAgB,yBAAyB,CAAC,YAAY,EAAE,MAAM,GAAG,qBAAqB,CA0BrF;AAED,wBAAgB,0BAA0B,CACxC,YAAY,EAAE,MAAM,GACnB,sBAAsB,GAAG,SAAS,CAgBpC;AAED,wBAAgB,yBAAyB,CACvC,YAAY,EAAE,MAAM,EACpB,YAAY,GAAE,kCAAuC,GACpD,qBAAqB,CA4BvB;AAED,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAahE;AAED,MAAM,WAAW,6BAA6B;IAC5C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,4BAA4B;IAC3C,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,gBAAgB,EAAE,MAAM,CAAC;IACzB,SAAS,EAAE,OAAO,CAAC;CACpB;AAeD,wFAAwF;AACxF,wBAAgB,uBAAuB,CACrC,YAAY,EAAE,MAAM,EACpB,OAAO,GAAE,6BAAkC,GAC1C,4BAA4B,CA6D9B"}

package/dist/core/governor/service-read.js

@@ -3,13 +3,99 @@ import { hostname } from "node:os";
 import { join, resolve } from "node:path";
 import { gunzipSync } from "node:zlib";
 import { coordEnv } from "../../lib/env.js";
+import { verifyProcessGeneration, } from "../agents/state/proc-start.js";
+import { currentHarneryRuntimeBuild } from "../events/v3/runtime-build.js";
 import { createStorageCatalog } from "../storage/catalog.js";
 import { parseLogRecord } from "../storage/jsonl.js";
 import { familyLogDirectory, readSegmentManifest } from "../storage/segments.js";
 const MAX_FILE_BYTES = 512 * 1024;
 const MAX_LOG_RECORDS = 10_000;
 const MAX_GOALS = 100;
-const FOREIGN_STATUS_STALE_MS = 30_000;
+export function currentGovernorServiceBuild() {
+    let version = "unknown";
+    let revision = "unknown";
+    try {
+        const manifest = JSON.parse(readFileSync(new URL("../../../package.json", import.meta.url), "utf8"));
+        if (typeof manifest.version === "string" && manifest.version.length <= 100) {
+            version = manifest.version;
+        }
+    }
+    catch {
+        // Missing package metadata cannot establish that the running build is current.
+    }
+    try {
+        revision = currentHarneryRuntimeBuild();
+    }
+    catch {
+        // Status still reports the unavailable build instead of guessing a match.
+    }
+    return { version, revision };
+}
+export function governorServiceBuildStatus(record) {
+    const installed_build = currentGovernorServiceBuild();
+    const candidate = record?.running_build;
+    const running_build = candidate &&
+        typeof candidate.version === "string" &&
+        candidate.version.length > 0 &&
+        candidate.version.length <= 100 &&
+        typeof candidate.revision === "string" &&
+        candidate.revision.length > 0 &&
+        candidate.revision.length <= 100 &&
+        candidate.version !== "unknown" &&
+        candidate.revision !== "unknown"
+        ? candidate
+        : null;
+    const restart_needed = running_build === null ||
+        installed_build.version === "unknown" ||
+        installed_build.revision === "unknown" ||
+        running_build.version !== installed_build.version ||
+        running_build.revision !== installed_build.revision;
+    return {
+        running_build,
+        installed_build,
+        restart_needed,
+        build_status: running_build === null
+            ? "running build unknown; restart needed"
+            : restart_needed
+                ? "restart needed"
+                : "current",
+    };
+}
+/** An unknown token or process probe cannot establish a running or stopped owner. */
+export function observeGovernorServiceProcess(record, dependencies = {}) {
+    if (!record)
+        return { generation: "unknown", liveness: "stopped" };
+    const generation = record.host === hostname()
+        ? verifyProcessGeneration(record.pid, record.start_token, dependencies.readToken)
+        : "unknown";
+    if (record.host !== hostname())
+        return { generation, liveness: "unknown" };
+    try {
+        const present = (dependencies.probePid ?? probePid)(record.pid);
+        if (!present)
+            return { generation, liveness: "stopped" };
+    }
+    catch (error) {
+        return {
+            generation,
+            liveness: error.code === "ESRCH" ? "stopped" : "unknown",
+        };
+    }
+    return {
+        generation,
+        liveness: generation === "same"
+            ? record.state === "stopped"
+                ? "stopped"
+                : "running"
+            : generation === "different"
+                ? "stopped"
+                : "unknown",
+    };
+}
+function probePid(pid) {
+    process.kill(pid, 0);
+    return true;
+}
 export function readGovernorServiceConfig(coordRootRaw) {
     const coordRoot = resolve(coordRootRaw);
     const config = readBoundedJson(join(serviceDir(coordRoot), "config.json"), "governor service configuration");
@@ -48,7 +134,7 @@ export function readGovernorServiceRuntime(coordRootRaw) {
     }
     return runtime;
 }
-export function readGovernorServiceStatus(coordRootRaw) {
+export function readGovernorServiceStatus(coordRootRaw, dependencies = {}) {
     const coordRoot = resolve(coordRootRaw);
     const record = readStatusRecord(coordRoot);
     let config;
@@ -65,10 +151,19 @@ export function readGovernorServiceStatus(coordRootRaw) {
     catch {
         // Runtime is recoverable and must not make the dashboard unreadable.
     }
-    if (!record)
-        return { running: false, stale: false, config, runtime };
-    const running = statusOwnerIsLive(record);
-    return { running, stale: !running && record.state !== "stopped", record, config, runtime };
+    const observation = observeGovernorServiceProcess(record, dependencies);
+    if (!record && existsSync(join(serviceDir(coordRoot), "status.json"))) {
+        observation.liveness = "unknown";
+    }
+    return {
+        running: observation.liveness === "running" && record?.state !== "stopped",
+        stale: observation.liveness === "stopped" && record !== undefined && record.state !== "stopped",
+        ...observation,
+        ...governorServiceBuildStatus(record),
+        record,
+        config,
+        runtime,
+    };
 }
 export function governorServiceLogPath(coordRoot) {
     const root = resolve(coordRoot);
@@ -346,27 +441,15 @@ function readStatusRecord(coordRoot) {
             !validTimestamp(value.heartbeat_at)) {
             return undefined;
         }
-        return value;
+        return {
+            ...value,
+            start_token: typeof value.start_token === "string" ? value.start_token : undefined,
+        };
     }
     catch {
         return undefined;
     }
 }
-function statusOwnerIsLive(record) {
-    if (record.state === "stopped")
-        return false;
-    if (record.host === hostname()) {
-        try {
-            process.kill(record.pid, 0);
-            return true;
-        }
-        catch (error) {
-            return error.code === "EPERM";
-        }
-    }
-    const age = Date.now() - Date.parse(record.heartbeat_at);
-    return Number.isFinite(age) && age < FOREIGN_STATUS_STALE_MS;
-}
 function readBoundedJson(path, label) {
     if (!existsSync(path))
         throw new Error(`${label} does not exist`);

package/dist/core/governor/service.d.ts

@@ -1,3 +1,4 @@
+import { type ProcessGenerationSignalDependencies, type ProcessGenerationVerdict } from "../agents/state/proc-start.js";
 import { type NormalizedPolicy, type PolicyIsolation } from "../policy/index.js";
 import type { RunWorkItemInput } from "../work/index.js";
 import { type GovernorRunReport, type GovernorStopReason } from "./runner.js";
@@ -50,9 +51,18 @@ export interface GovernorServiceRuntime {
     goals: Record<string, GovernorServiceGoalRuntime>;
 }
 export type GovernorServiceProcessState = "starting" | "running" | "stopping" | "stopped";
+export interface GovernorServiceBuild {
+    version: string;
+    revision: string;
+}
+export interface GovernorServiceProcessDependencies extends ProcessGenerationSignalDependencies {
+    probePid?: (pid: number) => boolean;
+}
 export interface GovernorServiceStatusRecord {
     schema_version: typeof GOVERNOR_SERVICE_STATUS_SCHEMA_VERSION;
     pid: number;
+    start_token?: string;
+    running_build?: GovernorServiceBuild;
     host: string;
     nonce: string;
     state: GovernorServiceProcessState;
@@ -69,6 +79,14 @@ export interface GovernorServiceStatusRecord {
 export interface GovernorServiceStatus {
     running: boolean;
     stale: boolean;
+    generation: ProcessGenerationVerdict;
+    liveness: "running" | "stopped" | "unknown";
+    running_build: GovernorServiceBuild | null;
+    installed_build: GovernorServiceBuild;
+    restart_needed: boolean;
+    build_status: string;
+    signal_sent?: boolean;
+    signal_verdict?: ProcessGenerationVerdict;
     record?: GovernorServiceStatusRecord;
     config?: GovernorServiceConfig;
     runtime?: GovernorServiceRuntime;
@@ -105,9 +123,9 @@ export interface RunGovernorServiceDaemonInput {
 export declare function configureGovernorService(input: ConfigureGovernorServiceInput): GovernorServiceConfig;
 export declare function readGovernorServiceConfig(coordRootRaw: string): GovernorServiceConfig;
 export declare function readGovernorServiceRuntime(coordRootRaw: string): GovernorServiceRuntime | undefined;
-export declare function readGovernorServiceStatus(coordRootRaw: string): GovernorServiceStatus;
+export declare function readGovernorServiceStatus(coordRootRaw: string, dependencies?: GovernorServiceProcessDependencies): GovernorServiceStatus;
 export declare function spawnGovernorService(coordRootRaw: string): Promise<GovernorServiceStatus>;
-export declare function requestGovernorServiceStop(coordRootRaw: string): GovernorServiceStatus;
+export declare function requestGovernorServiceStop(coordRootRaw: string, dependencies?: GovernorServiceProcessDependencies): GovernorServiceStatus;
 export declare function runGovernorServiceSweep(input: RunGovernorServiceSweepInput): Promise<GovernorServiceSweepReport>;
 export declare function runGovernorServiceDaemon(input: RunGovernorServiceDaemonInput): Promise<GovernorServiceStatusRecord>;
 export declare function governorServiceLogPath(coordRoot: string): string;

package/dist/core/governor/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../src/core/governor/service.ts"],"names":[],"mappings":"AAkBA,OAAO,EAAE,KAAK,gBAAgB,EAAmB,KAAK,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAIlG,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,KAAK,iBAAiB,EAAE,KAAK,kBAAkB,EAAe,MAAM,aAAa,CAAC;AAC3F,OAAO,EAAE,KAAK,cAAc,EAAgB,MAAM,YAAY,CAAC;AAE/D,eAAO,MAAM,sCAAsC,EAAG,CAAU,CAAC;AACjE,eAAO,MAAM,uCAAuC,EAAG,CAAU,CAAC;AAClE,eAAO,MAAM,sCAAsC,EAAG,CAAU,CAAC;AAOjE,MAAM,WAAW,2BAA2B;IAC1C,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,iBAAiB,EAAE,OAAO,CAAC;IAC3B,iBAAiB,EAAE,OAAO,CAAC;IAC3B,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,qBAAqB;IACpC,cAAc,EAAE,OAAO,sCAAsC,CAAC;IAC9D,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,gBAAgB,EAAE,MAAM,CAAC;IACzB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,MAAM,EAAE,2BAA2B,CAAC;IACpC,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,6BAA6B;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,MAAM,CAAC,EAAE,OAAO,CAAC,2BAA2B,CAAC,CAAC;CAC/C;AAED,MAAM,MAAM,wBAAwB,GAAG,MAAM,GAAG,SAAS,GAAG,iBAAiB,CAAC;AAE9E,MAAM,WAAW,0BAA0B;IACzC,KAAK,EAAE,wBAAwB,CAAC;IAChC,kBAAkB,EAAE,MAAM,CAAC;IAC3B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,kBAAkB,CAAC;IACtC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,sBAAsB;IACrC,cAAc,EAAE,OAAO,uCAAuC,CAAC;IAC/D,iBAAiB,EAAE,MAAM,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,0BAA0B,CAAC,CAAC;CACnD;AAED,MAAM,MAAM,2BAA2B,GAAG,UAAU,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,CAAC;AAE1F,MAAM,WAAW,2BAA2B;IAC1C,cAAc,EAAE,OAAO,sCAAsC,CAAC;IAC9D,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,2BAA2B,CAAC;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,2BAA2B,CAAC;IACrC,MAAM,CAAC,EAAE,qBAAqB,CAAC;IAC/B,OAAO,CAAC,EAAE,sBAAsB,CAAC;CAClC;AAED,MAAM,WAAW,2BAA2B;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,0BAA0B;IACzC,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,2BAA2B,EAAE,CAAC;CACzC;AAED,MAAM,WAAW,4BAA4B;IAC3C,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,qBAAqB,CAAC;IAC9B,MAAM,CAAC,EAAE,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EAAE,WAAW,GAAG,aAAa,GAAG,aAAa,CAAC,CAAC;IACvF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,cAAc,CAAC;IACjE,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACzD,WAAW,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;CACxC;AAED,MAAM,WAAW,6BAA6B;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EAAE,WAAW,GAAG,aAAa,GAAG,aAAa,CAAC,CAAC;IACtF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAChC;AASD,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,6BAA6B,GACnC,qBAAqB,CAiDvB;AAED,wBAAgB,yBAAyB,CAAC,YAAY,EAAE,MAAM,GAAG,qBAAqB,CAQrF;AAED,wBAAgB,0BAA0B,CACxC,YAAY,EAAE,MAAM,GACnB,sBAAsB,GAAG,SAAS,CAkBpC;AAED,wBAAgB,yBAAyB,CAAC,YAAY,EAAE,MAAM,GAAG,qBAAqB,CAkBrF;AAED,wBAAsB,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAyC/F;AAED,wBAAgB,0BAA0B,CAAC,YAAY,EAAE,MAAM,GAAG,qBAAqB,CAgBtF;AAED,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,4BAA4B,GAClC,OAAO,CAAC,0BAA0B,CAAC,CAwIrC;AAED,wBAAsB,wBAAwB,CAC5C,KAAK,EAAE,6BAA6B,GACnC,OAAO,CAAC,2BAA2B,CAAC,CA6GtC;AAED,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAKhE;AAiPD,wBAAgB,+BAA+B,CAC7C,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,QAAQ,GAAG,QAAQ,CAgBrB"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../src/core/governor/service.ts"],"names":[],"mappings":"AAkBA,OAAO,EACL,KAAK,mCAAmC,EACxC,KAAK,wBAAwB,EAG9B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EAAE,KAAK,gBAAgB,EAAmB,KAAK,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAIlG,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,KAAK,iBAAiB,EAAE,KAAK,kBAAkB,EAAe,MAAM,aAAa,CAAC;AAM3F,OAAO,EAAE,KAAK,cAAc,EAAgB,MAAM,YAAY,CAAC;AAE/D,eAAO,MAAM,sCAAsC,EAAG,CAAU,CAAC;AACjE,eAAO,MAAM,uCAAuC,EAAG,CAAU,CAAC;AAClE,eAAO,MAAM,sCAAsC,EAAG,CAAU,CAAC;AAMjE,MAAM,WAAW,2BAA2B;IAC1C,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,iBAAiB,EAAE,OAAO,CAAC;IAC3B,iBAAiB,EAAE,OAAO,CAAC;IAC3B,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,qBAAqB;IACpC,cAAc,EAAE,OAAO,sCAAsC,CAAC;IAC9D,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,gBAAgB,EAAE,MAAM,CAAC;IACzB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,MAAM,EAAE,2BAA2B,CAAC;IACpC,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,6BAA6B;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,MAAM,CAAC,EAAE,OAAO,CAAC,2BAA2B,CAAC,CAAC;CAC/C;AAED,MAAM,MAAM,wBAAwB,GAAG,MAAM,GAAG,SAAS,GAAG,iBAAiB,CAAC;AAE9E,MAAM,WAAW,0BAA0B;IACzC,KAAK,EAAE,wBAAwB,CAAC;IAChC,kBAAkB,EAAE,MAAM,CAAC;IAC3B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,kBAAkB,CAAC;IACtC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,sBAAsB;IACrC,cAAc,EAAE,OAAO,uCAAuC,CAAC;IAC/D,iBAAiB,EAAE,MAAM,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,0BAA0B,CAAC,CAAC;CACnD;AAED,MAAM,MAAM,2BAA2B,GAAG,UAAU,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,CAAC;AAE1F,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,kCAAmC,SAAQ,mCAAmC;IAC7F,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;CACrC;AAED,MAAM,WAAW,2BAA2B;IAC1C,cAAc,EAAE,OAAO,sCAAsC,CAAC;IAC9D,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,oBAAoB,CAAC;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,2BAA2B,CAAC;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;IACf,UAAU,EAAE,wBAAwB,CAAC;IACrC,QAAQ,EAAE,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;IAC5C,aAAa,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAC3C,eAAe,EAAE,oBAAoB,CAAC;IACtC,cAAc,EAAE,OAAO,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,cAAc,CAAC,EAAE,wBAAwB,CAAC;IAC1C,MAAM,CAAC,EAAE,2BAA2B,CAAC;IACrC,MAAM,CAAC,EAAE,qBAAqB,CAAC;IAC/B,OAAO,CAAC,EAAE,sBAAsB,CAAC;CAClC;AAED,MAAM,WAAW,2BAA2B;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,0BAA0B;IACzC,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,2BAA2B,EAAE,CAAC;CACzC;AAED,MAAM,WAAW,4BAA4B;IAC3C,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,qBAAqB,CAAC;IAC9B,MAAM,CAAC,EAAE,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EAAE,WAAW,GAAG,aAAa,GAAG,aAAa,CAAC,CAAC;IACvF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,cAAc,CAAC;IACjE,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACzD,WAAW,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;CACxC;AAED,MAAM,WAAW,6BAA6B;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EAAE,WAAW,GAAG,aAAa,GAAG,aAAa,CAAC,CAAC;IACtF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAChC;AAWD,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,6BAA6B,GACnC,qBAAqB,CAqDvB;AAED,wBAAgB,yBAAyB,CAAC,YAAY,EAAE,MAAM,GAAG,qBAAqB,CAQrF;AAED,wBAAgB,0BAA0B,CACxC,YAAY,EAAE,MAAM,GACnB,sBAAsB,GAAG,SAAS,CAkBpC;AAED,wBAAgB,yBAAyB,CACvC,YAAY,EAAE,MAAM,EACpB,YAAY,GAAE,kCAAuC,GACpD,qBAAqB,CA0BvB;AAED,wBAAsB,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAyC/F;AAED,wBAAgB,0BAA0B,CACxC,YAAY,EAAE,MAAM,EACpB,YAAY,GAAE,kCAAuC,GACpD,qBAAqB,CAwBvB;AAED,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,4BAA4B,GAClC,OAAO,CAAC,0BAA0B,CAAC,CAwIrC;AAED,wBAAsB,wBAAwB,CAC5C,KAAK,EAAE,6BAA6B,GACnC,OAAO,CAAC,2BAA2B,CAAC,CAyHtC;AAED,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAKhE;AAwPD,wBAAgB,+BAA+B,CAC7C,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,QAAQ,GAAG,QAAQ,CAgBrB"}

package/dist/core/governor/service.js

@@ -4,11 +4,14 @@ import { chmodSync, closeSync, existsSync, mkdirSync, openSync, readFileSync, re
 import { hostname } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import { coordEnv } from "../../lib/env.js";
+import { processStartToken, signalIfSameGeneration, } from "../agents/state/proc-start.js";
+import { resolveBinName } from "../config.js";
 import { normalizePolicy } from "../policy/index.js";
 import { closeProcessLoggers, legacyLogFields, processLogger } from "../storage/logger.js";
 import { stateDirMode, stateFileMode } from "../storage/modes.js";
 import { RotatingTextSink } from "../storage/process-log.js";
 import { runGovernor } from "./runner.js";
+import { currentGovernorServiceBuild, governorServiceBuildStatus, observeGovernorServiceProcess, } from "./service-read.js";
 import { readGovernor } from "./state.js";
 export const GOVERNOR_SERVICE_CONFIG_SCHEMA_VERSION = 1;
 export const GOVERNOR_SERVICE_RUNTIME_SCHEMA_VERSION = 1;
@@ -16,12 +19,16 @@ export const GOVERNOR_SERVICE_STATUS_SCHEMA_VERSION = 1;
 const MAX_FILE_BYTES = 512 * 1024;
 const MAX_GOALS = 100;
 const MAX_ERROR = 2_000;
-const FOREIGN_STATUS_STALE_MS = 30_000;
 export function configureGovernorService(input) {
     const coordRoot = resolve(input.coordRoot);
     const active = readStatusRecord(coordRoot);
-    if (active && statusOwnerIsLive(active)) {
-        throw new Error(`stop governor service pid ${active.pid} before changing its configuration`);
+    if (!active && existsSync(serviceStatusPath(coordRoot))) {
+        throw serviceStartRefusal(coordRoot, undefined, "unknown");
+    }
+    if (active) {
+        const liveness = statusOwnerIsLive(active);
+        if (liveness !== "stopped")
+            throw serviceStartRefusal(coordRoot, active.pid, liveness);
     }
     const goalIds = unique(input.goalIds.map((value) => value.trim()).filter(Boolean));
     if (goalIds.length < 1 || goalIds.length > MAX_GOALS) {
@@ -73,7 +80,7 @@ export function readGovernorServiceRuntime(coordRootRaw) {
     }
     return runtime;
 }
-export function readGovernorServiceStatus(coordRootRaw) {
+export function readGovernorServiceStatus(coordRootRaw, dependencies = {}) {
     const coordRoot = resolve(coordRootRaw);
     const record = readStatusRecord(coordRoot);
     let config;
@@ -90,17 +97,25 @@ export function readGovernorServiceStatus(coordRootRaw) {
     catch {
         // Status remains readable when recoverable runtime state is corrupt.
     }
-    if (!record)
-        return { running: false, stale: false, config, runtime };
-    const running = statusOwnerIsLive(record);
-    return { running, stale: !running && record.state !== "stopped", record, config, runtime };
+    const observation = observeGovernorServiceProcess(record, dependencies);
+    if (!record && existsSync(serviceStatusPath(coordRoot)))
+        observation.liveness = "unknown";
+    return {
+        running: observation.liveness === "running" && record?.state !== "stopped",
+        stale: observation.liveness === "stopped" && record !== undefined && record.state !== "stopped",
+        ...observation,
+        ...governorServiceBuildStatus(record),
+        record,
+        config,
+        runtime,
+    };
 }
 export async function spawnGovernorService(coordRootRaw) {
     const coordRoot = resolve(coordRootRaw);
     readGovernorServiceConfig(coordRoot);
     const current = readGovernorServiceStatus(coordRoot);
-    if (current.running) {
-        throw new Error(`governor service is already running under pid ${current.record?.pid}`);
+    if (current.liveness !== "stopped") {
+        throw serviceStartRefusal(coordRoot, current.record?.pid, current.liveness);
     }
     mkdirSync(serviceDir(coordRoot), { recursive: true, mode: stateDirMode() });
     const sharedLogs = coordEnv("SHARED_LOGS") !== "0";
@@ -143,24 +158,24 @@ export async function spawnGovernorService(coordRootRaw) {
     }
     throw new Error(`governor service failed to start; inspect ${governorServiceLogPath(coordRoot)}`);
 }
-export function requestGovernorServiceStop(coordRootRaw) {
+export function requestGovernorServiceStop(coordRootRaw, dependencies = {}) {
     const coordRoot = resolve(coordRootRaw);
-    const status = readGovernorServiceStatus(coordRoot);
-    if (!status.running || !status.record)
-        return status;
+    const status = readGovernorServiceStatus(coordRoot, dependencies);
+    if ((status.record?.state === "stopped" || !status.record) && status.liveness === "stopped") {
+        return { ...status, signal_sent: false, signal_verdict: status.generation };
+    }
     writePrivateJsonAtomic(serviceStopPath(coordRoot), {
         requested_at: new Date().toISOString(),
         requested_by_pid: process.pid,
     });
-    if (status.record.host === hostname()) {
-        try {
-            process.kill(status.record.pid, "SIGTERM");
-        }
-        catch {
-            // The durable stop request remains for a racing or restarted daemon.
-        }
-    }
-    return readGovernorServiceStatus(coordRoot);
+    const signal = status.record?.host === hostname() && status.record.state !== "stopped"
+        ? signalIfSameGeneration(status.record.pid, status.record.start_token, "SIGTERM", dependencies)
+        : { sent: false, verdict: status.generation };
+    return {
+        ...readGovernorServiceStatus(coordRoot, dependencies),
+        signal_sent: signal.sent,
+        signal_verdict: signal.verdict,
+    };
 }
 export async function runGovernorServiceSweep(input) {
     const coordRoot = resolve(input.coordRoot);
@@ -298,12 +313,23 @@ export async function runGovernorServiceSweep(input) {
 export async function runGovernorServiceDaemon(input) {
     const coordRoot = resolve(input.coordRoot);
     const config = readGovernorServiceConfig(coordRoot);
+    const existing = readStatusRecord(coordRoot);
+    if (!existing && existsSync(serviceStatusPath(coordRoot))) {
+        throw serviceStartRefusal(coordRoot, undefined, "unknown");
+    }
+    if (existing) {
+        const liveness = statusOwnerIsLive(existing);
+        if (liveness !== "stopped")
+            throw serviceStartRefusal(coordRoot, existing.pid, liveness);
+    }
     const release = acquireServiceLease(coordRoot);
     rmSync(serviceStopPath(coordRoot), { force: true });
     const now = new Date().toISOString();
     const status = {
         schema_version: GOVERNOR_SERVICE_STATUS_SCHEMA_VERSION,
         pid: process.pid,
+        start_token: processStartToken(process.pid) ?? undefined,
+        running_build: currentGovernorServiceBuild(),
         host: hostname(),
         nonce: randomUUID(),
         state: "starting",
@@ -330,6 +356,8 @@ export async function runGovernorServiceDaemon(input) {
     appendGovernorServiceDiagnostic(coordRoot, {
         event: "service.started",
         pid: process.pid,
+        start_token: status.start_token,
+        running_build: status.running_build,
         goals: config.goal_ids,
         config_created_at: config.created_at,
     });
@@ -514,6 +542,8 @@ function acquireServiceLease(coordRoot) {
     mkdirSync(dirname(path), { recursive: true, mode: stateDirMode() });
     const owner = {
         pid: process.pid,
+        start_token: processStartToken(process.pid) ?? undefined,
+        running_build: currentGovernorServiceBuild(),
         host: hostname(),
         nonce: randomUUID(),
         created_at: new Date().toISOString(),
@@ -537,8 +567,9 @@ function acquireServiceLease(coordRoot) {
     };
     if (!acquire()) {
         const existing = readLease(path);
-        if (existing && leaseOwnerIsLive(existing)) {
-            throw new Error(`governor service is already running under pid ${existing.pid}`);
+        const liveness = existing ? leaseOwnerIsLive(existing) : "unknown";
+        if (liveness !== "stopped") {
+            throw serviceStartRefusal(coordRoot, existing?.pid, liveness);
         }
         unlinkSync(path);
         if (!acquire())
@@ -563,7 +594,10 @@ function readLease(path) {
             typeof value.host === "string" &&
             typeof value.nonce === "string" &&
             typeof value.created_at === "string"
-            ? value
+            ? {
+                ...value,
+                start_token: typeof value.start_token === "string" ? value.start_token : undefined,
+            }
             : null;
     }
     catch {
@@ -571,11 +605,7 @@ function readLease(path) {
     }
 }
 function leaseOwnerIsLive(lease) {
-    if (lease.host !== hostname()) {
-        const age = Date.now() - Date.parse(lease.created_at);
-        return Number.isFinite(age) && age < FOREIGN_STATUS_STALE_MS;
-    }
-    return pidAlive(lease.pid);
+    return observeGovernorServiceProcess({ ...lease, state: "running" }).liveness;
 }
 function readStatusRecord(coordRoot) {
     if (!existsSync(serviceStatusPath(coordRoot)))
@@ -591,28 +621,23 @@ function readStatusRecord(coordRoot) {
             !validTimestamp(value.heartbeat_at)) {
             return undefined;
         }
-        return value;
+        return {
+            ...value,
+            start_token: typeof value.start_token === "string" ? value.start_token : undefined,
+        };
     }
     catch {
         return undefined;
     }
 }
 function statusOwnerIsLive(record) {
-    if (record.state === "stopped")
-        return false;
-    if (record.host === hostname())
-        return pidAlive(record.pid);
-    const age = Date.now() - Date.parse(record.heartbeat_at);
-    return Number.isFinite(age) && age < FOREIGN_STATUS_STALE_MS;
-}
-function pidAlive(pid) {
-    try {
-        process.kill(pid, 0);
-        return true;
-    }
-    catch (error) {
-        return error.code === "EPERM";
-    }
+    return observeGovernorServiceProcess(record).liveness;
+}
+function serviceStartRefusal(coordRoot, pid, liveness) {
+    const reason = liveness === "unknown"
+        ? `governor service process generation is unknown${pid ? ` for pid ${pid}` : ""}`
+        : `governor service process is still running under pid ${pid}`;
+    return new Error(`${reason}; run \`${resolveBinName(coordRoot)} governor service stop\` to write a durable stop request before starting or reconfiguring it`);
 }
 export function appendGovernorServiceDiagnostic(coordRoot, data) {
     if (coordEnv("SHARED_LOGS") !== "0") {