harnery 0.42.0 → 0.44.0

package/src/core/events/v3/support-storage/pack-reader.ts

@@ -1,7 +1,9 @@
 import { createHash } from "node:crypto";
-import { constants, createReadStream } from "node:fs";
+import { constants } from "node:fs";
 import { lstat, mkdir, open, realpath, rm, writeFile } from "node:fs/promises";
 import { dirname, isAbsolute, relative, resolve } from "node:path";
+import { Readable } from "node:stream";
+import { finished } from "node:stream/promises";
 import { StringDecoder } from "node:string_decoder";
 import { createGunzip, createInflateRaw } from "node:zlib";
 import { stateDirMode, stateFileMode } from "../../../storage/modes.ts";
@@ -89,24 +91,17 @@ async function* streamEventV3SupportPackRecordsForManifest(
       throw new Error("event_v3_support_payload_length_mismatch");
     if (payloadStat.size > bounded.max_payload_bytes)
       throw new Error("event_v3_support_payload_too_large");
-    if ((await hashHandle(payloadPath, payloadHandle)) !== manifest.payload.digest) {
+    if ((await hashHandle(payloadHandle)) !== manifest.payload.digest) {
       throw new Error("event_v3_support_payload_digest_mismatch");
     }
     limits.fault?.("after_payload_digest", payloadPath);
     await assertCanonicalSingleGzipMember(
-      payloadPath,
       payloadHandle,
       payloadStat.size,
       bounded.max_decompressed_bytes,
     );
 
     const gunzip = createGunzip();
-    const source = createReadStream(payloadPath, {
-      fd: payloadHandle.fd,
-      autoClose: false,
-      start: 0,
-    });
-    source.pipe(gunzip);
     const decoder = new StringDecoder("utf8");
     let pending = "";
     let decompressedBytes = 0;
@@ -116,7 +111,7 @@ async function* streamEventV3SupportPackRecordsForManifest(
     const entries: EventV3LogicalAuthorityEntry[] = [];
     const seen = new Set<string>();
 
-    for await (const current of gunzip) {
+    for await (const current of decompressHandle(payloadHandle, 0, gunzip)) {
       const chunk = current as Buffer;
       decompressedBytes += chunk.length;
       if (decompressedBytes > bounded.max_decompressed_bytes) {
@@ -247,16 +242,49 @@ export async function unpackEventV3SupportPack(
   }
 }
 
-async function hashHandle(
-  path: string,
-  handle: Awaited<ReturnType<typeof open>>,
-): Promise<`sha256:${string}`> {
+async function hashHandle(handle: Awaited<ReturnType<typeof open>>): Promise<`sha256:${string}`> {
   const hash = createHash("sha256");
-  const stream = createReadStream(path, { fd: handle.fd, autoClose: false, start: 0 });
-  for await (const current of stream) hash.update(current as Buffer);
+  for await (const current of handleChunks(handle, 0)) hash.update(current);
   return `sha256:${hash.digest("hex")}`;
 }
 
+async function* handleChunks(handle: Awaited<ReturnType<typeof open>>, position: number) {
+  while (true) {
+    const buffer = Buffer.alloc(64 * 1024);
+    const { bytesRead } = await handle.read(buffer, 0, buffer.length, position);
+    if (bytesRead === 0) return;
+    position += bytesRead;
+    yield buffer.subarray(0, bytesRead);
+  }
+}
+
+async function* decompressHandle(
+  handle: Awaited<ReturnType<typeof open>>,
+  start: number,
+  decoder: ReturnType<typeof createGunzip>,
+): AsyncGenerator<Buffer> {
+  const source = Readable.from(handleChunks(handle, start));
+  // Observe failures immediately, then settle source reads before the caller
+  // can close and reuse the verified handle, including on early rejection.
+  const completed = finished(source, { cleanup: true }).then(
+    () => undefined,
+    (error: unknown) => error,
+  );
+  source.once("error", (error) => decoder.destroy(error));
+  source.pipe(decoder);
+  try {
+    for await (const chunk of decoder) yield chunk as Buffer;
+    source.unpipe(decoder);
+    source.resume();
+    const error = await completed;
+    if (error) throw error;
+  } finally {
+    source.destroy();
+    decoder.destroy();
+    await completed;
+  }
+}
+
 async function realDirectory(path: string): Promise<string> {
   const stat = await lstat(path);
   if (!stat.isDirectory() || stat.isSymbolicLink())
@@ -265,7 +293,6 @@ async function realDirectory(path: string): Promise<string> {
 }
 
 async function assertCanonicalSingleGzipMember(
-  path: string,
   handle: Awaited<ReturnType<typeof open>>,
   payloadBytes: number,
   maximumDecompressedBytes: number,
@@ -284,9 +311,8 @@ async function assertCanonicalSingleGzipMember(
     throw new Error("event_v3_support_gzip_header_noncanonical");
   }
   const inflate = createInflateRaw();
-  createReadStream(path, { fd: handle.fd, autoClose: false, start: 10 }).pipe(inflate);
   let decompressed = 0;
-  for await (const current of inflate) {
+  for await (const current of decompressHandle(handle, 10, inflate)) {
     decompressed += (current as Buffer).length;
     if (decompressed > maximumDecompressedBytes) {
       inflate.destroy();

package/src/core/governor/planning.ts

@@ -124,6 +124,7 @@ export async function runGovernorPlanner(
     if (recovered) return recovered;
   }
   let proposalWritten = false;
+  let invalidProposal = false;
   try {
     const reviewRunId = reviewWorkflowRunId(request.id);
     const resumingReview = Boolean(
@@ -153,14 +154,22 @@ export async function runGovernorPlanner(
             onLog: input.onLog,
           })
         ).result;
-    const proposal = normalizeProposal(
-      request.id,
-      rawProposal,
-      input.record,
-      history.materialized_work_ids.length,
-      request.trigger ?? "recovery",
-      reviewInput ? persistedProposalTimestamp(reviewInput.candidate) : undefined,
-    );
+    let proposal: GovernorPlanProposal;
+    try {
+      proposal = normalizeProposal(
+        request.id,
+        rawProposal,
+        input.record,
+        history.materialized_work_ids.length,
+        request.trigger ?? "recovery",
+        reviewInput ? persistedProposalTimestamp(reviewInput.candidate) : undefined,
+      );
+    } catch (error) {
+      // A fresh invalid proposal can consume a replan without aborting the run.
+      // Corrupt persisted review input still requires investigation.
+      invalidProposal = !reviewInput;
+      throw error;
+    }
     if (policy.review) {
       if (proposal.decision === "attention") {
         appendPlanEvent(coordRoot, input.record.intent.id, request.id, {
@@ -258,6 +267,9 @@ export async function runGovernorPlanner(
       reason: bounded((error as Error).message, "plan failure", MAX_REASON),
       ...(failureClass ? { class: failureClass } : {}),
     });
+    if (invalidProposal) {
+      return outcome(readGovernorPlan(coordRoot, input.record.intent.id, request.id));
+    }
     throw error;
   }
 }

package/src/core/governor/service-read.ts

@@ -3,12 +3,19 @@ import { hostname } from "node:os";
 import { join, resolve } from "node:path";
 import { gunzipSync } from "node:zlib";
 import { coordEnv } from "../../lib/env.ts";
+import {
+  type ProcessGenerationVerdict,
+  verifyProcessGeneration,
+} from "../agents/state/proc-start.ts";
+import { currentHarneryRuntimeBuild } from "../events/v3/runtime-build.ts";
 import { createStorageCatalog } from "../storage/catalog.ts";
 import type { HarneryLogRecordV1 } from "../storage/jsonl.ts";
 import { parseLogRecord } from "../storage/jsonl.ts";
 import { familyLogDirectory, readSegmentManifest } from "../storage/segments.ts";
 import type {
+  GovernorServiceBuild,
   GovernorServiceConfig,
+  GovernorServiceProcessDependencies,
   GovernorServiceRuntime,
   GovernorServiceStatus,
   GovernorServiceStatusRecord,
@@ -17,7 +24,106 @@ import type {
 const MAX_FILE_BYTES = 512 * 1024;
 const MAX_LOG_RECORDS = 10_000;
 const MAX_GOALS = 100;
-const FOREIGN_STATUS_STALE_MS = 30_000;
+
+export function currentGovernorServiceBuild(): GovernorServiceBuild {
+  let version = "unknown";
+  let revision = "unknown";
+  try {
+    const manifest = JSON.parse(
+      readFileSync(new URL("../../../package.json", import.meta.url), "utf8"),
+    ) as {
+      version?: unknown;
+    };
+    if (typeof manifest.version === "string" && manifest.version.length <= 100) {
+      version = manifest.version;
+    }
+  } catch {
+    // Missing package metadata cannot establish that the running build is current.
+  }
+  try {
+    revision = currentHarneryRuntimeBuild();
+  } catch {
+    // Status still reports the unavailable build instead of guessing a match.
+  }
+  return { version, revision };
+}
+
+export function governorServiceBuildStatus(
+  record: GovernorServiceStatusRecord | undefined,
+): Pick<
+  GovernorServiceStatus,
+  "running_build" | "installed_build" | "restart_needed" | "build_status"
+> {
+  const installed_build = currentGovernorServiceBuild();
+  const candidate = record?.running_build;
+  const running_build =
+    candidate &&
+    typeof candidate.version === "string" &&
+    candidate.version.length > 0 &&
+    candidate.version.length <= 100 &&
+    typeof candidate.revision === "string" &&
+    candidate.revision.length > 0 &&
+    candidate.revision.length <= 100 &&
+    candidate.version !== "unknown" &&
+    candidate.revision !== "unknown"
+      ? candidate
+      : null;
+  const restart_needed =
+    running_build === null ||
+    installed_build.version === "unknown" ||
+    installed_build.revision === "unknown" ||
+    running_build.version !== installed_build.version ||
+    running_build.revision !== installed_build.revision;
+  return {
+    running_build,
+    installed_build,
+    restart_needed,
+    build_status:
+      running_build === null
+        ? "running build unknown; restart needed"
+        : restart_needed
+          ? "restart needed"
+          : "current",
+  };
+}
+
+/** An unknown token or process probe cannot establish a running or stopped owner. */
+export function observeGovernorServiceProcess(
+  record: Pick<GovernorServiceStatusRecord, "pid" | "host" | "state" | "start_token"> | undefined,
+  dependencies: GovernorServiceProcessDependencies = {},
+): { generation: ProcessGenerationVerdict; liveness: GovernorServiceStatus["liveness"] } {
+  if (!record) return { generation: "unknown", liveness: "stopped" };
+  const generation =
+    record.host === hostname()
+      ? verifyProcessGeneration(record.pid, record.start_token, dependencies.readToken)
+      : "unknown";
+  if (record.host !== hostname()) return { generation, liveness: "unknown" };
+  try {
+    const present = (dependencies.probePid ?? probePid)(record.pid);
+    if (!present) return { generation, liveness: "stopped" };
+  } catch (error) {
+    return {
+      generation,
+      liveness: (error as NodeJS.ErrnoException).code === "ESRCH" ? "stopped" : "unknown",
+    };
+  }
+  return {
+    generation,
+    liveness:
+      generation === "same"
+        ? record.state === "stopped"
+          ? "stopped"
+          : "running"
+        : generation === "different"
+          ? "stopped"
+          : "unknown",
+  };
+}
+
+function probePid(pid: number): boolean {
+  process.kill(pid, 0);
+  return true;
+}
 
 export function readGovernorServiceConfig(coordRootRaw: string): GovernorServiceConfig {
   const coordRoot = resolve(coordRootRaw);
@@ -67,7 +173,10 @@ export function readGovernorServiceRuntime(
   return runtime;
 }
 
-export function readGovernorServiceStatus(coordRootRaw: string): GovernorServiceStatus {
+export function readGovernorServiceStatus(
+  coordRootRaw: string,
+  dependencies: GovernorServiceProcessDependencies = {},
+): GovernorServiceStatus {
   const coordRoot = resolve(coordRootRaw);
   const record = readStatusRecord(coordRoot);
   let config: GovernorServiceConfig | undefined;
@@ -82,9 +191,19 @@ export function readGovernorServiceStatus(coordRootRaw: string): GovernorService
   } catch {
     // Runtime is recoverable and must not make the dashboard unreadable.
   }
-  if (!record) return { running: false, stale: false, config, runtime };
-  const running = statusOwnerIsLive(record);
-  return { running, stale: !running && record.state !== "stopped", record, config, runtime };
+  const observation = observeGovernorServiceProcess(record, dependencies);
+  if (!record && existsSync(join(serviceDir(coordRoot), "status.json"))) {
+    observation.liveness = "unknown";
+  }
+  return {
+    running: observation.liveness === "running" && record?.state !== "stopped",
+    stale: observation.liveness === "stopped" && record !== undefined && record.state !== "stopped",
+    ...observation,
+    ...governorServiceBuildStatus(record),
+    record,
+    config,
+    runtime,
+  };
 }
 
 export function governorServiceLogPath(coordRoot: string): string {
@@ -418,26 +537,15 @@ function readStatusRecord(coordRoot: string): GovernorServiceStatusRecord | unde
     ) {
       return undefined;
     }
-    return value;
+    return {
+      ...value,
+      start_token: typeof value.start_token === "string" ? value.start_token : undefined,
+    };
   } catch {
     return undefined;
   }
 }
 
-function statusOwnerIsLive(record: GovernorServiceStatusRecord): boolean {
-  if (record.state === "stopped") return false;
-  if (record.host === hostname()) {
-    try {
-      process.kill(record.pid, 0);
-      return true;
-    } catch (error) {
-      return (error as NodeJS.ErrnoException).code === "EPERM";
-    }
-  }
-  const age = Date.now() - Date.parse(record.heartbeat_at);
-  return Number.isFinite(age) && age < FOREIGN_STATUS_STALE_MS;
-}
-
 function readBoundedJson<T>(path: string, label: string): T {
   if (!existsSync(path)) throw new Error(`${label} does not exist`);
   const size = statSync(path).size;

package/src/core/governor/service.ts

@@ -16,12 +16,24 @@ import {
 import { hostname } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import { coordEnv } from "../../lib/env.ts";
+import {
+  type ProcessGenerationSignalDependencies,
+  type ProcessGenerationVerdict,
+  processStartToken,
+  signalIfSameGeneration,
+} from "../agents/state/proc-start.ts";
+import { resolveBinName } from "../config.ts";
 import { type NormalizedPolicy, normalizePolicy, type PolicyIsolation } from "../policy/index.ts";
 import { closeProcessLoggers, legacyLogFields, processLogger } from "../storage/logger.ts";
 import { stateDirMode, stateFileMode } from "../storage/modes.ts";
 import { RotatingTextSink } from "../storage/process-log.ts";
 import type { RunWorkItemInput } from "../work/index.ts";
 import { type GovernorRunReport, type GovernorStopReason, runGovernor } from "./runner.ts";
+import {
+  currentGovernorServiceBuild,
+  governorServiceBuildStatus,
+  observeGovernorServiceProcess,
+} from "./service-read.ts";
 import { type GovernorRecord, readGovernor } from "./state.ts";
 
 export const GOVERNOR_SERVICE_CONFIG_SCHEMA_VERSION = 1 as const;
@@ -31,7 +43,6 @@ export const GOVERNOR_SERVICE_STATUS_SCHEMA_VERSION = 1 as const;
 const MAX_FILE_BYTES = 512 * 1024;
 const MAX_GOALS = 100;
 const MAX_ERROR = 2_000;
-const FOREIGN_STATUS_STALE_MS = 30_000;
 
 export interface GovernorServiceEngineConfig {
   default_adapter?: string;
@@ -85,9 +96,20 @@ export interface GovernorServiceRuntime {
 
 export type GovernorServiceProcessState = "starting" | "running" | "stopping" | "stopped";
 
+export interface GovernorServiceBuild {
+  version: string;
+  revision: string;
+}
+
+export interface GovernorServiceProcessDependencies extends ProcessGenerationSignalDependencies {
+  probePid?: (pid: number) => boolean;
+}
+
 export interface GovernorServiceStatusRecord {
   schema_version: typeof GOVERNOR_SERVICE_STATUS_SCHEMA_VERSION;
   pid: number;
+  start_token?: string;
+  running_build?: GovernorServiceBuild;
   host: string;
   nonce: string;
   state: GovernorServiceProcessState;
@@ -105,6 +127,14 @@ export interface GovernorServiceStatusRecord {
 export interface GovernorServiceStatus {
   running: boolean;
   stale: boolean;
+  generation: ProcessGenerationVerdict;
+  liveness: "running" | "stopped" | "unknown";
+  running_build: GovernorServiceBuild | null;
+  installed_build: GovernorServiceBuild;
+  restart_needed: boolean;
+  build_status: string;
+  signal_sent?: boolean;
+  signal_verdict?: ProcessGenerationVerdict;
   record?: GovernorServiceStatusRecord;
   config?: GovernorServiceConfig;
   runtime?: GovernorServiceRuntime;
@@ -145,6 +175,8 @@ export interface RunGovernorServiceDaemonInput {
 
 interface ServiceLease {
   pid: number;
+  start_token?: string;
+  running_build?: GovernorServiceBuild;
   host: string;
   nonce: string;
   created_at: string;
@@ -155,8 +187,12 @@ export function configureGovernorService(
 ): GovernorServiceConfig {
   const coordRoot = resolve(input.coordRoot);
   const active = readStatusRecord(coordRoot);
-  if (active && statusOwnerIsLive(active)) {
-    throw new Error(`stop governor service pid ${active.pid} before changing its configuration`);
+  if (!active && existsSync(serviceStatusPath(coordRoot))) {
+    throw serviceStartRefusal(coordRoot, undefined, "unknown");
+  }
+  if (active) {
+    const liveness = statusOwnerIsLive(active);
+    if (liveness !== "stopped") throw serviceStartRefusal(coordRoot, active.pid, liveness);
   }
   const goalIds = unique(input.goalIds.map((value) => value.trim()).filter(Boolean));
   if (goalIds.length < 1 || goalIds.length > MAX_GOALS) {
@@ -235,7 +271,10 @@ export function readGovernorServiceRuntime(
   return runtime;
 }
 
-export function readGovernorServiceStatus(coordRootRaw: string): GovernorServiceStatus {
+export function readGovernorServiceStatus(
+  coordRootRaw: string,
+  dependencies: GovernorServiceProcessDependencies = {},
+): GovernorServiceStatus {
   const coordRoot = resolve(coordRootRaw);
   const record = readStatusRecord(coordRoot);
   let config: GovernorServiceConfig | undefined;
@@ -250,17 +289,25 @@ export function readGovernorServiceStatus(coordRootRaw: string): GovernorService
   } catch {
     // Status remains readable when recoverable runtime state is corrupt.
   }
-  if (!record) return { running: false, stale: false, config, runtime };
-  const running = statusOwnerIsLive(record);
-  return { running, stale: !running && record.state !== "stopped", record, config, runtime };
+  const observation = observeGovernorServiceProcess(record, dependencies);
+  if (!record && existsSync(serviceStatusPath(coordRoot))) observation.liveness = "unknown";
+  return {
+    running: observation.liveness === "running" && record?.state !== "stopped",
+    stale: observation.liveness === "stopped" && record !== undefined && record.state !== "stopped",
+    ...observation,
+    ...governorServiceBuildStatus(record),
+    record,
+    config,
+    runtime,
+  };
 }
 
 export async function spawnGovernorService(coordRootRaw: string): Promise<GovernorServiceStatus> {
   const coordRoot = resolve(coordRootRaw);
   readGovernorServiceConfig(coordRoot);
   const current = readGovernorServiceStatus(coordRoot);
-  if (current.running) {
-    throw new Error(`governor service is already running under pid ${current.record?.pid}`);
+  if (current.liveness !== "stopped") {
+    throw serviceStartRefusal(coordRoot, current.record?.pid, current.liveness);
   }
   mkdirSync(serviceDir(coordRoot), { recursive: true, mode: stateDirMode() });
   const sharedLogs = coordEnv("SHARED_LOGS") !== "0";
@@ -298,22 +345,33 @@ export async function spawnGovernorService(coordRootRaw: string): Promise<Govern
   throw new Error(`governor service failed to start; inspect ${governorServiceLogPath(coordRoot)}`);
 }
 
-export function requestGovernorServiceStop(coordRootRaw: string): GovernorServiceStatus {
+export function requestGovernorServiceStop(
+  coordRootRaw: string,
+  dependencies: GovernorServiceProcessDependencies = {},
+): GovernorServiceStatus {
   const coordRoot = resolve(coordRootRaw);
-  const status = readGovernorServiceStatus(coordRoot);
-  if (!status.running || !status.record) return status;
+  const status = readGovernorServiceStatus(coordRoot, dependencies);
+  if ((status.record?.state === "stopped" || !status.record) && status.liveness === "stopped") {
+    return { ...status, signal_sent: false, signal_verdict: status.generation };
+  }
   writePrivateJsonAtomic(serviceStopPath(coordRoot), {
     requested_at: new Date().toISOString(),
     requested_by_pid: process.pid,
   });
-  if (status.record.host === hostname()) {
-    try {
-      process.kill(status.record.pid, "SIGTERM");
-    } catch {
-      // The durable stop request remains for a racing or restarted daemon.
-    }
-  }
-  return readGovernorServiceStatus(coordRoot);
+  const signal =
+    status.record?.host === hostname() && status.record.state !== "stopped"
+      ? signalIfSameGeneration(
+          status.record.pid,
+          status.record.start_token,
+          "SIGTERM",
+          dependencies,
+        )
+      : { sent: false, verdict: status.generation };
+  return {
+    ...readGovernorServiceStatus(coordRoot, dependencies),
+    signal_sent: signal.sent,
+    signal_verdict: signal.verdict,
+  };
 }
 
 export async function runGovernorServiceSweep(
@@ -461,12 +519,22 @@ export async function runGovernorServiceDaemon(
 ): Promise<GovernorServiceStatusRecord> {
   const coordRoot = resolve(input.coordRoot);
   const config = readGovernorServiceConfig(coordRoot);
+  const existing = readStatusRecord(coordRoot);
+  if (!existing && existsSync(serviceStatusPath(coordRoot))) {
+    throw serviceStartRefusal(coordRoot, undefined, "unknown");
+  }
+  if (existing) {
+    const liveness = statusOwnerIsLive(existing);
+    if (liveness !== "stopped") throw serviceStartRefusal(coordRoot, existing.pid, liveness);
+  }
   const release = acquireServiceLease(coordRoot);
   rmSync(serviceStopPath(coordRoot), { force: true });
   const now = new Date().toISOString();
   const status: GovernorServiceStatusRecord = {
     schema_version: GOVERNOR_SERVICE_STATUS_SCHEMA_VERSION,
     pid: process.pid,
+    start_token: processStartToken(process.pid) ?? undefined,
+    running_build: currentGovernorServiceBuild(),
     host: hostname(),
     nonce: randomUUID(),
     state: "starting",
@@ -493,6 +561,8 @@ export async function runGovernorServiceDaemon(
   appendGovernorServiceDiagnostic(coordRoot, {
     event: "service.started",
     pid: process.pid,
+    start_token: status.start_token,
+    running_build: status.running_build,
     goals: config.goal_ids,
     config_created_at: config.created_at,
   });
@@ -716,6 +786,8 @@ function acquireServiceLease(coordRoot: string): () => void {
   mkdirSync(dirname(path), { recursive: true, mode: stateDirMode() });
   const owner: ServiceLease = {
     pid: process.pid,
+    start_token: processStartToken(process.pid) ?? undefined,
+    running_build: currentGovernorServiceBuild(),
     host: hostname(),
     nonce: randomUUID(),
     created_at: new Date().toISOString(),
@@ -736,8 +808,9 @@ function acquireServiceLease(coordRoot: string): () => void {
   };
   if (!acquire()) {
     const existing = readLease(path);
-    if (existing && leaseOwnerIsLive(existing)) {
-      throw new Error(`governor service is already running under pid ${existing.pid}`);
+    const liveness = existing ? leaseOwnerIsLive(existing) : "unknown";
+    if (liveness !== "stopped") {
+      throw serviceStartRefusal(coordRoot, existing?.pid, liveness);
     }
     unlinkSync(path);
     if (!acquire()) throw new Error("governor service lease raced with another process");
@@ -760,19 +833,18 @@ function readLease(path: string): ServiceLease | null {
       typeof value.host === "string" &&
       typeof value.nonce === "string" &&
       typeof value.created_at === "string"
-      ? (value as ServiceLease)
+      ? ({
+          ...value,
+          start_token: typeof value.start_token === "string" ? value.start_token : undefined,
+        } as ServiceLease)
       : null;
   } catch {
     return null;
   }
 }
 
-function leaseOwnerIsLive(lease: ServiceLease): boolean {
-  if (lease.host !== hostname()) {
-    const age = Date.now() - Date.parse(lease.created_at);
-    return Number.isFinite(age) && age < FOREIGN_STATUS_STALE_MS;
-  }
-  return pidAlive(lease.pid);
+function leaseOwnerIsLive(lease: ServiceLease): GovernorServiceStatus["liveness"] {
+  return observeGovernorServiceProcess({ ...lease, state: "running" }).liveness;
 }
 
 function readStatusRecord(coordRoot: string): GovernorServiceStatusRecord | undefined {
@@ -793,26 +865,31 @@ function readStatusRecord(coordRoot: string): GovernorServiceStatusRecord | unde
     ) {
       return undefined;
     }
-    return value;
+    return {
+      ...value,
+      start_token: typeof value.start_token === "string" ? value.start_token : undefined,
+    };
   } catch {
     return undefined;
   }
 }
 
-function statusOwnerIsLive(record: GovernorServiceStatusRecord): boolean {
-  if (record.state === "stopped") return false;
-  if (record.host === hostname()) return pidAlive(record.pid);
-  const age = Date.now() - Date.parse(record.heartbeat_at);
-  return Number.isFinite(age) && age < FOREIGN_STATUS_STALE_MS;
+function statusOwnerIsLive(record: GovernorServiceStatusRecord): GovernorServiceStatus["liveness"] {
+  return observeGovernorServiceProcess(record).liveness;
 }
 
-function pidAlive(pid: number): boolean {
-  try {
-    process.kill(pid, 0);
-    return true;
-  } catch (error) {
-    return (error as NodeJS.ErrnoException).code === "EPERM";
-  }
+function serviceStartRefusal(
+  coordRoot: string,
+  pid: number | undefined,
+  liveness: GovernorServiceStatus["liveness"],
+): Error {
+  const reason =
+    liveness === "unknown"
+      ? `governor service process generation is unknown${pid ? ` for pid ${pid}` : ""}`
+      : `governor service process is still running under pid ${pid}`;
+  return new Error(
+    `${reason}; run \`${resolveBinName(coordRoot)} governor service stop\` to write a durable stop request before starting or reconfiguring it`,
+  );
 }
 
 export function appendGovernorServiceDiagnostic(