harnery 0.43.0 → 0.44.0

package/dist/core/supervisor/findings.js

@@ -1,4 +1,5 @@
 import { createHash } from "node:crypto";
+import { canonicalizeDiagnosticIdentity } from "../diagnostics/path-identity.js";
 import { SUPERVISOR_DIAGNOSTIC_LIMITS, SUPERVISOR_FINDING_POLICY, SUPERVISOR_FINDING_SCHEMA_VERSION, } from "./contract.js";
 import { evaluateHookHealthAlerts } from "./hook-health-alerts.js";
 import { ledgerControlStateFindingCandidateV1, } from "./ledger-state.js";
@@ -31,14 +32,16 @@ export function updateSupervisorFindings(input) {
     const candidates = evaluateCandidates(input)
         .sort((left, right) => severityRank(right.severity) - severityRank(left.severity))
         .slice(0, SUPERVISOR_DIAGNOSTIC_LIMITS.max_active_findings);
-    const priorActive = new Map(previous.active.map((entry) => [entry.fingerprint, entry]));
+    const priorActive = new Map(previous.active.map((entry) => [findingFingerprint(entry), entry]));
     const current = new Set();
     const active = [];
     const transitions = new Map(previous.transitions.map((entry) => [entry.id, entry]));
-    for (const candidate of candidates) {
-        const fingerprint = findingFingerprint(candidate);
-        current.add(fingerprint);
-        const prior = priorActive.get(fingerprint) ?? recentResolved(previous, fingerprint, observedAt);
+    for (const observed of candidates) {
+        const identity = findingFingerprint(observed);
+        current.add(identity);
+        const prior = priorActive.get(identity) ?? recentResolved(previous, identity, observedAt);
+        const candidate = preserveEpisodeReferences(observed, prior);
+        const fingerprint = prior?.fingerprint ?? identity;
         const openedAt = prior?.opened_at ?? candidate.primary_source.observed_at;
         const occurrenceCount = prior
             ? prior.state === "resolved"
@@ -48,7 +51,7 @@ export function updateSupervisorFindings(input) {
         const peak = peakEvidence(prior, candidate.evidence, observedAt);
         const finding = {
             schema_version: SUPERVISOR_FINDING_SCHEMA_VERSION,
-            id: deterministicId("find", `${fingerprint}\u0000${openedAt}`),
+            id: prior?.id ?? deterministicId("find", `${fingerprint}\u0000${openedAt}`),
             fingerprint,
             source_kind: candidate.source_kind,
             finding_kind: candidate.finding_kind,
@@ -72,7 +75,7 @@ export function updateSupervisorFindings(input) {
         transitions.set(finding.id, finding);
     }
     for (const prior of priorActive.values()) {
-        if (current.has(prior.fingerprint))
+        if (current.has(findingFingerprint(prior)))
             continue;
         transitions.set(prior.id, {
             ...prior,
@@ -420,7 +423,7 @@ function stableSource(sourceKind, sourceId, observedAt, capability, recordId, sc
 function recentResolved(findings, fingerprint, observedAt) {
     const observedMs = Date.parse(observedAt);
     return findings.transitions
-        .filter((entry) => entry.fingerprint === fingerprint &&
+        .filter((entry) => findingFingerprint(entry) === fingerprint &&
         entry.state === "resolved" &&
         entry.resolved_at !== undefined &&
         observedMs - Date.parse(entry.resolved_at) >= 0 &&
@@ -460,7 +463,49 @@ function deterministicId(prefix, value) {
     return `${prefix}_${digest(value).slice(0, 24)}`;
 }
 function digest(value) {
-    return createHash("sha256").update(value).digest("hex");
+    return createHash("sha256").update(canonicalizeDiagnosticIdentity(value)).digest("hex");
+}
+/** Keep opaque episode links when the same source observation is replayed privately. */
+function preserveEpisodeReferences(candidate, prior) {
+    if (!prior)
+        return candidate;
+    const sources = [
+        prior.primary_source,
+        ...prior.evidence.map((entry) => entry.source),
+        ...(prior.workload_context ? [prior.workload_context.source] : []),
+    ];
+    const byIdentity = new Map(sources.map((source) => [sourceIdentity(source), source]));
+    const retainSource = (source) => {
+        const captured = byIdentity.get(sourceIdentity(source));
+        return captured ? { ...source, id: captured.id } : source;
+    };
+    return {
+        ...candidate,
+        primary_source: retainSource(candidate.primary_source),
+        evidence: candidate.evidence.map((entry) => {
+            const captured = prior.evidence.find((previous) => sourceIdentity(previous.source) === sourceIdentity(entry.source) &&
+                previous.unit === entry.unit &&
+                previous.observed_value === entry.observed_value &&
+                canonicalizeDiagnosticIdentity(previous.summary) ===
+                    canonicalizeDiagnosticIdentity(entry.summary));
+            return {
+                ...entry,
+                ...(captured ? { id: captured.id } : {}),
+                source: retainSource(entry.source),
+            };
+        }),
+        ...(candidate.workload_context
+            ? {
+                workload_context: {
+                    ...candidate.workload_context,
+                    source: retainSource(candidate.workload_context.source),
+                },
+            }
+            : {}),
+    };
+}
+function sourceIdentity(source) {
+    return canonicalizeDiagnosticIdentity([source.source_kind, source.source_id, source.record_id ?? "", source.observed_at].join("\u0000"));
 }
 function validFindings(value) {
     return (value?.schema_version === SUPERVISOR_FINDING_SCHEMA_VERSION &&

package/dist/core/supervisor/service.d.ts

@@ -1,4 +1,6 @@
+import { type ProcessGenerationVerdict } from "../agents/state/proc-start.js";
 import { type SupervisorServiceStatusRecord, type SupervisorStatus } from "./contract.js";
+import { type SupervisorProcessDependencies } from "./status.js";
 export declare const SUPERVISOR_DEFAULT_INTERVAL_MS = 2000;
 export declare const SUPERVISOR_DEFAULT_IDLE_EXIT_MS: number;
 export interface RunSupervisorInput {
@@ -24,6 +26,12 @@ export declare function spawnSupervisor(coordRootRaw: string, options?: {
     keepAlive?: boolean;
 }): Promise<SupervisorStatus>;
 export declare function ensureSupervisorRunning(coordRoot: string): Promise<EnsureSupervisorResult>;
-export declare function requestSupervisorStop(coordRootRaw: string): SupervisorStatus;
+export interface SupervisorStopResult extends SupervisorStatus {
+    signal_sent: boolean;
+    signal_verdict: ProcessGenerationVerdict;
+}
+export declare function requestSupervisorStop(coordRootRaw: string, dependencies?: SupervisorProcessDependencies & {
+    kill?: (pid: number, signal: NodeJS.Signals | number) => unknown;
+}): SupervisorStopResult;
 export declare function runSupervisor(input: RunSupervisorInput): Promise<SupervisorServiceStatusRecord>;
 //# sourceMappingURL=service.d.ts.map

package/dist/core/supervisor/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../src/core/supervisor/service.ts"],"names":[],"mappings":"AAgCA,OAAO,EAML,KAAK,6BAA6B,EAElC,KAAK,gBAAgB,EACtB,MAAM,eAAe,CAAC;AAsBvB,eAAO,MAAM,8BAA8B,OAAQ,CAAC;AACpD,eAAO,MAAM,+BAA+B,QAAa,CAAC;AAe1D,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,IAAI,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAChD;AAED,MAAM,MAAM,sBAAsB,GAC9B;IAAE,KAAK,EAAE,SAAS,GAAG,SAAS,CAAC;IAAC,MAAM,EAAE,gBAAgB,CAAA;CAAE,GAC1D;IAAE,KAAK,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,gBAAgB,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtE,wBAAsB,eAAe,CACnC,YAAY,EAAE,MAAM,EACpB,OAAO,GAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,CAAA;CAAO,GAC9E,OAAO,CAAC,gBAAgB,CAAC,CAwD3B;AAED,wBAAsB,uBAAuB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAahG;AAED,wBAAgB,qBAAqB,CAAC,YAAY,EAAE,MAAM,GAAG,gBAAgB,CAiB5E;AAED,wBAAsB,aAAa,CACjC,KAAK,EAAE,kBAAkB,GACxB,OAAO,CAAC,6BAA6B,CAAC,CAyQxC"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../src/core/supervisor/service.ts"],"names":[],"mappings":"AAkBA,OAAO,EACL,KAAK,wBAAwB,EAG9B,MAAM,+BAA+B,CAAC;AAevC,OAAO,EAML,KAAK,6BAA6B,EAElC,KAAK,gBAAgB,EACtB,MAAM,eAAe,CAAC;AAavB,OAAO,EAGL,KAAK,6BAA6B,EAEnC,MAAM,aAAa,CAAC;AASrB,eAAO,MAAM,8BAA8B,OAAQ,CAAC;AACpD,eAAO,MAAM,+BAA+B,QAAa,CAAC;AAe1D,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,IAAI,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAChD;AAED,MAAM,MAAM,sBAAsB,GAC9B;IAAE,KAAK,EAAE,SAAS,GAAG,SAAS,CAAC;IAAC,MAAM,EAAE,gBAAgB,CAAA;CAAE,GAC1D;IAAE,KAAK,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,gBAAgB,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtE,wBAAsB,eAAe,CACnC,YAAY,EAAE,MAAM,EACpB,OAAO,GAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,CAAA;CAAO,GAC9E,OAAO,CAAC,gBAAgB,CAAC,CAyD3B;AAED,wBAAsB,uBAAuB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAahG;AAED,MAAM,WAAW,oBAAqB,SAAQ,gBAAgB;IAC5D,WAAW,EAAE,OAAO,CAAC;IACrB,cAAc,EAAE,wBAAwB,CAAC;CAC1C;AAED,wBAAgB,qBAAqB,CACnC,YAAY,EAAE,MAAM,EACpB,YAAY,GAAE,6BAA6B,GAAG;IAC5C,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,GAAG,MAAM,KAAK,OAAO,CAAC;CAC7D,GACL,oBAAoB,CA8BtB;AAED,wBAAsB,aAAa,CACjC,KAAK,EAAE,kBAAkB,GACxB,OAAO,CAAC,6BAA6B,CAAC,CA+QxC"}

package/dist/core/supervisor/service.js

@@ -6,7 +6,8 @@ import { resolve } from "node:path";
 import { performance } from "node:perf_hooks";
 import { fileURLToPath } from "node:url";
 import { collectCoordinationHealthSnapshot } from "../agents/health.js";
-import { checkPidToken, processStartToken } from "../agents/state/proc-start.js";
+import { processStartToken, signalIfSameGeneration, } from "../agents/state/proc-start.js";
+import { resolveBinName } from "../config.js";
 import { pressureHistoryFromSupervisor } from "../diagnostics/advice.js";
 import { assessPressure } from "../diagnostics/pressure.js";
 import { readEventV3ControlState } from "../events/v3/control.js";
@@ -28,7 +29,7 @@ import { writeSupervisorHookHealth } from "./hook-health-storage.js";
 import { collectHookHealth } from "./hooks.js";
 import { SupervisorLogCollector } from "./log-feed.js";
 import { collectServiceHealth } from "./services.js";
-import { readSupervisorStatus } from "./status.js";
+import { installedSupervisorBuild, readSupervisorStatus, supervisorProcessLiveness, } from "./status.js";
 import { readSupervisorFindings, readSupervisorHistory, readSupervisorPressure, supervisorPaths, } from "./storage.js";
 import { buildSupervisorTimeline } from "./timeline.js";
 export const SUPERVISOR_DEFAULT_INTERVAL_MS = 2_000;
@@ -41,15 +42,17 @@ const LIVE_DISPLAY_SWEEP_INTERVAL_MS = 5 * 60_000;
 export async function spawnSupervisor(coordRootRaw, options = {}) {
     const coordRoot = resolve(coordRootRaw);
     const current = readSupervisorStatus(coordRoot);
-    if (current.running) {
+    if (current.liveness === "unknown")
+        throw unknownOwnerError();
+    if (current.liveness === "running") {
         throw new Error(`local supervisor is already running under pid ${current.record?.pid}`);
     }
+    const paths = supervisorPaths(coordRoot);
+    assertLeaseAvailable(paths.lease);
     await stopLegacyResourceObserver(coordRoot);
     const intervalMs = normalizeInterval(options.intervalMs);
     const idleExitMs = normalizeIdleExit(options.idleExitMs);
-    const paths = supervisorPaths(coordRoot);
     mkdirSync(paths.root, { recursive: true, mode: stateDirMode() });
-    rmSync(paths.stop, { force: true });
     const cliPath = fileURLToPath(new URL(import.meta.url.endsWith(".ts") ? "../../cli.ts" : "../../cli.js", import.meta.url));
     if (!existsSync(cliPath))
         throw new Error(`cannot find harn entrypoint at ${cliPath}`);
@@ -109,27 +112,38 @@ export async function ensureSupervisorRunning(coordRoot) {
         };
     }
 }
-export function requestSupervisorStop(coordRootRaw) {
+export function requestSupervisorStop(coordRootRaw, dependencies = {}) {
     const coordRoot = resolve(coordRootRaw);
     const paths = supervisorPaths(coordRoot);
-    const status = readSupervisorStatus(coordRoot);
+    const status = readSupervisorStatus(coordRoot, Date.now(), dependencies);
     mkdirSync(paths.root, { recursive: true, mode: stateDirMode() });
     writePrivateJsonAtomic(paths.stop, {
         requested_at: new Date().toISOString(),
         requested_by_pid: process.pid,
     });
-    if (status.running && status.record?.host === hostname() && process.platform !== "win32") {
-        try {
-            process.kill(status.record.pid, "SIGTERM");
-        }
-        catch {
-            // The durable stop file handles a racing exit.
-        }
+    const legacyPaths = resourcePaths(coordRoot);
+    if (existsSync(legacyPaths.service) || existsSync(legacyPaths.lease))
+        requestResourceServiceStop(coordRoot, dependencies);
+    let signal = { sent: false, verdict: status.generation };
+    if (status.liveness === "running" &&
+        status.record?.host === hostname() &&
+        process.platform !== "win32") {
+        signal = signalIfSameGeneration(status.record.pid, status.record.start_token, "SIGTERM", dependencies);
     }
-    return readSupervisorStatus(coordRoot);
+    return {
+        ...readSupervisorStatus(coordRoot, Date.now(), dependencies),
+        signal_sent: signal.sent,
+        signal_verdict: signal.verdict,
+    };
 }
 export async function runSupervisor(input) {
     const coordRoot = resolve(input.coordRoot);
+    const current = readSupervisorStatus(coordRoot);
+    if (current.liveness === "unknown")
+        throw unknownOwnerError();
+    if (current.liveness === "running") {
+        throw new Error(`local supervisor is already running under pid ${current.record?.pid}`);
+    }
     const paths = supervisorPaths(coordRoot);
     const intervalMs = normalizeInterval(input.intervalMs);
     const idleExitMs = normalizeIdleExit(input.idleExitMs);
@@ -144,6 +158,7 @@ export async function runSupervisor(input) {
         schema_version: SUPERVISOR_STATUS_SCHEMA_VERSION,
         pid: process.pid,
         ...(startToken ? { start_token: startToken } : {}),
+        running_build: installedSupervisorBuild(),
         host: hostname(),
         nonce: lease.nonce,
         state: "starting",
@@ -451,7 +466,10 @@ function acquireLease(coordRoot, now) {
             if (error.code !== "EEXIST")
                 throw error;
             const existing = readLease(paths.lease);
-            if (existing && leaseIsLive(existing)) {
+            const liveness = existing ? leaseIsLive(existing) : "unknown";
+            if (liveness === "unknown")
+                throw unknownOwnerError();
+            if (existing && liveness === "running") {
                 throw new Error(`local supervisor lease is held by pid ${existing.pid}`);
             }
             try {
@@ -487,7 +505,13 @@ function releaseLease(path, nonce) {
 function readLease(path) {
     try {
         const value = JSON.parse(readFileSync(path, "utf8"));
-        return value && Number.isSafeInteger(value.pid) && typeof value.nonce === "string"
+        return value &&
+            Number.isSafeInteger(value.pid) &&
+            value.pid > 0 &&
+            typeof value.host === "string" &&
+            value.host.length > 0 &&
+            typeof value.nonce === "string" &&
+            value.nonce.length > 0
             ? value
             : undefined;
     }
@@ -496,25 +520,31 @@ function readLease(path) {
     }
 }
 function leaseIsLive(lease) {
-    if (lease.host !== hostname())
-        return true;
-    try {
-        process.kill(lease.pid, 0);
-    }
-    catch (error) {
-        if (error.code !== "EPERM")
-            return false;
-    }
-    return checkPidToken(lease.pid, lease.start_token) !== "mismatch";
+    return supervisorProcessLiveness(lease).liveness;
+}
+function assertLeaseAvailable(path) {
+    if (!existsSync(path))
+        return;
+    const lease = readLease(path);
+    const liveness = lease ? leaseIsLive(lease) : "unknown";
+    if (liveness === "unknown")
+        throw unknownOwnerError();
+    if (liveness === "running")
+        throw new Error(`local supervisor lease is held by pid ${lease?.pid}`);
+}
+function unknownOwnerError() {
+    return new Error(`local supervisor process identity is unknown; run ${resolveBinName()} supervisor stop to write the durable stop request before starting again`);
 }
 async function stopLegacyResourceObserver(coordRoot) {
     const legacy = readResourceServiceStatus(coordRoot);
-    if (!legacy.running)
+    if (legacy.liveness === "stopped")
         return;
     requestResourceServiceStop(coordRoot);
     const deadline = Date.now() + 2_000;
-    while (readResourceServiceStatus(coordRoot).running && Date.now() < deadline)
+    while (readResourceServiceStatus(coordRoot).liveness !== "stopped" && Date.now() < deadline)
         await delay(50);
+    if (readResourceServiceStatus(coordRoot).liveness !== "stopped")
+        throw new Error("legacy resource observer has not stopped after its durable stop request; its process identity may be unknown");
 }
 function log(coordRoot, event, fields, error) {
     try {

package/dist/core/supervisor/services.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"services.d.ts","sourceRoot":"","sources":["../../../src/core/supervisor/services.ts"],"names":[],"mappings":"AAKA,OAAO,EACL,KAAK,qBAAqB,EAE1B,KAAK,wBAAwB,EAC7B,KAAK,6BAA6B,EACnC,MAAM,eAAe,CAAC;AAGvB,wBAAgB,0BAA0B,CACxC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAClC,wBAAwB,CAY1B;AAED,wBAAgB,4BAA4B,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,IAAI,CAEhF;AAED,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,6BAA6B,GACxC;IAAE,QAAQ,EAAE,qBAAqB,EAAE,CAAC;IAAC,SAAS,EAAE,wBAAwB,EAAE,CAAA;CAAE,CAuC9E"}
+{"version":3,"file":"services.d.ts","sourceRoot":"","sources":["../../../src/core/supervisor/services.ts"],"names":[],"mappings":"AAMA,OAAO,EACL,KAAK,qBAAqB,EAE1B,KAAK,wBAAwB,EAC7B,KAAK,6BAA6B,EACnC,MAAM,eAAe,CAAC;AAGvB,wBAAgB,0BAA0B,CACxC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAClC,wBAAwB,CAY1B;AAED,wBAAgB,4BAA4B,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,IAAI,CAEhF;AAED,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,6BAA6B,GACxC;IAAE,QAAQ,EAAE,qBAAqB,EAAE,CAAC;IAAC,SAAS,EAAE,wBAAwB,EAAE,CAAA;CAAE,CAoC9E"}

package/dist/core/supervisor/services.js

@@ -2,6 +2,7 @@ import { existsSync, readdirSync, readFileSync, rmSync, statSync } from "node:fs
 import { hostname } from "node:os";
 import { join } from "node:path";
 import { checkPidToken, processStartToken } from "../agents/state/proc-start.js";
+import { readGovernorServiceStatus } from "../governor/service-read.js";
 import { writePrivateJsonAtomic } from "../storage/atomic-json.js";
 import { SUPERVISOR_CONSUMER_SCHEMA_VERSION, } from "./contract.js";
 import { readSupervisorConsumer, supervisorConsumerPath, supervisorPaths } from "./storage.js";
@@ -24,7 +25,7 @@ export function unregisterSupervisorConsumer(coordRoot, id) {
 export function collectServiceHealth(coordRoot, supervisor) {
     const consumers = readLiveConsumers(coordRoot);
     const semantic = readDetachedService(join(coordRoot, ".harnery", "semantic", "v2", "service.json"), "semantic-reader");
-    const governor = readDetachedService(join(coordRoot, ".harnery", "governor-service", "service.json"), "governor");
+    const governor = readGovernorHealth(coordRoot);
     const relay = readPresenceRelay(join(coordRoot, ".harnery", "presence", "relay-daemon.json"));
     const dashboard = consumers.find((consumer) => consumer.id === "dashboard");
     const services = [
@@ -106,6 +107,26 @@ function readDetachedService(path, id) {
     const state = pidAlive(record.pid) ? "running" : "stale";
     return projection(id, state, record, state === "stale" ? "recorded-running-process-missing" : undefined);
 }
+function readGovernorHealth(coordRoot) {
+    const status = readGovernorServiceStatus(coordRoot);
+    const state = status.liveness === "unknown"
+        ? "unknown"
+        : status.running
+            ? "running"
+            : status.stale
+                ? "stale"
+                : "stopped";
+    const reason = state === "unknown"
+        ? "governor-process-generation-unknown"
+        : status.generation === "different"
+            ? "recorded-process-generation-different"
+            : status.stale
+                ? "recorded-running-process-missing"
+                : undefined;
+    return status.record
+        ? projection("governor", state, status.record, reason)
+        : { id: "governor", state, ...(reason ? { reason } : {}) };
+}
 function readPresenceRelay(path) {
     const record = readBoundedJson(path);
     if (!record || !Number.isSafeInteger(record.pid) || record.pid < 1) {

package/dist/core/supervisor/status.d.ts

@@ -1,3 +1,18 @@
-import { type SupervisorStatus } from "./contract.js";
-export declare function readSupervisorStatus(coordRoot: string, nowMs?: number): SupervisorStatus;
+import { type ProcessGenerationVerdict } from "../agents/state/proc-start.js";
+import { type SupervisorBuild, type SupervisorStatus } from "./contract.js";
+export interface SupervisorProcessDependencies {
+    readToken?: (pid: number) => string | null;
+    probePid?: (pid: number) => unknown;
+}
+export declare function installedSupervisorBuild(): SupervisorBuild;
+export declare function readSupervisorStatus(coordRoot: string, nowMs?: number, dependencies?: SupervisorProcessDependencies): SupervisorStatus;
+/** A stale heartbeat does not prove that a process has exited. */
+export declare function supervisorProcessLiveness(owner: {
+    pid: number;
+    host: string;
+    start_token?: string;
+}, dependencies?: SupervisorProcessDependencies): {
+    liveness: SupervisorStatus["liveness"];
+    generation: ProcessGenerationVerdict;
+};
 //# sourceMappingURL=status.d.ts.map

package/dist/core/supervisor/status.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../../../src/core/supervisor/status.ts"],"names":[],"mappings":"AAEA,OAAO,EAGL,KAAK,gBAAgB,EACtB,MAAM,eAAe,CAAC;AAKvB,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,SAAa,GAAG,gBAAgB,CAyB5F"}
+{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../../../src/core/supervisor/status.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,KAAK,wBAAwB,EAE9B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EAEL,KAAK,eAAe,EAEpB,KAAK,gBAAgB,EACtB,MAAM,eAAe,CAAC;AAKvB,MAAM,WAAW,6BAA6B;IAC5C,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IAC3C,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;CACrC;AAED,wBAAgB,wBAAwB,IAAI,eAAe,CAW1D;AAED,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,MAAM,EACjB,KAAK,SAAa,EAClB,YAAY,GAAE,6BAAkC,GAC/C,gBAAgB,CA+ClB;AAeD,kEAAkE;AAClE,wBAAgB,yBAAyB,CACvC,KAAK,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,EAC1D,YAAY,GAAE,6BAAkC,GAC/C;IAAE,QAAQ,EAAE,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAAC,UAAU,EAAE,wBAAwB,CAAA;CAAE,CAgBlF"}

package/dist/core/supervisor/status.js

@@ -1,28 +1,66 @@
+import { existsSync, readFileSync } from "node:fs";
 import { hostname } from "node:os";
-import { checkPidToken } from "../agents/state/proc-start.js";
+import { join } from "node:path";
+import { verifyProcessGeneration, } from "../agents/state/proc-start.js";
+import { currentHarneryRuntimeBuild, harneryPackageRoot } from "../events/v3/runtime-build.js";
 import { SUPERVISOR_STATUS_SCHEMA_VERSION, } from "./contract.js";
 import { readSupervisorServiceRecord, supervisorPaths } from "./storage.js";
 const STALE_HEARTBEAT_MS = 15_000;
-export function readSupervisorStatus(coordRoot, nowMs = Date.now()) {
+export function installedSupervisorBuild() {
+    let version = "unknown";
+    let revision = "unknown";
+    try {
+        const pkg = JSON.parse(readFileSync(join(harneryPackageRoot(), "package.json"), "utf8"));
+        if (typeof pkg.version === "string")
+            version = pkg.version;
+        revision = currentHarneryRuntimeBuild();
+    }
+    catch {
+        // Missing build evidence must still produce an inspectable status.
+    }
+    return { version, revision };
+}
+export function readSupervisorStatus(coordRoot, nowMs = Date.now(), dependencies = {}) {
     const paths = supervisorPaths(coordRoot);
     const record = readSupervisorServiceRecord(coordRoot);
+    const installedBuild = installedSupervisorBuild();
+    const runningBuild = validBuild(record?.running_build) ? record.running_build : null;
+    const restartNeeded = !runningBuild ||
+        installedBuild.version === "unknown" ||
+        installedBuild.revision === "unknown" ||
+        runningBuild.version !== installedBuild.version ||
+        runningBuild.revision !== installedBuild.revision;
+    const build = {
+        running_build: runningBuild,
+        installed_build: installedBuild,
+        restart_needed: restartNeeded,
+        build_status: !runningBuild
+            ? "running build unknown; restart needed"
+            : restartNeeded
+                ? "restart needed"
+                : "current",
+    };
     if (!validRecord(record)) {
         return {
             running: false,
             stale: false,
+            generation: "unknown",
+            liveness: existsSync(paths.service) ? "unknown" : "stopped",
+            ...build,
             status_path: paths.service,
             snapshot_path: paths.snapshot,
         };
     }
     const heartbeatAt = Date.parse(record.heartbeat_at);
     const stale = !Number.isFinite(heartbeatAt) || nowMs - heartbeatAt > STALE_HEARTBEAT_MS;
-    const running = record.host === hostname() &&
-        !stale &&
-        (record.state === "starting" || record.state === "running" || record.state === "stopping") &&
-        pidStillMatches(record.pid, record.start_token);
+    const owner = supervisorProcessLiveness(record, dependencies);
+    const liveness = owner.generation === "same" && record.state === "stopped" ? "stopped" : owner.liveness;
     return {
-        running,
+        running: liveness === "running" && !stale && record.state !== "stopped",
         stale,
+        generation: owner.generation,
+        liveness,
+        ...build,
         record,
         status_path: paths.service,
         snapshot_path: paths.snapshot,
@@ -36,13 +74,33 @@ function validRecord(value) {
         typeof value.heartbeat_at === "string" &&
         typeof value.keep_alive === "boolean");
 }
-function pidStillMatches(pid, startToken) {
+/** A stale heartbeat does not prove that a process has exited. */
+export function supervisorProcessLiveness(owner, dependencies = {}) {
+    if (owner.host !== hostname())
+        return { liveness: "unknown", generation: "unknown" };
     try {
-        process.kill(pid, 0);
+        (dependencies.probePid ?? ((pid) => process.kill(pid, 0)))(owner.pid);
     }
     catch (error) {
-        if (error.code !== "EPERM")
-            return false;
+        return {
+            liveness: error.code === "ESRCH" ? "stopped" : "unknown",
+            generation: "unknown",
+        };
     }
-    return checkPidToken(pid, startToken) !== "mismatch";
+    const generation = verifyProcessGeneration(owner.pid, owner.start_token, dependencies.readToken);
+    return {
+        generation,
+        liveness: generation === "same" ? "running" : generation === "different" ? "stopped" : "unknown",
+    };
+}
+function validBuild(value) {
+    if (!value || typeof value !== "object")
+        return false;
+    const build = value;
+    return (typeof build.version === "string" &&
+        !!build.version &&
+        build.version !== "unknown" &&
+        typeof build.revision === "string" &&
+        !!build.revision &&
+        build.revision !== "unknown");
 }

package/dist/core/supervisor/timeline.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"timeline.d.ts","sourceRoot":"","sources":["../../../src/core/supervisor/timeline.ts"],"names":[],"mappings":"AACA,OAAO,EAGL,KAAK,iBAAiB,EACtB,KAAK,yBAAyB,EAC9B,KAAK,kBAAkB,EAExB,MAAM,eAAe,CAAC;AAEvB,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,iBAAiB,EAC1B,cAAc,GAAE,SAAS,yBAAyB,EAAO,GACxD,kBAAkB,CAoDpB"}
+{"version":3,"file":"timeline.d.ts","sourceRoot":"","sources":["../../../src/core/supervisor/timeline.ts"],"names":[],"mappings":"AAEA,OAAO,EAGL,KAAK,iBAAiB,EACtB,KAAK,yBAAyB,EAC9B,KAAK,kBAAkB,EAExB,MAAM,eAAe,CAAC;AAEvB,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,iBAAiB,EAC1B,cAAc,GAAE,SAAS,yBAAyB,EAAO,GACxD,kBAAkB,CAoDpB"}

package/dist/core/supervisor/timeline.js

@@ -1,4 +1,5 @@
 import { createHash } from "node:crypto";
+import { canonicalizeDiagnosticIdentity } from "../diagnostics/path-identity.js";
 import { SUPERVISOR_DIAGNOSTIC_LIMITS, SUPERVISOR_TIMELINE_SCHEMA_VERSION, } from "./contract.js";
 export function buildSupervisorTimeline(finding, relatedSources = []) {
     const relatedEntries = clusterRelatedSources(relatedSources);
@@ -83,5 +84,5 @@ function clusterRelatedSources(sources) {
     });
 }
 function stableId(prefix, value) {
-    return `${prefix}_${createHash("sha256").update(value).digest("hex").slice(0, 24)}`;
+    return `${prefix}_${createHash("sha256").update(canonicalizeDiagnosticIdentity(value)).digest("hex").slice(0, 24)}`;
 }

package/dist/core/work/state.js

@@ -6,7 +6,7 @@ import { appendSegmentedJsonlFile, readSegmentedJsonlFileSync, } from "../storag
 import { stateDirMode, stateFileMode } from "../storage/modes.js";
 import { readWorkflowApproval } from "../workflow/approvals.js";
 import { stableDigest } from "../workflow/durable-record.js";
-import { readWorkflowProof } from "../workflow/proof.js";
+import { deriveRunFailureClass, readWorkflowProof } from "../workflow/proof.js";
 import { readWorkflowRunManifest, workflowScriptDigest } from "../workflow/run-state.js";
 import { WORKFLOW_TRANSCRIPT_EVENT_BYTES, workflowTranscriptPath } from "../workflow/transcript.js";
 import { isWorkspaceBoundExecutionEvidence } from "../workflow/workspaces/validate.js";
@@ -464,13 +464,13 @@ function inspectAttempt(coordRoot, event, intent, priorRunId) {
                 proof.acceptance.summary.unknown === 0
                 ? "succeeded"
                 : "failed";
-        // A failed attempt the run classified as uninformative about the work is
-        // uncharged (ADR 0046). Absent class ⇒ charged, as before. Read only for a
-        // failed attempt: a succeeded run never carries a class.
+        // Re-derive no-effect eligibility from every participant rather than
+        // trusting a persisted transport class. Missing evidence stays charged.
+        // The script's explicit decision authority remains a separate path.
         if (attempt.status === "failed" &&
-            (proof.run.class === "environment" ||
-                proof.run.class === "upstream" ||
-                proof.run.class === "decision")) {
+            (proof.run.class === "decision" ||
+                ((proof.run.class === "environment" || proof.run.class === "upstream") &&
+                    deriveRunFailureClass(proof.run.status, proof.agents) === proof.run.class))) {
             attempt.uncharged = proof.run.class;
             if (proof.run.class === "decision" && typeof proof.run.decision_id === "string") {
                 attempt.blocked_on = proof.run.decision_id;

package/dist/core/workflow/engine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAiDH,OAAO,KAAK,EAIV,UAAU,EAGV,SAAS,EAeV,MAAM,YAAY,CAAC;AAuDpB,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;gBAEf,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO;CAM/E;AAED,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;gBAEpB,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM;CAOvF;AAED;;;;6EAI6E;AAC7E,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;gBAEjB,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM;CAUhD;AAED,wBAAsB,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CA6E1F"}
+{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AA0DH,OAAO,KAAK,EAIV,UAAU,EAGV,SAAS,EAeV,MAAM,YAAY,CAAC;AAuDpB,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;gBAEf,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO;CAM/E;AAED,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;gBAEpB,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM;CAOvF;AAED;;;;6EAI6E;AAC7E,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;gBAEjB,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM;CAUhD;AAED,wBAAsB,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CA6E1F"}