harnery 0.43.0 → 0.44.0

package/src/core/agents/live-lifecycle-v3.ts

@@ -5,6 +5,7 @@ import { normalizeNativeIdV3 } from "../events/v3/canonical.ts";
 import type { EventV3 } from "../events/v3/contract.ts";
 import { readEventV3ControlState } from "../events/v3/control.ts";
 import { fingerprintContextV3 } from "../events/v3/fingerprint-keys.ts";
+import { withGenerationCustodyV3 } from "../events/v3/generation-custody.ts";
 import {
   liveInstanceIdV3,
   livePlatformV3,
@@ -25,17 +26,34 @@ interface LiveLifecycleObservationBaseV3 {
   observedAt?: string;
 }
 
+interface LiveSweepObservationV3Input extends LiveLifecycleObservationBaseV3 {
+  expectedGenerationId: `gen_${string}` | null;
+  observation: "stale_heartbeat" | "killed" | "unparseable_heartbeat" | "missing_timestamp";
+  ageMs: number;
+}
+
 export function recordLiveSweepObservationV3(
-  input: LiveLifecycleObservationBaseV3 & {
-    observation: "stale_heartbeat" | "killed" | "unparseable_heartbeat" | "missing_timestamp";
-    ageMs: number;
-  },
+  input: LiveSweepObservationV3Input,
 ): LiveLifecycleObservationV3Result {
-  return recordObservation(input, "lifecycle.sweep_observed", {
-    subject_instance_id: liveInstanceIdV3(input.owner),
-    observation: input.observation,
-    provisional: true,
-    age_ms: Math.max(0, Math.floor(input.ageMs)),
+  input = { ...input };
+  // Reject stale observations before preparing durable custody state. The
+  // in-custody checks cover replacement while acquiring custody and reentry.
+  requireSweepHookState(input);
+  return withGenerationCustodyV3(input.coordRoot, [liveInstanceIdV3(input.owner)], () => {
+    requireSweepHookState(input);
+    return recordObservation(
+      input,
+      "lifecycle.sweep_observed",
+      {
+        subject_instance_id: liveInstanceIdV3(input.owner),
+        observation: input.observation,
+        provisional: true,
+        age_ms: Math.max(0, Math.floor(input.ageMs)),
+      },
+      () => {
+        requireSweepHookState(input);
+      },
+    );
   });
 }
 
@@ -44,11 +62,16 @@ export function recordLiveResumeObservationV3(
 ): LiveLifecycleObservationV3Result {
   const normalized = withAttestedAdapter(input);
   const hook = requireHookState(normalized);
-  return recordObservation(normalized, "session.resumed", {
-    prior_generation_id: hook.generation_id,
-    continuity: "native",
-    evidence_reference: "heartbeat_recreated",
-  });
+  return recordObservation(
+    normalized,
+    "session.resumed",
+    {
+      prior_generation_id: hook.generation_id,
+      continuity: "native",
+      evidence_reference: "heartbeat_recreated",
+    },
+    () => {},
+  );
 }
 
 function recordObservation<T extends "lifecycle.sweep_observed" | "session.resumed">(
@@ -66,6 +89,7 @@ function recordObservation<T extends "lifecycle.sweep_observed" | "session.resum
         continuity: "native";
         evidence_reference: string;
       },
+  beforeWrite: () => void,
 ): LiveLifecycleObservationV3Result {
   const route = resolveLiveEventLedgerRouteV3(input.coordRoot);
   if (route.state === "blocked") throw new LiveCoordinationAuthorityV3Error(route.reason);
@@ -121,6 +145,7 @@ function recordObservation<T extends "lifecycle.sweep_observed" | "session.resum
     monotonic_ns: process.hrtime.bigint().toString(),
   };
   const event = buildEventV3(eventType, { ...common, payload } as never) as EventV3;
+  beforeWrite();
   const durability = writeEventV3(input.coordRoot, event, {
     expectedGenesisId: control.genesis.event.payload.genesis_id as `gex_${string}`,
   });
@@ -130,6 +155,19 @@ function recordObservation<T extends "lifecycle.sweep_observed" | "session.resum
   return { state: "recorded", event };
 }
 
+function requireSweepHookState(input: LiveSweepObservationV3Input): void {
+  if (
+    typeof input.expectedGenerationId !== "string" ||
+    !/^gen_[a-zA-Z0-9._-]+$/.test(input.expectedGenerationId)
+  ) {
+    throw new LiveCoordinationAuthorityV3Error("hook_generation_not_joinable");
+  }
+  const hook = requireHookState(withAttestedAdapter(input));
+  if (hook.generation_id !== input.expectedGenerationId) {
+    throw new LiveCoordinationAuthorityV3Error("expected_generation_changed");
+  }
+}
+
 function withAttestedAdapter<T extends LiveLifecycleObservationBaseV3>(input: T): T {
   const adapter = liveCoordinationAdapterV3(input.coordRoot, input.owner);
   if (!adapter) return input;

package/src/core/agents/mailbox.ts

@@ -9,13 +9,14 @@
  * shown to them, because nothing surfaces another session's journal.
  *
  * This module addresses the durable persona name instead of the instance, so a
- * message can be queued before its recipient exists. Delivery happens on the
- * recipient's side: their next SessionStart or prompt drains the queue, shows
- * the messages, and records them in their journal.
+ * message can be queued before its recipient exists. The recipient's next
+ * SessionStart or prompt can drain the queue for injection. A drain does not
+ * confirm that the adapter emitted the context or that anyone read it.
  *
  * Storage: `.harnery/mailbox/<slug>.jsonl`, one JSON record per line, appended
- * by senders and removed by an atomic claim on the recipient's side. Delivered
- * records are appended to `.harnery/mailbox/delivered/<slug>.jsonl` for audit.
+ * by senders and removed by an atomic claim on the recipient's side. Drained
+ * records are appended to `.harnery/mailbox/delivered/<slug>.jsonl` for audit,
+ * with injection explicitly unconfirmed.
  *
  * Related but distinct: `core/inbox` is an instance-keyed transport with a
  * storage-framework service behind it. This mailbox is name-keyed, file-only,
@@ -48,8 +49,8 @@ export const MAILBOX_MESSAGE_SCHEMA = "harnery.mailbox-message/v1" as const;
 export const MAX_BODY_BYTES = 4000;
 /** Pending messages held for one name before senders are refused. */
 export const MAX_PENDING = 25;
-/** Delivered-archive ceiling; the file is truncated from the head past this. */
-const MAX_DELIVERED_BYTES = 256 * 1024;
+/** Drain-archive ceiling; the file is truncated from the head past this. */
+const MAX_ARCHIVE_BYTES = 256 * 1024;
 
 export interface MailboxMessageV1 {
   schema: typeof MAILBOX_MESSAGE_SCHEMA;
@@ -104,7 +105,7 @@ export function mailboxPath(coordRoot: string, name: string): string {
   return join(mailboxDir(coordRoot), `${slugFor(name)}.jsonl`);
 }
 
-function deliveredPath(coordRoot: string, name: string): string {
+function archivePath(coordRoot: string, name: string): string {
   return join(mailboxDir(coordRoot), "delivered", `${slugFor(name)}.jsonl`);
 }
 
@@ -243,10 +244,10 @@ export function peekMailbox(coordRoot: string, name: string): MailboxMessageV1[]
 /**
  * Claim and return every pending message for a name.
  *
- * The claim is an atomic rename, so two sessions sharing a name cannot deliver
+ * The claim is an atomic rename, so two sessions sharing a name cannot claim
  * the same message twice: whichever rename wins owns the batch. Claimed records
- * are appended to the delivered archive before the claim file is removed, so a
- * crash between the two leaves an auditable copy rather than a silent loss.
+ * are archived before the claim file is removed. The archive records only the
+ * drain; output, recipient read, and turn completion remain unconfirmed.
  */
 export function drainMailbox(coordRoot: string, name: string): MailboxMessageV1[] {
   let path: string;
@@ -279,12 +280,20 @@ export function drainMailbox(coordRoot: string, name: string): MailboxMessageV1[
 
   if (messages.length > 0) {
     try {
-      const archive = deliveredPath(coordRoot, name);
+      const archive = archivePath(coordRoot, name);
       mkdirSync(join(mailboxDir(coordRoot), "delivered"), { recursive: true });
-      const deliveredAt = new Date().toISOString();
+      const drainedAt = new Date().toISOString();
       appendFileSync(
         archive,
-        `${messages.map((m) => JSON.stringify({ ...m, delivered_at: deliveredAt })).join("\n")}\n`,
+        `${messages
+          .map((m) =>
+            JSON.stringify({
+              ...m,
+              drained_at: drainedAt,
+              delivery_status: "injection-unconfirmed",
+            }),
+          )
+          .join("\n")}\n`,
         "utf8",
       );
       trimArchive(archive);
@@ -336,7 +345,7 @@ function sweepStaleClaims(coordRoot: string): void {
 
 function trimArchive(path: string): void {
   try {
-    if (statSync(path).size <= MAX_DELIVERED_BYTES) return;
+    if (statSync(path).size <= MAX_ARCHIVE_BYTES) return;
     const lines = readFileSync(path, "utf8").split("\n").filter(Boolean);
     const keep = lines.slice(Math.floor(lines.length / 2));
     writeFileSync(path, `${keep.join("\n")}\n`, "utf8");
@@ -354,8 +363,8 @@ export function formatMailboxDelivery(
   const bin = resolveBinName(coordRoot);
   const header =
     messages.length === 1
-      ? `Message from a peer agent (delivered now, recorded in your journal):`
-      : `${messages.length} messages from peer agents (delivered now, recorded in your journal):`;
+      ? `Message from a peer agent (prepared for injection, recorded in your journal):`
+      : `${messages.length} messages from peer agents (prepared for injection, recorded in your journal):`;
   const body = messages
     .map((m) => {
       const when = m.created_at.replace("T", " ").replace(/\.\d+Z$/, "Z");

package/src/core/agents/render/prompt-context.ts

@@ -48,9 +48,9 @@ import { join } from "node:path";
 import { coordEnv } from "../../../lib/env.ts";
 import { endOfTurnStatusCommand, hostPromptReminder, resolveBinName } from "../../config.ts";
 import type { PressureWorkloadClass } from "../../diagnostics/contract.ts";
+import { formatPeerInbox, peerInbox } from "../../inbox/peer-messages.ts";
 import { type RemoteMachine, readRemoteMachines } from "../../presence/index.ts";
 import { readResourceStatus } from "../../resources/status.ts";
-import { drainMailbox, formatMailboxDelivery } from "../mailbox.ts";
 import { sessionNameDisplayBlock, sessionNameDisplayPending } from "../session-name-display.ts";
 import { heartbeatPath } from "../state/heartbeat-reader.ts";
 import {
@@ -59,7 +59,7 @@ import {
 } from "../state/live-coordination-view.ts";
 import { forkRelationLabels } from "../state/names.ts";
 import type { AgentActivity, TaskState } from "../state/session-state.ts";
-import { formatPendingCouncils, recordDeliveredMessages } from "./session-context.ts";
+import { formatPendingCouncils } from "./session-context.ts";
 
 interface HeartbeatRow {
   instance_id?: string;
@@ -103,6 +103,8 @@ export interface PromptContextOpts {
    * being bounced into a retry. Not hash-deduped, same rationale as the
    * status footer. */
   turnRitualNudge?: string;
+  /** The emitter acknowledges exactly these IDs only after output succeeds. */
+  onInboxPrepared?: (messageIds: readonly string[]) => void;
 }
 
 /**
@@ -132,16 +134,12 @@ export function renderPromptContext(opts: PromptContextOpts): string {
   // skipped without it.
   const resolvedName = agentName ?? readLiveCoordinationRow(coordRoot, instanceId)?.name;
 
-  // 1. Peer messages. Drained first and never deduped: a message is delivered
-  // exactly once, and it is the one section here that carries new information
-  // from another agent rather than a reminder.
-  //
-  if (resolvedName) {
-    const delivered = drainMailbox(coordRoot, resolvedName);
-    if (delivered.length > 0) {
-      recordDeliveredMessages(instanceId, delivered);
-      sections.push(formatMailboxDelivery(coordRoot, delivered));
-    }
+  // 1. Instance-bound messages. Rendering is read-only; failed output leaves
+  // this same batch pending rather than losing it before a prompt sees it.
+  const delivered = peerInbox(coordRoot).prepareSurface(instanceId);
+  if (delivered.length > 0) {
+    opts.onInboxPrepared?.(delivered.map(({ message_id }) => message_id));
+    sections.push(formatPeerInbox(coordRoot, delivered));
   }
 
   // 2. Peer table with hash dedup.

package/src/core/agents/render/session-context.ts

@@ -12,9 +12,8 @@ import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
 import { join } from "node:path";
 import { resolveBinName, resolveHooksSetupHint } from "../../config.ts";
 import { harneryVersion, loadAdapterWiring } from "../../hooks/adapter/wiring.ts";
-import { appendEntry } from "../../journal/index.ts";
+import { formatPeerInbox, peerInbox } from "../../inbox/peer-messages.ts";
 import { readRemoteMachines } from "../../presence/index.ts";
-import { drainMailbox, formatMailboxDelivery, type MailboxMessageV1 } from "../mailbox.ts";
 import { readLiveCoordinationRows } from "../state/live-coordination-view.ts";
 import { forkRelationLabels, readForkState } from "../state/names.ts";
 import type { AgentActivity, TaskState } from "../state/session-state.ts";
@@ -42,6 +41,8 @@ export interface RenderOpts {
   /** Adapter label rendered in parens after the self-name (e.g. "Cursor", "Codex").
    * Claude Code omits it. */
   platformLabel?: string;
+  /** The emitter acknowledges exactly these IDs only after output succeeds. */
+  onInboxPrepared?: (messageIds: readonly string[]) => void;
 }
 
 /**
@@ -92,15 +93,12 @@ export function renderSessionContext(opts: RenderOpts): string {
     );
   }
 
-  // 3. Peer messages queued for this name while no session held it. Draining
-  // here is what makes `agents ping` safe to use on a dormant agent: the sender
-  // never has to know whether the recipient is running.
-  if (agentName) {
-    const delivered = drainMailbox(coordRoot, agentName);
-    if (delivered.length > 0) {
-      recordDeliveredMessages(instanceId, delivered);
-      messages.push(formatMailboxDelivery(coordRoot, delivered));
-    }
+  // 3. Rendering never consumes a message. The native emitter acknowledges the
+  // prepared instance-bound batch only after it has flushed the output.
+  const delivered = peerInbox(coordRoot).prepareSurface(instanceId);
+  if (delivered.length > 0) {
+    opts.onInboxPrepared?.(delivered.map(({ message_id }) => message_id));
+    messages.push(formatPeerInbox(coordRoot, delivered));
   }
 
   // 4. Council invites
@@ -147,27 +145,6 @@ export function renderSessionContext(opts: RenderOpts): string {
   return messages.join("\n\n");
 }
 
-/**
- * Write delivered peer messages into the recipient's own journal, so they
- * survive context compaction the way any other coordination breadcrumb does.
- * A message the sender already journaled (the recipient was live when it was
- * sent) is skipped to avoid a duplicate entry.
- */
-export function recordDeliveredMessages(
-  instanceId: string,
-  messages: readonly MailboxMessageV1[],
-): void {
-  for (const m of messages) {
-    if (m.journaled) continue;
-    try {
-      appendEntry(instanceId, "handoff", `from agent-${m.from_name}: ${m.body}`);
-    } catch {
-      // A journal write failure must never cost the delivery itself; the
-      // message is already in the rendered context the model reads.
-    }
-  }
-}
-
 /** One-line-per-agent view of sessions on other machines (presence refs). */
 function formatRemoteMachines(coordRoot: string): string {
   try {

package/src/core/agents/rules/stop-hook.ts

@@ -424,9 +424,9 @@ function sessionNameBlock(coordRoot: string, instanceId: string): VerdictResult
   } catch {
     // The ledger evidence still authorizes the block; the cache is UX only.
   }
-  const instruction = name
-    ? `Reproduce it by itself in a fenced code block: ${name}`
-    : `Run \`${resolveBinName(coordRoot)} agents suggest-name\`, then reproduce its output by itself in a fenced code block.`;
+  // The first post-mint reply was already rejected. Repeating its title later
+  // cannot change that evidence; the JSON retry result opens a new window.
+  const instruction = `Run \`${resolveBinName(coordRoot)} agents suggest-name --json\` as your only tool call to create a fresh verification boundary, then display its suggested_session_name verbatim by itself in a fenced code block${name ? `: ${name}` : "."}`;
   return {
     allow: false,
     exit_code: 2,

package/src/core/agents/state/heartbeat-writer.ts

@@ -24,6 +24,11 @@ import {
   writeFileSync,
 } from "node:fs";
 import { dirname, join } from "node:path";
+import {
+  assertCurrentGenerationV3,
+  withGenerationCustodyV3,
+} from "../../events/v3/generation-custody.ts";
+import { liveInstanceIdV3 } from "../../events/v3/live-routing.ts";
 import { canonicalClaimPath } from "../claim-path.ts";
 import { type Heartbeat, heartbeatPath, readHeartbeat } from "./heartbeat-reader.ts";
 import type { TaskState } from "./session-state.ts";
@@ -63,12 +68,15 @@ function mutate(
   instanceId: string,
   fn: (hb: Heartbeat) => Heartbeat,
 ): Heartbeat | null {
-  const hb = readHeartbeat(coordRoot, instanceId);
-  if (!hb) return null;
-  const next = fn(hb);
-  next.last_heartbeat = nowIsoSeconds();
-  atomicWrite(heartbeatPath(coordRoot, instanceId), JSON.stringify(next, null, 2));
-  return next;
+  return withGenerationCustodyV3(coordRoot, [liveInstanceIdV3(instanceId)], () => {
+    const hb = readHeartbeat(coordRoot, instanceId);
+    if (!hb) return null;
+    const next = fn(hb);
+    next.last_heartbeat = nowIsoSeconds();
+    assertCurrentGenerationV3(coordRoot, liveInstanceIdV3(instanceId), hb.v3_generation_id);
+    atomicWrite(heartbeatPath(coordRoot, instanceId), JSON.stringify(next, null, 2));
+    return next;
+  });
 }
 
 export function setTask(coordRoot: string, instanceId: string, task: string): Heartbeat | null {
@@ -100,12 +108,15 @@ export function setIdentityCache(
   name: string,
   agentId: string,
 ): Heartbeat | null {
-  const heartbeat = readHeartbeat(coordRoot, instanceId);
-  if (!heartbeat) return null;
-  heartbeat.name = name;
-  heartbeat.agent_id = agentId;
-  atomicWrite(heartbeatPath(coordRoot, instanceId), JSON.stringify(heartbeat, null, 2));
-  return heartbeat;
+  return withGenerationCustodyV3(coordRoot, [liveInstanceIdV3(instanceId)], () => {
+    const heartbeat = readHeartbeat(coordRoot, instanceId);
+    if (!heartbeat) return null;
+    heartbeat.name = name;
+    heartbeat.agent_id = agentId;
+    assertCurrentGenerationV3(coordRoot, liveInstanceIdV3(instanceId), heartbeat.v3_generation_id);
+    atomicWrite(heartbeatPath(coordRoot, instanceId), JSON.stringify(heartbeat, null, 2));
+    return heartbeat;
+  });
 }
 
 /** Restore the pool-assigned display name on a generation that was
@@ -328,6 +339,12 @@ export function clearCoordinationCache(coordRoot: string, instanceId: string): b
 }
 
 export function healPidmap(coordRoot: string, instanceId: string, pid: number): void {
+  withGenerationCustodyV3(coordRoot, [liveInstanceIdV3(instanceId)], () =>
+    healPidmapUnderCustody(coordRoot, instanceId, pid),
+  );
+}
+
+function healPidmapUnderCustody(coordRoot: string, instanceId: string, pid: number): void {
   const dir = join(coordRoot, ".harnery", "pid-map");
   mkdirSync(dir, { recursive: true });
   const hb = readHeartbeat(coordRoot, instanceId);

package/src/core/agents/state/live-coordination-writer.ts

@@ -5,6 +5,10 @@ import {
   readCoordinationViewV3,
   requireAuthoritySafeCoordinationViewV3,
 } from "../../events/v3/coordination-view.ts";
+import {
+  assertCurrentGenerationV3,
+  withGenerationCustodyV3,
+} from "../../events/v3/generation-custody.ts";
 import { liveInstanceIdV3, resolveLiveEventLedgerRouteV3 } from "../../events/v3/live-routing.ts";
 import { type Heartbeat, readHeartbeat } from "./heartbeat-reader.ts";
 import {
@@ -64,6 +68,26 @@ function materializeLiveCoordinationHeartbeat(
   _adapter: Adapter,
   model: string | undefined,
   force: boolean,
+): Heartbeat | null {
+  return withGenerationCustodyV3(coordRoot, [liveInstanceIdV3(nativeInstanceId)], () =>
+    materializeHeartbeatUnderCustody(
+      coordRoot,
+      nativeInstanceId,
+      nativeSessionId,
+      _adapter,
+      model,
+      force,
+    ),
+  );
+}
+
+function materializeHeartbeatUnderCustody(
+  coordRoot: string,
+  nativeInstanceId: string,
+  nativeSessionId: string,
+  _adapter: Adapter,
+  model: string | undefined,
+  force: boolean,
 ): Heartbeat | null {
   const route = resolveLiveEventLedgerRouteV3(coordRoot);
   if (route.state === "blocked") throw new Error(`event_v3_coordination_view:${route.reason}`);
@@ -133,6 +157,11 @@ function materializeLiveCoordinationHeartbeat(
     v3_projection_event_id: generation.last_event_id,
     v3_task_state: generation.task_state === "set" ? "set" : "cleared",
   };
+  assertCurrentGenerationV3(
+    coordRoot,
+    liveInstanceIdV3(nativeInstanceId),
+    generation.generation_id,
+  );
   writeHeartbeatCache(coordRoot, nativeInstanceId, materialized);
   return materialized;
 }

package/src/core/agents/state/pidmap.ts

@@ -24,6 +24,8 @@ import {
   writeFileSync,
 } from "node:fs";
 import { dirname, join } from "node:path";
+import { withGenerationCustodyV3 } from "../../events/v3/generation-custody.ts";
+import { liveInstanceIdV3 } from "../../events/v3/live-routing.ts";
 import { checkPidToken, processStartToken } from "./proc-start.ts";
 
 /**
@@ -126,6 +128,17 @@ export function writePidmapRow(
   pid: number,
   instanceId: string,
   platform: string,
+): void {
+  withGenerationCustodyV3(coordRoot, [liveInstanceIdV3(instanceId)], () =>
+    writePidmapRowUnderCustody(coordRoot, pid, instanceId, platform),
+  );
+}
+
+function writePidmapRowUnderCustody(
+  coordRoot: string,
+  pid: number,
+  instanceId: string,
+  platform: string,
 ): void {
   const dir = join(coordRoot, ".harnery", "pid-map");
   const path = join(dir, String(pid));

package/src/core/agents/state/proc-start.ts

@@ -160,6 +160,63 @@ export function processStartToken(pid: number): string | null {
   return startTokenProbe() === "procfs" ? procfsStartToken(pid) : psStartToken(pid);
 }
 
+export type ProcessGenerationVerdict = "same" | "different" | "unknown";
+
+type ReadProcessStartToken = (pid: number) => string | null;
+
+/** A missing or unreadable token never establishes process identity. */
+export function verifyProcessGeneration(
+  pid: number,
+  recordedToken: string | null | undefined,
+  readToken: ReadProcessStartToken = processStartToken,
+): ProcessGenerationVerdict {
+  if (
+    !Number.isInteger(pid) ||
+    pid <= 0 ||
+    typeof recordedToken !== "string" ||
+    !recordedToken.trim()
+  )
+    return "unknown";
+  // A bootless Linux token cannot identify a process across machine boots.
+  if (/^l\d+$/.test(recordedToken)) return "unknown";
+  try {
+    const currentToken = readToken(pid);
+    if (typeof currentToken !== "string" || !currentToken.trim()) return "unknown";
+    if (/^l\d+$/.test(currentToken)) return "unknown";
+    return currentToken === recordedToken ? "same" : "different";
+  } catch {
+    return "unknown";
+  }
+}
+
+export interface ProcessGenerationSignalDependencies {
+  readToken?: ReadProcessStartToken;
+  kill?: (pid: number, signal: NodeJS.Signals | number) => unknown;
+}
+
+/**
+ * Recheck the process generation immediately before sending the signal.
+ *
+ * The process can still exit and its PID can be reused between the token read
+ * and the signal. Eliminating that race requires a generation-bound OS handle.
+ */
+export function signalIfSameGeneration(
+  pid: number,
+  recordedToken: string | null | undefined,
+  signal: NodeJS.Signals | number,
+  dependencies: ProcessGenerationSignalDependencies = {},
+): { sent: boolean; verdict: ProcessGenerationVerdict } {
+  const kill = dependencies.kill ?? process.kill;
+  const verdict = verifyProcessGeneration(pid, recordedToken, dependencies.readToken);
+  if (verdict !== "same") return { sent: false, verdict };
+  try {
+    kill(pid, signal);
+    return { sent: true, verdict };
+  } catch {
+    return { sent: false, verdict };
+  }
+}
+
 /**
  * Do two tokens describe the same run?
  *