harnery 0.44.0 → 0.45.0

package/src/commands/turn-rollback.ts

@@ -0,0 +1,111 @@
+import type { Command } from "commander";
+import type { EmitContext, HarneryProgramContext } from "../commander.ts";
+import { monorepoRoot } from "../core/agents/index.ts";
+import {
+  applyTurnRollback,
+  beginTurnRollback,
+  inspectTurnRollback,
+  prepareTurnRollback,
+  sealTurnRollback,
+  type TurnRollbackPlan,
+} from "../core/turn-rollback/index.ts";
+import { readJsonRecord } from "../core/workflow/durable-record.ts";
+import { readWorkspaceBinding } from "../core/workflow/workspaces/state.ts";
+
+/** Explicit turn boundaries; hooks cannot infer provider ownership or path scope. */
+export function registerTurnRollbackCommand(
+  program: Command,
+  emit: EmitContext,
+  context?: HarneryProgramContext,
+): void {
+  const command = program
+    .command("turn-rollback")
+    .description("Capture and review exact-path content rollback in an owned workspace");
+  type Options = {
+    binding: string;
+    turn?: string;
+    generation?: string;
+    path?: string[];
+    yes?: boolean;
+    actor?: string;
+    reason?: string;
+    plan?: string;
+  };
+  const run =
+    (operation: (coordRoot: string, options: Options) => unknown | Promise<unknown>) =>
+    async (options: Options) => {
+      try {
+        const coordRoot = context?.resolveCoordRoot?.() ?? context?.repoRoot ?? monorepoRoot();
+        if (!coordRoot) throw new Error("project coordination root is unavailable");
+        emit.config({ format: "json" });
+        const result = await operation(coordRoot, options);
+        emit.data(result);
+        if (
+          result &&
+          typeof result === "object" &&
+          "status" in result &&
+          result.status === "unknown"
+        )
+          emit.setExitCode(1);
+      } catch (error) {
+        emit.error({ code: "turn_rollback_refused", message: String(error) });
+        emit.setExitCode(1);
+      }
+    };
+  const binding = (root: string, options: Options) => {
+    const value = readWorkspaceBinding(root, "local-git-worktree", options.binding);
+    if (!value) throw new Error("immutable workspace binding was not found");
+    return value;
+  };
+  command
+    .command("begin")
+    .description("Capture exact literal paths before a turn")
+    .requiredOption("--binding <id>", "Owned workspace binding ID")
+    .requiredOption("--turn <id>", "Caller turn identity")
+    .requiredOption("--generation <number>", "Increasing turn generation")
+    .requiredOption("--path <file...>", "Exact relative file paths, including planned new files")
+    .action(
+      run((root, options) =>
+        beginTurnRollback(root, {
+          binding: binding(root, options),
+          turn: { turn_id: options.turn!, generation: Number(options.generation) },
+          paths: options.path!,
+        }),
+      ),
+    );
+  for (const operation of ["seal", "prepare", "show"] as const) {
+    command
+      .command(`${operation} <capture-id>`)
+      .description(`${operation} an exact turn capture`)
+      .requiredOption("--binding <id>", "Owned workspace binding ID")
+      .action((id: string, options: Options) =>
+        run((root, opts) => {
+          const input = { binding: binding(root, opts), capture_id: id };
+          return operation === "seal"
+            ? sealTurnRollback(root, input)
+            : operation === "prepare"
+              ? prepareTurnRollback(root, input)
+              : inspectTurnRollback(root, input);
+        })(options),
+      );
+  }
+  command
+    .command("apply")
+    .description("Preview a saved proposal, or apply it after exact confirmation")
+    .requiredOption("--binding <id>", "Owned workspace binding ID")
+    .requiredOption("--plan <file>", "Saved JSON proposal returned by prepare")
+    .option("--yes", "Apply this exact proposal; preview is the default")
+    .option("--actor <name>", "Who authorized the restore")
+    .option("--reason <text>", "Why this turn is being restored")
+    .action(
+      run((root, options) =>
+        applyTurnRollback(root, {
+          binding: binding(root, options),
+          plan: readJsonRecord<TurnRollbackPlan>(options.plan!, "rollback proposal"),
+          yes: options.yes,
+          actor: options.actor,
+          reason: options.reason,
+        }),
+      ),
+    );
+}

package/src/commands/workflow.ts

@@ -73,6 +73,15 @@ interface WorkflowConfirmedMutationOpts {
 
 interface WorkflowReclaimOpts extends WorkflowConfirmedMutationOpts {
   discard?: boolean;
+  unknownLiveness?: string;
+  actor?: string;
+  reason?: string;
+}
+
+interface WorkflowUnlockOpts extends WorkflowConfirmedMutationOpts {
+  lockSha256?: string;
+  actor?: string;
+  reason?: string;
 }
 
 export function registerWorkflowCommand(program: Command, emit: EmitContext): void {
@@ -622,6 +631,12 @@ export function registerWorkflowCommand(program: Command, emit: EmitContext): vo
     )
     .option("--yes", "Confirm that this commits or discards uncommitted work, then releases")
     .option("--discard", "Throw the uncommitted work away instead of salvaging it")
+    .option(
+      "--unknown-liveness <sha256>",
+      "Recover unknown evidence pinned by the preview digest; active evidence still refuses",
+    )
+    .option("--actor <id>", "Actor responsible for an audited recovery")
+    .option("--reason <text>", "Reason for an audited recovery")
     .option("--json", "Emit the reclaim preview or confirmed result as JSON")
     .action(async (runId: string, opts: WorkflowReclaimOpts) => {
       const coordRoot = resolveCoordRoot();
@@ -648,6 +663,13 @@ export function registerWorkflowCommand(program: Command, emit: EmitContext): vo
         const result = await provider.reclaim(binding, {
           mode: opts.discard ? "discard" : "salvage",
           yes: opts.yes,
+          unknownLiveness: opts.unknownLiveness
+            ? {
+                evidenceSha256: opts.unknownLiveness,
+                actor: opts.actor!,
+                reason: opts.reason!,
+              }
+            : undefined,
         });
         if (opts.json) {
           emit.config({ format: "json" });
@@ -662,6 +684,7 @@ export function registerWorkflowCommand(program: Command, emit: EmitContext): vo
           emit.text(
             `reclaim preview: ${result.run_id}\n` +
               `mode: ${result.mode}\nliveness: ${result.liveness}\nownership: ${result.ownership}\n` +
+              `evidence sha256: ${result.evidence_sha256}\n` +
               `lease holder: ${holders.length > 0 ? holders.join(", ") : "none observed"}\n` +
               `dirty paths: ${result.dirty_paths === null ? "unknown" : result.dirty_paths.length > 0 ? result.dirty_paths.join(", ") : "none"}\n` +
               (result.ownership_detail ? `ownership detail: ${result.ownership_detail}\n` : "") +
@@ -685,6 +708,42 @@ export function registerWorkflowCommand(program: Command, emit: EmitContext): vo
       }
     });
 
+  workflow
+    .command("unlock <run-id>")
+    .description(
+      "Preview or explicitly retire one exact resume lock whose local owner is proven dead.",
+    )
+    .option("--lock-sha256 <sha256>", "Exact lock identity digest returned by the preview")
+    .option("--actor <id>", "Actor responsible for the recovery")
+    .option("--reason <text>", "Reason for the recovery")
+    .option("--yes", "Confirm removal after dead-owner and exact-lock checks")
+    .option("--json", "Emit the recovery preview or result as JSON")
+    .action(async (runId: string, opts: WorkflowUnlockOpts) => {
+      try {
+        const coordRoot = resolveCoordRoot();
+        if (!coordRoot) throw new Error("no .harnery/ coordination root found");
+        const { recoverWorkflowResumeLease } = await import("../core/workflow/index.ts");
+        const result = recoverWorkflowResumeLease(coordRoot, runId, opts);
+        if (opts.json) {
+          emit.config({ format: "json" });
+          emit.data(result);
+          return;
+        }
+        emit.text(
+          `resume lock ${result.action}: ${runId}\nowner: ${result.owner_state}\nlock sha256: ${result.lock_sha256 ?? "absent"}\n` +
+            (result.action === "preview"
+              ? "Pass --lock-sha256, --actor, --reason and --yes to confirm exact dead-owner recovery.\n"
+              : `recovery: ${result.recovery_id}\n`),
+        );
+      } catch (error) {
+        emit.error({
+          code: "workflow_resume_unlock_failed",
+          message: error instanceof Error ? error.message : String(error),
+        });
+        process.exit(1);
+      }
+    });
+
   const approvals = program
     .command("approval")
     .description("Inspect and resolve durable run-policy approvals.");

package/src/core/agents/coord-client.ts

@@ -265,7 +265,27 @@ export function parsePidmapRowStartToken(row: string): string | undefined {
  * a test can hold this one against `processStartToken` and fail on drift.
  */
 export function pidStartToken(pid: number): string | null {
+  if (!Number.isInteger(pid) || pid <= 0) return null;
   const forced = process.env.HARNERY_PID_PROBE;
+  if (process.platform === "win32" && forced !== "procfs" && forced !== "ps") {
+    try {
+      const out = spawnSync(
+        "powershell.exe",
+        [
+          "-NoLogo",
+          "-NoProfile",
+          "-NonInteractive",
+          "-Command",
+          `$process = [Diagnostics.Process]::GetProcessById(${pid}); try { 'w' + $process.StartTime.ToFileTimeUtc().ToString([Globalization.CultureInfo]::InvariantCulture) } finally { $process.Dispose() }`,
+        ],
+        { encoding: "utf8", timeout: 10_000, windowsHide: true },
+      );
+      const token = String(out.stdout ?? "").trim();
+      return out.status === 0 && /^w\d+$/.test(token) ? token : null;
+    } catch {
+      return null;
+    }
+  }
   const useProcfs = forced === "procfs" || (forced !== "ps" && existsSync("/proc/self/stat"));
   // One machine, one probe. Falling back to the other on a read failure would
   // answer in the wrong dialect and read as a recycled pid.

package/src/core/agents/state/proc-start.ts

@@ -34,9 +34,10 @@
 import { spawnSync } from "node:child_process";
 import { existsSync, readFileSync } from "node:fs";
 import { coordEnv } from "../../../lib/env.ts";
+import { signalProcessWithHandle, windowsProcessStartToken } from "./process-handle.ts";
 
 /** Which probe answers "when did this process start?" on this machine. */
-export type StartTokenProbe = "procfs" | "ps";
+export type StartTokenProbe = "procfs" | "ps" | "windows";
 
 /**
  * The `ps` probe is text formatted by `strftime("%c", localtime(...))`, so its
@@ -60,6 +61,7 @@ let cachedBootId: string | null | undefined;
 export function startTokenProbe(): StartTokenProbe {
   const override = coordEnv("PID_PROBE");
   if (override === "procfs" || override === "ps") return override;
+  if (process.platform === "win32") return "windows";
   if (cachedProbe === undefined) {
     cachedProbe = existsSync("/proc/self/stat") ? "procfs" : "ps";
   }
@@ -157,7 +159,12 @@ function defaultPsRun(pid: number): { status: number | null; stdout: string } {
  */
 export function processStartToken(pid: number): string | null {
   if (!Number.isFinite(pid) || pid <= 0) return null;
-  return startTokenProbe() === "procfs" ? procfsStartToken(pid) : psStartToken(pid);
+  const probe = startTokenProbe();
+  return probe === "windows"
+    ? windowsProcessStartToken(pid)
+    : probe === "procfs"
+      ? procfsStartToken(pid)
+      : psStartToken(pid);
 }
 
 export type ProcessGenerationVerdict = "same" | "different" | "unknown";
@@ -191,14 +198,12 @@ export function verifyProcessGeneration(
 
 export interface ProcessGenerationSignalDependencies {
   readToken?: ReadProcessStartToken;
-  kill?: (pid: number, signal: NodeJS.Signals | number) => unknown;
+  signalProcess?: typeof signalProcessWithHandle;
 }
 
 /**
- * Recheck the process generation immediately before sending the signal.
- *
- * The process can still exit and its PID can be reused between the token read
- * and the signal. Eliminating that race requires a generation-bound OS handle.
+ * Observations may refuse a signal, but only the retained native process handle
+ * can authorize it. No numeric-PID effect follows the preliminary token read.
  */
 export function signalIfSameGeneration(
   pid: number,
@@ -206,14 +211,12 @@ export function signalIfSameGeneration(
   signal: NodeJS.Signals | number,
   dependencies: ProcessGenerationSignalDependencies = {},
 ): { sent: boolean; verdict: ProcessGenerationVerdict } {
-  const kill = dependencies.kill ?? process.kill;
   const verdict = verifyProcessGeneration(pid, recordedToken, dependencies.readToken);
   if (verdict !== "same") return { sent: false, verdict };
   try {
-    kill(pid, signal);
-    return { sent: true, verdict };
+    return (dependencies.signalProcess ?? signalProcessWithHandle)(pid, recordedToken!, signal);
   } catch {
-    return { sent: false, verdict };
+    return { sent: false, verdict: "unknown" };
   }
 }
 

package/src/core/agents/state/process-handle.ts

@@ -0,0 +1,165 @@
+import { spawnSync } from "node:child_process";
+import { constants } from "node:os";
+import type { ProcessGenerationVerdict } from "./proc-start.ts";
+
+export interface ProcessHandleSignalResult {
+  sent: boolean;
+  verdict: ProcessGenerationVerdict;
+}
+
+interface NativeHelperResult extends ProcessHandleSignalResult {
+  token?: string;
+}
+
+export type NativeProcessHelperRunner = (
+  command: string,
+  args: string[],
+  options: {
+    input: string;
+    encoding: "utf8";
+    timeout: number;
+    maxBuffer: number;
+    windowsHide: boolean;
+  },
+) => { status: number | null; stdout: string | Buffer | null; error?: Error };
+
+// The helper owns the descriptor throughout observation and effect. The second
+// input line authorizes the effect; EOF releases the handle without signaling.
+export const LINUX_PROCESS_HANDLE_SCRIPT = `
+import json, os, pathlib, signal, sys
+result = {"sent": False, "verdict": "unknown"}
+fd = None
+try:
+    request = json.loads(sys.stdin.readline())
+    if not hasattr(os, "pidfd_open") or not hasattr(signal, "pidfd_send_signal"):
+        raise RuntimeError("pidfd support unavailable")
+    fd = os.pidfd_open(request["pid"])
+    stat = pathlib.Path("/proc/%d/stat" % request["pid"]).read_text()
+    ticks = stat[stat.rfind(") ") + 2:].split()[19]
+    boot = pathlib.Path("/proc/sys/kernel/random/boot_id").read_text().strip().replace("-", "")[:8]
+    token = "l%s.%s" % (boot, ticks)
+    result["token"] = token
+    recorded = request.get("token")
+    result["verdict"] = "same" if token == recorded else "different"
+    if request["mode"] == "signal" and result["verdict"] == "same":
+        print(json.dumps({"phase": "verified"}), flush=True)
+        if sys.stdin.readline().strip() == "signal":
+            signal.pidfd_send_signal(fd, request["signal"])
+            result["sent"] = True
+except Exception:
+    pass
+finally:
+    if fd is not None:
+        os.close(fd)
+print(json.dumps(result), flush=True)
+`;
+
+export const WINDOWS_PROCESS_HANDLE_SCRIPT = `
+$ErrorActionPreference = 'Stop'
+$result = @{ sent = $false; verdict = 'unknown' }
+$handle = [IntPtr]::Zero
+try {
+  Add-Type -TypeDefinition @'
+using System;
+using System.Runtime.InteropServices;
+public static class HarneryProcessHandle {
+  [DllImport("kernel32.dll", SetLastError=true)] public static extern IntPtr OpenProcess(uint access, bool inherit, uint processId);
+  [DllImport("kernel32.dll", SetLastError=true)] public static extern bool GetProcessTimes(IntPtr handle, out long creation, out long exit, out long kernel, out long user);
+  [DllImport("kernel32.dll", SetLastError=true)] public static extern bool TerminateProcess(IntPtr handle, uint exitCode);
+  [DllImport("kernel32.dll")] public static extern uint WaitForSingleObject(IntPtr handle, uint milliseconds);
+  [DllImport("kernel32.dll")] public static extern bool CloseHandle(IntPtr handle);
+}
+'@
+  $request = [Console]::In.ReadLine() | ConvertFrom-Json
+  $access = [uint32]0x101000
+  if ($request.mode -eq 'signal') { $access = $access -bor 1 }
+  $handle = [HarneryProcessHandle]::OpenProcess($access, $false, [uint32]$request.pid)
+  if ($handle -eq [IntPtr]::Zero) { throw 'process handle unavailable' }
+  [long]$creation = 0; [long]$exitTime = 0; [long]$kernel = 0; [long]$userTime = 0
+  if (-not [HarneryProcessHandle]::GetProcessTimes($handle, [ref]$creation, [ref]$exitTime, [ref]$kernel, [ref]$userTime)) { throw 'process time unavailable' }
+  $token = 'w' + $creation.ToString([Globalization.CultureInfo]::InvariantCulture)
+  $result.token = $token
+  $result.verdict = if ($token -ceq $request.token) { 'same' } else { 'different' }
+  if ($request.mode -eq 'signal' -and $result.verdict -eq 'same') {
+    [Console]::Out.WriteLine('{"phase":"verified"}')
+    [Console]::Out.Flush()
+    if ([Console]::In.ReadLine() -eq 'signal' -and [HarneryProcessHandle]::WaitForSingleObject($handle, 0) -eq 258) {
+      $result.sent = [HarneryProcessHandle]::TerminateProcess($handle, 1)
+    }
+  }
+} catch {} finally {
+  if ($handle -ne [IntPtr]::Zero) { [void][HarneryProcessHandle]::CloseHandle($handle) }
+}
+$result | ConvertTo-Json -Compress
+`;
+
+function runHelper(
+  request: { mode: "probe" | "signal"; pid: number; token?: string; signal?: number },
+  platform: NodeJS.Platform,
+  run: NativeProcessHelperRunner,
+): NativeHelperResult {
+  const unknown = { sent: false, verdict: "unknown" } as const;
+  if (!Number.isInteger(request.pid) || request.pid <= 0) return unknown;
+  if (platform !== "linux" && platform !== "win32") return unknown;
+  try {
+    const command = platform === "linux" ? "python3" : "powershell.exe";
+    const args =
+      platform === "linux"
+        ? ["-I", "-c", LINUX_PROCESS_HANDLE_SCRIPT]
+        : ["-NoLogo", "-NoProfile", "-NonInteractive", "-Command", WINDOWS_PROCESS_HANDLE_SCRIPT];
+    const output = run(command, args, {
+      input: `${JSON.stringify(request)}\nsignal\n`,
+      encoding: "utf8",
+      timeout: 10_000,
+      maxBuffer: 64 * 1024,
+      windowsHide: true,
+    });
+    if (output.error || output.status !== 0) return unknown;
+    const lines = String(output.stdout ?? "")
+      .trim()
+      .split(/\r?\n/);
+    const parsed = JSON.parse(lines.at(-1) ?? "") as NativeHelperResult;
+    if (
+      typeof parsed.sent !== "boolean" ||
+      !["same", "different", "unknown"].includes(parsed.verdict) ||
+      (parsed.sent && parsed.verdict !== "same")
+    )
+      return unknown;
+    return parsed;
+  } catch {
+    return unknown;
+  }
+}
+
+/** Windows creation FILETIME, read from an OpenProcess handle. */
+export function windowsProcessStartToken(
+  pid: number,
+  run: NativeProcessHelperRunner = spawnSync,
+): string | null {
+  const result = runHelper({ mode: "probe", pid }, "win32", run);
+  return typeof result.token === "string" && /^w\d+$/.test(result.token) ? result.token : null;
+}
+
+/** No numeric-PID signaling fallback is permitted when an exact handle fails. */
+export function signalProcessWithHandle(
+  pid: number,
+  recordedToken: string,
+  signal: NodeJS.Signals | number,
+  options: { platform?: NodeJS.Platform; run?: NativeProcessHelperRunner } = {},
+): ProcessHandleSignalResult {
+  const platform = options.platform ?? process.platform;
+  const number = typeof signal === "number" ? signal : constants.signals[signal];
+  if (
+    !Number.isInteger(number) ||
+    number <= 0 ||
+    (platform === "linux" && !/^l[0-9a-f]{8}\.\d+$/.test(recordedToken)) ||
+    (platform === "win32" && (!/^w\d+$/.test(recordedToken) || ![9, 15].includes(number)))
+  )
+    return { sent: false, verdict: "unknown" };
+  const result = runHelper(
+    { mode: "signal", pid, token: recordedToken, signal: number },
+    platform,
+    options.run ?? spawnSync,
+  );
+  return { sent: result.sent, verdict: result.verdict };
+}

package/src/core/artifacts/delivery-card.ts

@@ -14,6 +14,7 @@ import { isAbsolute, relative, resolve, sep } from "node:path";
 import { encodeLinkSafeComponent } from "../../lib/local-file-url.ts";
 import { findLiveTunnelForOrigin, tunnelServesPaths } from "../../lib/tunnel/state.ts";
 import { resolveWebPort } from "../config.ts";
+import { createTunnelReadinessVerifier } from "../servers/index.ts";
 import { stateFileMode } from "../storage/modes.ts";
 import { ARTIFACT_MANIFEST } from "./constants.ts";
 import { resolveArtifactRef, showArtifact } from "./index.ts";
@@ -330,7 +331,12 @@ function deliveryLinkBase(repoRoot: string, environment: DisplayEnvironment): st
   // route: its gate would refuse every link on the card.
   const tunnel =
     environment.tunnelUrl === undefined
-      ? findLiveTunnelForOrigin(webPort, `localhost:${webPort}`, repoRoot)
+      ? findLiveTunnelForOrigin(
+          webPort,
+          `localhost:${webPort}`,
+          repoRoot,
+          createTunnelReadinessVerifier({ coordRoot: repoRoot }),
+        )
       : null;
   const tunnelUrl =
     environment.tunnelUrl === undefined

package/src/core/resources/service.ts

@@ -1,4 +1,3 @@
-import { spawn } from "node:child_process";
 import { randomUUID } from "node:crypto";
 import {
   closeSync,
@@ -10,9 +9,10 @@ import {
   unlinkSync,
   writeFileSync,
 } from "node:fs";
-import { hostname, platform } from "node:os";
+import { hostname } from "node:os";
 import { resolve } from "node:path";
 import {
+  type ProcessGenerationSignalDependencies,
   type ProcessGenerationVerdict,
   processStartToken,
   signalIfSameGeneration,
@@ -55,80 +55,6 @@ export interface RunResourceServiceInput {
   wait?: (milliseconds: number) => Promise<void>;
 }
 
-export type EnsureResourceServiceResult =
-  | { state: "running" | "started"; status: ResourceServiceStatus }
-  | { state: "unsupported" | "unavailable"; status: ResourceServiceStatus; error: string };
-
-export async function spawnResourceService(
-  coordRootRaw: string,
-  options: { intervalMs?: number } = {},
-): Promise<ResourceServiceStatus> {
-  const coordRoot = resolve(coordRootRaw);
-  const current = readResourceServiceStatus(coordRoot);
-  if (current.liveness === "unknown") throw unknownResourceOwnerError();
-  if (current.liveness === "running") {
-    throw new Error(`resource observer is already running under pid ${current.record?.pid}`);
-  }
-  const intervalMs = normalizeInterval(options.intervalMs);
-  const paths = resourcePaths(coordRoot);
-  assertResourceLeaseAvailable(paths.lease);
-  mkdirSync(paths.root, { recursive: true, mode: stateDirMode() });
-  const harnBin = new URL("../../../bin/harn", import.meta.url).pathname;
-  if (!existsSync(harnBin)) throw new Error(`cannot find harn executable at ${harnBin}`);
-  let spawnError: Error | undefined;
-  const child = spawn(
-    harnBin,
-    ["resources", "service", "daemon", "--root", coordRoot, "--interval-ms", String(intervalMs)],
-    {
-      cwd: coordRoot,
-      detached: true,
-      stdio: ["ignore", "ignore", "ignore"],
-      env: {
-        ...process.env,
-        HARNERY_COORD_ROOT_OVERRIDE: coordRoot,
-        HARNERY_OUTPUT_SESSION_TEE: "0",
-      },
-    },
-  );
-  child.once("error", (error) => {
-    spawnError = error;
-  });
-  child.unref();
-  const deadline = Date.now() + 5_000;
-  while (Date.now() < deadline) {
-    await delay(50);
-    if (spawnError) throw spawnError;
-    const status = readResourceServiceStatus(coordRoot);
-    if (status.running && status.record?.pid === child.pid) return status;
-    if (child.exitCode !== null) break;
-  }
-  throw new Error(`resource observer failed to start; inspect ${paths.service}`);
-}
-
-export async function ensureResourceServiceRunning(
-  coordRoot: string,
-): Promise<EnsureResourceServiceResult> {
-  const status = readResourceServiceStatus(coordRoot);
-  if (status.running) return { state: "running", status };
-  if (platform() !== "linux") {
-    return {
-      state: "unsupported",
-      status,
-      error: `resource observer does not yet support ${platform()}`,
-    };
-  }
-  try {
-    const started = await spawnResourceService(coordRoot);
-    return { state: "started", status: started };
-  } catch (error) {
-    return {
-      state: "unavailable",
-      status: readResourceServiceStatus(coordRoot),
-      error: error instanceof Error ? error.message : String(error),
-    };
-  }
-}
-
 export interface ResourceServiceStopResult extends ResourceServiceStatus {
   signal_sent: boolean;
   signal_verdict: ProcessGenerationVerdict;
@@ -136,9 +62,7 @@ export interface ResourceServiceStopResult extends ResourceServiceStatus {
 
 export function requestResourceServiceStop(
   coordRootRaw: string,
-  dependencies: ResourceProcessDependencies & {
-    kill?: (pid: number, signal: NodeJS.Signals | number) => unknown;
-  } = {},
+  dependencies: ResourceProcessDependencies & ProcessGenerationSignalDependencies = {},
 ): ResourceServiceStopResult {
   const coordRoot = resolve(coordRootRaw);
   const paths = resourcePaths(coordRoot);
@@ -329,15 +253,6 @@ function leaseIsLive(lease: ResourceServiceLease): ResourceServiceStatus["livene
   return resourceProcessLiveness(lease).liveness;
 }
 
-function assertResourceLeaseAvailable(path: string): void {
-  if (!existsSync(path)) return;
-  const lease = readLease(path);
-  const liveness = lease ? leaseIsLive(lease) : "unknown";
-  if (liveness === "unknown") throw unknownResourceOwnerError();
-  if (liveness === "running")
-    throw new Error(`resource observer lease is held by pid ${lease?.pid}`);
-}
-
 function unknownResourceOwnerError(): Error {
   return new Error(
     `resource observer process identity is unknown; run ${resolveBinName()} supervisor stop to write the durable stop request before starting again`,

package/src/core/semantic/service.ts

@@ -225,19 +225,13 @@ export async function ensureSemanticServiceRunning(
 
 export function requestSemanticServiceStop(coordRootRaw: string): SemanticServiceStatus {
   const coordRoot = resolve(coordRootRaw);
-  const status = readSemanticServiceStatus(coordRoot);
   mkdirSync(semanticPaths(coordRoot).root, { recursive: true, mode: stateDirMode() });
   writePrivateJsonAtomic(semanticPaths(coordRoot).stop, {
     requested_at: new Date().toISOString(),
     requested_by_pid: process.pid,
   });
-  if (status.running && status.record?.host === hostname()) {
-    try {
-      process.kill(status.record.pid, "SIGTERM");
-    } catch {
-      // The durable stop request remains for a racing or restarted daemon.
-    }
-  }
+  // This record has no generation witness. The durable request is the stop
+  // authority; a numeric PID cannot authorize an additional signal.
   return readSemanticServiceStatus(coordRoot);
 }