harnery 0.44.0 → 0.45.0

package/dist/core/semantic/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../src/core/semantic/service.ts"],"names":[],"mappings":"AAoBA,OAAO,EAGL,iBAAiB,EAClB,MAAM,uBAAuB,CAAC;AAU/B,OAAO,EAAmB,KAAK,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAErE,OAAO,EAIL,KAAK,qBAAqB,EAC1B,KAAK,2BAA2B,EACjC,MAAM,qBAAqB,CAAC;AAc7B,OAAO,EACL,yBAAyB,EACzB,sCAAsC,EACtC,KAAK,wBAAwB,EAC7B,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,2BAA2B,GACjC,MAAM,qBAAqB,CAAC;AAE7B,eAAO,MAAM,oCAAoC,OAAQ,CAAC;AAC1D,eAAO,MAAM,gCAAgC,OAAQ,CAAC;AACtD,eAAO,MAAM,qCAAqC,OAAQ,CAAC;AAK3D,eAAO,MAAM,yCAAyC,QAAS,CAAC;AA2BhE,MAAM,WAAW,6BAA6B;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,iBAAiB,CAAC;IACrC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE;QAChB,SAAS,EAAE,MAAM,CAAC;QAClB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,UAAU,EAAE,MAAM,CAAC;QACnB,UAAU,EAAE,MAAM,OAAO,CAAC;KAC3B,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAClC,WAAW,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACvD;AAED,MAAM,MAAM,0BAA0B,GAClC,SAAS,GACT,SAAS,GACT,QAAQ,GACR,UAAU,GACV,aAAa,CAAC;AAElB,MAAM,WAAW,2BAA2B;IAC1C,KAAK,EAAE,0BAA0B,CAAC;IAClC,MAAM,CAAC,EAAE,qBAAqB,CAAC;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,iCAAiC;IAChD,UAAU,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,qBAAqB,CAAC;IACzD,KAAK,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAC7D,QAAQ,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC;IACzC,QAAQ,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC;CAC1C;AAED,wBAAsB,oBAAoB,CACxC,YAAY,EAAE,MAAM,EACpB,OAAO,GAAE;IAAE,YAAY,CAAC,EAAE,MAAM,CAAA;CAAO,GACtC,OAAO,CAAC,qBAAqB,CAAC,CAgDhC;AAED;;;;;;GAMG;AACH,wBAAsB,4BAA4B,CAChD,YAAY,EAAE,MAAM,EACpB,SAAS,GAAE,OAAO,CAAC,iCAAiC,CAAM,GACzD,OAAO,CAAC,2BAA2B,CAAC,CAsBtC;AAED,wBAAgB,0BAA0B,CAAC,YAAY,EAAE,MAAM,GAAG,qBAAqB,CAgBtF;AAED,wBAAsB,wBAAwB,CAC5C,KAAK,EAAE,6BAA6B,GACnC,OAAO,CAAC,2BAA2B,CAAC,CA8MtC;AAED,wBAAgB,2BAA2B,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,IAAI,CAuC5E;AAmID,wBAAgB,+BAA+B,CAC7C,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC7B,QAAQ,GAAG,QAAQ,CAerB"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../src/core/semantic/service.ts"],"names":[],"mappings":"AAoBA,OAAO,EAGL,iBAAiB,EAClB,MAAM,uBAAuB,CAAC;AAU/B,OAAO,EAAmB,KAAK,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAErE,OAAO,EAIL,KAAK,qBAAqB,EAC1B,KAAK,2BAA2B,EACjC,MAAM,qBAAqB,CAAC;AAc7B,OAAO,EACL,yBAAyB,EACzB,sCAAsC,EACtC,KAAK,wBAAwB,EAC7B,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,2BAA2B,GACjC,MAAM,qBAAqB,CAAC;AAE7B,eAAO,MAAM,oCAAoC,OAAQ,CAAC;AAC1D,eAAO,MAAM,gCAAgC,OAAQ,CAAC;AACtD,eAAO,MAAM,qCAAqC,OAAQ,CAAC;AAK3D,eAAO,MAAM,yCAAyC,QAAS,CAAC;AA2BhE,MAAM,WAAW,6BAA6B;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,iBAAiB,CAAC;IACrC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE;QAChB,SAAS,EAAE,MAAM,CAAC;QAClB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,UAAU,EAAE,MAAM,CAAC;QACnB,UAAU,EAAE,MAAM,OAAO,CAAC;KAC3B,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAClC,WAAW,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACvD;AAED,MAAM,MAAM,0BAA0B,GAClC,SAAS,GACT,SAAS,GACT,QAAQ,GACR,UAAU,GACV,aAAa,CAAC;AAElB,MAAM,WAAW,2BAA2B;IAC1C,KAAK,EAAE,0BAA0B,CAAC;IAClC,MAAM,CAAC,EAAE,qBAAqB,CAAC;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,iCAAiC;IAChD,UAAU,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,qBAAqB,CAAC;IACzD,KAAK,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAC7D,QAAQ,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC;IACzC,QAAQ,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC;CAC1C;AAED,wBAAsB,oBAAoB,CACxC,YAAY,EAAE,MAAM,EACpB,OAAO,GAAE;IAAE,YAAY,CAAC,EAAE,MAAM,CAAA;CAAO,GACtC,OAAO,CAAC,qBAAqB,CAAC,CAgDhC;AAED;;;;;;GAMG;AACH,wBAAsB,4BAA4B,CAChD,YAAY,EAAE,MAAM,EACpB,SAAS,GAAE,OAAO,CAAC,iCAAiC,CAAM,GACzD,OAAO,CAAC,2BAA2B,CAAC,CAsBtC;AAED,wBAAgB,0BAA0B,CAAC,YAAY,EAAE,MAAM,GAAG,qBAAqB,CAUtF;AAED,wBAAsB,wBAAwB,CAC5C,KAAK,EAAE,6BAA6B,GACnC,OAAO,CAAC,2BAA2B,CAAC,CA8MtC;AAED,wBAAgB,2BAA2B,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,IAAI,CAuC5E;AAmID,wBAAgB,+BAA+B,CAC7C,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC7B,QAAQ,GAAG,QAAQ,CAerB"}

package/dist/core/semantic/service.js

@@ -132,20 +132,13 @@ export async function ensureSemanticServiceRunning(coordRootRaw, overrides = {})
 }
 export function requestSemanticServiceStop(coordRootRaw) {
     const coordRoot = resolve(coordRootRaw);
-    const status = readSemanticServiceStatus(coordRoot);
     mkdirSync(semanticPaths(coordRoot).root, { recursive: true, mode: stateDirMode() });
     writePrivateJsonAtomic(semanticPaths(coordRoot).stop, {
         requested_at: new Date().toISOString(),
         requested_by_pid: process.pid,
     });
-    if (status.running && status.record?.host === hostname()) {
-        try {
-            process.kill(status.record.pid, "SIGTERM");
-        }
-        catch {
-            // The durable stop request remains for a racing or restarted daemon.
-        }
-    }
+    // This record has no generation witness. The durable request is the stop
+    // authority; a numeric PID cannot authorize an additional signal.
     return readSemanticServiceStatus(coordRoot);
 }
 export async function runSemanticServiceDaemon(input) {

package/dist/core/servers/index.d.ts

@@ -21,15 +21,18 @@
  */
 import { type ProcessGenerationSignalDependencies, type ProcessGenerationVerdict } from "../agents/state/proc-start.js";
 import { type ScanSupport } from "./net.js";
+export { processStartToken, signalIfSameGeneration, verifyProcessGeneration, } from "../agents/state/proc-start.js";
+export { acquireNoClobberLease } from "../workflow/workspaces/leases.js";
 export { ancestry, establishedConnectionCounts, listListeningPorts, listListeningSockets, lsofConnectionCounts, lsofListeningSockets, parseElapsed, parseLsofListen, parseProcNetTcp, processStartedAt, psProcessInfo, readProcessInfo, scanSupport, } from "./net.js";
-export { tunnelServerId, tunnelServerInput } from "./tunnels.js";
-export declare const SERVER_RECORD_SCHEMA_VERSION = 1;
+export { createTunnelReadinessVerifier, tunnelServerId, tunnelServerInput } from "./tunnels.js";
+export declare const SERVER_RECORD_SCHEMA_VERSION = 2;
 export declare const SERVER_DEFAULT_IDLE_HOURS = 2;
 export declare const SERVER_DEFAULT_OWNER_STALE_HOURS = 24;
 export type ServerKind = "service" | "session";
 export interface ServerRecord {
     schema_version: typeof SERVER_RECORD_SCHEMA_VERSION;
     id: string;
+    registration_id: string;
     kind: ServerKind;
     /** Free-form family name: `preview`, `tunnel`, `dashboard`, ... */
     type: string;
@@ -119,13 +122,11 @@ export declare function isValidServerId(id: string): boolean;
 export declare function registerServer(input: RegisterServerInput, options?: ServerOptions): ServerRecord | null;
 /** Best-effort registration that never throws (for server start paths). */
 export declare function tryRegisterServer(input: RegisterServerInput, options?: ServerOptions): ServerRecord | null;
-/**
- * Remove a server's record. With `pid`, only a record still naming that pid
- * is removed, so a replacement that re-registered the same id survives.
- */
-export declare function unregisterServer(id: string, options?: ServerOptions & {
-    pid?: number;
-}): boolean;
+/** Remove only the exact registration receipt observed by the caller. */
+export declare function unregisterServer(record: ServerRecord, options?: ServerOptions): boolean;
+/** Hold the exact registration receipt until a synchronous or asynchronous effect settles. */
+export declare function withServerRegistrationCustody<T>(record: ServerRecord, options: ServerOptions, effect: () => PromiseLike<T>): Promise<T>;
+export declare function withServerRegistrationCustody<T>(record: ServerRecord, options: ServerOptions, effect: () => T): T;
 export declare function readServer(id: string, options?: ServerOptions): ServerRecord | null;
 /** Mark a server as used now. */
 export declare function touchServer(id: string, options?: ServerOptions & {
@@ -186,8 +187,8 @@ export interface ServerProcessDependencies extends ProcessGenerationSignalDepend
 }
 /**
  * Stop a verified server with SIGTERM, then SIGKILL after the grace period.
- * Each signal, including the process group and auxiliary processes, requires
- * a fresh generation check. Unknown or different generations retain the record.
+ * Every signal targets one retained process handle, including auxiliary processes.
+ * Each target requires a fresh generation check. Unknown or different generations retain the record.
  */
 export declare function stopServer(record: ServerRecord, options?: ServerOptions & {
     graceMs?: number;

package/dist/core/servers/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/servers/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAQH,OAAO,EACL,KAAK,mCAAmC,EACxC,KAAK,wBAAwB,EAI9B,MAAM,+BAA+B,CAAC;AASvC,OAAO,EAOL,KAAK,WAAW,EAEjB,MAAM,UAAU,CAAC;AAElB,OAAO,EACL,QAAQ,EACR,2BAA2B,EAC3B,kBAAkB,EAClB,oBAAoB,EACpB,oBAAoB,EACpB,oBAAoB,EACpB,YAAY,EACZ,eAAe,EACf,eAAe,EACf,gBAAgB,EAChB,aAAa,EACb,eAAe,EACf,WAAW,GACZ,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEjE,eAAO,MAAM,4BAA4B,IAAI,CAAC;AAC9C,eAAO,MAAM,yBAAyB,IAAI,CAAC;AAC3C,eAAO,MAAM,gCAAgC,KAAK,CAAC;AAGnD,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,SAAS,CAAC;AAE/C,MAAM,WAAW,YAAY;IAC3B,cAAc,EAAE,OAAO,4BAA4B,CAAC;IACpD,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,UAAU,CAAC;IACjB,mEAAmE;IACnE,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,uEAAuE;IACvE,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,wEAAwE;IACxE,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,2EAA2E;IAC3E,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3C,IAAI,EAAE,MAAM,CAAC;IACb,mDAAmD;IACnD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/C,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,mBAAmB;IAClC,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,UAAU,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,wFAAwF;IACxF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,2EAA2E;IAC3E,KAAK,CAAC,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CACvD;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,MAAM,GAAG,YAAY,GAAG,SAAS,CAAC;AACxE,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,WAAW,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;AAE7E,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,YAAY,CAAC;IACrB,KAAK,EAAE,WAAW,CAAC;IACnB,WAAW,EAAE,UAAU,CAAC;IACxB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE,MAAM,CAAC;IACZ,iEAAiE;IACjE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,cAAc,EAAE,CAAC,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,WAAW,CAAC;IAClB,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,YAAY,EAAE,oBAAoB,EAAE,CAAC;IACrC,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,wBAAgB,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAEpD;AAMD,2DAA2D;AAC3D,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAM7D;AASD,wBAAgB,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAEnD;AAOD;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,KAAK,EAAE,mBAAmB,EAC1B,OAAO,CAAC,EAAE,aAAa,GACtB,YAAY,GAAG,IAAI,CA4CrB;AAED,2EAA2E;AAC3E,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,mBAAmB,EAC1B,OAAO,CAAC,EAAE,aAAa,GACtB,YAAY,GAAG,IAAI,CAMrB;AAaD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAWhG;AAED,wBAAgB,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,YAAY,GAAG,IAAI,CAInF;AAED,iCAAiC;AACjC,wBAAgB,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG;IAAE,GAAG,CAAC,EAAE,IAAI,CAAA;CAAE,GAAG,IAAI,CAUtF;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,MAAM,IAAI,CAYnF;AAmBD,wBAAgB,iBAAiB,CAAC,OAAO,CAAC,EAAE,aAAa,GAAG,YAAY,EAAE,CAazE;AAED,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAE7C;AAsBD,wBAAgB,WAAW,CACzB,MAAM,EAAE,YAAY,EACpB,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,EAC1C,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,GAClC,WAAW,CAOb;AAsBD,MAAM,WAAW,kBAAmB,SAAQ,aAAa;IACvD,6EAA6E;IAC7E,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,8DAA8D;IAC9D,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,2EAA2E;IAC3E,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AAED,iFAAiF;AACjF,wBAAgB,WAAW,CAAC,OAAO,CAAC,EAAE,kBAAkB,GAAG,aAAa,CAsDvE;AASD;;;;;GAKG;AACH,wBAAgB,yBAAyB,CACvC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,GAAG,OAAO,CAAC,CAAC,GACnD,oBAAoB,EAAE,CAmCxB;AAgBD,MAAM,WAAW,QAAQ;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE,MAAM,CAAC,EAAE,QAAQ,GAAG,UAAU,EAAE,CAiBjF;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,aAAa,GAAG,QAAQ,GAAG,SAAS,CAAC;IAC7C,UAAU,CAAC,EAAE,wBAAwB,CAAC;IACtC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,yBAA0B,SAAQ,mCAAmC;IACpF,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;CACrC;AAED;;;;GAIG;AACH,wBAAsB,UAAU,CAC9B,MAAM,EAAE,YAAY,EACpB,OAAO,CAAC,EAAE,aAAa,GAAG;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kBAAkB,CAAC,EAAE,yBAAyB,CAAC;CAChD,GACA,OAAO,CAAC,UAAU,CAAC,CAgErB;AA8CD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,MAAM,GAAG,IAAI,CAWvF;AAED,MAAM,WAAW,YAAa,SAAQ,aAAa;IACjD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,qFAAqF;IACrF,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACxB,YAAY,CAAC,EAAE;QACb,WAAW,CAAC,EAAE,OAAO,WAAW,CAAC;QACjC,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;KAC5C,CAAC;CACH;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,YAAY,CAsC7E;AAED,oFAAoF;AACpF,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAI1D"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/servers/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAQH,OAAO,EACL,KAAK,mCAAmC,EACxC,KAAK,wBAAwB,EAI9B,MAAM,+BAA+B,CAAC;AAUvC,OAAO,EAOL,KAAK,WAAW,EAEjB,MAAM,UAAU,CAAC;AAElB,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AACzE,OAAO,EACL,QAAQ,EACR,2BAA2B,EAC3B,kBAAkB,EAClB,oBAAoB,EACpB,oBAAoB,EACpB,oBAAoB,EACpB,YAAY,EACZ,eAAe,EACf,eAAe,EACf,gBAAgB,EAChB,aAAa,EACb,eAAe,EACf,WAAW,GACZ,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,6BAA6B,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEhG,eAAO,MAAM,4BAA4B,IAAI,CAAC;AAC9C,eAAO,MAAM,yBAAyB,IAAI,CAAC;AAC3C,eAAO,MAAM,gCAAgC,KAAK,CAAC;AAGnD,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,SAAS,CAAC;AAE/C,MAAM,WAAW,YAAY;IAC3B,cAAc,EAAE,OAAO,4BAA4B,CAAC;IACpD,EAAE,EAAE,MAAM,CAAC;IACX,eAAe,EAAE,MAAM,CAAC;IACxB,IAAI,EAAE,UAAU,CAAC;IACjB,mEAAmE;IACnE,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,uEAAuE;IACvE,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,wEAAwE;IACxE,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,2EAA2E;IAC3E,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3C,IAAI,EAAE,MAAM,CAAC;IACb,mDAAmD;IACnD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/C,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,mBAAmB;IAClC,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,UAAU,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,wFAAwF;IACxF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,2EAA2E;IAC3E,KAAK,CAAC,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CACvD;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,MAAM,GAAG,YAAY,GAAG,SAAS,CAAC;AACxE,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,WAAW,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;AAE7E,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,YAAY,CAAC;IACrB,KAAK,EAAE,WAAW,CAAC;IACnB,WAAW,EAAE,UAAU,CAAC;IACxB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE,MAAM,CAAC;IACZ,iEAAiE;IACjE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,cAAc,EAAE,CAAC,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,WAAW,CAAC;IAClB,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,YAAY,EAAE,oBAAoB,EAAE,CAAC;IACrC,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,wBAAgB,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAEpD;AAMD,2DAA2D;AAC3D,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAM7D;AASD,wBAAgB,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAEnD;AAOD;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,KAAK,EAAE,mBAAmB,EAC1B,OAAO,CAAC,EAAE,aAAa,GACtB,YAAY,GAAG,IAAI,CA8DrB;AAED,2EAA2E;AAC3E,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,mBAAmB,EAC1B,OAAO,CAAC,EAAE,aAAa,GACtB,YAAY,GAAG,IAAI,CAMrB;AAaD,yEAAyE;AACzE,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAIvF;AAED,8FAA8F;AAC9F,wBAAgB,6BAA6B,CAAC,CAAC,EAC7C,MAAM,EAAE,YAAY,EACpB,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE,MAAM,WAAW,CAAC,CAAC,CAAC,GAC3B,OAAO,CAAC,CAAC,CAAC,CAAC;AACd,wBAAgB,6BAA6B,CAAC,CAAC,EAC7C,MAAM,EAAE,YAAY,EACpB,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE,MAAM,CAAC,GACd,CAAC,CAAC;AAqFL,wBAAgB,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,YAAY,GAAG,IAAI,CAUnF;AAED,iCAAiC;AACjC,wBAAgB,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG;IAAE,GAAG,CAAC,EAAE,IAAI,CAAA;CAAE,GAAG,IAAI,CAYtF;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,MAAM,IAAI,CAYnF;AAqBD,wBAAgB,iBAAiB,CAAC,OAAO,CAAC,EAAE,aAAa,GAAG,YAAY,EAAE,CAmBzE;AAED,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAE7C;AAsBD,wBAAgB,WAAW,CACzB,MAAM,EAAE,YAAY,EACpB,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,EAC1C,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,GAClC,WAAW,CAOb;AAsBD,MAAM,WAAW,kBAAmB,SAAQ,aAAa;IACvD,6EAA6E;IAC7E,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,8DAA8D;IAC9D,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,2EAA2E;IAC3E,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AAED,iFAAiF;AACjF,wBAAgB,WAAW,CAAC,OAAO,CAAC,EAAE,kBAAkB,GAAG,aAAa,CAsDvE;AASD;;;;;GAKG;AACH,wBAAgB,yBAAyB,CACvC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,GAAG,OAAO,CAAC,CAAC,GACnD,oBAAoB,EAAE,CAmCxB;AAgBD,MAAM,WAAW,QAAQ;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE,MAAM,CAAC,EAAE,QAAQ,GAAG,UAAU,EAAE,CAiBjF;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,aAAa,GAAG,QAAQ,GAAG,SAAS,CAAC;IAC7C,UAAU,CAAC,EAAE,wBAAwB,CAAC;IACtC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,yBAA0B,SAAQ,mCAAmC;IACpF,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;CACrC;AAED;;;;GAIG;AACH,wBAAsB,UAAU,CAC9B,MAAM,EAAE,YAAY,EACpB,OAAO,CAAC,EAAE,aAAa,GAAG;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kBAAkB,CAAC,EAAE,yBAAyB,CAAC;CAChD,GACA,OAAO,CAAC,UAAU,CAAC,CAoCrB;AAgGD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,MAAM,GAAG,IAAI,CAWvF;AAED,MAAM,WAAW,YAAa,SAAQ,aAAa;IACjD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,qFAAqF;IACrF,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACxB,YAAY,CAAC,EAAE;QACb,WAAW,CAAC,EAAE,OAAO,WAAW,CAAC;QACjC,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;KAC5C,CAAC;CACH;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,YAAY,CAsC7E;AAED,oFAAoF;AACpF,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAI1D"}

package/dist/core/servers/index.js

@@ -19,7 +19,7 @@
  * which `gc` never stops; a record without an owner is never stopped
  * automatically.
  */
-import { createHash } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import { existsSync, mkdirSync, readdirSync, readFileSync, rmSync, statSync } from "node:fs";
 import { hostname } from "node:os";
 import { basename, isAbsolute, join, relative, resolve } from "node:path";
@@ -31,10 +31,13 @@ import { readCoordinationViewV3, requireAuthoritySafeCoordinationViewV3, } from
 import { liveInstanceIdV3 } from "../events/v3/live-route-observer.js";
 import { resolveOwner } from "../hooks/resolve/owner.js";
 import { writePrivateJsonAtomic } from "../storage/atomic-json.js";
+import { acquireNoClobberLease } from "../workflow/workspaces/leases.js";
 import { ancestry, establishedConnectionCounts, listListeningPorts, listListeningSockets, processStartedAt, readProcessInfo, scanSupport, } from "./net.js";
+export { processStartToken, signalIfSameGeneration, verifyProcessGeneration, } from "../agents/state/proc-start.js";
+export { acquireNoClobberLease } from "../workflow/workspaces/leases.js";
 export { ancestry, establishedConnectionCounts, listListeningPorts, listListeningSockets, lsofConnectionCounts, lsofListeningSockets, parseElapsed, parseLsofListen, parseProcNetTcp, processStartedAt, psProcessInfo, readProcessInfo, scanSupport, } from "./net.js";
-export { tunnelServerId, tunnelServerInput } from "./tunnels.js";
-export const SERVER_RECORD_SCHEMA_VERSION = 1;
+export { createTunnelReadinessVerifier, tunnelServerId, tunnelServerInput } from "./tunnels.js";
+export const SERVER_RECORD_SCHEMA_VERSION = 2;
 export const SERVER_DEFAULT_IDLE_HOURS = 2;
 export const SERVER_DEFAULT_OWNER_STALE_HOURS = 24;
 const TOUCH_INTERVAL_MS = 60_000;
@@ -83,40 +86,54 @@ export function registerServer(input, options) {
         !(Number.isInteger(input.port) && input.port > 0 && input.port < 65536))
         throw new Error(`invalid server port: ${input.port}`);
     const id = input.id ?? serverId(input.type, input.scope);
-    const now = new Date().toISOString();
-    const startToken = input.start_token ?? processStartToken(pid);
-    const pids = [...new Set(input.pids?.filter((p) => Number.isSafeInteger(p) && p > 0))];
-    const pidsStartTokens = {};
-    for (const auxiliaryPid of pids) {
-        const token = processStartToken(auxiliaryPid);
-        if (token)
-            pidsStartTokens[auxiliaryPid] = token;
-    }
-    const owner = input.owner === undefined ? callingOwner(coordRoot) : (input.owner ?? undefined);
-    const record = {
-        schema_version: SERVER_RECORD_SCHEMA_VERSION,
-        id,
-        kind: input.kind,
-        type: input.type,
-        label: input.label ?? id,
-        ...(input.url ? { url: input.url } : {}),
-        ...(input.port ? { port: input.port } : {}),
-        pid,
-        ...(startToken ? { start_token: startToken } : {}),
-        ...(pids.length ? { pids, pids_start_tokens: pidsStartTokens } : {}),
-        host: hostname(),
-        ...(input.scope ? { scope: resolve(input.scope) } : {}),
-        ...(input.cwd ? { cwd: resolve(input.cwd) } : {}),
-        ...(input.log ? { log: resolve(input.log) } : {}),
-        ...(owner ? { owner } : {}),
-        started_at: input.started_at ?? now,
-        registered_at: now,
-        last_active_at: now,
-    };
-    if (input.start_token !== undefined && verifyProcessGeneration(pid, input.start_token) !== "same")
-        throw new Error(`pid ${pid} generation could not be verified before registration`);
-    writePrivateJsonAtomic(recordPath(coordRoot, id), record);
-    return record;
+    return withServerMutation(coordRoot, id, () => {
+        const path = recordPath(coordRoot, id);
+        const now = new Date().toISOString();
+        const startToken = input.start_token ?? processStartToken(pid);
+        const pids = [...new Set(input.pids?.filter((p) => Number.isSafeInteger(p) && p > 0))];
+        const pidsStartTokens = {};
+        for (const auxiliaryPid of pids) {
+            const token = processStartToken(auxiliaryPid);
+            if (token)
+                pidsStartTokens[auxiliaryPid] = token;
+        }
+        const owner = input.owner === undefined ? callingOwner(coordRoot) : (input.owner ?? undefined);
+        const record = {
+            schema_version: SERVER_RECORD_SCHEMA_VERSION,
+            id,
+            registration_id: randomUUID(),
+            kind: input.kind,
+            type: input.type,
+            label: input.label ?? id,
+            ...(input.url ? { url: input.url } : {}),
+            ...(input.port ? { port: input.port } : {}),
+            pid,
+            ...(startToken ? { start_token: startToken } : {}),
+            ...(pids.length ? { pids, pids_start_tokens: pidsStartTokens } : {}),
+            host: hostname(),
+            ...(input.scope ? { scope: resolve(input.scope) } : {}),
+            ...(input.cwd ? { cwd: resolve(input.cwd) } : {}),
+            ...(input.log ? { log: resolve(input.log) } : {}),
+            ...(owner ? { owner } : {}),
+            started_at: input.started_at ?? now,
+            registered_at: now,
+            last_active_at: now,
+        };
+        if (input.start_token !== undefined &&
+            verifyProcessGeneration(pid, input.start_token) !== "same")
+            throw new Error(`pid ${pid} generation could not be verified before registration`);
+        if (existsSync(path)) {
+            const existing = readRecord(path);
+            if (!existing)
+                throw new Error(`registration ${id} custody is unknown: invalid or older server record retained`);
+            if (sameProcessCustody(existing, record) && serverState(existing) === "running")
+                return existing;
+            if (existing.host !== hostname() || !allProcessesAbsent(existing))
+                throw new Error(`registration ${id} custody is held by a live or unverifiable server`);
+        }
+        writePrivateJsonAtomic(path, record);
+        return record;
+    });
 }
 /** Best-effort registration that never throws (for server start paths). */
 export function tryRegisterServer(input, options) {
@@ -139,43 +156,106 @@ function callingOwner(coordRoot) {
         return undefined;
     }
 }
-/**
- * Remove a server's record. With `pid`, only a record still naming that pid
- * is removed, so a replacement that re-registered the same id survives.
- */
-export function unregisterServer(id, options) {
+/** Remove only the exact registration receipt observed by the caller. */
+export function unregisterServer(record, options) {
     const coordRoot = rootOf(options);
-    if (!coordRoot || !isValidServerId(id))
+    if (!coordRoot || !record || !isValidServerId(record.id))
         return false;
-    const path = recordPath(coordRoot, id);
-    if (options?.pid !== undefined) {
-        const record = readRecord(path);
-        if (record && record.pid !== options.pid)
-            return false;
+    return withServerMutation(coordRoot, record.id, () => removeServerReceipt(coordRoot, record));
+}
+export function withServerRegistrationCustody(record, options, effect) {
+    const coordRoot = rootOf(options);
+    if (!coordRoot)
+        throw new Error("registration custody root is unavailable");
+    const lease = serverMutationLease(coordRoot, record.id);
+    try {
+        const current = readServer(record.id, { coordRoot });
+        if (!current ||
+            current.registration_id !== record.registration_id ||
+            !sameProcessCustody(current, record))
+            throw new Error(`registration ${record.id} custody changed`);
+        const result = effect();
+        if (result !== null &&
+            (typeof result === "object" || typeof result === "function") &&
+            typeof result.then === "function")
+            return Promise.resolve(result).finally(() => lease.release());
+        lease.release();
+        return result;
     }
-    if (!existsSync(path))
+    catch (error) {
+        lease.release();
+        throw error;
+    }
+}
+function removeServerReceipt(coordRoot, record) {
+    const path = recordPath(coordRoot, record.id);
+    const current = readRecord(path);
+    if (!current ||
+        current.registration_id !== record.registration_id ||
+        !sameProcessCustody(current, record))
         return false;
-    rmSync(path, { force: true });
+    rmSync(path);
     return true;
 }
+function serverMutationLease(coordRoot, id) {
+    recordPath(coordRoot, id);
+    const scope = `server-registration-${id}`;
+    return acquireNoClobberLease({
+        path: join(serversDir(coordRoot), ".custody", id),
+        scope,
+        authoritySha256: createHash("sha256").update(scope).digest("hex"),
+        staleAfterMs: 1,
+    });
+}
+function withServerMutation(coordRoot, id, operation) {
+    const lease = serverMutationLease(coordRoot, id);
+    try {
+        return operation();
+    }
+    finally {
+        lease.release();
+    }
+}
+function sameProcessCustody(a, b) {
+    const helpers = (record) => [...new Set(record.pids ?? [])]
+        .sort((x, y) => x - y)
+        .map((pid) => [pid, record.pids_start_tokens?.[pid] ?? null]);
+    return (a.schema_version === SERVER_RECORD_SCHEMA_VERSION &&
+        b.schema_version === SERVER_RECORD_SCHEMA_VERSION &&
+        a.id === b.id &&
+        a.pid === b.pid &&
+        a.start_token === b.start_token &&
+        a.host === b.host &&
+        a.kind === b.kind &&
+        a.type === b.type &&
+        a.scope === b.scope &&
+        a.owner?.instance_id === b.owner?.instance_id &&
+        JSON.stringify(helpers(a)) === JSON.stringify(helpers(b)));
+}
 export function readServer(id, options) {
     const coordRoot = rootOf(options);
     if (!coordRoot || !isValidServerId(id))
         return null;
-    return readRecord(recordPath(coordRoot, id));
+    const path = recordPath(coordRoot, id);
+    const record = readRecord(path);
+    if (!record && existsSync(path))
+        throw new Error(`server record ${id} is invalid or uses an older schema; retained without custody`);
+    return record;
 }
 /** Mark a server as used now. */
 export function touchServer(id, options) {
     const coordRoot = rootOf(options);
     if (!coordRoot || !isValidServerId(id))
         return;
-    const path = recordPath(coordRoot, id);
-    const record = readRecord(path);
-    if (!record)
-        return;
-    writePrivateJsonAtomic(path, {
-        ...record,
-        last_active_at: (options?.now ?? new Date()).toISOString(),
+    withServerMutation(coordRoot, id, () => {
+        const path = recordPath(coordRoot, id);
+        const record = readRecord(path);
+        if (!record)
+            return;
+        writePrivateJsonAtomic(path, {
+            ...record,
+            last_active_at: (options?.now ?? new Date()).toISOString(),
+        });
     });
 }
 /**
@@ -204,6 +284,8 @@ function readRecord(path) {
         const value = JSON.parse(readFileSync(path, "utf8"));
         if (value?.schema_version !== SERVER_RECORD_SCHEMA_VERSION ||
             typeof value.id !== "string" ||
+            typeof value.registration_id !== "string" ||
+            !/^[0-9a-f-]{36}$/.test(value.registration_id) ||
             !Number.isSafeInteger(value.pid) ||
             (value.kind !== "service" && value.kind !== "session"))
             return null;
@@ -222,8 +304,12 @@ export function readServerRecords(options) {
         return [];
     return readdirSync(dir)
         .filter((name) => name.endsWith(".json"))
-        .map((name) => readRecord(join(dir, name)))
-        .filter((record) => record !== null)
+        .map((name) => {
+        const record = readRecord(join(dir, name));
+        if (!record)
+            throw new Error(`server record ${name} is invalid or uses an older schema; retained without custody`);
+        return record;
+    })
         .sort((a, b) => a.kind.localeCompare(b.kind) || a.type.localeCompare(b.type) || a.id.localeCompare(b.id));
 }
 export function pidAlive(pid) {
@@ -294,7 +380,7 @@ export function listServers(options) {
     records.forEach((record, i) => {
         const state = states[i];
         if (state === "dead" && allProcessesAbsent(record) && options?.prune !== false) {
-            unregisterServer(record.id, { coordRoot, pid: record.pid });
+            unregisterServer(record, { coordRoot });
             pruned.push(record.id);
             return;
         }
@@ -427,11 +513,49 @@ export function planServerGc(views, policy) {
 }
 /**
  * Stop a verified server with SIGTERM, then SIGKILL after the grace period.
- * Each signal, including the process group and auxiliary processes, requires
- * a fresh generation check. Unknown or different generations retain the record.
+ * Every signal targets one retained process handle, including auxiliary processes.
+ * Each target requires a fresh generation check. Unknown or different generations retain the record.
  */
 export async function stopServer(record, options) {
     const coordRoot = rootOf(options);
+    if (!coordRoot)
+        return {
+            id: record.id,
+            stopped: false,
+            method: "refused",
+            generation: "unknown",
+            detail: "registration custody root is unavailable",
+        };
+    let lease;
+    try {
+        lease = serverMutationLease(coordRoot, record.id);
+    }
+    catch {
+        return {
+            id: record.id,
+            stopped: false,
+            method: "refused",
+            generation: "unknown",
+            detail: "registration custody is unavailable",
+        };
+    }
+    try {
+        const current = readServer(record.id, { coordRoot });
+        if (!current || current.registration_id !== record.registration_id)
+            return {
+                id: record.id,
+                stopped: false,
+                method: "refused",
+                generation: "unknown",
+                detail: "registration custody changed; retained current server",
+            };
+        return await stopServerWithCustody(record, coordRoot, options);
+    }
+    finally {
+        lease.release();
+    }
+}
+async function stopServerWithCustody(record, coordRoot, options) {
     const graceMs = options?.graceMs ?? 5_000;
     const dependencies = options?.signalDependencies ?? {};
     const targets = [
@@ -449,7 +573,7 @@ export async function stopServer(record, options) {
     });
     const finish = (result) => {
         if (result.stopped || result.method === "not-running")
-            unregisterServer(record.id, { coordRoot, pid: record.pid });
+            removeServerReceipt(coordRoot, record);
         return result;
     };
     if (record.host !== hostname())
@@ -471,6 +595,9 @@ export async function stopServer(record, options) {
     }
     if (targets.every((target) => processPresence(target.pid, dependencies.probePid) === "absent"))
         return finish({ id: record.id, stopped: false, method: "not-running" });
+    const current = readServer(record.id, { coordRoot });
+    if (!current || !sameProcessCustody(current, record))
+        return refuse(record.pid, "unknown");
     for (const name of ["SIGTERM", "SIGKILL"]) {
         for (const target of targets) {
             const presence = processPresence(target.pid, dependencies.probePid);
@@ -478,11 +605,9 @@ export async function stopServer(record, options) {
                 continue;
             if (presence === "unknown")
                 return refuse(target.pid, "unknown");
-            const result = target.pid === record.pid
-                ? signalServerLeader(target.pid, target.token, name, dependencies)
-                : signalIfSameGeneration(target.pid, target.token, name, dependencies);
-            if (result.verdict !== "same")
-                return refuse(target.pid, result.verdict);
+            const result = signalIfSameGeneration(target.pid, target.token, name, dependencies);
+            if (!result.sent || result.verdict !== "same")
+                return refuse(target.pid, result.verdict === "same" ? "unknown" : result.verdict);
         }
         const observed = await waitForExit(targets, name === "SIGTERM" ? graceMs : 2_000, dependencies);
         if (observed.refused)
@@ -498,18 +623,6 @@ export async function stopServer(record, options) {
         detail: "process survived SIGKILL",
     };
 }
-function signalServerLeader(pid, token, name, dependencies) {
-    // The leader's generation authorizes its group. A failed group signal must
-    // not reuse that observation for the direct-PID fallback.
-    const kill = dependencies.kill ?? process.kill;
-    const group = signalIfSameGeneration(pid, token, name, {
-        readToken: dependencies.readToken,
-        kill: (leader, signal) => kill(-leader, signal),
-    });
-    return group.sent || group.verdict !== "same"
-        ? group
-        : signalIfSameGeneration(pid, token, name, dependencies);
-}
 async function waitForExit(targets, waitMs, dependencies) {
     const deadline = Date.now() + waitMs;
     while (true) {

package/dist/core/servers/tunnels.d.ts

@@ -2,10 +2,12 @@
  * Tunnels as registry services.
  *
  * `tunnel up` and `tunnel reload` register the new gate; `tunnel down` removes
- * its record. Older tunnels need an explicit adoption of an observed listener.
+ * its record. Missing original witnesses remain unknown and cannot authorize actions.
  */
-import { type TunnelState } from "../../lib/tunnel/state.js";
-import type { RegisterServerInput } from "./index.js";
+import { type TunnelReadinessVerifier, type TunnelState } from "../../lib/tunnel/state.js";
+import { type RegisterServerInput, type ServerOptions } from "./index.js";
+/** Verify only witnesses saved by the original tunnel registration. */
+export declare function createTunnelReadinessVerifier(options: ServerOptions): TunnelReadinessVerifier;
 export declare function tunnelServerId(name: string): string;
 /** Register the new gate; saved helper PIDs have no generation witnesses. */
 export declare function tunnelServerInput(state: TunnelState, coordRoot: string): RegisterServerInput;

package/dist/core/servers/tunnels.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tunnels.d.ts","sourceRoot":"","sources":["../../../src/core/servers/tunnels.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAe,KAAK,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAC1E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEtD,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED,6EAA6E;AAC7E,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,GAAG,mBAAmB,CAc5F"}
+{"version":3,"file":"tunnels.d.ts","sourceRoot":"","sources":["../../../src/core/servers/tunnels.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,EAEL,KAAK,uBAAuB,EAC5B,KAAK,WAAW,EACjB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,KAAK,mBAAmB,EAExB,KAAK,aAAa,EAGnB,MAAM,YAAY,CAAC;AAEpB,uEAAuE;AACvE,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,aAAa,GAAG,uBAAuB,CAiC7F;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED,6EAA6E;AAC7E,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,GAAG,mBAAmB,CAmB5F"}

package/dist/core/servers/tunnels.js

@@ -2,15 +2,57 @@
  * Tunnels as registry services.
  *
  * `tunnel up` and `tunnel reload` register the new gate; `tunnel down` removes
- * its record. Older tunnels need an explicit adoption of an observed listener.
+ * its record. Missing original witnesses remain unknown and cannot authorize actions.
  */
+import { hostname } from "node:os";
 import { resolve } from "node:path";
-import { gateLogFile } from "../../lib/tunnel/state.js";
+import { gateLogFile, } from "../../lib/tunnel/state.js";
+import { readServer, verifyProcessGeneration, withServerRegistrationCustody, } from "./index.js";
+/** Verify only witnesses saved by the original tunnel registration. */
+export function createTunnelReadinessVerifier(options) {
+    return {
+        observeProcess(pid, originalToken) {
+            try {
+                process.kill(pid, 0);
+            }
+            catch (error) {
+                const code = error.code;
+                if (code === "ESRCH")
+                    return "absent";
+                return "unknown";
+            }
+            return verifyProcessGeneration(pid, originalToken);
+        },
+        withRegistration(state, inspect) {
+            try {
+                const original = readServer(tunnelServerId(state.name), options);
+                if (!original ||
+                    original.host !== hostname() ||
+                    original.kind !== "service" ||
+                    original.type !== "tunnel" ||
+                    original.registration_id !== state.registration_id ||
+                    original.pid !== state.gate_pid ||
+                    original.start_token !== state.gate_start_token ||
+                    original.port !== state.gate_port ||
+                    original.url !== state.url)
+                    return "unknown";
+                return withServerRegistrationCustody(original, options, inspect);
+            }
+            catch {
+                return "unknown";
+            }
+        },
+    };
+}
 export function tunnelServerId(name) {
     return `tunnel-${name.toLowerCase().replace(/[^a-z0-9._-]+/g, "-")}`;
 }
 /** Register the new gate; saved helper PIDs have no generation witnesses. */
 export function tunnelServerInput(state, coordRoot) {
+    if (Object.hasOwn(state, "provider_pid") || Object.hasOwn(state, "provider_start_token"))
+        throw new Error("obsolete tunnel provider authority is unknown; state retained");
+    if (!state.gate_start_token)
+        throw new Error("tunnel gate generation witness is unavailable; state retained");
     return {
         id: tunnelServerId(state.name),
         kind: "service",
@@ -19,6 +61,7 @@ export function tunnelServerInput(state, coordRoot) {
         url: state.url,
         port: state.gate_port,
         pid: state.gate_pid,
+        start_token: state.gate_start_token,
         log: resolve(coordRoot, ".cache", "tunnel", gateLogFile(state.name)),
         cwd: coordRoot,
         started_at: state.started_at,

package/dist/core/supervisor/service.d.ts

@@ -1,4 +1,4 @@
-import { type ProcessGenerationVerdict } from "../agents/state/proc-start.js";
+import { type ProcessGenerationSignalDependencies, type ProcessGenerationVerdict } from "../agents/state/proc-start.js";
 import { type SupervisorServiceStatusRecord, type SupervisorStatus } from "./contract.js";
 import { type SupervisorProcessDependencies } from "./status.js";
 export declare const SUPERVISOR_DEFAULT_INTERVAL_MS = 2000;
@@ -30,8 +30,6 @@ export interface SupervisorStopResult extends SupervisorStatus {
     signal_sent: boolean;
     signal_verdict: ProcessGenerationVerdict;
 }
-export declare function requestSupervisorStop(coordRootRaw: string, dependencies?: SupervisorProcessDependencies & {
-    kill?: (pid: number, signal: NodeJS.Signals | number) => unknown;
-}): SupervisorStopResult;
+export declare function requestSupervisorStop(coordRootRaw: string, dependencies?: SupervisorProcessDependencies & ProcessGenerationSignalDependencies): SupervisorStopResult;
 export declare function runSupervisor(input: RunSupervisorInput): Promise<SupervisorServiceStatusRecord>;
 //# sourceMappingURL=service.d.ts.map

package/dist/core/supervisor/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../src/core/supervisor/service.ts"],"names":[],"mappings":"AAkBA,OAAO,EACL,KAAK,wBAAwB,EAG9B,MAAM,+BAA+B,CAAC;AAevC,OAAO,EAML,KAAK,6BAA6B,EAElC,KAAK,gBAAgB,EACtB,MAAM,eAAe,CAAC;AAavB,OAAO,EAGL,KAAK,6BAA6B,EAEnC,MAAM,aAAa,CAAC;AASrB,eAAO,MAAM,8BAA8B,OAAQ,CAAC;AACpD,eAAO,MAAM,+BAA+B,QAAa,CAAC;AAe1D,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,IAAI,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAChD;AAED,MAAM,MAAM,sBAAsB,GAC9B;IAAE,KAAK,EAAE,SAAS,GAAG,SAAS,CAAC;IAAC,MAAM,EAAE,gBAAgB,CAAA;CAAE,GAC1D;IAAE,KAAK,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,gBAAgB,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtE,wBAAsB,eAAe,CACnC,YAAY,EAAE,MAAM,EACpB,OAAO,GAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,CAAA;CAAO,GAC9E,OAAO,CAAC,gBAAgB,CAAC,CAyD3B;AAED,wBAAsB,uBAAuB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAahG;AAED,MAAM,WAAW,oBAAqB,SAAQ,gBAAgB;IAC5D,WAAW,EAAE,OAAO,CAAC;IACrB,cAAc,EAAE,wBAAwB,CAAC;CAC1C;AAED,wBAAgB,qBAAqB,CACnC,YAAY,EAAE,MAAM,EACpB,YAAY,GAAE,6BAA6B,GAAG;IAC5C,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,GAAG,MAAM,KAAK,OAAO,CAAC;CAC7D,GACL,oBAAoB,CA8BtB;AAED,wBAAsB,aAAa,CACjC,KAAK,EAAE,kBAAkB,GACxB,OAAO,CAAC,6BAA6B,CAAC,CA+QxC"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../src/core/supervisor/service.ts"],"names":[],"mappings":"AAkBA,OAAO,EACL,KAAK,mCAAmC,EACxC,KAAK,wBAAwB,EAG9B,MAAM,+BAA+B,CAAC;AAevC,OAAO,EAML,KAAK,6BAA6B,EAElC,KAAK,gBAAgB,EACtB,MAAM,eAAe,CAAC;AAavB,OAAO,EAGL,KAAK,6BAA6B,EAEnC,MAAM,aAAa,CAAC;AASrB,eAAO,MAAM,8BAA8B,OAAQ,CAAC;AACpD,eAAO,MAAM,+BAA+B,QAAa,CAAC;AAe1D,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,IAAI,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAChD;AAED,MAAM,MAAM,sBAAsB,GAC9B;IAAE,KAAK,EAAE,SAAS,GAAG,SAAS,CAAC;IAAC,MAAM,EAAE,gBAAgB,CAAA;CAAE,GAC1D;IAAE,KAAK,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,gBAAgB,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtE,wBAAsB,eAAe,CACnC,YAAY,EAAE,MAAM,EACpB,OAAO,GAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,CAAA;CAAO,GAC9E,OAAO,CAAC,gBAAgB,CAAC,CAyD3B;AAED,wBAAsB,uBAAuB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAahG;AAED,MAAM,WAAW,oBAAqB,SAAQ,gBAAgB;IAC5D,WAAW,EAAE,OAAO,CAAC;IACrB,cAAc,EAAE,wBAAwB,CAAC;CAC1C;AAED,wBAAgB,qBAAqB,CACnC,YAAY,EAAE,MAAM,EACpB,YAAY,GAAE,6BAA6B,GAAG,mCAAwC,GACrF,oBAAoB,CA8BtB;AAED,wBAAsB,aAAa,CACjC,KAAK,EAAE,kBAAkB,GACxB,OAAO,CAAC,6BAA6B,CAAC,CA+QxC"}