harnery 0.44.0 → 0.45.1

package/src/core/events/v3/producers/coordination-recorder.ts

@@ -33,7 +33,6 @@ import { markObservedClockRegressionV3 } from "../clock-order.ts";
 import type { EventV3 } from "../contract.ts";
 import { type EventV3WriteMode, readEventV3ControlState } from "../control.ts";
 import { fingerprintContextV3 } from "../fingerprint-keys.ts";
-import { assertCurrentGenerationV3, withGenerationCustodyV3 } from "../generation-custody.ts";
 import { clockIdV3, spanIdV3 } from "../ids.ts";
 import { closeSpanStateV3, type OpenSpanStateV3, openSpanStateV3 } from "../span-state.ts";
 import { EVENT_V3_LEDGER_RELATIVE_ROOT } from "../writer.ts";
@@ -104,7 +103,6 @@ export interface RecordCoordinationAuthorityV3Input<
   bridge?: "codex-wsl";
   expected_prior_state_digest: `sha256:${string}`;
   desired_state_digest: `sha256:${string}`;
-  expected_generation_id?: `gen_${string}`;
   monotonic_ns?: string;
   observed_at?: string;
   reconciler: AuthorityReconcilerV3;
@@ -131,16 +129,6 @@ export type RecordCoordinationAuthorityV3Result =
  */
 export function recordCoordinationAuthorityV3<S extends CoordinationAuthoritySignalV3>(
   input: RecordCoordinationAuthorityV3Input<S>,
-): RecordCoordinationAuthorityV3Result {
-  return withGenerationCustodyV3(
-    input.coordRoot,
-    [input.actor_instance_id, input.subject_instance_id],
-    () => recordCoordinationAuthorityWithCustodyV3(input),
-  );
-}
-
-function recordCoordinationAuthorityWithCustodyV3<S extends CoordinationAuthoritySignalV3>(
-  input: RecordCoordinationAuthorityV3Input<S>,
 ): RecordCoordinationAuthorityV3Result {
   const control = readEventV3ControlState(input.coordRoot);
   if (control.state !== input.mode) return { state: "gate_closed", reason: control.state };
@@ -153,8 +141,6 @@ function recordCoordinationAuthorityWithCustodyV3<S extends CoordinationAuthorit
   if (
     !hook ||
     hook.terminal ||
-    (input.expected_generation_id !== undefined &&
-      hook.generation_id !== input.expected_generation_id) ||
     hook.instance_id !== input.actor_instance_id ||
     !hook.last_event_id
   ) {
@@ -342,7 +328,6 @@ function recordCoordinationAuthorityWithCustodyV3<S extends CoordinationAuthorit
       mutation: normalized.mutation,
       event: normalized.event,
     });
-    assertCurrentGenerationV3(input.coordRoot, state.actor_instance_id, state.generation_id);
     if (input.signal === "wait-ended" && waitId) delete state.open_waits[waitId];
     state.pending = { source_id: sourceId, transaction };
     publishCoordinationState(path, state);

package/src/core/events/v3/producers/recorder.ts

@@ -43,7 +43,6 @@ import { markObservedClockRegressionV3 } from "../clock-order.ts";
 import type { EventV3 } from "../contract.ts";
 import { type EventV3WriteMode, readEventV3ControlState } from "../control.ts";
 import { fingerprintContextV3 } from "../fingerprint-keys.ts";
-import { withGenerationCustodyV3 } from "../generation-custody.ts";
 import {
   attestationIdV3,
   clockIdV3,
@@ -659,17 +658,6 @@ function processHookSignalLocked(
   input: RecordHookSignalV3Input,
   sessionHash: `hid_${string}`,
   path: string,
-): RecordHookSignalV3Result {
-  return withGenerationCustodyV3(input.coordRoot, [input.instance_id], () =>
-    processHookSignalWithCustodyLocked(control, input, sessionHash, path),
-  );
-}
-
-function processHookSignalWithCustodyLocked(
-  control: OpenHookControlStateV3,
-  input: RecordHookSignalV3Input,
-  sessionHash: `hid_${string}`,
-  path: string,
 ): RecordHookSignalV3Result {
   const behavior = adapterBehavior(input.adapter);
   const rootId = control.genesis.event.scope.root_id as `root_${string}`;
@@ -3221,14 +3209,6 @@ function suppressClosedSpanSignal(
  */
 export function recordApprovedSessionEndV3(
   input: RecordApprovedSessionEndV3Input,
-): RecordApprovedSessionEndV3Result {
-  return withGenerationCustodyV3(input.coordRoot, [input.instance_id], () =>
-    recordApprovedSessionEndWithCustodyV3(input),
-  );
-}
-
-function recordApprovedSessionEndWithCustodyV3(
-  input: RecordApprovedSessionEndV3Input,
 ): RecordApprovedSessionEndV3Result {
   const control = readEventV3ControlState(input.coordRoot);
   if (control.state !== input.mode) {
@@ -3576,81 +3556,77 @@ export function reanchorArchivedHookProducersV3(
   for (const archived of listArchivedHookProducerStatesV3(input.archivedEpoch)) {
     const previous = archived.state;
     if (previous.terminal || !previous.started_event_id) continue;
-    withGenerationCustodyV3(input.coordRoot, [previous.instance_id], () => {
-      const path = producerStatePath(input.coordRoot, previous.adapter, archived.sessionHash);
-      const lease = acquireStateLeaseWithRetry(input.coordRoot, path, 40);
-      if (!lease) {
-        throw new Error(`event_v3_rotation_reanchor_busy:${previous.instance_id}`);
+    const path = producerStatePath(input.coordRoot, previous.adapter, archived.sessionHash);
+    const lease = acquireStateLeaseWithRetry(input.coordRoot, path, 40);
+    if (!lease) {
+      throw new Error(`event_v3_rotation_reanchor_busy:${previous.instance_id}`);
+    }
+    try {
+      if (existsSync(path)) {
+        const current = readProducerState(path);
+        if (current.epoch_genesis_id === genesisId) continue;
       }
-      try {
-        if (existsSync(path)) {
-          const current = readProducerState(path);
-          if (current.epoch_genesis_id === genesisId) return;
-        }
-        const sourceEvent = `${previous.adapter}.epoch-rotation-reanchor`;
-        const rotationInput: RecordHookSignalV3Input = {
-          coordRoot: input.coordRoot,
-          mode: input.mode,
-          signal: "session-start",
-          payload: {
-            raw: {},
-            ...(previous.current_native_turn_id
-              ? { turn_id: previous.current_native_turn_id }
-              : {}),
-            ...(adapterBehavior(previous.adapter).tracksExecutionMode && previous.cursor_mode
-              ? { cursor_mode: previous.cursor_mode }
-              : {}),
-          },
-          adapter: previous.adapter,
-          instance_id: previous.instance_id,
-          producer_id: "prd_agent-hook",
-          build_id: input.build_id,
-          platform: input.platform,
-          observed_at: observedAt,
-          writerOptions: { expectedGenesisId: genesisId },
-        };
-        const state = newProducerState(
-          rotationInput,
-          previous.session_id,
-          epochId,
-          boundaryEventId as `evt_${string}`,
-          genesisId,
-        );
-        const sessionStart = buildMidFlightSessionStart(rotationInput, state, rootId);
-        if (sessionStart.event_type !== "session.started") {
-          throw new Error("rotation re-anchor session start could not be normalized");
-        }
-        sessionStart.provenance = {
-          ...sessionStart.provenance,
+      const sourceEvent = `${previous.adapter}.epoch-rotation-reanchor`;
+      const rotationInput: RecordHookSignalV3Input = {
+        coordRoot: input.coordRoot,
+        mode: input.mode,
+        signal: "session-start",
+        payload: {
+          raw: {},
+          ...(previous.current_native_turn_id ? { turn_id: previous.current_native_turn_id } : {}),
+          ...(adapterBehavior(previous.adapter).tracksExecutionMode && previous.cursor_mode
+            ? { cursor_mode: previous.cursor_mode }
+            : {}),
+        },
+        adapter: previous.adapter,
+        instance_id: previous.instance_id,
+        producer_id: "prd_agent-hook",
+        build_id: input.build_id,
+        platform: input.platform,
+        observed_at: observedAt,
+        writerOptions: { expectedGenesisId: genesisId },
+      };
+      const state = newProducerState(
+        rotationInput,
+        previous.session_id,
+        epochId,
+        boundaryEventId as `evt_${string}`,
+        genesisId,
+      );
+      const sessionStart = buildMidFlightSessionStart(rotationInput, state, rootId);
+      if (sessionStart.event_type !== "session.started") {
+        throw new Error("rotation re-anchor session start could not be normalized");
+      }
+      sessionStart.provenance = {
+        ...sessionStart.provenance,
+        source_event: sourceEvent,
+        attestation: "derived",
+        confidence: "high",
+        attribution: {
+          method: "session_env",
+          state: "verified",
+          subject_instance_id: state.instance_id,
+        },
+      };
+      sessionStart.payload.resume = {
+        state: "unknown",
+        reason: "epoch_rotation_reanchor",
+      };
+      assertEventV3(sessionStart);
+      commitEventLocked(rotationInput, state, path, sessionStart);
+      sessions += 1;
+
+      if (previous.current_turn_id && previous.current_turn_span) {
+        commitMidFlightTurnStart(rotationInput, state, path, rootId, {
           source_event: sourceEvent,
-          attestation: "derived",
           confidence: "high",
-          attribution: {
-            method: "session_env",
-            state: "verified",
-            subject_instance_id: state.instance_id,
-          },
-        };
-        sessionStart.payload.resume = {
-          state: "unknown",
-          reason: "epoch_rotation_reanchor",
-        };
-        assertEventV3(sessionStart);
-        commitEventLocked(rotationInput, state, path, sessionStart);
-        sessions += 1;
-
-        if (previous.current_turn_id && previous.current_turn_span) {
-          commitMidFlightTurnStart(rotationInput, state, path, rootId, {
-            source_event: sourceEvent,
-            confidence: "high",
-            attribution_method: "session_env",
-          });
-          turns += 1;
-        }
-      } finally {
-        lease.release();
+          attribution_method: "session_env",
+        });
+        turns += 1;
       }
-    });
+    } finally {
+      lease.release();
+    }
   }
   return { sessions, turns };
 }
@@ -3888,9 +3864,7 @@ export function readJoinableHookProducerStateV3(
   instanceId: `inst_${string}`,
 ): HookProducerStateV3 | undefined {
   const direct = readHookProducerStateV3(coordRoot, adapter, nativeSessionId);
-  // A terminal native session belonging to this actor is stale authority,
-  // not permission to adopt a replacement published under the same instance.
-  if (direct?.instance_id === instanceId) return direct.terminal ? undefined : direct;
+  if (direct?.instance_id === instanceId && !direct.terminal) return direct;
   const byInstance = readHookProducerStateByInstanceV3(coordRoot, instanceId);
   return byInstance?.adapter === adapter && !byInstance.terminal ? byInstance : undefined;
 }

package/src/core/hooks/cli.ts

@@ -844,6 +844,9 @@ async function main(): Promise<number> {
   if (eventName === "runtime-context-retry") {
     return runRuntimeContextRetryWorker(coordRoot, adapter, extra);
   }
+  if (eventName === SESSION_MAINTENANCE_EVENT) {
+    return runSessionMaintenanceWorker(coordRoot, adapter);
+  }
   const ledgerRoute = resolveLiveEventLedgerRouteV3(coordRoot);
 
   // Always log a breadcrumb, useful when an event_type maps to null or owner
@@ -1274,7 +1277,7 @@ function recordContextTelemetry(run: HookRun): void {
 }
 
 async function handleSessionStarted(run: HookRun): Promise<void> {
-  const { coordRoot, adapter, behavior, payload, owner, sessionId, data } = run;
+  const { coordRoot, adapter, payload, owner, sessionId, data } = run;
   // A configured backup runs out of process and is freshness-gated per host.
   // Startup never waits for restic or a remote provider; the child owns no
   // hook stdio, so the harness is not held open until it finishes. A failed
@@ -1285,52 +1288,10 @@ async function handleSessionStarted(run: HookRun): Promise<void> {
   } catch (err) {
     logError(coordRoot, err, { phase: "backup-schedule" });
   }
-  // Effect (journal-maintaining adapters): prune stale journal archives +
-  // sweep orphans. The recovery-cue is merged into the session-start
-  // additionalContext inside emitSessionStartSystemMessage.
-  if (behavior.journalMaintenance) journalJanitor(coordRoot);
-  imageJanitor(coordRoot);
-  // Session start is the only caller of the artifact janitor and the storage
-  // maintenance pass, so both load here instead of on every tool call.
-  const { autoCleanArtifacts } = await import("../artifacts/index.ts");
-  const { autoCleanEventV3Archives } = await import("../events/v3/archive-retention.ts");
-  const { createAutomaticMaintenanceComposition, runAutomaticMaintenancePass } = await import(
-    "../storage/maintenance-providers.ts"
-  );
-  // Effect: throttled hourly artifact sweep (see autoCleanArtifacts). It
-  // deletes expired workspaces, plus unheld workspaces over the per-bundle
-  // ceiling or repository budget once they have been idle past
-  // artifacts.idle_grace_hours. Each deletion is rechecked first and recorded
-  // in .harnery/artifact-deletions.jsonl. Best-effort like every janitor
-  // here: a failure logs and never blocks session start.
-  try {
-    autoCleanArtifacts(coordRoot);
-  } catch (err) {
-    logError(coordRoot, err, { phase: "artifact-auto-clean" });
-  }
-  // Effect: apply the same daily throttle to closed V3 epochs. The newest
-  // recovery epochs remain protected by the archive retention policy.
-  try {
-    autoCleanEventV3Archives(coordRoot);
-  } catch (err) {
-    logError(coordRoot, err, { phase: "event-v3-archive-auto-clean" });
-  }
-  // Plan one bounded, claim-first global slice from cached pressure only.
-  // Existing owner janitors above remain the only active executors until
-  // each provider receives a separate production activation.
-  try {
-    await runAutomaticMaintenancePass(
-      createAutomaticMaintenanceComposition(coordRoot, {
-        journal: () => {
-          if (behavior.journalMaintenance) journalJanitor(coordRoot);
-        },
-        images: () => imageJanitor(coordRoot),
-        artifacts: () => autoCleanArtifacts(coordRoot),
-      }),
-    );
-  } catch (err) {
-    logError(coordRoot, err, { phase: "storage-maintenance-auto" });
-  }
+  // Storage maintenance can walk large stores. It runs in a detached worker so
+  // session start emits its context without waiting for it; an adapter that
+  // stops a slow hook would otherwise drop that context entirely.
+  scheduleSessionMaintenance(coordRoot, adapter);
   let recovery: PreparedContextRecovery | null = null;
   if (payload?.source === "compact") {
     try {
@@ -1814,6 +1775,83 @@ async function handleCompletedResponse(run: CompletedResponseRun): Promise<numbe
   return 0;
 }
 
+const SESSION_MAINTENANCE_EVENT = "session-maintenance";
+
+function scheduleSessionMaintenance(coordRoot: string, adapter: Adapter): void {
+  const modulePath = process.argv[1];
+  if (!modulePath) return;
+  try {
+    const child = spawn(
+      process.execPath,
+      [modulePath, SESSION_MAINTENANCE_EVENT, "--adapter", adapter],
+      {
+        cwd: coordRoot,
+        detached: true,
+        stdio: "ignore",
+        env: childEnv(coordRoot),
+      },
+    );
+    child.unref();
+  } catch (err) {
+    logError(coordRoot, err, { phase: "session-maintenance-spawn" });
+  }
+}
+
+/**
+ * Session-start storage maintenance, run out of the hook's process. Every step
+ * is best-effort and throttled by its own stamp: a failure logs and never
+ * reaches the session.
+ */
+async function runSessionMaintenanceWorker(
+  coordRoot: string,
+  adapter: Adapter | null,
+): Promise<number> {
+  const journalMaintenance = adapter ? adapterBehavior(adapter).journalMaintenance : false;
+  // Effect (journal-maintaining adapters): prune stale journal archives +
+  // sweep orphans. The recovery cue is read separately at session start.
+  if (journalMaintenance) journalJanitor(coordRoot);
+  imageJanitor(coordRoot);
+  const { autoCleanArtifacts } = await import("../artifacts/index.ts");
+  const { autoCleanEventV3Archives } = await import("../events/v3/archive-retention.ts");
+  const { createAutomaticMaintenanceComposition, runAutomaticMaintenancePass } = await import(
+    "../storage/maintenance-providers.ts"
+  );
+  // Effect: throttled hourly artifact sweep (see autoCleanArtifacts). It
+  // deletes expired workspaces, plus unheld workspaces over the per-bundle
+  // ceiling or repository budget once they have been idle past
+  // artifacts.idle_grace_hours. Each deletion is rechecked first and recorded
+  // in .harnery/artifact-deletions.jsonl.
+  try {
+    autoCleanArtifacts(coordRoot);
+  } catch (err) {
+    logError(coordRoot, err, { phase: "artifact-auto-clean" });
+  }
+  // Effect: apply the same daily throttle to closed V3 epochs. The newest
+  // recovery epochs remain protected by the archive retention policy.
+  try {
+    autoCleanEventV3Archives(coordRoot);
+  } catch (err) {
+    logError(coordRoot, err, { phase: "event-v3-archive-auto-clean" });
+  }
+  // Plan one bounded, claim-first global slice from cached pressure only.
+  // Existing owner janitors above remain the only active executors until
+  // each provider receives a separate production activation.
+  try {
+    await runAutomaticMaintenancePass(
+      createAutomaticMaintenanceComposition(coordRoot, {
+        journal: () => {
+          if (journalMaintenance) journalJanitor(coordRoot);
+        },
+        images: () => imageJanitor(coordRoot),
+        artifacts: () => autoCleanArtifacts(coordRoot),
+      }),
+    );
+  } catch (err) {
+    logError(coordRoot, err, { phase: "storage-maintenance-auto" });
+  }
+  return 0;
+}
+
 function scheduleRuntimeContextRetry(
   coordRoot: string,
   adapter: Adapter,

package/src/core/resources/service.ts

@@ -1,4 +1,3 @@
-import { spawn } from "node:child_process";
 import { randomUUID } from "node:crypto";
 import {
   closeSync,
@@ -10,9 +9,10 @@ import {
   unlinkSync,
   writeFileSync,
 } from "node:fs";
-import { hostname, platform } from "node:os";
+import { hostname } from "node:os";
 import { resolve } from "node:path";
 import {
+  type ProcessGenerationSignalDependencies,
   type ProcessGenerationVerdict,
   processStartToken,
   signalIfSameGeneration,
@@ -55,80 +55,6 @@ export interface RunResourceServiceInput {
   wait?: (milliseconds: number) => Promise<void>;
 }
 
-export type EnsureResourceServiceResult =
-  | { state: "running" | "started"; status: ResourceServiceStatus }
-  | { state: "unsupported" | "unavailable"; status: ResourceServiceStatus; error: string };
-
-export async function spawnResourceService(
-  coordRootRaw: string,
-  options: { intervalMs?: number } = {},
-): Promise<ResourceServiceStatus> {
-  const coordRoot = resolve(coordRootRaw);
-  const current = readResourceServiceStatus(coordRoot);
-  if (current.liveness === "unknown") throw unknownResourceOwnerError();
-  if (current.liveness === "running") {
-    throw new Error(`resource observer is already running under pid ${current.record?.pid}`);
-  }
-  const intervalMs = normalizeInterval(options.intervalMs);
-  const paths = resourcePaths(coordRoot);
-  assertResourceLeaseAvailable(paths.lease);
-  mkdirSync(paths.root, { recursive: true, mode: stateDirMode() });
-  const harnBin = new URL("../../../bin/harn", import.meta.url).pathname;
-  if (!existsSync(harnBin)) throw new Error(`cannot find harn executable at ${harnBin}`);
-  let spawnError: Error | undefined;
-  const child = spawn(
-    harnBin,
-    ["resources", "service", "daemon", "--root", coordRoot, "--interval-ms", String(intervalMs)],
-    {
-      cwd: coordRoot,
-      detached: true,
-      stdio: ["ignore", "ignore", "ignore"],
-      env: {
-        ...process.env,
-        HARNERY_COORD_ROOT_OVERRIDE: coordRoot,
-        HARNERY_OUTPUT_SESSION_TEE: "0",
-      },
-    },
-  );
-  child.once("error", (error) => {
-    spawnError = error;
-  });
-  child.unref();
-  const deadline = Date.now() + 5_000;
-  while (Date.now() < deadline) {
-    await delay(50);
-    if (spawnError) throw spawnError;
-    const status = readResourceServiceStatus(coordRoot);
-    if (status.running && status.record?.pid === child.pid) return status;
-    if (child.exitCode !== null) break;
-  }
-  throw new Error(`resource observer failed to start; inspect ${paths.service}`);
-}
-
-export async function ensureResourceServiceRunning(
-  coordRoot: string,
-): Promise<EnsureResourceServiceResult> {
-  const status = readResourceServiceStatus(coordRoot);
-  if (status.running) return { state: "running", status };
-  if (platform() !== "linux") {
-    return {
-      state: "unsupported",
-      status,
-      error: `resource observer does not yet support ${platform()}`,
-    };
-  }
-  try {
-    const started = await spawnResourceService(coordRoot);
-    return { state: "started", status: started };
-  } catch (error) {
-    return {
-      state: "unavailable",
-      status: readResourceServiceStatus(coordRoot),
-      error: error instanceof Error ? error.message : String(error),
-    };
-  }
-}
-
 export interface ResourceServiceStopResult extends ResourceServiceStatus {
   signal_sent: boolean;
   signal_verdict: ProcessGenerationVerdict;
@@ -136,9 +62,7 @@ export interface ResourceServiceStopResult extends ResourceServiceStatus {
 
 export function requestResourceServiceStop(
   coordRootRaw: string,
-  dependencies: ResourceProcessDependencies & {
-    kill?: (pid: number, signal: NodeJS.Signals | number) => unknown;
-  } = {},
+  dependencies: ResourceProcessDependencies & ProcessGenerationSignalDependencies = {},
 ): ResourceServiceStopResult {
   const coordRoot = resolve(coordRootRaw);
   const paths = resourcePaths(coordRoot);
@@ -329,15 +253,6 @@ function leaseIsLive(lease: ResourceServiceLease): ResourceServiceStatus["livene
   return resourceProcessLiveness(lease).liveness;
 }
 
-function assertResourceLeaseAvailable(path: string): void {
-  if (!existsSync(path)) return;
-  const lease = readLease(path);
-  const liveness = lease ? leaseIsLive(lease) : "unknown";
-  if (liveness === "unknown") throw unknownResourceOwnerError();
-  if (liveness === "running")
-    throw new Error(`resource observer lease is held by pid ${lease?.pid}`);
-}
-
 function unknownResourceOwnerError(): Error {
   return new Error(
     `resource observer process identity is unknown; run ${resolveBinName()} supervisor stop to write the durable stop request before starting again`,

package/src/core/semantic/service.ts

@@ -225,19 +225,13 @@ export async function ensureSemanticServiceRunning(
 
 export function requestSemanticServiceStop(coordRootRaw: string): SemanticServiceStatus {
   const coordRoot = resolve(coordRootRaw);
-  const status = readSemanticServiceStatus(coordRoot);
   mkdirSync(semanticPaths(coordRoot).root, { recursive: true, mode: stateDirMode() });
   writePrivateJsonAtomic(semanticPaths(coordRoot).stop, {
     requested_at: new Date().toISOString(),
     requested_by_pid: process.pid,
   });
-  if (status.running && status.record?.host === hostname()) {
-    try {
-      process.kill(status.record.pid, "SIGTERM");
-    } catch {
-      // The durable stop request remains for a racing or restarted daemon.
-    }
-  }
+  // This record has no generation witness. The durable request is the stop
+  // authority; a numeric PID cannot authorize an additional signal.
   return readSemanticServiceStatus(coordRoot);
 }
 

package/src/core/servers/index.ts

@@ -52,6 +52,13 @@ import {
   scanSupport,
 } from "./net.ts";
 
+// Host supervisors verify and signal their own children with the same checks.
+export {
+  processStartToken,
+  signalIfSameGeneration,
+  verifyProcessGeneration,
+} from "../agents/state/proc-start.ts";
+export { acquireNoClobberLease } from "../workflow/workspaces/leases.ts";
 export {
   ancestry,
   establishedConnectionCounts,
@@ -591,6 +598,26 @@ export interface StopResult {
 
 export interface ServerProcessDependencies extends ProcessGenerationSignalDependencies {
   probePid?: (pid: number) => boolean;
+  /** Numeric signal, used for the process group and in tests. */
+  kill?: (pid: number, signal: NodeJS.Signals) => void;
+}
+
+/** Recheck the generation, then signal. A supplied `kill` replaces the handle path. */
+function signalVerified(
+  pid: number,
+  token: string | undefined,
+  name: NodeJS.Signals,
+  dependencies: ServerProcessDependencies,
+): { sent: boolean; verdict: ProcessGenerationVerdict } {
+  if (!dependencies.kill) return signalIfSameGeneration(pid, token, name, dependencies);
+  const verdict = verifyProcessGeneration(pid, token, dependencies.readToken);
+  if (verdict !== "same") return { sent: false, verdict };
+  try {
+    dependencies.kill(pid, name);
+    return { sent: true, verdict };
+  } catch {
+    return { sent: false, verdict };
+  }
 }
 
 /**
@@ -653,7 +680,7 @@ export async function stopServer(
       const result =
         target.pid === record.pid
           ? signalServerLeader(target.pid, target.token, name, dependencies)
-          : signalIfSameGeneration(target.pid, target.token, name, dependencies);
+          : signalVerified(target.pid, target.token, name, dependencies);
       if (result.verdict !== "same") return refuse(target.pid, result.verdict);
     }
     const observed = await waitForExit(targets, name === "SIGTERM" ? graceMs : 2_000, dependencies);
@@ -679,13 +706,13 @@ function signalServerLeader(
   // The leader's generation authorizes its group. A failed group signal must
   // not reuse that observation for the direct-PID fallback.
   const kill = dependencies.kill ?? process.kill;
-  const group = signalIfSameGeneration(pid, token, name, {
+  const group = signalVerified(pid, token, name, {
     readToken: dependencies.readToken,
     kill: (leader, signal) => kill(-leader, signal),
   });
   return group.sent || group.verdict !== "same"
     ? group
-    : signalIfSameGeneration(pid, token, name, dependencies);
+    : signalVerified(pid, token, name, dependencies);
 }
 
 async function waitForExit(