harnery 0.45.0 → 0.45.1

package/dist/core/hooks/cli.js

@@ -631,6 +631,9 @@ async function main() {
     if (eventName === "runtime-context-retry") {
         return runRuntimeContextRetryWorker(coordRoot, adapter, extra);
     }
+    if (eventName === SESSION_MAINTENANCE_EVENT) {
+        return runSessionMaintenanceWorker(coordRoot, adapter);
+    }
     const ledgerRoute = resolveLiveEventLedgerRouteV3(coordRoot);
     // Always log a breadcrumb, useful when an event_type maps to null or owner
     // resolution fails. Stays cheap (one append) and self-prunes via repo log
@@ -1007,7 +1010,7 @@ function recordContextTelemetry(run) {
     }
 }
 async function handleSessionStarted(run) {
-    const { coordRoot, adapter, behavior, payload, owner, sessionId, data } = run;
+    const { coordRoot, adapter, payload, owner, sessionId, data } = run;
     // A configured backup runs out of process and is freshness-gated per host.
     // Startup never waits for restic or a remote provider; the child owns no
     // hook stdio, so the harness is not held open until it finishes. A failed
@@ -1019,53 +1022,10 @@ async function handleSessionStarted(run) {
     catch (err) {
         logError(coordRoot, err, { phase: "backup-schedule" });
     }
-    // Effect (journal-maintaining adapters): prune stale journal archives +
-    // sweep orphans. The recovery-cue is merged into the session-start
-    // additionalContext inside emitSessionStartSystemMessage.
-    if (behavior.journalMaintenance)
-        journalJanitor(coordRoot);
-    imageJanitor(coordRoot);
-    // Session start is the only caller of the artifact janitor and the storage
-    // maintenance pass, so both load here instead of on every tool call.
-    const { autoCleanArtifacts } = await import("../artifacts/index.js");
-    const { autoCleanEventV3Archives } = await import("../events/v3/archive-retention.js");
-    const { createAutomaticMaintenanceComposition, runAutomaticMaintenancePass } = await import("../storage/maintenance-providers.js");
-    // Effect: throttled hourly artifact sweep (see autoCleanArtifacts). It
-    // deletes expired workspaces, plus unheld workspaces over the per-bundle
-    // ceiling or repository budget once they have been idle past
-    // artifacts.idle_grace_hours. Each deletion is rechecked first and recorded
-    // in .harnery/artifact-deletions.jsonl. Best-effort like every janitor
-    // here: a failure logs and never blocks session start.
-    try {
-        autoCleanArtifacts(coordRoot);
-    }
-    catch (err) {
-        logError(coordRoot, err, { phase: "artifact-auto-clean" });
-    }
-    // Effect: apply the same daily throttle to closed V3 epochs. The newest
-    // recovery epochs remain protected by the archive retention policy.
-    try {
-        autoCleanEventV3Archives(coordRoot);
-    }
-    catch (err) {
-        logError(coordRoot, err, { phase: "event-v3-archive-auto-clean" });
-    }
-    // Plan one bounded, claim-first global slice from cached pressure only.
-    // Existing owner janitors above remain the only active executors until
-    // each provider receives a separate production activation.
-    try {
-        await runAutomaticMaintenancePass(createAutomaticMaintenanceComposition(coordRoot, {
-            journal: () => {
-                if (behavior.journalMaintenance)
-                    journalJanitor(coordRoot);
-            },
-            images: () => imageJanitor(coordRoot),
-            artifacts: () => autoCleanArtifacts(coordRoot),
-        }));
-    }
-    catch (err) {
-        logError(coordRoot, err, { phase: "storage-maintenance-auto" });
-    }
+    // Storage maintenance can walk large stores. It runs in a detached worker so
+    // session start emits its context without waiting for it; an adapter that
+    // stops a slow hook would otherwise drop that context entirely.
+    scheduleSessionMaintenance(coordRoot, adapter);
     let recovery = null;
     if (payload?.source === "compact") {
         try {
@@ -1518,6 +1478,76 @@ async function handleCompletedResponse(run) {
     });
     return 0;
 }
+const SESSION_MAINTENANCE_EVENT = "session-maintenance";
+function scheduleSessionMaintenance(coordRoot, adapter) {
+    const modulePath = process.argv[1];
+    if (!modulePath)
+        return;
+    try {
+        const child = spawn(process.execPath, [modulePath, SESSION_MAINTENANCE_EVENT, "--adapter", adapter], {
+            cwd: coordRoot,
+            detached: true,
+            stdio: "ignore",
+            env: childEnv(coordRoot),
+        });
+        child.unref();
+    }
+    catch (err) {
+        logError(coordRoot, err, { phase: "session-maintenance-spawn" });
+    }
+}
+/**
+ * Session-start storage maintenance, run out of the hook's process. Every step
+ * is best-effort and throttled by its own stamp: a failure logs and never
+ * reaches the session.
+ */
+async function runSessionMaintenanceWorker(coordRoot, adapter) {
+    const journalMaintenance = adapter ? adapterBehavior(adapter).journalMaintenance : false;
+    // Effect (journal-maintaining adapters): prune stale journal archives +
+    // sweep orphans. The recovery cue is read separately at session start.
+    if (journalMaintenance)
+        journalJanitor(coordRoot);
+    imageJanitor(coordRoot);
+    const { autoCleanArtifacts } = await import("../artifacts/index.js");
+    const { autoCleanEventV3Archives } = await import("../events/v3/archive-retention.js");
+    const { createAutomaticMaintenanceComposition, runAutomaticMaintenancePass } = await import("../storage/maintenance-providers.js");
+    // Effect: throttled hourly artifact sweep (see autoCleanArtifacts). It
+    // deletes expired workspaces, plus unheld workspaces over the per-bundle
+    // ceiling or repository budget once they have been idle past
+    // artifacts.idle_grace_hours. Each deletion is rechecked first and recorded
+    // in .harnery/artifact-deletions.jsonl.
+    try {
+        autoCleanArtifacts(coordRoot);
+    }
+    catch (err) {
+        logError(coordRoot, err, { phase: "artifact-auto-clean" });
+    }
+    // Effect: apply the same daily throttle to closed V3 epochs. The newest
+    // recovery epochs remain protected by the archive retention policy.
+    try {
+        autoCleanEventV3Archives(coordRoot);
+    }
+    catch (err) {
+        logError(coordRoot, err, { phase: "event-v3-archive-auto-clean" });
+    }
+    // Plan one bounded, claim-first global slice from cached pressure only.
+    // Existing owner janitors above remain the only active executors until
+    // each provider receives a separate production activation.
+    try {
+        await runAutomaticMaintenancePass(createAutomaticMaintenanceComposition(coordRoot, {
+            journal: () => {
+                if (journalMaintenance)
+                    journalJanitor(coordRoot);
+            },
+            images: () => imageJanitor(coordRoot),
+            artifacts: () => autoCleanArtifacts(coordRoot),
+        }));
+    }
+    catch (err) {
+        logError(coordRoot, err, { phase: "storage-maintenance-auto" });
+    }
+    return 0;
+}
 function scheduleRuntimeContextRetry(coordRoot, adapter, nativeSessionId) {
     const modulePath = process.argv[1];
     if (!modulePath)

package/dist/core/servers/index.d.ts

@@ -24,15 +24,14 @@ import { type ScanSupport } from "./net.js";
 export { processStartToken, signalIfSameGeneration, verifyProcessGeneration, } from "../agents/state/proc-start.js";
 export { acquireNoClobberLease } from "../workflow/workspaces/leases.js";
 export { ancestry, establishedConnectionCounts, listListeningPorts, listListeningSockets, lsofConnectionCounts, lsofListeningSockets, parseElapsed, parseLsofListen, parseProcNetTcp, processStartedAt, psProcessInfo, readProcessInfo, scanSupport, } from "./net.js";
-export { createTunnelReadinessVerifier, tunnelServerId, tunnelServerInput } from "./tunnels.js";
-export declare const SERVER_RECORD_SCHEMA_VERSION = 2;
+export { tunnelServerId, tunnelServerInput } from "./tunnels.js";
+export declare const SERVER_RECORD_SCHEMA_VERSION = 1;
 export declare const SERVER_DEFAULT_IDLE_HOURS = 2;
 export declare const SERVER_DEFAULT_OWNER_STALE_HOURS = 24;
 export type ServerKind = "service" | "session";
 export interface ServerRecord {
     schema_version: typeof SERVER_RECORD_SCHEMA_VERSION;
     id: string;
-    registration_id: string;
     kind: ServerKind;
     /** Free-form family name: `preview`, `tunnel`, `dashboard`, ... */
     type: string;
@@ -122,11 +121,13 @@ export declare function isValidServerId(id: string): boolean;
 export declare function registerServer(input: RegisterServerInput, options?: ServerOptions): ServerRecord | null;
 /** Best-effort registration that never throws (for server start paths). */
 export declare function tryRegisterServer(input: RegisterServerInput, options?: ServerOptions): ServerRecord | null;
-/** Remove only the exact registration receipt observed by the caller. */
-export declare function unregisterServer(record: ServerRecord, options?: ServerOptions): boolean;
-/** Hold the exact registration receipt until a synchronous or asynchronous effect settles. */
-export declare function withServerRegistrationCustody<T>(record: ServerRecord, options: ServerOptions, effect: () => PromiseLike<T>): Promise<T>;
-export declare function withServerRegistrationCustody<T>(record: ServerRecord, options: ServerOptions, effect: () => T): T;
+/**
+ * Remove a server's record. With `pid`, only a record still naming that pid
+ * is removed, so a replacement that re-registered the same id survives.
+ */
+export declare function unregisterServer(id: string, options?: ServerOptions & {
+    pid?: number;
+}): boolean;
 export declare function readServer(id: string, options?: ServerOptions): ServerRecord | null;
 /** Mark a server as used now. */
 export declare function touchServer(id: string, options?: ServerOptions & {
@@ -184,11 +185,13 @@ export interface StopResult {
 }
 export interface ServerProcessDependencies extends ProcessGenerationSignalDependencies {
     probePid?: (pid: number) => boolean;
+    /** Numeric signal, used for the process group and in tests. */
+    kill?: (pid: number, signal: NodeJS.Signals) => void;
 }
 /**
  * Stop a verified server with SIGTERM, then SIGKILL after the grace period.
- * Every signal targets one retained process handle, including auxiliary processes.
- * Each target requires a fresh generation check. Unknown or different generations retain the record.
+ * Each signal, including the process group and auxiliary processes, requires
+ * a fresh generation check. Unknown or different generations retain the record.
  */
 export declare function stopServer(record: ServerRecord, options?: ServerOptions & {
     graceMs?: number;

package/dist/core/servers/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/servers/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAQH,OAAO,EACL,KAAK,mCAAmC,EACxC,KAAK,wBAAwB,EAI9B,MAAM,+BAA+B,CAAC;AAUvC,OAAO,EAOL,KAAK,WAAW,EAEjB,MAAM,UAAU,CAAC;AAElB,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AACzE,OAAO,EACL,QAAQ,EACR,2BAA2B,EAC3B,kBAAkB,EAClB,oBAAoB,EACpB,oBAAoB,EACpB,oBAAoB,EACpB,YAAY,EACZ,eAAe,EACf,eAAe,EACf,gBAAgB,EAChB,aAAa,EACb,eAAe,EACf,WAAW,GACZ,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,6BAA6B,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEhG,eAAO,MAAM,4BAA4B,IAAI,CAAC;AAC9C,eAAO,MAAM,yBAAyB,IAAI,CAAC;AAC3C,eAAO,MAAM,gCAAgC,KAAK,CAAC;AAGnD,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,SAAS,CAAC;AAE/C,MAAM,WAAW,YAAY;IAC3B,cAAc,EAAE,OAAO,4BAA4B,CAAC;IACpD,EAAE,EAAE,MAAM,CAAC;IACX,eAAe,EAAE,MAAM,CAAC;IACxB,IAAI,EAAE,UAAU,CAAC;IACjB,mEAAmE;IACnE,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,uEAAuE;IACvE,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,wEAAwE;IACxE,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,2EAA2E;IAC3E,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3C,IAAI,EAAE,MAAM,CAAC;IACb,mDAAmD;IACnD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/C,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,mBAAmB;IAClC,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,UAAU,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,wFAAwF;IACxF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,2EAA2E;IAC3E,KAAK,CAAC,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CACvD;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,MAAM,GAAG,YAAY,GAAG,SAAS,CAAC;AACxE,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,WAAW,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;AAE7E,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,YAAY,CAAC;IACrB,KAAK,EAAE,WAAW,CAAC;IACnB,WAAW,EAAE,UAAU,CAAC;IACxB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE,MAAM,CAAC;IACZ,iEAAiE;IACjE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,cAAc,EAAE,CAAC,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,WAAW,CAAC;IAClB,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,YAAY,EAAE,oBAAoB,EAAE,CAAC;IACrC,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,wBAAgB,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAEpD;AAMD,2DAA2D;AAC3D,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAM7D;AASD,wBAAgB,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAEnD;AAOD;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,KAAK,EAAE,mBAAmB,EAC1B,OAAO,CAAC,EAAE,aAAa,GACtB,YAAY,GAAG,IAAI,CA8DrB;AAED,2EAA2E;AAC3E,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,mBAAmB,EAC1B,OAAO,CAAC,EAAE,aAAa,GACtB,YAAY,GAAG,IAAI,CAMrB;AAaD,yEAAyE;AACzE,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAIvF;AAED,8FAA8F;AAC9F,wBAAgB,6BAA6B,CAAC,CAAC,EAC7C,MAAM,EAAE,YAAY,EACpB,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE,MAAM,WAAW,CAAC,CAAC,CAAC,GAC3B,OAAO,CAAC,CAAC,CAAC,CAAC;AACd,wBAAgB,6BAA6B,CAAC,CAAC,EAC7C,MAAM,EAAE,YAAY,EACpB,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE,MAAM,CAAC,GACd,CAAC,CAAC;AAqFL,wBAAgB,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,YAAY,GAAG,IAAI,CAUnF;AAED,iCAAiC;AACjC,wBAAgB,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG;IAAE,GAAG,CAAC,EAAE,IAAI,CAAA;CAAE,GAAG,IAAI,CAYtF;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,MAAM,IAAI,CAYnF;AAqBD,wBAAgB,iBAAiB,CAAC,OAAO,CAAC,EAAE,aAAa,GAAG,YAAY,EAAE,CAmBzE;AAED,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAE7C;AAsBD,wBAAgB,WAAW,CACzB,MAAM,EAAE,YAAY,EACpB,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,EAC1C,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,GAClC,WAAW,CAOb;AAsBD,MAAM,WAAW,kBAAmB,SAAQ,aAAa;IACvD,6EAA6E;IAC7E,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,8DAA8D;IAC9D,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,2EAA2E;IAC3E,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AAED,iFAAiF;AACjF,wBAAgB,WAAW,CAAC,OAAO,CAAC,EAAE,kBAAkB,GAAG,aAAa,CAsDvE;AASD;;;;;GAKG;AACH,wBAAgB,yBAAyB,CACvC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,GAAG,OAAO,CAAC,CAAC,GACnD,oBAAoB,EAAE,CAmCxB;AAgBD,MAAM,WAAW,QAAQ;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE,MAAM,CAAC,EAAE,QAAQ,GAAG,UAAU,EAAE,CAiBjF;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,aAAa,GAAG,QAAQ,GAAG,SAAS,CAAC;IAC7C,UAAU,CAAC,EAAE,wBAAwB,CAAC;IACtC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,yBAA0B,SAAQ,mCAAmC;IACpF,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;CACrC;AAED;;;;GAIG;AACH,wBAAsB,UAAU,CAC9B,MAAM,EAAE,YAAY,EACpB,OAAO,CAAC,EAAE,aAAa,GAAG;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kBAAkB,CAAC,EAAE,yBAAyB,CAAC;CAChD,GACA,OAAO,CAAC,UAAU,CAAC,CAoCrB;AAgGD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,MAAM,GAAG,IAAI,CAWvF;AAED,MAAM,WAAW,YAAa,SAAQ,aAAa;IACjD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,qFAAqF;IACrF,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACxB,YAAY,CAAC,EAAE;QACb,WAAW,CAAC,EAAE,OAAO,WAAW,CAAC;QACjC,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;KAC5C,CAAC;CACH;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,YAAY,CAsC7E;AAED,oFAAoF;AACpF,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAI1D"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/servers/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAQH,OAAO,EACL,KAAK,mCAAmC,EACxC,KAAK,wBAAwB,EAI9B,MAAM,+BAA+B,CAAC;AASvC,OAAO,EAOL,KAAK,WAAW,EAEjB,MAAM,UAAU,CAAC;AAGlB,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AACzE,OAAO,EACL,QAAQ,EACR,2BAA2B,EAC3B,kBAAkB,EAClB,oBAAoB,EACpB,oBAAoB,EACpB,oBAAoB,EACpB,YAAY,EACZ,eAAe,EACf,eAAe,EACf,gBAAgB,EAChB,aAAa,EACb,eAAe,EACf,WAAW,GACZ,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEjE,eAAO,MAAM,4BAA4B,IAAI,CAAC;AAC9C,eAAO,MAAM,yBAAyB,IAAI,CAAC;AAC3C,eAAO,MAAM,gCAAgC,KAAK,CAAC;AAGnD,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,SAAS,CAAC;AAE/C,MAAM,WAAW,YAAY;IAC3B,cAAc,EAAE,OAAO,4BAA4B,CAAC;IACpD,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,UAAU,CAAC;IACjB,mEAAmE;IACnE,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,uEAAuE;IACvE,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,wEAAwE;IACxE,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,2EAA2E;IAC3E,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3C,IAAI,EAAE,MAAM,CAAC;IACb,mDAAmD;IACnD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/C,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,mBAAmB;IAClC,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,UAAU,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,wFAAwF;IACxF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,2EAA2E;IAC3E,KAAK,CAAC,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CACvD;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,MAAM,GAAG,YAAY,GAAG,SAAS,CAAC;AACxE,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,WAAW,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;AAE7E,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,YAAY,CAAC;IACrB,KAAK,EAAE,WAAW,CAAC;IACnB,WAAW,EAAE,UAAU,CAAC;IACxB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE,MAAM,CAAC;IACZ,iEAAiE;IACjE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,cAAc,EAAE,CAAC,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,WAAW,CAAC;IAClB,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,YAAY,EAAE,oBAAoB,EAAE,CAAC;IACrC,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,wBAAgB,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAEpD;AAMD,2DAA2D;AAC3D,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAM7D;AASD,wBAAgB,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAEnD;AAOD;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,KAAK,EAAE,mBAAmB,EAC1B,OAAO,CAAC,EAAE,aAAa,GACtB,YAAY,GAAG,IAAI,CA4CrB;AAED,2EAA2E;AAC3E,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,mBAAmB,EAC1B,OAAO,CAAC,EAAE,aAAa,GACtB,YAAY,GAAG,IAAI,CAMrB;AAaD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAWhG;AAED,wBAAgB,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,YAAY,GAAG,IAAI,CAInF;AAED,iCAAiC;AACjC,wBAAgB,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG;IAAE,GAAG,CAAC,EAAE,IAAI,CAAA;CAAE,GAAG,IAAI,CAUtF;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,MAAM,IAAI,CAYnF;AAmBD,wBAAgB,iBAAiB,CAAC,OAAO,CAAC,EAAE,aAAa,GAAG,YAAY,EAAE,CAazE;AAED,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAE7C;AAsBD,wBAAgB,WAAW,CACzB,MAAM,EAAE,YAAY,EACpB,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,EAC1C,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,GAClC,WAAW,CAOb;AAsBD,MAAM,WAAW,kBAAmB,SAAQ,aAAa;IACvD,6EAA6E;IAC7E,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,8DAA8D;IAC9D,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,2EAA2E;IAC3E,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AAED,iFAAiF;AACjF,wBAAgB,WAAW,CAAC,OAAO,CAAC,EAAE,kBAAkB,GAAG,aAAa,CAsDvE;AASD;;;;;GAKG;AACH,wBAAgB,yBAAyB,CACvC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,GAAG,OAAO,CAAC,CAAC,GACnD,oBAAoB,EAAE,CAmCxB;AAgBD,MAAM,WAAW,QAAQ;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE,MAAM,CAAC,EAAE,QAAQ,GAAG,UAAU,EAAE,CAiBjF;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,aAAa,GAAG,QAAQ,GAAG,SAAS,CAAC;IAC7C,UAAU,CAAC,EAAE,wBAAwB,CAAC;IACtC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,yBAA0B,SAAQ,mCAAmC;IACpF,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IACpC,+DAA+D;IAC/D,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,KAAK,IAAI,CAAC;CACtD;AAoBD;;;;GAIG;AACH,wBAAsB,UAAU,CAC9B,MAAM,EAAE,YAAY,EACpB,OAAO,CAAC,EAAE,aAAa,GAAG;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kBAAkB,CAAC,EAAE,yBAAyB,CAAC;CAChD,GACA,OAAO,CAAC,UAAU,CAAC,CAgErB;AA8CD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,MAAM,GAAG,IAAI,CAWvF;AAED,MAAM,WAAW,YAAa,SAAQ,aAAa;IACjD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,qFAAqF;IACrF,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACxB,YAAY,CAAC,EAAE;QACb,WAAW,CAAC,EAAE,OAAO,WAAW,CAAC;QACjC,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;KAC5C,CAAC;CACH;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,YAAY,CAsC7E;AAED,oFAAoF;AACpF,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAI1D"}

package/dist/core/servers/index.js

@@ -19,7 +19,7 @@
  * which `gc` never stops; a record without an owner is never stopped
  * automatically.
  */
-import { createHash, randomUUID } from "node:crypto";
+import { createHash } from "node:crypto";
 import { existsSync, mkdirSync, readdirSync, readFileSync, rmSync, statSync } from "node:fs";
 import { hostname } from "node:os";
 import { basename, isAbsolute, join, relative, resolve } from "node:path";
@@ -31,13 +31,13 @@ import { readCoordinationViewV3, requireAuthoritySafeCoordinationViewV3, } from
 import { liveInstanceIdV3 } from "../events/v3/live-route-observer.js";
 import { resolveOwner } from "../hooks/resolve/owner.js";
 import { writePrivateJsonAtomic } from "../storage/atomic-json.js";
-import { acquireNoClobberLease } from "../workflow/workspaces/leases.js";
 import { ancestry, establishedConnectionCounts, listListeningPorts, listListeningSockets, processStartedAt, readProcessInfo, scanSupport, } from "./net.js";
+// Host supervisors verify and signal their own children with the same checks.
 export { processStartToken, signalIfSameGeneration, verifyProcessGeneration, } from "../agents/state/proc-start.js";
 export { acquireNoClobberLease } from "../workflow/workspaces/leases.js";
 export { ancestry, establishedConnectionCounts, listListeningPorts, listListeningSockets, lsofConnectionCounts, lsofListeningSockets, parseElapsed, parseLsofListen, parseProcNetTcp, processStartedAt, psProcessInfo, readProcessInfo, scanSupport, } from "./net.js";
-export { createTunnelReadinessVerifier, tunnelServerId, tunnelServerInput } from "./tunnels.js";
-export const SERVER_RECORD_SCHEMA_VERSION = 2;
+export { tunnelServerId, tunnelServerInput } from "./tunnels.js";
+export const SERVER_RECORD_SCHEMA_VERSION = 1;
 export const SERVER_DEFAULT_IDLE_HOURS = 2;
 export const SERVER_DEFAULT_OWNER_STALE_HOURS = 24;
 const TOUCH_INTERVAL_MS = 60_000;
@@ -86,54 +86,40 @@ export function registerServer(input, options) {
         !(Number.isInteger(input.port) && input.port > 0 && input.port < 65536))
         throw new Error(`invalid server port: ${input.port}`);
     const id = input.id ?? serverId(input.type, input.scope);
-    return withServerMutation(coordRoot, id, () => {
-        const path = recordPath(coordRoot, id);
-        const now = new Date().toISOString();
-        const startToken = input.start_token ?? processStartToken(pid);
-        const pids = [...new Set(input.pids?.filter((p) => Number.isSafeInteger(p) && p > 0))];
-        const pidsStartTokens = {};
-        for (const auxiliaryPid of pids) {
-            const token = processStartToken(auxiliaryPid);
-            if (token)
-                pidsStartTokens[auxiliaryPid] = token;
-        }
-        const owner = input.owner === undefined ? callingOwner(coordRoot) : (input.owner ?? undefined);
-        const record = {
-            schema_version: SERVER_RECORD_SCHEMA_VERSION,
-            id,
-            registration_id: randomUUID(),
-            kind: input.kind,
-            type: input.type,
-            label: input.label ?? id,
-            ...(input.url ? { url: input.url } : {}),
-            ...(input.port ? { port: input.port } : {}),
-            pid,
-            ...(startToken ? { start_token: startToken } : {}),
-            ...(pids.length ? { pids, pids_start_tokens: pidsStartTokens } : {}),
-            host: hostname(),
-            ...(input.scope ? { scope: resolve(input.scope) } : {}),
-            ...(input.cwd ? { cwd: resolve(input.cwd) } : {}),
-            ...(input.log ? { log: resolve(input.log) } : {}),
-            ...(owner ? { owner } : {}),
-            started_at: input.started_at ?? now,
-            registered_at: now,
-            last_active_at: now,
-        };
-        if (input.start_token !== undefined &&
-            verifyProcessGeneration(pid, input.start_token) !== "same")
-            throw new Error(`pid ${pid} generation could not be verified before registration`);
-        if (existsSync(path)) {
-            const existing = readRecord(path);
-            if (!existing)
-                throw new Error(`registration ${id} custody is unknown: invalid or older server record retained`);
-            if (sameProcessCustody(existing, record) && serverState(existing) === "running")
-                return existing;
-            if (existing.host !== hostname() || !allProcessesAbsent(existing))
-                throw new Error(`registration ${id} custody is held by a live or unverifiable server`);
-        }
-        writePrivateJsonAtomic(path, record);
-        return record;
-    });
+    const now = new Date().toISOString();
+    const startToken = input.start_token ?? processStartToken(pid);
+    const pids = [...new Set(input.pids?.filter((p) => Number.isSafeInteger(p) && p > 0))];
+    const pidsStartTokens = {};
+    for (const auxiliaryPid of pids) {
+        const token = processStartToken(auxiliaryPid);
+        if (token)
+            pidsStartTokens[auxiliaryPid] = token;
+    }
+    const owner = input.owner === undefined ? callingOwner(coordRoot) : (input.owner ?? undefined);
+    const record = {
+        schema_version: SERVER_RECORD_SCHEMA_VERSION,
+        id,
+        kind: input.kind,
+        type: input.type,
+        label: input.label ?? id,
+        ...(input.url ? { url: input.url } : {}),
+        ...(input.port ? { port: input.port } : {}),
+        pid,
+        ...(startToken ? { start_token: startToken } : {}),
+        ...(pids.length ? { pids, pids_start_tokens: pidsStartTokens } : {}),
+        host: hostname(),
+        ...(input.scope ? { scope: resolve(input.scope) } : {}),
+        ...(input.cwd ? { cwd: resolve(input.cwd) } : {}),
+        ...(input.log ? { log: resolve(input.log) } : {}),
+        ...(owner ? { owner } : {}),
+        started_at: input.started_at ?? now,
+        registered_at: now,
+        last_active_at: now,
+    };
+    if (input.start_token !== undefined && verifyProcessGeneration(pid, input.start_token) !== "same")
+        throw new Error(`pid ${pid} generation could not be verified before registration`);
+    writePrivateJsonAtomic(recordPath(coordRoot, id), record);
+    return record;
 }
 /** Best-effort registration that never throws (for server start paths). */
 export function tryRegisterServer(input, options) {
@@ -156,106 +142,43 @@ function callingOwner(coordRoot) {
         return undefined;
     }
 }
-/** Remove only the exact registration receipt observed by the caller. */
-export function unregisterServer(record, options) {
+/**
+ * Remove a server's record. With `pid`, only a record still naming that pid
+ * is removed, so a replacement that re-registered the same id survives.
+ */
+export function unregisterServer(id, options) {
     const coordRoot = rootOf(options);
-    if (!coordRoot || !record || !isValidServerId(record.id))
+    if (!coordRoot || !isValidServerId(id))
         return false;
-    return withServerMutation(coordRoot, record.id, () => removeServerReceipt(coordRoot, record));
-}
-export function withServerRegistrationCustody(record, options, effect) {
-    const coordRoot = rootOf(options);
-    if (!coordRoot)
-        throw new Error("registration custody root is unavailable");
-    const lease = serverMutationLease(coordRoot, record.id);
-    try {
-        const current = readServer(record.id, { coordRoot });
-        if (!current ||
-            current.registration_id !== record.registration_id ||
-            !sameProcessCustody(current, record))
-            throw new Error(`registration ${record.id} custody changed`);
-        const result = effect();
-        if (result !== null &&
-            (typeof result === "object" || typeof result === "function") &&
-            typeof result.then === "function")
-            return Promise.resolve(result).finally(() => lease.release());
-        lease.release();
-        return result;
-    }
-    catch (error) {
-        lease.release();
-        throw error;
+    const path = recordPath(coordRoot, id);
+    if (options?.pid !== undefined) {
+        const record = readRecord(path);
+        if (record && record.pid !== options.pid)
+            return false;
     }
-}
-function removeServerReceipt(coordRoot, record) {
-    const path = recordPath(coordRoot, record.id);
-    const current = readRecord(path);
-    if (!current ||
-        current.registration_id !== record.registration_id ||
-        !sameProcessCustody(current, record))
+    if (!existsSync(path))
         return false;
-    rmSync(path);
+    rmSync(path, { force: true });
     return true;
 }
-function serverMutationLease(coordRoot, id) {
-    recordPath(coordRoot, id);
-    const scope = `server-registration-${id}`;
-    return acquireNoClobberLease({
-        path: join(serversDir(coordRoot), ".custody", id),
-        scope,
-        authoritySha256: createHash("sha256").update(scope).digest("hex"),
-        staleAfterMs: 1,
-    });
-}
-function withServerMutation(coordRoot, id, operation) {
-    const lease = serverMutationLease(coordRoot, id);
-    try {
-        return operation();
-    }
-    finally {
-        lease.release();
-    }
-}
-function sameProcessCustody(a, b) {
-    const helpers = (record) => [...new Set(record.pids ?? [])]
-        .sort((x, y) => x - y)
-        .map((pid) => [pid, record.pids_start_tokens?.[pid] ?? null]);
-    return (a.schema_version === SERVER_RECORD_SCHEMA_VERSION &&
-        b.schema_version === SERVER_RECORD_SCHEMA_VERSION &&
-        a.id === b.id &&
-        a.pid === b.pid &&
-        a.start_token === b.start_token &&
-        a.host === b.host &&
-        a.kind === b.kind &&
-        a.type === b.type &&
-        a.scope === b.scope &&
-        a.owner?.instance_id === b.owner?.instance_id &&
-        JSON.stringify(helpers(a)) === JSON.stringify(helpers(b)));
-}
 export function readServer(id, options) {
     const coordRoot = rootOf(options);
     if (!coordRoot || !isValidServerId(id))
         return null;
-    const path = recordPath(coordRoot, id);
-    const record = readRecord(path);
-    if (!record && existsSync(path))
-        throw new Error(`server record ${id} is invalid or uses an older schema; retained without custody`);
-    return record;
+    return readRecord(recordPath(coordRoot, id));
 }
 /** Mark a server as used now. */
 export function touchServer(id, options) {
     const coordRoot = rootOf(options);
     if (!coordRoot || !isValidServerId(id))
         return;
-    withServerMutation(coordRoot, id, () => {
-        const path = recordPath(coordRoot, id);
-        const record = readRecord(path);
-        if (!record)
-            return;
-        writePrivateJsonAtomic(path, {
-            ...record,
-            last_active_at: (options?.now ?? new Date()).toISOString(),
-        });
+    const path = recordPath(coordRoot, id);
+    const record = readRecord(path);
+    if (!record)
+        return;
+    writePrivateJsonAtomic(path, {
+        ...record,
+        last_active_at: (options?.now ?? new Date()).toISOString(),
     });
 }
 /**
@@ -284,8 +207,6 @@ function readRecord(path) {
         const value = JSON.parse(readFileSync(path, "utf8"));
         if (value?.schema_version !== SERVER_RECORD_SCHEMA_VERSION ||
             typeof value.id !== "string" ||
-            typeof value.registration_id !== "string" ||
-            !/^[0-9a-f-]{36}$/.test(value.registration_id) ||
             !Number.isSafeInteger(value.pid) ||
             (value.kind !== "service" && value.kind !== "session"))
             return null;
@@ -304,12 +225,8 @@ export function readServerRecords(options) {
         return [];
     return readdirSync(dir)
         .filter((name) => name.endsWith(".json"))
-        .map((name) => {
-        const record = readRecord(join(dir, name));
-        if (!record)
-            throw new Error(`server record ${name} is invalid or uses an older schema; retained without custody`);
-        return record;
-    })
+        .map((name) => readRecord(join(dir, name)))
+        .filter((record) => record !== null)
         .sort((a, b) => a.kind.localeCompare(b.kind) || a.type.localeCompare(b.type) || a.id.localeCompare(b.id));
 }
 export function pidAlive(pid) {
@@ -380,7 +297,7 @@ export function listServers(options) {
     records.forEach((record, i) => {
         const state = states[i];
         if (state === "dead" && allProcessesAbsent(record) && options?.prune !== false) {
-            unregisterServer(record, { coordRoot });
+            unregisterServer(record.id, { coordRoot, pid: record.pid });
             pruned.push(record.id);
             return;
         }
@@ -511,51 +428,28 @@ export function planServerGc(views, policy) {
         };
     });
 }
-/**
- * Stop a verified server with SIGTERM, then SIGKILL after the grace period.
- * Every signal targets one retained process handle, including auxiliary processes.
- * Each target requires a fresh generation check. Unknown or different generations retain the record.
- */
-export async function stopServer(record, options) {
-    const coordRoot = rootOf(options);
-    if (!coordRoot)
-        return {
-            id: record.id,
-            stopped: false,
-            method: "refused",
-            generation: "unknown",
-            detail: "registration custody root is unavailable",
-        };
-    let lease;
+/** Recheck the generation, then signal. A supplied `kill` replaces the handle path. */
+function signalVerified(pid, token, name, dependencies) {
+    if (!dependencies.kill)
+        return signalIfSameGeneration(pid, token, name, dependencies);
+    const verdict = verifyProcessGeneration(pid, token, dependencies.readToken);
+    if (verdict !== "same")
+        return { sent: false, verdict };
     try {
-        lease = serverMutationLease(coordRoot, record.id);
+        dependencies.kill(pid, name);
+        return { sent: true, verdict };
     }
     catch {
-        return {
-            id: record.id,
-            stopped: false,
-            method: "refused",
-            generation: "unknown",
-            detail: "registration custody is unavailable",
-        };
-    }
-    try {
-        const current = readServer(record.id, { coordRoot });
-        if (!current || current.registration_id !== record.registration_id)
-            return {
-                id: record.id,
-                stopped: false,
-                method: "refused",
-                generation: "unknown",
-                detail: "registration custody changed; retained current server",
-            };
-        return await stopServerWithCustody(record, coordRoot, options);
-    }
-    finally {
-        lease.release();
+        return { sent: false, verdict };
     }
 }
-async function stopServerWithCustody(record, coordRoot, options) {
+/**
+ * Stop a verified server with SIGTERM, then SIGKILL after the grace period.
+ * Each signal, including the process group and auxiliary processes, requires
+ * a fresh generation check. Unknown or different generations retain the record.
+ */
+export async function stopServer(record, options) {
+    const coordRoot = rootOf(options);
     const graceMs = options?.graceMs ?? 5_000;
     const dependencies = options?.signalDependencies ?? {};
     const targets = [
@@ -573,7 +467,7 @@ async function stopServerWithCustody(record, coordRoot, options) {
     });
     const finish = (result) => {
         if (result.stopped || result.method === "not-running")
-            removeServerReceipt(coordRoot, record);
+            unregisterServer(record.id, { coordRoot, pid: record.pid });
         return result;
     };
     if (record.host !== hostname())
@@ -595,9 +489,6 @@ async function stopServerWithCustody(record, coordRoot, options) {
     }
     if (targets.every((target) => processPresence(target.pid, dependencies.probePid) === "absent"))
         return finish({ id: record.id, stopped: false, method: "not-running" });
-    const current = readServer(record.id, { coordRoot });
-    if (!current || !sameProcessCustody(current, record))
-        return refuse(record.pid, "unknown");
     for (const name of ["SIGTERM", "SIGKILL"]) {
         for (const target of targets) {
             const presence = processPresence(target.pid, dependencies.probePid);
@@ -605,9 +496,11 @@ async function stopServerWithCustody(record, coordRoot, options) {
                 continue;
             if (presence === "unknown")
                 return refuse(target.pid, "unknown");
-            const result = signalIfSameGeneration(target.pid, target.token, name, dependencies);
-            if (!result.sent || result.verdict !== "same")
-                return refuse(target.pid, result.verdict === "same" ? "unknown" : result.verdict);
+            const result = target.pid === record.pid
+                ? signalServerLeader(target.pid, target.token, name, dependencies)
+                : signalVerified(target.pid, target.token, name, dependencies);
+            if (result.verdict !== "same")
+                return refuse(target.pid, result.verdict);
         }
         const observed = await waitForExit(targets, name === "SIGTERM" ? graceMs : 2_000, dependencies);
         if (observed.refused)
@@ -623,6 +516,18 @@ async function stopServerWithCustody(record, coordRoot, options) {
         detail: "process survived SIGKILL",
     };
 }
+function signalServerLeader(pid, token, name, dependencies) {
+    // The leader's generation authorizes its group. A failed group signal must
+    // not reuse that observation for the direct-PID fallback.
+    const kill = dependencies.kill ?? process.kill;
+    const group = signalVerified(pid, token, name, {
+        readToken: dependencies.readToken,
+        kill: (leader, signal) => kill(-leader, signal),
+    });
+    return group.sent || group.verdict !== "same"
+        ? group
+        : signalVerified(pid, token, name, dependencies);
+}
 async function waitForExit(targets, waitMs, dependencies) {
     const deadline = Date.now() + waitMs;
     while (true) {

package/dist/core/servers/tunnels.d.ts

@@ -2,12 +2,10 @@
  * Tunnels as registry services.
  *
  * `tunnel up` and `tunnel reload` register the new gate; `tunnel down` removes
- * its record. Missing original witnesses remain unknown and cannot authorize actions.
+ * its record. Older tunnels need an explicit adoption of an observed listener.
  */
-import { type TunnelReadinessVerifier, type TunnelState } from "../../lib/tunnel/state.js";
-import { type RegisterServerInput, type ServerOptions } from "./index.js";
-/** Verify only witnesses saved by the original tunnel registration. */
-export declare function createTunnelReadinessVerifier(options: ServerOptions): TunnelReadinessVerifier;
+import { type TunnelState } from "../../lib/tunnel/state.js";
+import type { RegisterServerInput } from "./index.js";
 export declare function tunnelServerId(name: string): string;
 /** Register the new gate; saved helper PIDs have no generation witnesses. */
 export declare function tunnelServerInput(state: TunnelState, coordRoot: string): RegisterServerInput;