harnery 0.45.0 → 0.45.1

package/dist/core/servers/tunnels.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tunnels.d.ts","sourceRoot":"","sources":["../../../src/core/servers/tunnels.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,EAEL,KAAK,uBAAuB,EAC5B,KAAK,WAAW,EACjB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,KAAK,mBAAmB,EAExB,KAAK,aAAa,EAGnB,MAAM,YAAY,CAAC;AAEpB,uEAAuE;AACvE,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,aAAa,GAAG,uBAAuB,CAiC7F;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED,6EAA6E;AAC7E,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,GAAG,mBAAmB,CAmB5F"}
+{"version":3,"file":"tunnels.d.ts","sourceRoot":"","sources":["../../../src/core/servers/tunnels.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAe,KAAK,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAC1E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEtD,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED,6EAA6E;AAC7E,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,GAAG,mBAAmB,CAc5F"}

package/dist/core/servers/tunnels.js

@@ -2,57 +2,15 @@
  * Tunnels as registry services.
  *
  * `tunnel up` and `tunnel reload` register the new gate; `tunnel down` removes
- * its record. Missing original witnesses remain unknown and cannot authorize actions.
+ * its record. Older tunnels need an explicit adoption of an observed listener.
  */
-import { hostname } from "node:os";
 import { resolve } from "node:path";
-import { gateLogFile, } from "../../lib/tunnel/state.js";
-import { readServer, verifyProcessGeneration, withServerRegistrationCustody, } from "./index.js";
-/** Verify only witnesses saved by the original tunnel registration. */
-export function createTunnelReadinessVerifier(options) {
-    return {
-        observeProcess(pid, originalToken) {
-            try {
-                process.kill(pid, 0);
-            }
-            catch (error) {
-                const code = error.code;
-                if (code === "ESRCH")
-                    return "absent";
-                return "unknown";
-            }
-            return verifyProcessGeneration(pid, originalToken);
-        },
-        withRegistration(state, inspect) {
-            try {
-                const original = readServer(tunnelServerId(state.name), options);
-                if (!original ||
-                    original.host !== hostname() ||
-                    original.kind !== "service" ||
-                    original.type !== "tunnel" ||
-                    original.registration_id !== state.registration_id ||
-                    original.pid !== state.gate_pid ||
-                    original.start_token !== state.gate_start_token ||
-                    original.port !== state.gate_port ||
-                    original.url !== state.url)
-                    return "unknown";
-                return withServerRegistrationCustody(original, options, inspect);
-            }
-            catch {
-                return "unknown";
-            }
-        },
-    };
-}
+import { gateLogFile } from "../../lib/tunnel/state.js";
 export function tunnelServerId(name) {
     return `tunnel-${name.toLowerCase().replace(/[^a-z0-9._-]+/g, "-")}`;
 }
 /** Register the new gate; saved helper PIDs have no generation witnesses. */
 export function tunnelServerInput(state, coordRoot) {
-    if (Object.hasOwn(state, "provider_pid") || Object.hasOwn(state, "provider_start_token"))
-        throw new Error("obsolete tunnel provider authority is unknown; state retained");
-    if (!state.gate_start_token)
-        throw new Error("tunnel gate generation witness is unavailable; state retained");
     return {
         id: tunnelServerId(state.name),
         kind: "service",
@@ -61,7 +19,6 @@ export function tunnelServerInput(state, coordRoot) {
         url: state.url,
         port: state.gate_port,
         pid: state.gate_pid,
-        start_token: state.gate_start_token,
         log: resolve(coordRoot, ".cache", "tunnel", gateLogFile(state.name)),
         cwd: coordRoot,
         started_at: state.started_at,

package/dist/core/storage/durable-history.js

@@ -394,31 +394,55 @@ function acquireLease(lease) {
             pid: process.pid,
             acquired_at: new Date().toISOString(),
         };
-        let claimed;
-        try {
-            mkdirSync(lease, { mode: stateDirMode() });
-            assertDirectoryWithinParent(lease, parent);
-            claimed = captureDirectoryIdentity(lease);
-            writeOwner(join(lease, "owner.json"), owner);
-            syncDirectory(claimed);
+        if (claimLease(lease, parent, owner))
             return owner;
+        if (recoverStaleLease(lease, DURABLE_HISTORY_LEASE_STALE_MS))
+            continue;
+        throw new Error(`durable history lease busy: ${lease}`);
+    }
+    throw new Error(`durable history lease busy: ${lease}`);
+}
+/**
+ * Publish a complete lease in one rename. The owner record is written and synced
+ * in a private claim directory first, so a writer stopped at any point leaves
+ * either no lease or one with an owner. A held lease always has an owner record,
+ * here and in the earlier create-then-write protocol, so a rename that replaces
+ * an empty lease directory never takes a held lease. A lease with any entry makes
+ * the rename fail and the caller reports it busy.
+ */
+function claimLease(lease, parent, owner) {
+    const claim = `${lease}.claim-${process.pid}-${owner.owner_id}`;
+    try {
+        mkdirSync(claim, { mode: stateDirMode() });
+        assertDirectoryWithinParent(claim, parent);
+        const claimed = captureDirectoryIdentity(claim);
+        writeOwner(join(claim, "owner.json"), owner);
+        syncDirectory(claimed);
+        renameSync(claim, lease);
+    }
+    catch {
+        return false;
+    }
+    finally {
+        try {
+            rmSync(claim, { recursive: true, force: true });
         }
         catch {
-            if (claimed) {
-                try {
-                    assertDirectoryIdentity(claimed);
-                    rmSync(lease, { recursive: true, force: false });
-                }
-                catch {
-                    // Never remove a lease after its directory identity changes.
-                }
-            }
-            if (recoverStaleLease(lease, DURABLE_HISTORY_LEASE_STALE_MS))
-                continue;
-            throw new Error(`durable history lease busy: ${lease}`);
+            // A leftover claim directory never blocks a lease.
         }
     }
-    throw new Error(`durable history lease busy: ${lease}`);
+    try {
+        assertDirectoryWithinParent(lease, parent);
+        const current = JSON.parse(completeJsonl(join(lease, "owner.json")));
+        if (current.owner_id !== owner.owner_id)
+            return false;
+        syncDirectory(parent);
+        return true;
+    }
+    catch {
+        releaseOwnedLease(lease, owner);
+        return false;
+    }
 }
 function writeOwner(path, owner) {
     const parent = captureDirectoryIdentity(dirname(path));
@@ -468,7 +492,7 @@ function recoverStaleLease(lease, staleMs) {
         assertDirectoryIdentity(leaseIdentity);
         if (completeJsonl(ownerPath) !== raw)
             return false;
-        rmSync(lease, { recursive: true, force: false });
+        retireLease(lease, randomUUID());
         return true;
     }
     catch {
@@ -480,12 +504,22 @@ function releaseOwnedLease(lease, owner) {
         const current = JSON.parse(completeJsonl(join(lease, "owner.json")));
         if (current.owner_id !== owner.owner_id)
             return;
-        rmSync(lease, { recursive: true, force: false });
+        retireLease(lease, owner.owner_id);
     }
     catch {
         // A missing or replaced lease does not belong to this operation.
     }
 }
+/**
+ * Move a lease aside before deleting it. Its path goes from held to absent in
+ * one rename and is never an empty directory that a concurrent claim could
+ * replace while a recursive removal is still running.
+ */
+function retireLease(lease, tag) {
+    const retired = `${lease}.retired-${process.pid}-${tag}`;
+    renameSync(lease, retired);
+    rmSync(retired, { recursive: true, force: true });
+}
 function processIsAlive(pid) {
     try {
         process.kill(pid, 0);

package/dist/core/storage/segments.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"segments.d.ts","sourceRoot":"","sources":["../../../src/core/storage/segments.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,eAAe,CAAC;AAEpE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAI3D,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,yBAAyB,CAAC;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,oEAAoE;IACpE,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,SAAS,mBAAmB,EAAE,CAAC;CAC1C;AAED,MAAM,WAAW,4BAA4B;IAC3C,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,8BAA8B,CAAC;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,EAAE,MAAM,CAAC;IACvB,8DAA8D;IAC9D,oBAAoB,EAAE,MAAM,CAAC;IAC7B,iEAAiE;IACjE,uBAAuB,EAAE,MAAM,CAAC;IAChC,2EAA2E;IAC3E,6BAA6B,EAAE,MAAM,CAAC;IACtC,6EAA6E;IAC7E,2BAA2B,EAAE,MAAM,CAAC;IACpC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,wEAAwE;IACxE,qBAAqB,CAAC,EAAE,MAAM,IAAI,CAAC;CACpC;AAED,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,8BAA8B,CAAC;IACvC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,wEAAwE;IACxE,UAAU,CAAC,EAAE,gBAAgB,CAAC;CAC/B;AAED,MAAM,MAAM,gBAAgB,GAAG,CAC7B,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,KACX,MAAM,CAAC;AAEZ,MAAM,WAAW,mBAAmB;IAClC,gBAAgB,EAAE,MAAM,CAAC;IACzB,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;CACjB;AAcD,qBAAa,oBAAqB,SAAQ,KAAK;IAE3C,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,YAAY,GAAG,eAAe;gBAAlD,MAAM,EAAE,SAAS,GAAG,YAAY,GAAG,eAAe,EAC3D,OAAO,EAAE,MAAM;CAKlB;AAED,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,8BAA8B,GAAG,MAAM,CAMjF;AAED,qBAAa,eAAe;;gBAGd,OAAO,EAAE,oBAAoB;IAmBnC,MAAM,CACV,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,OAAO,GAAE,sBAA2B,EACpC,OAAO,UAAQ,EACf,GAAG,OAAa,GACf,OAAO,CAAC,mBAAmB,CAAC;CA4ChC;AAED,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,8BAA8B,GACtC,oBAAoB,CAyCtB;AAED,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,oBAAoB,GAAG,MAAM,CAE7E;AAED;;;;GAIG;AACH,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,4BAA4B,GACpC,OAAO,CAAC,SAAS,GAAG,iBAAiB,CAAC,CAuExC;AAED,wBAAsB,eAAe,CAAC,CAAC,EACrC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE;IAAE,gBAAgB,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,EACpF,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAC9B,OAAO,CAAC,CAAC,CAAC,CAkCZ"}
+{"version":3,"file":"segments.d.ts","sourceRoot":"","sources":["../../../src/core/storage/segments.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,eAAe,CAAC;AAEpE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAI3D,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,yBAAyB,CAAC;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,oEAAoE;IACpE,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,SAAS,mBAAmB,EAAE,CAAC;CAC1C;AAED,MAAM,WAAW,4BAA4B;IAC3C,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,8BAA8B,CAAC;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,EAAE,MAAM,CAAC;IACvB,8DAA8D;IAC9D,oBAAoB,EAAE,MAAM,CAAC;IAC7B,iEAAiE;IACjE,uBAAuB,EAAE,MAAM,CAAC;IAChC,2EAA2E;IAC3E,6BAA6B,EAAE,MAAM,CAAC;IACtC,6EAA6E;IAC7E,2BAA2B,EAAE,MAAM,CAAC;IACpC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,wEAAwE;IACxE,qBAAqB,CAAC,EAAE,MAAM,IAAI,CAAC;CACpC;AAED,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,8BAA8B,CAAC;IACvC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,wEAAwE;IACxE,UAAU,CAAC,EAAE,gBAAgB,CAAC;CAC/B;AAED,MAAM,MAAM,gBAAgB,GAAG,CAC7B,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,KACX,MAAM,CAAC;AAEZ,MAAM,WAAW,mBAAmB;IAClC,gBAAgB,EAAE,MAAM,CAAC;IACzB,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;CACjB;AAcD,qBAAa,oBAAqB,SAAQ,KAAK;IAE3C,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,YAAY,GAAG,eAAe;gBAAlD,MAAM,EAAE,SAAS,GAAG,YAAY,GAAG,eAAe,EAC3D,OAAO,EAAE,MAAM;CAKlB;AAED,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,8BAA8B,GAAG,MAAM,CAMjF;AAED,qBAAa,eAAe;;gBAGd,OAAO,EAAE,oBAAoB;IAmBnC,MAAM,CACV,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,OAAO,GAAE,sBAA2B,EACpC,OAAO,UAAQ,EACf,GAAG,OAAa,GACf,OAAO,CAAC,mBAAmB,CAAC;CA4ChC;AAED,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,8BAA8B,GACtC,oBAAoB,CAyCtB;AAED,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,oBAAoB,GAAG,MAAM,CAE7E;AAED;;;;GAIG;AACH,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,4BAA4B,GACpC,OAAO,CAAC,SAAS,GAAG,iBAAiB,CAAC,CAuExC;AAED,wBAAsB,eAAe,CAAC,CAAC,EACrC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE;IAAE,gBAAgB,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,EACpF,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAC9B,OAAO,CAAC,CAAC,CAAC,CA+BZ"}

package/dist/core/storage/segments.js

@@ -191,25 +191,19 @@ export async function withFamilyLease(directory, policy, operation) {
     let owner;
     while (true) {
         try {
-            mkdirSync(lease, { mode: stateDirMode() });
-            const leaseIdentity = captureDirectoryIdentity(lease);
-            owner = {
-                owner_id: randomUUID(),
-                pid: process.pid,
-                acquired_at: new Date().toISOString(),
-            };
-            writeNewFile(join(lease, "owner.json"), Buffer.from(`${JSON.stringify(owner)}\n`));
-            assertDirectoryIdentity(leaseIdentity);
+            owner = claimLease(lease);
             break;
         }
         catch (error) {
-            if (pathExists(lease) && !safeLeaseDirectory(lease)) {
+            if (leaseHasWrongType(lease)) {
                 throw new HarneryLogLeaseError("wrong_type", `log lease is not a directory: ${lease}`);
             }
             if (recoverStaleLease(lease, policy.lease_stale_ms))
                 continue;
             if (Date.now() - started >= policy.lease_timeout_ms) {
-                throw new HarneryLogLeaseError("timeout", `timed out acquiring log lease: ${lease}`);
+                throw new HarneryLogLeaseError("timeout", leaseHasValidOwner(lease)
+                    ? `timed out acquiring log lease: ${lease}`
+                    : `timed out acquiring log lease with no valid owner; an interrupted writer left it, and it is never recovered automatically: ${lease}`);
             }
             await new Promise((resolve) => setTimeout(resolve, policy.lease_retry_ms));
             void error;
@@ -223,6 +217,42 @@ export async function withFamilyLease(directory, policy, operation) {
             releaseOwnedLease(lease, owner);
     }
 }
+/**
+ * Publish a complete lease in one rename. The owner record is written and synced
+ * in a private claim directory first, so a writer stopped at any point leaves
+ * either no lease or one with an owner. A held lease always has an owner record,
+ * here and in the earlier create-then-write protocol, so a rename that replaces
+ * an empty lease directory never takes a held lease. A lease with any entry makes
+ * the rename fail, and the caller waits or recovers as before.
+ */
+function claimLease(lease) {
+    const owner = {
+        owner_id: randomUUID(),
+        pid: process.pid,
+        acquired_at: new Date().toISOString(),
+    };
+    const content = `${JSON.stringify(owner)}\n`;
+    const claim = `${lease}.claim-${process.pid}-${owner.owner_id}`;
+    try {
+        mkdirSync(claim, { mode: stateDirMode() });
+        writeNewFile(join(claim, "owner.json"), Buffer.from(content));
+        renameSync(claim, lease);
+    }
+    finally {
+        rmSync(claim, { recursive: true, force: true });
+    }
+    try {
+        captureDirectoryIdentity(lease);
+        if (readRegularFile(join(lease, "owner.json"), 4_096).toString("utf8") !== content) {
+            throw new Error(`log lease owner changed during claim: ${lease}`);
+        }
+    }
+    catch (error) {
+        releaseOwnedLease(lease, owner);
+        throw error;
+    }
+    return owner;
+}
 function shouldRotate(active, incoming, options, now) {
     const stat = regularFileStat(active);
     const incomingBytes = incoming.reduce((sum, record) => sum + record.byteLength, 0);
@@ -315,6 +345,18 @@ function atomicJson(path, value) {
     renameSync(temporary, path);
     assertRegularPath(path, captureDirectoryIdentity(dirname(path)));
 }
+function leaseHasValidOwner(lease) {
+    try {
+        const owner = JSON.parse(readRegularFile(join(lease, "owner.json"), 4_096).toString("utf8"));
+        return (typeof owner?.owner_id === "string" &&
+            owner.owner_id.length > 0 &&
+            Number.isSafeInteger(owner.pid) &&
+            Number.isFinite(Date.parse(owner.acquired_at)));
+    }
+    catch {
+        return false;
+    }
+}
 function recoverStaleLease(lease, maximumAgeMs) {
     let identity;
     let raw;
@@ -344,7 +386,7 @@ function recoverStaleLease(lease, maximumAgeMs) {
         assertDirectoryIdentity(identity);
         if (readRegularFile(join(lease, "owner.json"), 4_096).toString("utf8") !== raw)
             return false;
-        rmSync(lease, { recursive: true, force: false });
+        retireLease(lease, randomUUID());
         return true;
     }
     catch {
@@ -356,12 +398,22 @@ function releaseOwnedLease(lease, owner) {
         const current = JSON.parse(readRegularFile(join(lease, "owner.json"), 4_096).toString("utf8"));
         if (current.owner_id !== owner.owner_id)
             return;
-        rmSync(lease, { recursive: true, force: false });
+        retireLease(lease, owner.owner_id);
     }
     catch {
         // A missing or replaced lease does not belong to this operation.
     }
 }
+/**
+ * Move a lease aside before deleting it. Its path goes from held to absent in
+ * one rename and is never an empty directory that a concurrent claim could
+ * replace while a recursive removal is still running.
+ */
+function retireLease(lease, tag) {
+    const retired = `${lease}.retired-${process.pid}-${tag}`;
+    renameSync(lease, retired);
+    rmSync(retired, { recursive: true, force: true });
+}
 function processIsAlive(pid) {
     try {
         process.kill(pid, 0);
@@ -519,12 +571,16 @@ function writeAllSync(fd, buffer, writer) {
 function nativeWriteSync(fd, buffer, offset, length) {
     return writeSync(fd, buffer, offset, length);
 }
-function safeLeaseDirectory(path) {
+/** One lstat, so a lease released between checks reads as absent, not as a wrong type. */
+function leaseHasWrongType(path) {
     try {
-        return !lstatSync(path).isSymbolicLink() && lstatSync(path).isDirectory();
+        const stat = lstatSync(path);
+        return stat.isSymbolicLink() || !stat.isDirectory();
     }
-    catch {
-        return false;
+    catch (error) {
+        if (error.code === "ENOENT")
+            return false;
+        throw error;
     }
 }
 function pathExists(path) {

package/dist/core/work/state.js

@@ -6,7 +6,7 @@ import { appendSegmentedJsonlFile, readSegmentedJsonlFileSync, } from "../storag
 import { stateDirMode, stateFileMode } from "../storage/modes.js";
 import { readWorkflowApproval } from "../workflow/approvals.js";
 import { stableDigest } from "../workflow/durable-record.js";
-import { deriveRunFailureClass, readWorkflowProof } from "../workflow/proof.js";
+import { readWorkflowProof } from "../workflow/proof.js";
 import { readWorkflowRunManifest, workflowScriptDigest } from "../workflow/run-state.js";
 import { WORKFLOW_TRANSCRIPT_EVENT_BYTES, workflowTranscriptPath } from "../workflow/transcript.js";
 import { isWorkspaceBoundExecutionEvidence } from "../workflow/workspaces/validate.js";
@@ -464,13 +464,13 @@ function inspectAttempt(coordRoot, event, intent, priorRunId) {
                 proof.acceptance.summary.unknown === 0
                 ? "succeeded"
                 : "failed";
-        // Re-derive no-effect eligibility from every participant rather than
-        // trusting a persisted transport class. Missing evidence stays charged.
-        // The script's explicit decision authority remains a separate path.
+        // A failed attempt the run classified as uninformative about the work is
+        // uncharged (ADR 0046). Absent class ⇒ charged, as before. Read only for a
+        // failed attempt: a succeeded run never carries a class.
         if (attempt.status === "failed" &&
-            (proof.run.class === "decision" ||
-                ((proof.run.class === "environment" || proof.run.class === "upstream") &&
-                    deriveRunFailureClass(proof.run.status, proof.agents) === proof.run.class))) {
+            (proof.run.class === "environment" ||
+                proof.run.class === "upstream" ||
+                proof.run.class === "decision")) {
             attempt.uncharged = proof.run.class;
             if (proof.run.class === "decision" && typeof proof.run.decision_id === "string") {
                 attempt.blocked_on = proof.run.decision_id;

package/dist/core/workflow/engine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AA0DH,OAAO,KAAK,EAIV,UAAU,EAGV,SAAS,EAeV,MAAM,YAAY,CAAC;AAuDpB,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;gBAEf,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO;CAM/E;AAED,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;gBAEpB,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM;CAOvF;AAED;;;;6EAI6E;AAC7E,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;gBAEjB,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM;CAUhD;AAED,wBAAsB,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CA6E1F"}
+{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAiDH,OAAO,KAAK,EAIV,UAAU,EAGV,SAAS,EAeV,MAAM,YAAY,CAAC;AAuDpB,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;gBAEf,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO;CAM/E;AAED,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;gBAEpB,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM;CAOvF;AAED;;;;6EAI6E;AAC7E,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;gBAEjB,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM;CAUhD;AAED,wBAAsB,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CA6E1F"}

package/dist/core/workflow/engine.js

@@ -37,8 +37,7 @@ import { freezeWorkflowAttemptContext } from "./attempt-context.js";
 import { probeBilling } from "./billing.js";
 import { stableDigest } from "./durable-record.js";
 import { evidencePreflightError } from "./evidence-preflight.js";
-import { canRetryFailedSpawn, observeSpawnFailure, resolveFailureEvidence, } from "./failure-evidence.js";
-import { endWorkflowChildSessionV3, recordWorkflowChildTerminalFailureV3, startWorkflowChildSessionV3, } from "./live-session-v3.js";
+import { endWorkflowChildSessionV3, startWorkflowChildSessionV3 } from "./live-session-v3.js";
 import { buildWorkflowProof, createEvidenceRecord, digestResult, normalizeWorkflowMeta, writeWorkflowProof, } from "./proof.js";
 import { acquireWorkflowResumeLease, assertWorkflowRunResumable, assertWorkflowScriptUnchanged, WORKFLOW_RUN_MANIFEST_SCHEMA_VERSION, workflowScriptDigest, writeWorkflowRunManifest, } from "./run-state.js";
 import { assertProjectionWithinWorkspace, resolveGitGrantRoots } from "./sandbox-projection.js";
@@ -865,40 +864,23 @@ async function executeWorkflow(scriptPath, absScript, opts, resumeState, workCon
             },
         });
         agentProof.access = access;
-        let childGenerationId;
         let recordAgentEnd;
         const finalizeChild = () => {
             try {
-                if (childGenerationId)
-                    endWorkflowChildSessionV3({
-                        coordRoot: opts.coordRoot,
-                        instanceId: childInstanceId(runId, id),
-                        runId,
-                        agentId: id,
-                        adapter,
-                        cleanExit: agentProof.status === "succeeded",
-                        expectedGenerationId: childGenerationId,
-                    });
-                // Result publication is the resume-cache boundary, after canonical custody.
+                // Record the canonical terminal first. agent.end is the resume-cache
+                // boundary, so a child whose end was not recorded never reports success.
+                endWorkflowChildSessionV3({
+                    coordRoot: opts.coordRoot,
+                    instanceId: childInstanceId(runId, id),
+                    runId,
+                    agentId: id,
+                    adapter,
+                    cleanExit: agentProof.status === "succeeded",
+                });
                 recordAgentEnd?.();
             }
             catch (error) {
-                let reason = `V3 terminal recording failed: ${error.message}`;
-                try {
-                    if (childGenerationId)
-                        recordWorkflowChildTerminalFailureV3({
-                            coordRoot: opts.coordRoot,
-                            instanceId: childInstanceId(runId, id),
-                            runId,
-                            agentId: id,
-                            adapter,
-                            expectedGenerationId: childGenerationId,
-                            reason,
-                        });
-                }
-                catch (visibilityError) {
-                    reason += `; blocked lifecycle recording failed: ${visibilityError.message}`;
-                }
+                const reason = `V3 terminal recording failed: ${error.message}`;
                 const failure = new Error(agentProof.error ? `${agentProof.error}; ${reason}` : reason, {
                     cause: error,
                 });
@@ -930,7 +912,7 @@ async function executeWorkflow(scriptPath, absScript, opts, resumeState, workCon
             // Headless children do not reliably fire adapter hooks. The engine owns
             // their canonical V3 start so every dispatched child has an auditable
             // generation before it begins work.
-            const child = startWorkflowChildSessionV3({
+            startWorkflowChildSessionV3({
                 coordRoot: opts.coordRoot,
                 instanceId: childInstanceId(runId, id),
                 runId,
@@ -939,13 +921,9 @@ async function executeWorkflow(scriptPath, absScript, opts, resumeState, workCon
                 label,
                 model: agentOpts.model,
             });
-            if (!child.v3_generation_id)
-                throw new Error("workflow_child_v3_generation_missing");
-            childGenerationId = child.v3_generation_id;
             let attemptPrompt = dispatchPrompt;
             let last = null;
             let agentCostUsd = 0;
-            let informativeAttempt;
             for (let attempt = 1; attempt <= maxAttempts; attempt++) {
                 last = await spawner({
                     prompt: attemptPrompt,
@@ -967,29 +945,15 @@ async function executeWorkflow(scriptPath, absScript, opts, resumeState, workCon
                 agentCostUsd += last.costUsd ?? 0;
                 costUsd += last.costUsd ?? 0;
                 if (!last.ok) {
-                    const observed = last.failureEvidence === undefined
-                        ? observeSpawnFailure({}, last.text, "final_message")
-                        : resolveFailureEvidence(last.failureEvidence);
-                    agentProof.failure_evidence = informativeAttempt
-                        ? {
-                            ...observed,
-                            effect: { state: "unknown" },
-                            partial_output: informativeAttempt.partial_output,
-                        }
-                        : observed;
-                    transcript("agent.attempt_failed", {
-                        id,
-                        attempt,
-                        error: last.error,
-                        failure_evidence: observed,
-                        result_digest: digestResult(last.text, "text"),
-                        text: last.text,
-                    });
-                    if (!canRetryFailedSpawn({ ...last, failureEvidence: agentProof.failure_evidence }))
+                    transcript("agent.attempt_failed", { id, attempt, error: last.error });
+                    // ADR 0046: an environment failure (the binary was absent) cannot be
+                    // helped by retrying an unchanged environment, so stop the in-agent
+                    // retry too — not just the outer attempt/replan budget. An upstream
+                    // refusal keeps retrying here: the vendor may recover mid-loop.
+                    if (last.class === "environment")
                         break;
-                    continue;
+                    continue; // spawn-level failure: retry with the original prompt
                 }
-                informativeAttempt = observeSpawnFailure({}, last.text, "final_message");
                 if (!agentOpts.schema) {
                     agentProof.status = "succeeded";
                     agentProof.cost_usd =
@@ -1030,14 +994,7 @@ async function executeWorkflow(scriptPath, absScript, opts, resumeState, workCon
                     }, "json", parsed.value);
                     return parsed.value;
                 }
-                agentProof.failure_evidence = informativeAttempt;
-                transcript("agent.schema_retry", {
-                    id,
-                    attempt,
-                    problems,
-                    rejected_text: last.text,
-                    result_digest: digestResult(last.text, "text"),
-                });
+                transcript("agent.schema_retry", { id, attempt, problems });
                 // Keep the original cache identity while making the actual output
                 // contract explicit. A full bounded copy of the rejected value lets the
                 // child repair omissions instead of reconstructing an unseen object.
@@ -1076,7 +1033,6 @@ async function executeWorkflow(scriptPath, absScript, opts, resumeState, workCon
                 finalizeChild();
             }
             finally {
-                // A slot is disposable; unresolved custody remains visible and failed.
                 release();
             }
         }

package/dist/core/workflow/live-session-v3.d.ts

@@ -14,12 +14,6 @@ export declare function startWorkflowChildSessionV3(input: WorkflowChildSessionV
 /** Record the authoritative terminal before removing the disposable coordination cache. */
 export declare function endWorkflowChildSessionV3(input: WorkflowChildSessionV3Input & {
     cleanExit: boolean;
-    expectedGenerationId: string;
-}): void;
-/** Persist unresolved terminal custody only for the generation this dispatch owns. */
-export declare function recordWorkflowChildTerminalFailureV3(input: WorkflowChildSessionV3Input & {
-    expectedGenerationId: string;
-    reason: string;
 }): void;
 export { stableScopeId } from "./scope-id.js";
 //# sourceMappingURL=live-session-v3.d.ts.map

package/dist/core/workflow/live-session-v3.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"live-session-v3.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/live-session-v3.ts"],"names":[],"mappings":"AAUA,OAAO,EACL,KAAK,SAAS,EAGf,MAAM,qCAAqC,CAAC;AAoB7C,MAAM,WAAW,2BAA2B;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,8FAA8F;AAC9F,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,2BAA2B,GAAG,SAAS,CAqDzF;AAED,2FAA2F;AAC3F,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,2BAA2B,GAAG;IAAE,SAAS,EAAE,OAAO,CAAC;IAAC,oBAAoB,EAAE,MAAM,CAAA;CAAE,GACxF,IAAI,CAIN;AA0CD,sFAAsF;AACtF,wBAAgB,oCAAoC,CAClD,KAAK,EAAE,2BAA2B,GAAG;IAAE,oBAAoB,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACpF,IAAI,CAcN;AA8FD,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC"}
+{"version":3,"file":"live-session-v3.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/live-session-v3.ts"],"names":[],"mappings":"AAGA,OAAO,EAEL,KAAK,SAAS,EAEf,MAAM,qCAAqC,CAAC;AAY7C,MAAM,WAAW,2BAA2B;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,8FAA8F;AAC9F,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,2BAA2B,GAAG,SAAS,CAiDzF;AAED,2FAA2F;AAC3F,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,2BAA2B,GAAG;IAAE,SAAS,EAAE,OAAO,CAAA;CAAE,GAC1D,IAAI,CAmBN;AAgBD,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC"}