harnery 0.45.0 → 0.45.2

package/dist/core/servers/index.js

@@ -19,7 +19,7 @@
  * which `gc` never stops; a record without an owner is never stopped
  * automatically.
  */
-import { createHash, randomUUID } from "node:crypto";
+import { createHash } from "node:crypto";
 import { existsSync, mkdirSync, readdirSync, readFileSync, rmSync, statSync } from "node:fs";
 import { hostname } from "node:os";
 import { basename, isAbsolute, join, relative, resolve } from "node:path";
@@ -31,13 +31,13 @@ import { readCoordinationViewV3, requireAuthoritySafeCoordinationViewV3, } from
 import { liveInstanceIdV3 } from "../events/v3/live-route-observer.js";
 import { resolveOwner } from "../hooks/resolve/owner.js";
 import { writePrivateJsonAtomic } from "../storage/atomic-json.js";
-import { acquireNoClobberLease } from "../workflow/workspaces/leases.js";
 import { ancestry, establishedConnectionCounts, listListeningPorts, listListeningSockets, processStartedAt, readProcessInfo, scanSupport, } from "./net.js";
+// Host supervisors verify and signal their own children with the same checks.
 export { processStartToken, signalIfSameGeneration, verifyProcessGeneration, } from "../agents/state/proc-start.js";
 export { acquireNoClobberLease } from "../workflow/workspaces/leases.js";
 export { ancestry, establishedConnectionCounts, listListeningPorts, listListeningSockets, lsofConnectionCounts, lsofListeningSockets, parseElapsed, parseLsofListen, parseProcNetTcp, processStartedAt, psProcessInfo, readProcessInfo, scanSupport, } from "./net.js";
-export { createTunnelReadinessVerifier, tunnelServerId, tunnelServerInput } from "./tunnels.js";
-export const SERVER_RECORD_SCHEMA_VERSION = 2;
+export { tunnelServerId, tunnelServerInput } from "./tunnels.js";
+export const SERVER_RECORD_SCHEMA_VERSION = 1;
 export const SERVER_DEFAULT_IDLE_HOURS = 2;
 export const SERVER_DEFAULT_OWNER_STALE_HOURS = 24;
 const TOUCH_INTERVAL_MS = 60_000;
@@ -86,54 +86,40 @@ export function registerServer(input, options) {
         !(Number.isInteger(input.port) && input.port > 0 && input.port < 65536))
         throw new Error(`invalid server port: ${input.port}`);
     const id = input.id ?? serverId(input.type, input.scope);
-    return withServerMutation(coordRoot, id, () => {
-        const path = recordPath(coordRoot, id);
-        const now = new Date().toISOString();
-        const startToken = input.start_token ?? processStartToken(pid);
-        const pids = [...new Set(input.pids?.filter((p) => Number.isSafeInteger(p) && p > 0))];
-        const pidsStartTokens = {};
-        for (const auxiliaryPid of pids) {
-            const token = processStartToken(auxiliaryPid);
-            if (token)
-                pidsStartTokens[auxiliaryPid] = token;
-        }
-        const owner = input.owner === undefined ? callingOwner(coordRoot) : (input.owner ?? undefined);
-        const record = {
-            schema_version: SERVER_RECORD_SCHEMA_VERSION,
-            id,
-            registration_id: randomUUID(),
-            kind: input.kind,
-            type: input.type,
-            label: input.label ?? id,
-            ...(input.url ? { url: input.url } : {}),
-            ...(input.port ? { port: input.port } : {}),
-            pid,
-            ...(startToken ? { start_token: startToken } : {}),
-            ...(pids.length ? { pids, pids_start_tokens: pidsStartTokens } : {}),
-            host: hostname(),
-            ...(input.scope ? { scope: resolve(input.scope) } : {}),
-            ...(input.cwd ? { cwd: resolve(input.cwd) } : {}),
-            ...(input.log ? { log: resolve(input.log) } : {}),
-            ...(owner ? { owner } : {}),
-            started_at: input.started_at ?? now,
-            registered_at: now,
-            last_active_at: now,
-        };
-        if (input.start_token !== undefined &&
-            verifyProcessGeneration(pid, input.start_token) !== "same")
-            throw new Error(`pid ${pid} generation could not be verified before registration`);
-        if (existsSync(path)) {
-            const existing = readRecord(path);
-            if (!existing)
-                throw new Error(`registration ${id} custody is unknown: invalid or older server record retained`);
-            if (sameProcessCustody(existing, record) && serverState(existing) === "running")
-                return existing;
-            if (existing.host !== hostname() || !allProcessesAbsent(existing))
-                throw new Error(`registration ${id} custody is held by a live or unverifiable server`);
-        }
-        writePrivateJsonAtomic(path, record);
-        return record;
-    });
+    const now = new Date().toISOString();
+    const startToken = input.start_token ?? processStartToken(pid);
+    const pids = [...new Set(input.pids?.filter((p) => Number.isSafeInteger(p) && p > 0))];
+    const pidsStartTokens = {};
+    for (const auxiliaryPid of pids) {
+        const token = processStartToken(auxiliaryPid);
+        if (token)
+            pidsStartTokens[auxiliaryPid] = token;
+    }
+    const owner = input.owner === undefined ? callingOwner(coordRoot) : (input.owner ?? undefined);
+    const record = {
+        schema_version: SERVER_RECORD_SCHEMA_VERSION,
+        id,
+        kind: input.kind,
+        type: input.type,
+        label: input.label ?? id,
+        ...(input.url ? { url: input.url } : {}),
+        ...(input.port ? { port: input.port } : {}),
+        pid,
+        ...(startToken ? { start_token: startToken } : {}),
+        ...(pids.length ? { pids, pids_start_tokens: pidsStartTokens } : {}),
+        host: hostname(),
+        ...(input.scope ? { scope: resolve(input.scope) } : {}),
+        ...(input.cwd ? { cwd: resolve(input.cwd) } : {}),
+        ...(input.log ? { log: resolve(input.log) } : {}),
+        ...(owner ? { owner } : {}),
+        started_at: input.started_at ?? now,
+        registered_at: now,
+        last_active_at: now,
+    };
+    if (input.start_token !== undefined && verifyProcessGeneration(pid, input.start_token) !== "same")
+        throw new Error(`pid ${pid} generation could not be verified before registration`);
+    writePrivateJsonAtomic(recordPath(coordRoot, id), record);
+    return record;
 }
 /** Best-effort registration that never throws (for server start paths). */
 export function tryRegisterServer(input, options) {
@@ -156,106 +142,43 @@ function callingOwner(coordRoot) {
         return undefined;
     }
 }
-/** Remove only the exact registration receipt observed by the caller. */
-export function unregisterServer(record, options) {
+/**
+ * Remove a server's record. With `pid`, only a record still naming that pid
+ * is removed, so a replacement that re-registered the same id survives.
+ */
+export function unregisterServer(id, options) {
     const coordRoot = rootOf(options);
-    if (!coordRoot || !record || !isValidServerId(record.id))
+    if (!coordRoot || !isValidServerId(id))
         return false;
-    return withServerMutation(coordRoot, record.id, () => removeServerReceipt(coordRoot, record));
-}
-export function withServerRegistrationCustody(record, options, effect) {
-    const coordRoot = rootOf(options);
-    if (!coordRoot)
-        throw new Error("registration custody root is unavailable");
-    const lease = serverMutationLease(coordRoot, record.id);
-    try {
-        const current = readServer(record.id, { coordRoot });
-        if (!current ||
-            current.registration_id !== record.registration_id ||
-            !sameProcessCustody(current, record))
-            throw new Error(`registration ${record.id} custody changed`);
-        const result = effect();
-        if (result !== null &&
-            (typeof result === "object" || typeof result === "function") &&
-            typeof result.then === "function")
-            return Promise.resolve(result).finally(() => lease.release());
-        lease.release();
-        return result;
-    }
-    catch (error) {
-        lease.release();
-        throw error;
+    const path = recordPath(coordRoot, id);
+    if (options?.pid !== undefined) {
+        const record = readRecord(path);
+        if (record && record.pid !== options.pid)
+            return false;
     }
-}
-function removeServerReceipt(coordRoot, record) {
-    const path = recordPath(coordRoot, record.id);
-    const current = readRecord(path);
-    if (!current ||
-        current.registration_id !== record.registration_id ||
-        !sameProcessCustody(current, record))
+    if (!existsSync(path))
         return false;
-    rmSync(path);
+    rmSync(path, { force: true });
     return true;
 }
-function serverMutationLease(coordRoot, id) {
-    recordPath(coordRoot, id);
-    const scope = `server-registration-${id}`;
-    return acquireNoClobberLease({
-        path: join(serversDir(coordRoot), ".custody", id),
-        scope,
-        authoritySha256: createHash("sha256").update(scope).digest("hex"),
-        staleAfterMs: 1,
-    });
-}
-function withServerMutation(coordRoot, id, operation) {
-    const lease = serverMutationLease(coordRoot, id);
-    try {
-        return operation();
-    }
-    finally {
-        lease.release();
-    }
-}
-function sameProcessCustody(a, b) {
-    const helpers = (record) => [...new Set(record.pids ?? [])]
-        .sort((x, y) => x - y)
-        .map((pid) => [pid, record.pids_start_tokens?.[pid] ?? null]);
-    return (a.schema_version === SERVER_RECORD_SCHEMA_VERSION &&
-        b.schema_version === SERVER_RECORD_SCHEMA_VERSION &&
-        a.id === b.id &&
-        a.pid === b.pid &&
-        a.start_token === b.start_token &&
-        a.host === b.host &&
-        a.kind === b.kind &&
-        a.type === b.type &&
-        a.scope === b.scope &&
-        a.owner?.instance_id === b.owner?.instance_id &&
-        JSON.stringify(helpers(a)) === JSON.stringify(helpers(b)));
-}
 export function readServer(id, options) {
     const coordRoot = rootOf(options);
     if (!coordRoot || !isValidServerId(id))
         return null;
-    const path = recordPath(coordRoot, id);
-    const record = readRecord(path);
-    if (!record && existsSync(path))
-        throw new Error(`server record ${id} is invalid or uses an older schema; retained without custody`);
-    return record;
+    return readRecord(recordPath(coordRoot, id));
 }
 /** Mark a server as used now. */
 export function touchServer(id, options) {
     const coordRoot = rootOf(options);
     if (!coordRoot || !isValidServerId(id))
         return;
-    withServerMutation(coordRoot, id, () => {
-        const path = recordPath(coordRoot, id);
-        const record = readRecord(path);
-        if (!record)
-            return;
-        writePrivateJsonAtomic(path, {
-            ...record,
-            last_active_at: (options?.now ?? new Date()).toISOString(),
-        });
+    const path = recordPath(coordRoot, id);
+    const record = readRecord(path);
+    if (!record)
+        return;
+    writePrivateJsonAtomic(path, {
+        ...record,
+        last_active_at: (options?.now ?? new Date()).toISOString(),
     });
 }
 /**
@@ -284,8 +207,6 @@ function readRecord(path) {
         const value = JSON.parse(readFileSync(path, "utf8"));
         if (value?.schema_version !== SERVER_RECORD_SCHEMA_VERSION ||
             typeof value.id !== "string" ||
-            typeof value.registration_id !== "string" ||
-            !/^[0-9a-f-]{36}$/.test(value.registration_id) ||
             !Number.isSafeInteger(value.pid) ||
             (value.kind !== "service" && value.kind !== "session"))
             return null;
@@ -304,12 +225,8 @@ export function readServerRecords(options) {
         return [];
     return readdirSync(dir)
         .filter((name) => name.endsWith(".json"))
-        .map((name) => {
-        const record = readRecord(join(dir, name));
-        if (!record)
-            throw new Error(`server record ${name} is invalid or uses an older schema; retained without custody`);
-        return record;
-    })
+        .map((name) => readRecord(join(dir, name)))
+        .filter((record) => record !== null)
         .sort((a, b) => a.kind.localeCompare(b.kind) || a.type.localeCompare(b.type) || a.id.localeCompare(b.id));
 }
 export function pidAlive(pid) {
@@ -380,7 +297,7 @@ export function listServers(options) {
     records.forEach((record, i) => {
         const state = states[i];
         if (state === "dead" && allProcessesAbsent(record) && options?.prune !== false) {
-            unregisterServer(record, { coordRoot });
+            unregisterServer(record.id, { coordRoot, pid: record.pid });
             pruned.push(record.id);
             return;
         }
@@ -513,49 +430,11 @@ export function planServerGc(views, policy) {
 }
 /**
  * Stop a verified server with SIGTERM, then SIGKILL after the grace period.
- * Every signal targets one retained process handle, including auxiliary processes.
- * Each target requires a fresh generation check. Unknown or different generations retain the record.
+ * Each signal, including the process group and auxiliary processes, requires
+ * a fresh generation check. Unknown or different generations retain the record.
  */
 export async function stopServer(record, options) {
     const coordRoot = rootOf(options);
-    if (!coordRoot)
-        return {
-            id: record.id,
-            stopped: false,
-            method: "refused",
-            generation: "unknown",
-            detail: "registration custody root is unavailable",
-        };
-    let lease;
-    try {
-        lease = serverMutationLease(coordRoot, record.id);
-    }
-    catch {
-        return {
-            id: record.id,
-            stopped: false,
-            method: "refused",
-            generation: "unknown",
-            detail: "registration custody is unavailable",
-        };
-    }
-    try {
-        const current = readServer(record.id, { coordRoot });
-        if (!current || current.registration_id !== record.registration_id)
-            return {
-                id: record.id,
-                stopped: false,
-                method: "refused",
-                generation: "unknown",
-                detail: "registration custody changed; retained current server",
-            };
-        return await stopServerWithCustody(record, coordRoot, options);
-    }
-    finally {
-        lease.release();
-    }
-}
-async function stopServerWithCustody(record, coordRoot, options) {
     const graceMs = options?.graceMs ?? 5_000;
     const dependencies = options?.signalDependencies ?? {};
     const targets = [
@@ -573,7 +452,7 @@ async function stopServerWithCustody(record, coordRoot, options) {
     });
     const finish = (result) => {
         if (result.stopped || result.method === "not-running")
-            removeServerReceipt(coordRoot, record);
+            unregisterServer(record.id, { coordRoot, pid: record.pid });
         return result;
     };
     if (record.host !== hostname())
@@ -595,9 +474,6 @@ async function stopServerWithCustody(record, coordRoot, options) {
     }
     if (targets.every((target) => processPresence(target.pid, dependencies.probePid) === "absent"))
         return finish({ id: record.id, stopped: false, method: "not-running" });
-    const current = readServer(record.id, { coordRoot });
-    if (!current || !sameProcessCustody(current, record))
-        return refuse(record.pid, "unknown");
     for (const name of ["SIGTERM", "SIGKILL"]) {
         for (const target of targets) {
             const presence = processPresence(target.pid, dependencies.probePid);
@@ -605,9 +481,11 @@ async function stopServerWithCustody(record, coordRoot, options) {
                 continue;
             if (presence === "unknown")
                 return refuse(target.pid, "unknown");
-            const result = signalIfSameGeneration(target.pid, target.token, name, dependencies);
-            if (!result.sent || result.verdict !== "same")
-                return refuse(target.pid, result.verdict === "same" ? "unknown" : result.verdict);
+            const result = target.pid === record.pid
+                ? signalServerLeader(target.pid, target.token, name, dependencies)
+                : signalIfSameGeneration(target.pid, target.token, name, dependencies);
+            if (result.verdict !== "same")
+                return refuse(target.pid, result.verdict);
         }
         const observed = await waitForExit(targets, name === "SIGTERM" ? graceMs : 2_000, dependencies);
         if (observed.refused)
@@ -623,6 +501,18 @@ async function stopServerWithCustody(record, coordRoot, options) {
         detail: "process survived SIGKILL",
     };
 }
+function signalServerLeader(pid, token, name, dependencies) {
+    // The leader's generation authorizes its group. A failed group signal must
+    // not reuse that observation for the direct-PID fallback.
+    const kill = dependencies.kill ?? process.kill;
+    const group = signalIfSameGeneration(pid, token, name, {
+        readToken: dependencies.readToken,
+        kill: (leader, signal) => kill(-leader, signal),
+    });
+    return group.sent || group.verdict !== "same"
+        ? group
+        : signalIfSameGeneration(pid, token, name, dependencies);
+}
 async function waitForExit(targets, waitMs, dependencies) {
     const deadline = Date.now() + waitMs;
     while (true) {

package/dist/core/servers/tunnels.d.ts

@@ -2,12 +2,10 @@
  * Tunnels as registry services.
  *
  * `tunnel up` and `tunnel reload` register the new gate; `tunnel down` removes
- * its record. Missing original witnesses remain unknown and cannot authorize actions.
+ * its record. Older tunnels need an explicit adoption of an observed listener.
  */
-import { type TunnelReadinessVerifier, type TunnelState } from "../../lib/tunnel/state.js";
-import { type RegisterServerInput, type ServerOptions } from "./index.js";
-/** Verify only witnesses saved by the original tunnel registration. */
-export declare function createTunnelReadinessVerifier(options: ServerOptions): TunnelReadinessVerifier;
+import { type TunnelState } from "../../lib/tunnel/state.js";
+import type { RegisterServerInput } from "./index.js";
 export declare function tunnelServerId(name: string): string;
 /** Register the new gate; saved helper PIDs have no generation witnesses. */
 export declare function tunnelServerInput(state: TunnelState, coordRoot: string): RegisterServerInput;

package/dist/core/servers/tunnels.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tunnels.d.ts","sourceRoot":"","sources":["../../../src/core/servers/tunnels.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,EAEL,KAAK,uBAAuB,EAC5B,KAAK,WAAW,EACjB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,KAAK,mBAAmB,EAExB,KAAK,aAAa,EAGnB,MAAM,YAAY,CAAC;AAEpB,uEAAuE;AACvE,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,aAAa,GAAG,uBAAuB,CAiC7F;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED,6EAA6E;AAC7E,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,GAAG,mBAAmB,CAmB5F"}
+{"version":3,"file":"tunnels.d.ts","sourceRoot":"","sources":["../../../src/core/servers/tunnels.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAe,KAAK,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAC1E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEtD,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED,6EAA6E;AAC7E,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,GAAG,mBAAmB,CAc5F"}

package/dist/core/servers/tunnels.js

@@ -2,57 +2,15 @@
  * Tunnels as registry services.
  *
  * `tunnel up` and `tunnel reload` register the new gate; `tunnel down` removes
- * its record. Missing original witnesses remain unknown and cannot authorize actions.
+ * its record. Older tunnels need an explicit adoption of an observed listener.
  */
-import { hostname } from "node:os";
 import { resolve } from "node:path";
-import { gateLogFile, } from "../../lib/tunnel/state.js";
-import { readServer, verifyProcessGeneration, withServerRegistrationCustody, } from "./index.js";
-/** Verify only witnesses saved by the original tunnel registration. */
-export function createTunnelReadinessVerifier(options) {
-    return {
-        observeProcess(pid, originalToken) {
-            try {
-                process.kill(pid, 0);
-            }
-            catch (error) {
-                const code = error.code;
-                if (code === "ESRCH")
-                    return "absent";
-                return "unknown";
-            }
-            return verifyProcessGeneration(pid, originalToken);
-        },
-        withRegistration(state, inspect) {
-            try {
-                const original = readServer(tunnelServerId(state.name), options);
-                if (!original ||
-                    original.host !== hostname() ||
-                    original.kind !== "service" ||
-                    original.type !== "tunnel" ||
-                    original.registration_id !== state.registration_id ||
-                    original.pid !== state.gate_pid ||
-                    original.start_token !== state.gate_start_token ||
-                    original.port !== state.gate_port ||
-                    original.url !== state.url)
-                    return "unknown";
-                return withServerRegistrationCustody(original, options, inspect);
-            }
-            catch {
-                return "unknown";
-            }
-        },
-    };
-}
+import { gateLogFile } from "../../lib/tunnel/state.js";
 export function tunnelServerId(name) {
     return `tunnel-${name.toLowerCase().replace(/[^a-z0-9._-]+/g, "-")}`;
 }
 /** Register the new gate; saved helper PIDs have no generation witnesses. */
 export function tunnelServerInput(state, coordRoot) {
-    if (Object.hasOwn(state, "provider_pid") || Object.hasOwn(state, "provider_start_token"))
-        throw new Error("obsolete tunnel provider authority is unknown; state retained");
-    if (!state.gate_start_token)
-        throw new Error("tunnel gate generation witness is unavailable; state retained");
     return {
         id: tunnelServerId(state.name),
         kind: "service",
@@ -61,7 +19,6 @@ export function tunnelServerInput(state, coordRoot) {
         url: state.url,
         port: state.gate_port,
         pid: state.gate_pid,
-        start_token: state.gate_start_token,
         log: resolve(coordRoot, ".cache", "tunnel", gateLogFile(state.name)),
         cwd: coordRoot,
         started_at: state.started_at,

package/dist/core/storage/durable-history.js

@@ -394,31 +394,55 @@ function acquireLease(lease) {
             pid: process.pid,
             acquired_at: new Date().toISOString(),
         };
-        let claimed;
-        try {
-            mkdirSync(lease, { mode: stateDirMode() });
-            assertDirectoryWithinParent(lease, parent);
-            claimed = captureDirectoryIdentity(lease);
-            writeOwner(join(lease, "owner.json"), owner);
-            syncDirectory(claimed);
+        if (claimLease(lease, parent, owner))
             return owner;
+        if (recoverStaleLease(lease, DURABLE_HISTORY_LEASE_STALE_MS))
+            continue;
+        throw new Error(`durable history lease busy: ${lease}`);
+    }
+    throw new Error(`durable history lease busy: ${lease}`);
+}
+/**
+ * Publish a complete lease in one rename. The owner record is written and synced
+ * in a private claim directory first, so a writer stopped at any point leaves
+ * either no lease or one with an owner. A held lease always has an owner record,
+ * here and in the earlier create-then-write protocol, so a rename that replaces
+ * an empty lease directory never takes a held lease. A lease with any entry makes
+ * the rename fail and the caller reports it busy.
+ */
+function claimLease(lease, parent, owner) {
+    const claim = `${lease}.claim-${process.pid}-${owner.owner_id}`;
+    try {
+        mkdirSync(claim, { mode: stateDirMode() });
+        assertDirectoryWithinParent(claim, parent);
+        const claimed = captureDirectoryIdentity(claim);
+        writeOwner(join(claim, "owner.json"), owner);
+        syncDirectory(claimed);
+        renameSync(claim, lease);
+    }
+    catch {
+        return false;
+    }
+    finally {
+        try {
+            rmSync(claim, { recursive: true, force: true });
         }
         catch {
-            if (claimed) {
-                try {
-                    assertDirectoryIdentity(claimed);
-                    rmSync(lease, { recursive: true, force: false });
-                }
-                catch {
-                    // Never remove a lease after its directory identity changes.
-                }
-            }
-            if (recoverStaleLease(lease, DURABLE_HISTORY_LEASE_STALE_MS))
-                continue;
-            throw new Error(`durable history lease busy: ${lease}`);
+            // A leftover claim directory never blocks a lease.
         }
     }
-    throw new Error(`durable history lease busy: ${lease}`);
+    try {
+        assertDirectoryWithinParent(lease, parent);
+        const current = JSON.parse(completeJsonl(join(lease, "owner.json")));
+        if (current.owner_id !== owner.owner_id)
+            return false;
+        syncDirectory(parent);
+        return true;
+    }
+    catch {
+        releaseOwnedLease(lease, owner);
+        return false;
+    }
 }
 function writeOwner(path, owner) {
     const parent = captureDirectoryIdentity(dirname(path));
@@ -468,7 +492,7 @@ function recoverStaleLease(lease, staleMs) {
         assertDirectoryIdentity(leaseIdentity);
         if (completeJsonl(ownerPath) !== raw)
             return false;
-        rmSync(lease, { recursive: true, force: false });
+        retireLease(lease, randomUUID());
         return true;
     }
     catch {
@@ -480,12 +504,22 @@ function releaseOwnedLease(lease, owner) {
         const current = JSON.parse(completeJsonl(join(lease, "owner.json")));
         if (current.owner_id !== owner.owner_id)
             return;
-        rmSync(lease, { recursive: true, force: false });
+        retireLease(lease, owner.owner_id);
     }
     catch {
         // A missing or replaced lease does not belong to this operation.
     }
 }
+/**
+ * Move a lease aside before deleting it. Its path goes from held to absent in
+ * one rename and is never an empty directory that a concurrent claim could
+ * replace while a recursive removal is still running.
+ */
+function retireLease(lease, tag) {
+    const retired = `${lease}.retired-${process.pid}-${tag}`;
+    renameSync(lease, retired);
+    rmSync(retired, { recursive: true, force: true });
+}
 function processIsAlive(pid) {
     try {
         process.kill(pid, 0);

package/dist/core/storage/segments.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"segments.d.ts","sourceRoot":"","sources":["../../../src/core/storage/segments.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,eAAe,CAAC;AAEpE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAI3D,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,yBAAyB,CAAC;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,oEAAoE;IACpE,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,SAAS,mBAAmB,EAAE,CAAC;CAC1C;AAED,MAAM,WAAW,4BAA4B;IAC3C,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,8BAA8B,CAAC;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,EAAE,MAAM,CAAC;IACvB,8DAA8D;IAC9D,oBAAoB,EAAE,MAAM,CAAC;IAC7B,iEAAiE;IACjE,uBAAuB,EAAE,MAAM,CAAC;IAChC,2EAA2E;IAC3E,6BAA6B,EAAE,MAAM,CAAC;IACtC,6EAA6E;IAC7E,2BAA2B,EAAE,MAAM,CAAC;IACpC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,wEAAwE;IACxE,qBAAqB,CAAC,EAAE,MAAM,IAAI,CAAC;CACpC;AAED,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,8BAA8B,CAAC;IACvC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,wEAAwE;IACxE,UAAU,CAAC,EAAE,gBAAgB,CAAC;CAC/B;AAED,MAAM,MAAM,gBAAgB,GAAG,CAC7B,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,KACX,MAAM,CAAC;AAEZ,MAAM,WAAW,mBAAmB;IAClC,gBAAgB,EAAE,MAAM,CAAC;IACzB,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;CACjB;AAcD,qBAAa,oBAAqB,SAAQ,KAAK;IAE3C,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,YAAY,GAAG,eAAe;gBAAlD,MAAM,EAAE,SAAS,GAAG,YAAY,GAAG,eAAe,EAC3D,OAAO,EAAE,MAAM;CAKlB;AAED,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,8BAA8B,GAAG,MAAM,CAMjF;AAED,qBAAa,eAAe;;gBAGd,OAAO,EAAE,oBAAoB;IAmBnC,MAAM,CACV,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,OAAO,GAAE,sBAA2B,EACpC,OAAO,UAAQ,EACf,GAAG,OAAa,GACf,OAAO,CAAC,mBAAmB,CAAC;CA4ChC;AAED,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,8BAA8B,GACtC,oBAAoB,CAyCtB;AAED,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,oBAAoB,GAAG,MAAM,CAE7E;AAED;;;;GAIG;AACH,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,4BAA4B,GACpC,OAAO,CAAC,SAAS,GAAG,iBAAiB,CAAC,CAuExC;AAED,wBAAsB,eAAe,CAAC,CAAC,EACrC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE;IAAE,gBAAgB,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,EACpF,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAC9B,OAAO,CAAC,CAAC,CAAC,CAkCZ"}
+{"version":3,"file":"segments.d.ts","sourceRoot":"","sources":["../../../src/core/storage/segments.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,eAAe,CAAC;AAEpE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAI3D,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,yBAAyB,CAAC;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,oEAAoE;IACpE,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,SAAS,mBAAmB,EAAE,CAAC;CAC1C;AAED,MAAM,WAAW,4BAA4B;IAC3C,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,8BAA8B,CAAC;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,EAAE,MAAM,CAAC;IACvB,8DAA8D;IAC9D,oBAAoB,EAAE,MAAM,CAAC;IAC7B,iEAAiE;IACjE,uBAAuB,EAAE,MAAM,CAAC;IAChC,2EAA2E;IAC3E,6BAA6B,EAAE,MAAM,CAAC;IACtC,6EAA6E;IAC7E,2BAA2B,EAAE,MAAM,CAAC;IACpC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,wEAAwE;IACxE,qBAAqB,CAAC,EAAE,MAAM,IAAI,CAAC;CACpC;AAED,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,8BAA8B,CAAC;IACvC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,wEAAwE;IACxE,UAAU,CAAC,EAAE,gBAAgB,CAAC;CAC/B;AAED,MAAM,MAAM,gBAAgB,GAAG,CAC7B,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,KACX,MAAM,CAAC;AAEZ,MAAM,WAAW,mBAAmB;IAClC,gBAAgB,EAAE,MAAM,CAAC;IACzB,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;CACjB;AAcD,qBAAa,oBAAqB,SAAQ,KAAK;IAE3C,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,YAAY,GAAG,eAAe;gBAAlD,MAAM,EAAE,SAAS,GAAG,YAAY,GAAG,eAAe,EAC3D,OAAO,EAAE,MAAM;CAKlB;AAED,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,8BAA8B,GAAG,MAAM,CAMjF;AAED,qBAAa,eAAe;;gBAGd,OAAO,EAAE,oBAAoB;IAmBnC,MAAM,CACV,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,OAAO,GAAE,sBAA2B,EACpC,OAAO,UAAQ,EACf,GAAG,OAAa,GACf,OAAO,CAAC,mBAAmB,CAAC;CA4ChC;AAED,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,8BAA8B,GACtC,oBAAoB,CAyCtB;AAED,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,oBAAoB,GAAG,MAAM,CAE7E;AAED;;;;GAIG;AACH,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,4BAA4B,GACpC,OAAO,CAAC,SAAS,GAAG,iBAAiB,CAAC,CAuExC;AAED,wBAAsB,eAAe,CAAC,CAAC,EACrC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE;IAAE,gBAAgB,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,EACpF,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAC9B,OAAO,CAAC,CAAC,CAAC,CA+BZ"}