harnery 0.45.0 → 0.45.2

package/src/commands/workflow.ts

@@ -73,15 +73,7 @@ interface WorkflowConfirmedMutationOpts {
 
 interface WorkflowReclaimOpts extends WorkflowConfirmedMutationOpts {
   discard?: boolean;
-  unknownLiveness?: string;
-  actor?: string;
-  reason?: string;
-}
-
-interface WorkflowUnlockOpts extends WorkflowConfirmedMutationOpts {
-  lockSha256?: string;
-  actor?: string;
-  reason?: string;
+  force?: boolean;
 }
 
 export function registerWorkflowCommand(program: Command, emit: EmitContext): void {
@@ -632,11 +624,9 @@ export function registerWorkflowCommand(program: Command, emit: EmitContext): vo
     .option("--yes", "Confirm that this commits or discards uncommitted work, then releases")
     .option("--discard", "Throw the uncommitted work away instead of salvaging it")
     .option(
-      "--unknown-liveness <sha256>",
-      "Recover unknown evidence pinned by the preview digest; active evidence still refuses",
+      "--force",
+      "With --yes, admit missing or corrupt liveness evidence (active evidence still refuses) and record it",
     )
-    .option("--actor <id>", "Actor responsible for an audited recovery")
-    .option("--reason <text>", "Reason for an audited recovery")
     .option("--json", "Emit the reclaim preview or confirmed result as JSON")
     .action(async (runId: string, opts: WorkflowReclaimOpts) => {
       const coordRoot = resolveCoordRoot();
@@ -663,13 +653,7 @@ export function registerWorkflowCommand(program: Command, emit: EmitContext): vo
         const result = await provider.reclaim(binding, {
           mode: opts.discard ? "discard" : "salvage",
           yes: opts.yes,
-          unknownLiveness: opts.unknownLiveness
-            ? {
-                evidenceSha256: opts.unknownLiveness,
-                actor: opts.actor!,
-                reason: opts.reason!,
-              }
-            : undefined,
+          force: opts.force,
         });
         if (opts.json) {
           emit.config({ format: "json" });
@@ -684,11 +668,13 @@ export function registerWorkflowCommand(program: Command, emit: EmitContext): vo
           emit.text(
             `reclaim preview: ${result.run_id}\n` +
               `mode: ${result.mode}\nliveness: ${result.liveness}\nownership: ${result.ownership}\n` +
-              `evidence sha256: ${result.evidence_sha256}\n` +
               `lease holder: ${holders.length > 0 ? holders.join(", ") : "none observed"}\n` +
               `dirty paths: ${result.dirty_paths === null ? "unknown" : result.dirty_paths.length > 0 ? result.dirty_paths.join(", ") : "none"}\n` +
               (result.ownership_detail ? `ownership detail: ${result.ownership_detail}\n` : "") +
-              `Pass --yes to confirm ${result.mode} and release after all checks pass.\n`,
+              `Pass --yes to confirm ${result.mode} and release after all checks pass.\n` +
+              (result.liveness === "unknown"
+                ? "Liveness is unknown; add --force with --yes only if the run is known to be stopped.\n"
+                : ""),
           );
           return;
         }
@@ -708,42 +694,6 @@ export function registerWorkflowCommand(program: Command, emit: EmitContext): vo
       }
     });
 
-  workflow
-    .command("unlock <run-id>")
-    .description(
-      "Preview or explicitly retire one exact resume lock whose local owner is proven dead.",
-    )
-    .option("--lock-sha256 <sha256>", "Exact lock identity digest returned by the preview")
-    .option("--actor <id>", "Actor responsible for the recovery")
-    .option("--reason <text>", "Reason for the recovery")
-    .option("--yes", "Confirm removal after dead-owner and exact-lock checks")
-    .option("--json", "Emit the recovery preview or result as JSON")
-    .action(async (runId: string, opts: WorkflowUnlockOpts) => {
-      try {
-        const coordRoot = resolveCoordRoot();
-        if (!coordRoot) throw new Error("no .harnery/ coordination root found");
-        const { recoverWorkflowResumeLease } = await import("../core/workflow/index.ts");
-        const result = recoverWorkflowResumeLease(coordRoot, runId, opts);
-        if (opts.json) {
-          emit.config({ format: "json" });
-          emit.data(result);
-          return;
-        }
-        emit.text(
-          `resume lock ${result.action}: ${runId}\nowner: ${result.owner_state}\nlock sha256: ${result.lock_sha256 ?? "absent"}\n` +
-            (result.action === "preview"
-              ? "Pass --lock-sha256, --actor, --reason and --yes to confirm exact dead-owner recovery.\n"
-              : `recovery: ${result.recovery_id}\n`),
-        );
-      } catch (error) {
-        emit.error({
-          code: "workflow_resume_unlock_failed",
-          message: error instanceof Error ? error.message : String(error),
-        });
-        process.exit(1);
-      }
-    });
-
   const approvals = program
     .command("approval")
     .description("Inspect and resolve durable run-policy approvals.");

package/src/core/agents/coord-client.ts

@@ -265,27 +265,7 @@ export function parsePidmapRowStartToken(row: string): string | undefined {
  * a test can hold this one against `processStartToken` and fail on drift.
  */
 export function pidStartToken(pid: number): string | null {
-  if (!Number.isInteger(pid) || pid <= 0) return null;
   const forced = process.env.HARNERY_PID_PROBE;
-  if (process.platform === "win32" && forced !== "procfs" && forced !== "ps") {
-    try {
-      const out = spawnSync(
-        "powershell.exe",
-        [
-          "-NoLogo",
-          "-NoProfile",
-          "-NonInteractive",
-          "-Command",
-          `$process = [Diagnostics.Process]::GetProcessById(${pid}); try { 'w' + $process.StartTime.ToFileTimeUtc().ToString([Globalization.CultureInfo]::InvariantCulture) } finally { $process.Dispose() }`,
-        ],
-        { encoding: "utf8", timeout: 10_000, windowsHide: true },
-      );
-      const token = String(out.stdout ?? "").trim();
-      return out.status === 0 && /^w\d+$/.test(token) ? token : null;
-    } catch {
-      return null;
-    }
-  }
   const useProcfs = forced === "procfs" || (forced !== "ps" && existsSync("/proc/self/stat"));
   // One machine, one probe. Falling back to the other on a read failure would
   // answer in the wrong dialect and read as a recycled pid.

package/src/core/agents/live-authority-v3.ts

@@ -88,7 +88,6 @@ interface LiveAuthorityBaseV3 {
   nativeSessionId: string;
   adapter: Adapter;
   observationId?: string;
-  expectedGenerationId?: `gen_${string}`;
 }
 
 /**
@@ -649,13 +648,6 @@ function recordLiveAuthority<S extends CoordinationAuthoritySignalV3>(
     platform: livePlatformV3(),
     expected_prior_state_digest: coordinationAuthorityStateDigestV3(expected),
     desired_state_digest: coordinationAuthorityStateDigestV3(desired),
-    expected_generation_id:
-      input.expectedGenerationId ??
-      ((subject === input.owner
-        ? expected.v3_generation_id
-        : readLiveCoordinationRow(input.coordRoot, input.owner)?.v3_generation_id) as
-        | `gen_${string}`
-        | undefined),
     reconciler: {
       readStateDigest: () => {
         const heartbeat = readHeartbeat(input.coordRoot, subject);
@@ -689,12 +681,6 @@ export function liveCoordinationWriteModeV3(coordRoot: string): EventV3WriteMode
 }
 
 function requireHeartbeat(input: LiveAuthorityBaseV3, owner: string): Heartbeat {
-  if (
-    input.expectedGenerationId &&
-    readLiveCoordinationRow(input.coordRoot, owner)?.v3_generation_id !== input.expectedGenerationId
-  ) {
-    throw new LiveCoordinationAuthorityV3Error("expected_generation_changed");
-  }
   const heartbeat = ensureLiveCoordinationHeartbeat(
     input.coordRoot,
     owner,
@@ -702,9 +688,6 @@ function requireHeartbeat(input: LiveAuthorityBaseV3, owner: string): Heartbeat
     input.adapter,
   );
   if (!heartbeat) throw new LiveCoordinationAuthorityV3Error(`heartbeat_missing:${owner}`);
-  if (input.expectedGenerationId && heartbeat.v3_generation_id !== input.expectedGenerationId) {
-    throw new LiveCoordinationAuthorityV3Error("expected_generation_changed");
-  }
   return heartbeat;
 }
 

package/src/core/agents/live-lifecycle-v3.ts

@@ -5,7 +5,6 @@ import { normalizeNativeIdV3 } from "../events/v3/canonical.ts";
 import type { EventV3 } from "../events/v3/contract.ts";
 import { readEventV3ControlState } from "../events/v3/control.ts";
 import { fingerprintContextV3 } from "../events/v3/fingerprint-keys.ts";
-import { withGenerationCustodyV3 } from "../events/v3/generation-custody.ts";
 import {
   liveInstanceIdV3,
   livePlatformV3,
@@ -26,34 +25,17 @@ interface LiveLifecycleObservationBaseV3 {
   observedAt?: string;
 }
 
-interface LiveSweepObservationV3Input extends LiveLifecycleObservationBaseV3 {
-  expectedGenerationId: `gen_${string}` | null;
-  observation: "stale_heartbeat" | "killed" | "unparseable_heartbeat" | "missing_timestamp";
-  ageMs: number;
-}
-
 export function recordLiveSweepObservationV3(
-  input: LiveSweepObservationV3Input,
+  input: LiveLifecycleObservationBaseV3 & {
+    observation: "stale_heartbeat" | "killed" | "unparseable_heartbeat" | "missing_timestamp";
+    ageMs: number;
+  },
 ): LiveLifecycleObservationV3Result {
-  input = { ...input };
-  // Reject stale observations before preparing durable custody state. The
-  // in-custody checks cover replacement while acquiring custody and reentry.
-  requireSweepHookState(input);
-  return withGenerationCustodyV3(input.coordRoot, [liveInstanceIdV3(input.owner)], () => {
-    requireSweepHookState(input);
-    return recordObservation(
-      input,
-      "lifecycle.sweep_observed",
-      {
-        subject_instance_id: liveInstanceIdV3(input.owner),
-        observation: input.observation,
-        provisional: true,
-        age_ms: Math.max(0, Math.floor(input.ageMs)),
-      },
-      () => {
-        requireSweepHookState(input);
-      },
-    );
+  return recordObservation(input, "lifecycle.sweep_observed", {
+    subject_instance_id: liveInstanceIdV3(input.owner),
+    observation: input.observation,
+    provisional: true,
+    age_ms: Math.max(0, Math.floor(input.ageMs)),
   });
 }
 
@@ -62,16 +44,11 @@ export function recordLiveResumeObservationV3(
 ): LiveLifecycleObservationV3Result {
   const normalized = withAttestedAdapter(input);
   const hook = requireHookState(normalized);
-  return recordObservation(
-    normalized,
-    "session.resumed",
-    {
-      prior_generation_id: hook.generation_id,
-      continuity: "native",
-      evidence_reference: "heartbeat_recreated",
-    },
-    () => {},
-  );
+  return recordObservation(normalized, "session.resumed", {
+    prior_generation_id: hook.generation_id,
+    continuity: "native",
+    evidence_reference: "heartbeat_recreated",
+  });
 }
 
 function recordObservation<T extends "lifecycle.sweep_observed" | "session.resumed">(
@@ -89,7 +66,6 @@ function recordObservation<T extends "lifecycle.sweep_observed" | "session.resum
         continuity: "native";
         evidence_reference: string;
       },
-  beforeWrite: () => void,
 ): LiveLifecycleObservationV3Result {
   const route = resolveLiveEventLedgerRouteV3(input.coordRoot);
   if (route.state === "blocked") throw new LiveCoordinationAuthorityV3Error(route.reason);
@@ -145,7 +121,6 @@ function recordObservation<T extends "lifecycle.sweep_observed" | "session.resum
     monotonic_ns: process.hrtime.bigint().toString(),
   };
   const event = buildEventV3(eventType, { ...common, payload } as never) as EventV3;
-  beforeWrite();
   const durability = writeEventV3(input.coordRoot, event, {
     expectedGenesisId: control.genesis.event.payload.genesis_id as `gex_${string}`,
   });
@@ -155,19 +130,6 @@ function recordObservation<T extends "lifecycle.sweep_observed" | "session.resum
   return { state: "recorded", event };
 }
 
-function requireSweepHookState(input: LiveSweepObservationV3Input): void {
-  if (
-    typeof input.expectedGenerationId !== "string" ||
-    !/^gen_[a-zA-Z0-9._-]+$/.test(input.expectedGenerationId)
-  ) {
-    throw new LiveCoordinationAuthorityV3Error("hook_generation_not_joinable");
-  }
-  const hook = requireHookState(withAttestedAdapter(input));
-  if (hook.generation_id !== input.expectedGenerationId) {
-    throw new LiveCoordinationAuthorityV3Error("expected_generation_changed");
-  }
-}
-
 function withAttestedAdapter<T extends LiveLifecycleObservationBaseV3>(input: T): T {
   const adapter = liveCoordinationAdapterV3(input.coordRoot, input.owner);
   if (!adapter) return input;

package/src/core/agents/state/heartbeat-writer.ts

@@ -24,11 +24,6 @@ import {
   writeFileSync,
 } from "node:fs";
 import { dirname, join } from "node:path";
-import {
-  assertCurrentGenerationV3,
-  withGenerationCustodyV3,
-} from "../../events/v3/generation-custody.ts";
-import { liveInstanceIdV3 } from "../../events/v3/live-routing.ts";
 import { canonicalClaimPath } from "../claim-path.ts";
 import { type Heartbeat, heartbeatPath, readHeartbeat } from "./heartbeat-reader.ts";
 import type { TaskState } from "./session-state.ts";
@@ -68,15 +63,12 @@ function mutate(
   instanceId: string,
   fn: (hb: Heartbeat) => Heartbeat,
 ): Heartbeat | null {
-  return withGenerationCustodyV3(coordRoot, [liveInstanceIdV3(instanceId)], () => {
-    const hb = readHeartbeat(coordRoot, instanceId);
-    if (!hb) return null;
-    const next = fn(hb);
-    next.last_heartbeat = nowIsoSeconds();
-    assertCurrentGenerationV3(coordRoot, liveInstanceIdV3(instanceId), hb.v3_generation_id);
-    atomicWrite(heartbeatPath(coordRoot, instanceId), JSON.stringify(next, null, 2));
-    return next;
-  });
+  const hb = readHeartbeat(coordRoot, instanceId);
+  if (!hb) return null;
+  const next = fn(hb);
+  next.last_heartbeat = nowIsoSeconds();
+  atomicWrite(heartbeatPath(coordRoot, instanceId), JSON.stringify(next, null, 2));
+  return next;
 }
 
 export function setTask(coordRoot: string, instanceId: string, task: string): Heartbeat | null {
@@ -108,15 +100,12 @@ export function setIdentityCache(
   name: string,
   agentId: string,
 ): Heartbeat | null {
-  return withGenerationCustodyV3(coordRoot, [liveInstanceIdV3(instanceId)], () => {
-    const heartbeat = readHeartbeat(coordRoot, instanceId);
-    if (!heartbeat) return null;
-    heartbeat.name = name;
-    heartbeat.agent_id = agentId;
-    assertCurrentGenerationV3(coordRoot, liveInstanceIdV3(instanceId), heartbeat.v3_generation_id);
-    atomicWrite(heartbeatPath(coordRoot, instanceId), JSON.stringify(heartbeat, null, 2));
-    return heartbeat;
-  });
+  const heartbeat = readHeartbeat(coordRoot, instanceId);
+  if (!heartbeat) return null;
+  heartbeat.name = name;
+  heartbeat.agent_id = agentId;
+  atomicWrite(heartbeatPath(coordRoot, instanceId), JSON.stringify(heartbeat, null, 2));
+  return heartbeat;
 }
 
 /** Restore the pool-assigned display name on a generation that was
@@ -339,12 +328,6 @@ export function clearCoordinationCache(coordRoot: string, instanceId: string): b
 }
 
 export function healPidmap(coordRoot: string, instanceId: string, pid: number): void {
-  withGenerationCustodyV3(coordRoot, [liveInstanceIdV3(instanceId)], () =>
-    healPidmapUnderCustody(coordRoot, instanceId, pid),
-  );
-}
-
-function healPidmapUnderCustody(coordRoot: string, instanceId: string, pid: number): void {
   const dir = join(coordRoot, ".harnery", "pid-map");
   mkdirSync(dir, { recursive: true });
   const hb = readHeartbeat(coordRoot, instanceId);

package/src/core/agents/state/live-coordination-writer.ts

@@ -5,10 +5,6 @@ import {
   readCoordinationViewV3,
   requireAuthoritySafeCoordinationViewV3,
 } from "../../events/v3/coordination-view.ts";
-import {
-  assertCurrentGenerationV3,
-  withGenerationCustodyV3,
-} from "../../events/v3/generation-custody.ts";
 import { liveInstanceIdV3, resolveLiveEventLedgerRouteV3 } from "../../events/v3/live-routing.ts";
 import { type Heartbeat, readHeartbeat } from "./heartbeat-reader.ts";
 import {
@@ -68,26 +64,6 @@ function materializeLiveCoordinationHeartbeat(
   _adapter: Adapter,
   model: string | undefined,
   force: boolean,
-): Heartbeat | null {
-  return withGenerationCustodyV3(coordRoot, [liveInstanceIdV3(nativeInstanceId)], () =>
-    materializeHeartbeatUnderCustody(
-      coordRoot,
-      nativeInstanceId,
-      nativeSessionId,
-      _adapter,
-      model,
-      force,
-    ),
-  );
-}
-
-function materializeHeartbeatUnderCustody(
-  coordRoot: string,
-  nativeInstanceId: string,
-  nativeSessionId: string,
-  _adapter: Adapter,
-  model: string | undefined,
-  force: boolean,
 ): Heartbeat | null {
   const route = resolveLiveEventLedgerRouteV3(coordRoot);
   if (route.state === "blocked") throw new Error(`event_v3_coordination_view:${route.reason}`);
@@ -157,11 +133,6 @@ function materializeHeartbeatUnderCustody(
     v3_projection_event_id: generation.last_event_id,
     v3_task_state: generation.task_state === "set" ? "set" : "cleared",
   };
-  assertCurrentGenerationV3(
-    coordRoot,
-    liveInstanceIdV3(nativeInstanceId),
-    generation.generation_id,
-  );
   writeHeartbeatCache(coordRoot, nativeInstanceId, materialized);
   return materialized;
 }

package/src/core/agents/state/pidmap.ts

@@ -24,9 +24,7 @@ import {
   writeFileSync,
 } from "node:fs";
 import { dirname, join } from "node:path";
-import { withGenerationCustodyV3 } from "../../events/v3/generation-custody.ts";
-import { liveInstanceIdV3 } from "../../events/v3/live-routing.ts";
-import { checkPidToken, processStartToken } from "./proc-start.ts";
+import { processStartToken, verifyProcessGeneration } from "./proc-start.ts";
 
 /**
  * Row count that triggers a dead-row sweep on the next write.
@@ -61,7 +59,7 @@ export function parsePidmapRow(row: string): {
  */
 function rowStillNamesItsProcess(pid: number, startToken: string | undefined): boolean {
   if (!pidIsAlive(pid)) return false;
-  return checkPidToken(pid, startToken) !== "mismatch";
+  return verifyProcessGeneration(pid, startToken) !== "different";
 }
 
 function atomicWrite(path: string, content: string): void {
@@ -128,17 +126,6 @@ export function writePidmapRow(
   pid: number,
   instanceId: string,
   platform: string,
-): void {
-  withGenerationCustodyV3(coordRoot, [liveInstanceIdV3(instanceId)], () =>
-    writePidmapRowUnderCustody(coordRoot, pid, instanceId, platform),
-  );
-}
-
-function writePidmapRowUnderCustody(
-  coordRoot: string,
-  pid: number,
-  instanceId: string,
-  platform: string,
 ): void {
   const dir = join(coordRoot, ".harnery", "pid-map");
   const path = join(dir, String(pid));

package/src/core/agents/state/proc-start.ts

@@ -34,10 +34,9 @@
 import { spawnSync } from "node:child_process";
 import { existsSync, readFileSync } from "node:fs";
 import { coordEnv } from "../../../lib/env.ts";
-import { signalProcessWithHandle, windowsProcessStartToken } from "./process-handle.ts";
 
 /** Which probe answers "when did this process start?" on this machine. */
-export type StartTokenProbe = "procfs" | "ps" | "windows";
+export type StartTokenProbe = "procfs" | "ps";
 
 /**
  * The `ps` probe is text formatted by `strftime("%c", localtime(...))`, so its
@@ -61,7 +60,6 @@ let cachedBootId: string | null | undefined;
 export function startTokenProbe(): StartTokenProbe {
   const override = coordEnv("PID_PROBE");
   if (override === "procfs" || override === "ps") return override;
-  if (process.platform === "win32") return "windows";
   if (cachedProbe === undefined) {
     cachedProbe = existsSync("/proc/self/stat") ? "procfs" : "ps";
   }
@@ -104,7 +102,7 @@ export function resetStartTokenCaches(): void {
  * than by splitting the whole line, because comm is the executable name in
  * parentheses and may itself contain spaces and parens. The boot segment is
  * dropped rather than faked when the kernel will not name its boot, which
- * yields the pre-boot-id shape that `tokensAgree` still accepts.
+ * yields the pre-boot-id shape that `verifyProcessGeneration` compares by ticks.
  */
 export function procfsStartToken(pid: number): string | null {
   let stat: string;
@@ -159,19 +157,26 @@ function defaultPsRun(pid: number): { status: number | null; stdout: string } {
  */
 export function processStartToken(pid: number): string | null {
   if (!Number.isFinite(pid) || pid <= 0) return null;
-  const probe = startTokenProbe();
-  return probe === "windows"
-    ? windowsProcessStartToken(pid)
-    : probe === "procfs"
-      ? procfsStartToken(pid)
-      : psStartToken(pid);
+  return startTokenProbe() === "procfs" ? procfsStartToken(pid) : psStartToken(pid);
 }
 
 export type ProcessGenerationVerdict = "same" | "different" | "unknown";
 
 type ReadProcessStartToken = (pid: number) => string | null;
 
-/** A missing or unreadable token never establishes process identity. */
+/**
+ * Does `pid` still name the run that wrote `recordedToken`?
+ *
+ * - `"same"`: both tokens present and equal.
+ * - `"different"`: the pid was recycled. A liveness check cannot see this,
+ *   because a recycled pid is alive.
+ * - `"unknown"`: a token is missing, malformed, or unreadable. Never treat
+ *   this as proof of identity.
+ *
+ * A Linux token written without a boot segment cannot identify a run across
+ * reboots, so it is compared on its tick count: a different count proves a
+ * different run, and an equal count stays unknown.
+ */
 export function verifyProcessGeneration(
   pid: number,
   recordedToken: string | null | undefined,
@@ -184,26 +189,38 @@ export function verifyProcessGeneration(
     !recordedToken.trim()
   )
     return "unknown";
-  // A bootless Linux token cannot identify a process across machine boots.
-  if (/^l\d+$/.test(recordedToken)) return "unknown";
+  let currentToken: string | null;
   try {
-    const currentToken = readToken(pid);
-    if (typeof currentToken !== "string" || !currentToken.trim()) return "unknown";
-    if (/^l\d+$/.test(currentToken)) return "unknown";
-    return currentToken === recordedToken ? "same" : "different";
+    currentToken = readToken(pid);
   } catch {
     return "unknown";
   }
+  if (typeof currentToken !== "string" || !currentToken.trim()) return "unknown";
+  const bootless = (token: string) => /^l\d+$/.test(token);
+  if (
+    recordedToken[0] === "l" &&
+    currentToken[0] === "l" &&
+    (bootless(recordedToken) || bootless(currentToken))
+  )
+    return ticksOf(recordedToken) === ticksOf(currentToken) ? "unknown" : "different";
+  return currentToken === recordedToken ? "same" : "different";
+}
+
+function ticksOf(token: string): string {
+  const dot = token.indexOf(".");
+  return dot === -1 ? token.slice(1) : token.slice(dot + 1);
 }
 
 export interface ProcessGenerationSignalDependencies {
   readToken?: ReadProcessStartToken;
-  signalProcess?: typeof signalProcessWithHandle;
+  kill?: (pid: number, signal: NodeJS.Signals | number) => unknown;
 }
 
 /**
- * Observations may refuse a signal, but only the retained native process handle
- * can authorize it. No numeric-PID effect follows the preliminary token read.
+ * Recheck the process generation immediately before sending the signal.
+ *
+ * The process can still exit and its PID can be reused between the token read
+ * and the signal. Eliminating that race requires a generation-bound OS handle.
  */
 export function signalIfSameGeneration(
   pid: number,
@@ -211,58 +228,13 @@ export function signalIfSameGeneration(
   signal: NodeJS.Signals | number,
   dependencies: ProcessGenerationSignalDependencies = {},
 ): { sent: boolean; verdict: ProcessGenerationVerdict } {
+  const kill = dependencies.kill ?? process.kill;
   const verdict = verifyProcessGeneration(pid, recordedToken, dependencies.readToken);
   if (verdict !== "same") return { sent: false, verdict };
   try {
-    return (dependencies.signalProcess ?? signalProcessWithHandle)(pid, recordedToken!, signal);
+    kill(pid, signal);
+    return { sent: true, verdict };
   } catch {
-    return { sent: false, verdict: "unknown" };
+    return { sent: false, verdict };
   }
 }
-
-/**
- * Do two tokens describe the same run?
- *
- * Equality, plus one concession: a row written before tokens carried a boot
- * segment recorded the tick count alone, so it is compared on the part it
- * actually recorded. Refusing that would call every pre-upgrade row a recycled
- * pid and prune a working machine's live rows the first time the new code ran.
- * Such a row loses its reboot protection until the next write rewrites it,
- * which is a strictly better position than the one it came from.
- */
-export function tokensAgree(recorded: string, current: string): boolean {
-  if (recorded === current) return true;
-  // Only the Linux form has a boot segment to disagree about, and only when
-  // exactly one side carries one is this a shape difference rather than two
-  // genuinely different start instants.
-  if (recorded[0] !== "l" || current[0] !== "l") return false;
-  if (recorded.includes(".") === current.includes(".")) return false;
-  return ticksOf(recorded) === ticksOf(current);
-}
-
-function ticksOf(token: string): string {
-  const dot = token.indexOf(".");
-  return dot === -1 ? token.slice(1) : token.slice(dot + 1);
-}
-
-/**
- * Does `pid` still name the process a row recorded?
- *
- * Three answers, and the difference between the last two matters:
- *
- * - `"match"` — recorded token, current token, same run. The row is trustworthy.
- * - `"mismatch"` — both present and different. The pid was recycled. This is
- *   the case a liveness check cannot see, because a recycled pid is alive.
- * - `"unverified"` — no recorded token (a row written before tokens existed) or
- *   no current one (an unsupported platform). Callers treat this the way they
- *   treated every row previously: trust it if the pid is alive.
- */
-export function checkPidToken(
-  pid: number,
-  recorded: string | undefined,
-): "match" | "mismatch" | "unverified" {
-  if (!recorded) return "unverified";
-  const current = processStartToken(pid);
-  if (!current) return "unverified";
-  return tokensAgree(recorded, current) ? "match" : "mismatch";
-}