harnery 0.45.1 → 0.45.2

package/dist/commands/workflow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workflow.d.ts","sourceRoot":"","sources":["../../src/commands/workflow.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAmFnD,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,GAAG,IAAI,CAqyBjF"}
+{"version":3,"file":"workflow.d.ts","sourceRoot":"","sources":["../../src/commands/workflow.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AA2EnD,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,GAAG,IAAI,CA2vBjF"}

package/dist/commands/workflow.js

@@ -475,9 +475,7 @@ export function registerWorkflowCommand(program, emit) {
         .description("Preview reclaim of an inactive owned workspace, or confirm salvage or discard and release.")
         .option("--yes", "Confirm that this commits or discards uncommitted work, then releases")
         .option("--discard", "Throw the uncommitted work away instead of salvaging it")
-        .option("--unknown-liveness <sha256>", "Recover unknown evidence pinned by the preview digest; active evidence still refuses")
-        .option("--actor <id>", "Actor responsible for an audited recovery")
-        .option("--reason <text>", "Reason for an audited recovery")
+        .option("--force", "With --yes, admit missing or corrupt liveness evidence (active evidence still refuses) and record it")
         .option("--json", "Emit the reclaim preview or confirmed result as JSON")
         .action(async (runId, opts) => {
         const coordRoot = resolveCoordRoot();
@@ -502,13 +500,7 @@ export function registerWorkflowCommand(program, emit) {
             const result = await provider.reclaim(binding, {
                 mode: opts.discard ? "discard" : "salvage",
                 yes: opts.yes,
-                unknownLiveness: opts.unknownLiveness
-                    ? {
-                        evidenceSha256: opts.unknownLiveness,
-                        actor: opts.actor,
-                        reason: opts.reason,
-                    }
-                    : undefined,
+                force: opts.force,
             });
             if (opts.json) {
                 emit.config({ format: "json" });
@@ -519,11 +511,13 @@ export function registerWorkflowCommand(program, emit) {
                 const holders = result.lease_holder.map((holder) => `${holder.scope}: ${holder.owner_id ?? "unknown"}${holder.pid ? ` (pid ${holder.pid})` : ""}${holder.detail ? `; ${holder.detail}` : ""}`);
                 emit.text(`reclaim preview: ${result.run_id}\n` +
                     `mode: ${result.mode}\nliveness: ${result.liveness}\nownership: ${result.ownership}\n` +
-                    `evidence sha256: ${result.evidence_sha256}\n` +
                     `lease holder: ${holders.length > 0 ? holders.join(", ") : "none observed"}\n` +
                     `dirty paths: ${result.dirty_paths === null ? "unknown" : result.dirty_paths.length > 0 ? result.dirty_paths.join(", ") : "none"}\n` +
                     (result.ownership_detail ? `ownership detail: ${result.ownership_detail}\n` : "") +
-                    `Pass --yes to confirm ${result.mode} and release after all checks pass.\n`);
+                    `Pass --yes to confirm ${result.mode} and release after all checks pass.\n` +
+                    (result.liveness === "unknown"
+                        ? "Liveness is unknown; add --force with --yes only if the run is known to be stopped.\n"
+                        : ""));
                 return;
             }
             emit.text(`reclaim ${result.preparation.action}: ${result.preparation.detail}\n` +
@@ -539,39 +533,6 @@ export function registerWorkflowCommand(program, emit) {
             process.exit(1);
         }
     });
-    workflow
-        .command("unlock <run-id>")
-        .description("Preview or explicitly retire one exact resume lock whose local owner is proven dead.")
-        .option("--lock-sha256 <sha256>", "Exact lock identity digest returned by the preview")
-        .option("--actor <id>", "Actor responsible for the recovery")
-        .option("--reason <text>", "Reason for the recovery")
-        .option("--yes", "Confirm removal after dead-owner and exact-lock checks")
-        .option("--json", "Emit the recovery preview or result as JSON")
-        .action(async (runId, opts) => {
-        try {
-            const coordRoot = resolveCoordRoot();
-            if (!coordRoot)
-                throw new Error("no .harnery/ coordination root found");
-            const { recoverWorkflowResumeLease } = await import("../core/workflow/index.js");
-            const result = recoverWorkflowResumeLease(coordRoot, runId, opts);
-            if (opts.json) {
-                emit.config({ format: "json" });
-                emit.data(result);
-                return;
-            }
-            emit.text(`resume lock ${result.action}: ${runId}\nowner: ${result.owner_state}\nlock sha256: ${result.lock_sha256 ?? "absent"}\n` +
-                (result.action === "preview"
-                    ? "Pass --lock-sha256, --actor, --reason and --yes to confirm exact dead-owner recovery.\n"
-                    : `recovery: ${result.recovery_id}\n`));
-        }
-        catch (error) {
-            emit.error({
-                code: "workflow_resume_unlock_failed",
-                message: error instanceof Error ? error.message : String(error),
-            });
-            process.exit(1);
-        }
-    });
     const approvals = program
         .command("approval")
         .description("Inspect and resolve durable run-policy approvals.");

package/dist/core/agents/coord-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"coord-client.d.ts","sourceRoot":"","sources":["../../../src/core/agents/coord-client.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAeH;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAWhE;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,MAAM,CAI5E;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAOhF;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,IAAI,MAAM,GAAG,IAAI,CAE5C;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,GAAE,MAAsB,GAAG,MAAM,GAAG,IAAI,CA+B7E;AAED,iEAAiE;AACjE,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAE7D;AAeD;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGtD;AAiED,qEAAqE;AACrE,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAIvD;AAED,+EAA+E;AAC/E,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAG1D;AAED,mFAAmF;AACnF,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAExE;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CA+DxD;AAgCD;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,IAAI,MAAM,GAAG,IAAI,CAE5C;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,IAAI;IACxC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,MAAM,EAAE,KAAK,GAAG,QAAQ,GAAG,iBAAiB,GAAG,aAAa,GAAG,kBAAkB,GAAG,MAAM,CAAC;CAC5F,CAsEA;AAED;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,MAAM,GACX;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAsB5C;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG;IAClD,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,MAAM,EAAE,QAAQ,GAAG,iBAAiB,GAAG,MAAM,CAAC;CAC/C,CAyBA;AAyBD,sFAAsF;AACtF;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,IAAI,MAAM,GAAG,IAAI,CAEtD;AAuCD;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAEpE;AAED;;;;;;GAMG;AACH,wBAAgB,gCAAgC,CAC9C,IAAI,EAAE,MAAM,GACX;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG,IAAI,CAmB9C;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAOpE"}
+{"version":3,"file":"coord-client.d.ts","sourceRoot":"","sources":["../../../src/core/agents/coord-client.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAeH;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAWhE;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,MAAM,CAI5E;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAOhF;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,IAAI,MAAM,GAAG,IAAI,CAE5C;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,GAAE,MAAsB,GAAG,MAAM,GAAG,IAAI,CA+B7E;AAED,iEAAiE;AACjE,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAE7D;AAeD;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGtD;AAiED,qEAAqE;AACrE,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAIvD;AAED,+EAA+E;AAC/E,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAG1D;AAED,mFAAmF;AACnF,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAExE;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CA2CxD;AAgCD;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,IAAI,MAAM,GAAG,IAAI,CAE5C;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,IAAI;IACxC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,MAAM,EAAE,KAAK,GAAG,QAAQ,GAAG,iBAAiB,GAAG,aAAa,GAAG,kBAAkB,GAAG,MAAM,CAAC;CAC5F,CAsEA;AAED;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,MAAM,GACX;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAsB5C;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG;IAClD,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,MAAM,EAAE,QAAQ,GAAG,iBAAiB,GAAG,MAAM,CAAC;CAC/C,CAyBA;AAyBD,sFAAsF;AACtF;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,IAAI,MAAM,GAAG,IAAI,CAEtD;AAuCD;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAEpE;AAED;;;;;;GAMG;AACH,wBAAgB,gCAAgC,CAC9C,IAAI,EAAE,MAAM,GACX;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG,IAAI,CAmB9C;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAOpE"}

package/dist/core/agents/coord-client.js

@@ -251,25 +251,7 @@ export function parsePidmapRowStartToken(row) {
  * a test can hold this one against `processStartToken` and fail on drift.
  */
 export function pidStartToken(pid) {
-    if (!Number.isInteger(pid) || pid <= 0)
-        return null;
     const forced = process.env.HARNERY_PID_PROBE;
-    if (process.platform === "win32" && forced !== "procfs" && forced !== "ps") {
-        try {
-            const out = spawnSync("powershell.exe", [
-                "-NoLogo",
-                "-NoProfile",
-                "-NonInteractive",
-                "-Command",
-                `$process = [Diagnostics.Process]::GetProcessById(${pid}); try { 'w' + $process.StartTime.ToFileTimeUtc().ToString([Globalization.CultureInfo]::InvariantCulture) } finally { $process.Dispose() }`,
-            ], { encoding: "utf8", timeout: 10_000, windowsHide: true });
-            const token = String(out.stdout ?? "").trim();
-            return out.status === 0 && /^w\d+$/.test(token) ? token : null;
-        }
-        catch {
-            return null;
-        }
-    }
     const useProcfs = forced === "procfs" || (forced !== "ps" && existsSync("/proc/self/stat"));
     // One machine, one probe. Falling back to the other on a read failure would
     // answer in the wrong dialect and read as a recycled pid.

package/dist/core/agents/state/pidmap.js

@@ -15,7 +15,7 @@
  */
 import { existsSync, mkdirSync, readdirSync, readFileSync, renameSync, unlinkSync, writeFileSync, } from "node:fs";
 import { dirname, join } from "node:path";
-import { checkPidToken, processStartToken } from "./proc-start.js";
+import { processStartToken, verifyProcessGeneration } from "./proc-start.js";
 /**
  * Row count that triggers a dead-row sweep on the next write.
  *
@@ -44,7 +44,7 @@ export function parsePidmapRow(row) {
 function rowStillNamesItsProcess(pid, startToken) {
     if (!pidIsAlive(pid))
         return false;
-    return checkPidToken(pid, startToken) !== "mismatch";
+    return verifyProcessGeneration(pid, startToken) !== "different";
 }
 function atomicWrite(path, content) {
     mkdirSync(dirname(path), { recursive: true });

package/dist/core/agents/state/proc-start.d.ts

@@ -30,9 +30,8 @@
  *    through the caller's locale and timezone, so both are pinned; without that,
  *    two callers reading the same live process disagree.
  */
-import { signalProcessWithHandle } from "./process-handle.js";
 /** Which probe answers "when did this process start?" on this machine. */
-export type StartTokenProbe = "procfs" | "ps" | "windows";
+export type StartTokenProbe = "procfs" | "ps";
 /**
  * Which probe this machine uses, decided once.
  *
@@ -50,7 +49,7 @@ export declare function resetStartTokenCaches(): void;
  * than by splitting the whole line, because comm is the executable name in
  * parentheses and may itself contain spaces and parens. The boot segment is
  * dropped rather than faked when the kernel will not name its boot, which
- * yields the pre-boot-id shape that `tokensAgree` still accepts.
+ * yields the pre-boot-id shape that `verifyProcessGeneration` compares by ticks.
  */
 export declare function procfsStartToken(pid: number): string | null;
 /**
@@ -71,43 +70,33 @@ export declare function psStartToken(pid: number, run?: (pid: number) => {
 export declare function processStartToken(pid: number): string | null;
 export type ProcessGenerationVerdict = "same" | "different" | "unknown";
 type ReadProcessStartToken = (pid: number) => string | null;
-/** A missing or unreadable token never establishes process identity. */
+/**
+ * Does `pid` still name the run that wrote `recordedToken`?
+ *
+ * - `"same"`: both tokens present and equal.
+ * - `"different"`: the pid was recycled. A liveness check cannot see this,
+ *   because a recycled pid is alive.
+ * - `"unknown"`: a token is missing, malformed, or unreadable. Never treat
+ *   this as proof of identity.
+ *
+ * A Linux token written without a boot segment cannot identify a run across
+ * reboots, so it is compared on its tick count: a different count proves a
+ * different run, and an equal count stays unknown.
+ */
 export declare function verifyProcessGeneration(pid: number, recordedToken: string | null | undefined, readToken?: ReadProcessStartToken): ProcessGenerationVerdict;
 export interface ProcessGenerationSignalDependencies {
     readToken?: ReadProcessStartToken;
-    signalProcess?: typeof signalProcessWithHandle;
+    kill?: (pid: number, signal: NodeJS.Signals | number) => unknown;
 }
 /**
- * Observations may refuse a signal, but only the retained native process handle
- * can authorize it. No numeric-PID effect follows the preliminary token read.
+ * Recheck the process generation immediately before sending the signal.
+ *
+ * The process can still exit and its PID can be reused between the token read
+ * and the signal. Eliminating that race requires a generation-bound OS handle.
  */
 export declare function signalIfSameGeneration(pid: number, recordedToken: string | null | undefined, signal: NodeJS.Signals | number, dependencies?: ProcessGenerationSignalDependencies): {
     sent: boolean;
     verdict: ProcessGenerationVerdict;
 };
-/**
- * Do two tokens describe the same run?
- *
- * Equality, plus one concession: a row written before tokens carried a boot
- * segment recorded the tick count alone, so it is compared on the part it
- * actually recorded. Refusing that would call every pre-upgrade row a recycled
- * pid and prune a working machine's live rows the first time the new code ran.
- * Such a row loses its reboot protection until the next write rewrites it,
- * which is a strictly better position than the one it came from.
- */
-export declare function tokensAgree(recorded: string, current: string): boolean;
-/**
- * Does `pid` still name the process a row recorded?
- *
- * Three answers, and the difference between the last two matters:
- *
- * - `"match"` — recorded token, current token, same run. The row is trustworthy.
- * - `"mismatch"` — both present and different. The pid was recycled. This is
- *   the case a liveness check cannot see, because a recycled pid is alive.
- * - `"unverified"` — no recorded token (a row written before tokens existed) or
- *   no current one (an unsupported platform). Callers treat this the way they
- *   treated every row previously: trust it if the pid is alive.
- */
-export declare function checkPidToken(pid: number, recorded: string | undefined): "match" | "mismatch" | "unverified";
 export {};
 //# sourceMappingURL=proc-start.d.ts.map

package/dist/core/agents/state/proc-start.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"proc-start.d.ts","sourceRoot":"","sources":["../../../../src/core/agents/state/proc-start.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAKH,OAAO,EAAE,uBAAuB,EAA4B,MAAM,qBAAqB,CAAC;AAExF,0EAA0E;AAC1E,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,IAAI,GAAG,SAAS,CAAC;AAc1D;;;;;;GAMG;AACH,wBAAgB,eAAe,IAAI,eAAe,CAQjD;AAyBD,uDAAuD;AACvD,wBAAgB,qBAAqB,IAAI,IAAI,CAG5C;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAc3D;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAC1B,GAAG,EAAE,MAAM,EACX,GAAG,GAAE,CAAC,GAAG,EAAE,MAAM,KAAK;IAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAiB,GAC7E,MAAM,GAAG,IAAI,CAUf;AAWD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAQ5D;AAED,MAAM,MAAM,wBAAwB,GAAG,MAAM,GAAG,WAAW,GAAG,SAAS,CAAC;AAExE,KAAK,qBAAqB,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;AAE5D,wEAAwE;AACxE,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,MAAM,EACX,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACxC,SAAS,GAAE,qBAAyC,GACnD,wBAAwB,CAkB1B;AAED,MAAM,WAAW,mCAAmC;IAClD,SAAS,CAAC,EAAE,qBAAqB,CAAC;IAClC,aAAa,CAAC,EAAE,OAAO,uBAAuB,CAAC;CAChD;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,MAAM,EACX,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACxC,MAAM,EAAE,MAAM,CAAC,OAAO,GAAG,MAAM,EAC/B,YAAY,GAAE,mCAAwC,GACrD;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,wBAAwB,CAAA;CAAE,CAQtD;AAED;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAQtE;AAOD;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAC3B,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,GAAG,SAAS,GAC3B,OAAO,GAAG,UAAU,GAAG,YAAY,CAKrC"}
+{"version":3,"file":"proc-start.d.ts","sourceRoot":"","sources":["../../../../src/core/agents/state/proc-start.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAMH,0EAA0E;AAC1E,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,IAAI,CAAC;AAc9C;;;;;;GAMG;AACH,wBAAgB,eAAe,IAAI,eAAe,CAOjD;AAyBD,uDAAuD;AACvD,wBAAgB,qBAAqB,IAAI,IAAI,CAG5C;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAc3D;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAC1B,GAAG,EAAE,MAAM,EACX,GAAG,GAAE,CAAC,GAAG,EAAE,MAAM,KAAK;IAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAiB,GAC7E,MAAM,GAAG,IAAI,CAUf;AAWD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAG5D;AAED,MAAM,MAAM,wBAAwB,GAAG,MAAM,GAAG,WAAW,GAAG,SAAS,CAAC;AAExE,KAAK,qBAAqB,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;AAE5D;;;;;;;;;;;;GAYG;AACH,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,MAAM,EACX,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACxC,SAAS,GAAE,qBAAyC,GACnD,wBAAwB,CAuB1B;AAOD,MAAM,WAAW,mCAAmC;IAClD,SAAS,CAAC,EAAE,qBAAqB,CAAC;IAClC,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,GAAG,MAAM,KAAK,OAAO,CAAC;CAClE;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,MAAM,EACX,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACxC,MAAM,EAAE,MAAM,CAAC,OAAO,GAAG,MAAM,EAC/B,YAAY,GAAE,mCAAwC,GACrD;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,wBAAwB,CAAA;CAAE,CAUtD"}

package/dist/core/agents/state/proc-start.js

@@ -33,7 +33,6 @@
 import { spawnSync } from "node:child_process";
 import { existsSync, readFileSync } from "node:fs";
 import { coordEnv } from "../../../lib/env.js";
-import { signalProcessWithHandle, windowsProcessStartToken } from "./process-handle.js";
 /**
  * The `ps` probe is text formatted by `strftime("%c", localtime(...))`, so its
  * output moves with `TZ` and `LC_TIME`. A hook running under `LC_ALL=C` (git
@@ -55,8 +54,6 @@ export function startTokenProbe() {
     const override = coordEnv("PID_PROBE");
     if (override === "procfs" || override === "ps")
         return override;
-    if (process.platform === "win32")
-        return "windows";
     if (cachedProbe === undefined) {
         cachedProbe = existsSync("/proc/self/stat") ? "procfs" : "ps";
     }
@@ -98,7 +95,7 @@ export function resetStartTokenCaches() {
  * than by splitting the whole line, because comm is the executable name in
  * parentheses and may itself contain spaces and parens. The boot segment is
  * dropped rather than faked when the kernel will not name its boot, which
- * yields the pre-boot-id shape that `tokensAgree` still accepts.
+ * yields the pre-boot-id shape that `verifyProcessGeneration` compares by ticks.
  */
 export function procfsStartToken(pid) {
     let stat;
@@ -152,93 +149,63 @@ function defaultPsRun(pid) {
 export function processStartToken(pid) {
     if (!Number.isFinite(pid) || pid <= 0)
         return null;
-    const probe = startTokenProbe();
-    return probe === "windows"
-        ? windowsProcessStartToken(pid)
-        : probe === "procfs"
-            ? procfsStartToken(pid)
-            : psStartToken(pid);
+    return startTokenProbe() === "procfs" ? procfsStartToken(pid) : psStartToken(pid);
 }
-/** A missing or unreadable token never establishes process identity. */
+/**
+ * Does `pid` still name the run that wrote `recordedToken`?
+ *
+ * - `"same"`: both tokens present and equal.
+ * - `"different"`: the pid was recycled. A liveness check cannot see this,
+ *   because a recycled pid is alive.
+ * - `"unknown"`: a token is missing, malformed, or unreadable. Never treat
+ *   this as proof of identity.
+ *
+ * A Linux token written without a boot segment cannot identify a run across
+ * reboots, so it is compared on its tick count: a different count proves a
+ * different run, and an equal count stays unknown.
+ */
 export function verifyProcessGeneration(pid, recordedToken, readToken = processStartToken) {
     if (!Number.isInteger(pid) ||
         pid <= 0 ||
         typeof recordedToken !== "string" ||
         !recordedToken.trim())
         return "unknown";
-    // A bootless Linux token cannot identify a process across machine boots.
-    if (/^l\d+$/.test(recordedToken))
-        return "unknown";
+    let currentToken;
     try {
-        const currentToken = readToken(pid);
-        if (typeof currentToken !== "string" || !currentToken.trim())
-            return "unknown";
-        if (/^l\d+$/.test(currentToken))
-            return "unknown";
-        return currentToken === recordedToken ? "same" : "different";
+        currentToken = readToken(pid);
     }
     catch {
         return "unknown";
     }
+    if (typeof currentToken !== "string" || !currentToken.trim())
+        return "unknown";
+    const bootless = (token) => /^l\d+$/.test(token);
+    if (recordedToken[0] === "l" &&
+        currentToken[0] === "l" &&
+        (bootless(recordedToken) || bootless(currentToken)))
+        return ticksOf(recordedToken) === ticksOf(currentToken) ? "unknown" : "different";
+    return currentToken === recordedToken ? "same" : "different";
+}
+function ticksOf(token) {
+    const dot = token.indexOf(".");
+    return dot === -1 ? token.slice(1) : token.slice(dot + 1);
 }
 /**
- * Observations may refuse a signal, but only the retained native process handle
- * can authorize it. No numeric-PID effect follows the preliminary token read.
+ * Recheck the process generation immediately before sending the signal.
+ *
+ * The process can still exit and its PID can be reused between the token read
+ * and the signal. Eliminating that race requires a generation-bound OS handle.
  */
 export function signalIfSameGeneration(pid, recordedToken, signal, dependencies = {}) {
+    const kill = dependencies.kill ?? process.kill;
     const verdict = verifyProcessGeneration(pid, recordedToken, dependencies.readToken);
     if (verdict !== "same")
         return { sent: false, verdict };
     try {
-        return (dependencies.signalProcess ?? signalProcessWithHandle)(pid, recordedToken, signal);
+        kill(pid, signal);
+        return { sent: true, verdict };
     }
     catch {
-        return { sent: false, verdict: "unknown" };
+        return { sent: false, verdict };
     }
 }
-/**
- * Do two tokens describe the same run?
- *
- * Equality, plus one concession: a row written before tokens carried a boot
- * segment recorded the tick count alone, so it is compared on the part it
- * actually recorded. Refusing that would call every pre-upgrade row a recycled
- * pid and prune a working machine's live rows the first time the new code ran.
- * Such a row loses its reboot protection until the next write rewrites it,
- * which is a strictly better position than the one it came from.
- */
-export function tokensAgree(recorded, current) {
-    if (recorded === current)
-        return true;
-    // Only the Linux form has a boot segment to disagree about, and only when
-    // exactly one side carries one is this a shape difference rather than two
-    // genuinely different start instants.
-    if (recorded[0] !== "l" || current[0] !== "l")
-        return false;
-    if (recorded.includes(".") === current.includes("."))
-        return false;
-    return ticksOf(recorded) === ticksOf(current);
-}
-function ticksOf(token) {
-    const dot = token.indexOf(".");
-    return dot === -1 ? token.slice(1) : token.slice(dot + 1);
-}
-/**
- * Does `pid` still name the process a row recorded?
- *
- * Three answers, and the difference between the last two matters:
- *
- * - `"match"` — recorded token, current token, same run. The row is trustworthy.
- * - `"mismatch"` — both present and different. The pid was recycled. This is
- *   the case a liveness check cannot see, because a recycled pid is alive.
- * - `"unverified"` — no recorded token (a row written before tokens existed) or
- *   no current one (an unsupported platform). Callers treat this the way they
- *   treated every row previously: trust it if the pid is alive.
- */
-export function checkPidToken(pid, recorded) {
-    if (!recorded)
-        return "unverified";
-    const current = processStartToken(pid);
-    if (!current)
-        return "unverified";
-    return tokensAgree(recorded, current) ? "match" : "mismatch";
-}

package/dist/core/agents/state/service-process.d.ts

@@ -0,0 +1,61 @@
+import { type ProcessGenerationSignalDependencies, type ProcessGenerationVerdict } from "./proc-start.js";
+export interface ServiceProcessDependencies extends ProcessGenerationSignalDependencies {
+    /** Throws ESRCH, or returns false, when the process is gone. */
+    probePid?: (pid: number) => unknown;
+}
+export type ServiceLiveness = "running" | "stopped" | "unknown";
+export interface ServiceProcessOwner {
+    pid: number;
+    host: string;
+    start_token?: string;
+    state?: string;
+}
+/**
+ * A stale heartbeat does not prove that a process has exited. Another host, a
+ * probe error other than ESRCH, or an unverifiable token answers unknown. A
+ * recorded `stopped` state counts only while the generation still matches.
+ */
+export declare function observeServiceProcess(owner: ServiceProcessOwner, dependencies?: ServiceProcessDependencies): {
+    generation: ProcessGenerationVerdict;
+    liveness: ServiceLiveness;
+};
+/** Refuse a start while another owner runs or cannot be identified. */
+export declare function serviceStartRefusal(label: string, stopCommand: string, pid: number | undefined, liveness: ServiceLiveness): Error;
+export interface ServiceLease {
+    pid: number;
+    start_token?: string;
+    host: string;
+    nonce: string;
+    created_at?: string;
+}
+export declare function readServiceLease(path: string): ServiceLease | undefined;
+/** An absent lease is stopped; an unreadable one cannot be identified. */
+export declare function serviceLeaseOwner(path: string): {
+    lease?: ServiceLease;
+    liveness: ServiceLiveness;
+};
+/**
+ * Take the singleton lease with an exclusive create. A lease whose owner is
+ * proven stopped is replaced; any other owner refuses the start.
+ */
+export declare function acquireServiceLease(path: string, refuse: (pid: number | undefined, liveness: ServiceLiveness) => Error, fields?: Record<string, unknown>): {
+    nonce: string;
+    release: () => void;
+};
+export interface ServiceStopFields {
+    signal_sent: boolean;
+    signal_verdict: ProcessGenerationVerdict;
+}
+/**
+ * Write the durable stop request, then SIGTERM the owner `status` observed as
+ * running on this host, after a fresh generation check. The request stays for
+ * the daemon either way; `read` reports the state afterward.
+ */
+export declare function requestServiceStop<S extends {
+    liveness: ServiceLiveness;
+    generation: ProcessGenerationVerdict;
+    record?: ServiceProcessOwner;
+}>(status: S, read: () => S, stopPath: string, dependencies?: ServiceProcessDependencies, options?: {
+    signal?: boolean;
+}): S & ServiceStopFields;
+//# sourceMappingURL=service-process.d.ts.map

package/dist/core/agents/state/service-process.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-process.d.ts","sourceRoot":"","sources":["../../../../src/core/agents/state/service-process.ts"],"names":[],"mappings":"AAmBA,OAAO,EACL,KAAK,mCAAmC,EACxC,KAAK,wBAAwB,EAI9B,MAAM,iBAAiB,CAAC;AAEzB,MAAM,WAAW,0BAA2B,SAAQ,mCAAmC;IACrF,gEAAgE;IAChE,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;CACrC;AAED,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;AAEhE,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,mBAAmB,EAC1B,YAAY,GAAE,0BAA+B,GAC5C;IAAE,UAAU,EAAE,wBAAwB,CAAC;IAAC,QAAQ,EAAE,eAAe,CAAA;CAAE,CAuBrE;AAED,uEAAuE;AACvE,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,QAAQ,EAAE,eAAe,GACxB,KAAK,CAMP;AAED,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS,CAmBvE;AAED,0EAA0E;AAC1E,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG;IAC/C,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB,QAAQ,EAAE,eAAe,CAAC;CAC3B,CAIA;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,EAAE,QAAQ,EAAE,eAAe,KAAK,KAAK,EACrE,MAAM,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GACnC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,IAAI,CAAA;CAAE,CA0CxC;AAED,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,OAAO,CAAC;IACrB,cAAc,EAAE,wBAAwB,CAAC;CAC1C;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,CAAC,SAAS;IACR,QAAQ,EAAE,eAAe,CAAC;IAC1B,UAAU,EAAE,wBAAwB,CAAC;IACrC,MAAM,CAAC,EAAE,mBAAmB,CAAC;CAC9B,EAED,MAAM,EAAE,CAAC,EACT,IAAI,EAAE,MAAM,CAAC,EACb,QAAQ,EAAE,MAAM,EAChB,YAAY,GAAE,0BAA+B,EAC7C,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAA;CAAO,GACjC,CAAC,GAAG,iBAAiB,CAevB"}

package/dist/core/agents/state/service-process.js

@@ -0,0 +1,143 @@
+/**
+ * One owner check for every singleton background service (governor, local
+ * supervisor, legacy resource observer): is the recorded process still the
+ * run that wrote the record, and how is a stop requested?
+ */
+import { randomUUID } from "node:crypto";
+import { closeSync, existsSync, mkdirSync, openSync, readFileSync, unlinkSync, writeFileSync, } from "node:fs";
+import { hostname } from "node:os";
+import { dirname } from "node:path";
+import { writePrivateJsonAtomic } from "../../storage/atomic-json.js";
+import { stateDirMode, stateFileMode } from "../../storage/modes.js";
+import { processStartToken, signalIfSameGeneration, verifyProcessGeneration, } from "./proc-start.js";
+/**
+ * A stale heartbeat does not prove that a process has exited. Another host, a
+ * probe error other than ESRCH, or an unverifiable token answers unknown. A
+ * recorded `stopped` state counts only while the generation still matches.
+ */
+export function observeServiceProcess(owner, dependencies = {}) {
+    if (owner.host !== hostname())
+        return { generation: "unknown", liveness: "unknown" };
+    try {
+        if ((dependencies.probePid ?? ((pid) => process.kill(pid, 0)))(owner.pid) === false)
+            return { generation: "unknown", liveness: "stopped" };
+    }
+    catch (error) {
+        return {
+            generation: "unknown",
+            liveness: error.code === "ESRCH" ? "stopped" : "unknown",
+        };
+    }
+    const generation = verifyProcessGeneration(owner.pid, owner.start_token, dependencies.readToken);
+    return {
+        generation,
+        liveness: generation === "same"
+            ? owner.state === "stopped"
+                ? "stopped"
+                : "running"
+            : generation === "different"
+                ? "stopped"
+                : "unknown",
+    };
+}
+/** Refuse a start while another owner runs or cannot be identified. */
+export function serviceStartRefusal(label, stopCommand, pid, liveness) {
+    return new Error(liveness === "running"
+        ? `${label} is already running under pid ${pid}`
+        : `${label} process generation is unknown${pid ? ` for pid ${pid}` : ""}; run \`${stopCommand}\` to write a durable stop request before starting it again`);
+}
+export function readServiceLease(path) {
+    try {
+        const value = JSON.parse(readFileSync(path, "utf8"));
+        if (!Number.isSafeInteger(value.pid) ||
+            (value.pid ?? 0) <= 0 ||
+            typeof value.host !== "string" ||
+            !value.host ||
+            typeof value.nonce !== "string" ||
+            !value.nonce)
+            return undefined;
+        return {
+            ...value,
+            start_token: typeof value.start_token === "string" ? value.start_token : undefined,
+        };
+    }
+    catch {
+        return undefined;
+    }
+}
+/** An absent lease is stopped; an unreadable one cannot be identified. */
+export function serviceLeaseOwner(path) {
+    if (!existsSync(path))
+        return { liveness: "stopped" };
+    const lease = readServiceLease(path);
+    return { lease, liveness: lease ? observeServiceProcess(lease).liveness : "unknown" };
+}
+/**
+ * Take the singleton lease with an exclusive create. A lease whose owner is
+ * proven stopped is replaced; any other owner refuses the start.
+ */
+export function acquireServiceLease(path, refuse, fields = {}) {
+    mkdirSync(dirname(path), { recursive: true, mode: stateDirMode() });
+    for (let attempt = 0; attempt < 2; attempt++) {
+        const startToken = processStartToken(process.pid);
+        const lease = {
+            ...fields,
+            pid: process.pid,
+            ...(startToken ? { start_token: startToken } : {}),
+            host: hostname(),
+            nonce: randomUUID(),
+            created_at: new Date().toISOString(),
+        };
+        try {
+            const fd = openSync(path, "wx", stateFileMode());
+            try {
+                writeFileSync(fd, `${JSON.stringify(lease)}\n`, "utf8");
+            }
+            finally {
+                closeSync(fd);
+            }
+            return {
+                nonce: lease.nonce,
+                release: () => {
+                    if (readServiceLease(path)?.nonce !== lease.nonce)
+                        return;
+                    try {
+                        unlinkSync(path);
+                    }
+                    catch {
+                        // A missing lease is already released.
+                    }
+                },
+            };
+        }
+        catch (error) {
+            if (error.code !== "EEXIST")
+                throw error;
+            const owner = serviceLeaseOwner(path);
+            if (owner.liveness !== "stopped")
+                throw refuse(owner.lease?.pid, owner.liveness);
+            try {
+                unlinkSync(path);
+            }
+            catch {
+                // A concurrent starter may have replaced or removed the stale lease.
+            }
+        }
+    }
+    throw new Error(`could not acquire the singleton lease at ${path}`);
+}
+/**
+ * Write the durable stop request, then SIGTERM the owner `status` observed as
+ * running on this host, after a fresh generation check. The request stays for
+ * the daemon either way; `read` reports the state afterward.
+ */
+export function requestServiceStop(status, read, stopPath, dependencies = {}, options = {}) {
+    writePrivateJsonAtomic(stopPath, {
+        requested_at: new Date().toISOString(),
+        requested_by_pid: process.pid,
+    });
+    const signal = options.signal !== false && status.liveness === "running" && status.record?.host === hostname()
+        ? signalIfSameGeneration(status.record.pid, status.record.start_token, "SIGTERM", dependencies)
+        : { sent: false, verdict: status.generation };
+    return { ...read(), signal_sent: signal.sent, signal_verdict: signal.verdict };
+}

package/dist/core/context/index.d.ts

@@ -7,7 +7,7 @@
 import type { Adapter } from "../adapter.js";
 import type { RepoSnapshot } from "./observation.js";
 export type { RepoObservation, RepoSnapshot } from "./observation.js";
-export { observationsComparable } from "./observation.js";
+export { repoComparisonProblems } from "./observation.js";
 export declare const CONTEXT_SCHEMA_VERSION: 1;
 export declare const MAX_CAPSULE_BYTES: number;
 export type ContextSampleSource = "hook" | "native_event" | "result" | "transcript" | "estimate";
@@ -97,7 +97,6 @@ export interface PreparedContextCheckpoint {
     instance_id: string;
     generation: number;
     capsule_id: string;
-    capsule_sha256: string;
 }
 export interface PreparedContextRecovery {
     checkpoint: Readonly<PreparedContextCheckpoint>;
@@ -126,8 +125,11 @@ export declare function prepareContextRecovery(coordRoot: string, input: {
 }): PreparedContextRecovery | null;
 /**
  * Advance continuity only after the adapter accepted the prepared briefing.
- * Missing, altered, foreign or superseded checkpoints refuse without writing.
- * Repeating the same accepted checkpoint is an exact no-op.
+ * A foreign or superseded checkpoint refuses without writing, and repeating
+ * the same accepted checkpoint is an exact no-op. The write is a
+ * compare-and-write: if the state changed after it was read, for example
+ * because a newer checkpoint landed, completion refuses instead of
+ * overwriting it.
  */
 export declare function completeContextRecovery(coordRoot: string, input: {
     sessionId: string;