omp-conductor 0.15.3 → 0.15.5

package/src/upgrade.ts

@@ -1,7 +1,7 @@
 import { existsSync, readFileSync } from "node:fs";
 import { backupTimestamp, copyToUniqueBackup } from "./backups.ts";
 import { inspectBriefLayout, type BriefLayout } from "./brief-upgrade.ts";
-import { setPaused, statusSnapshot } from "./daemon.ts";
+import { pauseInstance, setPaused, statusSnapshot } from "./daemon.ts";
 import {
   DEFAULT_HERDR_SESSION,
   fleetLayers,
@@ -52,7 +52,28 @@ export interface UpgradeDeps {
   snapshot(project?: string): { liveWorkers: number };
   layers(project?: string): FleetLayers;
   brief(project?: string): { kind: BriefLayout["kind"]; current: boolean };
-  daemonIdentity(): { running: boolean; project?: string };
+  /**
+   * Every configured project name, in config order. One daemon serves all of
+   * them (the generated unit's ExecStart carries no `--project`), so a
+   * transaction that restarts that daemon has to know the whole set rather
+   * than the one project a caller happened to name (#389).
+   */
+  projectNames(): readonly string[];
+  /**
+   * The daemon the transaction targets, when one is running. `generation`
+   * identifies the exact instance (pid + start time) so a later restart cannot
+   * stop an instance created after the request began (#377).
+   */
+  daemonIdentity(): { running: boolean; project?: string; generation?: string };
+  /**
+   * The durable pause sentinel this fleet currently holds, as an *instance*,
+   * read from one selected file (the per-project sentinel first): who set it,
+   * why, and when that sentinel was created. Two pauses with identical
+   * provenance are still different instances if `since` differs, so a drain
+   * can tell its own sentinel from one a later actor re-created after a
+   * resume lifted it — even when a legacy global sentinel coexists (#377).
+   */
+  pauseState(project?: string): { source: string; reason?: string; since: number } | undefined;
   setPaused(value: boolean, project?: string): void;
   restartDaemon(): Promise<void>;
   sleep(ms: number): Promise<void>;
@@ -89,10 +110,17 @@ export const DEFAULT_DEPS: UpgradeDeps = {
     const live = readFileSync(layout.orchestratorPath, "utf8");
     return { kind: layout.kind, current: live === renderBriefForProject(project, policy) };
   },
+  projectNames: () => loadConfig().projects.map((p) => p.name),
   daemonIdentity: () => {
     const daemon = livingDaemon();
-    return daemon === undefined ? { running: false } : { running: true, project: daemon.project };
+    if (daemon === undefined) return { running: false };
+    return {
+      running: true,
+      project: daemon.project,
+      generation: `${daemon.pid}@${daemon.startedAt}`,
+    };
   },
+  pauseState: (project) => pauseInstance(project),
   setPaused: (v, project) =>
     setPaused(v, { source: "upgrade", reason: "upgrade, draining" }, project),
   restartDaemon: async () => {
@@ -248,10 +276,110 @@ function previousHerdrInstall(source: string): readonly [string, readonly string
   ];
 }
 
-async function waitForDrain(deps: UpgradeDeps, project?: string, deadlineAt?: number): Promise<void> {
+/**
+ * The projects one lifecycle transaction covers, and the single pause sentinel
+ * that represents them.
+ *
+ * Everything an upgrade or a draining restart replaces is host-wide: the
+ * Bun-global CLI, the omp plugin, the Herdr plugin, and the one dispatch
+ * daemon. That daemon serves *every* configured project — the generated unit's
+ * ExecStart carries no `--project` — so its restart lands on all of them at
+ * once. The scope therefore names every project whose workers must drain and
+ * whose brief must be refreshed, instead of the single project a caller
+ * happened to name (#389).
+ *
+ * `selectors` are what the rest of the module passes back to the project-aware
+ * deps. A selector of `undefined` means "the one configured project", which is
+ * how a single-project host has always addressed itself: keeping it verbatim
+ * means the single-project path still emits exactly the same `brief-upgrade`
+ * command and the same one `snapshot` call it did before.
+ *
+ * `pauseKey` is the sentinel this transaction owns. It is `undefined` for a
+ * host-wide scope, which selects the legacy *global* sentinel — and that is
+ * precisely the right instrument: `isPaused(name)` consults the global file
+ * for every project, so one write pauses the whole host, and removing it lifts
+ * exactly this transaction's pause while leaving any per-project operator hold
+ * standing.
+ */
+interface UpgradeScope {
+  /** Project selectors to address the project-aware deps with, never empty. */
+  selectors: readonly (string | undefined)[];
+  /** The sentinel this transaction pauses and resumes. */
+  pauseKey: string | undefined;
+}
+
+/**
+ * Decides which projects a transaction covers, and refuses the requests that
+ * cannot be honoured truthfully.
+ *
+ * Two refusals, both about a caller naming a project the daemon does not agree
+ * with:
+ *
+ *  - the daemon records a *different* project — it serves that one, so a
+ *    request aimed at another is simply about a different fleet;
+ *  - the daemon records *no* project while several are configured. That is not
+ *    "unknown", it is the multi-project daemon: it serves them all. Narrowing
+ *    is refused rather than obeyed, because draining one project and then
+ *    restarting the shared daemon would kill the other projects' live workers
+ *    without ever counting them (#389, and the shared-daemon rule in #378).
+ *
+ * A single-configured-project host keeps the historical bare selector, so its
+ * behaviour is unchanged whether or not the daemon recorded its name.
+ */
+function resolveScope(deps: UpgradeDeps, verb: "upgrade" | "restart", project?: string): UpgradeScope {
+  let configured: readonly string[] = [];
+  try {
+    configured = deps.projectNames();
+  } catch {
+    // No readable config is not this function's error to raise: the caller
+    // reaches a project-aware dep moments later and fails with the real
+    // problem. Treat it as the historical bare case.
+  }
+  const daemon = deps.daemonIdentity();
+
+  if (project !== undefined) {
+    if (daemon.running && daemon.project !== undefined && daemon.project !== project) {
+      throw new Error(
+        `active daemon serves ${daemon.project}; refusing to ${verb} --project ${project} while it is running`,
+      );
+    }
+    if (daemon.running && daemon.project === undefined && configured.length > 1) {
+      throw new Error(
+        `the running daemon serves all ${String(configured.length)} configured projects ` +
+          `(${configured.join(", ")}); ${verb} replaces host-wide packages and restarts that one daemon, ` +
+          `so it cannot be narrowed to --project ${project} — re-run \`omp-conductor ${verb}\` without --project`,
+      );
+    }
+    return { selectors: [project], pauseKey: project };
+  }
+
+  // A daemon that recorded its project serves that project alone; the rest of
+  // the config is somebody else's fleet as far as this restart is concerned.
+  if (daemon.running && daemon.project !== undefined) {
+    return { selectors: [daemon.project], pauseKey: daemon.project };
+  }
+  if (configured.length > 1) return { selectors: configured, pauseKey: undefined };
+  return { selectors: [undefined], pauseKey: undefined };
+}
+
+async function waitForDrain(
+  deps: UpgradeDeps,
+  scope: UpgradeScope,
+  deadlineAt?: number,
+  stale?: () => string | undefined,
+): Promise<void> {
   let last = -1;
   while (true) {
-    const workers = deps.snapshot(project).liveWorkers;
+    // A transaction that is no longer the fleet's current intent exits before
+    // it waits on anyone else's workers: a resume lifted its pause or the
+    // daemon it began with was replaced, so there is nothing left to drain
+    // and nothing it may stop (#377).
+    const cancelled = stale?.();
+    if (cancelled !== undefined) throw new Error(cancelled);
+    // Every project the scope covers: a host-wide drain that counted only one
+    // would report zero while another project's worker was still writing to a
+    // worktree the restart is about to orphan (#389).
+    const workers = scope.selectors.reduce((n, s) => n + deps.snapshot(s).liveWorkers, 0);
     if (workers === 0) return;
     if (deadlineAt !== undefined && Date.now() >= deadlineAt) {
       throw new Error(
@@ -264,10 +392,71 @@ async function waitForDrain(deps: UpgradeDeps, project?: string, deadlineAt?: nu
   }
 }
 
+/**
+ * What a draining restart captured when it began: the restart-owned pause and
+ * the daemon instance it is entitled to stop. Every later fence check compares
+ * live state against this snapshot, so the destructive restart call only ever
+ * acts on the world the request began in (#377).
+ */
+interface RestartBegun {
+  /** The durable pause sentinel this request relies on, proved readable as an instance. */
+  pauseToken: { source: string; reason?: string; since: number };
+  /** The daemon instance the restart targets, with its generation identity. */
+  daemon: ReturnType<UpgradeDeps["daemonIdentity"]>;
+}
+
+/**
+ * Why a draining restart can no longer act, or `undefined` when it still owns
+ * the pause and the daemon generation it began with. The pause check is the
+ * *restart-owned sentinel instance* — `drainAndRestart` proves ownership up
+ * front, so a token that cannot be re-read (sentinel removed, unreadable, or
+ * re-created — even under the same source and reason) means this request's own
+ * pause no longer exists and it must cancel. The generation check is the
+ * later-daemon fence: a daemon created after this request began — by
+ * `restart --now`, a crash-restart, or an operator start — must never be
+ * stopped by it.
+ */
+function restartFenceProblem(
+  deps: UpgradeDeps,
+  scope: UpgradeScope,
+  begun: RestartBegun,
+): string | undefined {
+  if (!deps.layers(scope.pauseKey).paused) {
+    return "restart cancelled: dispatch was resumed while the drain was in progress — nothing was restarted";
+  }
+  const owned = deps.pauseState(scope.pauseKey);
+  if (
+    owned === undefined ||
+    owned.since !== begun.pauseToken.since ||
+    owned.source !== begun.pauseToken.source ||
+    owned.reason !== begun.pauseToken.reason
+  ) {
+    return "restart cancelled: the restart-owned pause was lifted and replaced while the drain was in progress — nothing was restarted";
+  }
+  const now = deps.daemonIdentity();
+  if (now.running !== begun.daemon.running || (begun.daemon.running && now.generation !== begun.daemon.generation)) {
+    return "restart cancelled: the daemon instance was replaced while the drain was in progress — the newer daemon was left running";
+  }
+  return undefined;
+}
+
 /**
  * Pause, drain, restart, restore — the trusted restart transaction, minus the
  * install/verify steps of {@link upgradeConductor}.
  *
+ * Generation-scoped (#377): the transaction captures the restart-owned pause
+ * and the daemon generation when it begins and revalidates both on every drain
+ * poll and once more immediately before the destructive restart call. A
+ * `resume`, a `restart --now`, or any other action that lifts the pause or
+ * replaces the daemon while the drain waits makes the transaction stale: it
+ * exits nonzero without stopping anything, so a timed-out or disconnected
+ * restart caller cannot leave a delayed stop aimed at a later daemon
+ * generation. The stale transaction restores nothing and leaves whatever
+ * pause the fleet now has exactly as it found it. Ownership is proven up
+ * front: a sentinel that cannot be read as an instance at transaction start
+ * aborts before any drain or restart, because a lock the fence cannot compare
+ * against is a lock the fence cannot protect.
+ *
  * Mirrors the upgrade's fail-closed posture: on ANY throw after the pause the
  * fleet stays paused (no resume in a catch) and the error rethrows, so a
  * systemd-owned restart that fails or a drain that outlives `timeoutMs` cannot
@@ -278,11 +467,34 @@ export async function drainAndRestart(
   deps: UpgradeDeps,
   o: { project?: string; timeoutMs: number },
 ): Promise<void> {
-  const initial = deps.layers(o.project);
-  if (!initial.paused) deps.setPaused(true, o.project);
-  await waitForDrain(deps, o.project, Date.now() + o.timeoutMs);
+  // Host-wide by default (#389): the daemon this restarts serves every
+  // configured project, so the drain counts every project's workers and the
+  // pause covers all of them.
+  const scope = resolveScope(deps, "restart", o.project);
+  const initial = deps.layers(scope.pauseKey);
+  if (!initial.paused) deps.setPaused(true, scope.pauseKey);
+  // The lock must be provable NOW. A pause that cannot be read as an instance
+  // — sentinel malformed or unreadable — would make the whole fence fail open
+  // (nothing to compare against), so the transaction refuses before waiting
+  // on anything it cannot act upon either way.
+  const pauseToken = deps.pauseState(scope.pauseKey);
+  if (pauseToken === undefined) {
+    throw new Error(
+      "restart cancelled: cannot prove the restart-owned pause — the active pause sentinel is unreadable or malformed; nothing was restarted",
+    );
+  }
+  const begun: RestartBegun = {
+    pauseToken,
+    daemon: deps.daemonIdentity(),
+  };
+  const stale = () => restartFenceProblem(deps, scope, begun);
+  await waitForDrain(deps, scope, Date.now() + o.timeoutMs, stale);
+  // The drain completed; the world may have moved on while it did. Re-prove
+  // the pause and the generation an instant before the destructive call.
+  const cancelled = stale();
+  if (cancelled !== undefined) throw new Error(cancelled);
   await deps.restartDaemon();
-  if (!initial.paused) deps.setPaused(false, o.project);
+  if (!initial.paused) deps.setPaused(false, scope.pauseKey);
 }
 
 function recoveryProblem(
@@ -308,19 +520,32 @@ function recoveryProblem(
 async function waitForRecovery(
   deps: UpgradeDeps,
   initial: FleetLayers,
-  project?: string,
+  scope: UpgradeScope,
 ): Promise<void> {
   let problem = "recovery did not settle";
   for (let attempt = 0; attempt < RECOVERY_ATTEMPTS; attempt += 1) {
-    problem = recoveryProblem(deps.layers(project), initial, deps.snapshot(project).liveWorkers) ?? "";
+    const live = scope.selectors.reduce((n, s) => n + deps.snapshot(s).liveWorkers, 0);
+    problem = recoveryProblem(deps.layers(scope.pauseKey), initial, live) ?? "";
     if (problem === "") return;
     await deps.sleep(RECOVERY_POLL_MS);
   }
   throw new Error(`upgrade verification failed: ${problem}`);
 }
 
+/** One project's brief, as the transaction found it. */
+interface ScopedBrief {
+  /** The selector to address the project-aware deps and the CLI with. */
+  selector: string | undefined;
+  kind: BriefLayout["kind"];
+  current: boolean;
+}
+
 /**
- * Brings the brief up with the freshly installed package.
+ * Brings every in-scope brief up with the freshly installed package.
+ *
+ * Each project owns its own ORCHESTRATOR.md, so a host-wide upgrade migrates
+ * them one at a time rather than leaving every project but one on a floor the
+ * installed package no longer emits (#389).
  *
  * `brief-upgrade --migrate --apply` is the cross-version ABI: this code runs
  * from the *old* CLI while the new one is already installed, so the verb has to
@@ -334,29 +559,27 @@ async function waitForRecovery(
  *    fleet on a single-file brief whose floor no longer tracks the package —
  *    the exact drift this verb exists to end — so it fails loudly and rolls back.
  */
-async function upgradeBrief(
-  deps: UpgradeDeps,
-  kind: BriefLayout["kind"],
-  project?: string,
-): Promise<void> {
-  const selected = project === undefined ? [] : ["--project", project];
-  if (kind === "legacy-handwritten") {
-    // Ungated on purpose: a hand-written brief cannot be migrated without it.
-    await mustRun(deps, "omp-conductor", ["brief-upgrade", "--retrofit", "--apply", ...selected]);
-  }
-  try {
-    await mustRun(deps, "omp-conductor", ["brief-upgrade", "--migrate", "--apply", ...selected]);
-  } catch (err) {
-    if (kind !== "overlay") throw err;
-    const msg = err instanceof Error ? err.message : String(err);
-    deps.log(`brief: brief-upgrade unavailable in the target CLI (${msg}) — overlay recomposes each tick, continuing`);
+async function upgradeBriefs(deps: UpgradeDeps, briefs: readonly ScopedBrief[]): Promise<void> {
+  for (const brief of briefs) {
+    const selected = brief.selector === undefined ? [] : ["--project", brief.selector];
+    if (brief.kind === "legacy-handwritten") {
+      // Ungated on purpose: a hand-written brief cannot be migrated without it.
+      await mustRun(deps, "omp-conductor", ["brief-upgrade", "--retrofit", "--apply", ...selected]);
+    }
+    try {
+      await mustRun(deps, "omp-conductor", ["brief-upgrade", "--migrate", "--apply", ...selected]);
+    } catch (err) {
+      if (brief.kind !== "overlay") throw err;
+      const msg = err instanceof Error ? err.message : String(err);
+      deps.log(`brief: brief-upgrade unavailable in the target CLI (${msg}) — overlay recomposes each tick, continuing`);
+    }
   }
 }
 
 async function rollbackUpgrade(
   deps: UpgradeDeps,
   previous: InstalledSurfaces,
-  project: string | undefined,
+  scope: UpgradeScope,
   installTouched: boolean,
   briefChanged: boolean,
   herdrReloadStarted: boolean,
@@ -466,7 +689,10 @@ async function rollbackUpgrade(
   if (briefChanged) {
     try {
       deps.log("rollback: ORCHESTRATOR.md package floor");
-      await upgradeBrief(deps, "overlay", project);
+      await upgradeBriefs(
+        deps,
+        scope.selectors.map((selector) => ({ selector, kind: "overlay" as const, current: false })),
+      );
     } catch (err) {
       failures.push(err instanceof Error ? err.message : String(err));
     }
@@ -515,23 +741,21 @@ export async function upgradeConductor(
   }
 
   const requested = options.version === undefined ? `${PACKAGE}@latest` : `${PACKAGE}@${options.version}`;
-  const daemon = deps.daemonIdentity();
-  if (daemon.running && options.project !== undefined && daemon.project !== options.project) {
-    const active = daemon.project === undefined ? "an unrecorded project" : daemon.project;
-    throw new Error(
-      `active daemon serves ${active}; refusing to upgrade --project ${options.project} while it is running`,
-    );
-  }
-  const project = options.project ?? daemon.project;
+  // Host-wide by default (#389): one daemon serves every configured project,
+  // so an upgrade that restarts it drains them all and refreshes every brief.
+  const scope = resolveScope(deps, "upgrade", options.project);
 
   const release = parseRegistry(
     (await mustRun(deps, "npm", ["view", requested, "version", "gitHead", "--json"])).stdout,
   );
-  const initial = deps.layers(project);
+  const initial = deps.layers(scope.pauseKey);
   const surfaces = await inspectSurfaces(deps);
-  const brief = deps.brief(project);
+  const briefs: ScopedBrief[] = scope.selectors.map((selector) => ({
+    selector,
+    ...deps.brief(selector),
+  }));
   const installNeeded = !surfacesCurrent(surfaces, release.version, release.gitHead);
-  if (!installNeeded && brief.current) {
+  if (!installNeeded && briefs.every((b) => b.current)) {
     return {
       previousVersion: surfaces.cliVersion,
       ...release,
@@ -562,17 +786,24 @@ export async function upgradeConductor(
     // either — the in-memory restore below still covers a clean rollback.
   }
 
-  if (brief.kind === "missing") throw new Error("no ORCHESTRATOR.md exists for the configured project");
+  const missing = briefs.find((b) => b.kind === "missing");
+  if (missing !== undefined) {
+    throw new Error(
+      missing.selector === undefined
+        ? "no ORCHESTRATOR.md exists for the configured project"
+        : `no ORCHESTRATOR.md exists for project ${missing.selector}`,
+    );
+  }
   if (initial.herdr === "unknown") throw new Error("cannot determine whether herdr-fleet.service is active");
 
   deps.log(`target release: omp-conductor@${release.version} (${release.gitHead})`);
   if (!initial.paused) {
     deps.log("safety: pausing new issue claims");
-    deps.setPaused(true, project);
+    deps.setPaused(true, scope.pauseKey);
   }
   deps.log("drain: waiting for live omp worker sessions");
   try {
-    await waitForDrain(deps, project);
+    await waitForDrain(deps, scope);
   } catch (err) {
     const failure = err instanceof Error ? err.message : String(err);
     throw new Error(
@@ -610,7 +841,7 @@ export async function upgradeConductor(
 
     deps.log("brief: refreshing managed ORCHESTRATOR.md floor while preserving POLICY.md");
     briefChanged = true;
-    await upgradeBrief(deps, brief.kind, project);
+    await upgradeBriefs(deps, briefs);
 
     if (initial.herdr === "active") {
       herdrReloadStarted = true;
@@ -635,13 +866,13 @@ export async function upgradeConductor(
       const active = await mustRun(deps, "systemctl", ["is-active", HERDR_UNIT]);
       if (active.stdout.trim() !== "active") throw new Error(`${HERDR_UNIT} is not active after restart`);
     }
-    await waitForRecovery(deps, initial, project);
+    await waitForRecovery(deps, initial, scope);
     deps.log("verify 2/2: recovered fleet remains stable");
     await deps.sleep(1_000);
-    await waitForRecovery(deps, initial, project);
+    await waitForRecovery(deps, initial, scope);
 
-    if (!initial.paused) deps.setPaused(false, project);
-    const restoredDispatch = deps.layers(project).dispatch;
+    if (!initial.paused) deps.setPaused(false, scope.pauseKey);
+    const restoredDispatch = deps.layers(scope.pauseKey).dispatch;
     if (restoredDispatch !== initial.dispatch) {
       throw new Error(
         `dispatch state is ${restoredDispatch}; expected to restore ${initial.dispatch}`,
@@ -649,9 +880,9 @@ export async function upgradeConductor(
     }
   } catch (err) {
     try {
-      if (!deps.layers(project).paused) deps.setPaused(true, project);
+      if (!deps.layers(scope.pauseKey).paused) deps.setPaused(true, scope.pauseKey);
     } catch {
-      deps.setPaused(true, project);
+      deps.setPaused(true, scope.pauseKey);
     }
     const failure = err instanceof Error ? err.message : String(err);
     deps.log(`upgrade failed: ${failure}`);
@@ -659,7 +890,7 @@ export async function upgradeConductor(
       await rollbackUpgrade(
         deps,
         surfaces,
-        project,
+        scope,
         installTouched,
         briefChanged,
         herdrReloadStarted,

package/src/worker.ts

@@ -10,7 +10,7 @@
  * sliding into a merge queue.
  */
 
-import { createSession, disposeSession } from "./omp.ts";
+import { createSession, disposeSession, SessionAdmissionClosedError, type AgentSessionLike } from "./omp.ts";
 import type { ReleaseBlockContext } from "./release-policy.ts";
 import type { Caps, ReleaseShape, ResolvedGrants, RunState } from "./types.ts";
 
@@ -123,6 +123,13 @@ export interface WorkerOpts {
    * exists; absent = no pause surface (tests, one-shot callers).
    */
   onPauseControl?: (control: WorkerPauseControl) => void;
+  /**
+   * Pre-spawn admission gate, forwarded to `createSession` (#374): the daemon
+   * closes it the moment its stop begins, so a stop that lands while the
+   * session socket is binding refuses the spawn and the run settles `stopped`
+   * instead of `failed`. Absent, the spawn always proceeds.
+   */
+  maySpawn?: () => boolean;
 }
 
 /**
@@ -253,20 +260,39 @@ export async function runWorker(
   const now = deps.now ?? Date.now;
   const schedule = deps.schedule ?? scheduleWallClock;
 
-  const session = await deps.createSession({
-    cwd: o.cwd,
-    ...(o.sessionDir === undefined ? {} : { sessionDir: o.sessionDir }),
-    ...(o.model === undefined ? {} : { model: o.model }),
-    // Prevention half of #24: as a worker, structured file tools cannot leave
-    // this worktree, and no release grant can ever reach this session (#122).
-    role: "worker",
-    ...(o.releaseGrants === undefined ? {} : { releaseGrants: o.releaseGrants }),
-    ...(o.onReleaseBlocked === undefined ? {} : { onReleaseBlocked: o.onReleaseBlocked }),
-    ...(o.onSpawn === undefined ? {} : { onSpawn: o.onSpawn }),
-    ...(o.socketPath === undefined ? {} : { socketPath: o.socketPath }),
-    ...(o.verbSocketPath === undefined ? {} : { verbSocketPath: o.verbSocketPath }),
-    ...(o.onChildLog === undefined ? {} : { onChildLog: o.onChildLog }),
-  });
+  let session: AgentSessionLike;
+  try {
+    session = await deps.createSession({
+      cwd: o.cwd,
+      ...(o.sessionDir === undefined ? {} : { sessionDir: o.sessionDir }),
+      ...(o.model === undefined ? {} : { model: o.model }),
+      // Prevention half of #24: as a worker, structured file tools cannot leave
+      // this worktree, and no release grant can ever reach this session (#122).
+      role: "worker",
+      ...(o.releaseGrants === undefined ? {} : { releaseGrants: o.releaseGrants }),
+      ...(o.onReleaseBlocked === undefined ? {} : { onReleaseBlocked: o.onReleaseBlocked }),
+      ...(o.onSpawn === undefined ? {} : { onSpawn: o.onSpawn }),
+      ...(o.socketPath === undefined ? {} : { socketPath: o.socketPath }),
+      ...(o.verbSocketPath === undefined ? {} : { verbSocketPath: o.verbSocketPath }),
+      ...(o.onChildLog === undefined ? {} : { onChildLog: o.onChildLog }),
+      ...(o.maySpawn === undefined ? {} : { maySpawn: o.maySpawn }),
+    });
+  } catch (err) {
+    // The pre-spawn gate closed (#374): a daemon stop landed while the session
+    // socket was binding, so no child was ever created. That is a stop, not a
+    // failure — reporting `failed` here would charge an attempt against a
+    // worker the shutdown refused to start. `onSpawn` was never called.
+    if (err instanceof SessionAdmissionClosedError) {
+      return {
+        state: "stopped",
+        turns: 0,
+        spendUsd: 0,
+        report: "",
+        stoppedReason: "daemon shutdown began before the worker session started",
+      };
+    }
+    throw err;
+  }
 
   // Before the first turn, not after the last: a caller that only learns the
   // transcript path from the result learns it once the run it wanted to watch