rea-agents 6.0.0 → 6.2.0

package/dist/process/capture/FilesystemSnapshot.js

@@ -59,25 +59,33 @@ export const hashFile = async (path, expected, maxBytes, signal) => {
 /** Capture bounded, root-aliased filesystem state without following symlinks. */
 export const snapshotRoots = async (scenario, signal) => {
     const entries = [];
+    const completeRoots = [];
     let remainingBytes = scenario.limits.file_bytes;
     let truncated = false;
+    const enumerationReasons = new Set();
+    const hashOmissions = [];
     const visit = async (root, rootAlias, path, depth) => {
         signal?.throwIfAborted();
         if (entries.length >= scenario.limits.files ||
             depth > scenario.limits.filesystem_depth) {
             truncated = true;
-            return;
+            if (entries.length >= scenario.limits.files)
+                enumerationReasons.add("files_limit");
+            if (depth > scenario.limits.filesystem_depth)
+                enumerationReasons.add("depth_limit");
+            return false;
         }
         const stats = await lstatIfPresent(path);
         if (stats === undefined)
-            return;
+            return true;
         const relativePath = relative(root, path) || ".";
         if (stats.isSymbolicLink()) {
             const target = resolve(dirname(path), await readlink(path));
             const afterRead = await lstat(path);
             if (!hasSameIdentity(stats, afterRead, "symlink")) {
                 truncated = true;
-                return;
+                enumerationReasons.add("identity_changed");
+                return false;
             }
             entries.push({
                 path: `${rootAlias}:${relativePath}`,
@@ -87,15 +95,24 @@ export const snapshotRoots = async (scenario, signal) => {
                 sha256: null,
                 symlink_target: target,
             });
-            return;
+            return true;
         }
         if (stats.isFile()) {
             const sha256 = remainingBytes >= stats.size
                 ? await hashFile(path, stats, remainingBytes, signal)
                 : null;
             remainingBytes -= sha256 === null ? 0 : stats.size;
-            if (sha256 === null)
+            if (sha256 === null) {
                 truncated = true;
+                hashOmissions.push({
+                    path: `${rootAlias}:${relativePath}`,
+                    size_bytes: stats.size,
+                    remaining_budget_bytes: remainingBytes,
+                    reason: remainingBytes < stats.size
+                        ? "file_bytes_budget"
+                        : "file_changed_or_short_read",
+                });
+            }
             entries.push({
                 path: `${rootAlias}:${relativePath}`,
                 type: "file",
@@ -104,7 +121,7 @@ export const snapshotRoots = async (scenario, signal) => {
                 sha256,
                 symlink_target: null,
             });
-            return;
+            return true;
         }
         const type = stats.isDirectory() ? "directory" : "other";
         entries.push({
@@ -116,22 +133,42 @@ export const snapshotRoots = async (scenario, signal) => {
             symlink_target: null,
         });
         if (type !== "directory")
-            return;
+            return true;
         const children = await readdir(path);
         const afterRead = await lstat(path);
         if (!hasSameIdentity(stats, afterRead, "directory")) {
             truncated = true;
-            return;
+            enumerationReasons.add("identity_changed");
+            return false;
+        }
+        let complete = true;
+        for (const child of children.sort()) {
+            if (!(await visit(root, rootAlias, join(path, child), depth + 1)))
+                complete = false;
         }
-        for (const child of children.sort())
-            await visit(root, rootAlias, join(path, child), depth + 1);
+        return complete;
     };
     for (const [index, root] of scenario.filesystem_observation_paths.entries()) {
+        const alias = `root_${String(index)}`;
         if ((await lstatIfPresent(root)) === undefined) {
-            truncated = true;
+            completeRoots.push(alias);
             continue;
         }
-        await visit(root, `root_${String(index)}`, root, 0);
+        if (await visit(root, alias, root, 0))
+            completeRoots.push(alias);
     }
-    return { files: entries, truncated };
+    return {
+        files: entries,
+        truncated,
+        completeRoots,
+        coverage: {
+            files_limit: scenario.limits.files,
+            depth_limit: scenario.limits.filesystem_depth,
+            enumeration_truncated: completeRoots.length !== scenario.filesystem_observation_paths.length,
+            enumeration_reasons: [...enumerationReasons],
+            hash_budget_bytes: scenario.limits.file_bytes,
+            hashed_bytes: scenario.limits.file_bytes - remainingBytes,
+            hash_omissions: hashOmissions,
+        },
+    };
 };

package/dist/process/capture/ProcessCaptureError.js

@@ -1,3 +1,4 @@
+import { DarwinProcessOwnershipInspectionError } from "../DarwinProcessRunTokenReader.js";
 import { AnalysisError } from "../../domain/analysisErrorBase.js";
 /** Typed application failure produced by controlled process capture. */
 export class ProcessCaptureError extends AnalysisError {
@@ -12,14 +13,14 @@ export class ProcessCaptureError extends AnalysisError {
     cleanupReport;
     constructor(message, options) {
         super(message, options);
-        this.userMessage = options?.userMessage;
+        this.userMessage = options?.userMessage ?? message;
         this.userCategory = options?.userCategory;
         this.reason =
             options?.reason ??
                 (options?.userCategory === "cancelled" ? "cancelled" : "capture_failed");
         this.cleanupIncomplete = this.reason === "cleanup_incomplete";
         this.cleanupResources = options?.cleanupResources ?? [];
-        this.executionFailure = options?.executionFailure;
+        this.executionFailure = options?.executionFailure ?? message;
         this.partialObservation = options?.partialObservation;
         this.cleanupReport = options?.cleanupReport;
     }
@@ -40,3 +41,15 @@ export const processCaptureCancelled = () => new ProcessCaptureError("process ca
     reason: "cancelled",
     userMessage: "Process capture was cancelled. Start it again when ready.",
 });
+/** Preserve typed process-inspection preflight failures at the capture boundary. */
+export const normalizeCaptureFailure = (cause, signal) => {
+    if (cause instanceof ProcessCaptureError)
+        return cause;
+    if (cause instanceof DarwinProcessOwnershipInspectionError)
+        return new ProcessCaptureError(cause.message, { cause });
+    if (signal?.aborted === true &&
+        (cause === signal.reason ||
+            (cause instanceof Error && cause.name === "AbortError")))
+        return processCaptureCancelled();
+    return cause;
+};

package/dist/process/capture/ProcessCaptureLifecycle.js

@@ -3,18 +3,22 @@ import { constants, statSync } from "node:fs";
 import { open, mkdtemp, rm, stat } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import { digestProcessCommitment, parseProcessCapture, partialProcessCaptureObservationSchema, processComparisonContract, processScenarioCommitment, } from "../../domain/process/processCapture.js";
+import { setTimeout as delay } from "node:timers/promises";
+import { digestProcessCommitment, processComparisonContract, processScenarioCommitment, } from "../../domain/process/processScenario.js";
+import { parseProcessCapture } from "../../domain/process/processCaptureParsing.js";
 import { PRODUCT_IDENTITY } from "../../identity.js";
 import { snapshotRoots } from "./FilesystemSnapshot.js";
 import { classifyFilesystemEffects } from "./ProcessFilesystemEffects.js";
 import { cleanupOwnedProcessGroup, verifyNoTokenOwnedProcesses, } from "../ProcessOwnership.js";
 import { observeOwnedProcessGroup, prepareProcessOwnershipInspection, systemProcessOwnershipHost, } from "../ProcessOwnershipObservation.js";
-import { describeProcessCaptureExecutionFailure, ProcessCaptureError, } from "./ProcessCaptureError.js";
+import { describeProcessCaptureExecutionFailure, normalizeCaptureFailure, ProcessCaptureError, } from "./ProcessCaptureError.js";
 import { assertNotCancelled } from "./ProcessScenarioRuntimeValidation.js";
 import { normalizeProcessElapsedTime, normalizeProcessSamples, normalizeProcessText, } from "./ProcessNormalization.js";
 import { PROCESS_PROVIDER } from "../../domain/process/processEvidenceProvider.js";
 import { TerminalRenderer } from "./TerminalRenderer.js";
+import { hasCaptureTruncation, } from "../../domain/process/processCaptureCoverage.js";
 import { scheduleProcessInterval } from "./ProcessTimer.js";
+import { partialProcessCaptureObservationSchema } from "../../domain/process/processCapture.js";
 /** Seed explicit observation availability before capture completion begins. */
 export const createProcessCaptureObservationBuffer = (options) => ({
     target_pid: {
@@ -92,6 +96,9 @@ export const buildCaptureResult = (options) => {
     const sensitiveInputUnknown = "Sensitive scripted input values are redacted from process capture Evidence.";
     const filesystemObservationUnknown = "No filesystem observation paths were selected; filesystem effects remain unknown.";
     const hasFilesystemObservations = options.scenario.filesystem_observation_paths.length > 0;
+    const filesystemEffects = classifyFilesystemEffects(options.before, options.after);
+    const hasUnknownFilesystemEffects = filesystemEffects.some(({ status }) => status === "unknown");
+    const incompleteFilesystemUnknown = "Path absence in incomplete enumeration or below an unfollowed symbolic link remains unknown.";
     return {
         manifest: options.manifest,
         normalization: options.scenario.normalization,
@@ -111,8 +118,13 @@ export const buildCaptureResult = (options) => {
         event_journal: options.eventJournal,
         files_before: options.before.files,
         files_after: options.after.files,
-        filesystem_effects: classifyFilesystemEffects(options.before.files, options.after.files),
-        truncated: options.truncated,
+        filesystem_effects: filesystemEffects,
+        truncated: options.truncationDetails === undefined
+            ? options.truncated
+            : hasCaptureTruncation(options.truncationDetails),
+        ...(options.truncationDetails === undefined
+            ? {}
+            : { truncation_details: options.truncationDetails }),
         limitations: [
             "The executable digest is a prelaunch file sample; matching path metadata immediately after spawn does not prove an atomic operating-system image binding.",
             "Process trees are sampled and may omit short-lived descendants.",
@@ -122,6 +134,10 @@ export const buildCaptureResult = (options) => {
             "Filesystem observations are before/after snapshots, not syscall traces.",
             "Inherited host environment variables are not recorded and may affect results.",
             ...(!hasFilesystemObservations ? [filesystemObservationUnknown] : []),
+            ...(hasUnknownFilesystemEffects ? [incompleteFilesystemUnknown] : []),
+            ...(options.truncationDetails === undefined
+                ? []
+                : captureCoverageUnknowns(options.truncationDetails).map(({ reason }) => reason)),
             ...(hasSensitiveScriptedInput ? [sensitiveInputUnknown] : []),
         ],
         residual_unknowns: [
@@ -149,12 +165,58 @@ export const buildCaptureResult = (options) => {
                     },
                 ]
                 : []),
+            ...(hasUnknownFilesystemEffects
+                ? [
+                    {
+                        scope: "filesystem",
+                        reason: incompleteFilesystemUnknown,
+                    },
+                ]
+                : []),
             ...(hasSensitiveScriptedInput
                 ? [{ scope: "interaction", reason: sensitiveInputUnknown }]
                 : []),
+            ...(options.truncationDetails === undefined
+                ? []
+                : captureCoverageUnknowns(options.truncationDetails).filter(({ scope }) => scope !== "terminal")),
         ],
     };
 };
+const captureCoverageUnknowns = (details) => {
+    const unknowns = [];
+    if (details.raw_terminal.observed_frames > details.raw_terminal.retained_frames)
+        unknowns.push({
+            scope: "terminal",
+            reason: "Raw PTY chunks exceeded output_bytes and were omitted; rendered states also lack those inputs. See truncation_details.raw_terminal.",
+        });
+    if (details.rendered_terminal.observed_frames >
+        details.rendered_terminal.retained_frames)
+        unknowns.push({
+            scope: "terminal",
+            reason: "Cumulative rendered state and visible-line bytes exceeded output_bytes; whole rendered frames were omitted. Raw PTY coverage is reported separately. See truncation_details.rendered_terminal.",
+        });
+    for (const [name, coverage] of [
+        ["before", details.filesystem_before],
+        ["after_settlement", details.filesystem_after],
+    ]) {
+        if (coverage.enumeration_truncated)
+            unknowns.push({
+                scope: "filesystem",
+                reason: `Filesystem ${name} path enumeration was incomplete: ${coverage.enumeration_reasons.join(", ")}. See truncation_details.`,
+            });
+        if (coverage.hash_omissions.length > 0)
+            unknowns.push({
+                scope: "filesystem",
+                reason: `Filesystem ${name} omitted ${String(coverage.hash_omissions.length)} whole-file digests; per-path reasons and remaining file_bytes budget are in truncation_details.`,
+            });
+    }
+    if (details.process.sampling_partial)
+        unknowns.push({
+            scope: "process",
+            reason: "Process sampling stopped with incomplete observations; sample_limit is reported in truncation_details.process.",
+        });
+    return unknowns;
+};
 const identityFromStats = (stats) => ({
     dev: stats.dev,
     ino: stats.ino,
@@ -301,7 +363,8 @@ export const createRunManifest = async (scenario, startedAt, completedAt, execut
         normalization_sha256: digestProcessCommitment(scenario.normalization),
     };
 };
-export const observeSettlement = async (runId, processGroupIds, settleMs, recordEvent = () => undefined, platform = process.platform) => {
+export const observeSettlement = async (runId, processGroupIds, settleMs, recordEvent = () => undefined, platform = process.platform, signal) => {
+    assertNotCancelled(signal);
     if (platform === "win32") {
         recordEvent("lifecycle", 1);
         return { state: "unverifiable", elapsed_ms: 0 };
@@ -310,11 +373,9 @@ export const observeSettlement = async (runId, processGroupIds, settleMs, record
     let consecutiveEmpty = 0;
     let deadlineReached = false;
     while (!deadlineReached) {
-        const observations = await Promise.all([...new Set(processGroupIds)].map((processGroupId) => observeOwnedProcessGroup({
-            runId,
-            leaderPid: processGroupId,
-            processGroupId,
-        })));
+        assertNotCancelled(signal);
+        const observations = await Promise.all([...new Set(processGroupIds)].map((processGroupId) => observeOwnedProcessGroup({ runId, leaderPid: processGroupId, processGroupId }, undefined, signal)));
+        assertNotCancelled(signal);
         if (observations.some(({ state }) => state === "unverifiable")) {
             recordEvent("lifecycle", 1);
             return { state: "unverifiable", elapsed_ms: Date.now() - started };
@@ -331,7 +392,7 @@ export const observeSettlement = async (runId, processGroupIds, settleMs, record
         deadlineReached = Date.now() - started >= settleMs;
         if (deadlineReached)
             break;
-        await new Promise((resolve) => setTimeout(resolve, 50));
+        await delay(50, undefined, { signal });
     }
     recordEvent("lifecycle", 1);
     return { state: "alive_at_deadline", elapsed_ms: Date.now() - started };
@@ -403,6 +464,50 @@ const verifyTokenOwnedProcessesUntilSettled = async (verify) => {
     }
     return result;
 };
+const releaseCapturedProcessGroup = async (ownership, host) => {
+    if (host.platform === "win32")
+        return {
+            state: "unverified",
+            reason: "owned process cleanup is unverifiable on Windows without process-job authority",
+        };
+    let outcome = {
+        state: "cleaned",
+        reason: null,
+    };
+    const unverified = [];
+    try {
+        const cleaned = await host.cleanupProcessGroup(ownership);
+        unverified.push(...(cleaned.unverified ?? []));
+        if (!cleaned.cleaned) {
+            outcome = { state: "unverified", reason: cleaned.reason };
+        }
+        else {
+            const verified = await verifyTokenOwnedProcessesUntilSettled(() => host.verifyTokenOwnedProcesses(ownership.runId, undefined, ownership.captureBaseline, ownership));
+            unverified.push(...(verified.unverified ?? []));
+            if (!verified.cleaned)
+                outcome = { state: "unverified", reason: verified.reason };
+        }
+    }
+    catch (cause) {
+        outcome = {
+            state: "failed",
+            reason: cause instanceof Error
+                ? cause.message || cause.name || "owned process cleanup failed"
+                : "owned process cleanup failed",
+        };
+    }
+    return unverified.length === 0
+        ? outcome
+        : {
+            ...outcome,
+            unverified_processes: [
+                ...new Map(unverified.map(({ pid, diagnostic }) => [
+                    `${String(pid)}:${diagnostic}`,
+                    { pid, reason: diagnostic },
+                ])).values(),
+            ],
+        };
+};
 export const releaseProcessResources = async (options) => {
     const host = options.host ?? processCaptureCleanupHost;
     for (const timer of options.timers)
@@ -422,40 +527,20 @@ export const releaseProcessResources = async (options) => {
                 : "renderer dispose failed",
         };
     }
-    let ownedProcessGroup = {
-        state: options.terminal === undefined ? "not_required" : "cleaned",
-        reason: null,
-    };
-    if (options.terminal !== undefined) {
-        if (host.platform === "win32") {
-            ownedProcessGroup = {
-                state: "unverified",
-                reason: "owned process cleanup is unverifiable on Windows without process-job authority",
-            };
-        }
-        else {
-            const cleaned = await host.cleanupProcessGroup({
-                runId: options.runId,
-                leaderPid: options.terminal.pid,
-                processGroupId: options.terminal.pid,
-                sweepTokenOwnedProcesses: true,
-                ...(options.sampledProcessGroupIds === undefined
-                    ? {}
-                    : { sampledProcessGroupIds: options.sampledProcessGroupIds }),
-                ...(options.captureBaseline === undefined
-                    ? {}
-                    : { captureBaseline: options.captureBaseline }),
-            });
-            if (!cleaned.cleaned) {
-                ownedProcessGroup = { state: "unverified", reason: cleaned.reason };
-            }
-            else {
-                const verified = await verifyTokenOwnedProcessesUntilSettled(() => host.verifyTokenOwnedProcesses(options.runId, undefined, options.captureBaseline));
-                if (!verified.cleaned)
-                    ownedProcessGroup = { state: "unverified", reason: verified.reason };
-            }
-        }
-    }
+    const ownedProcessGroup = options.terminal === undefined
+        ? { state: "not_required", reason: null }
+        : await releaseCapturedProcessGroup({
+            runId: options.runId,
+            leaderPid: options.terminal.pid,
+            processGroupId: options.terminal.pid,
+            sweepTokenOwnedProcesses: true,
+            ...(options.sampledProcessGroupIds === undefined
+                ? {}
+                : { sampledProcessGroupIds: options.sampledProcessGroupIds }),
+            ...(options.captureBaseline === undefined
+                ? {}
+                : { captureBaseline: options.captureBaseline }),
+        }, host);
     let temporaryRoot = {
         state: "cleaned",
         reason: null,
@@ -487,12 +572,14 @@ export const cleanupReportFailure = (report) => {
 };
 export const captureTerminalFrames = (options) => {
     let outputBytes = 0;
-    let truncated = false;
+    let observedBytes = 0;
+    let observedFrames = 0;
     options.terminal.onData((data) => {
         options.onOutput();
         const bytes = Buffer.byteLength(data);
+        observedBytes += bytes;
+        observedFrames += 1;
         if (outputBytes + bytes > options.scenario.limits.output_bytes) {
-            truncated = true;
             return;
         }
         outputBytes += bytes;
@@ -503,49 +590,68 @@ export const captureTerminalFrames = (options) => {
             sequence,
             at_ms: atMs,
             data: normalized,
+            ...(normalized === data ? {} : { raw_data: data }),
         });
         options.renderer.write(data, atMs);
         options.recordEvent("frames", sequence);
     });
-    return () => truncated;
+    return () => ({
+        budget_bytes: options.scenario.limits.output_bytes,
+        observed_bytes: observedBytes,
+        retained_bytes: outputBytes,
+        observed_frames: observedFrames,
+        retained_frames: options.frames.length,
+    });
 };
 export const resolveProcessResult = (capture, executionFailure, cleanup, observations, partialContext) => {
     const cleanupFailure = cleanupReportFailure(cleanup);
-    if (cleanupFailure !== undefined) {
-        const cleanupResources = Object.entries(cleanup)
-            .filter(([, outcome]) => outcome.state === "failed" || outcome.state === "unverified")
-            .map(([resource]) => resource);
-        const executionFailureReason = describeProcessCaptureExecutionFailure(executionFailure);
-        let partialObservation;
-        if (capture !== undefined || observations !== undefined) {
-            const normalizedObservations = observations === undefined || partialContext === undefined
-                ? observations
-                : normalizePartialProcessObservations(observations, partialContext);
-            const partialPayload = capture === undefined
-                ? { observations: normalizedObservations }
-                : { capture };
-            const pendingCapture = capture === undefined
-                ? undefined
-                : {
-                    ...capture,
-                    settlement: {
+    const executionFailureReason = describeProcessCaptureExecutionFailure(executionFailure);
+    let partialObservation;
+    if ((cleanupFailure !== undefined || executionFailure !== undefined) &&
+        (capture !== undefined || observations !== undefined)) {
+        const normalizedObservations = observations === undefined || partialContext === undefined
+            ? observations
+            : normalizePartialProcessObservations(observations, partialContext);
+        if (capture === undefined) {
+            if (normalizedObservations !== undefined) {
+                const partialResult = partialProcessCaptureObservationSchema.safeParse({
+                    observations: normalizedObservations,
+                    cleanup,
+                    execution_failure: executionFailureReason ?? null,
+                });
+                if (partialResult.success)
+                    partialObservation = partialResult.data;
+            }
+        }
+        else {
+            const captureData = "cleanup" in capture
+                ? (() => {
+                    const { cleanup: _cleanup, ...data } = capture;
+                    void _cleanup;
+                    return data;
+                })()
+                : capture;
+            const settlement = cleanupFailure !== undefined
+                ? { ...capture.settlement, cleanup_outcome: "failed" }
+                : capture.settlement.state === "quiesced"
+                    ? {
                         ...capture.settlement,
-                        cleanup_outcome: "failed",
-                    },
-                };
+                        cleanup_outcome: "not_required",
+                    }
+                    : { ...capture.settlement, cleanup_outcome: "cleaned" };
             const partialResult = partialProcessCaptureObservationSchema.safeParse({
-                ...partialPayload,
-                ...(pendingCapture === undefined
-                    ? {}
-                    : {
-                        capture: Object.fromEntries(Object.entries(pendingCapture).filter(([key]) => key !== "cleanup")),
-                    }),
+                capture: { ...captureData, settlement },
                 cleanup,
                 execution_failure: executionFailureReason ?? null,
             });
             if (partialResult.success)
                 partialObservation = partialResult.data;
         }
+    }
+    if (cleanupFailure !== undefined) {
+        const cleanupResources = Object.entries(cleanup)
+            .filter(([, outcome]) => outcome.state === "failed" || outcome.state === "unverified")
+            .map(([resource]) => resource);
         throw new ProcessCaptureError(cleanupFailure, {
             cause: executionFailure,
             reason: "cleanup_incomplete",
@@ -557,20 +663,43 @@ export const resolveProcessResult = (capture, executionFailure, cleanup, observa
             cleanupReport: cleanup,
         });
     }
-    if (executionFailure instanceof ProcessCaptureError)
-        throw executionFailure;
+    if (executionFailure instanceof ProcessCaptureError) {
+        const retainedExecutionFailure = executionFailure.executionFailure ?? executionFailureReason;
+        const retainedPartialObservation = executionFailure.partialObservation ?? partialObservation;
+        throw new ProcessCaptureError(executionFailure.message, {
+            cause: executionFailure,
+            ...(executionFailure.userMessage === undefined
+                ? {}
+                : { userMessage: executionFailure.userMessage }),
+            ...(executionFailure.userCategory === undefined
+                ? {}
+                : { userCategory: executionFailure.userCategory }),
+            reason: executionFailure.reason,
+            cleanupResources: executionFailure.cleanupResources,
+            ...(retainedExecutionFailure === undefined
+                ? {}
+                : { executionFailure: retainedExecutionFailure }),
+            ...(retainedPartialObservation === undefined
+                ? {}
+                : { partialObservation: retainedPartialObservation }),
+            cleanupReport: executionFailure.cleanupReport ?? cleanup,
+        });
+    }
     if (executionFailure !== undefined) {
-        const executionFailureReason = describeProcessCaptureExecutionFailure(executionFailure);
         throw new ProcessCaptureError("process capture failed", {
             cause: executionFailure,
+            reason: "capture_failed",
             ...(executionFailureReason === undefined
                 ? {}
                 : { executionFailure: executionFailureReason }),
+            ...(partialObservation === undefined ? {} : { partialObservation }),
+            cleanupReport: cleanup,
         });
     }
     if (capture === undefined)
         throw new ProcessCaptureError("process capture produced no result");
-    if ("cleanup" in capture)
+    const unverifiedProcesses = cleanup.owned_process_group.unverified_processes;
+    if ("cleanup" in capture && unverifiedProcesses === undefined)
         return capture;
     const settlement = capture.settlement.state === "quiesced"
         ? { ...capture.settlement, cleanup_outcome: "not_required" }
@@ -579,9 +708,20 @@ export const resolveProcessResult = (capture, executionFailure, cleanup, observa
         return parseProcessCapture({
             ...capture,
             settlement,
+            residual_unknowns: [
+                ...capture.residual_unknowns,
+                ...(unverifiedProcesses ?? []).map(({ pid, reason }) => ({
+                    scope: "process",
+                    reason: `Ownership of unrelated process ${String(pid)} could not be verified; it was left untouched: ${reason}`,
+                })),
+            ],
             cleanup: {
+                ...("cleanup" in capture ? capture.cleanup : {}),
                 owned_process_group: "verified",
                 temporary_root: "removed",
+                ...(unverifiedProcesses === undefined
+                    ? {}
+                    : { unverified_processes: unverifiedProcesses }),
             },
         });
     }
@@ -594,16 +734,30 @@ export const prepareProcessCapture = async (scenario, signal, captureSnapshot =
     await host.prepareOwnershipInspector?.(signal);
     assertNotCancelled(signal);
     const before = await captureSnapshot(scenario, signal);
+    const runId = randomUUID();
     const temporaryRoot = await host.createTemporaryRoot();
     try {
         assertNotCancelled(signal);
-        const runId = randomUUID();
         const ownershipBaseline = (await host.captureOwnershipBaseline?.(signal)) ?? [];
         assertNotCancelled(signal);
         return { temporaryRoot, runId, ownershipBaseline, before };
     }
     catch (cause) {
-        await host.cleanup(temporaryRoot);
+        const cleanup = await releaseProcessResources({
+            timers: new Set(),
+            terminal: undefined,
+            renderer: undefined,
+            runId,
+            temporaryRoot,
+            host: { ...processCaptureCleanupHost, removeTemporaryRoot: host.cleanup },
+        });
+        resolveProcessResult(undefined, normalizeCaptureFailure(cause, signal), cleanup, createProcessCaptureObservationBuffer({
+            frames: [],
+            interactions: [],
+            samples: [],
+            eventJournal: [],
+            before,
+        }), { scenario });
         throw cause;
     }
 };