stitchkit 0.103.9 → 0.103.10

package/dist/index-nybn2err.js

@@ -0,0 +1,213 @@
+import {
+  loadDarwinBinding
+} from "./index-d4pa2bgs.js";
+import {
+  isRecord
+} from "./index-9jfdm5tg.js";
+
+// src/internal/process-instance.ts
+import { readFile as readFile2, readlink } from "node:fs/promises";
+import { platform as platform2 } from "node:os";
+import { z } from "zod";
+
+// src/internal/process-identity.ts
+import { execFile } from "node:child_process";
+import { readFile } from "node:fs/promises";
+import { platform } from "node:os";
+import { promisify } from "node:util";
+var detectedIdentity;
+async function firstReadableLine(paths) {
+  for (const path of paths) {
+    try {
+      const text = (await readFile(path, "utf8")).trim();
+      if (text.length > 0)
+        return text;
+    } catch {}
+  }
+  return null;
+}
+var run = promisify(execFile);
+function parsePlatformUuid(dump) {
+  return /"IOPlatformUUID"\s*=\s*"([^"]+)"/.exec(dump)?.[1] ?? null;
+}
+async function readDarwinPlatformUuid(command = "ioreg") {
+  try {
+    const { stdout } = await run(command, ["-rd1", "-c", "IOPlatformExpertDevice"], {
+      timeout: 2000,
+      maxBuffer: 1 << 20,
+      encoding: "utf8"
+    });
+    return parsePlatformUuid(stdout);
+  } catch {
+    return null;
+  }
+}
+async function machineIdentity(declared) {
+  if (declared !== undefined)
+    return declared;
+  if (detectedIdentity !== undefined)
+    return detectedIdentity;
+  detectedIdentity = platform() === "darwin" ? await readDarwinPlatformUuid() : await firstReadableLine(["/etc/machine-id", "/var/lib/dbus/machine-id"]);
+  return detectedIdentity;
+}
+async function probeLiveness(pid, reach = (target) => process.kill(target, 0)) {
+  try {
+    reach(pid);
+  } catch (error) {
+    return isRecord(error) && error.code === "ESRCH" ? "gone" : "alive";
+  }
+  return await isZombieProcess(pid) ? "gone" : "alive";
+}
+async function isZombieProcess(pid, seam = {}) {
+  const { procRoot = "/proc", psCommand = "ps" } = seam;
+  try {
+    const stat = await readFile(`${procRoot}/${pid}/stat`, "utf8");
+    return stat.slice(stat.lastIndexOf(")") + 1).trimStart().startsWith("Z");
+  } catch {}
+  try {
+    const { stdout } = await run(psCommand, ["-o", "state=", "-p", String(pid)], {
+      timeout: 2000,
+      maxBuffer: 1 << 16,
+      encoding: "utf8"
+    });
+    return stdout.trim().startsWith("Z");
+  } catch {
+    return false;
+  }
+}
+
+// src/internal/process-instance.ts
+var ProcessInstanceSchema2 = z.object({
+  platform: z.enum(["linux", "darwin"]),
+  bootId: z.string().min(1),
+  namespace: z.string().min(1),
+  startId: z.string().regex(/^\d+$/)
+}).strict();
+var ProcessInstanceObservationSchema = z.discriminatedUnion("state", [
+  z.object({ state: z.literal("observed"), instance: ProcessInstanceSchema2 }),
+  z.object({ state: z.literal("unavailable"), cause: z.unknown() })
+]);
+async function observeProcessInstance2(pid) {
+  z.number().int().positive().max(2147483647).parse(pid);
+  return observeProcessInstanceAt(pid, "/proc");
+}
+function linuxProcessStart(stat, pid) {
+  if (!stat.startsWith(`${pid} (`))
+    return null;
+  const end = stat.lastIndexOf(")");
+  if (end < 0)
+    return null;
+  const start = stat.slice(end + 1).trim().split(/\s+/)[19];
+  return start !== undefined && /^\d+$/.test(start) ? start : null;
+}
+async function readProcessInstance(pid, procRoot = "/proc") {
+  const result = await observeProcessInstanceAt(pid, procRoot);
+  return result.state === "observed" ? result.instance : null;
+}
+async function observeProcessInstanceAt(pid, procRoot) {
+  try {
+    if (platform2() === "darwin") {
+      return {
+        state: "observed",
+        instance: ProcessInstanceSchema2.parse(loadDarwinBinding().processIdentity(pid))
+      };
+    }
+    if (platform2() !== "linux")
+      throw new Error("Process lifetime observation requires Linux or Darwin");
+    const [bootId, namespace, ownStatus, timeNamespace, ownStat, stat] = await Promise.all([
+      readFile2(`${procRoot}/sys/kernel/random/boot_id`, "utf8"),
+      readlink(`${procRoot}/self/ns/pid`),
+      readFile2(`${procRoot}/self/status`, "utf8"),
+      readlink(`${procRoot}/self/ns/time`).catch((error) => {
+        if (error instanceof Error && "code" in error && error.code === "ENOENT")
+          return "";
+        throw error;
+      }),
+      readFile2(`${procRoot}/self/stat`, "utf8"),
+      readFile2(`${procRoot}/${pid}/stat`, "utf8")
+    ]);
+    const namespacePids = ownStatus.match(/^NStgid:[ \t]*(.*)$/m)?.[1]?.trim().split(/\s+/);
+    if (namespacePids?.length !== 1 || namespacePids[0] !== String(process.pid) || linuxProcessStart(ownStat, process.pid) === null)
+      throw new Error("Process namespace evidence is partial or belongs to a foreign proc mount");
+    const startId = linuxProcessStart(stat, pid);
+    if (startId === null || !bootId.trim())
+      throw new Error("Process boot/start evidence is incomplete");
+    return {
+      state: "observed",
+      instance: {
+        platform: "linux",
+        bootId: bootId.trim(),
+        namespace: `${namespace};${timeNamespace}`,
+        startId
+      }
+    };
+  } catch (cause) {
+    return { state: "unavailable", cause };
+  }
+}
+var ProcessOwnerEvidenceSchema = z.object({
+  liveness: z.enum(["alive", "gone", "not-probed"]),
+  identity: z.enum([
+    "matched",
+    "different-boot",
+    "reused-pid",
+    "pid-gone",
+    "legacy",
+    "unavailable"
+  ]),
+  cause: z.unknown().optional()
+});
+async function probeProcessOwner2(pid, recorded) {
+  z.number().int().positive().max(2147483647).parse(pid);
+  if (recorded != null)
+    ProcessInstanceSchema2.parse(recorded);
+  return probeProcessOwnerWith(pid, recorded, {
+    read: readProcessInstance,
+    observe: observeProcessInstance2,
+    liveness: probeLiveness
+  });
+}
+async function probeProcessOwnerWith(pid, recorded, probes = { read: readProcessInstance, liveness: probeLiveness }) {
+  if (recorded === undefined)
+    return { liveness: await probes.liveness(pid), identity: "legacy" };
+  const unavailable = (cause) => ({
+    liveness: "not-probed",
+    identity: "unavailable",
+    cause
+  });
+  if (recorded === null)
+    return unavailable(new Error("Recorded process lifetime is unavailable"));
+  const observe = async (target) => {
+    if (probes.observe)
+      return probes.observe(target);
+    const instance = await probes.read(target);
+    return instance ? { state: "observed", instance } : {
+      state: "unavailable",
+      cause: new Error("Process lifetime reader returned no evidence")
+    };
+  };
+  const own = await observe(process.pid);
+  if (own.state === "unavailable")
+    return unavailable(own.cause);
+  const current = own.instance;
+  if (recorded.platform !== current.platform)
+    return unavailable(new Error("Process platforms differ"));
+  if (recorded.bootId !== current.bootId)
+    return { liveness: "gone", identity: "different-boot" };
+  if (recorded.namespace !== current.namespace)
+    return unavailable(new Error("Process namespaces differ"));
+  const liveness = await probes.liveness(pid);
+  if (liveness === "gone")
+    return { liveness, identity: "pid-gone" };
+  const observation = await observe(pid);
+  if (observation.state === "unavailable")
+    return unavailable(observation.cause);
+  const observed = observation.instance;
+  if (!observed || observed.bootId !== current.bootId || observed.namespace !== current.namespace)
+    return unavailable(new Error("Observed boot or namespace changed during probe"));
+  if (recorded.startId !== observed.startId)
+    return { liveness: "gone", identity: "reused-pid" };
+  return { liveness: "alive", identity: "matched" };
+}
+
+export { machineIdentity, ProcessInstanceSchema2, observeProcessInstance2, readProcessInstance, probeProcessOwner2 };

package/dist/internal/exclusive-lock.d.ts

@@ -23,6 +23,7 @@ export interface ExclusiveLockDiagnosis {
     readonly liveness: 'alive' | 'gone' | 'not-probed';
     readonly identity?: ProcessOwnerEvidence['identity'];
     readonly owner: ExclusiveLockOwner | null;
+    readonly cause?: unknown;
 }
 /** A lock this process holds. */
 export interface HeldExclusiveLock {
@@ -42,7 +43,7 @@ export interface ExclusiveLockAttemptOptions {
      * How old a lock with no readable owner must be before it is taken. Absent,
      * an ownerless lock is never taken — it may predate owner records.
      */
-    readonly ownerlessGraceMs?: number;
+    readonly ownerlessGraceMs?: number | null;
 }
 export type ExclusiveLockAttempt = {
     readonly held: HeldExclusiveLock;

package/dist/internal/exclusive-lock.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"exclusive-lock.d.ts","sourceRoot":"","sources":["../../src/internal/exclusive-lock.ts"],"names":[],"mappings":"AA0BA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAEL,KAAK,oBAAoB,EAG1B,MAAM,oBAAoB,CAAC;AAK5B,gDAAgD;AAChD,QAAA,MAAM,wBAAwB;;;;;;;;;;;;;;iBAO5B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,wCAAwC;AACxC,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,WAAW,EAAE,cAAc,GAAG,iBAAiB,GAAG,gBAAgB,CAAC;IAC5E,QAAQ,CAAC,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,YAAY,CAAC;IACnD,QAAQ,CAAC,QAAQ,CAAC,EAAE,oBAAoB,CAAC,UAAU,CAAC,CAAC;IACrD,QAAQ,CAAC,KAAK,EAAE,kBAAkB,GAAG,IAAI,CAAC;CAC3C;AAED,iCAAiC;AACjC,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,kBAAkB,CAAC;IACnC,kFAAkF;IAClF,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,uFAAuF;IACvF,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,oFAAoF;IACpF,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC;AAED,MAAM,MAAM,oBAAoB,GAC5B;IAAE,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAA;CAAE,GACpC;IACE,kDAAkD;IAClD,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,6CAA6C;IAC7C,QAAQ,CAAC,SAAS,CAAC,EAAE,sBAAsB,CAAC;CAC7C,CAAC;AAmLN;;;;GAIG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,2BAA2B,GACnC,OAAO,CAAC,oBAAoB,CAAC,CAe/B;AAED,gFAAgF;AAChF,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAEpC"}
+{"version":3,"file":"exclusive-lock.d.ts","sourceRoot":"","sources":["../../src/internal/exclusive-lock.ts"],"names":[],"mappings":"AA0BA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAEL,KAAK,oBAAoB,EAG1B,MAAM,oBAAoB,CAAC;AAK5B,gDAAgD;AAChD,QAAA,MAAM,wBAAwB;;;;;;;;;;;;;;iBAO5B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,wCAAwC;AACxC,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,WAAW,EAAE,cAAc,GAAG,iBAAiB,GAAG,gBAAgB,CAAC;IAC5E,QAAQ,CAAC,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,YAAY,CAAC;IACnD,QAAQ,CAAC,QAAQ,CAAC,EAAE,oBAAoB,CAAC,UAAU,CAAC,CAAC;IACrD,QAAQ,CAAC,KAAK,EAAE,kBAAkB,GAAG,IAAI,CAAC;IAC1C,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,iCAAiC;AACjC,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,kBAAkB,CAAC;IACnC,kFAAkF;IAClF,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,uFAAuF;IACvF,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,oFAAoF;IACpF,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3C;AAED,MAAM,MAAM,oBAAoB,GAC5B;IAAE,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAA;CAAE,GACpC;IACE,kDAAkD;IAClD,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,6CAA6C;IAC7C,QAAQ,CAAC,SAAS,CAAC,EAAE,sBAAsB,CAAC;CAC7C,CAAC;AAmLN;;;;GAIG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,2BAA2B,GACnC,OAAO,CAAC,oBAAoB,CAAC,CAqB/B;AAED,gFAAgF;AAChF,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAEpC"}

package/dist/internal/process-instance.d.ts

@@ -1,5 +1,4 @@
 import { z } from 'zod';
-import { probeLiveness } from './process-identity.js';
 export declare const ProcessInstanceSchema: z.ZodObject<{
     platform: z.ZodEnum<{
         darwin: "darwin";
@@ -10,17 +9,55 @@ export declare const ProcessInstanceSchema: z.ZodObject<{
     startId: z.ZodString;
 }, z.core.$strict>;
 export type ProcessInstance = z.infer<typeof ProcessInstanceSchema>;
+/** An unavailable observation preserves its native or validation cause; it never proves death. */
+declare const ProcessInstanceObservationSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    state: z.ZodLiteral<"observed">;
+    instance: z.ZodObject<{
+        platform: z.ZodEnum<{
+            darwin: "darwin";
+            linux: "linux";
+        }>;
+        bootId: z.ZodString;
+        namespace: z.ZodString;
+        startId: z.ZodString;
+    }, z.core.$strict>;
+}, z.core.$strip>, z.ZodObject<{
+    state: z.ZodLiteral<"unavailable">;
+    cause: z.ZodUnknown;
+}, z.core.$strip>], "state">;
+export type ProcessInstanceObservation = z.infer<typeof ProcessInstanceObservationSchema>;
+export declare function observeProcessInstance(pid: number): Promise<ProcessInstanceObservation>;
 /** /proc stat field 22 follows a command name that may itself contain spaces and parentheses. */
 export declare function linuxProcessStart(stat: string, pid: number): string | null;
 /** @internal procRoot permits kernel-format fixtures without changing a real process or boot. */
 export declare function readProcessInstance(pid: number, procRoot?: string): Promise<ProcessInstance | null>;
-export interface ProcessOwnerEvidence {
-    readonly liveness: 'alive' | 'gone' | 'not-probed';
-    readonly identity: 'matched' | 'different-boot' | 'reused-pid' | 'pid-gone' | 'legacy' | 'unavailable';
-}
+/** @internal The fixture root is never a public owner option. */
+export declare function observeProcessInstanceAt(pid: number, procRoot: string): Promise<ProcessInstanceObservation>;
+declare const ProcessOwnerEvidenceSchema: z.ZodObject<{
+    liveness: z.ZodEnum<{
+        alive: "alive";
+        gone: "gone";
+        "not-probed": "not-probed";
+    }>;
+    identity: z.ZodEnum<{
+        "different-boot": "different-boot";
+        legacy: "legacy";
+        matched: "matched";
+        "pid-gone": "pid-gone";
+        "reused-pid": "reused-pid";
+        unavailable: "unavailable";
+    }>;
+    cause: z.ZodOptional<z.ZodUnknown>;
+}, z.core.$strip>;
+export type ProcessOwnerEvidence = z.infer<typeof ProcessOwnerEvidenceSchema>;
 /** Compare identities only inside one machine (the caller establishes that boundary). */
-export declare function probeProcessOwner(pid: number, recorded: ProcessInstance | null | undefined, probes?: {
-    read: typeof readProcessInstance;
-    liveness: typeof probeLiveness;
-}): Promise<ProcessOwnerEvidence>;
+export declare function probeProcessOwner(pid: number, recorded: ProcessInstance | null | undefined): Promise<ProcessOwnerEvidence>;
+interface ProcessOwnerProbes {
+    read(pid: number): Promise<ProcessInstance | null>;
+    liveness(pid: number): Promise<'alive' | 'gone'>;
+    observe?(pid: number): Promise<ProcessInstanceObservation>;
+}
+/** @internal Injection is for kernel-format controls, not a public ownership assertion. */
+export declare function probeProcessOwnerWith(pid: number, recorded: ProcessInstance | null | undefined, probes?: ProcessOwnerProbes): Promise<ProcessOwnerEvidence>;
+export {};
 //# sourceMappingURL=process-instance.d.ts.map

package/dist/internal/process-instance.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"process-instance.d.ts","sourceRoot":"","sources":["../../src/internal/process-instance.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAEnD,eAAO,MAAM,qBAAqB;;;;;;;;kBAOvB,CAAC;AACZ,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,iGAAiG;AACjG,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAS1E;AAED,iGAAiG;AACjG,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,MAAM,EACX,QAAQ,SAAU,GACjB,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CA6CjC;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,YAAY,CAAC;IACnD,QAAQ,CAAC,QAAQ,EACb,SAAS,GACT,gBAAgB,GAChB,YAAY,GACZ,UAAU,GACV,QAAQ,GACR,aAAa,CAAC;CACnB;AAED,yFAAyF;AACzF,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,eAAe,GAAG,IAAI,GAAG,SAAS,EAC5C,MAAM;IAAK,IAAI;IAAuB,QAAQ;CAAiB,GAC9D,OAAO,CAAC,oBAAoB,CAAC,CAyB/B"}
+{"version":3,"file":"process-instance.d.ts","sourceRoot":"","sources":["../../src/internal/process-instance.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,eAAO,MAAM,qBAAqB;;;;;;;;kBAOvB,CAAC;AACZ,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,kGAAkG;AAClG,QAAA,MAAM,gCAAgC;;;;;;;;;;;;;;4BAGpC,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE1F,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,0BAA0B,CAAC,CAGrC;AAED,iGAAiG;AACjG,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAS1E;AAED,iGAAiG;AACjG,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,MAAM,EACX,QAAQ,SAAU,GACjB,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAGjC;AAED,iEAAiE;AACjE,wBAAsB,wBAAwB,CAC5C,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,0BAA0B,CAAC,CAsDrC;AAED,QAAA,MAAM,0BAA0B;;;;;;;;;;;;;;;iBAW9B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,yFAAyF;AACzF,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,eAAe,GAAG,IAAI,GAAG,SAAS,GAC3C,OAAO,CAAC,oBAAoB,CAAC,CAQ/B;AAED,UAAU,kBAAkB;IAC1B,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;IACnD,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,MAAM,CAAC,CAAC;IACjD,OAAO,CAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAAC;CAC5D;AAED,2FAA2F;AAC3F,wBAAsB,qBAAqB,CACzC,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,eAAe,GAAG,IAAI,GAAG,SAAS,EAC5C,MAAM,GAAE,kBAA2E,GAClF,OAAO,CAAC,oBAAoB,CAAC,CA2C/B"}

package/dist/internal/with-exclusive-lock.d.ts

@@ -18,7 +18,7 @@ export interface ExclusiveLockOptions {
     timeoutMs?: number;
     /** Stops the wait; an abort while waiting rejects at once with its reason as the cause. */
     signal?: AbortSignal;
-    /** Permission bits of the lock file. Default `0o600`. */
+    /** Exact permission bits, independent of umask. Default `0o600`. Shared readers need a common group and traversable parents. */
     mode?: number;
     /**
      * This machine's identity, for a platform that offers none (`/etc/machine-id`
@@ -29,9 +29,10 @@ export interface ExclusiveLockOptions {
     /**
      * How old a lock with no readable owner must be before it is taken — the one
      * case where time decides, left by a process that died between creating the
-     * file and recording itself. Default 5 000.
+     * file and recording itself. Default 5 000; `null` disables age-based reclaim,
+     * including abandoned ownerless reclaim guards.
      */
-    ownerlessGraceMs?: number;
+    ownerlessGraceMs?: number | null;
 }
 /** The lock `run` executes under. */
 export interface ExclusiveLock {

package/dist/internal/with-exclusive-lock.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"with-exclusive-lock.d.ts","sourceRoot":"","sources":["../../src/internal/with-exclusive-lock.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAGL,KAAK,kBAAkB,EACxB,MAAM,kBAAkB,CAAC;AAE1B,YAAY,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAE3D,4CAA4C;AAC5C,MAAM,WAAW,oBAAoB;IACnC,2EAA2E;IAC3E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gGAAgG;IAChG,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,2FAA2F;IAC3F,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,yDAAyD;IACzD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,qCAAqC;AACrC,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,kBAAkB,CAAC;IACnC,iFAAiF;IACjF,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B;AAED,qEAAqE;AACrE,qBAAa,kBAAmB,SAAQ,KAAK;IAGzC,QAAQ,CAAC,IAAI,EAAE,cAAc,GAAG,cAAc;IAC9C,QAAQ,CAAC,KAAK,EAAE,MAAM;IACtB,wFAAwF;IACxF,QAAQ,CAAC,MAAM,EAAE,kBAAkB,GAAG,IAAI;IALnC,IAAI,SAAwB;IACrC,YACW,IAAI,EAAE,cAAc,GAAG,cAAc,EACrC,KAAK,EAAE,MAAM;IACtB,wFAAwF;IAC/E,MAAM,EAAE,kBAAkB,GAAG,IAAI,EAC1C,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAG9B;CACF;AAyCD;;;;;;;;;GASG;AACH,wBAAsB,iBAAiB,CAAC,CAAC,EACvC,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,CAAC,IAAI,EAAE,aAAa,KAAK,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,EAC5C,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,CAAC,CAAC,CAwDZ"}
+{"version":3,"file":"with-exclusive-lock.d.ts","sourceRoot":"","sources":["../../src/internal/with-exclusive-lock.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAGL,KAAK,kBAAkB,EACxB,MAAM,kBAAkB,CAAC;AAE1B,YAAY,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAE3D,4CAA4C;AAC5C,MAAM,WAAW,oBAAoB;IACnC,2EAA2E;IAC3E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gGAAgG;IAChG,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,2FAA2F;IAC3F,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,gIAAgI;IAChI,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAED,qCAAqC;AACrC,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,kBAAkB,CAAC;IACnC,iFAAiF;IACjF,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B;AAED,qEAAqE;AACrE,qBAAa,kBAAmB,SAAQ,KAAK;IAGzC,QAAQ,CAAC,IAAI,EAAE,cAAc,GAAG,cAAc;IAC9C,QAAQ,CAAC,KAAK,EAAE,MAAM;IACtB,wFAAwF;IACxF,QAAQ,CAAC,MAAM,EAAE,kBAAkB,GAAG,IAAI;IALnC,IAAI,SAAwB;IACrC,YACW,IAAI,EAAE,cAAc,GAAG,cAAc,EACrC,KAAK,EAAE,MAAM;IACtB,wFAAwF;IAC/E,MAAM,EAAE,kBAAkB,GAAG,IAAI,EAC1C,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAG9B;CACF;AAyCD;;;;;;;;;GASG;AACH,wBAAsB,iBAAiB,CAAC,CAAC,EACvC,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,CAAC,IAAI,EAAE,aAAa,KAAK,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,EAC5C,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,CAAC,CAAC,CA4DZ"}

package/dist/process/command-owner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"command-owner.d.ts","sourceRoot":"","sources":["../../src/process/command-owner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,8BAA8B,EAAS,MAAM,oBAAoB,CAAC;AAGhF,OAAO,EAEL,KAAK,oBAAoB,EAG1B,MAAM,YAAY,CAAC;AAGpB,wFAAwF;AACxF,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,oBAAoB,EAC3B,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,8BAA8B,KAAK,IAAI;;;;;;;;EA0H1D"}
+{"version":3,"file":"command-owner.d.ts","sourceRoot":"","sources":["../../src/process/command-owner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,8BAA8B,EAAS,MAAM,oBAAoB,CAAC;AAGhF,OAAO,EAEL,KAAK,oBAAoB,EAI1B,MAAM,YAAY,CAAC;AAIpB,wFAAwF;AACxF,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,oBAAoB,EAC3B,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,8BAA8B,KAAK,IAAI;;;;;;;;EA+J1D"}

package/dist/process/contract.d.ts

@@ -1,4 +1,13 @@
 import { z } from 'zod';
+declare const NativeCommandSettlementSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<"exit">;
+    exitCode: z.ZodNullable<z.ZodNumber>;
+    signal: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    kind: z.ZodLiteral<"error">;
+    cause: z.ZodUnknown;
+}, z.core.$strip>], "kind">;
+export type NativeCommandSettlement = z.infer<typeof NativeCommandSettlementSchema>;
 export declare const NativeCommandOptionsSchema: z.ZodObject<{
     executable: z.ZodString;
     args: z.ZodDefault<z.ZodArray<z.ZodString>>;
@@ -15,6 +24,7 @@ export declare const NativeCommandOptionsSchema: z.ZodObject<{
     stdin: z.ZodOptional<z.ZodCustom<Uint8Array<ArrayBufferLike>, Uint8Array<ArrayBufferLike>>>;
     maxStdinBytes: z.ZodDefault<z.ZodNumber>;
     onOutput: z.ZodOptional<z.ZodCustom<(bytes: Uint8Array, channel: 'stdout' | 'stderr', signal: AbortSignal) => void | Promise<void>, (bytes: Uint8Array, channel: 'stdout' | 'stderr', signal: AbortSignal) => void | Promise<void>>>;
+    onLeaderSettled: z.ZodOptional<z.ZodCustom<(event: NativeCommandSettlement, signal: AbortSignal) => void | Promise<void>, (event: NativeCommandSettlement, signal: AbortSignal) => void | Promise<void>>>;
     killGraceMs: z.ZodDefault<z.ZodNumber>;
     cleanupTimeoutMs: z.ZodDefault<z.ZodNumber>;
 }, z.core.$strict>;

package/dist/process/contract.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"contract.d.ts","sourceRoot":"","sources":["../../src/process/contract.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;gDAoBtB,UAAU,WACR,QAAQ,GAAG,QAAQ,UACpB,WAAW,KAChB,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;;;kBAgB7B,CAAC;AACL,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAC9E,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,0BAA0B,CAAC,CAAC;AACrF,QAAA,MAAM,yBAAyB;;;;;iBAK7B,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,qBAAa,kBAAmB,SAAQ,KAAK;aAEzB,IAAI,EAAE,eAAe,GAAG,qBAAqB,GAAG,iBAAiB;IADnF,YACkB,IAAI,EAAE,eAAe,GAAG,qBAAqB,GAAG,iBAAiB,EACjF,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,YAAY,EAIvB;CACF"}
+{"version":3,"file":"contract.d.ts","sourceRoot":"","sources":["../../src/process/contract.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,QAAA,MAAM,6BAA6B;;;;;;;2BAOjC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;gDAoBtB,UAAU,WACR,QAAQ,GAAG,QAAQ,UACpB,WAAW,KAChB,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;uDAKX,uBAAuB,UAAU,WAAW,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;;;kBAiBvF,CAAC;AACL,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAC9E,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,0BAA0B,CAAC,CAAC;AACrF,QAAA,MAAM,yBAAyB;;;;;iBAK7B,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,qBAAa,kBAAmB,SAAQ,KAAK;aAEzB,IAAI,EAAE,eAAe,GAAG,qBAAqB,GAAG,iBAAiB;IADnF,YACkB,IAAI,EAAE,eAAe,GAAG,qBAAqB,GAAG,iBAAiB,EACjF,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,YAAY,EAIvB;CACF"}

package/dist/process/group.d.ts

@@ -1,6 +1,6 @@
 import { NativeCommandError } from './contract.js';
 export declare function signalGroup(pid: number | undefined, signal: NodeJS.Signals): void;
-export declare function stopCommandGroup(pid: number | undefined, graceMs: number): Promise<void>;
+export declare function stopCommandGroup(pid: number | undefined, graceMs: number, cleanupTimeoutMs?: number): Promise<void>;
 export declare function commandCleanupError(cause: unknown): NativeCommandError;
 export declare function waitForCommandClose<T>(closed: Promise<T>, timeoutMs: number): Promise<T>;
 //# sourceMappingURL=group.d.ts.map

package/dist/process/group.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"group.d.ts","sourceRoot":"","sources":["../../src/process/group.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAEhD,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAOjF;AAYD,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC,CAQf;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,kBAAkB,CAItE;AAED,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAExF"}
+{"version":3,"file":"group.d.ts","sourceRoot":"","sources":["../../src/process/group.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAWhD,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAOjF;AAiCD,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,OAAO,EAAE,MAAM,EACf,gBAAgB,SAAO,GACtB,OAAO,CAAC,IAAI,CAAC,CASf;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,kBAAkB,CAItE;AAED,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAExF"}

package/dist/process/leader-settlement.d.ts

@@ -0,0 +1,4 @@
+import type { NativeCommandSettlement, ParsedNativeCommandOptions } from './contract.js';
+/** One bounded external resource settlement, shared by observed exit and terminal failure. */
+export declare function createLeaderSettlement(options: ParsedNativeCommandOptions, signal: AbortSignal): (event: NativeCommandSettlement) => Promise<void>;
+//# sourceMappingURL=leader-settlement.d.ts.map

package/dist/process/leader-settlement.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"leader-settlement.d.ts","sourceRoot":"","sources":["../../src/process/leader-settlement.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,uBAAuB,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAC;AAGtF,8FAA8F;AAC9F,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,0BAA0B,EACnC,MAAM,EAAE,WAAW,WAGJ,uBAAuB,KAAG,OAAO,CAAC,IAAI,CAAC,CA+BvD"}

package/llms/files.txt

@@ -30,7 +30,7 @@ available from `stitchkit/contract`.
 | `ManagedFileInspector` | _type_ | bounded-prefix read/write inspection callback with a finite cancellation signal that cannot own path or size |
 | `ManagedFileInspectionInput` / `ManagedFileInspection` | _type_ | inspector prefix/name/declared media/signal input and validated metadata-only result |
 | `writeFileAtomic` / `writeFileAtomicSync` / `WriteFileAtomicOptions` | function / _type_ | replace a file atomically: a random staging name created exclusively (never through a planted link), the mode set on the descriptor before the file is visible (default `0o600`, not masked by the umask), `fsync`, rename; a failure leaves the target and no staging file. The asynchronous form keeps the event loop running |
-| `withExclusiveLock` / `ExclusiveLockOptions` / `ExclusiveLock` / `ExclusiveLockOwner` | function / _type_ | run work under an exclusive lock between processes — a file recording its owner (pid, host, machine identity, time and nullable kernel process identity); waits up to `timeoutMs` (default 10 s) and stops on `signal`; a dead owner on this machine is taken over, a live, slow or foreign one never is; an ownerless lock only after `ownerlessGraceMs` |
+| `withExclusiveLock` / `ExclusiveLockOptions` / `ExclusiveLock` / `ExclusiveLockOwner` | function / _type_ | run work under an exclusive lock between processes — a file recording its owner (pid, host, machine identity, time and nullable kernel process identity); waits up to `timeoutMs` (default 10 s) and stops on `signal`; a dead owner on this machine is taken over, a live, slow or foreign one never is; an ownerless lock only after `ownerlessGraceMs` (default 5000 ms, `null` disables age-based reclaim including guards); exact `mode` is independent of umask; shared readers need a common group and traversable directories |
 | `ExclusiveLockError` | class | `LOCK_TIMEOUT` naming the resource and its holder, or `LOCK_ABORTED` with the signal's reason |
 | `createChunkSpool` | function | the server half of a chunked upload: parts on disk under `owner` + client-minted `uploadId`, each with a size+sha256 receipt; idempotent `open` and `put`, the first writer of a part wins across processes, `assemble` in order once every part is in, `sweep` of untouched uploads — [guide](../guide/client.md#chunked-uploads) |
 | `ChunkSpool` / `ChunkSpoolConfig` / `ChunkSpoolKey` / `ChunkSpoolOpen` / `ChunkSpoolPart` / `ChunkSpoolAssembly` | _type_ | the spool, its directory, part size, file limit, meta schema and age; an upload's key; its declaration; one part; the assembled parts with a concatenating `stream()` |

package/llms/process.txt

@@ -15,12 +15,16 @@ description: Native IO для Bun и Node, с явно выбранной durabi
 type: guide
 status: active
 created: 2026-10-01 20:44 +07:00
-updated: 2026-10-01 21:31 +07:00
+updated: 2026-10-02 00:37 +07:00
 participants:
   - role: authored
     harness: Codex
     model: GPT-6
     at: 2026-10-01 20:44 +07:00
+  - role: implemented
+    harness: Codex
+    model: GPT-6
+    at: 2026-10-02 00:08 +07:00
 ---
 
 # Native IO
@@ -136,6 +140,10 @@ callbacks owner не запускает. Normal completion ждёт всех byt
 
 Cleanup: POSIX process group, TERM, `killGraceMs` (default 100, maximum 10 000), затем KILL;
 `cleanupTimeoutMs` (default 2000, maximum 30 000) ограничивает ожидание close после сигналов.
+На Darwin временный `EPERM` при сигнале группе может означать zombies, ещё не убранные
+OS reaper. Повтор ограничен `cleanupTimeoutMs`; успех требует доставленного сигнала или
+`ESRCH`, постоянный отказ сохраняется в cause. Закрытие каждого owned pipe и выход leader
+наблюдаются отдельно, включая отсутствие общего `child.close` при teardown.
 Сохраняется caller/sink причина; failure cleanup — `NativeCommandError` с `COMMAND_CLEANUP` и
 AggregateError cause. Даже вышедший parent не исключает helper, удерживающий pipe. Windows
 отказывает с `COMMAND_UNAVAILABLE`; потомок, самостоятельно покинувший группу через setsid,
@@ -150,6 +158,68 @@ shell policy, command admission, логирование, redaction, bytes→text
 Длительные signal-only команды остаются streaming; bounded tar/capture получают свои явные limits.
 Импорт leaf не делает установку всего npm package маленькой; выбирайте dependency после измерения
 packed размера и dependency closure.
+## Resource-scoped launchers and shared owners
+
+`onLeaderSettled(event, signal)` observes leader exit before inherited stdout/stderr pipes
+close. A resource owner can stop its external scope there, allowing pipe drain to complete.
+The callback runs once: `event.kind === 'exit'` carries observed `exitCode`/`signal`; a terminal
+failure uses `kind: 'error'` and preserves its cause. Unavailable executables, output sink
+failure and caller cancellation settle through the same owner. `cleanupTimeoutMs` bounds
+the callback after settlement starts; it never becomes a deadline for signal-only execution.
+Honor the settlement signal; arbitrary user promises cannot be forcibly cancelled.
+
+```ts
+await runNativeCommand({
+  executable: launcher,
+  args,
+  signal: scope.signal,
+  onOutput: (bytes, channel, signal) => scope.write(bytes, channel, signal),
+  onLeaderSettled: (event, signal) => scope.settle(event, signal),
+});
+```
+
+`observeProcessInstance(pid)` returns `observed` with a `ProcessInstance`, or `unavailable`
+with its cause. `probeProcessOwner(pid, recorded)` compares that evidence on the machine the
+caller established: `matched`, `different-boot`, `reused-pid`, `pid-gone`, `legacy` or
+`unavailable`. Missing/partial/denied evidence is not death. Supervisor tree fencing remains
+the caller's job; a PID lifetime is not proof that its whole workload stopped.
+
+An exclusive lock applies exact requested permissions through its creating descriptor,
+independent of umask. Default `0600` stays private. Shared `0640` requires a common group and
+traversable directories; another UID also needs directory write permission to reclaim a
+proven-dead owner's file. Set `ownerlessGraceMs: null` to refuse every age-only reclaim,
+including ownerless reclaim guards. The default remains 5000 ms for existing clients.
+Восстановление stale reclaim guard использует тот же lock owner и следующий guard:
+проверка inode и удаление выполняются под ним. Конкурирующий writer не обходит guard,
+пока прежнее удаление приостановлено; live и unknown lifetime evidence остаются отказом.
+
+## Libraries with a Zod-only runtime
+
+Public leaves keep optional peers out of their import closure. Installing `stitchkit` still
+installs the complete package and ky; selective imports alone do not avoid that installation.
+A library can use Stitchkit as a build dependency, bundle its selected public native imports,
+keep Zod external, and publish the resulting implementation with its library artifact.
+
+```ts
+// The library's build entry; all mechanisms remain owned by Stitchkit.
+export { canonicalJson } from 'stitchkit/primitives';
+export { writeFileAtomic, withExclusiveLock } from 'stitchkit/files';
+export { observeProcessInstance, probeProcessOwner, runNativeCommand } from 'stitchkit/process';
+```
+
+Bundle for Node-compatible execution with Zod external. Publish declarations from the same
+version: carry their reachable relative `.d.ts` closure, rather than emitting references to
+`stitchkit` that force clients to install it for types. A library exposing its own DTOs may
+instead emit declarations for only that DTO contract. Keep the library's manifest at runtime
+`dependencies: {}` and `peerDependencies: { zod: ... }` when that is its declared promise.
+
+Darwin consumers need the published native binaries at the bundled loader's relative native
+directory. A JS-only bundle is not portable evidence. Qualify the packed library outside its
+build tree in Bun and Node, test its declarations, and check that importing an unbundled
+Stitchkit leaf fails there. A separate schema-only entry must not import the native entry.
+
+This delivery removes a runtime kernel installation; it does not remove the build-time
+Stitchkit installation or create an independent lightweight npm package.
 
 ==============================================================================
 # API reference: `stitchkit/process`  (docs/api/reference.md)
@@ -165,3 +235,8 @@ Native POSIX Bun/Node one-shot command execution. See [native IO](../guide/nativ
 | `NativeCommandOptions` | type | executable/args, env policy, signal/deadline, bytes sink and finite cleanup limits |
 | `NativeCommandResult` | type | observed nullable exit code/signal and captured stdout/stderr bytes |
 | `NativeCommandError` | class | COMMAND_LIMIT, COMMAND_UNAVAILABLE or COMMAND_CLEANUP with internal cause |
+
+| `NativeCommandSettlement` | type | observed leader `exit` or terminal `error`; `onLeaderSettled` runs once before drain, bounded by cleanupTimeoutMs, with a cancellable settlement signal |
+| `observeProcessInstance` / `ProcessInstanceObservation` | function / type | Linux/Darwin lifetime observation; observed identity or unavailable with its original cause, never guessed absence |
+| `ProcessInstanceSchema` / `ProcessInstance` | schema / type | platform, boot ID, namespace and process start identity from the shared native reader |
+| `probeProcessOwner` / `ProcessOwnerEvidence` | function / type | compare lifetimes on one caller-established machine; matched, boot change, reused PID, gone, legacy or unavailable with cause |