tickmarkr 2.7.4 → 2.7.5

package/dist/cli/commands/verify.js

@@ -15,7 +15,7 @@ import { GATE_NAMES } from "../../graph/schema.js";
 import { executionSignal } from "../../run/execution-budget.js";
 import { addDetachedWorktree, linkNodeModules, removeWorktree, shGit, shGitOk } from "../../run/git.js";
 import { foldOwedChecks, integrationMapped, owedCriteria, Journal, OWED_DISCHARGE_EVENT } from "../../run/journal.js";
-import { withRepositoryLease } from "../../run/lease.js";
+import { describeLeaseWait, withRepositoryLease } from "../../run/lease.js";
 import { isPidLive } from "../../run/lock.js";
 import { recordLaunchServices } from "../../run/launchservices-check.js";
 /**
@@ -529,9 +529,9 @@ export async function verify(argv, cwd = process.cwd(), options = {}) {
             return after ? rows.map((r) => ({ ...r, pass: false, details: `${refused(after)}\n${r.details}`, meta: { ...r.meta, subjectChanged: after } })) : rows;
         }, {
             signal: executionSignal(),
-            onWait: (holder) => {
-                console.error(`verify: waiting for the repository's runner lease held by pid ${holder.pid} in ${holder.cwd}`);
-                recordJournal?.append("suite-wait", values.task ?? "VERIFY", { holderPid: holder.pid, holderCwd: holder.cwd });
+            onWait: (holder, blockers) => {
+                console.error(`verify: waiting for the repository's runner lease ${describeLeaseWait(holder, blockers)}`);
+                recordJournal?.append("suite-wait", values.task ?? "VERIFY", { holderPid: holder.pid, holderCwd: holder.cwd, ...(blockers ? { blockers } : {}) });
             },
         });
         results = [...results, ...suite].sort((a, b) => GATE_NAMES.indexOf(a.gate) - GATE_NAMES.indexOf(b.gate));

package/dist/run/lease.d.ts

@@ -35,11 +35,19 @@ export interface RepositoryLeaseHolder {
     roots?: number[];
     rootBirths?: Record<string, string>;
 }
+/** Queue row 120: a live process keeping a dead or released holder's lease, as the wait names it: pid, executable and
+ * cwd. Its arguments and environment are never printed or read (`ps -o comm=`, the census's cwd-only probe). */
+export interface LeaseBlocker {
+    pid: number;
+    executable: string;
+    cwd?: string;
+}
 export interface RepositoryLeaseOptions {
     pollMs?: number;
     signal?: AbortSignal;
-    /** Called once per distinct holder the waiter is queued behind. */
-    onWait?: (holder: RepositoryLeaseHolder) => void;
+    /** Called once per distinct holder the waiter is queued behind, and again whenever the set of processes keeping a
+     * dead holder's lease changes; `blockers` names that set (queue row 120). */
+    onWait?: (holder: RepositoryLeaseHolder, blockers?: readonly LeaseBlocker[]) => void;
     /** The token a descendant inherited; defaults to REPOSITORY_LEASE_TOKEN_ENV. */
     inherited?: string;
     /** Manifest jobs bridge capabilities through explicit child environments, never process.env. */
@@ -82,6 +90,15 @@ export declare const readHolder: (path: string) => RepositoryLeaseHolder | undef
 export declare function tryReserve(path: string, mine: RepositoryLeaseHolder): boolean;
 /** Exposed for recovery regressions; the standalone verify uses the combined critical section. */
 export declare const reclaimDead: (path: string, identity: string, pollMs?: number) => Promise<boolean>;
+/** Each blocker's pid, executable and working directory, and NO argument: `ps -o comm=` (a command line joins argv with
+ * spaces, so no redaction could tell where a secret value ends, D-1710). The cwd comes from the census's cwd-only probe
+ * (async, batched, never rejecting, no environment read; queue row 103: no synchronous lsof on a waiting loop), imported
+ * lazily because suite-census imports this module. Diagnostics only: an unreadable process reads "(executable
+ * unreadable)", and this never throws into the wait. */
+export declare function describeLeaseBlockers(pids: readonly number[]): Promise<LeaseBlocker[]>;
+/** The wait's own words: the holder alone while it lives; once it has exited or released the lease, every process still
+ * keeping it. */
+export declare function describeLeaseWait(holder: RepositoryLeaseHolder, blockers?: readonly LeaseBlocker[]): string;
 export declare function protectedProcesses(holder: RepositoryLeaseHolder, tokenEnv?: string, ownedOnly?: boolean): Promise<number[]>;
 export declare const repositoryLeaseEnvironment: (env: NodeJS.ProcessEnv) => NodeJS.ProcessEnv;
 /** Called synchronously at spawn, before any user callback, and only on an owned generation. */

package/dist/run/lease.js

@@ -305,14 +305,47 @@ const reclaimDeadLocked = (path, identity) => {
 export const reclaimDead = async (path, identity, pollMs = 10) => withMutationLock(path, pollMs, undefined, () => reclaimDeadLocked(path, identity));
 const inspectAndReserve = async (path, mine) => {
     let occupant = readOccupant(path);
-    if (occupant && (!occupant.holder || (!holderAlive(occupant.holder) && !(occupant.holder.protectOrphans && (await protectedProcesses(occupant.holder)).length)))) {
+    const dead = occupant?.holder !== undefined && !holderAlive(occupant.holder);
+    // A dead holder's protected tree is what keeps the lease; the waiter is told which processes those are (queue row 120).
+    const blocking = dead && occupant.holder.protectOrphans ? await protectedProcesses(occupant.holder) : [];
+    if (occupant && (!occupant.holder || (dead && !blocking.length))) {
         reclaimDeadLocked(path, occupant.identity);
         occupant = readOccupant(path);
     }
     if (!occupant && tryReserve(path, mine))
         return { acquired: true };
-    return { acquired: false, holder: occupant?.holder };
+    return { acquired: false, holder: occupant?.holder, ...(blocking.length ? { blocking } : {}) };
 };
+/** Each blocker's pid, executable and working directory, and NO argument: `ps -o comm=` (a command line joins argv with
+ * spaces, so no redaction could tell where a secret value ends, D-1710). The cwd comes from the census's cwd-only probe
+ * (async, batched, never rejecting, no environment read; queue row 103: no synchronous lsof on a waiting loop), imported
+ * lazily because suite-census imports this module. Diagnostics only: an unreadable process reads "(executable
+ * unreadable)", and this never throws into the wait. */
+export async function describeLeaseBlockers(pids) {
+    const rows = await new Promise((done) => {
+        try {
+            execFile("ps", ["-o", "pid=,comm=", "-p", pids.join(",")], { encoding: "utf8", timeout: 5_000 }, (_error, stdout) => done(stdout ?? ""));
+        }
+        catch {
+            done("");
+        }
+    });
+    const executables = new Map(rows.split("\n").flatMap((line) => { const row = /^\s*(\d+)\s+(.*)$/.exec(line); return row ? [[Number(row[1]), row[2].trim()]] : []; }));
+    const cwds = await import("./suite-census.js").then(({ batchedProcessCwds }) => batchedProcessCwds(pids)).catch(() => undefined);
+    return pids.map((pid) => {
+        const cwd = cwds?.get(pid);
+        return { pid, executable: executables.get(pid) || "(executable unreadable)", ...(cwd ? { cwd } : {}) };
+    });
+}
+/** The wait's own words: the holder alone while it lives; once it has exited or released the lease, every process still
+ * keeping it. */
+export function describeLeaseWait(holder, blockers) {
+    const held = `held by pid ${holder.pid} in ${holder.cwd}`;
+    if (!blockers?.length)
+        return held;
+    const named = blockers.map((b) => `pid ${b.pid} ${b.executable}${b.cwd ? ` (cwd ${b.cwd})` : ""}`).join("; ");
+    return `${held}, which has exited or released it; ${blockers.length} process(es) it started still run and keep the lease until they exit: ${named}`;
+}
 // A durable capability is also a crash owner: census checks the exact generation's inherited
 // environment and recorded process groups, including live orphans reparented after owner death.
 // An unreadable census refuses reclamation/release. No dead-pid shortcut admits over a live tree.
@@ -386,6 +419,8 @@ export function registerRepositoryChild(pid) {
 }
 export const withFreshCommandLease = (command, run) => ownership.run({ token: "", active: false }, () => withCommandLease(command, run));
 const repositoryQueues = new Map();
+/** Queue row 120: the queue head's last view of what keeps a dead holder's lease, so in-process followers name it too. */
+const repositoryBlocking = new Map();
 /** The standalone wrapper uses the same command-then-repository order when a scheduler exists.
  * Without one (CLI/global setup), this remains exactly the outer file reservation API. */
 export function withRepositoryLease(cwd, run, opts = {}) {
@@ -426,10 +461,11 @@ async function repositoryLease(cwd, run, opts) {
     const ticket = Symbol("repository job");
     queue.add(ticket);
     let waitingOn;
-    const waitOn = (holder) => {
-        if (holder && holder.token !== waitingOn) {
-            waitingOn = holder.token;
-            opts.onWait?.(holder);
+    const waitOn = async (holder, blocking = []) => {
+        const key = holder && `${holder.token}\0${[...blocking].sort((a, b) => a - b).join(",")}`;
+        if (holder && key !== waitingOn) {
+            waitingOn = key;
+            opts.onWait?.(holder, blocking.length ? await describeLeaseBlockers(blocking) : undefined);
         }
     };
     try {
@@ -437,12 +473,19 @@ async function repositoryLease(cwd, run, opts) {
             opts.signal?.throwIfAborted();
             if (queue.values().next().value === ticket) {
                 const attempt = await withMutationLock(path, pollMs, opts.signal, () => inspectAndReserve(path, mine));
-                if (attempt.acquired)
+                if (attempt.acquired) {
+                    repositoryBlocking.delete(path);
                     break;
-                waitOn(attempt.holder);
+                }
+                if (attempt.holder)
+                    repositoryBlocking.set(path, { token: attempt.holder.token, blocking: attempt.blocking ?? [] });
+                await waitOn(attempt.holder, attempt.blocking);
+            }
+            else {
+                const holder = readHolder(path);
+                const seen = repositoryBlocking.get(path);
+                await waitOn(holder, holder && seen?.token === holder.token ? seen.blocking : []);
             }
-            else
-                waitOn(readHolder(path));
             await new Promise(wake => setTimeout(wake, pollMs));
         }
         const exported = process.env[REPOSITORY_LEASE_TOKEN_ENV];
@@ -495,8 +538,10 @@ async function repositoryLease(cwd, run, opts) {
     }
     finally {
         queue.delete(ticket);
-        if (!queue.size)
+        if (!queue.size) {
             repositoryQueues.delete(path);
+            repositoryBlocking.delete(path);
+        }
         // A waiter removes no repository generation, including cancellation before acquisition.
     }
 }

package/dist/run/suite-census.d.ts

@@ -6,6 +6,9 @@
  * not already probed — the census asks for a parent's cwd too. The answers feed countLiveSuites' existing lookups.
  */
 export type ProbeExec = (file: string, args: readonly string[]) => Promise<string>;
+/** Each pid's working directory: /proc first, then ONE batched lsof for the rest; never rejects, and reads no process
+ * environment (the runner-lease wait names blockers through it, queue row 120). Answers land in `cwds`. */
+export declare function batchedProcessCwds(pids: readonly number[], exec?: ProbeExec, proc?: ProcReader, cwds?: Map<number, string>): Promise<Map<number, string>>;
 /** The pids of every live (non-zombie) row of a `ps -o pid=,ppid=,state=,command=` snapshot whose command is a runner. */
 export declare function runnerPids(snapshot: string): number[];
 /** The /proc reads, injectable so the Linux branch is testable anywhere; each throws where /proc has no entry. */

package/dist/run/suite-census.js

@@ -16,6 +16,42 @@ const probeExec = (file, args) => new Promise((resolve) => {
         resolve("");
     }
 });
+// D-1567 batch poisoning: lsof and ps fail the WHOLE command for one -p member they cannot take (a marker of 22 digits
+// prints as 1e+21, 310 nines as Infinity; ps refuses one above int32), erasing every other pid's answer. The base probed
+// per pid, so such a pid lost only its own answer: it stays unanswered here and never joins a batch.
+const probeable = (pid) => Number.isSafeInteger(pid) && pid > 0 && pid <= 2_147_483_647;
+/** Each pid's working directory: /proc first, then ONE batched lsof for the rest; never rejects, and reads no process
+ * environment (the runner-lease wait names blockers through it, queue row 120). Answers land in `cwds`. */
+export async function batchedProcessCwds(pids, exec = probeExec, proc = procReader, cwds = new Map()) {
+    const rest = [];
+    for (const pid of pids.filter(probeable)) {
+        try {
+            cwds.set(pid, proc.cwd(pid));
+        }
+        catch {
+            rest.push(pid);
+        } // Darwin has no /proc
+    }
+    if (rest.length === 0)
+        return cwds;
+    let listing = "";
+    try {
+        listing = await exec("lsof", ["-a", "-p", rest.join(","), "-d", "cwd", "-Fn"]);
+    }
+    catch { /* the census never rejects */ }
+    let pid;
+    for (const line of listing.split("\n")) {
+        if (line.startsWith("p"))
+            pid = Number(line.slice(1));
+        else if (line.startsWith("n") && pid !== undefined) {
+            try {
+                cwds.set(pid, realpathSync(line.slice(1)));
+            }
+            catch { /* the directory is gone */ }
+        }
+    }
+    return cwds;
+}
 /** The pids of every live (non-zombie) row of a `ps -o pid=,ppid=,state=,command=` snapshot whose command is a runner. */
 export function runnerPids(snapshot) {
     const pids = [];
@@ -41,34 +77,7 @@ export async function batchedProcessProbes(pids, exec = probeExec, proc = procRe
     const cwds = new Map();
     const parents = new Map();
     const parentIn = (text) => new RegExp(`(?:^|\\s)${SUITE_PARENT_ENV}=(\\d+)(?:\\s|$)`).exec(text)?.[1];
-    // D-1567 batch poisoning: lsof and ps fail the WHOLE command for one -p member they cannot take (a marker of 22 digits
-    // prints as 1e+21, 310 nines as Infinity; ps refuses one above int32), erasing every other pid's answer. The base probed
-    // per pid, so such a pid lost only its own answer: it stays unanswered here and never joins a batch.
-    const probeable = (pid) => Number.isSafeInteger(pid) && pid > 0 && pid <= 2_147_483_647;
-    const probeCwds = async (wanted) => {
-        const rest = [];
-        for (const pid of wanted.filter(probeable)) {
-            try {
-                cwds.set(pid, proc.cwd(pid));
-            }
-            catch {
-                rest.push(pid);
-            } // Darwin has no /proc
-        }
-        if (rest.length === 0)
-            return;
-        let pid;
-        for (const line of (await ask("lsof", ["-a", "-p", rest.join(","), "-d", "cwd", "-Fn"])).split("\n")) {
-            if (line.startsWith("p"))
-                pid = Number(line.slice(1));
-            else if (line.startsWith("n") && pid !== undefined) {
-                try {
-                    cwds.set(pid, realpathSync(line.slice(1)));
-                }
-                catch { /* the directory is gone */ }
-            }
-        }
-    };
+    const probeCwds = (wanted) => batchedProcessCwds(wanted, ask, proc, cwds);
     const probeParents = async (wanted) => {
         const rest = [];
         for (const pid of wanted.filter(probeable)) {

package/dist/run/verification-job.d.ts

@@ -1,6 +1,6 @@
 import type { ShellReceipt } from "./protocol.js";
 import type { GateEvidenceOptions } from "../gates/baseline.js";
-import { type RepositoryLeaseHolder } from "./lease.js";
+import { type LeaseBlocker, type RepositoryLeaseHolder } from "./lease.js";
 export interface VerificationPhase {
     phase: "discovery" | "first-pass" | "continuation-discovery" | "continuation";
     nonce: string;
@@ -33,7 +33,9 @@ export interface VerificationJobReport {
     releasedAt?: number;
     reservationReused?: boolean;
     reservation?: RepositoryLeaseHolder;
-    waitingOn?: RepositoryLeaseHolder;
+    waitingOn?: RepositoryLeaseHolder & {
+        blockers?: readonly LeaseBlocker[];
+    };
     state: "queued" | "running" | "completed" | "failed" | "cancelled";
     phases: VerificationPhase[];
 }

package/dist/run/verification-job.js

@@ -132,7 +132,7 @@ export async function withVerificationJob(command, cwd, reportPath, evidence, ru
                 }
             }));
         }, { isolated: true, protectOrphans: true, independent: !!jobs.getStore(), signal, pollMs: 20,
-            onWait: holder => { report.waitingOn = { ...holder }; job.persist(); },
+            onWait: (holder, blockers) => { report.waitingOn = { ...holder, ...(blockers ? { blockers } : {}) }; job.persist(); },
             onAdmission: holder => { owner = holder; report.repositoryAdmittedAt = clock(); report.reservation = { ...holder }; job.persist(); },
             onRelease: () => { report.reapedAt ??= clock(); report.repositoryReleasedAt = clock(); job.persist(); } }));
         report.releasedAt = clock();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tickmarkr",
-  "version": "2.7.4",
+  "version": "2.7.5",
   "description": "Spec in, verified work out.",
   "type": "module",
   "license": "MIT",