toolroll 0.9.103 → 0.9.105

package/dist/route-store.d.ts

@@ -1,300 +0,0 @@
-import { type ExecClass, type IneligibleReason, type RevisionOrigin, type Selection } from "./contracts/route-results.js";
-import type { RecordValue } from "./route-results.js";
-import type { EarnedRule, EarnedTrial } from "./phase-routing.js";
-import { type Store } from "./store.js";
-/** A failed run's raw reason, by whose account it failed. Anything not listed counts as the model's (conservative: a
- * missing or unknown class counts against the cheaper model, never for it). */
-export declare const EXEC_CLASS_OF_REASON: Readonly<Record<string, ExecClass>>;
-/** The gateway's terminal classes that say the provider, not the model, ended the attempt. */
-export declare const INFRASTRUCTURE_TERMINALS: ReadonlySet<string>;
-/** The class a failed run's raw reason (before the tick's normalization) and its terminal class give. */
-export declare function execClassOf(reason: string, terminalClass: string | null): ExecClass;
-export type CohortRow = {
-    run: number;
-    taskRef: number;
-    rootRef: number;
-    repo: string | null;
-    role: "builder" | "repair";
-    size: "small" | "medium" | "large" | null;
-    risky: boolean | null;
-    qualityMode: "default" | "strict";
-    evidenceDemands: boolean;
-    publication: "none" | "notify" | "automerge";
-    release: boolean;
-    protected: boolean;
-    selection: Selection;
-    routeDigest: string;
-    provider: string;
-    model: string | null;
-    cohortSize: "small" | "medium" | null;
-    ineligible: IneligibleReason | null;
-    startedAt: string;
-};
-export type CohortInput = {
-    run: number;
-    taskRef: number;
-    role: "builder" | "repair";
-    routeDigest: string;
-    provider: string;
-    model: string | null;
-    qualityMode: "default" | "strict";
-    startedAt: string;
-};
-/** The sealed facts a code-writing run's eligibility is decided from, conservatively: anything unreadable or not
- * sealed is not eligible. Pure reads of the store, in the admission transaction. */
-export declare function cohortOf(store: Store, input: CohortInput): CohortRow;
-/** Keep a failed run's execution class from its raw reason, before the tick normalizes it (dispose.ts). First write
- * wins: a later ending of the same run never rewrites the class it was kept with. */
-export declare function recordExecClass(store: Store, runId: number, reason: string): void;
-/** Who a revision came from, written once with the revision's seal; never on a task that revises nothing. */
-export declare function recordRevisionOrigin(store: Store, taskId: string, origin: RevisionOrigin): void;
-/**
- * A code-writing run's cohort snapshot, in its admission transaction (store.ts admitRun), written once and never
- * updated. A snapshot that can't be computed is never a refused admission: the run is recorded as not eligible, and a
- * write that fails leaves no row (its record then reads "started before results were recorded"), so a cheaper model
- * never gains from either.
- */
-export declare function writeRunCohort(store: Store, input: CohortInput): void;
-/** Save a family's record as evaluated now. A decision time is kept while the state stays the same. Once a verdict
- * is final (settled) it never moves — state, reason, result run, acceptance and decision time stay as decided — but
- * the family's spending and counts keep being updated from later revision and repair runs until the record closes
- * (route-results.ts ACCUMULATE_FOR_MS); a closed record is never written again. */
-export declare function saveResultRecord(store: Store, value: RecordValue, now: Date): void;
-/** The generation of one (scope, phase) Models row set: 0 before anything changed it. */
-export declare function modelsGenerationOf(store: Store, scope: string, phase: string): number;
-/**
- * Move a (scope, phase) generation: called by every Models row writer (store.ts), inside the writer's own
- * transaction, whenever a row actually changed. Rules that depend on a generation that moved are paused in the same
- * transaction (pauseDependentRules), so a configuration change can never leave a rule running on terms it no longer
- * has.
- */
-export declare function bumpModelsGeneration(store: Store, scope: string, phase: string, now: Date): number;
-/** Pause every running rule or trial whose recorded dependency generations no longer match: a compare-and-swap on
- * the rule's own generation, so a rule another writer already moved is left to that writer. An unreadable
- * dependency list pauses too. */
-export declare function pauseDependentRules(store: Store, now: Date): number;
-/** A deleted project's results-routing rows (project-delete.ts, through store.ts forgetProjectModels): its rules,
- * their exposures and trial places, its records and its runs' cohort snapshots. How many rows went. */
-export declare function forgetProjectRoutes(store: Store, repo: string): number;
-/** A person who proved themselves for this act (model-choices.ts ModelAuthority's shape): the account, the credential
- * generation the proof was checked against, how they proved it, and whether the session or login still stands. */
-export type RulePerson = {
-    actor: string;
-    generation: number;
-    method: string;
-    live: () => boolean;
-};
-/** Who asks a rule act: a person, or this computer's local owner (local mode) inside the one act it may do. */
-export type RuleDoor = {
-    kind: "person";
-    person: RulePerson;
-} | {
-    kind: "local-owner";
-    actor: string;
-};
-/** The acts and the door each takes (docs/plans/results-routing.md, Authority). Raising acts take a person with a
- * step-up; lowering acts take a person, or a local owner whose in-flight act is exactly the one named here. */
-export declare const RULE_ACTS: Readonly<{
-    readonly accept: {
-        readonly raising: true;
-        readonly localAct: null;
-    };
-    readonly keep: {
-        readonly raising: true;
-        readonly localAct: null;
-    };
-    readonly "suggest-on": {
-        readonly raising: true;
-        readonly localAct: null;
-    };
-    readonly "turn-off": {
-        readonly raising: false;
-        readonly localAct: "routing-turn-off";
-    };
-    readonly dismiss: {
-        readonly raising: false;
-        readonly localAct: "dismiss-suggestion";
-    };
-    readonly "suggest-off": {
-        readonly raising: false;
-        readonly localAct: "dismiss-suggestion";
-    };
-    readonly "trial-start": {
-        readonly raising: true;
-        readonly localAct: null;
-    };
-    readonly "trial-stop": {
-        readonly raising: false;
-        readonly localAct: "trial-stop";
-    };
-}>;
-export type RuleAct = keyof typeof RULE_ACTS;
-export type RuleRefusalReason = "lead-refused" | "authority";
-/** A door proved inside the write's own transaction: minted only by proveRuleDoor, and spent only there. */
-export type ProvedRuleDoor = {
-    readonly actor: string;
-    readonly act: RuleAct;
-    readonly via: "person" | "local-owner";
-};
-/**
- * The rule doors' one proof, run inside the write's transaction: a lead token or a remote API token never acts
- * (`lead-refused`); a person is re-proved — the same account, still active, still an instance operator who can open
- * the project, at the credential generation the proof was made under, by a proof that still stands (model-choices.ts
- * applyModelChoices' re-proof); a local owner only for a lowering act, only while it still stands, and only when its
- * in-flight act is exactly that act's.
- */
-export declare function proveRuleDoor(store: Store, door: RuleDoor, act: RuleAct, repo: string): {
-    ok: true;
-    door: ProvedRuleDoor;
-} | {
-    ok: false;
-    reason: RuleRefusalReason;
-};
-export type RuleInsert = {
-    repo: string;
-    cohortSize: "small" | "medium";
-    provider: string;
-    model: string;
-    configuredProvider: string;
-    configuredModel: string | null;
-    grant: unknown;
-    prices: unknown;
-    depends: Readonly<Record<string, number>>;
-};
-/** Insert an accepted earned rule, live. The winner index makes a second live rule for the same project and size
- * refuse (null); nothing else is written. */
-export declare function insertEarnedRule(store: Store, door: ProvedRuleDoor, rule: RuleInsert, now: Date): number | null;
-/** A person's or local owner's end of a live rule — turned off, or a paused one dropped — by compare-and-swap on its
- * generation. False when the rule moved since (or isn't live). */
-export declare function endRuleByDoor(store: Store, door: ProvedRuleDoor, ruleId: number, generation: number, now: Date): boolean;
-/** Keep a paused rule: live again, on the configuration generations it depends on now. Its sealed grant (terms,
- * cutoff, expiry) never changes. */
-export declare function keepPausedRule(store: Store, door: ProvedRuleDoor, ruleId: number, generation: number, depends: Readonly<Record<string, number>>): boolean;
-/** "Not now" on one suggestion: kept as an ended offer (state dropped, reason not-now) so the same suggestion stays
- * quiet for its 30 days; it never blocks a rule. */
-export declare function recordNotNow(store: Store, door: ProvedRuleDoor, offer: {
-    repo: string;
-    cohortSize: "small" | "medium";
-    provider: string;
-    model: string;
-    configuredProvider: string;
-    configuredModel: string | null;
-    prices: unknown;
-}, now: Date): void;
-/** A project's "Suggest cheaper models" switch. False when the project isn't saved here. */
-export declare function writeSuggestModels(store: Store, door: ProvedRuleDoor, repo: string, on: boolean): boolean;
-/** The plane's own end of a rule (no person): switched off by its sealed trigger, paused (a configuration or grant
- * change), or expired. A compare-and-swap on the rule's generation and a live state: false when it moved since. */
-export declare function endRuleByPlane(store: Store, ruleId: number, generation: number, to: "switched-off" | "paused" | "expired", reason: string, now: Date): boolean;
-/** The exposure rows a filing writes (store.ts saveScope): a build leg sealed under a rule opens the task's exposure
- * to it (`proposed`) or, filed again, adds `refiled`; a filing that no longer selects a rule the task was exposed to
- * adds `refiled` to that open exposure, which its approval then closes as approved with another model. Re-filing
- * never adds a row. */
-export declare function noteExposureFiled(store: Store, taskRef: number, selection: Selection | undefined, now: Date): void;
-/** An approval closes the task's open exposures: as proposed when it sealed that very rule, otherwise approved with
- * the model it sealed. */
-export declare function noteExposureSealed(store: Store, taskRef: number, sealed: {
-    selection: Selection | undefined;
-    model: string;
-}, now: Date): void;
-/** A cancel closes the task's open exposures. */
-export declare function noteExposureCancelled(store: Store, taskRef: number, now: Date): void;
-/** A project's live earned rules, as routing reads them (phase-routing.ts EarnedRule): kind rule, state active, a
- * Claude model. A row that doesn't read is left out (it can only ever not apply). */
-export declare function liveEarnedRules(store: Store, repo: string | null): EarnedRule[];
-/** Why a build of this task must not start under the rule its route sealed, or null: the rule switched itself off
- * after the approval and the task hasn't started (docs/plans/results-routing.md, "When a rule ends"). A rule turned off
- * by a person, or expired, keeps the sealed model; a started task's later attempts finish under it. */
-export declare function ruleHoldOf(store: Store, taskId: string): {
-    rule: number;
-    model: string;
-} | null;
-export type TrialInsert = {
-    repo: string;
-    cohortSize: "small" | "medium";
-    model: string;
-    configuredProvider: string;
-    configuredModel: string | null;
-    limit: number;
-    grant: unknown;
-    prices: unknown;
-    depends: Readonly<Record<string, number>>;
-};
-/** Start a trial, live (state trialling) with its number of places. The winner index makes a second live rule or
- * trial for the same project and size refuse (null); nothing else is written. */
-export declare function insertTrial(store: Store, door: ProvedRuleDoor, trial: TrialInsert, now: Date): number | null;
-/**
- * A person's or local owner's stop of a live or paused trial, by compare-and-swap on its generation, in the same
- * transaction as releasing the places of tasks not approved on them (those plans are re-filed by the rule pass). A
- * place a task was approved on stays reserved: that task keeps the model a person approved (as a rule turned off
- * does). False when the trial moved since.
- */
-export declare function endTrialByDoor(store: Store, door: ProvedRuleDoor, trialId: number, generation: number, now: Date): boolean;
-/** A project's live trial for one size, as routing reads it (without this filing's place): state trialling, a Claude
- * model. Null when none, or when its row doesn't read (it can only ever not apply). */
-export declare function liveTrialFor(store: Store, repo: string | null, size: string | null | undefined): Omit<EarnedTrial, "reservation"> | null;
-/**
- * This task's place in a trial, in the filing's own write transaction (store.ts saveScope, serialized by
- * beginWriteWithin): a place it already holds (reserved, or consumed by its own earlier attempt) is reused, so
- * repeated saves never take a second one; a place it gave up is never taken back; otherwise a new one only while
- * reserved + consumed is under the trial's limit and the trial is live. Its digest is bound by settleTrialPlaces in
- * the same transaction. Null: no place.
- */
-export declare function reserveTrialPlace(store: Store, trialId: number, taskRef: number, now: Date): number | null;
-/**
- * After a filing, in its transaction: the place its route seals (if any) is bound to the scope digest it was filed
- * under (a compare-and-swap on `reserved`; a place this task's own attempt already consumed stays as it is), and every
- * other place this task holds unconsumed is released. A selection that names a place this task doesn't hold throws:
- * nothing files on it.
- */
-export declare function settleTrialPlaces(store: Store, taskRef: number, selection: Selection | undefined, digest: string, now: Date): void;
-/** A cancel gives up every place the task holds unconsumed (store.ts applyCancellationLocked). A consumed place is
- * never released. How many went. */
-export declare function releaseTrialPlaces(store: Store, taskRef: number, now: Date): number;
-/**
- * Why a seal of this route must not stand, or null (store.ts sealScopeApproval): a trial task is approved only by a
- * person — their own ceremony (no basis; not a machine acting, not an AI approver's name) or their paired-chat tap —
- * never a mode, a grant, a schedule, a carry, an automatic seal or the lead; and only while its place stands.
- */
-export declare function trialSealProblem(store: Store, input: {
-    taskRef: number | null;
-    selection: Selection | undefined;
-    digest: string;
-    basis: string | null;
-    by: string;
-    machine: boolean;
-}): string | null;
-/**
- * A code-writing run's trial check, in its admission transaction after the run row exists (store.ts admitRun): for a
- * route sealed on a trial, the approval must be a person's own (approval-authority.ts trialSealStandsSql), and the
- * sealed place is consumed exactly once — a compare-and-swap on `reserved` and the sealed scope digest. A retry or
- * repair of the same task whose place that task already consumed is admitted without consuming again. The words, or
- * null to admit; the caller refuses (rolling the row back) on words.
- */
-export declare function admitTrialRun(store: Store, input: {
-    taskId: string;
-    taskRef: number;
-    role: string;
-    run: number;
-    now: Date;
-}): string | null;
-/** Consume one reserved place for this run: only with the sealed scope digest it was bound to. */
-export declare function consumeTrialPlace(store: Store, reservation: number, sealedDigest: string, run: number, now: Date): boolean;
-/** A trial's places: its limit, how many are reserved (waiting) and consumed (started). */
-export declare function trialPlacesOf(store: Store, trialId: number): {
-    limit: number;
-    reserved: number;
-    consumed: number;
-};
-/** Which place in its trial this one is (1-based, counting places held or used, in order), or null. */
-export declare function trialOrdinalOf(store: Store, reservation: number): {
-    trial: number;
-    ordinal: number;
-    state: string;
-} | null;
-/** Whether a proposal's trial place still stands for re-use by its next approval: the trial is live and the place is
- * held reserved by that task (the rule pass re-files a proposal whose place doesn't). */
-export declare function trialPlaceLive(store: Store, selection: {
-    rule: number;
-    reservation: number;
-}, taskRef: number): boolean;

package/dist/run-closeout.d.ts

@@ -1,89 +0,0 @@
-import { type Store, type WorktreeRow } from "./store.js";
-/** How long a process has after SIGTERM before SIGKILL. */
-export declare const STOP_GRACE_MS = 10000;
-export type ProcessRow = {
-    pid: number;
-    ppid: number;
-    pgid: number;
-    bornAt: number;
-    name: string;
-    terminal: boolean;
-};
-/** Every process now: ids, when it was born (from its age) and its program's name — never its arguments, which can
- * carry private provider inputs. */
-export declare function processCensus(now?: number): ProcessRow[];
-/** `ps -o pid=,ppid=,pgid=,etime=,tty=,comm=` rows; etime is [[dd-]hh:]mm:ss, tty `??` or `?` for none. Unreadable rows are left out. */
-export declare function parseCensus(text: string, now: number): ProcessRow[];
-/** This process, its ancestors, pid 1 and their process groups: the live service, never stopped. */
-export declare function protectedProcesses(census: readonly ProcessRow[], self?: number): {
-    pids: Set<number>;
-    groups: Set<number>;
-};
-export type Witness = {
-    pid: number;
-    group: boolean;
-    observedAt: number;
-};
-/**
- * What of a run is still running: each witnessed process that is still the same process (born no later than the run
- * saw it), and every member of each witnessed group whose leader is that same process or gone. Never anything
- * protected.
- */
-export declare function closeoutTargets(census: readonly ProcessRow[], witnesses: readonly Witness[], guard: {
-    pids: ReadonlySet<number>;
-    groups: ReadonlySet<number>;
-}): ProcessRow[];
-export type Stopped = {
-    stopped: ProcessRow[];
-    killed: ProcessRow[];
-};
-export type StopOptions = {
-    graceMs?: number;
-    census?: () => ProcessRow[];
-    signal?: (pid: number, signal: NodeJS.Signals) => void;
-    sleep?: (ms: number) => Promise<void>;
-};
-/** SIGTERM each target, wait up to the grace for them to go, then SIGKILL what is still the same process. */
-export declare function stopProcesses(targets: readonly ProcessRow[], options?: StopOptions): Promise<Stopped>;
-/** "node (4123), serve (4130); 1 needed SIGKILL after 10 s" — for the ledger. */
-export declare function stoppedWords(done: Stopped, graceMs?: number): string;
-export type CloseoutOptions = StopOptions & {
-    repo?: string;
-    actor?: string;
-};
-/**
- * The worker's pass: every finished run of this host that still has a process witness open is closed out. A run
- * whose transport here still holds a live child is left to that road.
- * Returns what each run had stopped.
- */
-export declare function closeOutRuns(store: Store, clock: () => Date, options?: CloseoutOptions): Promise<{
-    runId: number;
-    done: Stopped;
-}[]>;
-/** Which processes run from inside each of `paths` (their working directory is there): lsof on macOS, /proc on Linux. */
-export declare function processesIn(paths: readonly string[]): Map<string, number[]>;
-/**
- * Of the processes running from a finished checkout (`inside`), the ones Toolroll left there: each descends from a
- * process a finished run started (`roots`), or is an orphan (its parent is pid 1), or is the child of one that goes.
- * Never one with a live parent Toolroll didn't start — a deploy the lead runs from the checkout, a person's agent or
- * its tools — nor anything at a terminal or protected.
- */
-export declare function checkoutTargets(census: readonly ProcessRow[], inside: ReadonlySet<number>, roots: ReadonlySet<number>, guard: {
-    pids: ReadonlySet<number>;
-    groups: ReadonlySet<number>;
-}): ProcessRow[];
-/**
- * Completing or cancelling a task closes out its checkout: what Toolroll left running from it (`checkoutTargets`) is
- * stopped (SIGTERM, then SIGKILL after the grace), in the ledger. `finished` lists the checkouts whose task is
- * complete or cancelled, with when it finished; each is looked at once per finish.
- */
-export declare function closeOutCheckouts(store: Store, clock: () => Date, finished: readonly {
-    row: WorktreeRow;
-    taskId: string | null;
-    finishedAt: string;
-}[], options?: CloseoutOptions & {
-    find?: typeof processesIn;
-}): Promise<{
-    path: string;
-    done: Stopped;
-}[]>;

package/dist/run-efficiency.d.ts

@@ -1,74 +0,0 @@
-/**
- * How a run went (docs/plans/run-efficiency.md): derived from the run's own records, display only. It never changes a
- * completion, an approval, a charge or a check verdict, and it claims nothing its sources don't hold — an unreported
- * number is unknown (null, shown as a dash), never zero.
- *
- * Sources, and what each can say: the run row (wall times, tokens, the provider's raw usage with its cache counts, the
- * agent's turns where reported) is kept with the run; the live records (`<evidence>/live/<run>.jsonl`, display-only,
- * kept 24 hours) are read once, bounded, through the descriptor-safe live reader, for step counts and observed step
- * times. No command text is ever stored here: repeats are counted, never quoted.
- */
-import { type Run, type Store } from "./store.js";
-import type { LiveActivityKind, LiveRecord } from "./live-records.js";
-export declare const RUN_EFFICIENCY_VERSION = 3;
-/** Budgets for one derivation: never more than the live file's own cap, and a bounded record count. */
-export declare const EFFICIENCY_READ_BYTES: number;
-export declare const EFFICIENCY_RECORDS = 20000;
-export type StepsState = "complete" | "truncated" | "expired" | "absent";
-export type RunEfficiency = {
-    version: number;
-    /** Waiting to start (claimed → provider started) and the agent (provider started → finished); null when unrecorded. */
-    time: {
-        waitMs: number | null;
-        agentMs: number | null;
-    };
-    turns: number | null;
-    /** Tokens in counts everything the model read (cached included); `cacheShare` is read-from-cache ÷ that, 0–1. */
-    usage: {
-        in: number | null;
-        out: number | null;
-        cacheRead: number | null;
-        cacheWrite: number | null;
-        cacheShare: number | null;
-        provider: string;
-        model: string | null;
-    };
-    steps: {
-        state: StepsState;
-        reason: string | null;
-        total: number | null;
-        failed: number | null;
-        unknownDuration: number | null;
-        byKind: Partial<Record<LiveActivityKind, number>>;
-        longest: {
-            kind: LiveActivityKind;
-            ms: number;
-        }[];
-        /** Repeated activity: the same step (kind and its full recorded input) at least three times. Null when the inputs
-         * can't be compared (command detail off, or a target hidden or shortened) — said, never guessed. */
-        repeats: {
-            kind: LiveActivityKind;
-            count: number;
-        }[] | null;
-        repeatsReason: string | null;
-    };
-};
-/** Tokens and cache from the provider's own usage report, read per provider (their counts mean different things). */
-export declare function usageOf(run: Pick<Run, "provider" | "model" | "tokensIn" | "tokensOut"> & {
-    usageJson?: string | null;
-}): RunEfficiency["usage"];
-/** The live records' steps, bounded: counts by kind, failures, observed times and repeats (never their words). */
-/** `measured`: the recorder saw this provider's steps start and end as they happened (Claude's stream does); for the
- * others their times are partly made up (Codex reports a step when it completes, ACP agents may report late), so no
- * duration is claimed for them. */
-export declare function stepsOf(records: Iterable<LiveRecord>, truncated: string | null, measured?: boolean): RunEfficiency["steps"];
-/** Derive a finished run's How it ran from its records, read under the run's own captured "Show commands" answer. */
-export declare function deriveRunEfficiency(run: Run & {
-    usageJson?: string | null;
-}, evidenceRoot: string, now: Date, commands?: boolean): RunEfficiency;
-/**
- * A finished run's How it ran: the saved one when it was derived by this version, else derived now and saved (once:
- * a row whose steps were complete or have expired is final). An unfinished run is derived but never saved, and
- * nothing is saved when `save` is false (a page read ahead of its link writes nothing).
- */
-export declare function runEfficiencyOf(store: Store, evidenceRoot: string, runId: number, now: Date, save?: boolean): RunEfficiency | null;

package/dist/run-ending.d.ts

@@ -1,21 +0,0 @@
-/**
- * How a run ended, asked one way.
- *
- * "Interrupted" is stored in two spellings. Every ending written today is the outcome `failed` with the reason
- * `interrupted`. Rows written between schema 25 and 114 carry the outcome `interrupted` itself (a held session cut
- * down mid-flight) and still read. A check that knows only one spelling treats the same event two ways, so every check
- * asks here.
- */
-export declare function wasInterrupted(run: {
-    outcome: string | null;
-    reason?: string | null;
-}): boolean;
-/**
- * The spelling written today, and only it. The roads that hand an interrupted attempt's draft to the next attempt
- * (salvage in the checkout, the recovery grant, the check a run never reached) ask this one: they were built for the
- * runs that write it, and reading the old spelling there would widen what they recover.
- */
-export declare function endedInterrupted(run: {
-    outcome: unknown;
-    reason?: unknown;
-}): boolean;

package/dist/runner-process.d.ts

@@ -1,76 +0,0 @@
-import type { Runner } from "./runner.js";
-export type RunnerProcessRole = "up" | "console" | "worker";
-export type RunnerProcess = {
-    pid: number;
-    role: RunnerProcessRole;
-    started: string;
-};
-export type RunnerProcessRecord = {
-    v: 1;
-    runner: string;
-    host: string;
-    registeredAt: string;
-    /** A digest of the plane's credential hash for this registration: it names the incarnation, it proves nothing. */
-    credential: string;
-    processes: RunnerProcess[];
-    /** Authenticated with the plane's stored credential hash; legacy/forged records prove nothing. */
-    signature?: string;
-};
-export declare const RUNNER_PROCESS_DIR = "runner-processes";
-/** The namespace is created before builds launch and denied by name, including in a shared state folder. */
-export declare function ensureRunnerProcessFolder(folder: string): void;
-export declare function sealRunnerProcessRecord(record: RunnerProcessRecord, credentialHash: string): RunnerProcessRecord;
-/** Where a runner's record lives: beside the database, under a name derived from the runner's (never the name itself). */
-export declare function runnerProcessFile(databaseFile: string, runner: string): string;
-/** The incarnation's name in a record: a digest of the stored credential hash, so the record never holds that hash. */
-export declare function credentialDigest(credentialHash: string): string;
-/** `ps -o lstart=` (LC_ALL=C, TZ=UTC) as an ISO second, or null when it isn't exactly that shape. */
-export declare function parseProcessStart(raw: string): string | null;
-/** When a process started (whole seconds), or null when there is no such process or it can't be read. */
-export declare function processStart(pid: number): string | null;
-/** The probes a proof uses; real by default, supplied by tests. */
-export type ProcessProbe = {
-    exists: (pid: number) => "absent" | "present" | "unknown";
-    start: (pid: number) => string | null;
-};
-export declare const realProcessProbe: ProcessProbe;
-/** Proved gone: no process has this id, or the one that has it started at another time (the id was reused). */
-export declare function processGone(entry: RunnerProcess, probe?: ProcessProbe): boolean;
-/** A record read strictly: a regular private file of bounded size, every field its exact type, or null. */
-export declare function readRunnerProcessRecord(file: string): RunnerProcessRecord | null;
-/** Replace the record atomically: a private temp file in a private folder, renamed into place. */
-export declare function writeRunnerProcessRecord(file: string, record: RunnerProcessRecord): void;
-/**
- * Whether the plane's current holder of a runner name is proved gone: the record is for exactly that registration,
- * on this host, and every process it names has exited (by identity). `detail` says which processes, for the ledger.
- */
-export declare function holderProvedGone(record: RunnerProcessRecord | null, holder: {
-    runner: Runner;
-    credentialHash: string;
-}, host: string, probe?: ProcessProbe): {
-    gone: true;
-    detail: string;
-} | {
-    gone: false;
-    why: string;
-};
-/** Re-read after observing exit: an up may append a child between the first read and its own exit. */
-export declare function recordedHolderProvedGone(file: string, holder: {
-    runner: Runner;
-    credentialHash: string;
-}, host: string, probe?: ProcessProbe): {
-    gone: true;
-    detail: string;
-} | {
-    gone: false;
-    why: string;
-};
-/**
- * Whether a record is authentic for exactly this registration on this host (the checks holderProvedGone makes before
- * it looks at any process): sealed with the stored credential hash, for this runner, host, registration and
- * credential. Null when it stands; otherwise why not. It says nothing about which processes still run.
- */
-export declare function recordStandsFor(record: RunnerProcessRecord | null, holder: {
-    runner: Runner;
-    credentialHash: string;
-}, host: string): string | null;