toolroll 0.9.76 → 0.9.78

package/dist/review-context.js

@@ -45,6 +45,7 @@ import { createHash } from "node:crypto";
 import { hasForbiddenControls } from "./decision.js";
 import { EVIDENCE_CAPS, isBinaryAssetPath, isImagePath, readVerifiedArtifact, redactSecretLines, scanForSecrets, storeEvidence } from "./evidence.js";
 import { parseProof } from "./proof.js";
+import { noLazyFetch } from "./teardown-git.js";
 /** Explicit bounds. Content bytes are UTF-8 of the stored (possibly
  * redacted) text; the aggregate is the sum over every stored item. */
 export const LEGACY_REVIEW_CONTEXT_LIMITS = {
@@ -468,11 +469,12 @@ export function citesSuppliedProvenance(note, supplied) {
             return true;
     return false;
 }
-const GIT_READ = ["--literal-pathspecs", "--no-lazy-fetch", "--no-replace-objects", "--no-optional-locks"];
+/** Read flags: --no-lazy-fetch where git has it (the hardened runner refuses a partial clone where it doesn't). */
+const gitRead = () => ["--literal-pathspecs", ...noLazyFetch(), "-c", "protocol.allow=never", "--no-replace-objects", "--no-optional-locks"];
 async function treeEntries(git, cwd, revision, paths) {
     if (paths.length === 0)
         return new Map();
-    const listed = await git("git", [...GIT_READ, "ls-tree", "-z", "-l", revision, "--", ...paths], { cwd, maxBuffer: 4 * 1024 * 1024 });
+    const listed = await git("git", [...gitRead(), "ls-tree", "-z", "-l", revision, "--", ...paths], { cwd, maxBuffer: 4 * 1024 * 1024 });
     if (listed.code !== 0)
         return null;
     const entries = new Map();
@@ -570,7 +572,7 @@ async function ancestorPatch(store, git, args, inventory, path) {
         if (!base || !head || !SHA1.test(base) || !SHA1.test(head))
             return fail(`run #${runId} has no exact patch endpoints`);
         for (const from of new Set([base, previousHead ?? base])) {
-            const ancestor = await git("git", [...GIT_READ, "merge-base", "--is-ancestor", from, head], { cwd: args.worktree });
+            const ancestor = await git("git", [...gitRead(), "merge-base", "--is-ancestor", from, head], { cwd: args.worktree });
             if (ancestor.code !== 0)
                 return fail(`run #${runId}'s patch ancestry could not be verified`);
         }
@@ -780,7 +782,7 @@ export async function deriveReviewContext(store, git, args, lineage) {
     const sourceCriteria = new Map((sourceScopeVerified ? sourceScope.acceptance : []).map(one => [one.id, one]));
     // 3. Ancestry: is the source head an ancestor of this head?
     if (sourceHead !== null) {
-        const check = await git("git", [...GIT_READ, "merge-base", "--is-ancestor", sourceHead, args.head], { cwd: args.worktree });
+        const check = await git("git", [...gitRead(), "merge-base", "--is-ancestor", sourceHead, args.head], { cwd: args.worktree });
         if (check.code === 0)
             inventory.ancestry = { verified: true, detail: `${sourceHead} is an ancestor of ${args.head}` };
         else if (check.code === 1) {
@@ -832,7 +834,7 @@ export async function deriveReviewContext(store, git, args, lineage) {
     if (generalPaths.length === 0 && sourceScopeVerified) {
         const paths = sourceScope.touches.filter(path => safeContextPath(path.replace(/\/$/, "")) && !/[?*\[\]]/.test(path));
         if (paths.length > 0) {
-            const listed = await git("git", [...GIT_READ, "ls-tree", "-r", "-z", "--name-only", args.head, "--", ...paths], { cwd: args.worktree, maxBuffer: 4 * 1024 * 1024 });
+            const listed = await git("git", [...gitRead(), "ls-tree", "-r", "-z", "--name-only", args.head, "--", ...paths], { cwd: args.worktree, maxBuffer: 4 * 1024 * 1024 });
             if (listed.code === 0)
                 generalPaths.push(...[...new Set(listed.stdout.split("\0").filter(safeContextPath))].sort());
             else
@@ -949,7 +951,7 @@ export async function deriveReviewContext(store, git, args, lineage) {
                     gap("aggregate-limit", `${entry.size} bytes would cross the ${REVIEW_CONTEXT_LIMITS.aggregateBytes}-byte aggregate limit`);
                     continue;
                 }
-                const read = await git("git", [...GIT_READ, "cat-file", "blob", entry.object], { cwd: args.worktree, maxBuffer: REVIEW_CONTEXT_LIMITS.itemBytes + 4096 });
+                const read = await git("git", [...gitRead(), "cat-file", "blob", entry.object], { cwd: args.worktree, maxBuffer: REVIEW_CONTEXT_LIMITS.itemBytes + 4096 });
                 if (read.code !== 0) {
                     gap("capture-failed", `blob ${entry.object} could not be read (git exit ${read.code})`);
                     continue;

package/dist/runner-process.d.ts

@@ -0,0 +1,67 @@
+import type { Runner } from "./runner.js";
+export type RunnerProcessRole = "up" | "console" | "worker";
+export type RunnerProcess = {
+    pid: number;
+    role: RunnerProcessRole;
+    started: string;
+};
+export type RunnerProcessRecord = {
+    v: 1;
+    runner: string;
+    host: string;
+    registeredAt: string;
+    /** A digest of the plane's credential hash for this registration: it names the incarnation, it proves nothing. */
+    credential: string;
+    processes: RunnerProcess[];
+    /** Authenticated with the plane's stored credential hash; legacy/forged records prove nothing. */
+    signature?: string;
+};
+export declare const RUNNER_PROCESS_DIR = "runner-processes";
+/** The namespace is created before builds launch and denied by name, including in a shared state folder. */
+export declare function ensureRunnerProcessFolder(folder: string): void;
+export declare function sealRunnerProcessRecord(record: RunnerProcessRecord, credentialHash: string): RunnerProcessRecord;
+/** Where a runner's record lives: beside the database, under a name derived from the runner's (never the name itself). */
+export declare function runnerProcessFile(databaseFile: string, runner: string): string;
+/** The incarnation's name in a record: a digest of the stored credential hash, so the record never holds that hash. */
+export declare function credentialDigest(credentialHash: string): string;
+/** `ps -o lstart=` (LC_ALL=C, TZ=UTC) as an ISO second, or null when it isn't exactly that shape. */
+export declare function parseProcessStart(raw: string): string | null;
+/** When a process started (whole seconds), or null when there is no such process or it can't be read. */
+export declare function processStart(pid: number): string | null;
+/** The probes a proof uses; real by default, supplied by tests. */
+export type ProcessProbe = {
+    exists: (pid: number) => "absent" | "present" | "unknown";
+    start: (pid: number) => string | null;
+};
+export declare const realProcessProbe: ProcessProbe;
+/** Proved gone: no process has this id, or the one that has it started at another time (the id was reused). */
+export declare function processGone(entry: RunnerProcess, probe?: ProcessProbe): boolean;
+/** A record read strictly: a regular private file of bounded size, every field its exact type, or null. */
+export declare function readRunnerProcessRecord(file: string): RunnerProcessRecord | null;
+/** Replace the record atomically: a private temp file in a private folder, renamed into place. */
+export declare function writeRunnerProcessRecord(file: string, record: RunnerProcessRecord): void;
+/**
+ * Whether the plane's current holder of a runner name is proved gone: the record is for exactly that registration,
+ * on this host, and every process it names has exited (by identity). `detail` says which processes, for the ledger.
+ */
+export declare function holderProvedGone(record: RunnerProcessRecord | null, holder: {
+    runner: Runner;
+    credentialHash: string;
+}, host: string, probe?: ProcessProbe): {
+    gone: true;
+    detail: string;
+} | {
+    gone: false;
+    why: string;
+};
+/** Re-read after observing exit: an up may append a child between the first read and its own exit. */
+export declare function recordedHolderProvedGone(file: string, holder: {
+    runner: Runner;
+    credentialHash: string;
+}, host: string, probe?: ProcessProbe): {
+    gone: true;
+    detail: string;
+} | {
+    gone: false;
+    why: string;
+};

package/dist/runner-process.js

@@ -0,0 +1,219 @@
+/**
+ * Which processes hold a runner's credential, kept beside the plane's database so a later `up` can prove the previous
+ * holder is gone (docs: the 2026-10-29 deploy incident). `toolroll up` registers its runner, then records itself and
+ * every role child it hands the token to, each by process id AND start time, before the child receives the token.
+ *
+ * A fresh `up` whose runner name is still held (its heartbeat looks fresh, or its watch lease has not lapsed) asks
+ * this record whether that holder is gone: the record must be for exactly the registration the plane holds (name,
+ * host, registration time and credential), and every process in it must have exited, each proved by identity (no
+ * such process, or a process with that id started at a different time). Then the plane retires the stale holder in
+ * the same transaction that proved it (runner.ts registerRunnerIfIdle). Anything missing, unreadable or ambiguous
+ * proves nothing, and the door keeps refusing until the heartbeat ages out, exactly as before.
+ *
+ * The record is the plane's own state (the folder that holds the database). It grants nothing by itself: it can
+ * only let a name whose every recorded holder has exited be taken over early.
+ */
+import { createHash, createHmac, randomUUID, timingSafeEqual } from "node:crypto";
+import { execFileSync } from "node:child_process";
+import { closeSync, fstatSync, lstatSync, mkdirSync, openSync, readSync, realpathSync, renameSync, rmSync, writeFileSync, fsyncSync, constants } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+export const RUNNER_PROCESS_DIR = "runner-processes";
+/** The namespace is created before builds launch and denied by name, including in a shared state folder. */
+export function ensureRunnerProcessFolder(folder) {
+    try {
+        mkdirSync(folder, { mode: 0o700 });
+    }
+    catch (error) {
+        if (error.code !== "EEXIST")
+            throw error;
+    }
+    const stat = lstatSync(folder);
+    if (!stat.isDirectory() || stat.isSymbolicLink() || (stat.mode & 0o077) !== 0
+        || (process.getuid && stat.uid !== process.getuid()) || realpathSync(folder) !== resolve(folder))
+        throw Error("Untrusted runner process folder");
+}
+export function sealRunnerProcessRecord(record, credentialHash) {
+    const { signature: _signature, ...plain } = record;
+    return { ...plain, signature: createHmac("sha256", credentialHash).update(JSON.stringify(plain)).digest("hex") };
+}
+const MAX_RECORD = 64 * 1024;
+const MAX_PROCESSES = 64;
+const ROLES = new Set(["up", "console", "worker"]);
+/** Where a runner's record lives: beside the database, under a name derived from the runner's (never the name itself). */
+export function runnerProcessFile(databaseFile, runner) {
+    let database = databaseFile;
+    try {
+        database = realpathSync(databaseFile);
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw error;
+    }
+    return join(realpathSync(dirname(database)), RUNNER_PROCESS_DIR, `${createHash("sha256").update(runner, "utf8").digest("hex").slice(0, 32)}.json`);
+}
+/** The incarnation's name in a record: a digest of the stored credential hash, so the record never holds that hash. */
+export function credentialDigest(credentialHash) {
+    return createHash("sha256").update(`runner-process:${credentialHash}`, "utf8").digest("hex").slice(0, 32);
+}
+const LSTART = /^(Sun|Mon|Tue|Wed|Thu|Fri|Sat) (Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec) (\d{1,2}) (\d{2}:\d{2}:\d{2}) (\d{4})$/;
+/** `ps -o lstart=` (LC_ALL=C, TZ=UTC) as an ISO second, or null when it isn't exactly that shape. */
+export function parseProcessStart(raw) {
+    const match = LSTART.exec(raw.trim().replace(/ +/g, " "));
+    if (match === null)
+        return null;
+    const utc = `${match[1]}, ${match[3].padStart(2, "0")} ${match[2]} ${match[5]} ${match[4]} GMT`;
+    const at = Date.parse(utc);
+    if (!Number.isFinite(at) || new Date(at).toUTCString() !== utc)
+        return null;
+    return new Date(at).toISOString();
+}
+/** When a process started (whole seconds), or null when there is no such process or it can't be read. */
+export function processStart(pid) {
+    if (!Number.isSafeInteger(pid) || pid <= 1 || process.platform === "win32")
+        return null;
+    try {
+        const raw = execFileSync("/bin/ps", ["-p", String(pid), "-o", "lstart="], {
+            encoding: "utf8", env: { PATH: "/usr/bin:/bin", LC_ALL: "C", TZ: "UTC" }, stdio: ["ignore", "pipe", "ignore"],
+            maxBuffer: 1024, timeout: 2_000, killSignal: "SIGKILL",
+        });
+        return parseProcessStart(raw);
+    }
+    catch {
+        return null;
+    }
+}
+export const realProcessProbe = {
+    exists: pid => {
+        try {
+            process.kill(pid, 0);
+            return "present";
+        }
+        catch (error) {
+            const code = error.code;
+            return code === "ESRCH" ? "absent" : code === "EPERM" ? "present" : "unknown";
+        }
+    },
+    start: processStart,
+};
+/** Proved gone: no process has this id, or the one that has it started at another time (the id was reused). */
+export function processGone(entry, probe = realProcessProbe) {
+    const exists = probe.exists(entry.pid);
+    if (exists === "absent")
+        return true;
+    if (exists === "unknown")
+        return false;
+    const started = probe.start(entry.pid);
+    if (started === null)
+        return probe.exists(entry.pid) === "absent";
+    return started !== entry.started;
+}
+/** A record read strictly: a regular private file of bounded size, every field its exact type, or null. */
+export function readRunnerProcessRecord(file) {
+    let fd = null;
+    try {
+        const folder = lstatSync(dirname(file));
+        if (!folder.isDirectory() || folder.isSymbolicLink() || (folder.mode & 0o077) !== 0
+            || (process.getuid && folder.uid !== process.getuid()) || realpathSync(dirname(file)) !== resolve(dirname(file)))
+            return null;
+        const link = lstatSync(file);
+        if (!link.isFile() || link.isSymbolicLink() || link.size > MAX_RECORD)
+            return null;
+        fd = openSync(file, constants.O_RDONLY | constants.O_NONBLOCK | (constants.O_NOFOLLOW ?? 0));
+        const stat = fstatSync(fd);
+        if (!stat.isFile() || stat.size > MAX_RECORD || stat.ino !== link.ino || stat.dev !== link.dev || (stat.mode & 0o077) !== 0)
+            return null;
+        if (typeof process.getuid === "function" && stat.uid !== process.getuid())
+            return null;
+        const buffer = Buffer.alloc(stat.size);
+        let read = 0;
+        while (read < stat.size) {
+            const n = readSync(fd, buffer, read, stat.size - read, read);
+            if (n === 0)
+                break;
+            read += n;
+        }
+        return parseRecord(JSON.parse(buffer.subarray(0, read).toString("utf8")));
+    }
+    catch {
+        return null;
+    }
+    finally {
+        if (fd !== null)
+            closeSync(fd);
+    }
+}
+const ISO = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/;
+function parseRecord(value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+        return null;
+    const v = value;
+    const text = (one, max = 512) => typeof one === "string" && one !== "" && one.length <= max && !one.includes("\0");
+    if (v["v"] !== 1 || !text(v["runner"]) || !text(v["host"]) || !text(v["registeredAt"]) || !ISO.test(v["registeredAt"]) || !text(v["credential"], 64))
+        return null;
+    const list = v["processes"];
+    if (!Array.isArray(list) || list.length === 0 || list.length > MAX_PROCESSES)
+        return null;
+    const processes = [];
+    for (const one of list) {
+        if (typeof one !== "object" || one === null)
+            return null;
+        const p = one;
+        if (!Number.isSafeInteger(p["pid"]) || p["pid"] <= 1 || !ROLES.has(p["role"]) || !text(p["started"], 32) || !ISO.test(p["started"]))
+            return null;
+        processes.push({ pid: p["pid"], role: p["role"], started: p["started"] });
+    }
+    return { v: 1, runner: v["runner"], host: v["host"], registeredAt: v["registeredAt"], credential: v["credential"], processes,
+        ...(typeof v["signature"] === "string" ? { signature: v["signature"] } : {}) };
+}
+/** Replace the record atomically: a private temp file in a private folder, renamed into place. */
+export function writeRunnerProcessRecord(file, record) {
+    ensureRunnerProcessFolder(dirname(file));
+    const temp = `${file}.${randomUUID()}.tmp`;
+    try {
+        const fd = openSync(temp, "wx", 0o600);
+        try {
+            writeFileSync(fd, JSON.stringify(record));
+            fsyncSync(fd);
+        }
+        finally {
+            closeSync(fd);
+        }
+        renameSync(temp, file);
+    }
+    finally {
+        rmSync(temp, { force: true });
+    }
+}
+/**
+ * Whether the plane's current holder of a runner name is proved gone: the record is for exactly that registration,
+ * on this host, and every process it names has exited (by identity). `detail` says which processes, for the ledger.
+ */
+export function holderProvedGone(record, holder, host, probe = realProcessProbe) {
+    if (record === null)
+        return { gone: false, why: "no readable record of its processes" };
+    const expected = sealRunnerProcessRecord(record, holder.credentialHash).signature;
+    if (typeof record.signature !== "string" || !/^[a-f0-9]{64}$/.test(record.signature)
+        || !timingSafeEqual(Buffer.from(record.signature, "hex"), Buffer.from(expected, "hex")))
+        return { gone: false, why: "its process record is not authenticated" };
+    if (record.runner !== holder.runner.name || record.host !== holder.runner.host || record.host !== host)
+        return { gone: false, why: "its record is for another worker or machine" };
+    if (record.registeredAt !== holder.runner.registeredAt || record.credential !== credentialDigest(holder.credentialHash))
+        return { gone: false, why: "its record is from an earlier start" };
+    if (!record.processes.some(one => one.role === "up"))
+        return { gone: false, why: "its record names no `up` process" };
+    const left = record.processes.filter(one => !processGone(one, probe));
+    if (left.length > 0)
+        return { gone: false, why: `process ${left.map(one => one.pid).join(", ")} is still running` };
+    return { gone: true, detail: `${record.runner}: process ${record.processes.map(one => `${one.pid} (${one.role})`).join(", ")} proved gone` };
+}
+/** Re-read after observing exit: an up may append a child between the first read and its own exit. */
+export function recordedHolderProvedGone(file, holder, host, probe = realProcessProbe) {
+    const record = readRunnerProcessRecord(file);
+    const proof = holderProvedGone(record, holder, host, probe);
+    if (!proof.gone)
+        return proof;
+    const after = readRunnerProcessRecord(file);
+    if (after === null || JSON.stringify(after) !== JSON.stringify(record))
+        return { gone: false, why: "its process record changed during the exit proof" };
+    return proof;
+}

package/dist/runner.d.ts

@@ -21,7 +21,7 @@
  */
 import { type AcpProviderId } from "./acp-agents.js";
 import type { AcpAttestation } from "./store.js";
-import type { Store, Mutation } from "./store.js";
+import { type Store, type Mutation } from "./store.js";
 import { type ProviderId } from "./provider.js";
 import type { ReadinessObservation } from "./phase-routing.js";
 /** A runner's repo binding, in the same canonical form task filing uses —
@@ -59,11 +59,18 @@ export declare const RUNNER_TOKEN_MS: number;
 /**
  * How long a runner may go quiet before it is presumed gone.
  *
- * Comfortably more than any sensible heartbeat interval: declaring a busy
- * machine dead because one check-in was slow costs more than waiting another
- * minute for a machine that really is.
+ * Four heartbeats (RUNNER_HEARTBEAT_MS): one slow check-in never declares a busy
+ * machine dead, and a machine that really is gone holds its name for a minute,
+ * not three (docs/plans/actors-lessons.md). A clean stop doesn't wait even that
+ * long: a draining or stopped holder never blocks the next start
+ * (registerRunnerIfIdle).
  */
-export declare const DEFAULT_LIVENESS_MS: number;
+export declare const DEFAULT_LIVENESS_MS = 60000;
+/** How often a live runner says so: `up`'s runner heartbeat and every watch lease renewal. */
+export declare const RUNNER_HEARTBEAT_MS = 15000;
+/** The longest a watch lease may be taken or renewed for (durable-actors' MAX_HOST_LEASE_DURATION_MS): a crashed
+ * holder's projects are free within a minute. The store clamps every ttl to it. */
+export { MAX_WATCH_LEASE_MS } from "./store.js";
 export type RegisterOptions = {
     name: string;
     host: string;
@@ -140,13 +147,35 @@ export declare function normalizeRunnerName(raw: string): string;
  * live claim owns), reclaims, and rotates. Two racers serialize: one wins,
  * the other gets the typed refusal.
  */
-export declare function registerRunnerIfIdle(store: Store, options: RegisterOptions): (Registration & {
+export declare function registerRunnerIfIdle(store: Store, options: RegisterOptions & {
+    /**
+     * Whether the name's current holder is proved gone (runner-process.ts): every process it handed its credential to
+     * has exited, verified by identity. Asked only while the holder still blocks the name, inside this transaction;
+     * a proof retires that holder and lapses its watch leases here, so a stale heartbeat never outlives its processes.
+     */
+    previousGone?: (holder: {
+        runner: Runner;
+        credentialHash: string;
+    }) => {
+        gone: true;
+        detail: string;
+    } | {
+        gone: false;
+        why: string;
+    };
+}): (Registration & {
     ok: true;
     recoveredRuns: number;
+    signedOff: string | null;
 }) | {
     ok: false;
     reason: "runner-alive" | "watch-live";
     detail: string;
+} | {
+    ok: false;
+    reason: "runner-draining";
+    detail: string;
+    until: string;
 };
 /**
  * The authenticated lease door (arc 2 findings 15/26): credential verified
@@ -280,3 +309,16 @@ export declare function reportProviderReadinessAuthed(store: Store, args: {
     token: string;
     observations: readonly Omit<ReadinessObservation, "runner" | "observedAt">[];
 }, now: Date): AuthResult;
+/** A worker's lifecycle row (service_lifecycle). */
+export declare const workerComponent: (name: string) => string;
+/**
+ * The stop begins (durable-actors' draining report), fenced by this holder's credential: from now this runner takes
+ * no new work (claim.ts acquire refuses). `until` is a schedule, never proof that the holder exited.
+ */
+export declare function drainRunnerIfCurrent(store: Store, name: string, token: string, now: Date, until: Date): boolean;
+/** A runner's drain as its own lifecycle row reports it (only the current registration's row counts): null when it
+ * isn't draining; ended once its bound passed or it reported stopped. */
+export declare function drainOf(store: Store, runner: Runner, now: Date): {
+    until: string;
+    ended: boolean;
+} | null;

package/dist/runner.js

@@ -19,12 +19,14 @@
  * again. Reaping on the second tells you a *machine* is gone, and everything
  * it was holding — claims and worktrees alike — needs recovering together.
  */
+import { mintSecret } from "./secret-mint.js";
 import { isAcpProvider } from "./acp-agents.js";
 import { verifyLaunch } from "./acp-attest.js";
 import { inspectAcpAgent, inspectionWords } from "./acp-inspect.js";
 import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
 import { resolve } from "node:path";
 import { canonicalProject } from "./project.js";
+import { lifecycleOf, reportLifecycle } from "./store.js";
 import { ALL_CREDENTIAL_ENV, PROVIDER_IDS, inspectionOf } from "./provider.js";
 import { attestationOf, versionInRange } from "./attest.js";
 /** A runner's repo binding, in the same canonical form task filing uses —
@@ -38,11 +40,18 @@ export const RUNNER_TOKEN_MS = 365 * 86_400_000;
 /**
  * How long a runner may go quiet before it is presumed gone.
  *
- * Comfortably more than any sensible heartbeat interval: declaring a busy
- * machine dead because one check-in was slow costs more than waiting another
- * minute for a machine that really is.
+ * Four heartbeats (RUNNER_HEARTBEAT_MS): one slow check-in never declares a busy
+ * machine dead, and a machine that really is gone holds its name for a minute,
+ * not three (docs/plans/actors-lessons.md). A clean stop doesn't wait even that
+ * long: a draining or stopped holder never blocks the next start
+ * (registerRunnerIfIdle).
  */
-export const DEFAULT_LIVENESS_MS = 3 * 60_000;
+export const DEFAULT_LIVENESS_MS = 60_000;
+/** How often a live runner says so: `up`'s runner heartbeat and every watch lease renewal. */
+export const RUNNER_HEARTBEAT_MS = 15_000;
+/** The longest a watch lease may be taken or renewed for (durable-actors' MAX_HOST_LEASE_DURATION_MS): a crashed
+ * holder's projects are free within a minute. The store clamps every ttl to it. */
+export { MAX_WATCH_LEASE_MS } from "./store.js";
 export function register(store, options) {
     const { name, host, capacity = 1, repos = [], agents = [], now, newToken = mintToken, mutation = {}, } = options;
     const token = newToken();
@@ -77,6 +86,9 @@ export function register(store, options) {
     // Doing it from the `previous` snapshot above is racy: two registrars can
     // read the same predecessor and otherwise mint the same generation.
     const runner = store.saveRunner(proposed, hashToken(token), mutation);
+    // v137: this registration is started; its lifecycle row is bound to it by registered_at, so an earlier holder's
+    // drain or stop never describes it.
+    reportLifecycle(store, workerComponent(name), "started", runner.registeredAt, now);
     return {
         runner,
         token,
@@ -203,9 +215,30 @@ export function normalizeRunnerName(raw) {
  * the other gets the typed refusal.
  */
 export function registerRunnerIfIdle(store, options) {
-    const { name, now } = options;
+    const { name, now, previousGone, ...registration } = options;
     return store.transact(() => {
-        const existing = store.getRunner(name);
+        let existing = store.getRunner(name);
+        // The protection against two live holders stands: only a holder whose every process is proved gone, or whose own
+        // drain has ended (its stop bound passed, or it reported stopped), is signed off.
+        let signedOff = null;
+        const blocked = existing !== null && ((existing.runner.retiredAt === null && isAlive(existing.runner, now)) || store.liveWatchLeaseOf(name, now) !== null);
+        const drain = existing === null ? null : drainOf(store, existing.runner, now);
+        // A scheduled drain deadline is not proof that its timer ran or its children exited.
+        if (blocked && existing !== null && previousGone !== undefined) {
+            const proof = previousGone(existing);
+            if (proof.gone) {
+                store.retireRunner(name, now);
+                store.expireWatchLeasesOf(name, now);
+                store.recordAction({ at: now.toISOString(), actor: "toolroll up", repo: null, taskId: null, runId: null,
+                    action: "worker signed off", outcome: "processes proved gone", source: "policy", detail: proof.detail });
+                signedOff = proof.detail;
+                existing = store.getRunner(name);
+            }
+        }
+        // A live draining holder remains exclusive even if its advertised deadline has passed.
+        if (existing !== null && drain !== null && (isAlive(existing.runner, now) || store.liveWatchLeaseOf(name, now) !== null)) {
+            return { ok: false, reason: "runner-draining", until: drain.until, detail: `Toolroll is restarting (draining): ${name} is still stopping (scheduled by ${drain.until})` };
+        }
         if (existing !== null && existing.runner.retiredAt === null && isAlive(existing.runner, now)) {
             return {
                 ok: false,
@@ -226,8 +259,8 @@ export function registerRunnerIfIdle(store, options) {
         // otherwise hide it from every later recovery.
         const recoveredRuns = existing === null ? 0 : store.recoverRunnerWork(name, now).runs.length;
         // A restart keeps the capacity an operator set; only an explicit one changes it.
-        const registration = register(store, { ...options, capacity: options.capacity ?? existing?.runner.capacity ?? 1 });
-        return { ok: true, ...registration, recoveredRuns };
+        const registered = register(store, { ...registration, name, now, capacity: options.capacity ?? existing?.runner.capacity ?? 1 });
+        return { ok: true, ...registered, recoveredRuns, signedOff };
     });
 }
 /**
@@ -281,6 +314,10 @@ export function retireRunnerIfCurrent(store, name, token, now) {
         if (!auth.ok)
             return { ok: false, reason: auth.reason };
         store.retireRunner(name, now);
+        // Stopped is retired: its leases lapse now, so the next start or watch takes its projects over (recovering whatever
+        // this incarnation left) without waiting for them to run out.
+        store.expireWatchLeasesOf(name, now);
+        reportLifecycle(store, workerComponent(name), "stopped", auth.runner.registeredAt, now);
         return { ok: true };
     });
 }
@@ -352,7 +389,7 @@ export function recoverDead(store, now, livenessMs = DEFAULT_LIVENESS_MS) {
 }
 /** 32 bytes of randomness, urlsafe, so it survives being pasted anywhere. */
 function mintToken() {
-    return randomBytes(32).toString("base64url");
+    return mintSecret(32);
 }
 export function hashToken(token) {
     return createHash("sha256").update(token, "utf8").digest("hex");
@@ -434,3 +471,30 @@ export function reportProviderReadinessAuthed(store, args, now) {
         return auth;
     });
 }
+// ---- v137 lifecycle (docs/plans/actors-lessons.md): last in the file, so the reviewed function positions stay ----
+/** A worker's lifecycle row (service_lifecycle). */
+export const workerComponent = (name) => `worker:${name}`;
+/**
+ * The stop begins (durable-actors' draining report), fenced by this holder's credential: from now this runner takes
+ * no new work (claim.ts acquire refuses). `until` is a schedule, never proof that the holder exited.
+ */
+export function drainRunnerIfCurrent(store, name, token, now, until) {
+    return store.transact(() => {
+        const auth = authenticate(store, name, token);
+        if (!auth.ok)
+            return false;
+        return reportLifecycle(store, workerComponent(name), "draining", auth.runner.registeredAt, now, { drainUntil: until });
+    });
+}
+/** A runner's drain as its own lifecycle row reports it (only the current registration's row counts): null when it
+ * isn't draining; ended once its bound passed or it reported stopped. */
+export function drainOf(store, runner, now) {
+    const row = lifecycleOf(store, workerComponent(runner.name));
+    if (row === null || row.holder !== runner.registeredAt)
+        return null;
+    if (row.state === "stopped")
+        return { until: row.changedAt, ended: true };
+    if (row.state !== "draining" || row.drainUntil === null)
+        return null;
+    return { until: row.drainUntil, ended: Date.parse(row.drainUntil) <= now.getTime() };
+}

package/dist/sandbox-runtime.d.ts

@@ -63,6 +63,14 @@ export declare const SEATBELT_NO_OTHER_TERMINAL: string;
  * any program read them (anthropics/sandbox-runtime#755). Build agents keep it (Claude Code signs in from the keychain).
  */
 export declare const SEATBELT_NO_KEYCHAIN: string;
+/**
+ * First after the profile's default deny: a mach service lookup the profile doesn't allow is still denied, unreported.
+ * On macOS 26.5 a reported mach-lookup denial now and then never answers: bootstrap_look_up blocks in launchd for good
+ * (seen as npm stuck in Node's DNS setup, dns_configuration_copy → com.apple.SystemConfiguration.DNSConfiguration, about
+ * 1 launch in 70 under load; never with the report off). Every allow after it still wins, so what is reachable is the
+ * same; only the report goes.
+ */
+export declare const SEATBELT_QUIET_MACH_DENY = "(deny mach-lookup (with no-report))";
 /**
  * Chromium, a project check's launch only: Playwright's default browser (its Chromium headless shell) registers its
  * port rendezvous service as org.chromium.Chromium.MachPortRendezvousServer.<its pid> at start, and its helpers look

package/dist/sandbox-runtime.js

@@ -122,8 +122,16 @@ export const SEATBELT_NO_OTHER_TERMINAL = [
  */
 export const SEATBELT_NO_KEYCHAIN = [
     "; Toolroll: no keychain",
-    "(deny mach-lookup (global-name \"com.apple.SecurityServer\") (global-name \"com.apple.securityd.xpc\"))",
+    "(deny mach-lookup (with no-report) (global-name \"com.apple.SecurityServer\") (global-name \"com.apple.securityd.xpc\"))",
 ].join("\n");
+/**
+ * First after the profile's default deny: a mach service lookup the profile doesn't allow is still denied, unreported.
+ * On macOS 26.5 a reported mach-lookup denial now and then never answers: bootstrap_look_up blocks in launchd for good
+ * (seen as npm stuck in Node's DNS setup, dns_configuration_copy → com.apple.SystemConfiguration.DNSConfiguration, about
+ * 1 launch in 70 under load; never with the report off). Every allow after it still wins, so what is reachable is the
+ * same; only the report goes.
+ */
+export const SEATBELT_QUIET_MACH_DENY = "(deny mach-lookup (with no-report))";
 /**
  * Chromium, a project check's launch only: Playwright's default browser (its Chromium headless shell) registers its
  * port rendezvous service as org.chromium.Chromium.MachPortRendezvousServer.<its pid> at start, and its helpers look
@@ -226,11 +234,15 @@ export function withSeatbeltRules(command, rules, expected) {
     const profile = words[exec + 2];
     if (!profile.startsWith("(version 1)\n(deny default"))
         throw shape();
+    // Where the default deny's line ends (the profile's end when it is the last line).
+    const lineEnd = profile.indexOf("\n", "(version 1)\n".length);
+    const opening = lineEnd < 0 ? profile.length : lineEnd;
     if (!/^\/[A-Za-z0-9_./-]+$/.test(words[exec + 3]))
         throw shape();
     if (expected !== undefined && words[exec + 5] !== expected)
         throw shape();
-    return srtQuote([...words.slice(0, exec + 2), `${profile}\n${rules}\n`, ...words.slice(exec + 3)]);
+    const quiet = `${profile.slice(0, opening)}\n${SEATBELT_QUIET_MACH_DENY}${profile.slice(opening)}`;
+    return srtQuote([...words.slice(0, exec + 2), `${quiet}\n${rules}\n`, ...words.slice(exec + 3)]);
 }
 /** The runtime's macOS invocation for `file args` run from `cwd`: a command line for /bin/sh. */
 export function srtMacosCommand(file, args, terms, cwd = process.cwd(), temp) {