toolroll 0.9.77 → 0.9.78

package/dist/store.d.ts

@@ -26,7 +26,7 @@ import type { Scope } from "./scope.js";
 import type { QualityMode } from "./quality.js";
 import type { ProgressSnapshot } from "./plan.js";
 import { type CheckProgressSnapshot } from "./check-progress.js";
-import { type ReleaseTerms } from "./contracts/release-terms.js";
+import { type ReleaseCheckPurpose, type ReleaseTerms } from "./contracts/release-terms.js";
 import { type ProjectAccess } from "./project-access.js";
 import { type LedgerEntry } from "./action-ledger.js";
 import type { LimitReading, LimitWindow } from "./provider-limits.js";
@@ -106,6 +106,10 @@ export declare const LIVE_STEER_SCHEMA = "\nCREATE TABLE IF NOT EXISTS run_pause
 /** v136: a run's own "Show commands in the live view" answer, captured once before its live file opens (live-detail.ts).
  * Absent, unreadable or anything but 1 means off. */
 export declare const RUN_LIVE_DETAIL_SCHEMA = "\nCREATE TABLE IF NOT EXISTS run_live_detail (\n  run         INTEGER PRIMARY KEY REFERENCES run(id) ON DELETE CASCADE,\n  commands    INTEGER NOT NULL CHECK (commands IN (0,1)),\n  captured_at TEXT NOT NULL\n);\n-- The Agents view's Live grid (docs/plans/agents-view.md \u00A72.5): every role's running runs and its recently ended ones.\n-- (id > 0 keeps them to the grid's own query, which names it: no other query's plan is offered them.)\nCREATE INDEX IF NOT EXISTS run_live_open ON run (id) WHERE outcome IS NULL AND id > 0;\nCREATE INDEX IF NOT EXISTS run_live_recent ON run (finished_at) WHERE outcome IS NOT NULL AND id > 0;\n";
+/** v137 (docs/plans/actors-lessons.md): explicit lifecycle, latency timelines and the continuous database copy. New
+ * tables only. A lifecycle row's `holder` binds it to one registration (a worker's registered_at) or one console
+ * process; a row whose holder no longer matches says nothing. Timelines are bounded and pruned as they are written. */
+export declare const V137_SCHEMA = "\nCREATE TABLE IF NOT EXISTS service_lifecycle (\n  component   TEXT PRIMARY KEY,\n  state       TEXT NOT NULL CHECK (state IN ('started','draining','stopped')),\n  holder      TEXT NOT NULL,\n  pid         INTEGER,\n  changed_at  TEXT NOT NULL,\n  beat_at     TEXT NOT NULL,\n  drain_until TEXT\n);\nCREATE TABLE IF NOT EXISTS latency_timeline (\n  id              INTEGER PRIMARY KEY AUTOINCREMENT,\n  kind            TEXT NOT NULL CHECK (kind IN ('console','release-check','deploy')),\n  subject         TEXT NOT NULL,\n  task_id         TEXT,\n  run_id          INTEGER,\n  started_at      TEXT NOT NULL,\n  total_ms        INTEGER NOT NULL,\n  milestones_json TEXT NOT NULL\n);\nCREATE INDEX IF NOT EXISTS latency_timeline_by_kind ON latency_timeline (kind, id);\nCREATE INDEX IF NOT EXISTS latency_timeline_by_run ON latency_timeline (run_id) WHERE run_id IS NOT NULL;\nCREATE INDEX IF NOT EXISTS latency_timeline_by_task ON latency_timeline (task_id) WHERE task_id IS NOT NULL;\nCREATE TABLE IF NOT EXISTS live_backup (\n  id            INTEGER PRIMARY KEY CHECK (id = 1),\n  enabled       INTEGER NOT NULL DEFAULT 1,\n  every_minutes INTEGER NOT NULL DEFAULT 5,\n  keep          INTEGER NOT NULL DEFAULT 24,\n  folder        TEXT,\n  holder        TEXT,\n  held_until    TEXT,\n  latest_file   TEXT,\n  latest_sha256 TEXT,\n  latest_at     TEXT,\n  latest_schema INTEGER,\n  latest_bytes  INTEGER,\n  tried_at      TEXT,\n  problem       TEXT\n);\n";
 /** A project's "Show commands in the live view" (live-detail.ts): absent means off. */
 export declare const LIVE_DETAIL_SCHEMA = "\nCREATE TABLE IF NOT EXISTS live_detail_setting (\n  repo       TEXT PRIMARY KEY,\n  commands   INTEGER NOT NULL CHECK (commands IN (0,1)),\n  updated_by TEXT NOT NULL,\n  updated_at TEXT NOT NULL\n);\n-- Every run a steering note reached, kept as it happens (live-notes.ts): a\n-- note's own attached/mailed fields move to the next attempt, this does not.\nCREATE TABLE IF NOT EXISTS steer_note_run (\n  note INTEGER NOT NULL REFERENCES task_steer(id) ON DELETE CASCADE,\n  run  INTEGER NOT NULL REFERENCES run(id) ON DELETE CASCADE,\n  how  TEXT NOT NULL CHECK (how IN ('attached','mailed','read')),\n  at   TEXT NOT NULL,\n  PRIMARY KEY (note, run, how)\n);\nCREATE INDEX IF NOT EXISTS steer_note_run_by_run ON steer_note_run (run, note);\n";
 export declare const CHAT_APPROVAL_SCHEMA = "\nCREATE TABLE IF NOT EXISTS chat_approval_setting (\n  approver             TEXT NOT NULL,\n  scope                TEXT NOT NULL,\n  enabled              INTEGER NOT NULL CHECK (enabled IN (0,1)),\n  full_access          INTEGER NOT NULL DEFAULT 0 CHECK (full_access IN (0,1)),\n  attempt_cap_microusd INTEGER CHECK (attempt_cap_microusd IS NULL OR attempt_cap_microusd >= 0),\n  generation           INTEGER NOT NULL,\n  digest               TEXT NOT NULL,\n  updated_by           TEXT NOT NULL,\n  updated_at           TEXT NOT NULL,\n  PRIMARY KEY (approver, scope)\n);\n";
@@ -186,7 +190,7 @@ export type SealedLedgerEntry = LedgerEntry & {
         hash: string;
     } | null;
 };
-export declare const SCHEMA_VERSION = 136;
+export declare const SCHEMA_VERSION = 138;
 /** v118: the tables merged into `credential`, in the order they move (a person's API tokens keep their ids first). */
 export declare const V118_MERGED_TABLES: Readonly<Record<string, CredentialKind>>;
 /**
@@ -331,6 +335,12 @@ export declare const V135_ADDED_COLUMNS: Readonly<Record<string, Readonly<Record
     definition: string;
     saved: string;
 }>>>>;
+/** v138 (docs/plans/pipeline-speed.md, P0): a scope's release check purpose, part of its digest when present. Saved
+ * rows read NULL. */
+export declare const V138_ADDED_COLUMNS: Readonly<Record<string, Readonly<Record<string, {
+    definition: string;
+    saved: string;
+}>>>>;
 /**
  * v135: one approval per release (docs/plans/release-once.md). `release_authority` is the single source of truth for a
  * release a person approved: one row per generation, changed only by compare-and-swap on `rev`, with a lease whose
@@ -2339,6 +2349,8 @@ export declare class Store {
         proposedVia?: ScopeAuthor | null;
         /** v135: release terms (release-once.md); undefined keeps the ones the scope carries, null removes them. */
         releaseTerms?: ReleaseTerms | null;
+        /** v138: a release check's purpose; undefined keeps the scope's, null removes it. Never beside terms. */
+        releaseCheck?: ReleaseCheckPurpose | null;
     }): void;
     /**
      * Re-file a scope under its OWN current words (v47): the route is
@@ -6600,6 +6612,9 @@ export declare class Store {
     };
     heartbeatWatchLease(runner: string, repo: string, owner: string, ttlMs: number, now: Date): boolean;
     releaseWatchLease(runner: string, repo: string, owner: string, now: Date): void;
+    /** Lapse every watch lease a runner holds now: its holder was proved gone (runner.ts registerRunnerIfIdle). The rows
+     * stay, so the next acquire takes them over and recovers the superseded incarnation as after any crash. */
+    expireWatchLeasesOf(runner: string, now: Date): number;
     /** The first still-unexpired watch lease this runner holds, if any (arc 2:
      * the takeover door refuses while one exists). */
     liveWatchLeaseOf(runner: string, now: Date): {
@@ -7790,3 +7805,111 @@ export declare function predecessorWatches(store: Store, runner: string, now: Da
     repo: string;
     owner: string;
 }[];
+/** The longest a watch lease is taken or renewed for (durable-actors' MAX_HOST_LEASE_DURATION_MS). */
+export declare const MAX_WATCH_LEASE_MS = 60000;
+/** A service component's lifecycle (durable-actors' host lifecycle reports): started, then heartbeats, then draining
+ * (no new admission; its own drain ends by drain_until), then stopped (retired). */
+export type LifecycleState = "started" | "draining" | "stopped";
+export type LifecycleRow = {
+    component: string;
+    state: LifecycleState;
+    holder: string;
+    pid: number | null;
+    changedAt: string;
+    beatAt: string;
+    drainUntil: string | null;
+};
+/** One component's lifecycle row, or null (never reported: a component from before v137 says nothing). */
+export declare function lifecycleOf(store: Store, component: string): LifecycleRow | null;
+/** Every reported component, by name. */
+export declare function lifecycles(store: Store): LifecycleRow[];
+/**
+ * Report a component's state. `started` replaces whatever an earlier holder left; `draining` and `stopped` only move the
+ * current holder's row (a stale process can't mark its successor draining), and never back from stopped. Returns
+ * whether the row now says what was asked.
+ */
+export declare function reportLifecycle(store: Store, component: string, state: LifecycleState, holder: string, now: Date, extra?: {
+    pid?: number | null;
+    drainUntil?: Date | null;
+}): boolean;
+/** The short heartbeat: the current holder's row, while it is not stopped. False means another holder took it. */
+export declare function beatLifecycle(store: Store, component: string, holder: string, now: Date): boolean;
+/** A milestone in a latency timeline: what happened, how long after the operation began (ms), and an optional short
+ * reason. Never a secret: route ids, phase and part names, fixed reason words. */
+export type Milestone = {
+    name: string;
+    ms: number;
+    detail?: string;
+};
+export type LatencyKind = "console" | "release-check" | "deploy";
+export type LatencyTimeline = {
+    id: number;
+    kind: LatencyKind;
+    subject: string;
+    taskId: string | null;
+    runId: number | null;
+    startedAt: string;
+    totalMs: number;
+    milestones: Milestone[];
+};
+/** At most this many milestones per timeline (the rest are dropped, the last kept), and timelines kept per kind. */
+export declare const MAX_MILESTONES = 40;
+export declare const TIMELINES_KEPT = 200;
+/** Timelines older than this go whatever their count. */
+export declare const TIMELINE_DAYS = 14;
+/** Milestones made safe to keep: bounded in number and length, offsets whole non-negative milliseconds, in order. */
+export declare function boundedMilestones(milestones: readonly Milestone[]): Milestone[];
+/** Keep one timeline, then prune its kind to the newest TIMELINES_KEPT within TIMELINE_DAYS. */
+export declare function recordLatencyTimeline(store: Store, entry: {
+    kind: LatencyKind;
+    subject: string;
+    taskId?: string | null;
+    runId?: number | null;
+    startedAt: Date;
+    totalMs: number;
+    milestones: readonly Milestone[];
+}, now: Date): number;
+/** Timelines, newest first: of one kind, one run's, or one task's. A row that doesn't read is left out. */
+export declare function latencyTimelines(store: Store, filter: {
+    kind?: LatencyKind;
+    runId?: number;
+    taskId?: string;
+    limit?: number;
+}): LatencyTimeline[];
+/** The continuous copy (live-backup.ts): how often, how many, where (null: `backups/live` beside the database). */
+export type LiveBackupSettings = {
+    enabled: boolean;
+    everyMinutes: number;
+    keep: number;
+    folder: string | null;
+};
+export declare const DEFAULT_LIVE_BACKUP: LiveBackupSettings;
+/** The latest copy that passed its integrity check, as it was when it was made. */
+export type LiveBackupCopy = {
+    file: string;
+    sha256: string;
+    madeAt: string;
+    schemaVersion: number;
+    bytes: number;
+};
+export type LiveBackupState = {
+    settings: LiveBackupSettings;
+    latest: LiveBackupCopy | null;
+    triedAt: string | null;
+    problem: string | null;
+};
+export declare function liveBackupState(store: Store): LiveBackupState;
+/** Change the continuous copy's settings; the ledger keeps before → after. A new folder forgets the latest copy (it is
+ * in the old one). */
+export declare function setLiveBackupSettings(store: Store, next: LiveBackupSettings, by: string, now: Date): LiveBackupSettings;
+/** Take (or keep) the continuous copy's lease until `until`: one process copies at a time. */
+export declare function holdLiveBackup(store: Store, holder: string, now: Date, until: Date): boolean;
+export declare function releaseLiveBackup(store: Store, holder: string): void;
+/** A copy's outcome: a verified copy becomes the latest; a failure is kept as the problem (the latest stays). */
+export declare function recordLiveBackup(store: Store, outcome: {
+    ok: true;
+    copy: LiveBackupCopy;
+} | {
+    ok: false;
+    problem: string;
+}, now: Date): void;

package/dist/store.js

@@ -85,7 +85,7 @@ import { authenticate as runnerAuthenticate } from "./runner.js";
 import { stampNewProjectLevel } from "./check-levels.js";
 import { parseCheckProgressSnapshot } from "./check-progress.js";
 import { authorityStandsSql } from "./approval-authority.js";
-import { releasePolicyDigest, storedReleaseTerms, readReleaseTerms, readReleasePolicy } from "./contracts/release-terms.js";
+import { releasePolicyDigest, serializeReleaseCheckPurpose, storedReleaseCheckPurpose, storedReleaseTerms, readReleaseTerms, readReleasePolicy } from "./contracts/release-terms.js";
 import { accountReachesSql, normalizeProjectAccess, projectAccessAllows, readProjectAccess } from "./project-access.js";
 import { LEDGER_COLUMNS, LEDGER_SCHEMA, LEDGER_TABLE, LEDGER_V99_TABLE, installLedgerTriggers } from "./action-ledger.js";
 import { PLAN_AUTO_SCHEMA } from "./plan-auto.js";
@@ -459,6 +459,49 @@ CREATE TABLE IF NOT EXISTS run_live_detail (
 CREATE INDEX IF NOT EXISTS run_live_open ON run (id) WHERE outcome IS NULL AND id > 0;
 CREATE INDEX IF NOT EXISTS run_live_recent ON run (finished_at) WHERE outcome IS NOT NULL AND id > 0;
 `;
+/** v137 (docs/plans/actors-lessons.md): explicit lifecycle, latency timelines and the continuous database copy. New
+ * tables only. A lifecycle row's `holder` binds it to one registration (a worker's registered_at) or one console
+ * process; a row whose holder no longer matches says nothing. Timelines are bounded and pruned as they are written. */
+export const V137_SCHEMA = `
+CREATE TABLE IF NOT EXISTS service_lifecycle (
+  component   TEXT PRIMARY KEY,
+  state       TEXT NOT NULL CHECK (state IN ('started','draining','stopped')),
+  holder      TEXT NOT NULL,
+  pid         INTEGER,
+  changed_at  TEXT NOT NULL,
+  beat_at     TEXT NOT NULL,
+  drain_until TEXT
+);
+CREATE TABLE IF NOT EXISTS latency_timeline (
+  id              INTEGER PRIMARY KEY AUTOINCREMENT,
+  kind            TEXT NOT NULL CHECK (kind IN ('console','release-check','deploy')),
+  subject         TEXT NOT NULL,
+  task_id         TEXT,
+  run_id          INTEGER,
+  started_at      TEXT NOT NULL,
+  total_ms        INTEGER NOT NULL,
+  milestones_json TEXT NOT NULL
+);
+CREATE INDEX IF NOT EXISTS latency_timeline_by_kind ON latency_timeline (kind, id);
+CREATE INDEX IF NOT EXISTS latency_timeline_by_run ON latency_timeline (run_id) WHERE run_id IS NOT NULL;
+CREATE INDEX IF NOT EXISTS latency_timeline_by_task ON latency_timeline (task_id) WHERE task_id IS NOT NULL;
+CREATE TABLE IF NOT EXISTS live_backup (
+  id            INTEGER PRIMARY KEY CHECK (id = 1),
+  enabled       INTEGER NOT NULL DEFAULT 1,
+  every_minutes INTEGER NOT NULL DEFAULT 5,
+  keep          INTEGER NOT NULL DEFAULT 24,
+  folder        TEXT,
+  holder        TEXT,
+  held_until    TEXT,
+  latest_file   TEXT,
+  latest_sha256 TEXT,
+  latest_at     TEXT,
+  latest_schema INTEGER,
+  latest_bytes  INTEGER,
+  tried_at      TEXT,
+  problem       TEXT
+);
+`;
 /** A project's "Show commands in the live view" (live-detail.ts): absent means off. */
 export const LIVE_DETAIL_SCHEMA = `
 CREATE TABLE IF NOT EXISTS live_detail_setting (
@@ -756,7 +799,14 @@ const REGISTERED_AT_FILING = "again, as it was filed";
 // v136 adds, and changes no saved row: each run's own "Show commands in the live view" answer, captured once before its
 // live file opens (run_live_detail; docs/plans/agents-view.md §2.4). Saved runs have none, which every reader takes as
 // commands off: permission is never recovered from a transcript or the project's current setting.
-export const SCHEMA_VERSION = 136;
+// v137 adds, and changes no saved row (docs/plans/actors-lessons.md): each service component's lifecycle
+// (service_lifecycle: started, draining or stopped, with a short heartbeat), bounded per-operation latency timelines
+// (latency_timeline: slow console requests, release check parts, deploy phases) and the continuous database copy's
+// settings and latest verified copy (live_backup, one row; absent reads every 5 minutes, keep 24, beside the database).
+// v138 adds, and changes no saved row: a release check's purpose (task_scope.release_check_json; docs/plans/
+// pipeline-speed.md, P0) — this exact candidate is a release's check, for a release that can't carry. Saved rows read
+// NULL: no purpose (a termsless release task stays exactly as it was approved).
+export const SCHEMA_VERSION = 138;
 /** v118: the tables merged into `credential`, in the order they move (a person's API tokens keep their ids first). */
 export const V118_MERGED_TABLES = Object.freeze({ api_token: "person", coordinator_credential: "coordinator", lead_credential: "lead" });
 /** The foreign keys that named a merged table, exactly as their DDL wrote them; each names `credential(id)` instead. */
@@ -889,7 +939,7 @@ const V115_DROPPED_REFERENCES = /\s+REFERENCES (?:contestant|contest|tournament_
  * unchanged), and adds the nullable column in V125_ADDED_COLUMNS, checked the same way. v126 only adds a new table
  * (task_source) and the columns in V126_ADDED_COLUMNS (null or 0), checked the same way.
  */
-export const UPDATE_SAFE_MIGRATIONS = Object.freeze([108, 109, 110, 111, 112, 113, 114, 115, 116, 117, 118, 119, 120, 121, 122, 123, 124, 125, 126, 127, 128, 129, 130, 131, 132, 133, 134, 135, 136]);
+export const UPDATE_SAFE_MIGRATIONS = Object.freeze([108, 109, 110, 111, 112, 113, 114, 115, 116, 117, 118, 119, 120, 121, 122, 123, 124, 125, 126, 127, 128, 129, 130, 131, 132, 133, 134, 135, 136, 137, 138]);
 /** v119: the columns it adds, by table, with the value every row saved before it reads (toolroll-update's HISTORY_RULES). */
 export const V119_ADDED_COLUMNS = Object.freeze({
     task_ref: { planning_generation: { definition: "INTEGER NOT NULL DEFAULT 0", saved: "0" } },
@@ -1010,6 +1060,11 @@ export const V134_ADDED_COLUMNS = Object.freeze({
 export const V135_ADDED_COLUMNS = Object.freeze({
     task_scope: { release_terms_json: { definition: "TEXT", saved: "NULL" } },
 });
+/** v138 (docs/plans/pipeline-speed.md, P0): a scope's release check purpose, part of its digest when present. Saved
+ * rows read NULL. */
+export const V138_ADDED_COLUMNS = Object.freeze({
+    task_scope: { release_check_json: { definition: "TEXT", saved: "NULL" } },
+});
 /**
  * v135: one approval per release (docs/plans/release-once.md). `release_authority` is the single source of truth for a
  * release a person approved: one row per generation, changed only by compare-and-swap on `rev`, with a lease whose
@@ -4240,6 +4295,13 @@ CREATE INDEX IF NOT EXISTS run_checkpoint_by_task ON run_checkpoint (task_ref, i
     }
     // v136: each run's own live-view answer (a new table only; saved runs have none: commands off).
     db.exec(RUN_LIVE_DETAIL_SCHEMA);
+    // v137: lifecycle, latency timelines and the continuous copy (new tables only).
+    db.exec(V137_SCHEMA);
+    // v138: a scope's release check purpose (V138_ADDED_COLUMNS: saved rows NULL, no purpose).
+    for (const [table, columns] of Object.entries(V138_ADDED_COLUMNS)) {
+        for (const [column, { definition }] of Object.entries(columns))
+            addColumn(db, table, column, definition);
+    }
     // Keep the epoch until reclamation succeeds, including a retry after compaction already committed. A new file has
     // nothing to reclaim.
     if (!fresh)
@@ -6669,7 +6731,7 @@ export class Store {
     saveScope(scope, mutation = {}, options = {}) {
         this.once(mutation, "saveScope", () => this.transact(() => {
             // The text's current author mark, read before this write (approval policy §1.4).
-            const prior = this.db.prepare("SELECT proposed_via, release_terms_json FROM task_scope WHERE task_id = ?").get(scope.taskId);
+            const prior = this.db.prepare("SELECT proposed_via, release_terms_json, release_check_json FROM task_scope WHERE task_id = ?").get(scope.taskId);
             // THE filing invariant (foundations findings 5/13/19): every scope
             // row leaves this method either RESOLVED (working profile stamped,
             // digest recomputed to bind it, version 2) or UNRESOLVED with its
@@ -6833,6 +6895,12 @@ export class Store {
             // v135: release terms the caller names, else the ones this scope already carries (a refile keeps them bound).
             const priorTerms = storedReleaseTerms(prior?.["release_terms_json"]);
             const releaseTerms = options.releaseTerms !== undefined ? options.releaseTerms : priorTerms.ok ? priorTerms.terms : null;
+            // v138: the release check purpose likewise; terms named now replace a kept purpose (a scope carries one or the other).
+            const priorPurpose = storedReleaseCheckPurpose(prior?.["release_check_json"]);
+            const releaseCheck = options.releaseCheck !== undefined ? options.releaseCheck
+                : options.releaseTerms != null ? null : priorPurpose.ok ? priorPurpose.purpose : null;
+            if (releaseTerms !== null && releaseCheck !== null)
+                throw new Error("A scope carries release terms or a release check purpose, never both.");
             const digestInput = {
                 goal: scope.goal,
                 outOfScope: scope.outOfScope,
@@ -6842,6 +6910,7 @@ export class Store {
                 qualityMode,
                 candidate: scope.candidate ?? null,
                 releaseTerms,
+                releaseCheck,
             };
             // EVERY route filed since v47 binds into the digest — routine-shaped
             // ones included — so approval freezes exactly which agent runs each
@@ -6871,8 +6940,8 @@ export class Store {
                 .prepare(`INSERT INTO task_scope
              (task_id, goal, out_of_scope, touches, budget_microusd, proposed_at, digest, approved_at, approved_by, approved_digest,
               profile_json, profile_state, unresolved_reason, digest_version, profile_provenance, proposed_chain_json, acceptance_json, quality_mode,
-              risk_level, proposed_route_json, route_era, candidate, release_terms_json)
-           VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+              risk_level, proposed_route_json, route_era, candidate, release_terms_json, release_check_json)
+           VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
            ON CONFLICT (task_id) DO UPDATE SET
              goal = excluded.goal, out_of_scope = excluded.out_of_scope,
              touches = excluded.touches, budget_microusd = excluded.budget_microusd,
@@ -6884,7 +6953,7 @@ export class Store {
              profile_provenance = excluded.profile_provenance, proposed_chain_json = excluded.proposed_chain_json,
              acceptance_json = excluded.acceptance_json, quality_mode = excluded.quality_mode,
              risk_level = excluded.risk_level, proposed_route_json = excluded.proposed_route_json, route_era = excluded.route_era,
-             candidate = excluded.candidate, release_terms_json = excluded.release_terms_json`)
+             candidate = excluded.candidate, release_terms_json = excluded.release_terms_json, release_check_json = excluded.release_check_json`)
                 .run(scope.taskId, scope.goal, scope.outOfScope, JSON.stringify(scope.touches), scope.budgetMicrousd ?? null, scope.proposedAt, boundDigest, scope.approvedAt, scope.approvedBy, scope.approvedDigest, profile === null ? null : canonicalProfileJson(profile), profile === null ? "unresolved" : "resolved", unresolvedReason, profile === null ? 1 : 2, provenance, 
             // Fallback chains (v30-v114) are gone: no filing names one.
             null, scope.acceptance.length === 0 ? null : JSON.stringify(scope.acceptance), qualityMode, 
@@ -6892,7 +6961,7 @@ export class Store {
             // routine risk, the value its signed terms always carried.
             "routine", route === null ? null : canonicalRouteJson(route), 
             // The durable era: every row this method writes is a routed row.
-            ROUTE_ERA, scope.candidate ?? null, releaseTerms === null ? null : serializeReleaseTerms(releaseTerms));
+            ROUTE_ERA, scope.candidate ?? null, releaseTerms === null ? null : serializeReleaseTerms(releaseTerms), releaseCheck === null ? null : serializeReleaseCheckPurpose(releaseCheck));
             // Who wrote THIS text (mate arc, ruling 2): set per write, so a human
             // rewrite clears the lead's mark and a mate rewrite sets it — but only a
             // person's write clears one (approval policy §1.4): the lead (its token)
@@ -7017,7 +7086,14 @@ export class Store {
             // A DEPLOY GATE FROM CHAT (chat-management.md §0a.5): a signed candidate or release terms seal from chat only
             // with the release card's evidence (its act and card digest), never through the plain plan card or a generic
             // one. Read from the raw row, so a terms column that doesn't parse is a deploy gate too.
-            const deployGate = (typeof working["candidate"] === "string" && working["candidate"] !== "") || working["release_terms_json"] != null;
+            const deployGate = (typeof working["candidate"] === "string" && working["candidate"] !== "") || working["release_terms_json"] != null || working["release_check_json"] != null;
+            // A RELEASE CHECK PURPOSE (v138) seals, like terms, only on a person's own yes: the ceremony or a paired-chat tap
+            // through the release card — never a mode, a grant, a carry or an automatic seal (those need terms).
+            const purpose = storedReleaseCheckPurpose(working["release_check_json"]);
+            if (!purpose.ok)
+                return false;
+            if (purpose.purpose !== null && basis !== undefined && basis.kind !== "chat")
+                return false;
             if (deployGate && basis?.kind === "chat" && !(basis.card === "release" && typeof basis.cardDigest === "string" && /^[0-9a-f]{64}$/.test(basis.cardDigest)))
                 return false;
             // AUTOMATIC RELEASE SEALS (auto-approve-green.md): only on a release task (a candidate and release terms signed
@@ -11652,7 +11728,7 @@ export class Store {
         if (route === null) {
             return { ok: false, reason: "unreadable", detail: scope.approvedRouteJson == null ? "the approval sealed no agent route — re-file the scope and approve it again" : "the approval's sealed agent route cannot be read — re-file the scope and approve it again" };
         }
-        const fields = { goal: scope.goal, outOfScope: scope.outOfScope, touches: scope.touches, budgetMicrousd: scope.budgetMicrousd, acceptance: scope.acceptance, candidate: scope.candidate ?? null, qualityMode: scope.qualityMode ?? "default", releaseTerms: scope.releaseTerms ?? null };
+        const fields = { goal: scope.goal, outOfScope: scope.outOfScope, touches: scope.touches, budgetMicrousd: scope.budgetMicrousd, acceptance: scope.acceptance, candidate: scope.candidate ?? null, qualityMode: scope.qualityMode ?? "default", releaseTerms: scope.releaseTerms ?? null, releaseCheck: scope.releaseCheck ?? null };
         const chain = scope.approvalKind === "chain" ? chainFromJson(scope.approvedChainJson ?? null) : null;
         const target = chain !== null ? { chain } : (scope.approvedProfile ?? null);
         if (target === null)
@@ -17508,7 +17584,8 @@ export class Store {
     acquireWatchLease(runner, repo, owner, ttlMs, now) {
         return this.transact(() => {
             const stamp = now.toISOString();
-            const expires = new Date(now.getTime() + ttlMs).toISOString();
+            // Never longer than MAX_WATCH_LEASE_MS, whatever a caller asks: a crashed holder's project is free within a minute.
+            const expires = new Date(now.getTime() + Math.min(ttlMs, MAX_WATCH_LEASE_MS)).toISOString();
             const row = this.db
                 .prepare("SELECT * FROM watch_lease WHERE runner = ? AND repo = ?")
                 .get(runner, repo);
@@ -17545,7 +17622,7 @@ export class Store {
         const { changes } = this.db
             .prepare(`UPDATE watch_lease SET expires_at = ?, heartbeat_at = ?
           WHERE runner = ? AND repo = ? AND owner = ? AND expires_at > ?`)
-            .run(new Date(now.getTime() + ttlMs).toISOString(), now.toISOString(), runner, repo, owner, now.toISOString());
+            .run(new Date(now.getTime() + Math.min(ttlMs, MAX_WATCH_LEASE_MS)).toISOString(), now.toISOString(), runner, repo, owner, now.toISOString());
         return Number(changes) > 0;
     }
     releaseWatchLease(runner, repo, owner, now) {
@@ -17553,6 +17630,12 @@ export class Store {
             .prepare("UPDATE watch_lease SET expires_at = ? WHERE runner = ? AND repo = ? AND owner = ?")
             .run(now.toISOString(), runner, repo, owner);
     }
+    /** Lapse every watch lease a runner holds now: its holder was proved gone (runner.ts registerRunnerIfIdle). The rows
+     * stay, so the next acquire takes them over and recovers the superseded incarnation as after any crash. */
+    expireWatchLeasesOf(runner, now) {
+        const stamp = now.toISOString();
+        return Number(this.db.prepare("UPDATE watch_lease SET expires_at = ? WHERE runner = ? AND expires_at > ?").run(stamp, runner, stamp).changes);
+    }
     /** The first still-unexpired watch lease this runner holds, if any (arc 2:
      * the takeover door refuses while one exists). */
     liveWatchLeaseOf(runner, now) {
@@ -20189,6 +20272,14 @@ export function scopeTermsProblem(row) {
         if (!terms.ok)
             return terms.problem;
     }
+    // v138: likewise the release check purpose, and never beside terms.
+    if ("release_check_json" in row) {
+        const purpose = storedReleaseCheckPurpose(row["release_check_json"]);
+        if (!purpose.ok)
+            return purpose.problem;
+        if (purpose.purpose !== null && row["release_terms_json"] != null)
+            return "the scope carries both release terms and a release check purpose";
+    }
     for (const column of ["approved_at", "approved_by", "approved_digest", "profile_json", "approved_profile_json", "proposed_chain_json", "approved_chain_json", "proposed_route_json", "approved_route_json", "unresolved_reason"]) {
         if (row[column] !== null && row[column] !== undefined && typeof row[column] !== "string")
             return `${column.replace(/_/g, " ")} is not stored as text`;
@@ -20234,6 +20325,7 @@ function readScope(row) {
         routeEra: row["route_era"] === null || row["route_era"] === undefined ? null : Number(row["route_era"]),
         candidate: typeof row["candidate"] === "string" && row["candidate"] !== "" ? row["candidate"] : null,
         releaseTerms: (() => { const read = storedReleaseTerms(row["release_terms_json"]); return read.ok ? read.terms : null; })(),
+        releaseCheck: (() => { const read = storedReleaseCheckPurpose(row["release_check_json"]); return read.ok ? read.purpose : null; })(),
         proposedVia: row["proposed_via"] === "mate" || row["proposed_via"] === "coordinator" || row["proposed_via"] === "scout" || row["proposed_via"] === "lead" ? row["proposed_via"] : null,
     };
 }
@@ -20882,3 +20974,149 @@ export function predecessorWatches(store, runner, now) {
           AND (c.released_at IS NULL OR EXISTS (SELECT 1 FROM run r WHERE r.lease_id = c.lease_id AND r.outcome IS NULL))))
       ORDER BY w.repo`).all(runner, now.toISOString()).map(row => ({ repo: String(row["repo"]), owner: String(row["owner"]) }));
 }
+// ---- v137: lifecycle, latency timelines, the continuous copy (docs/plans/actors-lessons.md) ----------------------
+/** The longest a watch lease is taken or renewed for (durable-actors' MAX_HOST_LEASE_DURATION_MS). */
+export const MAX_WATCH_LEASE_MS = 60_000;
+function lifecycleRowOf(row) {
+    return { component: String(row["component"]), state: String(row["state"]), holder: String(row["holder"]), pid: row["pid"] == null ? null : Number(row["pid"]),
+        changedAt: String(row["changed_at"]), beatAt: String(row["beat_at"]), drainUntil: row["drain_until"] == null ? null : String(row["drain_until"]) };
+}
+/** One component's lifecycle row, or null (never reported: a component from before v137 says nothing). */
+export function lifecycleOf(store, component) {
+    const row = store.handle.prepare("SELECT * FROM service_lifecycle WHERE component = ?").get(component);
+    return row === undefined ? null : lifecycleRowOf(row);
+}
+/** Every reported component, by name. */
+export function lifecycles(store) {
+    return store.handle.prepare("SELECT * FROM service_lifecycle ORDER BY component").all().map(lifecycleRowOf);
+}
+/**
+ * Report a component's state. `started` replaces whatever an earlier holder left; `draining` and `stopped` only move the
+ * current holder's row (a stale process can't mark its successor draining), and never back from stopped. Returns
+ * whether the row now says what was asked.
+ */
+export function reportLifecycle(store, component, state, holder, now, extra = {}) {
+    const stamp = now.toISOString();
+    const until = extra.drainUntil == null ? null : extra.drainUntil.toISOString();
+    if (state === "started") {
+        store.handle.prepare(`INSERT INTO service_lifecycle (component, state, holder, pid, changed_at, beat_at, drain_until) VALUES (?, 'started', ?, ?, ?, ?, NULL)
+      ON CONFLICT(component) DO UPDATE SET state = 'started', holder = excluded.holder, pid = excluded.pid, changed_at = excluded.changed_at, beat_at = excluded.beat_at, drain_until = NULL`)
+            .run(component, holder, extra.pid ?? null, stamp, stamp);
+        return true;
+    }
+    const changed = store.handle.prepare(`UPDATE service_lifecycle SET state = ?, changed_at = ?, beat_at = ?, drain_until = CASE WHEN ? = 'draining' THEN ? ELSE drain_until END
+    WHERE component = ? AND holder = ? AND state <> 'stopped'`).run(state, stamp, stamp, state, until, component, holder).changes;
+    return Number(changed) === 1;
+}
+/** The short heartbeat: the current holder's row, while it is not stopped. False means another holder took it. */
+export function beatLifecycle(store, component, holder, now) {
+    return Number(store.handle.prepare("UPDATE service_lifecycle SET beat_at = ? WHERE component = ? AND holder = ? AND state <> 'stopped'")
+        .run(now.toISOString(), component, holder).changes) === 1;
+}
+/** At most this many milestones per timeline (the rest are dropped, the last kept), and timelines kept per kind. */
+export const MAX_MILESTONES = 40;
+export const TIMELINES_KEPT = 200;
+/** Timelines older than this go whatever their count. */
+export const TIMELINE_DAYS = 14;
+const plainText = (value, max) => value.replace(/[\u0000-\u001f\u007f]+/g, " ").trim().slice(0, max);
+/** Milestones made safe to keep: bounded in number and length, offsets whole non-negative milliseconds, in order. */
+export function boundedMilestones(milestones) {
+    const clean = milestones.filter(one => typeof one.name === "string" && Number.isFinite(one.ms)).map(one => ({
+        name: plainText(one.name, 80), ms: Math.max(0, Math.round(one.ms)),
+        ...(typeof one.detail === "string" && one.detail.trim() !== "" ? { detail: plainText(one.detail, 160) } : {}),
+    })).filter(one => one.name !== "");
+    return clean.length <= MAX_MILESTONES ? clean : [...clean.slice(0, MAX_MILESTONES - 1), clean[clean.length - 1]];
+}
+/** Keep one timeline, then prune its kind to the newest TIMELINES_KEPT within TIMELINE_DAYS. */
+export function recordLatencyTimeline(store, entry, now) {
+    return store.transact(() => {
+        const id = Number(store.handle.prepare(`INSERT INTO latency_timeline (kind, subject, task_id, run_id, started_at, total_ms, milestones_json) VALUES (?, ?, ?, ?, ?, ?, ?)`)
+            .run(entry.kind, plainText(entry.subject, 120), entry.taskId ?? null, entry.runId ?? null, entry.startedAt.toISOString(), Math.max(0, Math.round(entry.totalMs)), JSON.stringify(boundedMilestones(entry.milestones))).lastInsertRowid);
+        const cutoff = new Date(now.getTime() - TIMELINE_DAYS * 86_400_000).toISOString();
+        store.handle.prepare(`DELETE FROM latency_timeline WHERE kind = ? AND (started_at < ? OR id <= (SELECT id FROM latency_timeline WHERE kind = ? ORDER BY id DESC LIMIT 1 OFFSET ?))`)
+            .run(entry.kind, cutoff, entry.kind, TIMELINES_KEPT);
+        return id;
+    });
+}
+/** Timelines, newest first: of one kind, one run's, or one task's. A row that doesn't read is left out. */
+export function latencyTimelines(store, filter) {
+    const where = [], args = [];
+    if (filter.kind !== undefined) {
+        where.push("kind = ?");
+        args.push(filter.kind);
+    }
+    if (filter.runId !== undefined && filter.taskId !== undefined) {
+        where.push("(run_id = ? OR task_id = ?)");
+        args.push(filter.runId, filter.taskId);
+    }
+    else if (filter.runId !== undefined) {
+        where.push("run_id = ?");
+        args.push(filter.runId);
+    }
+    else if (filter.taskId !== undefined) {
+        where.push("task_id = ?");
+        args.push(filter.taskId);
+    }
+    const rows = store.handle.prepare(`SELECT * FROM latency_timeline${where.length === 0 ? "" : ` WHERE ${where.join(" AND ")}`} ORDER BY id DESC LIMIT ?`).all(...args, Math.min(200, Math.max(1, filter.limit ?? 20)));
+    return rows.flatMap(row => {
+        let milestones;
+        try {
+            const parsed = JSON.parse(String(row["milestones_json"]));
+            milestones = Array.isArray(parsed) ? boundedMilestones(parsed) : [];
+        }
+        catch {
+            return [];
+        }
+        return [{ id: Number(row["id"]), kind: String(row["kind"]), subject: String(row["subject"]), taskId: row["task_id"] == null ? null : String(row["task_id"]),
+                runId: row["run_id"] == null ? null : Number(row["run_id"]), startedAt: String(row["started_at"]), totalMs: Number(row["total_ms"]), milestones }];
+    });
+}
+export const DEFAULT_LIVE_BACKUP = { enabled: true, everyMinutes: 5, keep: 24, folder: null };
+export function liveBackupState(store) {
+    const row = store.handle.prepare("SELECT * FROM live_backup WHERE id = 1").get();
+    if (row === undefined)
+        return { settings: { ...DEFAULT_LIVE_BACKUP }, latest: null, triedAt: null, problem: null };
+    const latest = row["latest_file"] == null || row["latest_sha256"] == null || row["latest_at"] == null || row["latest_schema"] == null ? null
+        : { file: String(row["latest_file"]), sha256: String(row["latest_sha256"]), madeAt: String(row["latest_at"]), schemaVersion: Number(row["latest_schema"]), bytes: Number(row["latest_bytes"] ?? 0) };
+    return { settings: { enabled: Number(row["enabled"]) === 1, everyMinutes: Number(row["every_minutes"]), keep: Number(row["keep"]), folder: row["folder"] == null ? null : String(row["folder"]) },
+        latest, triedAt: row["tried_at"] == null ? null : String(row["tried_at"]), problem: row["problem"] == null ? null : String(row["problem"]) };
+}
+const liveBackupWords = (one) => `${one.enabled ? `every ${one.everyMinutes} min` : "off"}, keep ${one.keep}, ${one.folder ?? "the default folder"}`;
+/** Change the continuous copy's settings; the ledger keeps before → after. A new folder forgets the latest copy (it is
+ * in the old one). */
+export function setLiveBackupSettings(store, next, by, now) {
+    return store.transact(() => {
+        const before = liveBackupState(store).settings;
+        store.handle.prepare(`INSERT INTO live_backup (id, enabled, every_minutes, keep, folder) VALUES (1, ?, ?, ?, ?)
+      ON CONFLICT(id) DO UPDATE SET enabled = excluded.enabled, every_minutes = excluded.every_minutes, keep = excluded.keep, folder = excluded.folder`)
+            .run(next.enabled ? 1 : 0, next.everyMinutes, next.keep, next.folder);
+        if (before.folder !== next.folder)
+            store.handle.prepare("UPDATE live_backup SET latest_file = NULL, latest_sha256 = NULL, latest_at = NULL, latest_schema = NULL, latest_bytes = NULL WHERE id = 1").run();
+        if (liveBackupWords(before) !== liveBackupWords(next)) {
+            store.recordAction({ at: now.toISOString(), actor: by, repo: null, taskId: null, runId: null, action: "continuous backup settings changed", outcome: "changed", source: "policy", detail: `${liveBackupWords(before)} → ${liveBackupWords(next)}` });
+        }
+        return liveBackupState(store).settings;
+    });
+}
+/** Take (or keep) the continuous copy's lease until `until`: one process copies at a time. */
+export function holdLiveBackup(store, holder, now, until) {
+    return store.transact(() => {
+        store.handle.prepare("INSERT OR IGNORE INTO live_backup (id) VALUES (1)").run();
+        return Number(store.handle.prepare("UPDATE live_backup SET holder = ?, held_until = ? WHERE id = 1 AND (holder IS NULL OR holder = ? OR held_until IS NULL OR held_until < ?)")
+            .run(holder, until.toISOString(), holder, now.toISOString()).changes) === 1;
+    });
+}
+export function releaseLiveBackup(store, holder) {
+    store.handle.prepare("UPDATE live_backup SET holder = NULL, held_until = NULL WHERE id = 1 AND holder = ?").run(holder);
+}
+/** A copy's outcome: a verified copy becomes the latest; a failure is kept as the problem (the latest stays). */
+export function recordLiveBackup(store, outcome, now) {
+    store.handle.prepare("INSERT OR IGNORE INTO live_backup (id) VALUES (1)").run();
+    if (outcome.ok) {
+        store.handle.prepare("UPDATE live_backup SET latest_file = ?, latest_sha256 = ?, latest_at = ?, latest_schema = ?, latest_bytes = ?, tried_at = ?, problem = NULL WHERE id = 1")
+            .run(outcome.copy.file, outcome.copy.sha256, outcome.copy.madeAt, outcome.copy.schemaVersion, outcome.copy.bytes, now.toISOString());
+    }
+    else {
+        store.handle.prepare("UPDATE live_backup SET tried_at = ?, problem = ? WHERE id = 1").run(now.toISOString(), plainText(outcome.problem, 300));
+    }
+}

package/dist/surface.js

@@ -110,7 +110,9 @@ const GUIDE_ROWS = [
             { name: "limit", takesValue: true, meaning: "<step>=<minutes>: one waiting step's time limit" },
             { name: "tap", takesValue: true, meaning: "the Homebrew tap, owner/name" },
             { name: "release-gate", takesValue: true, meaning: "<id>: show why an update pause left before a deployment's swap is safe to lift" },
-            { name: "yes", takesValue: false, meaning: "with --release-gate: lift that one pause once it is proved" }],
+            { name: "yes", takesValue: false, meaning: "with --release-gate: lift that one pause once it is proved; with --recover-deploy: recover" },
+            { name: "recover-deploy", takesValue: false, meaning: "put back a deployment that stopped half way: stop only its own proved leftovers, restart the previous service, lift the pause" },
+            { name: "stage", takesValue: true, meaning: "with --recover-deploy: the deployment's staging folder" }],
         notableReasons: ["usage", "ambiguous", "drift", "timeout", "check-failed", "ci-failed", "tree-mismatch", "conflict", "mixed-runtime", "gate-held", "after-swap"] },
     operator("demo", "a seeded throwaway sandbox"),
     ...KNOWLEDGE_DESCRIPTORS.map(spec => ({ invocation: `knowledge ${spec.action}`, synopsis: spec.synopsis, audience: "audience" in spec ? spec.audience : "agent", agentMayInvoke: !("audience" in spec), mutation: spec.mutation, flags: spec.flags, ...(spec.takesQuery ? { positionals: [{ name: "query", required: true, meaning: "search text or source file for impact" }] } : {}) })),

package/dist/teardown-git.js

@@ -364,7 +364,7 @@ function includeIn(path, gitFile = "git") {
     const text = regularFile(path);
     if (text === null)
         return "an unreadable file";
-    const parsed = spawnSync(gitFile, ["config", "--file", path, "--no-includes", "--name-only", "--list", "-z"], { cwd: "/", encoding: "utf8", timeout: 5_000, env: { PATH: process.env["PATH"] ?? "", GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_GLOBAL: "/dev/null", HOME: "/nonexistent" } });
+    const parsed = spawnSync(gitFile, ["config", "--file", path, "--no-includes", "--name-only", "--list", "-z"], { cwd: "/", encoding: "utf8", timeout: 5_000, killSignal: "SIGKILL", env: { PATH: process.env["PATH"] ?? "", GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_GLOBAL: "/dev/null", HOME: "/nonexistent" } });
     if (parsed.status !== 0)
         return "an unreadable file";
     const named = parsed.stdout.split("\0").find(name => /^(include\.path|includeif\..*\.path)$/i.test(name));
@@ -488,7 +488,7 @@ function gitView(checkout, kind, binding = {}, gitFile = "git") {
             throw new Error("the checkout's git config couldn't be read as a plain file");
         const configPath = join(view, "config");
         writeFileSync(configPath, config, { mode: 0o600 });
-        const plain = { cwd: "/", encoding: "utf8", timeout: 5_000, env: { PATH: process.env["PATH"] ?? "", GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_GLOBAL: "/dev/null", HOME: "/nonexistent" } };
+        const plain = { cwd: "/", encoding: "utf8", timeout: 5_000, killSignal: "SIGKILL", env: { PATH: process.env["PATH"] ?? "", GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_GLOBAL: "/dev/null", HOME: "/nonexistent" } };
         if (/worktreeconfig/i.test(config)) {
             const flag = spawnSync(gitFile, ["config", "--file", configPath, "--no-includes", "--type=bool", "--get", "extensions.worktreeConfig"], plain);
             if (flag.status !== 0 && flag.status !== 1)
@@ -1038,7 +1038,7 @@ export function lfsExtensionIn(checkout, gitFile = "git") {
     catch {
         return false;
     }
-    const parsed = spawnSync(gitFile, ["config", "--file", path, "--no-includes", "--name-only", "--list", "-z"], { cwd: "/", encoding: "utf8", timeout: 5_000, env: { PATH: process.env["PATH"] ?? "", GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_GLOBAL: "/dev/null", HOME: "/nonexistent" } });
+    const parsed = spawnSync(gitFile, ["config", "--file", path, "--no-includes", "--name-only", "--list", "-z"], { cwd: "/", encoding: "utf8", timeout: 5_000, killSignal: "SIGKILL", env: { PATH: process.env["PATH"] ?? "", GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_GLOBAL: "/dev/null", HOME: "/nonexistent" } });
     return parsed.status !== 0 || parsed.stdout.split("\0").filter(Boolean).some(name => lfsCommand(name) || ["include", "includeif"].includes(keyParts(name).section));
 }
 /** Every command runs against a view of the checkout's repository (gitView) whose config and info are copies the
@@ -1148,7 +1148,7 @@ export function viewedGitSync(cwd, args, options = {}) {
     const view = gitView(cwd, "read", options.binding, gitFile);
     try {
         const env = { PATH: process.env["PATH"] ?? "", HOME: process.env["HOME"] ?? "", LANG: "C", GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_GLOBAL: "/dev/null", GIT_TERMINAL_PROMPT: "0", ...view.env };
-        const bounded = { cwd, env, encoding: "utf8", timeout: options.timeoutMs ?? 60_000, maxBuffer: options.maxBuffer ?? 1_048_576, stdio: ["ignore", "pipe", "pipe"] };
+        const bounded = { cwd, env, encoding: "utf8", timeout: options.timeoutMs ?? 60_000, killSignal: "SIGKILL", maxBuffer: options.maxBuffer ?? 1_048_576, stdio: ["ignore", "pipe", "pipe"] };
         const own = spawnSync(gitFile, ["--no-optional-locks", "config", "--list", "--show-scope", "-z"], bounded);
         if (own.status !== 0)
             throw new Error("its config couldn't be read");
@@ -1234,7 +1234,7 @@ export function lazyFetchSupported(gitFile = "git") {
     const executable = gitExecutablePath(gitFile);
     let known = lazyFetchByGit.get(executable);
     if (known === undefined) {
-        const probe = spawnSync(executable, ["--no-lazy-fetch", "version"], { cwd: "/", encoding: "utf8", timeout: 5_000, stdio: ["ignore", "pipe", "pipe"],
+        const probe = spawnSync(executable, ["--no-lazy-fetch", "version"], { cwd: "/", encoding: "utf8", timeout: 5_000, killSignal: "SIGKILL", stdio: ["ignore", "pipe", "pipe"],
             env: { PATH: process.env["PATH"] ?? "", GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_GLOBAL: "/dev/null", HOME: "/nonexistent" } });
         known = probe.status === 0;
         lazyFetchByGit.set(executable, known);