weir-harness 1.1.7 → 1.2.1

package/src/edit-lock/lifecycle.js

@@ -195,11 +195,25 @@ export function createEditLockLifecycle(runtime, sessionForAgent, options = {})
   }
   /** Register once before publishing an agent's editing tools. A session the
    * manager already knows (restart, re-created agent) is never re-armed: it
-   * starts interrupted and needs trusted resume. @param {object} agent
+   * starts interrupted and needs trusted resume. Presenting the SAME agent
+   * object again adopts the established entry instead of registering twice
+   * (change edit-lock-shared-domain-mounts, design D2). @param {object} agent
    * @returns {Promise<'active'|'interrupted'>} */
   function start(agent) {
     if (closed) return Promise.reject(new Error('edit lifecycle closed'))
-    if (entries.has(agent)) return Promise.reject(new Error('agent already registered'))
+    const existing = entries.get(agent)
+    if (existing) {
+      // Same-agent binding adoption: a sibling mount's idempotent re-setup
+      // presents the same agent object and takes the established start result
+      // verbatim — no openSession, no revocation, no epoch advance, no state
+      // change. A stopped/revoked entry keeps its state: adoption returns its
+      // established result, and business ingress stays gated by
+      // denyStopped/business until a trusted resume. Identity continuity is
+      // required — a host that reused the agent object for a different
+      // session keeps the duplicate-registration refusal.
+      if (sessionForAgent(agent) === existing.sessionId) return existing.ready
+      return Promise.reject(new Error('agent already registered'))
+    }
     const sessionId = sessionForAgent(agent)
     if (!sessionId) return Promise.reject(new Error('unregistered lifecycle agent'))
     const prior = [...entries].find(([, entry]) => entry.sessionId === sessionId)
@@ -213,10 +227,12 @@ export function createEditLockLifecycle(runtime, sessionForAgent, options = {})
         ? (/** @type {any} */ (prior[0]).remote !== true && holderStatus(prior[0]) === 'idle' ? 'serving-idle' : 'serving')
         : 'unknown'
       const refusal = () => {
-        const reason = bindingRefusalReason(/** @type {any} */ (prior[0]).remote === true ? undefined : process.pid, attestation)
+        const pid = /** @type {any} */ (prior[0]).remote === true ? undefined : process.pid
+        const reason = bindingRefusalReason(pid, attestation)
+        const failure = bindingFailure(pid, attestation)
         // Remote callers render after their retry budget; local callers have no wire.
-        return Object.assign(new Error(/** @type {any} */ (agent).remote === true ? reason : `${reason}: ${bindingGuidance(sessionId, reason)}`),
-          { bindingFailure: bindingFailure(/** @type {any} */ (prior[0]).remote === true ? undefined : process.pid, attestation) })
+        return Object.assign(new Error(/** @type {any} */ (agent).remote === true ? reason : `${reason}: ${bindingGuidance(sessionId, failure)}`),
+          { bindingFailure: failure })
       }
       // Remote entries are channel proxies, NOT runtime identities. Only the
       // endpoint's nonce attestation may reclaim them (including same-process).
@@ -280,8 +296,9 @@ export function createEditLockLifecycle(runtime, sessionForAgent, options = {})
       // re-attempts the transfer.
       return forget(prior[0]).then(() => start(agent), () => {
         const reason = bindingRefusalReason(process.pid, 'serving-idle')
-        throw Object.assign(new Error(/** @type {any} */ (agent).remote === true ? reason : `${reason}: ${bindingGuidance(sessionId, reason)}`),
-          { bindingFailure: bindingFailure(process.pid, 'serving-idle') })
+        const failure = bindingFailure(process.pid, 'serving-idle')
+        throw Object.assign(new Error(/** @type {any} */ (agent).remote === true ? reason : `${reason}: ${bindingGuidance(sessionId, failure)}`),
+          { bindingFailure: failure })
       })
     }
     return start(agent)

package/src/edit-lock/limits.js

@@ -0,0 +1,61 @@
+// Edit Lock retention policy: the defaults and the overlay resolver the
+// lifecycle (edit-lock/index.js) consumes. Moved verbatim out of
+// src/settings/sections.js (subsystem-seam-hygiene, D4) — the owner subsystem
+// now holds the policy; settings' field-default parity consumes this module
+// directly (the temporary sections.js re-export was removed by dead-export-cleanup).
+
+/** Resolved Edit Lock retention policy. The flat keys are declared in the
+ * settings sections table; this is the ONE place that turns them into the
+ * values the lifecycle consumes, so defaults and validation cannot drift
+ * apart. */
+export const EDIT_LOCK_DEFAULTS = Object.freeze({
+  holdDefaultMinutes: 30,
+  holdSingleMaxMinutes: 30,
+  holdCumulativeMaxMinutes: 120,
+  nudgeAttempts: 2,
+  nudgeFallback: 'release',
+})
+
+/** Overlay one Edit Lock section onto the defaults. A key the user never set
+ * falls back to its default; a key that is present but unusable (alone or in
+ * combination) throws with the flat settings key named, because silently clamping
+ * a retention cap would change how long other sessions stay blocked from those
+ * files. The Edit Lock composition refuses retention requests with that error and
+ * runs every other path (settling, status, release, stop, unlock) on defaults.
+ * @param {any} section */
+export function editLockLimits(section) {
+  const value = section && typeof section === 'object' ? section : {}
+  /** @type {{holdDefaultMinutes: number, holdSingleMaxMinutes: number, holdCumulativeMaxMinutes: number, nudgeAttempts: number, nudgeFallback: 'release'|'abnormal'}} */
+  const limits = { ...EDIT_LOCK_DEFAULTS }
+  /** @param {'holdDefaultMinutes'|'holdSingleMaxMinutes'|'holdCumulativeMaxMinutes'} key @param {string} name */
+  const take = (key, name) => {
+    const input = value[key]
+    if (input === undefined) return
+    if (typeof input !== 'number' || !Number.isFinite(input) || input <= 0) {
+      throw new Error(`weir-settings: ${name} must be a positive number`)
+    }
+    limits[key] = input
+  }
+  take('holdDefaultMinutes', 'editLockHoldDefaultMinutes')
+  take('holdSingleMaxMinutes', 'editLockHoldSingleMaxMinutes')
+  take('holdCumulativeMaxMinutes', 'editLockHoldCumulativeMaxMinutes')
+  if (limits.holdDefaultMinutes > limits.holdSingleMaxMinutes) {
+    throw new Error('weir-settings: editLockHoldDefaultMinutes must not exceed editLockHoldSingleMaxMinutes')
+  }
+  if (limits.holdCumulativeMaxMinutes < limits.holdSingleMaxMinutes) {
+    throw new Error('weir-settings: editLockHoldCumulativeMaxMinutes must be at least editLockHoldSingleMaxMinutes')
+  }
+  if (value.nudgeAttempts !== undefined) {
+    if (!Number.isSafeInteger(value.nudgeAttempts) || value.nudgeAttempts < 0) {
+      throw new Error('weir-settings: editLockNudgeAttempts must be a non-negative integer')
+    }
+    limits.nudgeAttempts = value.nudgeAttempts
+  }
+  if (value.nudgeFallback !== undefined) {
+    if (value.nudgeFallback !== 'release' && value.nudgeFallback !== 'abnormal') {
+      throw new Error('weir-settings: editLockNudgeFallback must be "release" or "abnormal"')
+    }
+    limits.nudgeFallback = value.nudgeFallback
+  }
+  return Object.freeze(limits)
+}

package/src/edit-lock/maintenance.js

@@ -6,7 +6,7 @@ import { join } from 'node:path'
 import { AUTHORITY_DIR } from './domains.js'
 import { reservationPathFor } from './reservation.js'
 import { parseSnapshot } from './snapshot.js'
-import { maintenanceState, summarizeAuthorityImage } from './inspect.js'
+import { maintenanceState, summarizeAuthorityImage, recoveryProposals } from './inspect.js'
 import { readSnapshotBytes, checkedPath, verifyPins, missing, errorMessage, MAX_SNAPSHOT_BYTES } from './read-authority.js'
 import { recoverAuthority } from './admin-recovery.js'
 import { createAudit, AUDIT_TYPES } from '../shared/audit.js'
@@ -141,7 +141,10 @@ export function inspectAuthority(root) {
   if (read.presence === 'not-a-file') return { ...base, presence: 'not-a-file' }
   if (read.presence !== 'valid') return { ...base, presence: 'unreadable', message: read.message }
   try {
-    return { ...base, presence: 'valid', snapshot: summarizeAuthorityImage(parseSnapshot(read.bytes, root)) }
+    const parsed = parseSnapshot(read.bytes, root)
+    // Both projections derive from the SAME parsed image: the snapshot summary
+    // and the server-computed recovery proposals (additive, schemaVersion 1).
+    return { ...base, presence: 'valid', snapshot: summarizeAuthorityImage(parsed), recoveryProposals: recoveryProposals(root, parsed) }
   } catch (error) {
     return { ...base, presence: 'corrupt', message: errorMessage(error) }
   }

package/src/edit-lock/manager.js

@@ -4,7 +4,8 @@ import { bindRequest } from './request-binding.js'
 import { lookupOperation } from './operation-history.js'
 import { canonicalRequestData } from './request-data.js'
 import { admitMutation as admitHistory, publicationCandidate } from './admission.js'
-import { administrativeState, AUTOMATIC_RECOVERY_ACTOR, digest, dispositionFor, LATE_WRITER_RISK, ONLINE_RECOVERY_ACTOR, revokedOwner } from './admin-ledger.js'
+import { administrativeState, AUTOMATIC_RECOVERY_ACTOR, digest, LATE_WRITER_RISK, ONLINE_RECOVERY_ACTOR } from './admin-ledger.js'
+import { dispositionFor, revokedOwner } from './derived-facts.js'
 import { canonical } from './snapshot.js'
 import { incarnationProcess, withIncarnation } from './incarnations.js'
 
@@ -395,8 +396,11 @@ function managerCore(store, kernel, { processIdentity = null, root = null, write
         if (cancelled.has(captured.sessionId)) throw new Error('session cancelled')
         // A revoked owner is NOT refused here: the resume commits the epoch
         // advance that atomically ends the revocation (no ledger change).
+        // Admission runs in the resume mode: the epoch advance publishes nothing,
+        // so unresolved resource-level fences never block the trusted Continue;
+        // the fenced resources stay barred to every other ingress.
         return draft.operations.resume(captured, requestId, receipt)
-      }, () => sessionResources(captured.sessionId)).then(async resumed => {
+      }, () => sessionResources(captured.sessionId), 'resume').then(async resumed => {
         const cancellation = cancelled.get(captured.sessionId)
         if (cancellation) {
           await cancellation

package/src/edit-lock/operation-history.js

@@ -1,5 +1,5 @@
 import { isAbsolute, relative } from 'node:path'
-import { dispositionFor } from './admin-ledger.js'
+import { dispositionFor } from './derived-facts.js'
 
 /** Historical assertions only: no authentication, live permission or FS publication.
  * Digests MUST be computed by a future trusted publisher over canonical requests,

package/src/edit-lock/peer-client.js

@@ -1,3 +1,4 @@
+import { asBindingFailure } from './binding-guidance.js'
 import { canonicalRequestData } from './request-data.js'
 import { PEER_KINDS } from './peer.js'
 
@@ -39,15 +40,21 @@ export function createEditLockPeerClient(stream, hooks = {}) {
         try { hooks.onEvent?.(message.event) } catch { /* notices never imply consent */ }
         continue
       }
+      const frameKeys = !message || typeof message !== 'object' ? '' : Object.keys(message).sort().join(',')
+      // The error frame carries the structured binding refusal as an additive
+      // optional field (change edit-lock-deepening, design D2).
       if (!message || typeof message.callId !== 'string' || typeof message.ok !== 'boolean'
-        || Object.keys(message).sort().join(',') !== (message.ok ? 'callId,ok,outcome' : 'callId,error,ok')
+        || (message.ok ? frameKeys !== 'callId,ok,outcome' : frameKeys !== 'callId,error,ok' && frameKeys !== 'bindingFailure,callId,error,ok')
         || (!message.ok && typeof message.error !== 'string')) { close(); return }
       const entry = pending.get(message.callId)
       if (!entry) { close(); return }
       pending.delete(message.callId)
       entry.cleanup()
       if (message.ok) entry.resolve(message.outcome)
-      else entry.reject(new Error(message.error))
+      else {
+        const failure = asBindingFailure(message.bindingFailure)
+        entry.reject(Object.assign(new Error(message.error), failure ? { bindingFailure: failure } : {}))
+      }
     }
   }
   stream.on('data', receive)

package/src/edit-lock/peer-transport.js

@@ -1,3 +1,4 @@
+import { asBindingFailure } from './binding-guidance.js'
 import { canonicalRequestData } from './request-data.js'
 
 /** Attach ONLY an authenticated, host-owned byte stream. Never accepts public
@@ -54,7 +55,12 @@ export function serveEditLockPeer(stream, peer) {
       const callId = request.callId
       void peer.receive(request).then(
         outcome => { try { send({callId, ok:true, outcome:outcome ?? null}) } catch { close() } },
-        error => { try { send({callId, ok:false, error:String(error?.message ?? error).slice(0,4096)}) } catch { close() } },
+        error => {
+          // The wire carries the structured binding refusal additively (change
+          // edit-lock-deepening, design D2); the text stays for display.
+          const failure = asBindingFailure(/** @type {any} */ (error)?.bindingFailure)
+          try { send({ callId, ok: false, error: String(/** @type {any} */ (error)?.message ?? error).slice(0, 4096), ...(failure ? { bindingFailure: failure } : {}) }) } catch { close() }
+        },
       )
     }
   }

package/src/edit-lock/remote.js

@@ -3,7 +3,7 @@ import { lstatSync, realpathSync, unlinkSync } from 'node:fs'
 import { createConnection, createServer } from 'node:net'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
-import { bindingGuidance, bindingRefusal } from './binding-guidance.js'
+import { asBindingFailure, bindingGuidance, bindingRefusal } from './binding-guidance.js'
 import { createEditLockPeer } from './peer.js'
 import { serveEditLockPeer } from './peer-transport.js'
 import { createEditLockPeerClient } from './peer-client.js'
@@ -275,12 +275,16 @@ export function createRemoteEditLockDomain(endpoint, hooks) {
     for (let attempt = 0; ; attempt++) {
       try { return await openChannel(agent, retry) } catch (error) {
         if (/** @type {any} */ (error)?.answeredRefusal !== true) throw error
-        if (!retry && /session already bound/.test(String(/** @type {any} */ (error)?.message)) && attempt < 20) {
+        // The retry budget classifies on the STRUCTURED refusal field, never on
+        // the display text (change edit-lock-deepening, design D2): only an
+        // answered, publisher-classified duplicate binding is retried — the
+        // publisher may not yet have processed the earlier channel's death.
+        if (!retry && /** @type {any} */ (error)?.bindingFailure?.code === 'binding-duplicate' && attempt < 20) {
           await new Promise(resolve => setTimeout(resolve, 50))
           continue
         }
         const reason = String(/** @type {any} */ (error)?.message ?? error)
-        const guidance = bindingGuidance(agent.id, reason)
+        const guidance = bindingGuidance(agent.id, /** @type {any} */ (error)?.bindingFailure)
         throw Object.assign(new Error(`edit lock duplicate session binding: ${guidance} (publisher answered: ${reason})`), { bindingFailure: /** @type {any} */ (error)?.bindingFailure })
       }
     }
@@ -317,7 +321,10 @@ export function createRemoteEditLockDomain(endpoint, hooks) {
       let opened
       try {
         opened = await channel.client.request('open', 'open', { sessionId: agent.id, nonce, pid: process.pid, bindingFailures: true, retry }, never)
-        if (opened?.state === 'unavailable' && opened.bindingFailure?.code === 'binding-duplicate') throw Object.assign(new Error(opened.reason), { bindingFailure: opened.bindingFailure })
+        // The answered refusal's structured field is validated on receipt;
+        // only the exact minted shape becomes decision input.
+        const refused = opened?.state === 'unavailable' ? asBindingFailure(opened.bindingFailure) : undefined
+        if (refused) throw Object.assign(new Error(opened.reason), { bindingFailure: refused })
       } catch (error) {
         const message = String(/** @type {any} */ (error)?.message ?? error)
         // No answer ever arrived — the channel died mid-open or the request

package/src/edit-lock/state.js

@@ -24,6 +24,7 @@
  * @typedef {{ now?: number, singleMaxMs: number, cumulativeMaxMs: number }} HoldCaps
  */
 
+import { settleHoldFacts } from './derived-facts.js'
 /** Private transfer seam; no raw hydration is exported. */
 const cores = new WeakMap()
 /** @param {string} managerIncarnation */
@@ -165,10 +166,7 @@ export function createEditLockState(managerIncarnation) {
       const held = holds.get(sessionId)
       if (!held) return Object.freeze({ sessionId, held: false, expired: false, holdUntil: null, remainingMs: 0, holdCumulativeMs: 0 })
       const owns = [...locks.values()].some(lock => lock.owner === sessionId)
-      const remainingMs = held.holdUntil === null ? 0 : Math.max(0, held.holdUntil - now)
-      const holding = held.holding && owns
-      return Object.freeze({ sessionId, held: holding, expired: holding && held.holdUntil !== null && remainingMs === 0,
-        holdUntil: held.holdUntil, remainingMs, holdCumulativeMs: held.holdCumulativeMs })
+      return Object.freeze(settleHoldFacts(sessionId, held, owns, now))
     },
   }
 

package/src/edit-lock/view.js

@@ -10,6 +10,7 @@
  * in `technical` and per-lock `detail`, for the expandable detail only.
  */
 import { isAbsolute, relative, sep } from 'node:path'
+import { revokedOwner, settleHoldFacts } from './derived-facts.js'
 
 /** Session states the panel renders, in precedence order. */
 export const VIEW_STATES = Object.freeze(['revoked', 'unavailable', 'stopped', 'attention', 'confirm', 'holding', 'editing', 'idle'])
@@ -140,21 +141,19 @@ export function buildColdView({ image, sessionId, cwd, root, autoResume = true,
   const locks = (Array.isArray(image?.locks) ? image.locks : []).filter(lock => lock !== null && typeof lock === 'object')
   const holds = Array.isArray(image?.holds) ? image.holds : []
   const recoveries = Array.isArray(image?.recovery) ? image.recovery : []
-  const adminRecoveries = Array.isArray(image?.adminRecoveries) ? image.adminRecoveries : []
   const session = sessions.find(row => row?.sessionId === sessionId) ?? null
   // The manager derives the revoked flag from the administrative ledger at
-  // status time (revokedOwner); the cold read applies the same rule to the image.
-  const revoked = session != null && adminRecoveries.some(row => row?.owner === sessionId && Number.isSafeInteger(row?.revokedEpoch) && session.executionEpoch <= row.revokedEpoch)
-  // Read-time retention settlement, byte-equivalent to the kernel's settleHold:
-  // a hold counts only while the session owns a lock, and the remaining budget
-  // is computed against the read instant, so a missed expiry timer can never
-  // leave stale ownership behind a status read.
+  // status time (revokedOwner); the cold read applies the SAME shared rule in
+  // its deliberately tolerant partial mode (design D1).
+  const revoked = revokedOwner(image, sessionId, { partial: true })
+  // Read-time retention settlement through the shared derived fact (design D5,
+  // partial mode — byte-equivalent to the kernel's settleHold): a hold counts
+  // only while the session owns a lock, and the remaining budget is computed
+  // against the read instant, so a missed expiry timer can never leave stale
+  // ownership behind a status read. No hold row settles to no retention (null).
   const held = holds.find(row => row?.sessionId === sessionId) ?? null
   const owns = locks.some(lock => lock.owner === sessionId)
-  const remainingMs = held?.holdUntil == null ? 0 : Math.max(0, held.holdUntil - now)
-  const holding = held?.holding === true && owns
-  const retention = held ? { sessionId, held: holding, expired: holding && held.holdUntil !== null && remainingMs === 0,
-    holdUntil: held.holdUntil, remainingMs, holdCumulativeMs: held.holdCumulativeMs } : null
+  const retention = held ? settleHoldFacts(sessionId, held, owns, now, { partial: true }) : null
   const status = {
     sessionId,
     // Interrupted records a stopped session (a restarted host interrupts every

package/src/lsp/admin.js

@@ -4,40 +4,18 @@
 // resolve through ctx.get so the module mounts harmlessly in compositions
 // without them (headless).
 import { buildRegistry, DEFAULT_SERVERS, displayInstallCommand, installSpecFor, languageIdsForFamily } from './registry.js'
-import { npmGlobalPrefix, resolveExecutable as extendedResolveExecutable, runBounded, spawnArgv } from './child-process.js'
+import { npmGlobalPrefix, resolveExecutable as extendedResolveExecutable, runBounded, spawnArgv } from '../process/index.js'
+import { jsonResponse, readJsonBody } from '../shared/http-json.js'
 
 const name = 'weir-lsp-admin'
 const inject = []
 const DEFAULT_INSTALL_TIMEOUT_MS = 600_000
 const VERSION_PROBE_TIMEOUT_MS = 8_000
 
-export function jsonResponse(payload, status = 200) {
-  return new Response(JSON.stringify(payload), {
-    status,
-    headers: { 'content-type': 'application/json' },
-  })
-}
-
 export function errorResponse(message, status = 400) {
   return jsonResponse({ ok: false, error: { code: `weir-lsp/${status === 400 ? 'invalid' : 'internal'}`, message } }, status)
 }
 
-/** Read the JSON body of a connection request (Request-like or stream). */
-export async function readJsonBody(request) {
-  try {
-    if (typeof request?.json === 'function') return await request.json()
-  } catch {
-    return null
-  }
-  try {
-    const chunks = []
-    for await (const chunk of request?.body ?? []) chunks.push(Buffer.from(chunk))
-    return JSON.parse(Buffer.concat(chunks).toString('utf8'))
-  } catch {
-    return null
-  }
-}
-
 /** Accept only lines that plausibly carry a version (stack traces and
  *  paths from servers without --version support are dropped). */
 export function looksLikeVersion(line) {

package/src/lsp/index.js

@@ -8,7 +8,7 @@
 // ESM, ctx-only.
 import { createLspManager, LSP_DEFAULTS } from './manager.js'
 import { buildRegistry } from './registry.js'
-import { resolveExecutable as extendedResolveExecutable } from './child-process.js'
+import { resolveExecutable as extendedResolveExecutable } from '../process/index.js'
 import { createLspTools } from './tools.js'
 
 const name = 'weir-lsp'

package/src/lsp/manager.js

@@ -2,7 +2,7 @@
 // lazy start, full-document sync, idle shutdown, per-session holder refcounts.
 import { createLspClient, handshake, shutdownClient } from './client.js'
 import { familyForLanguageId } from './registry.js'
-import { childEnvironment, spawnArgv } from './child-process.js'
+import { childEnvironment, spawnArgv } from '../process/index.js'
 import { pathToUri } from './uri.js'
 
 export const LSP_DEFAULTS = {

package/src/notify/permissions-admin.js

@@ -4,7 +4,7 @@
 // connection service resolves from that scope (S20). The platform and the
 // process spawner are injected for tests.
 import { execFile as nodeExecFile } from 'node:child_process'
-import { jsonResponse, readJsonBody } from '../lsp/admin.js'
+import { jsonResponse, readJsonBody } from '../shared/http-json.js'
 import { ACTIONS, readNotificationPermission, runPermissionAction, SENDER } from './permissions.js'
 
 const STATUS_PATH = '/api/weir-notify/permissions/status'

package/src/{lsp/child-process.js → process/index.js}

@@ -1,15 +1,21 @@
-// Executable resolution for LSP servers and installers. The desktop app is
+// Generic process machinery: executable resolution, launch-shape
+// adjudication, and deadline-bounded runs — one concept, three stages
+// (resolve → launch shape → bounded run). The desktop app is
 // a GUI process launched by LaunchServices, so its PATH is the minimal
 // `/usr/bin:/bin:/usr/sbin:/sbin` — Homebrew (/opt/homebrew, /usr/local),
 // nvm, cargo, go, pipx and npm-global bins are all missing, and
 // ctx.subprocess.resolveExecutable() fails for them (S21). This helper
-// falls back to scanning well-known installation directories so servers and
-// their installers resolve the same way they do in the user's shell.
+// falls back to scanning well-known installation directories so spawned
+// tools resolve the same way they do in the user's shell.
 //
 // Windows resolves through the same helper with a different dialect: npm puts
 // its global shims in `%APPDATA%\npm` (not `~/.npm-global/bin`), bare names
 // carry a PATHEXT extension, and the PATH separator is `;`.
-// Renamed-and-expanded from executable.js (design D1): one concept, three stages — resolve → launch shape → bounded run.
+//
+// No LSP-specific semantics live here: the LSP subsystem (server lifecycle,
+// version probe, panel installer) and the worktree git runner are peer
+// consumers. Moved verbatim out of src/lsp/child-process.js
+// (subsystem-seam-hygiene, D1); npm install POLICY stays in src/lsp/.
 import { accessSync, constants, existsSync, mkdirSync, readdirSync, readFileSync, statSync } from 'node:fs'
 import { homedir } from 'node:os'
 import { dirname, join, join as nodeJoin } from 'node:path'
@@ -304,6 +310,7 @@ function expandShimToken(token, text, shimDirectory, join) {
 function tokenizeShimLine(line) {
   const tokens = []
   let current = ''
+  /** @type {string | null} */
   let quote = null
   let escaped = false
   for (const character of line) {
@@ -495,6 +502,7 @@ export async function runBounded(subprocess, { argv, timeoutMs, unref = false })
   })
   let timedOut = false
   let timer
+  /** @type {Promise<void>} */
   const deadline = new Promise((resolve) => {
     timer = setTimeout(() => {
       timedOut = true

package/src/settings/env-admin.js

@@ -4,7 +4,7 @@
 // settings row through ctx.inject so no new package subpath is needed (S19),
 // same pattern as wireLspAdmin / wireNotifyPermissions. The platform is
 // injected for tests.
-import { jsonResponse } from '../lsp/admin.js'
+import { jsonResponse } from '../shared/http-json.js'
 
 const ENV_PATH = '/api/weir-settings/env'
 

package/src/settings/index.js

@@ -9,7 +9,7 @@
 // config contains only the values the user actually set, so the settings
 // service can overlay them over preset-row config without clobbering
 // bundle-shipped defaults (layering: module defaults ← row config ← service).
-import { createWhitelistDefaultsCache, DEFAULT_WHITELIST_PATH } from '../shared/whitelist-defaults.js'
+import { createWhitelistDefaultsCache, DEFAULT_WHITELIST_PATH } from '../delegate/whitelist-defaults.js'
 import { configValue } from './volatile.js'
 import { computeSections } from './sections.js'
 import { wireLspAdmin } from '../lsp/admin.js'

package/src/settings/sections.js

@@ -149,60 +149,6 @@ export const FIELD_DEFAULTS = Object.freeze({
   blackboardWriteTokenTtlMinutes: 60,
 })
 
-/** Resolved Edit Lock retention policy. The keys are declared above; this is the
- * ONE place that turns them into the values the lifecycle consumes, so defaults
- * and validation cannot drift apart. */
-export const EDIT_LOCK_DEFAULTS = Object.freeze({
-  holdDefaultMinutes: 30,
-  holdSingleMaxMinutes: 30,
-  holdCumulativeMaxMinutes: 120,
-  nudgeAttempts: 2,
-  nudgeFallback: 'release',
-})
-
-/** Overlay one Edit Lock section onto the defaults. A key the user never set
- * falls back to its default; a key that is present but unusable (alone or in
- * combination) throws with the flat settings key named, because silently clamping
- * a retention cap would change how long other sessions stay blocked from those
- * files. The Edit Lock composition refuses retention requests with that error and
- * runs every other path (settling, status, release, stop, unlock) on defaults.
- * @param {any} section */
-export function editLockLimits(section) {
-  const value = section && typeof section === 'object' ? section : {}
-  /** @type {{holdDefaultMinutes: number, holdSingleMaxMinutes: number, holdCumulativeMaxMinutes: number, nudgeAttempts: number, nudgeFallback: 'release'|'abnormal'}} */
-  const limits = { ...EDIT_LOCK_DEFAULTS }
-  /** @param {'holdDefaultMinutes'|'holdSingleMaxMinutes'|'holdCumulativeMaxMinutes'} key @param {string} name */
-  const take = (key, name) => {
-    const input = value[key]
-    if (input === undefined) return
-    if (typeof input !== 'number' || !Number.isFinite(input) || input <= 0) {
-      throw new Error(`weir-settings: ${name} must be a positive number`)
-    }
-    limits[key] = input
-  }
-  take('holdDefaultMinutes', 'editLockHoldDefaultMinutes')
-  take('holdSingleMaxMinutes', 'editLockHoldSingleMaxMinutes')
-  take('holdCumulativeMaxMinutes', 'editLockHoldCumulativeMaxMinutes')
-  if (limits.holdDefaultMinutes > limits.holdSingleMaxMinutes) {
-    throw new Error('weir-settings: editLockHoldDefaultMinutes must not exceed editLockHoldSingleMaxMinutes')
-  }
-  if (limits.holdCumulativeMaxMinutes < limits.holdSingleMaxMinutes) {
-    throw new Error('weir-settings: editLockHoldCumulativeMaxMinutes must be at least editLockHoldSingleMaxMinutes')
-  }
-  if (value.nudgeAttempts !== undefined) {
-    if (!Number.isSafeInteger(value.nudgeAttempts) || value.nudgeAttempts < 0) {
-      throw new Error('weir-settings: editLockNudgeAttempts must be a non-negative integer')
-    }
-    limits.nudgeAttempts = value.nudgeAttempts
-  }
-  if (value.nudgeFallback !== undefined) {
-    if (value.nudgeFallback !== 'release' && value.nudgeFallback !== 'abnormal') {
-      throw new Error('weir-settings: editLockNudgeFallback must be "release" or "abnormal"')
-    }
-    limits.nudgeFallback = value.nudgeFallback
-  }
-  return Object.freeze(limits)
-}
 const zs = z
 
 function fieldSchema(type) {

package/src/shared/audit.js

@@ -35,6 +35,11 @@ export const AUDIT_TYPES = Object.freeze({
   // identity, feed census and provider status, never skill names; the receipt
   // itself stays the only effective-state authority.
   capabilityRead: 'capability-read',
+  // The pending model-facing capability notice (durable-pending-notice D7):
+  // queue / degrade / deliver / clear outcomes of the durable notice unit.
+  // Counts only, never names — the same rule as capability-read above; the
+  // accepted selection record stays the only effective-state authority.
+  capabilityNotice: 'capability-notice',
   // Session blackboard release facts (design D3): one record per key release
   // that had waiting subscribers; the emission lives in the blackboard plugin
   // and never touches a session log.

package/src/shared/http-json.js

@@ -0,0 +1,28 @@
+// Generic HTTP JSON helpers for the host-side admin endpoints: Response
+// shaping and request-body reading shared by the lsp, settings, and notify
+// admin modules. Sunk verbatim out of src/lsp/admin.js
+// (subsystem-seam-hygiene, D2); the LSP-specific error namespace
+// (errorResponse) and endpoint assembly (wireLspAdmin) stay in src/lsp/.
+
+export function jsonResponse(payload, status = 200) {
+  return new Response(JSON.stringify(payload), {
+    status,
+    headers: { 'content-type': 'application/json' },
+  })
+}
+
+/** Read the JSON body of a connection request (Request-like or stream). */
+export async function readJsonBody(request) {
+  try {
+    if (typeof request?.json === 'function') return await request.json()
+  } catch {
+    return null
+  }
+  try {
+    const chunks = []
+    for await (const chunk of request?.body ?? []) chunks.push(Buffer.from(chunk))
+    return JSON.parse(Buffer.concat(chunks).toString('utf8'))
+  } catch {
+    return null
+  }
+}

package/src/{delegate/audit-readers.js → shared/terminal-evidence.js}

@@ -1,9 +1,39 @@
-// Best-effort cold readers for supervision rebuild: the audit JSONL tail and a
-// child's final assistant text. These are the only node: consumers in the
-// delegate subsystem's cold path — the composition root stays node:-free.
+// Terminal evidence — the single definition site for what proves a supervised
+// child reached a terminal state: the STATUS/REPORT parser, the terminal-status
+// predicate (its JSDoc carries the one blocked-vs-terminal rule every consumer
+// refers to), and the two best-effort cold readers (the bounded audit-JSONL
+// tail; a child log's final assistant text). Delegate supervision and worktree
+// zombie-lane reconciliation both import from here, so neither subsystem
+// reaches into the other for this concept.
+//
+// Load-bearing tolerance semantics (zombie-lane safety): readAuditTail's 256KB
+// bounded window and error tolerance (missing/unreadable → [], a partial first
+// line dropped, malformed lines skipped) make an aged-out fact degrade to "no
+// evidence", never to a wrong release. Keep them byte-exact.
+//
+// Ports & adapters: the readers take their services as parameters (never ctx).
+// node: imports are the src/shared precedent (audit.js);
+// the node:-free constraint guards the delegate composition root, not shared.
 import { openSync, readSync, closeSync, statSync } from 'node:fs'
 import { join } from 'node:path'
-import { contentText } from '../shared/content-text.js'
+import { contentText } from './content-text.js'
+
+/** Parse a child's final assistant text into a terminal status, or null. */
+export function parseTerminalStatus(text) {
+  if (typeof text !== 'string' || text.length === 0) return null
+  const match = /^STATUS:[ \t]*(completed|blocked)[ \t]*$/m.exec(text)
+  if (!match) return null
+  const reportMatch = /^REPORT:[ \t]*([\s\S]*)$/m.exec(text.slice(match.index))
+  return { status: match[1], report: (reportMatch?.[1] ?? '').trim() }
+}
+
+/**
+ * Single exit for the terminal-status predicate: statuses that count toward
+ * group completion (blocked waits for a resume, so it is NOT terminal here).
+ */
+export function isTerminalStatus(status) {
+  return status === 'completed' || status === 'terminated'
+}
 
 /** Audit JSONL location for one session (cold-safe channel; may not exist). */
 export function auditFilePathOf(session) {

package/src/worktree/errors.js

@@ -18,6 +18,9 @@ export const WORKTREE_CODES = Object.freeze({
   UNKNOWN_LANE: 'UNKNOWN_LANE',
   ILLEGAL_TRANSITION: 'ILLEGAL_TRANSITION',
   LANE_NOT_DISPATCHABLE: 'LANE_NOT_DISPATCHABLE',
+  // The binding commit's reservation is gone (force-reclaim / reconcile
+  // --rebuild) or the lane left `working` before the commit landed.
+  LANE_RESERVATION_LOST: 'LANE_RESERVATION_LOST',
   LANE_BUSY: 'LANE_BUSY',
   NOT_LANDABLE: 'NOT_LANDABLE',
   STALE_LANDABLE: 'STALE_LANDABLE',