Module running 

The machine-wide map of capsules that are currently reachable: one record per session that opened an A2A door, at ~/.murmur/running/<session_id>.json.

A record is a hint, never a truth. Nothing can guarantee it is removed — a SIGKILLed capsule writes no farewell — so a reader never trusts one. verify puts three layers between a record and the claim that a session is live, and each is insufficient alone:

1. The pid is alive. Necessary, nowhere near sufficient.
2. The process’s start time matches the recorded one. Pids are reused, so without this a record can name an unrelated process that happens to hold the number now.
3. The door answers and identifies itself. A live pid proves neither that the process is the capsule nor that it can still respond, so the agent card is fetched and its session_id compared.

Reading prunes a record only on evidence: layer 1 finding no process, or layer 2 reading a start time that differs from the recorded one, which means the pid was reused. That is the only reaper there is, and it is enough because the record is a hint. A reading that could not be taken is not evidence. A live pid whose start time cannot be read is ProcessState::Unverified: kept, reported as unreachable, and never signalled. A record that passes 1 and 2 and fails 3 is kept too: it names a process that is alive, possibly mid-turn, and unlinking it would throw away the only handle to a running capsule because it was slow to answer.

The record names the process and stores nothing from the environment. The directory is 0700 and each record 0600, because the set of records is a map of reachable capsules to anything on the machine that can read it.

Structs

RunningGuard

One session’s record, written for exactly as long as the session runs.

RunningRecord

Where one running session’s door is, and which process holds it.

Enums

Liveness

What all three layers say about a record.

ProcessState

What layers 1 and 2 say about the process a record names.

SignalOutcome

What sending one signal to a record’s process did.

Functions

has_controlling_terminal

Whether the calling process has a controlling terminal, which is what decides outlives_launcher: a capsule attached to a terminal dies with that window.

list

Every record that parses, most recent session first.

process_start_token

Layer 2’s reading: an opaque, platform-local token for when pid’s process started.

process_state

Layers 1 and 2: the pid is alive, and the process holding it is the one that wrote the record.

prune

Unlink one record. For a Liveness::Gone reading only.

running_dir

~/.murmur/running, created if missing and held at 0700, inside a ~/.murmur held at 0700.

signal_kill

SIGKILL the process a record names, if it is still that process.

signal_term

SIGTERM the process a record names, if it is still that process.

verify

All three layers, door probe included.