Actively confirms the browser's CDP channel is alive, unlike the passive isConnected() flag which lags a killed browser under load. Does a real newBrowserCDPSession round-trip bounded by timeoutMs — a dead or wedged channel resolves false within the budget rather than hanging. Chromium-only: firefox/webkit use a pipe transport whose 'disconnected' fires promptly on process exit, so isConnected() is already reliable there.

The crash-budget policy, as one pure decision: what a run's outcome does to the counter, and what should happen next.

Unlinks the daemon's on-disk liveness markers: the socket, the info file, and the lock. socket/info are gated on listenSucceeded — a daemon that reaches shutdown without ever binding (e.g. an early throw) doesn't own them, and unlinking would corrupt whatever started in its place. The lock IS ours unconditionally: reaching shutdown means tryAcquireDaemonLock returned true, so always release it or the next spawn has to stale-pid-recover.

Daemon process entry point. Owns one persistent Chrome and one Unix socket; serves run requests serially. Shuts down on SIGTERM/SIGINT, idle timeout, package.json mutation, node version mismatch, or an explicit shutdown request.

Tears the daemon down: notifies pending clients, removes the on-disk liveness markers, closes the browser/esbuild within a bounded grace, then exits. Idempotent via state.shuttingDown. exit is injectable only so the shutdown ordering can be tested without killing the test process; production always uses the default. See test/commands/daemon-shutdown-test.ts.

Budget for the pre-run liveness probe. A healthy CDP round-trip answers in single-digit ms even on a loaded runner, so this is generous headroom: if it elapses, the browser is dead (or wedged) and recovery relaunches a fresh one. Kept well under GROUP_TIMEOUT_MS so a doomed browser surfaces in seconds, not the 3-minute last-resort deadline.

How long a crash relaunch may take before the daemon declares itself unrecoverable.