@adhdev/daemon-core 1.0.18-rc.2 → 1.0.18-rc.20

package/src/commands/process-lifecycle.ts

@@ -0,0 +1,248 @@
+import { execFileSync, type ExecFileSyncOptions } from 'child_process';
+import * as path from 'path';
+
+export interface ProcessLifecycleOptions {
+    platform?: NodeJS.Platform;
+    execFileSync?: typeof import('child_process').execFileSync;
+}
+
+export interface OwnedProcessInfo {
+    pid: number;
+    commandLine: string | null;
+}
+
+function defaultExecFileSync(): typeof import('child_process').execFileSync {
+    return execFileSync;
+}
+
+function getWindowsProcessCommandLine(
+    pid: number,
+    exec: typeof import('child_process').execFileSync,
+): string | null {
+    const pidFilter = `ProcessId=${pid}`;
+
+    try {
+        const psOut = exec('powershell.exe', [
+            '-NoProfile',
+            '-NonInteractive',
+            '-ExecutionPolicy', 'Bypass',
+            '-Command',
+            `(Get-CimInstance Win32_Process -Filter "${pidFilter}").CommandLine`,
+        ], { encoding: 'utf8', timeout: 5000, stdio: ['ignore', 'pipe', 'ignore'], windowsHide: true });
+        const text = String(psOut).trim();
+        if (text) return text;
+    } catch {
+        // fall through to wmic fallback
+    }
+
+    try {
+        const wmicOut = exec('wmic', [
+            'process', 'where', pidFilter, 'get', 'CommandLine',
+        ], { encoding: 'utf8', timeout: 3000, stdio: ['ignore', 'pipe', 'ignore'], windowsHide: true });
+        const text = String(wmicOut).trim();
+        if (text) return text;
+    } catch {
+        // noop
+    }
+
+    return null;
+}
+
+export function getProcessCommandLine(
+    pid: number,
+    options: ProcessLifecycleOptions = {},
+): string | null {
+    if (!Number.isFinite(pid) || pid <= 0) return null;
+    const exec = options.execFileSync ?? defaultExecFileSync();
+    const platform = options.platform ?? process.platform;
+
+    if (platform === 'win32') {
+        return getWindowsProcessCommandLine(pid, exec);
+    }
+
+    try {
+        const text = String(exec('ps', ['-o', 'command=', '-p', String(pid)], {
+            encoding: 'utf8',
+            timeout: 3000,
+            stdio: ['ignore', 'pipe', 'ignore'],
+        })).trim();
+        return text || null;
+    } catch {
+        return null;
+    }
+}
+
+/**
+ * Extract the script argument (the token after the node executable) from a
+ * command line. Handles both quoted and unquoted executables/scripts.
+ */
+export function parseNodeScriptPath(commandLine: string | null): string | null {
+    if (!commandLine) return null;
+    let rest = commandLine.trim();
+
+    // Skip the leading executable token.
+    if (rest.startsWith('"')) {
+        const end = rest.indexOf('"', 1);
+        if (end === -1) return null;
+        rest = rest.slice(end + 1).trim();
+    } else {
+        const idx = rest.search(/\s/);
+        if (idx === -1) return null;
+        rest = rest.slice(idx + 1).trim();
+    }
+    if (!rest) return null;
+
+    if (rest.startsWith('"')) {
+        const end = rest.indexOf('"', 1);
+        return end === -1 ? rest.slice(1) : rest.slice(1, end);
+    }
+    const idx = rest.search(/\s/);
+    return idx === -1 ? rest : rest.slice(0, idx);
+}
+
+function normalizeWindowsPath(value: string): string {
+    return value.toLowerCase().replace(/\//g, '\\').replace(/\\+$/, '');
+}
+
+function isCommandLineUnderPrefix(commandLine: string | null, prefix: string): boolean {
+    if (!commandLine) return false;
+    const needle = normalizeWindowsPath(prefix);
+    // Command-line paths may quote Windows separators as either single or
+    // doubled backslashes; collapse doubles before matching.
+    const haystack = commandLine.split('\\\\').join('\\').toLowerCase();
+    return haystack.includes(needle);
+}
+
+export function killProcess(pid: number, options: ProcessLifecycleOptions = {}): boolean {
+    if (!Number.isFinite(pid) || pid <= 0) return false;
+    const exec = options.execFileSync ?? defaultExecFileSync();
+    const platform = options.platform ?? process.platform;
+
+    try {
+        if (platform === 'win32') {
+            exec('taskkill', ['/PID', String(pid), '/T', '/F'], {
+                stdio: 'ignore',
+                windowsHide: true,
+            });
+        } else {
+            process.kill(pid, 'SIGTERM');
+        }
+        return true;
+    } catch {
+        return false;
+    }
+}
+
+export async function waitForPidExit(pid: number, timeoutMs: number): Promise<boolean> {
+    const start = Date.now();
+    while (Date.now() - start < timeoutMs) {
+        try {
+            process.kill(pid, 0);
+            await new Promise((resolve) => setTimeout(resolve, 250));
+        } catch {
+            return true;
+        }
+    }
+    return false;
+}
+
+/**
+ * List Node processes whose command line places them under any of the supplied
+ * prefixes. Windows-only — the versioned-prefix lifecycle this supports does not
+ * exist on POSIX, so the helper is a no-op there.
+ */
+export function listOwnedNodeProcesses(options: {
+    prefixes: readonly string[];
+    excludePids?: readonly number[];
+    markers?: readonly string[];
+} & ProcessLifecycleOptions): OwnedProcessInfo[] {
+    const platform = options.platform ?? process.platform;
+    if (platform !== 'win32') return [];
+
+    const exec = options.execFileSync ?? defaultExecFileSync();
+    const prefixes = options.prefixes.map((p) => normalizeWindowsPath(p));
+    const exclude = new Set((options.excludePids ?? []).filter((n) => Number.isFinite(n) && n > 0));
+    // Command-line paths use Windows separators; normalize marker separators the
+    // same way so a marker like "dist/cli/index.js" matches "dist\cli\index.js".
+    const markers = (options.markers ?? []).map((m) => m.toLowerCase().replace(/\//g, '\\'));
+
+    let pids: number[] = [];
+    try {
+        const out = String(exec('powershell.exe', [
+            '-NoProfile',
+            '-NonInteractive',
+            '-ExecutionPolicy', 'Bypass',
+            '-Command',
+            'Get-Process node -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id | ConvertTo-Json -Compress',
+        ], { encoding: 'utf8', timeout: 8000, stdio: ['ignore', 'pipe', 'ignore'], windowsHide: true })).trim();
+        if (out) {
+            const parsed = JSON.parse(out);
+            pids = Array.isArray(parsed) ? parsed : [parsed];
+        }
+    } catch {
+        return [];
+    }
+
+    const results: OwnedProcessInfo[] = [];
+    for (const pid of pids) {
+        if (!Number.isFinite(pid) || pid <= 0 || exclude.has(pid)) continue;
+        const commandLine = getProcessCommandLine(pid, { platform, execFileSync: exec });
+        if (!commandLine) continue;
+        const lower = commandLine.toLowerCase();
+        const underPrefix = prefixes.some((prefix) => lower.includes(prefix));
+        if (!underPrefix) continue;
+        if (markers.length > 0 && !markers.some((marker) => lower.includes(marker))) continue;
+        results.push({ pid, commandLine });
+    }
+    return results;
+}
+
+export async function stopOwnedProcesses(options: {
+    processes: readonly OwnedProcessInfo[];
+    waitMs?: number;
+} & ProcessLifecycleOptions): Promise<{ stopped: number; survivors: OwnedProcessInfo[] }> {
+    const waitMs = options.waitMs ?? 15_000;
+    const killed = new Set<number>();
+
+    for (const p of options.processes) {
+        if (killProcess(p.pid, options)) killed.add(p.pid);
+    }
+
+    const survivors: OwnedProcessInfo[] = [];
+    for (const p of options.processes) {
+        if (!killed.has(p.pid)) {
+            survivors.push(p);
+            continue;
+        }
+        const exited = await waitForPidExit(p.pid, waitMs);
+        if (!exited) survivors.push(p);
+    }
+
+    // A process counts as stopped only when it left the process table; a failed
+    // kill or a post-kill timeout both land it in `survivors`.
+    return { stopped: options.processes.length - survivors.length, survivors };
+}
+
+export async function stopOwnedProcessesForPrefixes(options: {
+    prefixes: readonly string[];
+    excludePids?: readonly number[];
+    markers?: readonly string[];
+    waitMs?: number;
+    log?: (message: string) => void;
+} & ProcessLifecycleOptions): Promise<{ stopped: number; survivors: OwnedProcessInfo[] }> {
+    const processes = listOwnedNodeProcesses(options);
+    if (processes.length === 0) return { stopped: 0, survivors: [] };
+
+    options.log?.(`Stopping ${processes.length} owned process(es) under prefixes: ${options.prefixes.join(', ')}`);
+    const result = await stopOwnedProcesses({
+        processes,
+        waitMs: options.waitMs,
+        platform: options.platform,
+        execFileSync: options.execFileSync,
+    });
+
+    if (result.survivors.length > 0) {
+        options.log?.(`Could not stop ${result.survivors.length} owned process(es): ${result.survivors.map((s) => s.pid).join(', ')}`);
+    }
+    return result;
+}

package/src/commands/router-refine.ts

@@ -36,8 +36,10 @@ import {
     RefineExecFileAsync,
     RefineStageOutcome,
     classifyPatchEquivalenceFailure,
+    convergeDivergedSubmoduleGitlinks,
     recordMeshRefineStage,
     resolveRefineryAutoPublishSubmoduleMainCommits,
+    rootRebaseResolvingGitlinks,
     runMeshRefineEffectiveDiffGate,
     runMeshRefinePatchEquivalenceGate,
     runMeshRefineSubmoduleReachabilityGate,
@@ -539,6 +541,9 @@ async function computeBranchBaseDivergence(
 export async function refineSyncBaseStage(self: DaemonCommandRouter, ctx: RefineContext): Promise<RefineStageOutcome> {
             const { repoRoot, baseHead, node, branch, baseBranch, refineStages, execFileAsync } = ctx;
             let branchHead = ctx.branchHead;
+            // Converged submodule gitlink resolutions (path → rebased commit) from STEP 1;
+            // consumed by the gitlink-aware root rebase (STEP 2) to resolve gitlink conflicts.
+            let gitlinkResolutions: Array<{ path: string; rebasedCommit: string }> = [];
             const syncStarted = Date.now();
             const divergence = await computeBranchBaseDivergence(execFileAsync, node.workspace, baseHead, branchHead);
 
@@ -571,25 +576,87 @@ export async function refineSyncBaseStage(self: DaemonCommandRouter, ctx: Refine
                 const preRebasePe = await runMeshRefinePatchEquivalenceGate(repoRoot, baseHead, branchHead);
                 const alreadyMerged = !preRebasePe.actualPatchId && !!preRebasePe.expectedPatchId;
                 const submoduleConflict = preRebasePe.actionableHint?.kind === 'submodule_conflict';
-                if (alreadyMerged || submoduleConflict) {
+                if (alreadyMerged) {
                     recordMeshRefineStage(refineStages, 'sync_base', 'passed', syncStarted, {
                         ahead: divergence.ahead,
                         behind: divergence.behind,
                         rebased: false,
-                        reason: alreadyMerged ? 'already_merged_via_other_path_skip_rebase' : 'submodule_conflict_defer_to_patch_equivalence',
+                        reason: 'already_merged_via_other_path_skip_rebase',
                     });
                     return { kind: 'continue', ctx };
                 }
+                if (submoduleConflict) {
+                    // DS3: a "submodule conflict" here means base and branch advanced the
+                    // SAME submodule to DIVERGED sibling commits (neither an ancestor of the
+                    // other), so the gitlink stays in the diff and patch-equivalence fails.
+                    // Attempt to auto-converge it (STEP 1): rebase the branch-side submodule
+                    // commit onto the base-side commit INSIDE the worktree submodule, so the
+                    // base-side commit becomes a strict ancestor of the rebased tip. The root
+                    // rebase below (STEP 2) then resolves the gitlink conflict to that rebased
+                    // commit. Together this automates the documented manual strict-ff bypass
+                    // and keeps the landed oss history linear. On any real submodule content
+                    // conflict it backs out cleanly → we FALL BACK to the historical
+                    // defer→patch_equivalence path below.
+                    const converge = convergeDivergedSubmoduleGitlinks(node.workspace, repoRoot, baseHead, branchHead);
+                    if (converge.converged) {
+                        gitlinkResolutions = converge.resolutions;
+                        recordMeshRefineStage(refineStages, 'submodule_gitlink_converge', 'passed', syncStarted, {
+                            reason: 'submodule_diverged_auto_rebased',
+                            gitlinks: converge.gitlinks,
+                        });
+                        LOG.info('Mesh', `[Refinery] Auto-converged diverged submodule gitlink(s) onto base for node ${node.id}: `
+                            + converge.resolutions.map(r => `${r.path}→${r.rebasedCommit.slice(0, 12)}`).join(', '));
+                        // Fall through (do NOT return) → the gitlink-aware root rebase below runs.
+                    } else {
+                        // Fail-safe: convergence declined (conflict / unreachable / not a real
+                        // divergence) → preserve the historical defer→blocked_review behavior.
+                        recordMeshRefineStage(refineStages, 'submodule_gitlink_converge', 'skipped', syncStarted, {
+                            reason: 'submodule_conflict_defer_to_patch_equivalence',
+                            convergeReason: converge.reason,
+                            gitlinks: converge.gitlinks,
+                        });
+                        recordMeshRefineStage(refineStages, 'sync_base', 'passed', syncStarted, {
+                            ahead: divergence.ahead,
+                            behind: divergence.behind,
+                            rebased: false,
+                            reason: 'submodule_conflict_defer_to_patch_equivalence',
+                        });
+                        return { kind: 'continue', ctx };
+                    }
+                }
             } catch { /* fail-open: on gate error, fall through to the rebase */ }
 
             // behind>0: strictly-behind OR diverged. Rebase the branch onto the pinned
             // baseHead. A conflict aborts and terminates blocked_review (retryable=false —
             // a real content conflict needs human resolution, not a base-movement retry).
+            //
+            // When STEP 1 converged a diverged submodule gitlink, use the gitlink-aware
+            // root rebase (STEP 2): git's recursive merge refuses to auto-merge the still-
+            // diverged intermediate gitlink, so we drive the rebase and resolve each
+            // submodule-gitlink conflict to the converged commit. A non-gitlink conflict
+            // aborts and falls through to the same blocked_review handling as a plain
+            // rebase conflict below (via the thrown gitlinkRebaseError).
             const rebaseStarted = Date.now();
             try {
-                execFileSync('git', ['rebase', baseHead], { cwd: node.workspace, stdio: ['ignore', 'pipe', 'pipe'] });
+                if (gitlinkResolutions.length > 0) {
+                    const gitlinkRebase = rootRebaseResolvingGitlinks(node.workspace, baseHead, gitlinkResolutions);
+                    if (!gitlinkRebase.ok) {
+                        // Surface as a rebase failure so the shared blocked_review handling
+                        // (submodule-hint recovery included) runs — nothing was left mid-rebase
+                        // (rootRebaseResolvingGitlinks aborts on failure).
+                        const err: any = new Error(`gitlink-aware rebase aborted: ${gitlinkRebase.reason || 'unknown'}`);
+                        err.gitlinkRebaseReason = gitlinkRebase.reason;
+                        err.gitlinkRebaseConflicts = gitlinkRebase.conflictPaths;
+                        err.alreadyAborted = true;
+                        throw err;
+                    }
+                } else {
+                    execFileSync('git', ['rebase', baseHead], { cwd: node.workspace, stdio: ['ignore', 'pipe', 'pipe'] });
+                }
             } catch (rebaseErr: any) {
-                try { execFileSync('git', ['rebase', '--abort'], { cwd: node.workspace, stdio: 'ignore' }); } catch { /* ignore */ }
+                if (!rebaseErr?.alreadyAborted) {
+                    try { execFileSync('git', ['rebase', '--abort'], { cwd: node.workspace, stdio: 'ignore' }); } catch { /* ignore */ }
+                }
                 // A rebase conflict on a submodule/gitlink divergence is a SPECIAL case the
                 // patch-equivalence gate describes with a rich actionable hint (which
                 // submodule, base vs branch commit, how to resolve). Run that gate against

package/src/commands/router.ts

@@ -227,6 +227,14 @@ const MESH_FORWARDABLE_SESSION_COMMANDS = new Set([
     // MUTATES the worker PTY, so forwarding to the real owner (not a wrong local session) is
     // doubly important. The daemon re-enforces the destructive-key confirm gate after the forward.
     'send_keys',
+    // interactive_prompt_response (mesh_answer_question, mission f1d25e11): the coordinator
+    // answers a REMOTE worker's AskUserQuestion (waiting_choice). The answer must reach the
+    // OWNING worker session's live instance — its activeInteractivePrompt (the authoritative
+    // prompt the labels/indexes resolve against) and its adapter.setInteractivePromptResponse
+    // live only there. Without forwarding, the coordinator's local high-family handler returns
+    // 'No running instance for session …' and the question is never answered — the exact
+    // remote-worker forwarding gap of mission 6938892f, now closed for questions too.
+    'interactive_prompt_response',
 ]);
 
 function normalizeCommandSource(source: string): CommandLogEntry['source'] {

package/src/commands/upgrade-helper.ts

@@ -4,11 +4,18 @@ import * as fs from 'fs';
 import * as os from 'os';
 import * as path from 'path';
 import {
+  ADHDEV_OWNED_MARKERS,
   createDefaultWindowsAtomicHooks,
   findPortableNode22,
   performWindowsAtomicUpgrade,
   resolveWindowsInstallerLayout,
 } from './windows-atomic-upgrade.js';
+import {
+  getProcessCommandLine,
+  killProcess,
+  stopOwnedProcessesForPrefixes,
+  waitForPidExit,
+} from './process-lifecycle.js';
 
 const UPGRADE_HELPER_ENV = 'ADHDEV_DAEMON_UPGRADE_HELPER';
 
@@ -137,19 +144,68 @@ function resolveInstallPrefixFromPackageRoot(packageRoot: string, packageName: s
   return maybeLibDir;
 }
 
+// True when `prefix` is the bin dir of a portable Node 22 the installer manages
+// under ~/.adhdev/tools/node22/<node-vX>/. A `npm i -g adhdev` run while that
+// portable node is the active `node` installs adhdev into node's own default
+// global prefix (= that dir) — a "legacy node22-prefix" install that lives at
+// the FRONT of PATH (Enable-NodePath prepends node22) and shadows the canonical
+// dispatcher shims in ~/.adhdev/npm-global. Because self-upgrade reuses the
+// running prefix, that install then re-installs into the same node22 dir forever
+// and never converts to the dispatcher. Detecting it lets us force convergence.
+function isPortableNode22Prefix(prefix: string | null, homeDir: string): boolean {
+  if (!prefix) return false;
+  const portableRoot = path.join(homeDir, '.adhdev', 'tools', 'node22');
+  const normalizedPrefix = path.resolve(prefix).replace(/[\\/]+$/, '').toLowerCase();
+  const normalizedRoot = path.resolve(portableRoot).replace(/[\\/]+$/, '').toLowerCase();
+  return normalizedPrefix === normalizedRoot || normalizedPrefix.startsWith(`${normalizedRoot}${path.sep.toLowerCase()}`);
+}
+
+// Redirect a legacy node22-prefix install to the canonical dispatcher install
+// root so resolveWindowsInstallerLayout accepts it and the atomic-upgrade
+// publishes the ~/.adhdev/npm-global pointer + shims. Prefer the version the
+// dispatcher pointer already names (so we sit on the real active dispatcher
+// prefix); otherwise synthesize a stable migration sentinel under npm-installs.
+// resolveWindowsInstallerLayout only requires a `npm-installs/version-*` path —
+// performWindowsAtomicUpgrade stages a fresh version- prefix of its own and uses
+// this only as the "old prefix" to stop/clean, so a non-existent path is a no-op.
+function canonicalDispatcherInstallPrefix(homeDir: string): string {
+  const installRoot = path.join(homeDir, '.adhdev', 'npm-installs');
+  const pointerPath = path.join(homeDir, '.adhdev', 'npm-global', '.adhdev-current');
+  try {
+    const activeVersion = fs.readFileSync(pointerPath, 'utf8').trim();
+    if (activeVersion.startsWith('version-')) return path.join(installRoot, activeVersion);
+  } catch {
+    // No dispatcher pointer yet (first migration off the legacy layout).
+  }
+  return path.join(installRoot, 'version-legacy-migrate');
+}
+
 export function resolveCurrentGlobalInstallSurface(options: {
   packageName: string;
   currentCliPath?: string;
   nodeExecutable?: string;
   platform?: NodeJS.Platform;
+  homeDir?: string;
 }): CurrentGlobalInstallSurface {
   const packageRoot = findCurrentPackageRoot(options.currentCliPath || process.argv[1], options.packageName);
   const npmInvocation = resolveSiblingNpmInvocation(options.nodeExecutable || process.execPath, options.platform);
+  const platform = options.platform || process.platform;
+  const homeDir = options.homeDir || os.homedir();
+  let installPrefix = packageRoot ? resolveInstallPrefixFromPackageRoot(packageRoot, options.packageName) : null;
+  // FIX C: on Windows, never let a self-upgrade perpetuate the legacy
+  // node22-prefix install. If the running adhdev lives under ~/.adhdev/tools/
+  // node22, force the install onto the canonical dispatcher prefix so the update
+  // converges to the ~/.adhdev/npm-global pointer + shims. Scoped to win32 AND a
+  // tools/node22 prefix so npm-linked dev / standalone / real dispatcher installs
+  // are untouched.
+  if (platform === 'win32' && isPortableNode22Prefix(installPrefix, homeDir)) {
+    installPrefix = canonicalDispatcherInstallPrefix(homeDir);
+  }
   return {
     npmExecutable: npmInvocation.executable,
     npmArgsPrefix: npmInvocation.argsPrefix,
     packageRoot,
-    installPrefix: packageRoot ? resolveInstallPrefixFromPackageRoot(packageRoot, options.packageName) : null,
+    installPrefix,
     execOptions: npmInvocation.execOptions,
   };
 }
@@ -235,77 +291,11 @@ export function execNpmCommandSync(
   );
 }
 
-function killPid(pid: number): boolean {
-  try {
-    if (process.platform === 'win32') {
-      execFileSync('taskkill', ['/PID', String(pid), '/T', '/F'], { stdio: 'ignore', windowsHide: true });
-    } else {
-      process.kill(pid, 'SIGTERM');
-    }
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-function getWindowsProcessCommandLine(pid: number): string | null {
-  const pidFilter = `ProcessId=${pid}`;
-  try {
-    const psOut = execFileSync('powershell.exe', [
-      '-NoProfile',
-      '-NonInteractive',
-      '-ExecutionPolicy', 'Bypass',
-      '-Command',
-      `(Get-CimInstance Win32_Process -Filter "${pidFilter}").CommandLine`,
-    ], { encoding: 'utf8', timeout: 5000, stdio: ['ignore', 'pipe', 'ignore'], windowsHide: true }).trim();
-    if (psOut) return psOut;
-  } catch {
-    // fall through to wmic fallback
-  }
-
-  try {
-    const wmicOut = execFileSync('wmic', [
-      'process', 'where', pidFilter, 'get', 'CommandLine',
-    ], { encoding: 'utf8', timeout: 3000, stdio: ['ignore', 'pipe', 'ignore'], windowsHide: true }).trim();
-    if (wmicOut) return wmicOut;
-  } catch {
-    // noop
-  }
-  return null;
-}
-
-function getProcessCommandLine(pid: number): string | null {
-  if (!Number.isFinite(pid) || pid <= 0) return null;
-  if (process.platform === 'win32') return getWindowsProcessCommandLine(pid);
-  try {
-    const text = execFileSync('ps', ['-o', 'command=', '-p', String(pid)], {
-      encoding: 'utf8',
-      timeout: 3000,
-      stdio: ['ignore', 'pipe', 'ignore'],
-    }).trim();
-    return text || null;
-  } catch {
-    return null;
-  }
-}
-
 function isManagedSessionHostPid(pid: number): boolean {
   const commandLine = getProcessCommandLine(pid);
   return !!commandLine && /session-host-daemon/i.test(commandLine);
 }
 
-async function waitForPidExit(pid: number, timeoutMs: number): Promise<void> {
-  const start = Date.now();
-  while (Date.now() - start < timeoutMs) {
-    try {
-      process.kill(pid, 0);
-      await new Promise((resolve) => setTimeout(resolve, 250));
-    } catch {
-      return;
-    }
-  }
-}
-
 export async function stopSessionHostProcesses(appName: string): Promise<void> {
   const pidFile = path.join(os.homedir(), '.adhdev', `${appName}-session-host.pid`);
   let killedPid: number | null = null;
@@ -313,7 +303,7 @@ export async function stopSessionHostProcesses(appName: string): Promise<void> {
     if (fs.existsSync(pidFile)) {
       const pid = Number.parseInt(fs.readFileSync(pidFile, 'utf8').trim(), 10);
       if (Number.isFinite(pid) && pid !== process.pid && isManagedSessionHostPid(pid)) {
-        if (killPid(pid)) killedPid = pid;
+        if (killProcess(pid)) killedPid = pid;
       }
     }
   } catch {
@@ -430,7 +420,7 @@ export async function stopForeignNativeAddonHolders(
     appendUpgradeLog(
       `Foreign native-addon holder found: pid ${holder.pid}${holder.commandLine ? ` — ${holder.commandLine}` : ''}`,
     );
-    const killed = killPid(holder.pid);
+    const killed = killProcess(holder.pid);
     if (killed) {
       await waitForPidExit(holder.pid, 15000);
       appendUpgradeLog(`Terminated foreign native-addon holder pid ${holder.pid}`);
@@ -600,21 +590,55 @@ async function runDaemonUpgradeHelper(payload: DaemonUpgradeHelperPayload): Prom
       throw new Error(`portable Node.js 22 npm CLI is missing: ${npmCliPath}`);
     }
     appendUpgradeLog(`Installer-managed pointer layout detected; active prefix will remain untouched: ${windowsInstallerLayout.activePrefix}`);
-    await performWindowsAtomicUpgrade({
-      layout: windowsInstallerLayout,
-      packageName: payload.packageName,
-      targetVersion: payload.targetVersion,
-      portableNode,
-      hooks: createDefaultWindowsAtomicHooks({
+
+    // Terminate any ADHDev-owned process still executing from the current active
+    // prefix or the legacy stable shim tree before activation. The parent daemon
+    // and this helper itself are excluded: the parent is already exiting, and the
+    // helper must survive to complete the upgrade.
+    const upgradePids = [process.pid, payload.parentPid].filter((n): n is number => Number.isFinite(n) && n > 0);
+    const preStop = await stopOwnedProcessesForPrefixes({
+      prefixes: [windowsInstallerLayout.activePrefix, windowsInstallerLayout.stablePrefix],
+      excludePids: upgradePids,
+      markers: Array.from(ADHDEV_OWNED_MARKERS),
+      waitMs: 15_000,
+      log: appendUpgradeLog,
+    });
+    if (preStop.survivors.length > 0) {
+      throw new Error(
+        `Cannot upgrade: owned processes still running under current prefix: ${preStop.survivors.map((s) => s.pid).join(', ')}`
+      );
+    }
+
+    try {
+      await performWindowsAtomicUpgrade({
+        layout: windowsInstallerLayout,
         packageName: payload.packageName,
         targetVersion: payload.targetVersion,
-        npmCliPath,
-        restartArgv,
-        cwd: payload.cwd || process.cwd(),
-        env: Object.fromEntries(Object.entries(process.env).filter(([key]) => key !== UPGRADE_HELPER_ENV)),
-        log: appendUpgradeLog,
-      }),
-    });
+        portableNode,
+        excludePids: upgradePids,
+        hooks: createDefaultWindowsAtomicHooks({
+          packageName: payload.packageName,
+          targetVersion: payload.targetVersion,
+          npmCliPath,
+          restartArgv,
+          cwd: payload.cwd || process.cwd(),
+          env: Object.fromEntries(Object.entries(process.env).filter(([key]) => key !== UPGRADE_HELPER_ENV)),
+          log: appendUpgradeLog,
+        }),
+      });
+    } catch (error: any) {
+      // performWindowsAtomicUpgrade already rolled the pointer/shims back to the
+      // prior version before rethrowing. Without a durable notice that rollback
+      // was silent — the daemon simply kept running the old version (the rc.6
+      // stuck-upgrade defect). Leave an actionable last-error file naming the
+      // target that failed its health/version gate.
+      emitUpgradeFailureNotice([
+        `adhdev ${payload.packageName}@${payload.targetVersion} upgrade failed and was rolled back: ${error?.message || String(error)}`,
+        `Previous version preserved (active prefix: ${windowsInstallerLayout.activePrefix}).`,
+        'See daemon-upgrade.log for the full install/health trace. The next daemon start will retry.',
+      ]);
+      throw error;
+    }
     try { fs.unlinkSync(getUpgradeFailureNoticePath()); } catch { /* no previous failure notice */ }
     appendUpgradeLog('Installer-managed Windows atomic upgrade completed');
     return;