@ddtcorex/dsh-maestro-supervisor 0.7.10 → 0.8.2

package/lib/snapshot.d.ts

@@ -1,22 +1,59 @@
-interface ManifestEntry {
-    path: string;
-    sha256: string;
-}
-interface Manifest {
+export interface SnapshotResult {
     ts: string;
-    files: ManifestEntry[];
+    /** Files (and symlinks) copied into this snapshot. */
+    files: number;
+    /** Entries that could not be copied; the snapshot stays usable either way. */
+    skipped: Array<{
+        path: string;
+        reason: string;
+    }>;
 }
-export declare function writeLKG(dshHome: string, lkgRoot: string): Promise<{
-    ts: string;
-    manifest: Manifest;
-}>;
+export interface SnapshotDeps {
+    /**
+     * Copy one regular file, preserving `mode`. Injectable so a failing entry
+     * (the EACCES a read-only attachment object produces) can be table-tested
+     * without depending on the host's uid or filesystem quirks.
+     */
+    copyFile?: (src: string, dest: string, mode: number) => void;
+}
+/**
+ * DSH-home entries the last-known-good snapshot deliberately never copies.
+ *
+ * The LKG exists to recover a boot that fails while loading the plugin tree, so
+ * it holds boot **configuration**: `profiles/` (the plugin tree with its
+ * lockfile, `cordis.patch.yml` and sidecars), the per-plugin config directories
+ * and the settings documents. Everything below is runtime **data** — it is
+ * written continuously while `dsh web` runs, so restoring a snapshot of it can
+ * only lose newer state, and some of it is hostile to a bulk copy:
+ *
+ * - `sessions/` — append-only transcripts. Restoring a stale copy over live
+ *   sessions drops every turn recorded after the snapshot, i.e. the recovery
+ *   path would lose the log it is supposed to protect.
+ * - `attachments/` — content-addressed blobs stored mode `0400`. That read-only
+ *   bit is exactly what made the 2026-09-13 rollback abort with
+ *   `EACCES: Permission denied '.../attachments/v1/objects/f8'`.
+ * - `plugins-src/` — plugin source cache, re-fetched on demand (~400 MB host).
+ * - `.supervisor/` — the LKG root itself lives inside the DSH home, so copying
+ *   it would recurse into every retained snapshot.
+ *
+ * This list is data, not a heuristic: the copy loop and the restore loop both
+ * consult `isLkgExcluded()`, and the table test pins the rule.
+ */
+export declare const LKG_EXCLUDED_ENTRIES: readonly string[];
+/**
+ * True when a DSH-home-relative path must never enter (or leave) the LKG.
+ *
+ * The named entries match the first path segment; `*.log` matches by basename
+ * anywhere, because append-only logs are data at any depth and a restored stale
+ * `dsh-web.log` would poison the boot-boundary scan.
+ */
+export declare function isLkgExcluded(relPath: string): boolean;
+/** Human-readable, bounded reason for a per-entry copy failure. */
+export declare function failureReason(e: unknown): string;
+export declare function writeLKG(dshHome: string, lkgRoot: string, deps?: SnapshotDeps): Promise<SnapshotResult>;
 export declare function pruneByAge(root: string, maxAgeMs: number): Promise<void>;
 export declare function pruneBySize(root: string, maxBytes: number): Promise<void>;
 export declare function isDuplicateLKG(dshHome: string, lkgRoot: string): Promise<boolean>;
 export declare function verifyLKG(lkgPath: string): Promise<boolean>;
 export declare function rotateLKG(lkgRoot: string, keep?: number): Promise<void>;
-export declare function writeFailed(dshHome: string, failedRoot: string): Promise<{
-    ts: string;
-    manifest: Manifest;
-}>;
-export {};
+export declare function writeFailed(dshHome: string, failedRoot: string): Promise<SnapshotResult>;

package/lib/snapshot.js

@@ -1,6 +1,51 @@
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import * as crypto from 'node:crypto';
+/**
+ * DSH-home entries the last-known-good snapshot deliberately never copies.
+ *
+ * The LKG exists to recover a boot that fails while loading the plugin tree, so
+ * it holds boot **configuration**: `profiles/` (the plugin tree with its
+ * lockfile, `cordis.patch.yml` and sidecars), the per-plugin config directories
+ * and the settings documents. Everything below is runtime **data** — it is
+ * written continuously while `dsh web` runs, so restoring a snapshot of it can
+ * only lose newer state, and some of it is hostile to a bulk copy:
+ *
+ * - `sessions/` — append-only transcripts. Restoring a stale copy over live
+ *   sessions drops every turn recorded after the snapshot, i.e. the recovery
+ *   path would lose the log it is supposed to protect.
+ * - `attachments/` — content-addressed blobs stored mode `0400`. That read-only
+ *   bit is exactly what made the 2026-09-13 rollback abort with
+ *   `EACCES: Permission denied '.../attachments/v1/objects/f8'`.
+ * - `plugins-src/` — plugin source cache, re-fetched on demand (~400 MB host).
+ * - `.supervisor/` — the LKG root itself lives inside the DSH home, so copying
+ *   it would recurse into every retained snapshot.
+ *
+ * This list is data, not a heuristic: the copy loop and the restore loop both
+ * consult `isLkgExcluded()`, and the table test pins the rule.
+ */
+export const LKG_EXCLUDED_ENTRIES = [
+    'sessions',
+    'attachments',
+    'plugins-src',
+    '.supervisor',
+];
+/**
+ * True when a DSH-home-relative path must never enter (or leave) the LKG.
+ *
+ * The named entries match the first path segment; `*.log` matches by basename
+ * anywhere, because append-only logs are data at any depth and a restored stale
+ * `dsh-web.log` would poison the boot-boundary scan.
+ */
+export function isLkgExcluded(relPath) {
+    const normalized = relPath.replace(/\\/g, '/').replace(/^\.\//, '').replace(/^\/+/, '');
+    const segments = normalized.split('/').filter(s => s.length > 0 && s !== '.');
+    if (!segments.length)
+        return false;
+    if (LKG_EXCLUDED_ENTRIES.includes(segments[0]))
+        return true;
+    return segments[segments.length - 1].endsWith('.log');
+}
 function sha256File(filePath) {
     const data = fs.readFileSync(filePath);
     return crypto.createHash('sha256').update(data).digest('hex');
@@ -16,7 +61,78 @@ function walkFiles(dir, base = dir) {
     }
     return out;
 }
-export async function writeLKG(dshHome, lkgRoot) {
+/** Human-readable, bounded reason for a per-entry copy failure. */
+export function failureReason(e) {
+    const err = e;
+    const code = typeof err?.code === 'string' && err.code ? `${err.code}: ` : '';
+    const message = typeof err?.message === 'string' ? err.message : String(e);
+    return `${code}${message}`.slice(0, 300);
+}
+/**
+ * Copy one snapshot entry, collecting — never throwing — per-entry failures
+ * (D2). `fs.cpSync` aborts the whole snapshot on the first unreadable object,
+ * which is precisely how one 0400 attachment file stopped the rollback that
+ * exists to rescue a broken boot.
+ */
+function copyEntry(state, src, dest, rel) {
+    if (isLkgExcluded(rel))
+        return;
+    let st;
+    try {
+        st = fs.lstatSync(src);
+    }
+    catch (e) {
+        state.skipped.push({ path: rel, reason: failureReason(e) });
+        return;
+    }
+    if (st.isDirectory()) {
+        let names;
+        try {
+            // Directory modes are replicated only in their permission-to-traverse
+            // sense: the snapshot itself must stay readable/removable even when the
+            // source directory is not (a 0000 source dir must not produce a snapshot
+            // that nothing — including retention — can delete).
+            fs.mkdirSync(dest, { recursive: true, mode: (st.mode & 0o7777) | 0o700 });
+            names = fs.readdirSync(src);
+        }
+        catch (e) {
+            state.skipped.push({ path: rel, reason: failureReason(e) });
+            return;
+        }
+        for (const name of names) {
+            copyEntry(state, path.join(src, name), path.join(dest, name), rel ? `${rel}/${name}` : name);
+        }
+        return;
+    }
+    if (st.isSymbolicLink()) {
+        try {
+            const link = fs.readlinkSync(src);
+            fs.mkdirSync(path.dirname(dest), { recursive: true });
+            try {
+                fs.unlinkSync(dest);
+            }
+            catch { }
+            fs.symlinkSync(link, dest);
+            state.copied++;
+        }
+        catch (e) {
+            state.skipped.push({ path: rel, reason: failureReason(e) });
+        }
+        return;
+    }
+    if (st.isFile()) {
+        try {
+            fs.mkdirSync(path.dirname(dest), { recursive: true });
+            state.copyFile(src, dest, st.mode & 0o7777);
+            state.copied++;
+        }
+        catch (e) {
+            state.skipped.push({ path: rel, reason: failureReason(e) });
+        }
+    }
+    // Sockets/FIFOs/devices are not boot configuration: ignored on purpose.
+}
+export async function writeLKG(dshHome, lkgRoot, deps = {}) {
     // Dedupe: skip snapshot if current state identical to latest LKG (prevents 5-min unconditional growth)
     try {
         if (await isDuplicateLKG(dshHome, lkgRoot)) {
@@ -31,36 +147,68 @@ export async function writeLKG(dshHome, lkgRoot) {
             const latest = entries[entries.length - 1];
             const manifestPath = path.join(lkgRoot, latest, 'manifest.json');
             const manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf-8'));
-            return { ts: latest, manifest };
+            return { ts: latest, files: manifest.files?.length ?? 0, skipped: [] };
         }
     }
     catch { }
     const ts = new Date().toISOString().replace(/[:.]/g, '-');
     const dest = path.join(lkgRoot, ts);
-    fs.mkdirSync(dest, { recursive: true });
-    // Copy DSH home contents (if exists, copy recursively) — skip .supervisor to avoid recursion
-    if (fs.existsSync(dshHome)) {
-        for (const entry of fs.readdirSync(dshHome)) {
-            if (entry === '.supervisor')
-                continue;
-            const src = path.join(dshHome, entry);
-            const dst = path.join(dest, entry);
-            fs.cpSync(src, dst, { recursive: true });
-        }
-    }
-    const files = fs.existsSync(dest) ? walkFiles(dest) : [];
+    try {
+        fs.mkdirSync(dest, { recursive: true });
+    }
+    catch (e) {
+        // No snapshot is better than an exception thrown into the rollback path.
+        return { ts, files: 0, skipped: [{ path: lkgRoot, reason: failureReason(e) }] };
+    }
+    const state = {
+        dshHome,
+        copyFile: deps.copyFile ?? ((src, dst, mode) => {
+            fs.copyFileSync(src, dst);
+            try {
+                fs.chmodSync(dst, mode);
+            }
+            catch { }
+        }),
+        copied: 0,
+        skipped: [],
+    };
+    // Copy only the boot configuration (D1), one entry at a time so a single
+    // unreadable file is recorded and skipped instead of aborting the snapshot (D2).
+    let topLevel = [];
+    try {
+        if (fs.existsSync(dshHome))
+            topLevel = fs.readdirSync(dshHome);
+    }
+    catch (e) {
+        state.skipped.push({ path: '.', reason: failureReason(e) });
+    }
+    for (const entry of topLevel) {
+        copyEntry(state, path.join(dshHome, entry), path.join(dest, entry), entry);
+    }
+    let fileList = [];
+    try {
+        fileList = fs.existsSync(dest) ? walkFiles(dest) : [];
+    }
+    catch (e) {
+        state.skipped.push({ path: 'manifest', reason: failureReason(e) });
+    }
     const manifest = {
         ts,
-        files: files
+        files: fileList
             .filter(f => f !== 'manifest.json')
             .map(f => ({ path: f, sha256: sha256File(path.join(dest, f)) })),
     };
-    fs.writeFileSync(path.join(dest, 'manifest.json'), JSON.stringify(manifest, null, 2));
+    try {
+        fs.writeFileSync(path.join(dest, 'manifest.json'), JSON.stringify(manifest, null, 2));
+    }
+    catch (e) {
+        state.skipped.push({ path: 'manifest.json', reason: failureReason(e) });
+    }
     // Retention: keep only 3 most recent, plus age (7d) and size (5GB) caps — prevents unbounded 40GB+ growth
     await rotateLKG(lkgRoot, 3).catch(() => { });
     await pruneByAge(lkgRoot, 7 * 24 * 60 * 60 * 1000).catch(() => { });
     await pruneBySize(lkgRoot, 5 * 1024 * 1024 * 1024).catch(() => { });
-    return { ts, manifest };
+    return { ts, files: state.copied, skipped: state.skipped };
 }
 export async function pruneByAge(root, maxAgeMs) {
     if (!fs.existsSync(root))
@@ -150,7 +298,9 @@ export async function isDuplicateLKG(dshHome, lkgRoot) {
             let newestFileMtime = 0;
             if (fs.existsSync(dshHome)) {
                 for (const entry of fs.readdirSync(dshHome)) {
-                    if (entry === '.supervisor')
+                    // Same scope as the copy loop: runtime data changes constantly and
+                    // must not defeat the dedupe for the configuration being snapshotted.
+                    if (isLkgExcluded(entry))
                         continue;
                     try {
                         const s = fs.statSync(path.join(dshHome, entry));

package/lib/supervisor.d.ts

@@ -1,15 +1,25 @@
-import type { HealthState } from './health-poller.js';
+import { type HealthState } from './health-poller.js';
 import type { RestartRequest } from './restart-guards.js';
+import { type RestartOutcome } from './intents.js';
 import { type MintCookieOpts } from './dsh-session.js';
+/** Partial-restore report a rollback may hand back (cli.ts wires RestoreResult). */
+export interface RollbackSummary {
+    target?: string;
+    restored?: number;
+    skipped?: Array<{
+        path: string;
+        reason: string;
+    }>;
+}
 export interface SupervisorDeps {
     pollHealth: () => Promise<HealthState>;
     writeLKG: () => Promise<{
         ts: string;
-        manifest: any;
+        manifest?: any;
     }>;
     writeFailed: () => Promise<{
         ts: string;
-        manifest: any;
+        manifest?: any;
     }>;
     writeReport: (opts: {
         ts: string;
@@ -18,12 +28,13 @@ export interface SupervisorDeps {
         logTail?: string;
         gitDiff?: string;
     }) => Promise<string>;
-    rollback: (ts?: string) => Promise<void>;
+    rollback: (ts?: string) => Promise<RollbackSummary | void>;
     restartWeb?: () => Promise<void>;
     notify: (msg: string) => Promise<void>;
     intervalMs?: number;
     debounceMs?: number;
     downThreshold?: number;
+    bootGraceMs?: number;
     getTime?: () => number;
     isPlannedRestartActive?: () => boolean | Promise<boolean>;
     writePlannedRestart?: (ttlMs?: number) => void;
@@ -45,7 +56,11 @@ export interface SupervisorDeps {
     }>;
     readRestartRequest?: () => RestartRequest | undefined;
     onRestartRequestHandled?: (req: RestartRequest) => void;
+    writeOutcome?: (sessionId: string, outcome: RestartOutcome) => void;
+    listenerPid?: (port: number) => number | undefined;
 }
+/** PID holding a 127.0.0.1 listener on the port, or undefined. Never throws. */
+export declare function defaultListenerPid(port: number): number | undefined;
 export declare function resumeViaRpc(ids: string[], fetchFn?: (url: string, init: RequestInit) => Promise<Response>, extraHeaders?: Record<string, string>): Promise<{
     resumed: string[];
 }>;
@@ -86,9 +101,16 @@ export declare class Supervisor {
     private getEffectiveDownThreshold;
     private getEffectiveDegradedThreshold;
     private getEffectivePollTimeoutMs;
+    private getEffectiveBootGraceMs;
     private findInterruptedRecent;
     private collectGitDiff;
     private attemptAutoResume;
+    /**
+     * D4: a restore that could not put every entry back must be surfaced loudly.
+     * Without this, a half-restored tree reads exactly like a clean recovery in
+     * the log and in the operator's Telegram feed.
+     */
+    private reportRollbackResult;
     private handleDebugResult;
     tick(): Promise<void>;
     start(): Promise<void>;

package/lib/supervisor.js

@@ -1,3 +1,4 @@
+import { classifyFetchFailure } from './health-poller.js';
 import { runDebugAgent } from './debug-agent.js';
 import { findInterrupted as defaultFindInterrupted, parseDuration } from './resume.js';
 import * as fs from 'node:fs';
@@ -5,9 +6,23 @@ import * as path from 'node:path';
 import * as os from 'node:os';
 import { resolveHarnessRoot } from './paths.js';
 import { readSupervisorConfig } from './config.js';
-import { writePlannedRestart as defaultWritePlannedRestart, checkPlannedRestart as defaultCheckPlannedRestart, clearPlannedRestart, PLANNED_RESTART_TTL_MS } from './restart-guards.js';
+import { writePlannedRestart as defaultWritePlannedRestart, checkPlannedRestart as defaultCheckPlannedRestart, clearPlannedRestart } from './restart-guards.js';
+import { writeRestartOutcome as defaultWriteOutcome } from './intents.js';
+import { execFileSync } from 'node:child_process';
 import { mintDshSessionCookie } from './dsh-session.js';
-import { buildKillStalePortsCommand } from './restart-guards.js';
+/** PID holding a 127.0.0.1 listener on the port, or undefined. Never throws. */
+export function defaultListenerPid(port) {
+    try {
+        const out = execFileSync('ss', ['-tlnp'], { encoding: 'utf8' });
+        for (const line of out.split('\n')) {
+            const m = new RegExp(`127\\.0\\.0\\.1:${port}\\s[^]*?pid=(\\d+)`).exec(line);
+            if (m)
+                return Number(m[1]);
+        }
+    }
+    catch { }
+    return undefined;
+}
 export async function resumeViaRpc(ids, fetchFn = globalThis.fetch, extraHeaders = {}) {
     const rpcId = crypto.randomUUID();
     const response = await fetchFn('http://127.0.0.1:3080/dsh-maestro-supervisor-resume/resume', {
@@ -71,31 +86,22 @@ export class Supervisor {
         return this.deps.clearPlannedRestart ?? clearPlannedRestart;
     }
     async restartWeb() {
-        this.getWritePlannedRestart()(30000);
+        const grace = await this.getEffectiveBootGraceMs();
+        // Marker first, and its TTL is the boot budget — not 30 s. The observed
+        // boot took 1m52s: after +30 s every poll was judged as a crash, which is
+        // exactly how the 2026-09-13 rollback report was produced (D5).
+        this.getWritePlannedRestart()(grace);
         if (this.deps.restartWeb) {
+            // Injected implementation (cli.ts daemon wiring, tests): it owns the
+            // boot lock, so the single-flight guarantee stays in one place.
             await this.deps.restartWeb();
             return;
         }
-        // Fallback systemctl path (mirrors cli.ts) — kept for standalone use
-        const { execSync } = await import('node:child_process');
-        try {
-            execSync(buildKillStalePortsCommand(), { timeout: 5000, stdio: 'pipe' });
-        }
-        catch { }
-        try {
-            execSync('systemctl --user is-active --quiet dsh-web.service && systemctl --user restart dsh-web.service || systemctl --user start dsh-web.service', { timeout: 15000, stdio: 'pipe' });
-            return;
-        }
-        catch { }
-        try {
-            execSync('systemctl --user start dsh-web.service', { timeout: 15000, stdio: 'pipe' });
-            return;
+        const { performSingleBootRestart } = await import('./restart-web.js');
+        const res = await performSingleBootRestart({ bootGraceMs: grace });
+        if (!res.restarted) {
+            await this.deps.notify(`restart skipped: ${res.reason ?? 'boot lock held'}`).catch(() => { });
         }
-        catch { }
-        const { resolveDeepseekHarnessDir } = await import('./paths.js');
-        const harnessRoot = resolveDeepseekHarnessDir();
-        const logPath = path.join(os.homedir(), '.dsh/dsh-web.log');
-        execSync(`setsid nohup bash -c 'export NVM_DIR="$HOME/.nvm"; [ -s "$NVM_DIR/nvm.sh" ] && . "$NVM_DIR/nvm.sh"; cd ${JSON.stringify(harnessRoot)} && exec node --import tsx/esm apps/cli/src/bin.ts web --no-open >> ${JSON.stringify(logPath)} 2>&1' &`, { timeout: 5000 });
     }
     getRunDebugAgent() {
         return this.deps.runDebugAgent ?? runDebugAgent;
@@ -242,6 +248,17 @@ export class Supervisor {
         catch { }
         return 20000;
     }
+    async getEffectiveBootGraceMs() {
+        if (this.deps.bootGraceMs !== undefined)
+            return this.deps.bootGraceMs;
+        try {
+            const cfg = await readSupervisorConfig();
+            if (typeof cfg.bootGraceMs === 'number' && cfg.bootGraceMs > 0)
+                return cfg.bootGraceMs;
+        }
+        catch { }
+        return 180_000;
+    }
     async findInterruptedRecent(withinMs) {
         const ms = withinMs ?? this.getResumeWithinMs();
         // Prefer injected mock for testability
@@ -312,6 +329,17 @@ export class Supervisor {
             await this.deps.notify(`RESUME FAILED: ${ids.length} interrupted sessions (${ids.slice(0, 3).join(', ')}) — ${e?.message ?? String(e)}`).catch(() => { });
         }
     }
+    /**
+     * D4: a restore that could not put every entry back must be surfaced loudly.
+     * Without this, a half-restored tree reads exactly like a clean recovery in
+     * the log and in the operator's Telegram feed.
+     */
+    async reportRollbackResult(summary, reportPath) {
+        if (!summary || !summary.skipped?.length)
+            return;
+        const first = summary.skipped.slice(0, 3).map(s => `${s.path} (${s.reason})`).join('; ');
+        await this.deps.notify(`ROLLBACK PARTIAL: ${summary.restored ?? 0} restored, ${summary.skipped.length} skipped — ${first} (report: ${reportPath})`).catch(() => { });
+    }
     handleDebugResult(reportPath, res) {
         if (res.fixed) {
             void this.deps.notify(`FIXED: debug-agent fixed ${reportPath} — ${res.reason}`).catch(() => { });
@@ -352,13 +380,24 @@ export class Supervisor {
                         // own 30s TTL runs out.
                         this.lastRollback = this.deps.getTime ? this.deps.getTime() : Date.now();
                         await this.restartWeb();
-                        // Supervisor.restartWeb() wrote a 30s marker; extend it past a slow
-                        // boot. It is cleared only once the boot proves healthy below.
-                        this.getWritePlannedRestart()(PLANNED_RESTART_TTL_MS);
+                        // restartWeb() already wrote the marker with the boot budget as its
+                        // TTL; the marker is cleared on the first healthy poll instead.
                         await this.deps.notify(`restarted dsh-web after self-restart by session ${restartReq.callerSessionId}`);
                     }
                     catch (e) {
                         await this.deps.notify(`self-restart dsh-web failed: ${e?.message ?? String(e)}`).catch(() => { });
+                        if (restartReq.callerSessionId) {
+                            try {
+                                ;
+                                (this.deps.writeOutcome ?? defaultWriteOutcome)(restartReq.callerSessionId, {
+                                    state: 'failed',
+                                    oldPid: restartReq.oldPid,
+                                    swappedAt: this.deps.getTime ? this.deps.getTime() : Date.now(),
+                                    error: e?.message ?? String(e),
+                                });
+                            }
+                            catch { }
+                        }
                     }
                     finally {
                         // Hold the marker and latch until health.up: clearing here would
@@ -375,6 +414,14 @@ export class Supervisor {
         // DEGRADED: http 200 but log has plugin error → report + notify, rollback after consecutive threshold
         if (health.degraded) {
             this.consecutiveDown = 0;
+            // D1: a degraded verdict while the current boot is unproven is a boot
+            // transient, not a plugin error — the incident's report line
+            // "rollback — degraded: This operation was aborted" was produced exactly
+            // here, five polls after a slow boot.
+            if (health.bootPhase === 'booting') {
+                this.consecutiveDegraded = 0;
+                return;
+            }
             // Check suppression first — don't count degraded during planned restart grace
             let suppressedByMarkerDeg = false;
             try {
@@ -457,7 +504,8 @@ export class Supervisor {
                 const degradedHealth = { up: false, httpCode: health.httpCode, error: `degraded → down: ${degradedError}`, logTail: logTail2, degraded: false };
                 const reportPath2 = await this.deps.writeReport({ ts: ts2, health: degradedHealth, action: `rollback — degraded: ${degradedError}`, logTail: logTail2, gitDiff: gitDiff2 }).catch(() => '');
                 try {
-                    await this.deps.rollback();
+                    const summary = await this.deps.rollback();
+                    await this.reportRollbackResult(summary, reportPath2);
                 }
                 catch (e) {
                     await this.deps.notify(`rollback failed: ${e?.message ?? String(e)} (report: ${reportPath2})`).catch(() => { });
@@ -485,20 +533,33 @@ export class Supervisor {
         if (health.up) {
             this.consecutiveDown = 0;
             this.consecutiveDegraded = 0;
-            // Post-self-restart boot proved healthy: clear the suppression marker,
-            // run the post-restart session-scan hook and re-arm the single-flight
-            // latch. A failed clear keeps the latch set so the same marker is never
-            // re-handled into a second restart.
+            // D5: a healthy poll is the authoritative "the restart succeeded"
+            // signal — clear the suppression marker here instead of waiting for its
+            // TTL, so a stale marker can never mute a later real crash.
+            let markerClearedThisTick = false;
+            try {
+                if (this.getCheckPlannedRestart()()) {
+                    this.getClearPlannedRestart()();
+                    markerClearedThisTick = true;
+                }
+            }
+            catch { }
+            // Post-self-restart boot proved healthy: run the post-restart
+            // session-scan hook and re-arm the single-flight latch. A failed clear
+            // keeps the latch set so the same marker is never re-handled into a
+            // second restart.
             if (this.awaitingHealthyBoot) {
                 this.awaitingHealthyBoot = false;
                 const req = this.pendingRestartRequest;
                 this.pendingRestartRequest = undefined;
-                let cleared = false;
-                try {
-                    this.getClearPlannedRestart()();
-                    cleared = true;
+                let cleared = markerClearedThisTick;
+                if (!cleared) {
+                    try {
+                        this.getClearPlannedRestart()();
+                        cleared = true;
+                    }
+                    catch { }
                 }
-                catch { }
                 if (cleared)
                     this.restartRequestHandled = false;
                 if (req) {
@@ -506,6 +567,19 @@ export class Supervisor {
                         this.deps.onRestartRequestHandled?.(req);
                     }
                     catch { }
+                    if (req.callerSessionId) {
+                        try {
+                            const listen = this.deps.listenerPid ?? defaultListenerPid;
+                            (this.deps.writeOutcome ?? defaultWriteOutcome)(req.callerSessionId, {
+                                state: 'ok',
+                                oldPid: req.oldPid,
+                                newPid: listen(3082),
+                                httpStatus: health?.httpCode ?? 200,
+                                swappedAt: this.deps.getTime ? this.deps.getTime() : Date.now(),
+                            });
+                        }
+                        catch { }
+                    }
                 }
             }
             // Throttle LKG writes to at most once per 5 minutes
@@ -556,6 +630,13 @@ export class Supervisor {
         // A lone timed-out poll (e.g. a slow plugin-tree boot) must not trigger
         // rollback/restart: that restart produces its own transient errors on
         // the next poll, which would otherwise re-trigger this same path forever.
+        // D1/D2: while the boot is unproven only a refused connection may advance
+        // the down counter — nothing is listening, so the process is gone. A
+        // timeout/abort (or anything unattributable) is a slow boot, not a crash.
+        if (health.bootPhase === 'booting' && classifyFetchFailure(health.error) !== 'refused') {
+            this.consecutiveDown = 0;
+            return;
+        }
         this.consecutiveDown++;
         let downThreshold = await this.getEffectiveDownThreshold();
         // When a planned restart marker is active, double the threshold (3→6 at
@@ -589,7 +670,8 @@ export class Supervisor {
             const gitDiff = await this.collectGitDiff().catch(() => '');
             const reportPath = await this.deps.writeReport({ ts, health, action: `rollback — ${health.error ?? 'down'}`, logTail, gitDiff }).catch(() => '');
             try {
-                await this.deps.rollback();
+                const summary = await this.deps.rollback();
+                await this.reportRollbackResult(summary, reportPath);
             }
             catch (e) {
                 await this.deps.notify(`rollback failed: ${e?.message ?? String(e)} (report: ${reportPath})`).catch(() => { });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ddtcorex/dsh-maestro-supervisor",
-  "version": "0.7.10",
+  "version": "0.8.2",
   "description": "Supervisor daemon for DSH Web resilience — auto-detect crashes, rollback to LKG, report",
   "type": "module",
   "main": "./lib/index.js",