@jinn-network/client 0.1.8 → 0.1.9-canary.144d87d2

package/dist/plugins/learner/hooks/session-start

@@ -35,4 +35,33 @@ fi
 git config user.name "claude-code-learner"
 git config user.email "claude-code-learner@local"
 
-echo "session-start: implStateDir ready at $(pwd) (HEAD=$(git rev-parse HEAD))"
+# Operational readiness goes to STDERR. Claude Code parses a SessionStart hook's
+# STDOUT as JSON for `hookSpecificOutput`; any stray stdout would break that parse,
+# so stdout below carries nothing but the additionalContext payload.
+echo "session-start: implStateDir ready at $(pwd) (HEAD=$(git rev-parse HEAD))" >&2
+
+# Steer skill-selection toward this plugin's OWN learn loop. This is the agnostic,
+# plugin-owned mechanism: the learner plugin asserts its own behaviour from its own
+# SessionStart hook, without any other plugin or the harness prompt knowing it exists.
+#
+# It is delivered via the documented `hookSpecificOutput.additionalContext` contract,
+# which is injected into the model's context at session start. The previous plain
+# `echo` was logged as a hook event (visible to the harness via --include-hook-events)
+# but NEVER entered the model context — which is why, despite the learn skill being
+# projected and available, the model kept selecting a direct-solve skill and the loop
+# ran 0% of the time. (Verified: additionalContext reaches the model in headless
+# `-p` / stream-json mode on claude 2.1.x.)
+#
+# MODE-AWARE (extends the original train-only steer for the held-out exam): in
+# `frozen` mode the harness freeze-fences implStateDir, so running the learn loop's
+# Improve/Memory phases would WRITE implStateDir and trip the fence → the eval
+# aborts with a violation. The frozen steer therefore tells the model to CONSULT
+# the accumulated knowledge (read-only) and solve directly — which is exactly how
+# prior learning should raise the frozen score — and to NOT run the loop or modify
+# implStateDir. `JINN_HARNESS_MODE` is set by the harness adapter (default train).
+if [[ "${JINN_HARNESS_MODE:-train}" == "frozen" ]]; then
+  STEER="This is a FROZEN evaluation run. Before solving, CONSULT the accumulated learner knowledge under implStateDir (notes/, skills/, strategies/, patterns/, tests/) and apply any relevant strategy or pattern to this task. Then solve the task and call submit_typed_payload. Do NOT run the learn loop (no Orient/Improve/Memory phases) and do NOT create, edit, or commit anything under implStateDir — the harness verifies implStateDir is unchanged and will discard this run if it is modified."
+else
+  STEER="A seven-phase self-improvement loop is available as the learn skill (claude-code-learner:learn): Orient, Strategize, Plan, Execute, Debrief, Improve, then Memory consolidation. For this session your FIRST action MUST be to invoke the learn skill (via the Skill tool) and run the full loop end-to-end, instead of solving the task directly or selecting another skill first. The Execute phase still performs the actual task work and still calls submit_typed_payload; the surrounding phases capture reusable strategy and persist it to implStateDir so future runs improve. Do not skip the loop."
+fi
+printf '{"hookSpecificOutput":{"hookEventName":"SessionStart","additionalContext":"%s"}}\n' "$STEER"

package/dist/plugins/learner/skills/learn/consolidator-prompt.md

@@ -18,6 +18,10 @@ Anything that writes to `implStateDir` happens here, including:
 - **Unused skills / hooks / tools** — anything not invoked in the last N runs (default 20; check policy override). Move to `implStateDir/.archive/<ts>/` or delete per policy.
 - **Regressed promotions** — revert an Improve commit only when it actually made things worse. There are two triggers; act on either:
   1. **Qualitative trigger** — if the trend in `analysisPath` (the Debrief signal) indicates a recent change made things worse, `git revert <commit-sha>` it. Be specific: revert the exact commit identified, not a bulk rollback. The target sha is `improvePromotionsDir/<n>.json`'s `implStateDirShaAfter`.
+  > The graded score (Tier 2) lowers the variance of the keep/revert decision only.
+  > It never overrules the binary verdict, and it MUST NOT be used to size on-chain
+  > reward — that path is gated on the withheld-test challenge (#1019, design §5.5).
+
   2. **Quantitative trigger (#764)** — for each candidate Improve commit on recent `implStateDir` git history (the commits since `implStateDirShaBefore`, identified from each `improvePromotionsDir/<n>.json` `implStateDirShaAfter`), ask the network-truth indexer whether the commit's per-codeDigest pass rate is significantly worse than its parent's. **Do not hand-roll the codeDigest hash or the statistics — shell out to the CLI**, which exports each commit's tree (`git archive`, no `.git`) and hashes it the way production stamps codeDigest, then runs the documented test:
 
      ```bash

package/dist/preflight/deployment-readiness.d.ts

@@ -0,0 +1,147 @@
+/**
+ * Deployment-readiness preflight (issue #958).
+ *
+ * Hosted deploys have no boot-time guard that the environment is fit to run;
+ * misconfig fails silently or mid-run. This module adds a set of checks that
+ * answer "is this environment fit to run the daemon?" and a boot gate that
+ * **fails loud — but only in a deployment context**.
+ *
+ * Load-bearing constraint: a plain local `jinn run` (no `JINN_STATE_DIR`,
+ * running as the user, no relayer configured) must NEVER be newly gated. The
+ * fail-loud boot gate fires only when `isDeploymentContext()` is true; outside
+ * that, every check is advisory (surfaced in `doctor`, never boot-fatal). The
+ * `doctor` command runs all checks regardless of context.
+ *
+ * The checks compose existing primitives where possible:
+ *   - `writable_volume`        — the one genuinely new primitive (write+fsync+unlink probe)
+ *   - `state_on_volume`        — assert resolved state lives on the configured volume
+ *   - `credentials_resolvable` — reuses `detectAuthContext`; presence-only, NEVER echoes secrets
+ *   - `relayer_reachable`      — cheap probe; skip-ok when no relayer endpoint is configured
+ *   - `agent_cli_non_root`     — uid 0 is unfit (the agent CLI refuses to run as root)
+ *
+ * Every check is side-effect-light and NEVER throws — a failure becomes a
+ * structured fail result, not an exception. The aggregate is the safe caller
+ * surface; the gate adds the fail-loud envelope on top.
+ */
+import { type EnvelopeSinks } from '../errors/envelope.js';
+import { detectAuthContext as defaultDetectAuthContext, type AuthContext } from './claude-auth.js';
+export interface DeploymentCheckResult {
+    name: 'writable_volume' | 'state_on_volume' | 'credentials_resolvable' | 'relayer_reachable' | 'agent_cli_non_root';
+    ok: boolean;
+    detail: string;
+    remedy?: string;
+}
+/** Inputs that come from the resolved config / process — never secret values. */
+export interface DeploymentReadinessInputs {
+    /** `config.stateDir` — the volume root, when set (S3, JINN_STATE_DIR). */
+    stateDir: string | undefined;
+    /** `config.earningDir` — the resolved earning/state directory. */
+    earningDir: string;
+    /**
+     * Optional relayer endpoint. No config field plumbs this today (the
+     * claim-relayer is referenced only as a contract-level concept), so this is
+     * `undefined` in production and the relayer check degrades to skip-ok. The DI
+     * surface keeps it injectable so the reachability path stays testable and so
+     * a future relayer-URL config can wire straight in.
+     */
+    relayerUrl: string | undefined;
+    /**
+     * `config.runtimeMode` — a persisted runtime mode (`'docker-compose'` /
+     * `'container'`) declared by the operator (via `jinn auth --mode` or the app
+     * setup) rather than via env / `/.dockerenv`. Threaded into
+     * `detectAuthContext` as `configuredMode` so a config-declared compose /
+     * container operator is detected as a deployment context (and the boot gate
+     * arms) even with no `JINN_RUNTIME_MODE` env var and no `/.dockerenv`.
+     * `undefined` leaves detection on env / filesystem signals only — preserving
+     * the bare-local regression guarantee.
+     */
+    runtimeMode: AuthContext | undefined;
+}
+/** Injectable dependencies — tests pass doubles; production uses the defaults. */
+export interface DeploymentReadinessDeps {
+    env: NodeJS.ProcessEnv;
+    /** `process.getuid` (undefined on platforms without it, e.g. Windows). */
+    getuid: (() => number) | undefined;
+    detectAuthContext: typeof defaultDetectAuthContext;
+    fetch: typeof fetch;
+}
+export interface DeploymentReadinessReport {
+    /** True when we are in a deployment context (gate is armed). */
+    deployment: boolean;
+    /** The auth context detected for this run. */
+    authContext: AuthContext;
+    checks: DeploymentCheckResult[];
+    /**
+     * True when the daemon must refuse to boot: deployment context AND at least
+     * one HARD check failed. Always false outside a deployment context.
+     */
+    bootFatal: boolean;
+}
+/**
+ * Deployment context = `JINN_STATE_DIR` set OR `config.stateDir` set OR the
+ * auth context is a container / docker-compose. A plain local operator (bare
+ * context, no state-dir) is NOT a deployment context, so the boot gate stays
+ * disarmed for them.
+ */
+export declare function isDeploymentContext(input: {
+    env: NodeJS.ProcessEnv;
+    authContext: AuthContext;
+    stateDir: string | undefined;
+}): boolean;
+/**
+ * Attempt to write + fsync + unlink a temp file under `dir`. ok when it
+ * succeeds; structured fail (never throws) on EACCES / EROFS / ENOSPC / missing
+ * dir / any other fs error.
+ */
+export declare function checkWritableVolume(dir: string): Promise<DeploymentCheckResult>;
+/**
+ * In a deployment context, assert resolved state lives on the configured
+ * volume — i.e. `stateDir` is set AND `earningDir` resolves under it. Advisory
+ * (always ok) outside a deployment context.
+ */
+export declare function checkStateOnVolume(input: {
+    deployment: boolean;
+    stateDir: string | undefined;
+    earningDir: string;
+}): DeploymentCheckResult;
+/**
+ * Presence-only credential check. In a bare context the operator authenticates
+ * the agent CLI interactively (claude session auth), so credentials are not
+ * env-resolvable and that is fine. In a container / compose context there is no
+ * interactive login, so SOME agent-CLI auth signal must be present in the env.
+ *
+ * NEVER returns or logs a secret value — only presence + context.
+ */
+export declare function checkCredentialsResolvable(input: {
+    context: AuthContext;
+    env: NodeJS.ProcessEnv;
+}): DeploymentCheckResult;
+/**
+ * If a relayer endpoint is configured, probe it (short-timeout HEAD/GET). If
+ * not configured, skip-ok. Never throws.
+ *
+ * Production passes `relayerUrl: undefined` today — no config field plumbs a
+ * relayer URL (the claim-relayer is a contract-level / off-process concept), so
+ * this degrades to skip-ok. The injectable surface keeps the reachable /
+ * unreachable paths testable.
+ */
+export declare function checkRelayerReachable(relayerUrl: string | undefined, fetchImpl: typeof fetch): Promise<DeploymentCheckResult>;
+/**
+ * ok when uid !== 0 (or no getuid on the platform). Fail when running as root —
+ * the agent CLI refuses to run as root, so a root daemon is unfit. Never throws.
+ */
+export declare function checkAgentCliNonRoot(getuid: (() => number) | undefined): DeploymentCheckResult;
+/**
+ * Run every deployment-readiness check and assemble a report. Detects the
+ * deployment context internally and decides `bootFatal` accordingly. Never
+ * throws — each check degrades to a structured fail.
+ */
+export declare function runDeploymentReadinessChecks(inputs: DeploymentReadinessInputs, deps: DeploymentReadinessDeps): Promise<DeploymentReadinessReport>;
+/**
+ * Boot gate for `jinn run`. Runs the readiness aggregate; in a deployment
+ * context, fail loud (emit `invalid_invocation` envelope + non-zero exit) when
+ * a hard check fails. Outside a deployment context, log advisories for any
+ * failing check and proceed. Mirrors `applyPidfileLivenessGate`'s contract:
+ * `emitEnvelope` does not return in production (it `process.exit`s).
+ */
+export declare function applyDeploymentReadinessGate(inputs: DeploymentReadinessInputs, deps: DeploymentReadinessDeps, sinks?: EnvelopeSinks): Promise<void>;

package/dist/preflight/deployment-readiness.js

@@ -0,0 +1,366 @@
+/**
+ * Deployment-readiness preflight (issue #958).
+ *
+ * Hosted deploys have no boot-time guard that the environment is fit to run;
+ * misconfig fails silently or mid-run. This module adds a set of checks that
+ * answer "is this environment fit to run the daemon?" and a boot gate that
+ * **fails loud — but only in a deployment context**.
+ *
+ * Load-bearing constraint: a plain local `jinn run` (no `JINN_STATE_DIR`,
+ * running as the user, no relayer configured) must NEVER be newly gated. The
+ * fail-loud boot gate fires only when `isDeploymentContext()` is true; outside
+ * that, every check is advisory (surfaced in `doctor`, never boot-fatal). The
+ * `doctor` command runs all checks regardless of context.
+ *
+ * The checks compose existing primitives where possible:
+ *   - `writable_volume`        — the one genuinely new primitive (write+fsync+unlink probe)
+ *   - `state_on_volume`        — assert resolved state lives on the configured volume
+ *   - `credentials_resolvable` — reuses `detectAuthContext`; presence-only, NEVER echoes secrets
+ *   - `relayer_reachable`      — cheap probe; skip-ok when no relayer endpoint is configured
+ *   - `agent_cli_non_root`     — uid 0 is unfit (the agent CLI refuses to run as root)
+ *
+ * Every check is side-effect-light and NEVER throws — a failure becomes a
+ * structured fail result, not an exception. The aggregate is the safe caller
+ * surface; the gate adds the fail-loud envelope on top.
+ */
+import { promises as fs } from 'node:fs';
+import { join, resolve } from 'node:path';
+import { randomBytes } from 'node:crypto';
+import { emitEnvelope } from '../errors/envelope.js';
+import { emitStructured } from '../events/emitter.js';
+/** Hard checks — failing one of these in a deployment context refuses the boot. */
+const HARD_CHECK_NAMES = new Set([
+    'writable_volume',
+    'state_on_volume',
+    'agent_cli_non_root',
+]);
+// ---------------------------------------------------------------------------
+// isDeploymentContext
+// ---------------------------------------------------------------------------
+/**
+ * Deployment context = `JINN_STATE_DIR` set OR `config.stateDir` set OR the
+ * auth context is a container / docker-compose. A plain local operator (bare
+ * context, no state-dir) is NOT a deployment context, so the boot gate stays
+ * disarmed for them.
+ */
+export function isDeploymentContext(input) {
+    if (typeof input.env['JINN_STATE_DIR'] === 'string' && input.env['JINN_STATE_DIR'].length > 0) {
+        return true;
+    }
+    if (typeof input.stateDir === 'string' && input.stateDir.length > 0)
+        return true;
+    return input.authContext === 'container' || input.authContext === 'docker-compose';
+}
+// ---------------------------------------------------------------------------
+// writable_volume — the new primitive
+// ---------------------------------------------------------------------------
+/**
+ * Attempt to write + fsync + unlink a temp file under `dir`. ok when it
+ * succeeds; structured fail (never throws) on EACCES / EROFS / ENOSPC / missing
+ * dir / any other fs error.
+ */
+export async function checkWritableVolume(dir) {
+    const probePath = join(dir, `.jinn-writeprobe-${process.pid}-${randomBytes(4).toString('hex')}`);
+    let handle;
+    try {
+        handle = await fs.open(probePath, 'w', 0o600);
+        await handle.write('jinn-writable-volume-probe');
+        await handle.sync();
+        await handle.close();
+        handle = undefined;
+        await fs.unlink(probePath);
+        return {
+            name: 'writable_volume',
+            ok: true,
+            detail: `${dir} is writable`,
+        };
+    }
+    catch (err) {
+        // Best-effort cleanup; ignore whatever it throws.
+        if (handle)
+            await handle.close().catch(() => undefined);
+        await fs.unlink(probePath).catch(() => undefined);
+        const code = err.code;
+        return {
+            name: 'writable_volume',
+            ok: false,
+            detail: `${dir} is not writable${code ? ` (${code})` : ''}`,
+            remedy: 'Ensure the daemon process can write to the state directory. In hosted deploys, mount a writable ' +
+                'persistent volume at the path pointed to by JINN_STATE_DIR (or earningDir) and give the daemon user write access.',
+        };
+    }
+}
+// ---------------------------------------------------------------------------
+// state_on_volume
+// ---------------------------------------------------------------------------
+/**
+ * In a deployment context, assert resolved state lives on the configured
+ * volume — i.e. `stateDir` is set AND `earningDir` resolves under it. Advisory
+ * (always ok) outside a deployment context.
+ */
+export function checkStateOnVolume(input) {
+    if (!input.deployment) {
+        return {
+            name: 'state_on_volume',
+            ok: true,
+            detail: 'not a deployment context — state location is advisory only',
+        };
+    }
+    if (!input.stateDir) {
+        return {
+            name: 'state_on_volume',
+            ok: false,
+            detail: 'deployment context but JINN_STATE_DIR / stateDir is unset — state would land on the ephemeral ~/.jinn-client default and be lost on redeploy',
+            remedy: 'Set JINN_STATE_DIR to the mounted persistent volume (e.g. JINN_STATE_DIR=/data).',
+        };
+    }
+    const root = resolve(input.stateDir);
+    const earning = resolve(input.earningDir);
+    const under = earning === root || earning.startsWith(root + '/');
+    if (!under) {
+        return {
+            name: 'state_on_volume',
+            ok: false,
+            detail: `earningDir (${earning}) does not resolve under the configured volume (${root})`,
+            remedy: 'Remove the per-key earningDir/dbPath override so state derives under JINN_STATE_DIR, or point them at the volume.',
+        };
+    }
+    return {
+        name: 'state_on_volume',
+        ok: true,
+        detail: `state resolves under the configured volume ${root}`,
+    };
+}
+// ---------------------------------------------------------------------------
+// credentials_resolvable
+// ---------------------------------------------------------------------------
+/**
+ * Presence-only credential check. In a bare context the operator authenticates
+ * the agent CLI interactively (claude session auth), so credentials are not
+ * env-resolvable and that is fine. In a container / compose context there is no
+ * interactive login, so SOME agent-CLI auth signal must be present in the env.
+ *
+ * NEVER returns or logs a secret value — only presence + context.
+ */
+export function checkCredentialsResolvable(input) {
+    // Env vars that, if present and non-empty, indicate the agent CLI can resolve
+    // credentials non-interactively. Presence only — values are never read out.
+    const AUTH_ENV_KEYS = [
+        'ANTHROPIC_API_KEY',
+        'CLAUDE_CODE_OAUTH_TOKEN',
+        'OPENROUTER_API_KEY',
+        'OPENAI_API_KEY',
+    ];
+    const present = AUTH_ENV_KEYS.filter((k) => {
+        const v = input.env[k];
+        return typeof v === 'string' && v.trim().length > 0;
+    });
+    if (input.context === 'bare') {
+        return {
+            name: 'credentials_resolvable',
+            ok: true,
+            detail: present.length > 0
+                ? `bare context; agent-CLI auth env present (${present.length} key(s))`
+                : 'bare context; agent CLI uses interactive session auth',
+        };
+    }
+    // container / docker-compose: no interactive login path — need an env signal.
+    if (present.length > 0) {
+        return {
+            name: 'credentials_resolvable',
+            ok: true,
+            detail: `${input.context} context; agent-CLI auth env present (${present.length} key(s))`,
+        };
+    }
+    return {
+        name: 'credentials_resolvable',
+        ok: false,
+        detail: `${input.context} context but no agent-CLI auth credential is resolvable from the environment`,
+        remedy: 'Provide the agent CLI credentials the harness needs (e.g. ANTHROPIC_API_KEY / CLAUDE_CODE_OAUTH_TOKEN, ' +
+            'or OPENROUTER_API_KEY for the hermes harness) as a secret in the deploy environment.',
+    };
+}
+// ---------------------------------------------------------------------------
+// relayer_reachable
+// ---------------------------------------------------------------------------
+/**
+ * If a relayer endpoint is configured, probe it (short-timeout HEAD/GET). If
+ * not configured, skip-ok. Never throws.
+ *
+ * Production passes `relayerUrl: undefined` today — no config field plumbs a
+ * relayer URL (the claim-relayer is a contract-level / off-process concept), so
+ * this degrades to skip-ok. The injectable surface keeps the reachable /
+ * unreachable paths testable.
+ */
+export async function checkRelayerReachable(relayerUrl, fetchImpl) {
+    if (!relayerUrl) {
+        return {
+            name: 'relayer_reachable',
+            ok: true,
+            detail: 'no claim-relayer endpoint configured — skipped',
+        };
+    }
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), 3000);
+    try {
+        const res = (await fetchImpl(relayerUrl, {
+            method: 'HEAD',
+            signal: controller.signal,
+        }));
+        const status = typeof res.status === 'number' ? res.status : undefined;
+        const reachable = res.ok === true || (status !== undefined && status >= 200 && status < 400);
+        if (reachable) {
+            return {
+                name: 'relayer_reachable',
+                ok: true,
+                detail: `claim-relayer responded${status !== undefined ? ` (${status})` : ''}`,
+            };
+        }
+        return {
+            name: 'relayer_reachable',
+            ok: false,
+            detail: `claim-relayer responded with a non-success status${status !== undefined ? ` (${status})` : ''}`,
+            remedy: 'Check the relayer service health and the configured endpoint.',
+        };
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        return {
+            name: 'relayer_reachable',
+            ok: false,
+            detail: `claim-relayer unreachable: ${msg}`,
+            remedy: 'Verify the relayer service is running and the endpoint/network path is reachable.',
+        };
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+// ---------------------------------------------------------------------------
+// agent_cli_non_root
+// ---------------------------------------------------------------------------
+/**
+ * ok when uid !== 0 (or no getuid on the platform). Fail when running as root —
+ * the agent CLI refuses to run as root, so a root daemon is unfit. Never throws.
+ */
+export function checkAgentCliNonRoot(getuid) {
+    if (typeof getuid !== 'function') {
+        return {
+            name: 'agent_cli_non_root',
+            ok: true,
+            detail: 'platform has no uid concept — non-root assumption holds',
+        };
+    }
+    let uid;
+    try {
+        uid = getuid();
+    }
+    catch {
+        // Can't determine uid: don't crash, treat as non-fatal (conservative ok —
+        // we'd rather not falsely gate a boot on an unreadable uid).
+        return {
+            name: 'agent_cli_non_root',
+            ok: true,
+            detail: 'could not read process uid — assuming non-root',
+        };
+    }
+    if (uid === 0) {
+        return {
+            name: 'agent_cli_non_root',
+            ok: false,
+            detail: 'daemon is running as root (uid 0); the agent CLI refuses to run as root',
+            remedy: 'Run the daemon as a non-root user. In containers, create and drop to a non-root user (e.g. via gosu) before launching.',
+        };
+    }
+    return {
+        name: 'agent_cli_non_root',
+        ok: true,
+        detail: `running as non-root (uid ${uid})`,
+    };
+}
+// ---------------------------------------------------------------------------
+// runDeploymentReadinessChecks — the aggregate
+// ---------------------------------------------------------------------------
+/**
+ * Run every deployment-readiness check and assemble a report. Detects the
+ * deployment context internally and decides `bootFatal` accordingly. Never
+ * throws — each check degrades to a structured fail.
+ */
+export async function runDeploymentReadinessChecks(inputs, deps) {
+    const authContext = (() => {
+        try {
+            return deps.detectAuthContext({
+                cwd: process.cwd(),
+                env: deps.env,
+                configuredMode: inputs.runtimeMode,
+            });
+        }
+        catch {
+            return 'bare';
+        }
+    })();
+    const deployment = isDeploymentContext({
+        env: deps.env,
+        authContext,
+        stateDir: inputs.stateDir,
+    });
+    // The writable-volume probe targets the volume root when set, else earningDir.
+    const probeDir = inputs.stateDir ?? inputs.earningDir;
+    const checks = [
+        await checkWritableVolume(probeDir),
+        checkStateOnVolume({ deployment, stateDir: inputs.stateDir, earningDir: inputs.earningDir }),
+        checkCredentialsResolvable({ context: authContext, env: deps.env }),
+        await checkRelayerReachable(inputs.relayerUrl, deps.fetch),
+        checkAgentCliNonRoot(deps.getuid),
+    ];
+    const bootFatal = deployment && checks.some((c) => !c.ok && HARD_CHECK_NAMES.has(c.name));
+    return { deployment, authContext, checks, bootFatal };
+}
+// ---------------------------------------------------------------------------
+// applyDeploymentReadinessGate — the boot gate (fail-loud only in deployment)
+// ---------------------------------------------------------------------------
+/**
+ * Boot gate for `jinn run`. Runs the readiness aggregate; in a deployment
+ * context, fail loud (emit `invalid_invocation` envelope + non-zero exit) when
+ * a hard check fails. Outside a deployment context, log advisories for any
+ * failing check and proceed. Mirrors `applyPidfileLivenessGate`'s contract:
+ * `emitEnvelope` does not return in production (it `process.exit`s).
+ */
+export async function applyDeploymentReadinessGate(inputs, deps, sinks = {}) {
+    const report = await runDeploymentReadinessChecks(inputs, deps);
+    const failed = report.checks.filter((c) => !c.ok);
+    if (report.bootFatal) {
+        const hardFailures = failed.filter((c) => HARD_CHECK_NAMES.has(c.name));
+        const summary = hardFailures.map((c) => `${c.name}: ${c.detail}`).join('; ');
+        emitEnvelope({
+            code: 'invalid_invocation',
+            message: `Environment is not fit to run the daemon in this deployment — ${summary}`,
+            hint: 'Run `jinn doctor --human` for the full readiness report. Fix the failing check(s) and restart.',
+            exampleCli: 'jinn doctor --human',
+            details: {
+                field: 'deployment_readiness',
+                authContext: report.authContext,
+                // Names + ok only — no secret material, no raw env values.
+                failed: hardFailures.map((c) => ({ name: c.name, detail: c.detail })),
+            },
+        }, sinks);
+        // emitEnvelope calls process.exit in production; in tests the injected exit
+        // is a no-op. Either way, do not fall through to "proceed" logging.
+        return;
+    }
+    // Advisory path (local operator, or non-hard failures in a deployment ctx):
+    // surface each failing check but never gate the boot.
+    for (const c of failed) {
+        emitStructured({
+            kind: 'system',
+            message: `deployment-readiness advisory — ${c.name}: ${c.detail}`,
+            details: {
+                phase: 'preflight',
+                check: c.name,
+                deployment: report.deployment,
+                ...(c.remedy ? { remedy: c.remedy } : {}),
+            },
+        });
+    }
+}
+//# sourceMappingURL=deployment-readiness.js.map

package/dist/preflight/deployment-readiness.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deployment-readiness.js","sourceRoot":"","sources":["../../src/preflight/deployment-readiness.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EAAE,YAAY,EAAsB,MAAM,uBAAuB,CAAC;AACzE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAoEtD,mFAAmF;AACnF,MAAM,gBAAgB,GAA+C,IAAI,GAAG,CAAC;IAC3E,iBAAiB;IACjB,iBAAiB;IACjB,oBAAoB;CACrB,CAAC,CAAC;AAEH,8EAA8E;AAC9E,sBAAsB;AACtB,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAInC;IACC,IAAI,OAAO,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9F,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACjF,OAAO,KAAK,CAAC,WAAW,KAAK,WAAW,IAAI,KAAK,CAAC,WAAW,KAAK,gBAAgB,CAAC;AACrF,CAAC;AAED,8EAA8E;AAC9E,sCAAsC;AACtC,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,GAAW;IACnD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,oBAAoB,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACjG,IAAI,MAAiC,CAAC;IACtC,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QAC9C,MAAM,MAAM,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC;QACjD,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,MAAM,GAAG,SAAS,CAAC;QACnB,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC3B,OAAO;YACL,IAAI,EAAE,iBAAiB;YACvB,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,GAAG,GAAG,cAAc;SAC7B,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,kDAAkD;QAClD,IAAI,MAAM;YAAE,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACxD,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAClD,MAAM,IAAI,GAAI,GAA6B,CAAC,IAAI,CAAC;QACjD,OAAO;YACL,IAAI,EAAE,iBAAiB;YACvB,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,GAAG,GAAG,mBAAmB,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YAC3D,MAAM,EACJ,kGAAkG;gBAClG,mHAAmH;SACtH,CAAC;IACJ,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,kBAAkB;AAClB,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAIlC;IACC,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;QACtB,OAAO;YACL,IAAI,EAAE,iBAAiB;YACvB,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,4DAA4D;SACrE,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;QACpB,OAAO;YACL,IAAI,EAAE,iBAAiB;YACvB,EAAE,EAAE,KAAK;YACT,MAAM,EACJ,8IAA8I;YAChJ,MAAM,EAAE,kFAAkF;SAC3F,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACrC,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC;IACjE,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO;YACL,IAAI,EAAE,iBAAiB;YACvB,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,eAAe,OAAO,mDAAmD,IAAI,GAAG;YACxF,MAAM,EACJ,mHAAmH;SACtH,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI,EAAE,iBAAiB;QACvB,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,8CAA8C,IAAI,EAAE;KAC7D,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,yBAAyB;AACzB,8EAA8E;AAE9E;;;;;;;GAOG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAG1C;IACC,8EAA8E;IAC9E,4EAA4E;IAC5E,MAAM,aAAa,GAAG;QACpB,mBAAmB;QACnB,yBAAyB;QACzB,oBAAoB;QACpB,gBAAgB;KACR,CAAC;IACX,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QACzC,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACvB,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,IAAI,KAAK,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;QAC7B,OAAO;YACL,IAAI,EAAE,wBAAwB;YAC9B,EAAE,EAAE,IAAI;YACR,MAAM,EACJ,OAAO,CAAC,MAAM,GAAG,CAAC;gBAChB,CAAC,CAAC,6CAA6C,OAAO,CAAC,MAAM,UAAU;gBACvE,CAAC,CAAC,uDAAuD;SAC9D,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO;YACL,IAAI,EAAE,wBAAwB;YAC9B,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,yCAAyC,OAAO,CAAC,MAAM,UAAU;SAC1F,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI,EAAE,wBAAwB;QAC9B,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,8EAA8E;QACtG,MAAM,EACJ,yGAAyG;YACzG,sFAAsF;KACzF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,UAA8B,EAC9B,SAAuB;IAEvB,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO;YACL,IAAI,EAAE,mBAAmB;YACzB,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,gDAAgD;SACzD,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,CAAC;IACzD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,CAAC,MAAM,SAAS,CAAC,UAAU,EAAE;YACvC,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAsC,CAAC;QACzC,MAAM,MAAM,GAAG,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;QACvE,MAAM,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,CAAC,CAAC;QAC7F,IAAI,SAAS,EAAE,CAAC;YACd,OAAO;gBACL,IAAI,EAAE,mBAAmB;gBACzB,EAAE,EAAE,IAAI;gBACR,MAAM,EAAE,0BAA0B,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;aAC/E,CAAC;QACJ,CAAC;QACD,OAAO;YACL,IAAI,EAAE,mBAAmB;YACzB,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,oDAAoD,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YACxG,MAAM,EAAE,+DAA+D;SACxE,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,OAAO;YACL,IAAI,EAAE,mBAAmB;YACzB,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,8BAA8B,GAAG,EAAE;YAC3C,MAAM,EAAE,mFAAmF;SAC5F,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAkC;IACrE,IAAI,OAAO,MAAM,KAAK,UAAU,EAAE,CAAC;QACjC,OAAO;YACL,IAAI,EAAE,oBAAoB;YAC1B,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,yDAAyD;SAClE,CAAC;IACJ,CAAC;IACD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,EAAE,CAAC;IACjB,CAAC;IAAC,MAAM,CAAC;QACP,0EAA0E;QAC1E,6DAA6D;QAC7D,OAAO;YACL,IAAI,EAAE,oBAAoB;YAC1B,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,gDAAgD;SACzD,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC;QACd,OAAO;YACL,IAAI,EAAE,oBAAoB;YAC1B,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,yEAAyE;YACjF,MAAM,EACJ,wHAAwH;SAC3H,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI,EAAE,oBAAoB;QAC1B,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,4BAA4B,GAAG,GAAG;KAC3C,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,+CAA+C;AAC/C,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,MAAiC,EACjC,IAA6B;IAE7B,MAAM,WAAW,GAAG,CAAC,GAAG,EAAE;QACxB,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,iBAAiB,CAAC;gBAC5B,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE;gBAClB,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,cAAc,EAAE,MAAM,CAAC,WAAW;aACnC,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,MAAqB,CAAC;QAC/B,CAAC;IACH,CAAC,CAAC,EAAE,CAAC;IAEL,MAAM,UAAU,GAAG,mBAAmB,CAAC;QACrC,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,WAAW;QACX,QAAQ,EAAE,MAAM,CAAC,QAAQ;KAC1B,CAAC,CAAC;IAEH,+EAA+E;IAC/E,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,UAAU,CAAC;IAEtD,MAAM,MAAM,GAA4B;QACtC,MAAM,mBAAmB,CAAC,QAAQ,CAAC;QACnC,kBAAkB,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC;QAC5F,0BAA0B,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;QACnE,MAAM,qBAAqB,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC;QAC1D,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC;KAClC,CAAC;IAEF,MAAM,SAAS,GACb,UAAU,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAE1E,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AACxD,CAAC;AAED,8EAA8E;AAC9E,8EAA8E;AAC9E,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,MAAiC,EACjC,IAA6B,EAC7B,QAAuB,EAAE;IAEzB,MAAM,MAAM,GAAG,MAAM,4BAA4B,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAChE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAElD,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACrB,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACxE,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7E,YAAY,CACV;YACE,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EAAE,iEAAiE,OAAO,EAAE;YACnF,IAAI,EAAE,gGAAgG;YACtG,UAAU,EAAE,qBAAqB;YACjC,OAAO,EAAE;gBACP,KAAK,EAAE,sBAAsB;gBAC7B,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,2DAA2D;gBAC3D,MAAM,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;aACtE;SACF,EACD,KAAK,CACN,CAAC;QACF,4EAA4E;QAC5E,oEAAoE;QACpE,OAAO;IACT,CAAC;IAED,4EAA4E;IAC5E,sDAAsD;IACtD,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,cAAc,CAAC;YACb,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,mCAAmC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,MAAM,EAAE;YACjE,OAAO,EAAE;gBACP,KAAK,EAAE,WAAW;gBAClB,KAAK,EAAE,CAAC,CAAC,IAAI;gBACb,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC1C;SACF,CAAC,CAAC;IACL,CAAC;AACH,CAAC"}

package/dist/preflight/pidfile-liveness.d.ts

@@ -6,11 +6,17 @@
  * Branches (load-bearing — see #649 acceptance criteria):
  *   - File missing               → { decision: 'proceed' }
  *   - File malformed (NaN/empty) → { decision: 'unlink-stale', reason: 'malformed' }
+ *   - PID 1 or our own pid       → { decision: 'unlink-stale', reason: 'self-or-pid1-container' }
  *   - process.kill(pid, 0) ESRCH → { decision: 'unlink-stale', reason: 'esrch' }
  *   - process.kill(pid, 0) ok    → { decision: 'refuse', reason: 'alive' }
  *   - process.kill(pid, 0) EPERM → { decision: 'refuse', reason: 'eperm' }
  *   - any other errno            → { decision: 'refuse', reason: 'unknown' }
  *
+ * The PID-1/self branch classifies *before* the `process.kill` probe (#805): in
+ * a container the daemon is PID 1, whose pidfile outlives the container on the
+ * persistent volume; `process.kill(1, 0)` always succeeds, so a probe-first
+ * order would mis-classify the stale record as a live sibling and crash-loop.
+ *
  * `.trim()` before `parseInt` is required: `main.ts` writes the PID with a
  * trailing `\n` (see `client/src/main.ts` writeFileSync near the pidfile site).
  */
@@ -21,7 +27,7 @@ export type PidfileLivenessDecision = {
     decision: 'unlink-stale';
     pid: number | null;
     pidfilePath: string;
-    reason: 'malformed' | 'esrch';
+    reason: 'malformed' | 'esrch' | 'self-or-pid1-container';
 } | {
     decision: 'refuse';
     pid: number;

package/dist/preflight/pidfile-liveness.js

@@ -6,11 +6,17 @@
  * Branches (load-bearing — see #649 acceptance criteria):
  *   - File missing               → { decision: 'proceed' }
  *   - File malformed (NaN/empty) → { decision: 'unlink-stale', reason: 'malformed' }
+ *   - PID 1 or our own pid       → { decision: 'unlink-stale', reason: 'self-or-pid1-container' }
  *   - process.kill(pid, 0) ESRCH → { decision: 'unlink-stale', reason: 'esrch' }
  *   - process.kill(pid, 0) ok    → { decision: 'refuse', reason: 'alive' }
  *   - process.kill(pid, 0) EPERM → { decision: 'refuse', reason: 'eperm' }
  *   - any other errno            → { decision: 'refuse', reason: 'unknown' }
  *
+ * The PID-1/self branch classifies *before* the `process.kill` probe (#805): in
+ * a container the daemon is PID 1, whose pidfile outlives the container on the
+ * persistent volume; `process.kill(1, 0)` always succeeds, so a probe-first
+ * order would mis-classify the stale record as a live sibling and crash-loop.
+ *
  * `.trim()` before `parseInt` is required: `main.ts` writes the PID with a
  * trailing `\n` (see `client/src/main.ts` writeFileSync near the pidfile site).
  */
@@ -35,6 +41,14 @@ export function checkPidfileLiveness(input) {
     if (!Number.isFinite(parsed) || parsed <= 0) {
         return { decision: 'unlink-stale', pid: null, pidfilePath: pidPath, reason: 'malformed' };
     }
+    // #805: in a container the daemon is PID 1; the pidfile on the persistent
+    // volume outlives the container, and `process.kill(1, 0)` always succeeds, so
+    // we must classify the self/PID-1 record as stale *before* the liveness probe
+    // below — otherwise the probe reports it alive and the daemon crash-loops. A
+    // record of our own pid is likewise self, never a live sibling.
+    if (parsed === 1 || parsed === process.pid) {
+        return { decision: 'unlink-stale', pid: parsed, pidfilePath: pidPath, reason: 'self-or-pid1-container' };
+    }
     try {
         process.kill(parsed, 0);
         return { decision: 'refuse', pid: parsed, pidfilePath: pidPath, reason: 'alive' };

package/dist/preflight/pidfile-liveness.js.map

@@ -1 +1 @@
-{"version":3,"file":"pidfile-liveness.js","sourceRoot":"","sources":["../../src/preflight/pidfile-liveness.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAE/D,OAAO,EAAE,YAAY,EAAsB,MAAM,uBAAuB,CAAC;AACzE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAqBtD,MAAM,UAAU,oBAAoB,CAClC,KAAgC;IAEhC,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAC1B,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IACjC,CAAC;IAED,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,4EAA4E;QAC5E,sDAAsD;QACtD,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC5F,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,EAAE,CAAC;QAC5C,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC5F,CAAC;IAED,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACxB,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IACpF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,KAAK,GAAI,GAA6B,CAAC,IAAI,CAAC;QAClD,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;YACtB,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QAC1F,CAAC;QACD,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;YACtB,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QACpF,CAAC;QACD,2EAA2E;QAC3E,qBAAqB;QACrB,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACtF,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,wBAAwB,CACtC,OAAe,EACf,QAAuB,EAAE;IAEzB,MAAM,QAAQ,GAAG,oBAAoB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;IACnD,IAAI,QAAQ,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACnC,YAAY,CACV;YACE,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EAAE,+CAA+C,QAAQ,CAAC,GAAG,IAAI;YACxE,IAAI,EAAE,4FAA4F;YAClG,UAAU,EAAE,WAAW;YACvB,OAAO,EAAE;gBACP,KAAK,EAAE,gBAAgB;gBACvB,GAAG,EAAE,QAAQ,CAAC,GAAG;gBACjB,WAAW,EAAE,OAAO;gBACpB,MAAM,EAAE,QAAQ,CAAC,MAAM;aACxB;SACF,EACD,KAAK,CACN,CAAC;QACF,yEAAyE;QACzE,0EAA0E;QAC1E,iBAAiB;QACjB,OAAO;IACT,CAAC;IACD,IAAI,QAAQ,CAAC,QAAQ,KAAK,cAAc,EAAE,CAAC;QACzC,cAAc,CAAC;YACb,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,8BAA8B,QAAQ,CAAC,MAAM,GAAG;YACzD,OAAO,EAAE;gBACP,KAAK,EAAE,WAAW;gBAClB,WAAW,EAAE,OAAO;gBACpB,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,GAAG,EAAE,QAAQ,CAAC,GAAG;aAClB;SACF,CAAC,CAAC;QACH,IAAI,CAAC;YACH,UAAU,CAAC,OAAO,CAAC,CAAC;QACtB,CAAC;QAAC,MAAM,CAAC;YACP,4EAA4E;QAC9E,CAAC;IACH,CAAC;AACH,CAAC"}
+{"version":3,"file":"pidfile-liveness.js","sourceRoot":"","sources":["../../src/preflight/pidfile-liveness.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAE/D,OAAO,EAAE,YAAY,EAAsB,MAAM,uBAAuB,CAAC;AACzE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAqBtD,MAAM,UAAU,oBAAoB,CAClC,KAAgC;IAEhC,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAC1B,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IACjC,CAAC;IAED,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,4EAA4E;QAC5E,sDAAsD;QACtD,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC5F,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,EAAE,CAAC;QAC5C,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC5F,CAAC;IAED,0EAA0E;IAC1E,8EAA8E;IAC9E,8EAA8E;IAC9E,6EAA6E;IAC7E,gEAAgE;IAChE,IAAI,MAAM,KAAK,CAAC,IAAI,MAAM,KAAK,OAAO,CAAC,GAAG,EAAE,CAAC;QAC3C,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;IAC3G,CAAC;IAED,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACxB,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IACpF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,KAAK,GAAI,GAA6B,CAAC,IAAI,CAAC;QAClD,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;YACtB,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QAC1F,CAAC;QACD,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;YACtB,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QACpF,CAAC;QACD,2EAA2E;QAC3E,qBAAqB;QACrB,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACtF,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,wBAAwB,CACtC,OAAe,EACf,QAAuB,EAAE;IAEzB,MAAM,QAAQ,GAAG,oBAAoB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;IACnD,IAAI,QAAQ,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACnC,YAAY,CACV;YACE,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EAAE,+CAA+C,QAAQ,CAAC,GAAG,IAAI;YACxE,IAAI,EAAE,4FAA4F;YAClG,UAAU,EAAE,WAAW;YACvB,OAAO,EAAE;gBACP,KAAK,EAAE,gBAAgB;gBACvB,GAAG,EAAE,QAAQ,CAAC,GAAG;gBACjB,WAAW,EAAE,OAAO;gBACpB,MAAM,EAAE,QAAQ,CAAC,MAAM;aACxB;SACF,EACD,KAAK,CACN,CAAC;QACF,yEAAyE;QACzE,0EAA0E;QAC1E,iBAAiB;QACjB,OAAO;IACT,CAAC;IACD,IAAI,QAAQ,CAAC,QAAQ,KAAK,cAAc,EAAE,CAAC;QACzC,cAAc,CAAC;YACb,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,8BAA8B,QAAQ,CAAC,MAAM,GAAG;YACzD,OAAO,EAAE;gBACP,KAAK,EAAE,WAAW;gBAClB,WAAW,EAAE,OAAO;gBACpB,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,GAAG,EAAE,QAAQ,CAAC,GAAG;aAClB;SACF,CAAC,CAAC;QACH,IAAI,CAAC;YACH,UAAU,CAAC,OAAO,CAAC,CAAC;QACtB,CAAC;QAAC,MAAM,CAAC;YACP,4EAA4E;QAC9E,CAAC;IACH,CAAC;AACH,CAAC"}