@mmmbuto/nexuscrew 0.8.20 → 0.8.22

package/lib/fleet/cell-exec.js

@@ -1,13 +1,23 @@
 #!/usr/bin/env node
 'use strict';
 
-// Tiny launch helper. It receives only a local socket path and a random,
-// single-use nonce in argv. Provider values arrive over the private Unix
-// socket, stay in memory and are passed directly to the child process.
+// Private per-cell launcher and supervisor.  tmux sees only this helper plus a
+// single-use broker ticket; the real command, provider environment and restart
+// policy arrive in memory over the local 0600 Unix socket.
 const net = require('node:net');
 const { spawn } = require('node:child_process');
 const { MAX_PAYLOAD } = require('./launch-broker.js');
 
+const DEFAULT_SUPERVISE = Object.freeze({
+  enabled: true,
+  initialReadyMs: 500,
+  restartDelayMs: 1000,
+  maxRestartDelayMs: 60000,
+  resetAfterMs: 30000,
+  rapidWindowMs: 60000,
+  maxRapidRestarts: 8,
+});
+
 function parseArgs(argv) {
   const out = {};
   for (let i = 0; i < argv.length; i += 2) {
@@ -20,12 +30,57 @@ function parseArgs(argv) {
   return out;
 }
 
+function validInteger(value, min, max) {
+  return Number.isInteger(value) && value >= min && value <= max;
+}
+
+function validSupervise(value) {
+  if (value === undefined) return true;
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return false;
+  const keys = new Set([
+    'enabled', 'initialReadyMs', 'restartDelayMs', 'maxRestartDelayMs',
+    'resetAfterMs', 'rapidWindowMs', 'maxRapidRestarts',
+  ]);
+  if (Object.keys(value).some((key) => !keys.has(key))) return false;
+  if (value.enabled !== undefined && typeof value.enabled !== 'boolean') return false;
+  const checks = [
+    ['initialReadyMs', 50, 30000], ['restartDelayMs', 50, 60000],
+    ['maxRestartDelayMs', 100, 300000], ['resetAfterMs', 1000, 3600000],
+    ['rapidWindowMs', 1000, 3600000], ['maxRapidRestarts', 1, 100],
+  ];
+  return checks.every(([key, min, max]) => value[key] === undefined || validInteger(value[key], min, max));
+}
+
+function promptCharsOk(prompt) {
+  if (typeof prompt !== 'string' || prompt.length > 131072) return false;
+  for (let i = 0; i < prompt.length; i += 1) {
+    const code = prompt.charCodeAt(i);
+    if (code === 9 || code === 10 || code === 13) continue;
+    if (code < 32 || code === 127) return false;
+  }
+  return true;
+}
+
+function validRestartPrompt(value) {
+  if (value === undefined) return true;
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return false;
+  if (Object.keys(value).some((key) => !['tmuxBin', 'tmuxSession', 'prompt', 'readyMs'].includes(key))) return false;
+  return typeof value.tmuxBin === 'string' && value.tmuxBin.length > 0 && value.tmuxBin.length <= 4096
+    && !/[\0\r\n]/.test(value.tmuxBin)
+    && typeof value.tmuxSession === 'string' && /^[\w.@%:+-]{1,128}$/.test(value.tmuxSession)
+    && promptCharsOk(value.prompt)
+    && (value.readyMs === undefined || validInteger(value.readyMs, 0, 30000));
+}
+
 function validPayload(payload) {
   if (!payload || typeof payload !== 'object' || Array.isArray(payload)) return false;
+  if (Object.keys(payload).some((key) => !['command', 'args', 'env', 'supervise', 'restartPrompt'].includes(key))) return false;
   if (typeof payload.command !== 'string' || !payload.command || !Array.isArray(payload.args)) return false;
   if (!payload.env || typeof payload.env !== 'object' || Array.isArray(payload.env)) return false;
   return payload.args.every((v) => typeof v === 'string')
-    && Object.entries(payload.env).every(([k, v]) => /^[A-Za-z_][A-Za-z0-9_]{0,63}$/.test(k) && typeof v === 'string');
+    && Object.entries(payload.env).every(([k, v]) => /^[A-Za-z_][A-Za-z0-9_]{0,63}$/.test(k) && typeof v === 'string')
+    && validSupervise(payload.supervise)
+    && validRestartPrompt(payload.restartPrompt);
 }
 
 function receivePayload(socketPath, nonce, timeoutMs = 5000) {
@@ -57,19 +112,115 @@ function receivePayload(socketPath, nonce, timeoutMs = 5000) {
   });
 }
 
+function normalizeSupervise(value = {}) {
+  return { ...DEFAULT_SUPERVISE, ...(value || {}) };
+}
+
+function waitChild(child) {
+  return new Promise((resolve) => {
+    let settled = false;
+    const finish = (code, signal, error = null) => {
+      if (settled) return; settled = true; resolve({ code: code == null ? 1 : code, signal, error });
+    };
+    child.once('error', (error) => finish(1, null, error));
+    child.once('exit', (code, signal) => finish(code, signal));
+  });
+}
+
+function scheduleRestartPrompt(config, childState, seams = {}) {
+  if (!config) return { cancel() {} };
+  let timer = null; let cancelled = false;
+  const setTimer = seams.setTimeout || setTimeout;
+  const clearTimer = seams.clearTimeout || clearTimeout;
+  timer = setTimer(async () => {
+    timer = null;
+    if (cancelled || childState.exited) return;
+    try {
+      const inject = seams.injectPrompt || require('./launch.js').injectPrompt;
+      await inject(config.tmuxBin, config.tmuxSession, config.prompt, {
+        target: process.env.TMUX_PANE || `=${config.tmuxSession}`,
+        readyMs: 0,
+      });
+    } catch (_) { /* keepalive must not die because prompt reinjection failed */ }
+  }, config.readyMs ?? 400);
+  timer.unref?.();
+  return { cancel() { cancelled = true; if (timer) clearTimer(timer); timer = null; } };
+}
+
 async function main(argv = process.argv.slice(2), seams = {}) {
   const parsed = parseArgs(argv);
   if (!parsed) throw new Error('usage: cell-exec --socket <path> --nonce <hex>');
   const payload = await (seams.receivePayload || receivePayload)(parsed.socketPath, parsed.nonce);
+  const supervise = normalizeSupervise(payload.supervise);
   const spawnImpl = seams.spawn || spawn;
-  const child = spawnImpl(payload.command, payload.args, { env: payload.env, stdio: 'inherit' });
+  const now = seams.now || Date.now;
+  const sleep = seams.sleep || ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+  const proc = seams.process || process;
+  const writeError = seams.writeError || ((message) => process.stderr.write(message));
+  const childEnv = { ...payload.env };
+  // tmux injects these only after the broker ticket was created. Preserve them
+  // for the actual TUI and bind NexusCrew MCP callbacks to the owning session.
+  if (process.env.TMUX) childEnv.TMUX = process.env.TMUX;
+  if (process.env.TMUX_PANE) childEnv.TMUX_PANE = process.env.TMUX_PANE;
+
+  let current = null; let stopping = false;
+  const handlers = new Map();
   for (const signal of ['SIGTERM', 'SIGINT', 'SIGHUP']) {
-    process.once(signal, () => { try { child.kill(signal); } catch (_) {} });
+    const handler = () => {
+      stopping = true;
+      try { if (current) current.kill(signal); } catch (_) {}
+    };
+    handlers.set(signal, handler);
+    proc.once?.(signal, handler);
   }
-  return new Promise((resolve, reject) => {
-    child.once('error', reject);
-    child.once('exit', (code, signal) => resolve(signal ? 128 : (code == null ? 1 : code)));
-  });
+  const cleanup = () => {
+    for (const [signal, handler] of handlers) proc.off?.(signal, handler);
+  };
+
+  let generation = 0;
+  let delayMs = supervise.restartDelayMs;
+  let rapid = [];
+  try {
+    for (;;) {
+      if (stopping) return 0;
+      const startedAt = now();
+      current = spawnImpl(payload.command, payload.args, { env: childEnv, stdio: 'inherit' });
+      const childState = { exited: false };
+      const prompt = generation > 0 ? scheduleRestartPrompt(payload.restartPrompt, childState, seams) : null;
+      const result = await waitChild(current);
+      childState.exited = true;
+      prompt?.cancel();
+      current = null;
+      const runtimeMs = Math.max(0, now() - startedAt);
+      if (stopping) return 0;
+      if (!supervise.enabled) return result.signal ? 128 : result.code;
+
+      // Preserve the launch readiness contract: a first child that dies before
+      // the gate is a failed start, not a successfully supervised cell.
+      if (generation === 0 && runtimeMs < supervise.initialReadyMs) {
+        return result.signal ? 128 : (result.code || 1);
+      }
+
+      const stamp = now();
+      if (runtimeMs >= supervise.resetAfterMs) {
+        rapid = [];
+        delayMs = supervise.restartDelayMs;
+      } else {
+        rapid = rapid.filter((value) => stamp - value <= supervise.rapidWindowMs);
+        rapid.push(stamp);
+        if (rapid.length > supervise.maxRapidRestarts) {
+          writeError('nexuscrew cell supervisor stopped after repeated early exits\n');
+          return result.signal ? 128 : (result.code || 1);
+        }
+      }
+      await sleep(delayMs);
+      // A down/kill-session can reach the supervisor while it is waiting in
+      // backoff. Never start another client after that stop signal.
+      if (stopping) return 0;
+      delayMs = Math.min(supervise.maxRestartDelayMs, Math.max(supervise.restartDelayMs, delayMs * 2));
+      generation += 1;
+    }
+  } finally { cleanup(); }
 }
 
 if (require.main === module) {
@@ -78,4 +229,7 @@ if (require.main === module) {
   });
 }
 
-module.exports = { parseArgs, validPayload, receivePayload, main };
+module.exports = {
+  DEFAULT_SUPERVISE, parseArgs, validSupervise, validRestartPrompt, validPayload,
+  receivePayload, normalizeSupervise, waitChild, scheduleRestartPrompt, main,
+};

package/lib/fleet/definitions.js

@@ -306,7 +306,7 @@ function parseCell(c, engineIds) {
 // ---------------------------------------------------------------------------
 // validateCommandTrust(command) -> {ok, reason}
 // Path assoluto, regular file, owner-executable, NON symlink (lstat), NON
-// world-writable. Riutilizza il pattern di binTrusted in lib/fleet/index.js.
+// world-writable. Questa è la trust boundary dei comandi engine built-in.
 // ---------------------------------------------------------------------------
 function validateCommandTrust(command) {
   if (typeof command !== 'string' || !command) return { ok: false, reason: 'command vuoto' };

package/lib/fleet/provider.js

@@ -1,103 +1,23 @@
 'use strict';
-// B4.2 — Provider selection. Sceglie UNA volta, a startup, quale fleet governa il
-// runtime (design §4b/§9b/§9g). Ritorna { mode, reason, fleet }.
-//
-//   mode ∈ 'external' | 'builtin' | 'disabled'
-//
-// Regole (design §9g):
-//  - forced (cfg.fleetProvider | NEXUSCREW_FLEET_PROVIDER): onorato e FAIL-CLOSED
-//    se indisponibile. NIENTE auto-fallback silenzioso al built-in.
-//  - auto: 'external' vince solo se fidato (binTrusted, riusato da index.js) E
-//    risponde al contratto (createFleet → available). Altrimenti 'builtin' se
-//    abilitato e fleet.json valido. Altrimenti 'disabled'.
-//
-// Il drift a runtime NON si risolve qui: e' una scelta one-shot. Se l'external
-// diventa invalido DOPO lo startup, lo status risultante sara' degraded/unavailable
-// (mai fall-through silenzioso al built-in) — gestito dal layer di status.
-const { binTrusted, externalFleetCandidates, resolveExternalFleet } = require('./index.js');
+// NexusCrew is the single Fleet authority.  The legacy external `fleet` binary
+// is intentionally not discovered or executed: definitions, credentials,
+// lifecycle and boot ownership all live in the builtin provider.
 const { createBuiltinFleet } = require('./builtin.js');
 
 const DISABLED_FLEET = Object.freeze({
   available: false, provider: 'disabled', isCellSession: () => false, capabilities: () => [],
 });
 
-function failClosed(mode) {
-  return {
-    mode: 'disabled',
-    reason: `fail-closed: provider forzato "${mode}" non disponibile (nessun auto-fallback, §9g)`,
-    fleet: DISABLED_FLEET,
-  };
+function disabled(reason) {
+  return { mode: 'disabled', reason, fleet: DISABLED_FLEET };
 }
 
-// Costruisce (una volta) i candidati e ne valuta la disponibilita'.
 async function selectProvider(cfg = {}) {
-  if (cfg.fleetEnabled === false) {
-    return { mode: 'disabled', reason: 'fleet disabilitato (fleetEnabled=false)', fleet: DISABLED_FLEET };
-  }
-
-  const forced = (cfg.fleetProvider || process.env.NEXUSCREW_FLEET_PROVIDER || '').toLowerCase() || null;
-
-  // External: scopre il binario fleet legacy cross-platform (cfg.fleetBin,
-  // $PREFIX/bin/fleet su Termux, ~/.local/bin/fleet) e accetta il primo fidato
-  // (binTrusted) che risponde al contratto (status --json con schema valido).
-  let extFleet = null;
-  let extReason = null;
-  const resolvedExternal = await resolveExternalFleet(cfg);
-  if (resolvedExternal) {
-    extFleet = resolvedExternal.fleet;
-    extReason = resolvedExternal.reason;
-  } else {
-    // Diagnosi: perché nessun candidato external è valido (fidato + contratto).
-    const cands = externalFleetCandidates(cfg);
-    if (!cands.length) extReason = 'nessun fleetBin esterno configurato';
-    else extReason = `nessun candidato external valido: ${cands.map((b) => (binTrusted(b) ? `${b} (non risponde al contratto)` : `${b} (non fidato)`)).join('; ')}`;
-  }
-
-  // Builtin: abilitato + fleet.json valido.
-  let biFleet = null;
-  let biReason = null;
-  if (cfg.builtinEnabled !== false) {
-    const f = await createBuiltinFleet({ ...cfg, fleetProviderReason: 'fleet.json definitions' });
-    if (f.available) { biFleet = f; biReason = 'fleet.json valido'; }
-    else biReason = 'fleet.json mancante o invalido (fail-closed)';
-  } else {
-    biReason = 'builtin disabilitato (builtinEnabled=false)';
-  }
-
-  // --- Mode FORZATO: fail-closed se il richiesto non e' disponibile ---
-  if (forced === 'external') {
-    return extFleet
-      ? { mode: 'external', reason: `forced external (${extReason})`, fleet: extFleet }
-      : failClosed('external');
-  }
-  if (forced === 'builtin') {
-    return biFleet
-      ? { mode: 'builtin', reason: `forced builtin (${biReason})`, fleet: biFleet }
-      : failClosed('builtin');
-  }
-  if (forced === 'disabled') {
-    return { mode: 'disabled', reason: 'forced disabled', fleet: DISABLED_FLEET };
-  }
-  if (forced) {
-    return failClosed(forced); // valore forzato non riconosciuto
-  }
-
-  // --- AUTO: external fidato+contratto vince, poi builtin, poi disabled ---
-  if (extFleet) {
-    return { mode: 'external', reason: `auto: external ${extReason}`, fleet: extFleet };
-  }
-  if (biFleet) {
-    return {
-      mode: 'builtin',
-      reason: `auto: external scartato (${extReason}) → builtin (${biReason})`,
-      fleet: biFleet,
-    };
-  }
-  return {
-    mode: 'disabled',
-    reason: `auto: nessun provider disponibile — external: ${extReason}; builtin: ${biReason}`,
-    fleet: DISABLED_FLEET,
-  };
+  if (cfg.fleetEnabled === false) return disabled('fleet disabilitata (fleetEnabled=false)');
+  if (cfg.builtinEnabled === false) return disabled('fleet builtin disabilitata (builtinEnabled=false)');
+  const fleet = await createBuiltinFleet({ ...cfg, fleetProviderReason: 'NexusCrew builtin fleet' });
+  if (!fleet.available) return disabled('fleet.json mancante o invalido (fail-closed)');
+  return { mode: 'builtin', reason: 'NexusCrew builtin fleet', fleet };
 }
 
 module.exports = { selectProvider, DISABLED_FLEET };

package/lib/fleet/routes.js

@@ -1,9 +1,8 @@
 'use strict';
 const express = require('express');
 
-// Capability minime del contratto storico per i fleet external/legacy che NON
-// dichiarano capabilities() (design §9c): status/up/down/engine/boot.
-// Il built-in B4 aggiunge define/edit/remove/schema.
+// Fallback difensivo per un adapter builtin incompleto nei test. Il provider di
+// prodotto dichiara sempre la propria capability list.
 const DEFAULT_CAPS = ['status', 'up', 'down', 'engine', 'boot'];
 
 function capList(fleet) {
@@ -33,8 +32,7 @@ function fleetRoutes(fleetP, cfg = {}) {
 
   const guard = (fn, opts = {}) => async (req, res) => {
     try {
-      // READONLY e' un gate di prodotto, non solo del provider built-in: deve
-      // bloccare anche il fleet esterno legacy prima che tocchi systemd/tmux reali.
+      // READONLY e' un gate di prodotto oltre che del provider built-in.
       if (opts.mutate && readonly()) return res.status(403).json({ error: 'READONLY: mutazione fleet bloccata' });
       const fleet = await fleetP;
       if (!fleet.available) return res.status(404).json({ error: 'fleet non disponibile' });
@@ -45,8 +43,7 @@ function fleetRoutes(fleetP, cfg = {}) {
   };
 
   // /status espone anche `provider` e `capabilities` (design §9b/§9c), oltre ai
-  // campi storici (available/cells/engines). Provider senza capabilities()
-  // (external legacy) → DEFAULT_CAPS; external senza campo provider → 'external'.
+  // campi storici (available/cells/engines).
   r.get('/status', async (_req, res) => {
     try {
       const fleet = await fleetP;
@@ -59,11 +56,8 @@ function fleetRoutes(fleetP, cfg = {}) {
         });
       }
       const st = await fleet.status();
-      const provider = st.provider || fleet.provider || 'external';
-      // bootOwner (§9b): preferisce quello dichiarato dal provider (st.bootOwner);
-      // altrimenti deriva dal mode: builtin -> 'builtin', disabled -> 'none',
-      // external -> 'external'. Contratto valori: 'builtin' | 'external' | 'none'.
-      const bootOwner = st.bootOwner || (provider === 'builtin' ? 'builtin' : provider === 'disabled' ? 'none' : 'external');
+      const provider = st.provider || fleet.provider || 'builtin';
+      const bootOwner = st.bootOwner || (provider === 'disabled' ? 'none' : 'builtin');
       res.json({
         ...st,
         provider,
@@ -76,7 +70,6 @@ function fleetRoutes(fleetP, cfg = {}) {
   // /up: il built-in (capability 'edit') è definitions-driven — se il body porta
   // un engine lo persiste sulla cella (f.engine) PRIMA di up, perché l'engine
   // dichiarato vince sull'override runtime (ignored dal builtin.up).
-  // External legacy: passthrough up(cell,{engine,boot}) invariato.
   r.post('/up', guard(async (f, b) => {
     const cell = String(b.cell || '');
     if (b.engine && capList(f).includes('edit')) {
@@ -129,7 +122,7 @@ function fleetRoutes(fleetP, cfg = {}) {
     return f.restoreEngines(b.engines, { overwrite: b.overwrite === true });
   }, { mutate: true }));
   // Riconciliazione sessione tmux esistente (cella Fleet legacy orfana) in cella
-  // gestita fleet.json. Capability 'define' (solo builtin): external legacy -> 501.
+  // gestita fleet.json.
   r.post('/import-cell', guard(async (f, b) => { requireCap(f, 'import'); return f.importCell(b || {}); }, { mutate: true }));
 
   r.use((err, _req, res, _next) => {

package/lib/fleet/runtime.js

@@ -93,7 +93,8 @@ function createBuiltinRuntime(ctx) {
         permissionPolicy: effectivePolicy,
         permissionPolicies: { ...(c.permissionPolicies || {}) },
         active: alive, boot: c.boot, tmux: alive,
-        rc: '', key: '', degraded: false, // builtin: cella "up" <=> sessione tmux viva
+        supervised: true, keepalive: true,
+        rc: '', key: '', degraded: false, // supervisor vivo <=> sessione tmux viva
       };
     });
     const needsOllama = cache.defs.engines.some((e) => e.managed?.provider === 'ollama-cloud');
@@ -157,26 +158,45 @@ function createBuiltinRuntime(ctx) {
     const realCwd = resolveCwd(cell.cwd, home);
     if (!realCwd) throw httpError(400, `cwd non valida (deve esistere sotto la home): ${cell.cwd}`);
 
-    // (4)+(5) argv diretto (no shell). Environment-bearing launches go
-    // through a private, one-shot Unix-socket broker so credentials never
-    // appear in `ps`, tmux argv, tmux global/session env or a temporary file.
+    // (4)+(5) argv diretto (no shell). Every cell goes through the private
+    // broker-backed supervisor: credentials never enter tmux state/argv and a
+    // client that exits after readiness is restarted with bounded backoff.
     // '-P -F #{pane_id}': tmux stampa il pane id della sessione appena creata,
     // cosi' l'iniezione del prompt bersaglia ESATTAMENTE quel pane (audit impl
     // #5: elimina la race di riuso del nome sessione tra waitAlive e paste).
-    let tmuxLaunchEngine = launchEngine;
-    if (Object.keys(launchEngine.env || {}).length) {
-      const child = composeClientInvocation(launchEngine, cell);
-      const ticket = await launchBroker.issue({
-        command: child.command,
-        args: child.args,
-        env: { ...minimalEnv(), ...launchEngine.env },
-      });
-      tmuxLaunchEngine = {
-        command: process.execPath,
-        args: [path.join(__dirname, 'cell-exec.js'), '--socket', ticket.socketPath, '--nonce', ticket.nonce],
-        env: {}, promptMode: 'managed-argv',
-      };
-    }
+    const readyMs = cfg.launchReadyMs != null ? cfg.launchReadyMs : 500;
+    const child = composeClientInvocation(launchEngine, cell);
+    const ticket = await launchBroker.issue({
+      command: child.command,
+      args: child.args,
+      env: {
+        ...minimalEnv(),
+        ...launchEngine.env,
+        NEXUSCREW_MCP_SESSION: cell.tmuxSession,
+      },
+      supervise: {
+        enabled: true,
+        initialReadyMs: Math.max(50, Math.min(30000, Number(readyMs) || 500)),
+        restartDelayMs: Math.max(50, Math.min(60000, Number(cfg.cellRestartDelayMs) || 1000)),
+        maxRestartDelayMs: Math.max(100, Math.min(300000, Number(cfg.cellMaxRestartDelayMs) || 60000)),
+        resetAfterMs: Math.max(1000, Math.min(3600000, Number(cfg.cellRestartResetMs) || 30000)),
+        rapidWindowMs: Math.max(1000, Math.min(3600000, Number(cfg.cellRapidWindowMs) || 60000)),
+        maxRapidRestarts: Math.max(1, Math.min(100, Number(cfg.cellMaxRapidRestarts) || 8)),
+      },
+      ...(launchEngine.promptMode === 'send-keys' && cell.prompt ? {
+        restartPrompt: {
+          tmuxBin,
+          tmuxSession: cell.tmuxSession,
+          prompt: cell.prompt,
+          readyMs: Math.max(0, Math.min(30000, Number(cfg.sendKeysReadyMs) || readyMs)),
+        },
+      } : {}),
+    });
+    const tmuxLaunchEngine = {
+      command: process.execPath,
+      args: [path.join(__dirname, 'cell-exec.js'), '--socket', ticket.socketPath, '--nonce', ticket.nonce],
+      env: {}, promptMode: 'managed-argv',
+    };
     const argv = composeLaunchArgv({ tmuxSession: cell.tmuxSession, realCwd, engine: tmuxLaunchEngine, cell });
     argv.splice(2, 0, '-P', '-F', '#{pane_id}');
     // Mantieni il pane morto solo durante la finestra di readiness: permette di
@@ -196,7 +216,6 @@ function createBuiltinRuntime(ctx) {
     // moment later (missing login, bad model, incompatible provider).  Without
     // this readiness gate the PWA reported success and then showed nothing.
     // Always verify liveness, including cells without a system prompt.
-    const readyMs = cfg.launchReadyMs != null ? cfg.launchReadyMs : 500;
     const paneId = launch.stdout.trim().split('\n')[0] || '';
     const readiness = paneId.startsWith('%')
       ? await waitStablePane(tmuxBin, paneId, { env: minimalEnv(), readyMs })
@@ -253,7 +272,7 @@ function createBuiltinRuntime(ctx) {
 
   // restart = down (riusa la kill esistente; sessione non viva NON e' errore,
   // come down) seguito da up (rilancia secondo la definizione corrente).
-  // Capability del SOLO built-in: i provider legacy non la espongono (501 in route).
+  // Restart è implementato dal runtime built-in come transizione intenzionale.
   async function restart(cellId) {
     if (readonly()) throw httpError(403, 'READONLY: restart bloccato');
     await down(cellId); // idempotente: cella non viva -> nessun errore