@mnstry/atelier 0.2.0-alpha.11 → 0.2.0-alpha.13

package/src/runtime/obsidian/launch-plan.mjs

@@ -0,0 +1,91 @@
+// How `open` shows a vault in Obsidian, as steps a launcher carries out. Pure.
+//
+// Two facts of the app (1.13.7, read from its main process and checked on an
+// isolated instance) decide the steps:
+//
+//   - An app started with an `obsidian://` URL opens only that URL's vault and
+//     deletes the `open` flag of every other vault without a window, so the
+//     person's other vaults do not come back the next time Obsidian starts.
+//     Started plainly, it reopens every vault its list marks open (the view's
+//     vault included, when it was added to the list marked open) and keeps
+//     the flags.
+//   - `open?path=` picks the listed vault whose folder is the longest string
+//     prefix of the path, with no separator check; `open?vault=<id>` names one
+//     vault exactly.
+//
+// So a vault is named by its id where that id reaches it first (a vaultRoute
+// of `how: 'id'`), and otherwise by its own path, which the app then matches
+// exactly (a listed folder is the longest prefix of its own path); an app that is not running is
+// started plainly and handed the URL only once it answers: a URL reaching a
+// running app opens a window and changes no flag. On Linux a plain start is not
+// qualified, and the URL starts the app, with the flag loss as a known limit.
+//
+// Steps:
+//   { step: 'plain-start' }           start the app with no URL
+//   { step: 'wait-for-app' }          wait, bounded, until the app itself answers its command-line tool
+//   { step: 'url', uri }              hand the URL to the running app
+//   { step: 'url-start', uri }        start the app with the URL (Linux only)
+//
+// { ok: true, steps } or { ok: false, reason }.
+
+const VAULT_ID = /^[A-Za-z0-9_-]{1,64}$/
+
+export function launchPlan({ platform = process.platform, appRunning, vaultId = null, vaultPath = null } = {}) {
+  let uri
+  if (typeof vaultId === 'string' && VAULT_ID.test(vaultId)) uri = `obsidian://open?vault=${encodeURIComponent(vaultId)}`
+  else if (typeof vaultPath === 'string' && vaultPath.startsWith('/') && !vaultPath.includes('\u0000')) uri = `obsidian://open?path=${encodeURIComponent(vaultPath)}`
+  else return { ok: false, reason: 'vault-id-unknown' }
+  if (platform !== 'darwin' && platform !== 'linux') return { ok: false, reason: 'launcher-platform-unqualified' }
+  if (appRunning === true) return { ok: true, steps: [{ step: 'url', uri }] }
+  if (platform === 'darwin') return { ok: true, steps: [{ step: 'plain-start' }, { step: 'wait-for-app' }, { step: 'url', uri }] }
+  return { ok: true, steps: [{ step: 'url-start', uri }] }
+}
+
+// Pure. Whether the command-line tool's reply to a URL says the app took it ("Processed URI …").
+export const urlProcessed = (stdout) => typeof stdout === 'string' && /^processed uri\b/im.test(stdout)
+
+// Carries out a launchPlan with injected actions, so the order and the
+// fallbacks are the same for the production launcher and the test harness:
+//
+//   start()        -> Promise<boolean>  start the app with no URL
+//   answered()     -> Promise<boolean>  one poll: the app itself answered (appAnswered); a tool that cannot find the
+//                                       app yet is not an answer
+//   handLink(uri)  -> Promise<boolean>  the app's tool took the URL (urlProcessed)
+//   osOpen(uri)    -> Promise<boolean>  the operating system accepted the URL
+//
+// A URL is never handed to the operating system for an app this launch
+// started: that would start or reach it while it starts, which is what drops
+// the other vaults' reopen flags. A vault added flagged open is opened anyway by
+// a plainly started app, and `open` waits for it; one already listed but closed
+// is handed the link once more instead (opening.mjs). `startedEarlier` says
+// that an earlier launch of the same `open` started the app (a link handed to
+// it once more): the link then goes through the app's tool only, as well.
+export async function runLaunchPlan(plan, { start, answered, handLink, osOpen, sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms)), waitMs = 30_000, pollMs = 500, now = () => Date.now(), startedEarlier = false }) {
+  if (!plan?.ok) return { launched: false, reason: plan?.reason ?? 'launcher-refused' }
+  let started = startedEarlier === true
+  let reason = 'url-accepted'
+  for (const { step, uri } of plan.steps) {
+    if (step === 'plain-start') {
+      if (!(await start())) return { launched: false, reason: 'os-open-failed' }
+      started = true
+    } else if (step === 'wait-for-app') {
+      const deadline = now() + waitMs
+      let up = false
+      while (!up) {
+        up = await answered()
+        if (up) break
+        if (now() >= deadline) return { launched: true, reason: 'app-started-not-answering' }
+        await sleep(pollMs)
+      }
+    } else if (step === 'url') {
+      if (await handLink(uri)) continue
+      if (started) return { launched: true, reason: 'app-started-link-not-taken' }
+      if (!(await osOpen(uri))) return { launched: false, reason: 'os-open-failed' }
+      reason = 'os-open-accepted'
+    } else if (step === 'url-start') {
+      if (!(await osOpen(uri))) return { launched: false, reason: 'os-open-failed' }
+      reason = 'os-open-accepted'
+    }
+  }
+  return { launched: true, reason: started && reason === 'url-accepted' ? 'plain-start-then-url' : reason }
+}

package/src/runtime/obsidian/lifecycle.mjs

@@ -2,15 +2,17 @@ import childProcess from 'node:child_process'
 import { randomBytes as cryptoRandomBytes } from 'node:crypto'
 import fs from 'node:fs'
 import net from 'node:net'
+import path from 'node:path'
+import { compareAppVersions } from './app-capability.mjs'
 import { isoTime } from './documents.mjs'
-import { refuse } from './errors.mjs'
+import { ObsidianMaintenanceRefusal, refuse } from './errors.mjs'
 import { ensureWorkspaceIdentity } from './machine-settings.mjs'
 import { acquirePrivateGenerationLock, createAbandonmentProof, isProcessAlive } from './private-lock.mjs'
 import { processRunsRecordedExecutable } from './process-identity.mjs'
 import { DEFAULT_PROBE_TIMEOUT_MS, LOOPBACK_HOSTS, probeHealth, requestLoopback } from './service-client.mjs'
 import { SERVICE_ENTRY_PATH } from './service-entry-path.mjs'
 import {
-  CONSENT_COVERAGES, SERVICE_SETTINGS_SCHEMA, executableIdentity, openServiceLog, publicRecord, readServiceRecord, readServiceSettings, removeServiceRecord,
+  CONSENT_COVERAGES, SERVICE_SETTINGS_SCHEMA, executableIdentity, openServiceLog, publicRecord, readLastStartup, readServiceRecord, readServiceSettings, releaseOfEntry, removeServiceRecord,
   serviceNameFor, servicePaths, writeServiceSettings,
 } from './service-record.mjs'
 import { resolveServiceWorkspace } from './service.mjs'
@@ -103,8 +105,18 @@ function freeLoopbackPort(host) {
   })
 }
 
-async function resolveSettings({ workspaceRoot, workspaceId }, { host, port, consent, now }) {
+// The service settings of this workspace with the address and consent given, written when that changes anything: the
+// first start needs a consent naming its actor, and a consent for another actor or coverage replaces the recorded one.
+// Installing and removing a login item raise and lower the coverage through it (login-item.mjs).
+export async function ensureServiceSettings(workspace, { host, port, consent, now }) {
+  return resolveSettings(workspace, { host, port, consent, now })
+}
+
+async function resolveSettings({ workspaceRoot, workspaceId }, { host, port, consent: given, now }) {
   const current = readServiceSettings({ workspaceRoot, workspaceId })
+  // A consent derived from the account of a person at a terminal (`derived: true`) stands only for a workspace that has
+  // none. Read here, under the start lock, so one recorded meanwhile by another run is never replaced or narrowed.
+  const consent = given?.derived === true && current !== null ? undefined : given
   if (host !== undefined && !LOOPBACK_HOSTS.includes(host)) refuse('service-address-not-loopback', 'the service host must be the literal 127.0.0.1 or ::1')
   if (port !== undefined && (!Number.isInteger(port) || port < 1024 || port > 65535)) refuse('service-address-not-loopback', 'the service port must be between 1024 and 65535')
   if (consent !== undefined && (typeof consent?.actor !== 'string' || !CONSENT_COVERAGES.includes(consent.coverage ?? 'service'))) refuse('startup-consent-required', 'a consent names its actor and what it covers')
@@ -119,11 +131,55 @@ async function resolveSettings({ workspaceRoot, workspaceId }, { host, port, con
   return changed ? writeServiceSettings({ workspaceRoot, workspaceId, settings: next }) : current
 }
 
+// Asks the service manager of the installed login item to start the service, and waits, bounded, for this
+// workspace's service to prove itself (healthy, or busy in its first tick) with a record naming the digest of the
+// entry the item runs. The runtime identifier is the service's own there, so that digest is what makes it the one
+// asked for. A service that refused under the item exited cleanly and recorded why (`last-startup.json`); that code is
+// the answer. { result } or, when the manager did not start it (the item is not loaded: switched off in System
+// Settings, or no user service manager), { fallback: code }.
+async function startThroughLoginItem({ workspace, loginItem, entryPath, deadline, probeTimeoutMs, alive, rules }) {
+  const { workspaceRoot, workspaceId } = workspace
+  const lastStartup = () => { try { return JSON.stringify(readLastStartup(workspace)) } catch { return null } }
+  const before = lastStartup()
+  let asked
+  try { asked = await loginItem.start() } catch { asked = { ok: false, code: 'login-item-start-failed' } }
+  const item = { via: 'login-item', ...(asked?.refreshed === true ? { refreshed: true } : {}) }
+  if (asked?.ok !== true) return { fallback: typeof asked?.code === 'string' ? asked.code : 'login-item-start-failed', refreshed: asked?.refreshed === true }
+  // A unit written again on the way names the entry of now. One whose entry cannot be read cannot prove anything.
+  let expected
+  try { expected = executableIdentity(typeof asked.entryPath === 'string' ? asked.entryPath : entryPath).digest } catch { return { result: { state: 'start-failed', started: false, alreadyRunning: false, workspaceId, reason: 'login-item-entry-missing', observed: null, logPath: servicePaths(workspaceRoot).loginItemLog, loginItem: item } } }
+  let last = null
+  const proves = (status) => status?.record?.executable?.digest === expected
+  while (Date.now() < deadline) {
+    last = await evaluate(workspace, { probeTimeoutMs, alive, rules }).catch((error) => ({ state: 'refused', reason: error.code ?? 'untyped-error' }))
+    if (last.state === 'healthy' && proves(last)) return { result: { ...shown(last), started: true, alreadyRunning: false, loginItem: item } }
+    const now = lastStartup()
+    if (now !== before && now !== null) {
+      const startup = JSON.parse(now)
+      if (startup?.outcome === 'refused') return { result: { state: 'start-failed', started: false, alreadyRunning: false, workspaceId, reason: startup.code, observed: last.state ?? null, logPath: servicePaths(workspaceRoot).log, loginItem: item } }
+    }
+    await sleep(50)
+  }
+  // As for a child started here: a service that proved itself and went straight into a long first tick runs, and is
+  // answered as busy only once the wait for it to be healthy is over.
+  if (last?.state === 'busy' && proves(last)) return { result: { ...shown(last), started: true, alreadyRunning: false, busy: true, loginItem: item } }
+  return { result: { state: 'start-failed', started: false, alreadyRunning: false, workspaceId, reason: 'health-never-proved-ownership', observed: last?.state ?? null, logPath: servicePaths(workspaceRoot).loginItemLog, loginItem: item } }
+}
+
+// `loginItem`, for a workspace with an installed login item: { start() }, which asks its service manager to start the
+// service (login-item.mjs). The service is then started through it, never as a child beside it, so two starts never
+// compete; `entryPath` is the entry the item runs. When the manager does not start it, the service is started as a
+// child, and the answer says why (`loginItem: { via: 'child', reason }`).
+//
+// `replaceOutdated`: a proven runtime of this workspace that runs an earlier release than the entry this start would run
+// (runtimeRelease) is stopped as `stopService` stops it and started again in its place, under the consent already
+// recorded (`replaced: 'outdated'`); one of a later release is never replaced (`release: 'later'`). Without it, any
+// proven runtime is answered as already running.
 export async function startService(options = {}, rules = LIFECYCLE_PRIMITIVES) {
   const {
     loadProject, dataRoot, host, port, consent, detached = false, entryPath = SERVICE_ENTRY_PATH, entryArgs = [], intervalMs,
     startTimeoutMs = DEFAULT_START_TIMEOUT_MS, probeTimeoutMs, clock = () => new Date(), env = process.env, platform = process.platform,
-    spawn = childProcess.spawn, execPath = process.execPath, alive = isProcessAlive, randomBytes = cryptoRandomBytes,
+    spawn = childProcess.spawn, execPath = process.execPath, alive = isProcessAlive, randomBytes = cryptoRandomBytes, loginItem = null, replaceOutdated = false,
   } = options
   const { project, workspace } = context({ loadProject, dataRoot, env, platform, create: true })
   const { workspaceRoot, workspaceId } = workspace
@@ -144,11 +200,26 @@ export async function startService(options = {}, rules = LIFECYCLE_PRIMITIVES) {
 
   let child = null
   try {
-    const before = await evaluate(workspace, { probeTimeoutMs, alive, rules })
-    if (rules.isOurs(before)) return { ...shown(before), started: false, alreadyRunning: true }
+    let before = await evaluate(workspace, { probeTimeoutMs, alive, rules })
+    // A runtime of an earlier release, still running after an upgrade, is replaced when asked to; it is stopped through its
+    // own listener, as its owner stops it, and nothing else is ever stopped here.
+    let replaced = null
+    if (rules.isOurs(before)) {
+      const standing = replaceOutdated ? runtimeRelease(before, entryPath) : null
+      if (standing === 'later') return { ...shown(before), started: false, alreadyRunning: true, release: 'later' }
+      if (standing !== 'outdated') return { ...shown(before), started: false, alreadyRunning: true }
+      const stopped = await stopService({ loadProject, dataRoot, env, platform, probeTimeoutMs, alive }, rules)
+      if (!stopped.stopped) return { ...shown(before), started: false, alreadyRunning: true, release: 'outdated', reason: stopped.reason ?? 'the-runtime-was-not-stopped' }
+      replaced = 'outdated'
+      before = await evaluate(workspace, { probeTimeoutMs, alive, rules })
+    }
     // Running, and in a long tick: nothing is started beside it and nothing replaces it.
     if (before.state === 'busy') return { ...shown(before), started: false, alreadyRunning: true, busy: true }
-    if (rules.refusesOccupied(before)) refuse('service-port-occupied', 'something that is not this service answers on the loopback port; it is never taken over', { reason: before.reason, address: before.address })
+    // With a login item, a listener that has not written its record yet may be the service its manager is starting
+    // right now (it listens before it records itself): the start below asks the manager, which starts nothing beside
+    // a running job, and accepts only a runtime that proves itself. Anything else stays occupied and is never adopted.
+    const starting = loginItem !== null && before.state === 'occupied' && before.reason === 'a-listener-without-a-record'
+    if (rules.refusesOccupied(before) && !starting) refuse('service-port-occupied', 'something that is not this service answers on the loopback port; it is never taken over', { reason: before.reason, address: before.address })
     // `stale-record` and `pid-not-ours`: nothing listens, so the recorded runtime is not serving. Its PID is never signalled;
     // the new service replaces the record once it listens. Nothing under recovery or staging is touched on the way.
     const settings = await resolveSettings(workspace, { host, port, consent, now: isoTime(clock) })
@@ -157,13 +228,23 @@ export async function startService(options = {}, rules = LIFECYCLE_PRIMITIVES) {
       if (moved.kind !== 'refused') refuse('service-port-occupied', 'something already answers on the selected loopback port; it is never taken over', { address: { host: settings.host, port: settings.port } })
     }
 
+    // An installed login item starts it. Only when its manager does not is a child started, and the answer says why.
+    let fallback = null
+    if (loginItem !== null) {
+      const managed = await startThroughLoginItem({ workspace, loginItem, entryPath, deadline, probeTimeoutMs, alive, rules })
+      if (managed.result) return replaced === null ? managed.result : { ...managed.result, replaced }
+      fallback = { via: 'child', reason: managed.fallback, ...(managed.refreshed ? { refreshed: true } : {}) }
+    }
+    const withFallback = (result) => ({ ...result, ...(fallback === null ? {} : { loginItem: fallback }), ...(replaced === null ? {} : { replaced }) })
+
     const runtimeId = `rt-${randomBytes(16).toString('hex')}`
     const executable = executableIdentity(entryPath)
     const log = openServiceLog(workspaceRoot)
     try {
       const args = [executable.path, `--project=${project.configPath}`, ...(dataRoot === undefined ? [] : [`--data-root=${dataRoot}`]), `--runtime-id=${runtimeId}`, ...(intervalMs === undefined ? [] : [`--interval-ms=${intervalMs}`]), ...entryArgs]
-      // No shell. Detached only when the service is meant to outlive the command that starts it.
-      child = spawn(execPath, args, { detached, shell: false, windowsHide: true, stdio: ['ignore', log.descriptor, log.descriptor], env })
+      // No shell. Detached only when the service is meant to outlive the command that starts it. It runs in the root
+      // directory, never in the one the command was started in, which may be a vault or a folder somebody removes.
+      child = spawn(execPath, args, { detached, shell: false, windowsHide: true, stdio: ['ignore', log.descriptor, log.descriptor], env, cwd: path.parse(executable.path).root })
     } finally {
       fs.closeSync(log.descriptor)
     }
@@ -177,19 +258,19 @@ export async function startService(options = {}, rules = LIFECYCLE_PRIMITIVES) {
       last = await evaluate(workspace, { probeTimeoutMs, alive, rules }).catch((error) => ({ state: 'refused', reason: error.code ?? 'untyped-error' }))
       if (last.state === 'healthy' && last.record.runtimeId === runtimeId && last.record.pid === child.pid) {
         if (detached) child.unref()
-        return { ...shown(last), started: true, alreadyRunning: false, ...(detached ? {} : { child }) }
+        return withFallback({ ...shown(last), started: true, alreadyRunning: false, ...(detached ? {} : { child }) })
       }
       await sleep(50)
     }
     // The child created here wrote the record and went straight into a long first tick: it runs, and is not stopped.
     if (exited === null && last?.state === 'busy' && last.record?.runtimeId === runtimeId && last.record?.pid === child.pid) {
       if (detached) child.unref()
-      return { ...shown(last), started: true, alreadyRunning: false, busy: true, ...(detached ? {} : { child }) }
+      return withFallback({ ...shown(last), started: true, alreadyRunning: false, busy: true, ...(detached ? {} : { child }) })
     }
     // Ownership was never proven: only the child created here is stopped, by its handle.
     if (exited === null) { child.kill(); const until = Date.now() + 5000; while (exited === null && Date.now() < until) await sleep(25) }
     removeServiceRecord({ workspaceRoot, workspaceId, runtimeId, pid: child.pid })
-    return { state: 'start-failed', started: false, alreadyRunning: false, workspaceId, reason: exited?.error ?? (exited?.code === null || exited === null ? 'health-never-proved-ownership' : `service-exited-${exited.code}`), observed: last?.state ?? null, logPath: log.file }
+    return withFallback({ state: 'start-failed', started: false, alreadyRunning: false, workspaceId, reason: exited?.error ?? (exited?.code === null || exited === null ? 'health-never-proved-ownership' : `service-exited-${exited.code}`), observed: last?.state ?? null, logPath: log.file })
   } finally {
     lock.release()
   }
@@ -226,26 +307,116 @@ export async function stopService(options = {}, rules = LIFECYCLE_PRIMITIVES) {
 
 // One authenticated request to the proven runtime, and to nothing else: anything but a healthy status is answered
 // with that status and no request is made.
-async function askProvenRuntime(options, rules, { method, operation, timeoutMs }) {
+async function askProvenRuntime(options, rules, { method, operation, timeoutMs, body = {} }) {
   const { loadProject, dataRoot, probeTimeoutMs, env = process.env, platform = process.platform, alive = isProcessAlive } = options
   const { workspace } = context({ loadProject, dataRoot, env, platform })
   if (!workspace?.workspaceRoot) return { requested: false, state: 'stopped', reason: 'workspace-not-prepared' }
   const status = await evaluate(workspace, { probeTimeoutMs, alive, rules })
   if (status.state !== 'healthy') return { requested: false, state: status.state, reason: status.reason }
   const { record } = status
-  const answer = await requestLoopback({ host: record.host, port: record.port, method, path: operation, bearer: record.ext.bearer, payload: method === 'POST' ? { runtimeId: record.runtimeId } : null, timeoutMs })
-  return { requested: true, state: 'healthy', answer }
+  const answer = await requestLoopback({ host: record.host, port: record.port, method, path: operation, bearer: record.ext.bearer, payload: method === 'POST' ? { runtimeId: record.runtimeId, ...body } : null, timeoutMs })
+  return { requested: true, state: 'healthy', answer, runtimeId: record.runtimeId }
+}
+
+// Pure. How the release a runtime recorded at its start (`executable.ext.release`, see releaseIdentity: the package
+// version and a digest of every runtime module) stands to the installed one, `installed` being { entry, release }, the
+// digest of the entry this command would start and the release that entry's package holds now (releaseOfEntry):
+//   current   the same version, entry module and modules;
+//   outdated  an earlier version; the same version with another entry module or other modules; or no release named,
+//             as releases before the one that began recording it record none;
+//   later     a later version, or another version that cannot be ordered. The installed release never replaces it, so two
+//             installations used on one workspace do not replace each other's runtime.
+// Versions are ordered as semantic versions, a prerelease below its release (0.2.0-alpha.11 < 0.2.0-alpha.12 < 0.2.0).
+export function releaseStanding(executable, installed) {
+  const recorded = executable?.ext?.release
+  if (recorded === undefined || recorded === null) return 'outdated'
+  // The same version string is compared by content, whether or not it can be ordered: a fork's "dev" on both sides
+  // is this release when its modules match, and outdated otherwise, never later.
+  const order = recorded.version === installed.release.version ? 0 : compareAppVersions(recorded.version, installed.release.version)
+  if (order === null || order > 0) return 'later'
+  if (order < 0) return 'outdated'
+  return executable.digest === installed.entry && recorded.digest === installed.release.digest ? 'current' : 'outdated'
+}
+
+// How the release the proven runtime runs stands to the installed one (releaseStanding), `entryPath` being the entry
+// this command would start: its digest and the release are both read from that entry, so with a login item the
+// installed release is the project's own package, read through the path the item names, whichever package this command
+// runs from. Null when the runtime is not proven, or the installed side cannot be read.
+export function runtimeRelease(status, entryPath) {
+  if (status?.state !== 'healthy' || typeof status.record?.executable?.digest !== 'string' || typeof entryPath !== 'string') return null
+  let installed
+  try { installed = { entry: executableIdentity(entryPath).digest, release: releaseOfEntry(entryPath) } } catch { return null }
+  return releaseStanding(status.record.executable, installed)
+}
+
+// Stops the proven runtime of this workspace through its own listener and starts `entryPath` in its place, detached,
+// under the consent already recorded. Only a runtime that proves itself ours is ever stopped (stopService).
+// { ok: true } or { ok: false, state, reason }.
+async function restartProvenRuntime(options, rules) {
+  const { consent: _given, ...rest } = options
+  const stopped = await stopService(rest, rules)
+  if (!stopped.stopped) return { ok: false, state: stopped.state, reason: stopped.reason ?? 'the-runtime-was-not-stopped' }
+  let started
+  try { started = await startService({ ...rest, detached: true }, rules) } catch (error) {
+    if (!(error instanceof ObsidianMaintenanceRefusal)) throw error
+    return { ok: false, state: 'stopped', reason: error.code }
+  }
+  if (started.state === 'healthy') return { ok: true }
+  return { ok: false, state: started.state, reason: started.state === 'busy' ? 'restarted-service-in-its-first-tick' : started.reason ?? started.state }
 }
 
 // Asks the proven runtime for one tick now and returns what that tick reported. A tick that outlasts the wait is
-// `pending`, not an error.
+// `pending`, not an error. With `scopeId`, that view is prepared and published once more on the tick.
+//
+// `service`, the start options of the entry this command would start ({ entryPath, entryArgs, ... }), lets an
+// outdated runtime be replaced: one that runs an earlier release (runtimeRelease) is restarted before it is asked,
+// and one that refuses a tick naming a view (a runtime of 0.2.0-alpha.11 or earlier, which knows no view in a tick)
+// is restarted and asked again, each time under the consent already recorded (`restarted: 'outdated'`). A listener
+// of now refuses a tick only when it names another runtime: when a concurrent command replaced the runtime between
+// the check and the request, the one that took its place is asked, and nothing is restarted. A runtime of a later
+// release is never replaced by this one, nor asked: `service-other-release`. Without `service`, an outdated runtime
+// is only reported (`service-outdated`). `runtimeId` names the runtime that answered, or the one left running.
 export async function requestServiceTick(options = {}, rules = LIFECYCLE_PRIMITIVES) {
-  const asked = await askProvenRuntime(options, rules, { method: 'POST', operation: '/tick', timeoutMs: options.tickTimeoutMs ?? 60 * 1000 })
-  if (!asked.requested) return asked
-  const { answer } = asked
-  if (answer.kind === 'timeout') return { requested: true, state: 'healthy', pending: true, tick: null, reason: 'tick-still-running' }
-  if (answer.kind !== 'response' || answer.statusCode !== 200 || answer.body === null) return { requested: true, state: 'healthy', pending: false, tick: null, reason: 'tick-was-not-answered' }
-  return { requested: true, state: 'healthy', pending: false, tick: answer.body, reason: 'tick-ran' }
+  const { service = null, scopeId } = options
+  const ask = () => askProvenRuntime(options, rules, { method: 'POST', operation: '/tick', timeoutMs: options.tickTimeoutMs ?? 60 * 1000, ...(scopeId === undefined ? {} : { body: { scopeId } }) })
+  let restarted = null
+  const restart = async () => {
+    const renewed = await restartProvenRuntime({ ...options, ...service }, rules)
+    if (renewed.ok || renewed.reason === 'restarted-service-in-its-first-tick') restarted = 'outdated'
+    return renewed.ok ? null : { requested: false, state: renewed.state, reason: renewed.reason, ...(restarted === null ? {} : { restarted }) }
+  }
+  const later = (status) => ({ requested: false, state: 'healthy', runtimeId: status.record.runtimeId, reason: 'service-other-release' })
+  const replaces = typeof service?.entryPath === 'string'
+  if (replaces) {
+    const status = await serviceStatus(options, rules)
+    const standing = runtimeRelease(status, service.entryPath)
+    if (standing === 'later') return later(status)
+    if (standing === 'outdated') {
+      const failed = await restart()
+      if (failed) return failed
+    }
+  }
+  let asked = await ask()
+  const refusesView = () => asked.requested && scopeId !== undefined && asked.answer.kind === 'response' && asked.answer.statusCode === 409
+  if (refusesView() && replaces && restarted === null) {
+    // The record is read again first: a runtime that took this one's place meanwhile is asked, not replaced.
+    const now = await serviceStatus(options, rules)
+    if (now.state === 'healthy' && now.record?.runtimeId !== asked.runtimeId) asked = await ask()
+    if (refusesView()) {
+      if (runtimeRelease(now, service.entryPath) === 'later') return later(now)
+      const failed = await restart()
+      if (failed) return failed
+      asked = await ask()
+    }
+  }
+  const shown = restarted === null ? {} : { restarted }
+  if (!asked.requested) return { ...asked, ...shown }
+  const { answer, runtimeId } = asked
+  const base = { requested: true, state: 'healthy', runtimeId, ...shown }
+  if (refusesView()) return { ...base, pending: false, tick: null, reason: 'service-outdated' }
+  if (answer.kind === 'timeout') return { ...base, pending: true, tick: null, reason: 'tick-still-running' }
+  if (answer.kind !== 'response' || answer.statusCode !== 200 || answer.body === null) return { ...base, pending: false, tick: null, reason: 'tick-was-not-answered' }
+  return { ...base, pending: false, tick: answer.body, reason: 'tick-ran' }
 }
 
 // The status document of the proven runtime: loop, last tick, last error code, freshness summary and, where the