@mnstry/atelier 0.2.0-alpha.12 → 0.2.0-alpha.14

package/src/runtime/obsidian/extension-points.mjs

@@ -65,7 +65,7 @@ export function normalizeApplyResult(value) {
 // an apply operation replaces it.
 const OPERATION_NAME = /^[a-z][a-z0-9-]{0,31}$/
 // The operations the command ships. The service composes the same registry, so both refuse the same contributions.
-export const BUILT_IN_OPERATIONS = Object.freeze(['status', 'scope', 'audience', 'mode', 'policy', 'service', 'open', 'plugin', 'apply', 'help'])
+export const BUILT_IN_OPERATIONS = Object.freeze(['status', 'settings', 'location', 'scope', 'view', 'audience', 'mode', 'policy', 'service', 'open', 'uninstall', 'plugin', 'apply', 'help'])
 export const REPLACEABLE_OPERATIONS = Object.freeze(['apply'])
 
 export function createCommandOperations({ reserved = [] } = {}) {

package/src/runtime/obsidian/index.mjs

@@ -6,8 +6,9 @@
 export { ObsidianMaintenanceRefusal } from './errors.mjs'
 export { DISABLED_REASONS, ENABLEMENT_STATES, readObsidianEnablement } from './enablement.mjs'
 export {
-  LOCAL_POINTER_SCHEMA, MACHINE_SETTINGS_SCHEMA, MAINTENANCE_MODES, authorizeAutomaticApply, defaultDataRoot, defaultMachineSettings, ensureWorkspaceIdentity,
-  installApplyPolicy, localPointerPath, protectedRoots, readInstalledApplyPolicy, readLocalPointer, readMachineSettings, resolveDataRoot, revokeApplyPolicy, workspaceStateRoot, writeLocalPointer, writeMachineSettings,
+  DECISIONS, DECISION_SOURCES, LOCAL_POINTER_SCHEMA, MACHINE_SETTINGS_SCHEMA, MACHINE_SETTINGS_SCHEMA_V1, MAINTENANCE_MODES, ONLY_YOU_AUDIENCES, authorizeAutomaticApply,
+  defaultDataRoot, defaultMachineSettings, ensureWorkspaceIdentity, installApplyPolicy, localPointerPath, protectedRoots, readInstalledApplyPolicy, readLocalPointer,
+  readMachineSettings, resolveDataRoot, revokeApplyPolicy, withDecision, workspaceStateRoot, writeLocalPointer, writeMachineSettings,
 } from './machine-settings.mjs'
 export { APPLY_RESULT_STATUSES, BUILT_IN_OPERATIONS, EXTENSION_KINDS, REPLACEABLE_OPERATIONS, UNAVAILABLE_APPLY_OPERATION, createCommandOperations, createMaintenanceExtensions, createObsidianRegistry } from './extension-points.mjs'
 export { CONTRIBUTIONS_DIRECTORY, loadContributions } from './contributions.mjs'
@@ -20,19 +21,21 @@ export {
 } from './state-store.mjs'
 export { listConfigFiles, listSourceFiles, listVaultNotes, reconcile } from './observation.mjs'
 export { createFsWatcherFactory, createNullWatcherFactory } from './watchers.mjs'
-export { DEFAULT_ELIGIBILITY, assetEligibilityFor, createProductionSeams } from './pipeline.mjs'
+export { DEFAULT_ELIGIBILITY, assetEligibilityFor, createProductionSeams, eligibilityFor, onlyYouEligibility } from './pipeline.mjs'
 export { DEFAULT_FULL_RECONCILIATION_INTERVAL_MS, DEFAULT_LATE_WRITER_WINDOW_MS, DEFAULT_PUBLICATION_RETRY_MS, DEFAULT_RETRY_INTERVAL_MS, createMaintenanceEngine } from './engine.mjs'
 export { ENGINE_LOCK_DIRECTORY, LOCK_TICKET_SCHEMA, acquirePrivateGenerationLock, createAbandonmentProof, inspectPrivateGenerationLock } from './private-lock.mjs'
 export { DEFAULT_MAX_BACKOFF_MS, DEFAULT_TICK_INTERVAL_MS, createTickLoop } from './tick-loop.mjs'
 export { HEALTH_SCHEMA, LOOPBACK_HOSTS, probeHealth, requestLoopback } from './service-client.mjs'
 export {
-  CONSENT_COVERAGES, SERVICE_ERROR_SCHEMA, SERVICE_SETTINGS_SCHEMA, executableIdentity, publicRecord, readLastServiceError, readServiceRecord, readServiceSettings,
-  removeServiceRecord, serviceNameFor, servicePaths, validateServiceRecord, writeServiceRecord, writeServiceSettings,
+  CONSENT_COVERAGES, LAST_STARTUP_SCHEMA, SERVICE_ERROR_SCHEMA, SERVICE_SETTINGS_SCHEMA, STARTUP_OUTCOMES, executableIdentity, publicRecord, readLastServiceError, readLastStartup,
+  readServiceRecord, readServiceSettings, removeServiceRecord, serviceNameFor, servicePaths, validateServiceRecord, writeServiceRecord, writeServiceSettings,
 } from './service-record.mjs'
 export { MAX_REQUEST_BYTES, SERVICE_OPERATIONS, createServiceServer } from './service-server.mjs'
 export { PLUGIN_BEARER_SCHEMA, PLUGIN_PRESENCE_SCHEMA, createPluginChannel, createPluginSessions, ensurePluginBearer, pluginBearerDirectory, pluginPresence, readPluginBearers } from './plugin-channel.mjs'
 export { PLUGIN_PRESENCE_REASONS, pluginPresenceOf, turnPluginOnNext, withPluginReportedVersion } from './plugin-presence.mjs'
 export { PLUGIN_CHOICE_SCHEMA, PLUGIN_CHOICE_STATES, confirmPluginEntry, confirmPluginSeen, currentPluginChoice, decidePluginChoice, pluginChoiceDirectory, readCommunityEntry, readPluginChoice, viewVaultRoot, writePluginChoice } from './plugin-choice.mjs'
-export { DEFAULT_SHUTDOWN_GRACE_MS, SERVICE_STATUS_SCHEMA, resolveServiceWorkspace, runMaintenanceService } from './service.mjs'
+export { DEFAULT_SHUTDOWN_GRACE_MS, RELEASE_CHANGED, SERVICE_STATUS_SCHEMA, resolveServiceWorkspace, runMaintenanceService } from './service.mjs'
 export { DEFAULT_START_TIMEOUT_MS, DEFAULT_STOP_TIMEOUT_MS, SERVICE_STATES, readServiceStatusDocument, requestServiceTick, serviceStatus, startService, stopService } from './lifecycle.mjs'
-export { STARTUP_PLATFORMS, buildStartupAdapter } from './startup-adapters.mjs'
+export { STARTUP_PLATFORMS, buildStartupAdapter, startupSearchPath } from './startup-adapters.mjs'
+export { LOGIN_ITEM_SCHEMA, installLoginItem, loginItemStatus, removeLoginItem, resolveLoginItemEntry } from './login-item.mjs'
+export { SERVICE_MANAGER_KINDS, createLaunchdManager, createSystemdManager } from './service-managers.mjs'

package/src/runtime/obsidian/launch-plan.mjs

@@ -55,11 +55,14 @@ export const urlProcessed = (stdout) => typeof stdout === 'string' && /^processe
 //
 // A URL is never handed to the operating system for an app this launch
 // started: that would start or reach it while it starts, which is what drops
-// the other vaults' reopen flags. The vault was added flagged open, so a plainly
-// started app opens it anyway, and `open` waits for it.
-export async function runLaunchPlan(plan, { start, answered, handLink, osOpen, sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms)), waitMs = 30_000, pollMs = 500, now = () => Date.now() }) {
+// the other vaults' reopen flags. A vault added flagged open is opened anyway by
+// a plainly started app, and `open` waits for it; one already listed but closed
+// is handed the link once more instead (opening.mjs). `startedEarlier` says
+// that an earlier launch of the same `open` started the app (a link handed to
+// it once more): the link then goes through the app's tool only, as well.
+export async function runLaunchPlan(plan, { start, answered, handLink, osOpen, sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms)), waitMs = 30_000, pollMs = 500, now = () => Date.now(), startedEarlier = false }) {
   if (!plan?.ok) return { launched: false, reason: plan?.reason ?? 'launcher-refused' }
-  let started = false
+  let started = startedEarlier === true
   let reason = 'url-accepted'
   for (const { step, uri } of plan.steps) {
     if (step === 'plain-start') {

package/src/runtime/obsidian/lifecycle.mjs

@@ -12,9 +12,10 @@ import { processRunsRecordedExecutable } from './process-identity.mjs'
 import { DEFAULT_PROBE_TIMEOUT_MS, LOOPBACK_HOSTS, probeHealth, requestLoopback } from './service-client.mjs'
 import { SERVICE_ENTRY_PATH } from './service-entry-path.mjs'
 import {
-  CONSENT_COVERAGES, SERVICE_SETTINGS_SCHEMA, executableIdentity, openServiceLog, publicRecord, readServiceRecord, readServiceSettings, releaseIdentity, removeServiceRecord,
+  CONSENT_COVERAGES, SERVICE_SETTINGS_SCHEMA, executableIdentity, openServiceLog, publicRecord, readLastStartup, readServiceRecord, readServiceSettings, releaseOfEntry, removeServiceRecord,
   serviceNameFor, servicePaths, writeServiceSettings,
 } from './service-record.mjs'
+import { personalHomeOf } from './personal-selection.mjs'
 import { resolveServiceWorkspace } from './service.mjs'
 
 // start / status / stop of the maintenance service of one workspace, as
@@ -61,9 +62,11 @@ export const LIFECYCLE_PRIMITIVES = Object.freeze({
   provesOurProcess: (record) => processRunsRecordedExecutable(record),
 })
 
-function context({ loadProject, dataRoot, env, platform, create = false, randomBytes }) {
+// `locateProject`, when given, answers what the workspace is resolved from without loading the project (a bound
+// personal home, locatePersonalHome): its service is then found, started and stopped whatever its selection holds.
+function context({ loadProject, locateProject = null, dataRoot, env, platform, create = false, randomBytes }) {
   if (typeof loadProject !== 'function') throw new TypeError('the service lifecycle needs loadProject')
-  const project = loadProject()
+  const project = locateProject === null ? loadProject() : locateProject()
   if (create) ensureWorkspaceIdentity({ project, ...(randomBytes ? { randomBytes } : {}) })
   const workspace = resolveServiceWorkspace({ project, dataRoot, env, platform, create })
   return { project, workspace }
@@ -90,8 +93,8 @@ async function evaluate({ workspaceRoot, workspaceId }, { probeTimeoutMs = DEFAU
 
 const shown = ({ record, ...status }) => ({ ...status, record: publicRecord(record) })
 
-export async function serviceStatus({ loadProject, dataRoot, env = process.env, platform = process.platform, probeTimeoutMs, alive } = {}, rules = LIFECYCLE_PRIMITIVES) {
-  const { workspace } = context({ loadProject, dataRoot, env, platform })
+export async function serviceStatus({ loadProject, locateProject, dataRoot, env = process.env, platform = process.platform, probeTimeoutMs, alive } = {}, rules = LIFECYCLE_PRIMITIVES) {
+  const { workspace } = context({ loadProject, locateProject, dataRoot, env, platform })
   if (!workspace?.workspaceRoot) return { state: 'stopped', reason: 'workspace-not-prepared', workspaceId: workspace?.workspaceId ?? null, record: null, address: null }
   return shown(await evaluate(workspace, { probeTimeoutMs, alive, rules }))
 }
@@ -105,8 +108,18 @@ function freeLoopbackPort(host) {
   })
 }
 
-async function resolveSettings({ workspaceRoot, workspaceId }, { host, port, consent, now }) {
+// The service settings of this workspace with the address and consent given, written when that changes anything: the
+// first start needs a consent naming its actor, and a consent for another actor or coverage replaces the recorded one.
+// Installing and removing a login item raise and lower the coverage through it (login-item.mjs).
+export async function ensureServiceSettings(workspace, { host, port, consent, now }) {
+  return resolveSettings(workspace, { host, port, consent, now })
+}
+
+async function resolveSettings({ workspaceRoot, workspaceId }, { host, port, consent: given, now }) {
   const current = readServiceSettings({ workspaceRoot, workspaceId })
+  // A consent derived from the account of a person at a terminal (`derived: true`) stands only for a workspace that has
+  // none. Read here, under the start lock, so one recorded meanwhile by another run is never replaced or narrowed.
+  const consent = given?.derived === true && current !== null ? undefined : given
   if (host !== undefined && !LOOPBACK_HOSTS.includes(host)) refuse('service-address-not-loopback', 'the service host must be the literal 127.0.0.1 or ::1')
   if (port !== undefined && (!Number.isInteger(port) || port < 1024 || port > 65535)) refuse('service-address-not-loopback', 'the service port must be between 1024 and 65535')
   if (consent !== undefined && (typeof consent?.actor !== 'string' || !CONSENT_COVERAGES.includes(consent.coverage ?? 'service'))) refuse('startup-consent-required', 'a consent names its actor and what it covers')
@@ -121,13 +134,57 @@ async function resolveSettings({ workspaceRoot, workspaceId }, { host, port, con
   return changed ? writeServiceSettings({ workspaceRoot, workspaceId, settings: next }) : current
 }
 
+// Asks the service manager of the installed login item to start the service, and waits, bounded, for this
+// workspace's service to prove itself (healthy, or busy in its first tick) with a record naming the digest of the
+// entry the item runs. The runtime identifier is the service's own there, so that digest is what makes it the one
+// asked for. A service that refused under the item exited cleanly and recorded why (`last-startup.json`); that code is
+// the answer. { result } or, when the manager did not start it (the item is not loaded: switched off in System
+// Settings, or no user service manager), { fallback: code }.
+async function startThroughLoginItem({ workspace, loginItem, entryPath, deadline, probeTimeoutMs, alive, rules }) {
+  const { workspaceRoot, workspaceId } = workspace
+  const lastStartup = () => { try { return JSON.stringify(readLastStartup(workspace)) } catch { return null } }
+  const before = lastStartup()
+  let asked
+  try { asked = await loginItem.start() } catch { asked = { ok: false, code: 'login-item-start-failed' } }
+  const item = { via: 'login-item', ...(asked?.refreshed === true ? { refreshed: true } : {}) }
+  if (asked?.ok !== true) return { fallback: typeof asked?.code === 'string' ? asked.code : 'login-item-start-failed', refreshed: asked?.refreshed === true }
+  // A unit written again on the way names the entry of now. One whose entry cannot be read cannot prove anything.
+  let expected
+  try { expected = executableIdentity(typeof asked.entryPath === 'string' ? asked.entryPath : entryPath).digest } catch { return { result: { state: 'start-failed', started: false, alreadyRunning: false, workspaceId, reason: 'login-item-entry-missing', observed: null, logPath: servicePaths(workspaceRoot).loginItemLog, loginItem: item } } }
+  let last = null
+  const proves = (status) => status?.record?.executable?.digest === expected
+  while (Date.now() < deadline) {
+    last = await evaluate(workspace, { probeTimeoutMs, alive, rules }).catch((error) => ({ state: 'refused', reason: error.code ?? 'untyped-error' }))
+    if (last.state === 'healthy' && proves(last)) return { result: { ...shown(last), started: true, alreadyRunning: false, loginItem: item } }
+    const now = lastStartup()
+    if (now !== before && now !== null) {
+      const startup = JSON.parse(now)
+      if (startup?.outcome === 'refused') return { result: { state: 'start-failed', started: false, alreadyRunning: false, workspaceId, reason: startup.code, observed: last.state ?? null, logPath: servicePaths(workspaceRoot).log, loginItem: item } }
+    }
+    await sleep(50)
+  }
+  // As for a child started here: a service that proved itself and went straight into a long first tick runs, and is
+  // answered as busy only once the wait for it to be healthy is over.
+  if (last?.state === 'busy' && proves(last)) return { result: { ...shown(last), started: true, alreadyRunning: false, busy: true, loginItem: item } }
+  return { result: { state: 'start-failed', started: false, alreadyRunning: false, workspaceId, reason: 'health-never-proved-ownership', observed: last?.state ?? null, logPath: servicePaths(workspaceRoot).loginItemLog, loginItem: item } }
+}
+
+// `loginItem`, for a workspace with an installed login item: { start() }, which asks its service manager to start the
+// service (login-item.mjs). The service is then started through it, never as a child beside it, so two starts never
+// compete; `entryPath` is the entry the item runs. When the manager does not start it, the service is started as a
+// child, and the answer says why (`loginItem: { via: 'child', reason }`).
+//
+// `replaceOutdated`: a proven runtime of this workspace that runs an earlier release than the entry this start would run
+// (runtimeRelease) is stopped as `stopService` stops it and started again in its place, under the consent already
+// recorded (`replaced: 'outdated'`); one of a later release is never replaced (`release: 'later'`). Without it, any
+// proven runtime is answered as already running.
 export async function startService(options = {}, rules = LIFECYCLE_PRIMITIVES) {
   const {
-    loadProject, dataRoot, host, port, consent, detached = false, entryPath = SERVICE_ENTRY_PATH, entryArgs = [], intervalMs,
+    loadProject, locateProject, dataRoot, host, port, consent, detached = false, entryPath = SERVICE_ENTRY_PATH, entryArgs = [], intervalMs,
     startTimeoutMs = DEFAULT_START_TIMEOUT_MS, probeTimeoutMs, clock = () => new Date(), env = process.env, platform = process.platform,
-    spawn = childProcess.spawn, execPath = process.execPath, alive = isProcessAlive, randomBytes = cryptoRandomBytes,
+    spawn = childProcess.spawn, execPath = process.execPath, alive = isProcessAlive, randomBytes = cryptoRandomBytes, loginItem = null, replaceOutdated = false,
   } = options
-  const { project, workspace } = context({ loadProject, dataRoot, env, platform, create: true })
+  const { project, workspace } = context({ loadProject, locateProject, dataRoot, env, platform, create: true })
   const { workspaceRoot, workspaceId } = workspace
   const deadline = Date.now() + startTimeoutMs
 
@@ -146,11 +203,26 @@ export async function startService(options = {}, rules = LIFECYCLE_PRIMITIVES) {
 
   let child = null
   try {
-    const before = await evaluate(workspace, { probeTimeoutMs, alive, rules })
-    if (rules.isOurs(before)) return { ...shown(before), started: false, alreadyRunning: true }
+    let before = await evaluate(workspace, { probeTimeoutMs, alive, rules })
+    // A runtime of an earlier release, still running after an upgrade, is replaced when asked to; it is stopped through its
+    // own listener, as its owner stops it, and nothing else is ever stopped here.
+    let replaced = null
+    if (rules.isOurs(before)) {
+      const standing = replaceOutdated ? runtimeRelease(before, entryPath) : null
+      if (standing === 'later') return { ...shown(before), started: false, alreadyRunning: true, release: 'later' }
+      if (standing !== 'outdated') return { ...shown(before), started: false, alreadyRunning: true }
+      const stopped = await stopService({ loadProject, locateProject, dataRoot, env, platform, probeTimeoutMs, alive }, rules)
+      if (!stopped.stopped) return { ...shown(before), started: false, alreadyRunning: true, release: 'outdated', reason: stopped.reason ?? 'the-runtime-was-not-stopped' }
+      replaced = 'outdated'
+      before = await evaluate(workspace, { probeTimeoutMs, alive, rules })
+    }
     // Running, and in a long tick: nothing is started beside it and nothing replaces it.
     if (before.state === 'busy') return { ...shown(before), started: false, alreadyRunning: true, busy: true }
-    if (rules.refusesOccupied(before)) refuse('service-port-occupied', 'something that is not this service answers on the loopback port; it is never taken over', { reason: before.reason, address: before.address })
+    // With a login item, a listener that has not written its record yet may be the service its manager is starting
+    // right now (it listens before it records itself): the start below asks the manager, which starts nothing beside
+    // a running job, and accepts only a runtime that proves itself. Anything else stays occupied and is never adopted.
+    const starting = loginItem !== null && before.state === 'occupied' && before.reason === 'a-listener-without-a-record'
+    if (rules.refusesOccupied(before) && !starting) refuse('service-port-occupied', 'something that is not this service answers on the loopback port; it is never taken over', { reason: before.reason, address: before.address })
     // `stale-record` and `pid-not-ours`: nothing listens, so the recorded runtime is not serving. Its PID is never signalled;
     // the new service replaces the record once it listens. Nothing under recovery or staging is touched on the way.
     const settings = await resolveSettings(workspace, { host, port, consent, now: isoTime(clock) })
@@ -159,11 +231,22 @@ export async function startService(options = {}, rules = LIFECYCLE_PRIMITIVES) {
       if (moved.kind !== 'refused') refuse('service-port-occupied', 'something already answers on the selected loopback port; it is never taken over', { address: { host: settings.host, port: settings.port } })
     }
 
+    // An installed login item starts it. Only when its manager does not is a child started, and the answer says why.
+    let fallback = null
+    if (loginItem !== null) {
+      const managed = await startThroughLoginItem({ workspace, loginItem, entryPath, deadline, probeTimeoutMs, alive, rules })
+      if (managed.result) return replaced === null ? managed.result : { ...managed.result, replaced }
+      fallback = { via: 'child', reason: managed.fallback, ...(managed.refreshed ? { refreshed: true } : {}) }
+    }
+    const withFallback = (result) => ({ ...result, ...(fallback === null ? {} : { loginItem: fallback }), ...(replaced === null ? {} : { replaced }) })
+
     const runtimeId = `rt-${randomBytes(16).toString('hex')}`
     const executable = executableIdentity(entryPath)
     const log = openServiceLog(workspaceRoot)
     try {
-      const args = [executable.path, `--project=${project.configPath}`, ...(dataRoot === undefined ? [] : [`--data-root=${dataRoot}`]), `--runtime-id=${runtimeId}`, ...(intervalMs === undefined ? [] : [`--interval-ms=${intervalMs}`]), ...entryArgs]
+      // A bound personal home is named instead of a project: the service follows the selection confirmed there.
+      const home = personalHomeOf(project)
+      const args = [executable.path, home === null ? `--project=${project.configPath}` : `--personal-home=${home}`, ...(dataRoot === undefined ? [] : [`--data-root=${dataRoot}`]), `--runtime-id=${runtimeId}`, ...(intervalMs === undefined ? [] : [`--interval-ms=${intervalMs}`]), ...entryArgs]
       // No shell. Detached only when the service is meant to outlive the command that starts it. It runs in the root
       // directory, never in the one the command was started in, which may be a vault or a folder somebody removes.
       child = spawn(execPath, args, { detached, shell: false, windowsHide: true, stdio: ['ignore', log.descriptor, log.descriptor], env, cwd: path.parse(executable.path).root })
@@ -180,27 +263,27 @@ export async function startService(options = {}, rules = LIFECYCLE_PRIMITIVES) {
       last = await evaluate(workspace, { probeTimeoutMs, alive, rules }).catch((error) => ({ state: 'refused', reason: error.code ?? 'untyped-error' }))
       if (last.state === 'healthy' && last.record.runtimeId === runtimeId && last.record.pid === child.pid) {
         if (detached) child.unref()
-        return { ...shown(last), started: true, alreadyRunning: false, ...(detached ? {} : { child }) }
+        return withFallback({ ...shown(last), started: true, alreadyRunning: false, ...(detached ? {} : { child }) })
       }
       await sleep(50)
     }
     // The child created here wrote the record and went straight into a long first tick: it runs, and is not stopped.
     if (exited === null && last?.state === 'busy' && last.record?.runtimeId === runtimeId && last.record?.pid === child.pid) {
       if (detached) child.unref()
-      return { ...shown(last), started: true, alreadyRunning: false, busy: true, ...(detached ? {} : { child }) }
+      return withFallback({ ...shown(last), started: true, alreadyRunning: false, busy: true, ...(detached ? {} : { child }) })
     }
     // Ownership was never proven: only the child created here is stopped, by its handle.
     if (exited === null) { child.kill(); const until = Date.now() + 5000; while (exited === null && Date.now() < until) await sleep(25) }
     removeServiceRecord({ workspaceRoot, workspaceId, runtimeId, pid: child.pid })
-    return { state: 'start-failed', started: false, alreadyRunning: false, workspaceId, reason: exited?.error ?? (exited?.code === null || exited === null ? 'health-never-proved-ownership' : `service-exited-${exited.code}`), observed: last?.state ?? null, logPath: log.file }
+    return withFallback({ state: 'start-failed', started: false, alreadyRunning: false, workspaceId, reason: exited?.error ?? (exited?.code === null || exited === null ? 'health-never-proved-ownership' : `service-exited-${exited.code}`), observed: last?.state ?? null, logPath: log.file })
   } finally {
     lock.release()
   }
 }
 
 export async function stopService(options = {}, rules = LIFECYCLE_PRIMITIVES) {
-  const { loadProject, dataRoot, stopTimeoutMs = DEFAULT_STOP_TIMEOUT_MS, probeTimeoutMs, env = process.env, platform = process.platform, alive = isProcessAlive, force = false, kill = process.kill.bind(process) } = options
-  const { workspace } = context({ loadProject, dataRoot, env, platform })
+  const { loadProject, locateProject, dataRoot, stopTimeoutMs = DEFAULT_STOP_TIMEOUT_MS, probeTimeoutMs, env = process.env, platform = process.platform, alive = isProcessAlive, force = false, kill = process.kill.bind(process) } = options
+  const { workspace } = context({ loadProject, locateProject, dataRoot, env, platform })
   if (!workspace?.workspaceRoot) return { state: 'stopped', stopped: false, refused: false, reason: 'workspace-not-prepared' }
   const { workspaceRoot, workspaceId } = workspace
   const status = await evaluate(workspace, { probeTimeoutMs, alive, rules })
@@ -230,8 +313,8 @@ export async function stopService(options = {}, rules = LIFECYCLE_PRIMITIVES) {
 // One authenticated request to the proven runtime, and to nothing else: anything but a healthy status is answered
 // with that status and no request is made.
 async function askProvenRuntime(options, rules, { method, operation, timeoutMs, body = {} }) {
-  const { loadProject, dataRoot, probeTimeoutMs, env = process.env, platform = process.platform, alive = isProcessAlive } = options
-  const { workspace } = context({ loadProject, dataRoot, env, platform })
+  const { loadProject, locateProject, dataRoot, probeTimeoutMs, env = process.env, platform = process.platform, alive = isProcessAlive } = options
+  const { workspace } = context({ loadProject, locateProject, dataRoot, env, platform })
   if (!workspace?.workspaceRoot) return { requested: false, state: 'stopped', reason: 'workspace-not-prepared' }
   const status = await evaluate(workspace, { probeTimeoutMs, alive, rules })
   if (status.state !== 'healthy') return { requested: false, state: status.state, reason: status.reason }
@@ -242,7 +325,7 @@ async function askProvenRuntime(options, rules, { method, operation, timeoutMs,
 
 // Pure. How the release a runtime recorded at its start (`executable.ext.release`, see releaseIdentity: the package
 // version and a digest of every runtime module) stands to the installed one, `installed` being { entry, release }, the
-// digest of the entry this command would start and releaseIdentity():
+// digest of the entry this command would start and the release that entry's package holds now (releaseOfEntry):
 //   current   the same version, entry module and modules;
 //   outdated  an earlier version; the same version with another entry module or other modules; or no release named,
 //             as releases before the one that began recording it record none;
@@ -261,11 +344,13 @@ export function releaseStanding(executable, installed) {
 }
 
 // How the release the proven runtime runs stands to the installed one (releaseStanding), `entryPath` being the entry
-// this command would start. Null when the runtime is not proven, or the installed side cannot be read.
+// this command would start: its digest and the release are both read from that entry, so with a login item the
+// installed release is the project's own package, read through the path the item names, whichever package this command
+// runs from. Null when the runtime is not proven, or the installed side cannot be read.
 export function runtimeRelease(status, entryPath) {
   if (status?.state !== 'healthy' || typeof status.record?.executable?.digest !== 'string' || typeof entryPath !== 'string') return null
   let installed
-  try { installed = { entry: executableIdentity(entryPath).digest, release: releaseIdentity() } } catch { return null }
+  try { installed = { entry: executableIdentity(entryPath).digest, release: releaseOfEntry(entryPath) } } catch { return null }
   return releaseStanding(status.record.executable, installed)
 }