@moretea-labs/forge 1.8.1 → 1.8.2

package/src/runtime/standalone-recovery/core.ts

@@ -22,10 +22,13 @@ import {
   inspectForgeRuntimeLaunchAgentContract,
   installForgeRuntimeService,
   readForgeRuntimeServiceConfig,
+  restoreRuntimeConfigFromVerifiedLaunchdContract,
+  verifiedRuntimePortFromLaunchdContract,
   syncForgeRuntimeActiveEntrypoint,
   uninstallForgeRuntimeService,
 } from '../root/service';
 import { removeRetiredCandidateExecutionLane } from '../root/runtime-lane';
+import { inspectWorkflowSupervisorBrowserAdapter, installWorkflowSupervisorBrowserAdapter } from '../plugins/computer-chatgpt-browser-adapter-installer';
 import {
   inspectKnownGoodRecoveryBundle,
   knownGoodRecoveryBundleRoot,
@@ -57,7 +60,15 @@ import {
   type RuntimeReleaseAuthority,
 } from '../root/release-store';
 import type { RuntimeReleaseManifest } from '../root/types';
-import { ensurePackageConnectorService, packageConnectorAuthMode, packageConnectorServicePaths, type PackageConnectorReleaseBinding } from '../root/package-connector-service';
+import {
+  armPackageConnectorCutoverDrain,
+  clearPackageConnectorCutoverDrain,
+  ensurePackageConnectorService,
+  packageConnectorAuthMode,
+  packageConnectorServicePaths,
+  readPackageConnectorServiceAuthority,
+  type PackageConnectorReleaseBinding,
+} from '../root/package-connector-service';
 import { createRecoveryHttpTransport, type RecoveryHttpTransport } from './http-transport';
 import { observeRecoveryWatchdogHealth } from './watchdog-heartbeat';
 import { RECOVERY_DAEMON_LABEL } from './service-labels';
@@ -72,7 +83,7 @@ import {
   type ControllerHomeStorageMigration,
 } from '../../cli/repositories/controller-home';
 import { readCurrentRecoveryRelease, type RecoveryRuntimeRole } from './release';
-import { recoveryOperationLockPath } from './operation-lock';
+import { acquireRecoveryOperationLock, recoveryOperationLockOwnerAlive, recoveryOperationLockPath, RecoveryOperationLockRaceError, type RecoveryOperationLockRecord } from './operation-lock';
 import { RECOVERY_MUTATION_IDENTITY_FIELDS, type RecoveryMutationIdentityArguments } from './mutation-identity-contract';
 import { createCandidateExecutionLane, readStableExecutionLane } from '../root/runtime-lane';
 import {
@@ -316,15 +327,7 @@ export type RecoveryMutationAction =
   | 'restart_recovery_gateway'
   | 'repair_public_tunnel';
 
-interface RecoveryLock {
-  schemaVersion?: 1;
-  pid: number;
-  instanceId: string;
-  processStartTime?: string;
-  acquiredAt: string;
-  action?: RecoveryMutationAction;
-  requestId?: string;
-}
+type RecoveryLock = RecoveryOperationLockRecord;
 
 interface RecoveryLockIntent {
   action: RecoveryMutationAction;
@@ -961,23 +964,6 @@ function persistWatchdogDiagnosticEvidence(config: RecoveryConfig, result: Verif
   return evidence;
 }
 
-function processStartTime(pid: number): string | undefined {
-  const result = spawnSync('/bin/ps', ['-o', 'lstart=', '-p', String(pid)], {
-    encoding: 'utf8',
-    timeout: 2_000,
-    maxBuffer: 4_096,
-  });
-  if (result.status !== 0 || typeof result.stdout !== 'string') return undefined;
-  return result.stdout.trim() || undefined;
-}
-
-function recoveryLockOwnerAlive(lock: RecoveryLock): boolean {
-  if (!pidAlive(lock.pid)) return false;
-  if (!lock.processStartTime) return true;
-  const observed = processStartTime(lock.pid);
-  return observed === lock.processStartTime;
-}
-
 function recoveryLockOwnerAttributable(owner: RecoveryLock): boolean {
   return Boolean(owner.action && owner.requestId?.trim());
 }
@@ -1005,7 +991,7 @@ function recoveryBusyDetail(owner: RecoveryLock): string {
 function liveRecoveryMutationLock(config: RecoveryConfig): RecoveryLock | undefined {
   const owner = json<RecoveryLock>(lockPath(config));
   if (!owner || !Number.isInteger(owner.pid) || owner.pid <= 0 || typeof owner.instanceId !== 'string' || !owner.instanceId.trim()) return undefined;
-  return recoveryLockOwnerAlive(owner) ? owner : undefined;
+  return recoveryOperationLockOwnerAlive(owner) ? owner : undefined;
 }
 
 async function withLock<T>(
@@ -1013,73 +999,35 @@ async function withLock<T>(
   intent: RecoveryLockIntent,
   action: (lock: RecoveryLock) => Promise<T>,
 ): Promise<RecoveryLockAttempt<T>> {
-  const path = lockPath(config);
-  mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
-  const instanceId = randomUUID();
-  const requestId = intent.requestId?.trim() || `internal:${intent.action}:${instanceId}`;
-  const lock: RecoveryLock = {
-    schemaVersion: 1,
-    pid: process.pid,
-    instanceId,
-    processStartTime: processStartTime(process.pid),
-    acquiredAt: new Date().toISOString(),
-    action: intent.action,
-    requestId,
-  };
-
-  for (let attempt = 0; attempt < 2; attempt += 1) {
-    let fd: number | undefined;
-    let acquired = false;
-    try {
-      try {
-        fd = openSync(path, 'wx', 0o600);
-        writeFileSync(fd, JSON.stringify(lock));
-        acquired = true;
-      } catch (error) {
-        if ((error as NodeJS.ErrnoException).code !== 'EEXIST') throw error;
-        const existing = json<RecoveryLock>(path);
-        if (!existing || !Number.isInteger(existing.pid) || typeof existing.instanceId !== 'string') {
-          throw new Error('RECOVERY_OPERATION_LOCK_UNCERTAIN');
-        }
-        if (recoveryLockOwnerAlive(existing)) {
-          assertRecoveryLockOwnerAttributable(config, existing);
-          return { acquired: false, owner: existing };
-        }
-        const latest = json<RecoveryLock>(path);
-        if (!latest || latest.instanceId !== existing.instanceId) {
-          if (attempt === 1) {
-            if (latest && recoveryLockOwnerAlive(latest)) {
-              assertRecoveryLockOwnerAttributable(config, latest);
-              return { acquired: false, owner: latest };
-            }
-            audit(config, 'recovery_operation_lock_race', {
-              existingInstanceId: existing.instanceId,
-              existingPid: existing.pid,
-              latestInstanceId: latest?.instanceId ?? null,
-              latestPid: latest?.pid ?? null,
-            });
-            throw new Error('RECOVERY_OPERATION_LOCK_RACE');
-          }
-          continue;
-        }
-        if (recoveryLockOwnerAlive(latest)) {
-          assertRecoveryLockOwnerAttributable(config, latest);
-          return { acquired: false, owner: latest };
-        }
-        try { writeFileSync(`${path}.stale-${Date.now()}-${existing.instanceId}`, readFileSync(path)); } catch { /* evidence best effort */ }
-        rmSync(path, { force: true });
-        continue;
-      }
-      return { acquired: true, value: await action(lock) };
-    } finally {
-      if (fd !== undefined) closeSync(fd);
-      if (acquired) {
-        const current = json<RecoveryLock>(path);
-        if (current?.instanceId === lock.instanceId) rmSync(path, { force: true });
-      }
+  // Installer, certification and Recovery actions share one physical lock writer.
+  // Core supplies only action attribution, audit and scoped handle release.
+  let attempt: ReturnType<typeof acquireRecoveryOperationLock>;
+  try {
+    attempt = acquireRecoveryOperationLock({
+      controllerHome: config.controllerHome,
+      action: intent.action,
+      requestId: intent.requestId,
+    });
+  } catch (error) {
+    if (error instanceof RecoveryOperationLockRaceError) {
+      audit(config, 'recovery_operation_lock_race', {
+        existingInstanceId: error.existing.instanceId,
+        existingPid: error.existing.pid,
+        latestInstanceId: error.latest?.instanceId ?? null,
+        latestPid: error.latest?.pid ?? null,
+      });
     }
+    throw error;
+  }
+  if (!attempt.acquired) {
+    assertRecoveryLockOwnerAttributable(config, attempt.owner);
+    return { acquired: false, owner: attempt.owner };
+  }
+  try {
+    return { acquired: true, value: await action(attempt.handle.record) };
+  } finally {
+    attempt.handle.close();
   }
-  throw new Error('RECOVERY_OPERATION_LOCK_BUSY');
 }
 
 export async function runtimeStatus(config: RecoveryConfig) {
@@ -2163,6 +2111,23 @@ function quarantine(config: RecoveryConfig, release: ReleaseEvidence | undefined
   writeJson(quarantinePath(config), { schemaVersion: 1, releases });
 }
 
+/** Optional installed projection belongs to the whole active release. Fresh
+ * Candidate B/uninstalled Homes never opt into global browser registration.
+ * Loaded-tab capability and provider connectivity remain separate evidence.
+ */
+function syncInstalledBrowserAdapterProjection(controllerHome: string): void {
+  let projection = inspectWorkflowSupervisorBrowserAdapter(controllerHome);
+  if (!existsSync(projection.extensionPath) && !existsSync(projection.nativeHostPath)) return;
+  const authority = readRuntimeReleaseAuthority(controllerHome);
+  if (!authority) throw new Error('RECOVERY_BROWSER_ADAPTER_RELEASE_AUTHORITY_MISSING');
+  if (!projection.projectionCurrent || projection.activeReleaseId !== authority.active.releaseId) {
+    projection = installWorkflowSupervisorBrowserAdapter(controllerHome);
+  }
+  if (!projection.projectionCurrent || projection.activeReleaseId !== authority.active.releaseId) {
+    throw new Error(`RECOVERY_BROWSER_ADAPTER_PROJECTION_UNVERIFIED: ${projection.detail}`);
+  }
+}
+
 async function rollbackPreviousLocked(config: RecoveryConfig, reason: string): Promise<RollbackResult> {
   const before = await verifyStableRuntime(config);
   const active = before.releases.active;
@@ -2208,6 +2173,7 @@ async function rollbackPreviousLocked(config: RecoveryConfig, reason: string): P
       || committed.active.artifactIdentity !== target.artifactIdentity
       || committed.active.manifestSha256 !== target.manifestSha256
     ) throw new Error('RECOVERY_ROLLBACK_AUTHORITY_MISMATCH');
+    syncInstalledBrowserAdapterProjection(config.controllerHome);
     quarantine(config, active, 'whole-Runtime rollback completed');
     audit(config, 'rollback_succeeded', {
       operationId,
@@ -2229,7 +2195,7 @@ async function rollbackPreviousLocked(config: RecoveryConfig, reason: string): P
   } catch (error) {
     const detail = error instanceof Error ? error.message : 'whole-Runtime rollback failed';
     audit(config, 'rollback_failed', { operationId, activeRevision: active.revision, targetRevision: target.revision, detail });
-    return { ok: false, operationId, detail };
+    return { ok: false, operationId, detail, verify: await verifyStableRuntime(config) };
   }
 }
 
@@ -2965,6 +2931,8 @@ function primaryRuntimeServiceContractMatches(config: RecoveryConfig, owner: Pri
 }
 
 export interface PrimaryConnectorRecoveryDependencies {
+  /** Explicit operator recovery; watchdog calls leave a healthy Connector alone. */
+  forceHealthyRestart?: boolean;
   /** Durable caller identity propagated into the Recovery mutation lock and audit trail. */
   requestId?: string;
   platform?: NodeJS.Platform;
@@ -3045,6 +3013,7 @@ export interface AutomaticReleaseCutoverReadiness {
   ready: boolean;
   activeSessions?: number;
   activePosts?: number;
+  oldestActivePostAgeMs?: number;
   activeStreams?: number;
   initializing?: number;
   latestActivityAgeMs?: number;
@@ -3053,6 +3022,7 @@ export interface AutomaticReleaseCutoverReadiness {
 
 const AUTOMATIC_RELEASE_CUTOVER_QUIET_MS = 30_000;
 const AUTOMATIC_RELEASE_CUTOVER_HEALTH_TIMEOUT_MS = 2_000;
+const RELEASE_SESSION_CONNECTOR_DRAIN_WAIT_MS = 180_000;
 
 function primaryConnectorHealthEndpoint(config: RecoveryConfig): string | undefined {
   const localMcpUrl = config.primaryConnectorService?.localMcpUrl?.trim();
@@ -3087,7 +3057,7 @@ export async function probeReleaseCutoverReadiness(
       signal: controller.signal,
     });
     if (!response.ok) return { ready: false, detail: `primary Connector health returned HTTP ${response.status}` };
-    let payload: { sessions?: { active?: unknown; activePosts?: unknown; activeStreams?: unknown; initializing?: unknown; latestActivityAgeMs?: unknown } };
+    let payload: { sessions?: { active?: unknown; activePosts?: unknown; oldestActivePostAgeMs?: unknown; activeStreams?: unknown; initializing?: unknown; latestActivityAgeMs?: unknown } };
     try {
       payload = JSON.parse(response.body) as typeof payload;
     } catch {
@@ -3095,6 +3065,8 @@ export async function probeReleaseCutoverReadiness(
     }
     const activeSessions = Number(payload.sessions?.active);
     const activePosts = Number(payload.sessions?.activePosts);
+    const oldestActivePostAgeMs = payload.sessions?.oldestActivePostAgeMs === undefined
+      ? undefined : Number(payload.sessions.oldestActivePostAgeMs);
     const activeStreams = Number(payload.sessions?.activeStreams);
     const initializing = Number(payload.sessions?.initializing);
     const latestActivityAgeMs = Number(payload.sessions?.latestActivityAgeMs);
@@ -3109,6 +3081,8 @@ export async function probeReleaseCutoverReadiness(
     const evidence = {
       activeSessions,
       activePosts,
+      ...(oldestActivePostAgeMs !== undefined && Number.isFinite(oldestActivePostAgeMs)
+        ? { oldestActivePostAgeMs } : {}),
       ...(Number.isFinite(activeStreams) ? { activeStreams } : {}),
       initializing,
       ...(Number.isFinite(latestActivityAgeMs) ? { latestActivityAgeMs } : {}),
@@ -3117,7 +3091,7 @@ export async function probeReleaseCutoverReadiness(
       return {
         ready: false,
         ...evidence,
-        detail: `primary Connector is busy: activePosts=${activePosts}; activeStreams=${activeStreams}; initializing=${initializing}`,
+        detail: `primary Connector is busy: activePosts=${activePosts}; activeStreams=${activeStreams}; initializing=${initializing}${oldestActivePostAgeMs !== undefined && Number.isFinite(oldestActivePostAgeMs) ? `; oldestActivePostAgeMs=${oldestActivePostAgeMs}` : ''}`,
       };
     }
     if (activeSessions > 0 && (!Number.isFinite(latestActivityAgeMs) || latestActivityAgeMs < quietMs)) {
@@ -3242,6 +3216,7 @@ export async function restartPrimaryConnector(
 ): Promise<PrimaryConnectorRestartResult> {
   const verifyLocal = dependencies.verifyLocal ?? verifyLocalRuntime;
   const initialLocal = await verifyLocal(config);
+  const forceHealthyRestart = dependencies.forceHealthyRestart === true;
   // `verifyLocalRuntime` also reports the Connector's own loopback probe.
   // That probe is expected to be false when this recovery action is needed,
   // so it must not prevent a healthy canonical Runtime from repairing the
@@ -3283,7 +3258,7 @@ export async function restartPrimaryConnector(
     let localConnector = await probeConnectorLocal(config);
     let connectorOwnership = localConnector?.ok ? await probeConnectorOwnership(config) : undefined;
     let observed = localConnector?.ok && connectorOwnership?.ok ? await reconnect(config) : undefined;
-    if (observed?.ok) {
+    if (observed?.ok && !forceHealthyRestart) {
       return {
         ok: true,
         attempted: bindingRepair.attempted,
@@ -3299,7 +3274,7 @@ export async function restartPrimaryConnector(
     // A healthy local OAuth endpoint proves the Connector is not the broken hop.
     // If a distinct primary tunnel is configured, skip the pointless Gateway
     // restart and repair the public hop directly.
-    const restartConnector = !localConnector?.ok || !connectorOwnership?.ok || !tunnelConfigured;
+    const restartConnector = forceHealthyRestart || !localConnector?.ok || !connectorOwnership?.ok || !tunnelConfigured;
     if (restartConnector) {
       const restarted = await ensurePrimaryConnectorServiceStarted(service, runCommand);
       if (!restarted.ok) {
@@ -3331,7 +3306,8 @@ export async function restartPrimaryConnector(
       }
     }
 
-    observed ??= await reconnect(config);
+    if (restartConnector) observed = await reconnect(config);
+    else observed ??= await reconnect(config);
     const primaryTunnel = configuredPrimaryPublicTunnel(config);
     if (!observed.ok && localConnector?.ok && connectorOwnership?.ok && primaryTunnel) {
       let tunnelRestarted: { ok: boolean; attempted: boolean; detail: string; serviceTarget: string } | undefined;
@@ -3445,7 +3421,9 @@ async function observePrimaryRuntimePort(config: RecoveryConfig, runCommand: Com
   try {
     port = readForgeRuntimeServiceConfig(paths.configPath).port;
   } catch {
-    return { port: -1, pids: [], uncertain: 'primary Runtime service port could not be read' };
+    const provenPort = verifiedRuntimePortFromLaunchdContract(config.controllerHome);
+    if (!provenPort) return { port: -1, pids: [], uncertain: 'primary Runtime service port could not be read from config or exact launchd contract' };
+    port = provenPort;
   }
   const result = await runCommand('lsof', ['-nP', '-Fp', `-iTCP:${port}`, '-sTCP:LISTEN'], 3_000);
   if (result.status === 1 && result.stderr.trim().length === 0) return { port, pids: [] };
@@ -3694,6 +3672,16 @@ async function stopPrimaryRuntimeForReleaseTransition(input: {
       staleListenerCleanup,
     };
   }
+  // A corrupt config is reconstructed through the original validated writer
+  // only after the Runtime service, listener, owner and Supervisor are quiescent.
+  try {
+    readForgeRuntimeServiceConfig(forgeRuntimeServicePaths(input.config.controllerHome).configPath);
+  } catch {
+    if (input.service.platform !== 'launchd'
+      || !restoreRuntimeConfigFromVerifiedLaunchdContract(input.config.controllerHome)) {
+      return { ok: false, detail: 'stopped Runtime config cannot be restored from an exact launchd contract', staleListenerCleanup };
+    }
+  }
   return {
     ok: true,
     detail: `primary Runtime ${input.service.platform} service, owner, TCP listener, and Workflow Supervisor writer are quiescent`,
@@ -3836,6 +3824,7 @@ async function rebindStartAndVerifyPrimaryRuntime(input: {
 
   try {
     input.beforeStart?.();
+    syncInstalledBrowserAdapterProjection(input.config.controllerHome);
   } catch (error) {
     return {
       ok: false,
@@ -5711,7 +5700,14 @@ export async function cutoverConfiguredRuntimeReleaseSession(
       const reconciliationDeadline = Date.now() + reconciliationTimeoutMs;
       let stableNow = observeRuntimeStatus(config.controllerHome);
       const stableIdentity = () => {
-        const liveRuntimeIdentityVerified = stableNow.running && stableNow.ready && !stableNow.stale;
+        // A crash after authority publication must not bypass projection
+        // verification. Reconciliation observes only; the release transaction
+        // owns any projection mutation before starting the Runtime.
+        const projection = inspectWorkflowSupervisorBrowserAdapter(config.controllerHome);
+        const installed = existsSync(projection.extensionPath) || existsSync(projection.nativeHostPath);
+        const projectionVerified = !installed || (projection.projectionCurrent
+          && projection.activeReleaseId === stableNow.snapshot?.releaseId);
+        const liveRuntimeIdentityVerified = stableNow.running && stableNow.ready && !stableNow.stale && projectionVerified;
         return {
           candidateIsStable: Boolean(
             liveRuntimeIdentityVerified
@@ -5806,6 +5802,10 @@ export async function cutoverConfiguredRuntimeReleaseSession(
         };
       }
 
+      const projection = inspectWorkflowSupervisorBrowserAdapter(config.controllerHome);
+      const projectionFailure = (existsSync(projection.extensionPath) || existsSync(projection.nativeHostPath))
+        && (!projection.projectionCurrent || projection.activeReleaseId !== stableNow.snapshot?.releaseId)
+        ? `; installed browser projection is unverified: ${projection.detail}` : '';
       session = advanceReleaseSession({
         controllerHome: config.controllerHome,
         sessionId,
@@ -5814,7 +5814,7 @@ export async function cutoverConfiguredRuntimeReleaseSession(
         receipts: [{
           id: 'cutover_failed',
           kind: 'cutover',
-          summary: `${reason}; Stable A outcome is not fully verified; Candidate B is retired`.slice(0, 500),
+          summary: `${reason}; Stable A outcome is not fully verified${projectionFailure}; Candidate B is retired`.slice(0, 500),
         }],
       });
       const cleanup = cleanupRetiredCandidateLane(config, session);
@@ -5828,7 +5828,7 @@ export async function cutoverConfiguredRuntimeReleaseSession(
       return {
         ok: false as const,
         attempted: true,
-        detail: `${reason}; Candidate B is retired but Stable A cutover/rollback outcome is not fully verified${cleanup.ok ? '' : `; Candidate B cleanup failed: ${cleanup.detail}`}`,
+        detail: `${reason}; Candidate B is retired but Stable A cutover/rollback outcome is not fully verified${projectionFailure}${cleanup.ok ? '' : `; Candidate B cleanup failed: ${cleanup.detail}`}`,
         releaseSession: session,
         ...(activation ? { activation } : {}),
       };
@@ -5912,79 +5912,94 @@ export async function cutoverConfiguredRuntimeReleaseSession(
       ) throw new Error('RELEASE_SESSION_STABLE_CHANGED_DURING_PROMOTION');
 
       // Connector quietness is a cutover invariant, not an automatic-release
-      // policy. Every caller, including explicit/local-recovery ReleaseSession
-      // progression, must prove that no MCP request/stream is active and that
-      // remaining sessions have been idle for the bounded quiet window before
-      // Stable A ownership can move. Otherwise a perfectly valid release switch
-      // can tear down the ChatGPT turn that requested it.
-      let readiness = await probeReleaseCutoverReadiness(config);
-      // The post-promotion verification above may itself create MCP activity
-      // on the primary Connector.  Give that activity a bounded opportunity
-      // to become quiet before deferring the session; otherwise every retry
-      // re-verifies the Runtime, refreshes latestActivityAgeMs, and can defer
-      // forever without ever reaching the cutover attempt.
-      const quietWaitDeadline = Date.now() + AUTOMATIC_RELEASE_CUTOVER_QUIET_MS + 5_000;
-      while (
-        !readiness.ready
-        && readiness.activePosts === 0
-        && readiness.activeStreams === 0
-        && readiness.initializing === 0
-        && Number.isFinite(readiness.latestActivityAgeMs)
-        && (readiness.latestActivityAgeMs ?? AUTOMATIC_RELEASE_CUTOVER_QUIET_MS) < AUTOMATIC_RELEASE_CUTOVER_QUIET_MS
-        && Date.now() < quietWaitDeadline
-      ) {
-        const remainingMs = Math.max(
-          50,
-          AUTOMATIC_RELEASE_CUTOVER_QUIET_MS - (readiness.latestActivityAgeMs ?? 0) + 25,
-        );
-        await sleep(Math.min(2_000, remainingMs));
-        readiness = await probeReleaseCutoverReadiness(config);
-      }
-      if (!readiness.ready) {
-        audit(config, 'release_session_cutover_deferred_for_mcp_activity', {
+      // policy. Passive observation alone can starve forever under continuous
+      // valid MCP traffic, so the existing Package Connector generation is
+      // mechanically fenced from admitting new POSTs while already-admitted
+      // responses drain. The marker is scoped to this exact Stable A Connector
+      // authority generation; Candidate/rollback rebinds change that generation
+      // and therefore remain able to perform post-cutover verification.
+      const connectorAuthority = readPackageConnectorServiceAuthority(config.controllerHome);
+      const connectorDrain = connectorAuthority
+        ? armPackageConnectorCutoverDrain({
+            controllerHome: config.controllerHome,
+            sessionId,
+            stableReleaseId: session.stableRelease.releaseId,
+            connectorAuthority,
+          })
+        : undefined;
+      try {
+        let readiness = await probeReleaseCutoverReadiness(config);
+        // The caller that requested cutover may itself still be one admitted MCP
+        // POST until a detached Recovery process takes over. Keep the fence up
+        // long enough for that response plus other already-admitted POSTs to
+        // settle, then preserve the existing 30s session-idle invariant.
+        const quietWaitDeadline = Date.now() + RELEASE_SESSION_CONNECTOR_DRAIN_WAIT_MS;
+        while (!readiness.ready && Date.now() < quietWaitDeadline) {
+          const hasInFlightActivity = (readiness.activePosts ?? 0) > 0
+            || (readiness.activeStreams ?? 0) > 0
+            || (readiness.initializing ?? 0) > 0;
+          const awaitingQuietWindow = readiness.activePosts === 0
+            && readiness.activeStreams === 0
+            && readiness.initializing === 0
+            && Number.isFinite(readiness.latestActivityAgeMs)
+            && (readiness.latestActivityAgeMs ?? AUTOMATIC_RELEASE_CUTOVER_QUIET_MS) < AUTOMATIC_RELEASE_CUTOVER_QUIET_MS;
+          if (!(connectorDrain && hasInFlightActivity) && !awaitingQuietWindow) break;
+          const remainingMs = awaitingQuietWindow
+            ? Math.max(50, AUTOMATIC_RELEASE_CUTOVER_QUIET_MS - (readiness.latestActivityAgeMs ?? 0) + 25)
+            : 500;
+          await sleep(Math.min(2_000, remainingMs));
+          readiness = await probeReleaseCutoverReadiness(config);
+        }
+        if (!readiness.ready) {
+          audit(config, 'release_session_cutover_deferred_for_mcp_activity', {
+            sessionId,
+            detail: readiness.detail,
+            activeSessions: readiness.activeSessions,
+            activePosts: readiness.activePosts,
+            oldestActivePostAgeMs: readiness.oldestActivePostAgeMs,
+            activeStreams: readiness.activeStreams,
+            initializing: readiness.initializing,
+            latestActivityAgeMs: readiness.latestActivityAgeMs,
+            connectorDrainArmed: Boolean(connectorDrain),
+            requestKind: requestId?.startsWith('recovery-auto-release:') ? 'automatic' : 'explicit',
+          });
+          return {
+            ok: true as const,
+            attempted: false,
+            noOp: true,
+            detail: `RELEASE_SESSION_CUTOVER_DEFERRED_FOR_MCP_ACTIVITY: ${readiness.detail}`,
+            releaseSession: session,
+          };
+        }
+
+        session = advanceReleaseSession({
+          controllerHome: config.controllerHome,
           sessionId,
-          detail: readiness.detail,
-          activeSessions: readiness.activeSessions,
-          activePosts: readiness.activePosts,
-          activeStreams: readiness.activeStreams,
-          initializing: readiness.initializing,
-          latestActivityAgeMs: readiness.latestActivityAgeMs,
-          requestKind: requestId?.startsWith('recovery-auto-release:') ? 'automatic' : 'explicit',
+          expectedRevision: session.revision,
+          phase: 'cutover_attempting',
+          receipts: [{
+            id: 'cutover_attempt',
+            kind: 'cutover',
+            summary: `byte-identical Candidate B ${candidateRelease.releaseId} promoted to Stable A release storage; beginning the single fenced cutover attempt`,
+          }],
         });
-        return {
-          ok: true as const,
-          attempted: false,
-          noOp: true,
-          detail: `RELEASE_SESSION_CUTOVER_DEFERRED_FOR_MCP_ACTIVITY: ${readiness.detail}`,
-          releaseSession: session,
-        };
-      }
-
-      session = advanceReleaseSession({
-        controllerHome: config.controllerHome,
-        sessionId,
-        expectedRevision: session.revision,
-        phase: 'cutover_attempting',
-        receipts: [{
-          id: 'cutover_attempt',
-          kind: 'cutover',
-          summary: `byte-identical Candidate B ${candidateRelease.releaseId} promoted to Stable A release storage; beginning the single fenced cutover attempt`,
-        }],
-      });
 
-      const activation = await activateRuntimeReleaseInternal(config, promoted.manifestPath, {}, {
-        ...(requestId?.trim() ? { requestId: requestId.trim() } : {}),
-        expectedAuthorityRevision: session.stableRelease.authorityRevision,
-        expectedActiveReleaseId: session.stableRelease.releaseId,
-        releaseSessionId: session.sessionId,
-      }, releaseSessionLock);
-
-      return reconcileCutoverAttempt(
-        activation.ok
-          ? 'cutover activation completed; reconciling canonical Runtime identity before phase progression'
-          : `cutover activation returned failure: ${activation.detail}`,
-        activation,
-      );
+        const activation = await activateRuntimeReleaseInternal(config, promoted.manifestPath, {}, {
+          ...(requestId?.trim() ? { requestId: requestId.trim() } : {}),
+          expectedAuthorityRevision: session.stableRelease.authorityRevision,
+          expectedActiveReleaseId: session.stableRelease.releaseId,
+          releaseSessionId: session.sessionId,
+        }, releaseSessionLock);
+
+        return reconcileCutoverAttempt(
+          activation.ok
+            ? 'cutover activation completed; reconciling canonical Runtime identity before phase progression'
+            : `cutover activation returned failure: ${activation.detail}`,
+          activation,
+        );
+      } finally {
+        if (connectorDrain) clearPackageConnectorCutoverDrain(config.controllerHome);
+      }
     } catch (error) {
       const detail = error instanceof Error ? error.message : String(error);
       const latest = readReleaseSession(config.controllerHome, sessionId) ?? session;