@openrig/cli 0.5.9 → 0.5.11

package/dist/daemon-lifecycle.d.ts

@@ -1,4 +1,5 @@
 import type { ChildProcess } from "node:child_process";
+import type { DaemonStartLock } from "./daemon-start-lock.js";
 import { type InitWorkspaceResult, type ManagedPathKind } from "@openrig/daemon/instance-initialization";
 export interface DaemonState {
     pid: number;
@@ -45,6 +46,10 @@ export interface DaemonStatus {
     /** OPR.0.4.3.21 — event-loop evidence when healthz answered with a monitor. */
     eventLoop?: DaemonEventLoopEvidence;
 }
+export interface GetDaemonStatusOptions {
+    /** Observers may disable cleanup; only a matching clean shutdown permits removal. */
+    cleanupStaleState?: boolean;
+}
 /** Build the daemon HTTP URL from status. Uses persisted host or defaults to 127.0.0.1. */
 export declare function getDaemonUrl(status: DaemonStatus): string;
 /**
@@ -96,6 +101,8 @@ export interface StartOptions {
     skipKernelBoot?: boolean;
 }
 export interface LifecycleDeps {
+    /** Required by startDaemon; read-only lifecycle consumers need no launch capability. */
+    acquireStartLock?: () => DaemonStartLock;
     spawn: (cmd: string, args: string[], opts: {
         env: Record<string, string>;
         stdio: unknown;
@@ -115,6 +122,7 @@ export interface LifecycleDeps {
      * not exercise collisions may omit it and use the legacy exists seam. */
     pathKind?: (path: string) => ManagedPathKind;
     openForAppend: (path: string) => number;
+    closeFile?: (fd: number) => void;
     isProcessAlive: (pid: number) => boolean;
     sleep?: (ms: number) => Promise<void>;
     homeDir?: string;
@@ -219,8 +227,8 @@ export declare function verifyRequiredListeners(input: {
     reason: string;
 }>;
 export declare function startDaemon(opts: StartOptions, deps: LifecycleDeps): Promise<DaemonState>;
-export declare function stopDaemon(deps: LifecycleDeps): Promise<void>;
-export declare function getDaemonStatus(deps: LifecycleDeps): Promise<DaemonStatus>;
+export declare function stopDaemon(deps: LifecycleDeps): Promise<"stopped" | "no-target">;
+export declare function getDaemonStatus(deps: LifecycleDeps, options?: GetDaemonStatusOptions): Promise<DaemonStatus>;
 export declare function readLogs(deps: LifecycleDeps): string | null;
 export declare function tailLogs(deps: LifecycleDeps, opts: {
     follow: boolean;
@@ -246,15 +254,8 @@ export declare function fetchSelfHostIdentity(deps: LifecycleDeps, url: string):
     selfHostId: string;
     selfHostIdSource?: string;
 } | undefined>;
-/**
- * A4 HTTP-path origin-triple carry: resolve THIS host's `selfHostId` for a REMOTE-targeting client,
- * so the stamped X-OpenRig-Session becomes the origin TRIPLE (member@rig@selfHostId) and the remote
- * daemon renders the ORIGIN host. The id comes from the LOCAL daemon's /healthz (env OPENRIG_URL,
- * else the running local daemon), via the shipped fail-open `fetchSelfHostId`. C1 fail-open all the
- * way down: no env URL and no running local daemon ⇒ `undefined` ⇒ the 2-part header stamps (today's
- * behavior, no new failure mode). This is THIS host's own derived id, never a caller-supplied string.
- */
-export declare function resolveOriginSelfHostId(deps: LifecycleDeps): Promise<string | undefined>;
+/** Resolve this instance's persisted identity even during an outage; never read it from the target. */
+export declare function resolveOriginSelfHostId(_deps: LifecycleDeps): Promise<string | undefined>;
 export interface KernelReadyResult {
     ok: boolean;
     kernelState: string | null;

package/dist/daemon-lifecycle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"daemon-lifecycle.d.ts","sourceRoot":"","sources":["../src/daemon-lifecycle.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGvD,OAAO,EAKL,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACrB,MAAM,yCAAyC,CAAC;AAEjD,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B;;8EAE0E;IAC1E,KAAK,EAAE,SAAS,GAAG,SAAS,GAAG,OAAO,GAAG,YAAY,CAAC;IACtD;6FACyF;IACzF,WAAW,CAAC,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,cAAc,GAAG,oBAAoB,CAAC;IAC/C,+EAA+E;IAC/E,SAAS,CAAC,EAAE,uBAAuB,CAAC;CACrC;AAED,2FAA2F;AAC3F,wBAAgB,YAAY,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,CAEzD;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,qBAAqB,IAAI,qBAAqB,CAM7D;AAED;;;;GAIG;AAEH;;oFAEoF;AACpF,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,YAAY,GAAG,qBAAqB,CAU9E;AAED;;0FAE0F;AAC1F,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,CAAC,EAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAe1F;AAED,wBAAgB,qBAAqB,CAAC,IAAI,CAAC,EAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,CAUrE;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,kFAAkF;IAClF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IAItB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,8BAA8B,CAAC,EAAE,MAAM,CAAC;IAKxC,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE;QACzC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC5B,KAAK,EAAE,OAAO,CAAC;QACf,QAAQ,EAAE,OAAO,CAAC;KACnB,KAAK,YAAY,CAAC;IAInB,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IAChF,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC;IAC/C,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IAC1C,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACnD,UAAU,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACnC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IAClC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B;6EACyE;IACzE,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,eAAe,CAAC;IAC7C,aAAa,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;IACxC,cAAc,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IAIzC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAItC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,EAAE,CAAC;CACtC;AAED,eAAO,MAAM,WAAW,QAAe,CAAC;AACxC,eAAO,MAAM,UAAU,QAAc,CAAC;AACtC,eAAO,MAAM,UAAU,QAAwC,CAAC;AAChE,eAAO,MAAM,QAAQ,QAAuC,CAAC;AAC7D,eAAO,MAAM,iBAAiB,QAA+C,CAAC;AAC9E,eAAO,MAAM,eAAe,QAA8C,CAAC;AA8B3E,MAAM,MAAM,uBAAuB,GAAG,mBAAmB,CAAC;AAe1D,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,GAAG,uBAAuB,CAElG;AAqCD,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,OAAO,GAAG,MAAM,CAWzF;AAED,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAuFD,wBAAgB,cAAc,CAC5B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,IAAI,EAAE;IACJ,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;;;;;;OAWG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,EAAE,EAAE,MAAM,CAAC;IACX,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,eAAe,CAAC,EAAE,MAAM,CAAC;IAIzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,8BAA8B,CAAC,EAAE,MAAM,CAAC;IAGxC,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B,GACA,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAsCxB;AAID;;;0EAG0E;AAC1E,wBAAgB,iBAAiB,CAAC,KAAK,EAAE;IACvC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;CACpB,GAAG;IAAE,QAAQ,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,CAQlD;AAED;;;;kEAIkE;AAClE,wBAAsB,uBAAuB,CAAC,KAAK,EAAE;IACnD,IAAI,EAAE;QAAE,IAAI,EAAE,UAAU,GAAG,SAAS,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,iBAAiB,EAAE,OAAO,CAAA;KAAE,CAAC;IACpF,IAAI,EAAE,MAAM,CAAC;IACb;;kFAE8E;IAC9E,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,GAAG,WAAW,GAAG,eAAe,CAAC,CAAC;CAC5E,GAAG,OAAO,CACP;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,GAChC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAChD;IAAE,EAAE,EAAE,eAAe,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAC1C,CA2CA;AAED,wBAAsB,WAAW,CAAC,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,WAAW,CAAC,CAqJ/F;AAED,wBAAsB,UAAU,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAkDnE;AAgDD,wBAAsB,eAAe,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC,CAgEhF;AAED,wBAAgB,QAAQ,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,GAAG,IAAI,CAI3D;AAED,wBAAgB,QAAQ,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE;IAAE,MAAM,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,CAW7E;AAiDD;;;;;;;;;;GAUG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAWnG;AAED;;;;GAIG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,aAAa,EACnB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAAC,CAgBxE;AAED;;;;;;;GAOG;AACH,wBAAsB,uBAAuB,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAe9F;AA8CD,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,OAAO,CAAC;IACZ,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,cAAc,SAAM,GACnB,OAAO,CAAC,iBAAiB,CAAC,CAoC5B"}
+{"version":3,"file":"daemon-lifecycle.d.ts","sourceRoot":"","sources":["../src/daemon-lifecycle.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAK9D,OAAO,EAKL,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACrB,MAAM,yCAAyC,CAAC;AAEjD,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B;;8EAE0E;IAC1E,KAAK,EAAE,SAAS,GAAG,SAAS,GAAG,OAAO,GAAG,YAAY,CAAC;IACtD;6FACyF;IACzF,WAAW,CAAC,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,cAAc,GAAG,oBAAoB,CAAC;IAC/C,+EAA+E;IAC/E,SAAS,CAAC,EAAE,uBAAuB,CAAC;CACrC;AAED,MAAM,WAAW,sBAAsB;IACrC,qFAAqF;IACrF,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED,2FAA2F;AAC3F,wBAAgB,YAAY,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,CAEzD;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,qBAAqB,IAAI,qBAAqB,CAM7D;AAED;;;;GAIG;AAEH;;oFAEoF;AACpF,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,YAAY,GAAG,qBAAqB,CAU9E;AAED;;0FAE0F;AAC1F,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,CAAC,EAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAe1F;AAED,wBAAgB,qBAAqB,CAAC,IAAI,CAAC,EAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,CAUrE;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,kFAAkF;IAClF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IAItB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,8BAA8B,CAAC,EAAE,MAAM,CAAC;IAKxC,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,aAAa;IAC5B,wFAAwF;IACxF,gBAAgB,CAAC,EAAE,MAAM,eAAe,CAAC;IACzC,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE;QACzC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC5B,KAAK,EAAE,OAAO,CAAC;QACf,QAAQ,EAAE,OAAO,CAAC;KACnB,KAAK,YAAY,CAAC;IAInB,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IAChF,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC;IAC/C,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IAC1C,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACnD,UAAU,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACnC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IAClC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B;6EACyE;IACzE,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,eAAe,CAAC;IAC7C,aAAa,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;IACxC,SAAS,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,IAAI,CAAC;IACjC,cAAc,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IAIzC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAItC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,EAAE,CAAC;CACtC;AAED,eAAO,MAAM,WAAW,QAAe,CAAC;AACxC,eAAO,MAAM,UAAU,QAAc,CAAC;AACtC,eAAO,MAAM,UAAU,QAAwC,CAAC;AAChE,eAAO,MAAM,QAAQ,QAAuC,CAAC;AAC7D,eAAO,MAAM,iBAAiB,QAA+C,CAAC;AAC9E,eAAO,MAAM,eAAe,QAA8C,CAAC;AA8B3E,MAAM,MAAM,uBAAuB,GAAG,mBAAmB,CAAC;AAe1D,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,GAAG,uBAAuB,CAElG;AAqCD,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,OAAO,GAAG,MAAM,CAWzF;AAED,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAuFD,wBAAgB,cAAc,CAC5B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,IAAI,EAAE;IACJ,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;;;;;;OAWG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,EAAE,EAAE,MAAM,CAAC;IACX,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,eAAe,CAAC,EAAE,MAAM,CAAC;IAIzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,8BAA8B,CAAC,EAAE,MAAM,CAAC;IAGxC,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B,GACA,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAsCxB;AAID;;;0EAG0E;AAC1E,wBAAgB,iBAAiB,CAAC,KAAK,EAAE;IACvC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;CACpB,GAAG;IAAE,QAAQ,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,CAQlD;AAED;;;;kEAIkE;AAClE,wBAAsB,uBAAuB,CAAC,KAAK,EAAE;IACnD,IAAI,EAAE;QAAE,IAAI,EAAE,UAAU,GAAG,SAAS,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,iBAAiB,EAAE,OAAO,CAAA;KAAE,CAAC;IACpF,IAAI,EAAE,MAAM,CAAC;IACb;;kFAE8E;IAC9E,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,GAAG,WAAW,GAAG,eAAe,CAAC,CAAC;CAC5E,GAAG,OAAO,CACP;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,GAChC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAChD;IAAE,EAAE,EAAE,eAAe,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAC1C,CA2CA;AAKD,wBAAsB,WAAW,CAAC,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,WAAW,CAAC,CAY/F;AAwOD,wBAAsB,UAAU,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,SAAS,GAAG,WAAW,CAAC,CAuEtF;AAgDD,wBAAsB,eAAe,CACnC,IAAI,EAAE,aAAa,EACnB,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAAC,YAAY,CAAC,CAoEvB;AAED,wBAAgB,QAAQ,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,GAAG,IAAI,CAI3D;AAED,wBAAgB,QAAQ,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE;IAAE,MAAM,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,CAW7E;AAiDD;;;;;;;;;;GAUG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAWnG;AAED;;;;GAIG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,aAAa,EACnB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAAC,CAgBxE;AAED,uGAAuG;AACvG,wBAAsB,uBAAuB,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAE/F;AA8CD,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,OAAO,CAAC;IACZ,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,cAAc,SAAM,GACnB,OAAO,CAAC,iBAAiB,CAAC,CAoC5B"}

package/dist/daemon-lifecycle.js

@@ -1,6 +1,8 @@
 import path from "node:path";
 import { existsSync } from "node:fs";
+import { DAEMON_STOP_WAIT_MS, DAEMON_SHUTDOWN_RECEIPT } from "@openrig/daemon/daemon-shutdown";
 import { ConfigStore } from "./config-store.js";
+import { readLocalOrigin } from "./local-origin.js";
 import { OPENRIG_HOME, LEGACY_RIGGED_HOME, readOpenRigEnv } from "./openrig-compat.js";
 import { ensureDefaultWorkspace, ensureOpenRigInstance, formatInstanceInitializationConflicts, } from "@openrig/daemon/instance-initialization";
 /** Build the daemon HTTP URL from status. Uses persisted host or defaults to 127.0.0.1. */
@@ -202,7 +204,7 @@ function readState(deps) {
     }
     catch {
         // Malformed daemon.json — treat as no state
-        console.error("Warning: malformed daemon.json, treating as stopped");
+        console.error("Warning: malformed daemon.json; target identity unavailable");
         return null;
     }
 }
@@ -385,7 +387,27 @@ export async function verifyRequiredListeners(input) {
     }
     return { ok: true, verified };
 }
+class StartupIdentityError extends Error {
+}
+class StartupChildPendingError extends Error {
+}
 export async function startDaemon(opts, deps) {
+    if (!deps.acquireStartLock)
+        throw new Error("Daemon startup requires a local launch reservation");
+    const lock = deps.acquireStartLock();
+    let preserve = false;
+    try {
+        return await startOwnedDaemon(opts, deps, lock);
+    }
+    catch (error) {
+        preserve = error instanceof StartupChildPendingError;
+        throw error;
+    }
+    finally {
+        lock.release(preserve);
+    }
+}
+async function startOwnedDaemon(opts, deps, lock) {
     const port = opts.port ?? DEFAULT_PORT;
     const db = opts.db ?? DEFAULT_DB;
     // bug-fix slice auth-bearer-tailscale-trust: preserve the
@@ -437,151 +459,285 @@ export async function startDaemon(opts, deps) {
         throw new Error(`OpenRig instance initialization blocked: ${formatInstanceInitializationConflicts(initialization)}`);
     }
     const logFd = deps.openForAppend(LOG_FILE);
-    const child = deps.spawn(process.execPath, [daemonEntry], {
-        env: buildDaemonEnv(process.env, {
-            port,
-            host: explicitHost,
-            db,
-            transcriptsEnabled: opts.transcriptsEnabled,
-            transcriptsPath: opts.transcriptsPath,
-            transcriptsLines: opts.transcriptsLines,
-            transcriptsPollIntervalSeconds: opts.transcriptsPollIntervalSeconds,
-            skipKernelBoot: opts.skipKernelBoot,
-        }),
-        stdio: ["ignore", logFd, logFd],
-        detached: true,
-    });
+    let child;
+    try {
+        child = deps.spawn(process.execPath, [daemonEntry], {
+            env: buildDaemonEnv(process.env, {
+                port,
+                host: explicitHost,
+                db,
+                transcriptsEnabled: opts.transcriptsEnabled,
+                transcriptsPath: opts.transcriptsPath,
+                transcriptsLines: opts.transcriptsLines,
+                transcriptsPollIntervalSeconds: opts.transcriptsPollIntervalSeconds,
+                skipKernelBoot: opts.skipKernelBoot,
+            }),
+            stdio: ["ignore", logFd, logFd],
+            detached: true,
+        });
+    }
+    finally {
+        deps.closeFile?.(logFd);
+    }
+    let childFailure;
+    let rejectExit;
+    let resolveExit;
+    const exited = new Promise((resolve) => { resolveExit = resolve; });
+    const failed = new Promise((_, reject) => { rejectExit = reject; });
+    // An error can arrive during synchronous publication/cleanup, between awaits.
+    void failed.catch(() => { });
+    const onError = (error) => {
+        childFailure = new Error(`Daemon child failed to spawn: ${error.message}`);
+        rejectExit(childFailure);
+    };
+    const onExit = (code, signal) => {
+        childFailure = new Error(`Daemon child ${child.pid ?? "unknown"} exited before startup completed (code ${code}, signal ${signal ?? "none"})`);
+        rejectExit(childFailure);
+        resolveExit();
+    };
+    child.once("error", onError);
+    child.once("exit", onExit);
     child.unref();
     const pid = child.pid;
-    // Poll healthz against the configured probe host (loopback default
-    // when operator didn't opt in to a specific bind).
+    const hasExited = () => child.exitCode != null || child.signalCode != null;
+    const assertChild = () => {
+        if (childFailure)
+            throw childFailure;
+        if (!Number.isSafeInteger(pid) || pid <= 0)
+            throw new Error("Daemon spawn returned no valid child PID");
+        if (hasExited())
+            throw new Error(`Daemon child ${pid} exited before startup completed`);
+    };
     const healthzUrl = `http://${probeHost}:${port}/healthz`;
-    let healthy = false;
-    for (let i = 0; i < HEALTHZ_RETRIES; i++) {
+    const readOwnedHealth = async (url) => {
+        assertChild();
+        let timer;
         try {
-            const res = await fetchDaemonProbe(deps, healthzUrl, HEALTHZ_PROBE_TIMEOUT_MS);
-            if (res.ok) {
-                healthy = true;
-                break;
-            }
-        }
-        catch {
-            // Not ready yet
+            return await Promise.race([
+                failed,
+                new Promise((_, reject) => {
+                    timer = setTimeout(() => reject(new HealthProbeTimeoutError(url)), HEALTHZ_PROBE_TIMEOUT_MS);
+                }),
+                (async () => {
+                    const res = await deps.fetch(url);
+                    if (!res.ok)
+                        return null;
+                    let body;
+                    try {
+                        body = res.json ? await res.json() : null;
+                    }
+                    catch {
+                        throw new StartupIdentityError(`Daemon startup identity unavailable at ${url}: expected child PID ${pid}; invalid health response`);
+                    }
+                    if (body?.pid !== pid) {
+                        throw new StartupIdentityError(`Daemon startup identity mismatch at ${url}: expected child PID ${pid}, observed ${typeof body?.pid === "number" ? body.pid : "unknown"}; state not published`);
+                    }
+                    assertChild();
+                    return body;
+                })(),
+            ]);
         }
-        await new Promise((r) => setTimeout(r, HEALTHZ_DELAY_MS));
-    }
-    if (!healthy) {
-        try {
-            deps.kill(pid, "SIGTERM");
+        finally {
+            if (timer)
+                clearTimeout(timer);
         }
-        catch { /* best effort */ }
-        const logContent = deps.readFile(resolveLifecycleFile(deps, "daemon.log"));
-        throw new Error(summarizeDaemonStartFailure(healthzUrl, logContent));
-    }
-    // S20 — the restored adoption/upgrade gate: when the daemon reports its bind plan,
-    // derive the required listener set from the EFFECTIVE mode and prove every listener
-    // by probing its own /healthz. A silently dropped listener fails the start LOUDLY
-    // (the 0.5.3-receipt regression accepted loopback health alone and missed exactly
-    // this). Older daemons without the payload skip the gate unchanged (additive).
+    };
     try {
-        const healthRes = await fetchDaemonProbe(deps, healthzUrl, HEALTHZ_PROBE_TIMEOUT_MS);
-        const healthBody = (await (healthRes.json?.() ?? Promise.resolve(null)).catch(() => null));
-        if (healthBody?.bind) {
-            const gate = await verifyRequiredListeners({
-                bind: healthBody.bind,
-                port,
-                // r2 repair — error PROVENANCE preserved: an explicit non-OK answer or a
-                // connection refusal is positive evidence ("unhealthy"); a timeout or any
-                // other transient probe exception is "indeterminate" and can never kill.
-                probe: async (url) => {
-                    try {
-                        const r = await fetchDaemonProbe(deps, url, HEALTHZ_PROBE_TIMEOUT_MS);
-                        return r.ok ? "healthy" : "unhealthy";
+        assertChild();
+        lock.recordChild(pid);
+        let healthy = false;
+        let lastProbe = "health endpoint not responding";
+        for (let i = 0; i < HEALTHZ_RETRIES; i++) {
+            try {
+                const body = await readOwnedHealth(healthzUrl);
+                if (body) {
+                    const bind = body.bind;
+                    if (!bind || !["explicit", "default"].includes(bind.mode) || !Array.isArray(bind.hosts)
+                        || bind.hosts.length === 0 || !bind.hosts.every((host) => typeof host === "string" && host.length > 0)
+                        || typeof bind.tailscaleDetected !== "boolean") {
+                        throw new StartupIdentityError(`Daemon startup listener identity unavailable for child PID ${pid}; state not published`);
                     }
-                    catch (err) {
-                        const code = err.code
-                            ?? err.cause?.code;
-                        return code === "ECONNREFUSED" ? "unhealthy" : "indeterminate";
+                    const gate = await verifyRequiredListeners({ bind, port, probe: async (url) => {
+                            try {
+                                return await readOwnedHealth(url) ? "healthy" : "unhealthy";
+                            }
+                            catch (error) {
+                                if (error instanceof StartupIdentityError || childFailure)
+                                    throw error;
+                                const code = error.code
+                                    ?? error.cause?.code;
+                                return code === "ECONNREFUSED" ? "unhealthy" : "indeterminate";
+                            }
+                        } });
+                    if (gate.ok === false)
+                        throw new StartupIdentityError(`Daemon child ${pid} FAILED the listener adoption gate: ${gate.reason}`);
+                    if (gate.ok === true) {
+                        healthy = true;
+                        break;
                     }
-                },
-            });
-            if (gate.ok === false) {
-                try {
-                    deps.kill(pid, "SIGTERM");
+                    lastProbe = gate.reason;
                 }
-                catch { /* best effort */ }
-                throw new Error(`daemon started but FAILED the listener adoption gate: ${gate.reason}`);
             }
-            // gate.ok === "indeterminate" falls through healthy: no evidence, no action.
+            catch (error) {
+                assertChild();
+                if (error instanceof StartupIdentityError)
+                    throw error;
+                lastProbe = error instanceof Error ? error.message : String(error);
+            }
+            await Promise.race([new Promise((resolve) => setTimeout(resolve, HEALTHZ_DELAY_MS)), failed]);
+        }
+        if (!healthy) {
+            throw new Error(`${summarizeDaemonStartFailure(healthzUrl, deps.readFile(resolveLifecycleFile(deps, "daemon.log")))}. Last probe: ${lastProbe}`);
+        }
+        assertChild();
+        if (!deps.isProcessAlive(pid))
+            throw new Error(`Daemon child ${pid} liveness could not be confirmed; state not published`);
+        const state = { pid: pid, port, host: probeHost, db, startedAt: new Date().toISOString() };
+        try {
+            deps.writeFile(STATE_FILE, JSON.stringify(state, null, 2));
+            assertChild();
+            // A synchronous writer can outlast the process while exit events remain
+            // undelivered. Recheck physical evidence on the other side of publication.
+            if (!deps.isProcessAlive(pid))
+                throw new Error(`Daemon child ${pid} liveness could not be confirmed at state publication; startup not accepted`);
+        }
+        catch (error) {
+            removeMatchingState(deps, STATE_FILE, state);
+            throw error;
         }
+        return state;
     }
-    catch (err) {
-        if (err instanceof Error && err.message.includes("listener adoption gate"))
-            throw err;
-        // A parse/probe hiccup on the gate read must not kill an otherwise healthy start;
-        // the gate acts only on POSITIVE evidence of a bad bind (never on its own failure).
-    }
-    const state = {
-        pid,
-        port,
-        // Persist the probe host (operator-explicit when set, loopback
-        // default otherwise) so subsequent status reads can reach the
-        // daemon regardless of whether tailscale was added at multi-bind.
-        host: probeHost,
-        db,
-        startedAt: new Date().toISOString(),
-    };
-    deps.writeFile(STATE_FILE, JSON.stringify(state, null, 2));
-    return state;
+    catch (error) {
+        // Only this launch's child may be cleaned up. A retained child also retains
+        // the reservation so a retry cannot run another pre-bind initialization.
+        // A failed ps is not exit evidence. This is our unreaped child: signal only
+        // that PID, then release exclusion only after its own exit is observed.
+        if (Number.isSafeInteger(pid) && pid > 0 && !hasExited()) {
+            try {
+                deps.kill(pid, "SIGTERM");
+            }
+            catch { /* confirm exit below */ }
+            let timer;
+            try {
+                const gone = await Promise.race([
+                    exited.then(() => true),
+                    new Promise((resolve) => { timer = setTimeout(() => resolve(false), DAEMON_STOP_WAIT_MS); }),
+                ]);
+                if (!gone)
+                    throw new StartupChildPendingError(`${error instanceof Error ? error.message : error}. Child PID ${pid} exit is unconfirmed; startup reservation retained. Inspect daemon-start.lock and daemon.log before recovery.`);
+            }
+            finally {
+                if (timer)
+                    clearTimeout(timer);
+            }
+        }
+        throw error;
+    }
+    finally {
+        // A native spawn failure with no PID emits its error on the next turn.
+        if (pid !== undefined || childFailure)
+            child.off("error", onError);
+        child.off("exit", onExit);
+    }
+}
+function readShutdownReceipt(deps, stateFile) {
+    const receiptPath = path.join(path.dirname(stateFile), DAEMON_SHUTDOWN_RECEIPT);
+    const raw = deps.readFile(receiptPath);
+    let receipt;
+    try {
+        receipt = JSON.parse(raw ?? "null") ?? undefined;
+    }
+    catch { /* unavailable */ }
+    if (receipt?.schema !== "openrig.daemon-shutdown/v1" || !Number.isSafeInteger(receipt.pid) || receipt.pid <= 0
+        || !Number.isFinite(Date.parse(receipt.startedAt)) || !(Date.parse(receipt.completedAt) >= Date.parse(receipt.startedAt))
+        || !(Date.parse(receipt.completedAt) <= Date.now()) || typeof receipt.phase !== "string"
+        || !Array.isArray(receipt.failures) || !["clean", "failed", "timed-out"].includes(receipt.outcome))
+        receipt = undefined;
+    return { receipt, present: raw !== null || deps.exists(receiptPath), receiptPath };
+}
+function receiptMatchesState(receipt, state, notBefore = Date.parse(state.startedAt)) {
+    return receipt?.pid === state.pid && Date.parse(receipt.startedAt) >= notBefore;
+}
+function isCleanShutdown(receipt) {
+    return receipt?.outcome === "clean" && receipt.phase === "complete" && receipt.failures.length === 0;
+}
+function removeMatchingState(deps, stateFile, state) {
+    // A concurrent start/rebind must not have its state removed by an old stop/status.
+    const current = readState(deps);
+    if (current?.pid === state.pid && current.startedAt === state.startedAt && current.port === state.port
+        && current.host === state.host && current.db === state.db)
+        deps.removeFile(stateFile);
 }
 export async function stopDaemon(deps) {
     const state = readState(deps);
-    if (!state) {
-        const configured = resolveConfiguredDaemonTarget();
-        let recoveredRunning = false;
+    const configured = resolveConfiguredDaemonTarget();
+    const explicitUrl = readOpenRigEnv("OPENRIG_URL", "RIGGED_URL");
+    const stateUrl = state ? `http://${state.host ?? DEFAULT_HOST}:${state.port}` : undefined;
+    const target = stateUrl ?? explicitUrl?.replace(/\/+$/, "") ?? `http://${configured.host}:${configured.port}`;
+    if (stateUrl && explicitUrl && new URL(explicitUrl).origin !== new URL(stateUrl).origin) {
+        throw new Error(`Cannot stop safely: addressed ${explicitUrl}/healthz does not match local PID ${state.pid} at ${stateUrl}/healthz; no signal sent.`);
+    }
+    const check = `${target}/healthz`;
+    const listener = async () => {
         try {
-            await fetchDaemonProbe(deps, `http://${configured.host}:${configured.port}/healthz`, HEALTHZ_PROBE_TIMEOUT_MS);
-            recoveredRunning = true;
+            await fetchDaemonProbe(deps, check, HEALTHZ_PROBE_TIMEOUT_MS);
+            return "responding";
         }
-        catch (err) {
-            if (err instanceof HealthProbeTimeoutError) {
-                throw new Error(`Daemon state is missing and port ${configured.port} is unresponsive — cannot stop safely.`);
-            }
+        catch (error) {
+            return isRefusedError(error) ? "refused" : "unavailable";
         }
-        if (recoveredRunning) {
-            throw new Error(`Daemon is running on port ${configured.port}, but daemon state is missing — cannot stop safely.`);
+    };
+    if (!state) {
+        const effect = await listener();
+        const sibling = findSiblingHome(deps);
+        if (effect !== "refused" || sibling) {
+            throw new Error(`Daemon state is missing — cannot stop safely. Checked ${check}; listener ${effect}.` +
+                (sibling ? ` Resolved home ${sibling.resolvedHome}; live sibling ${sibling.siblingHome}.` : ""));
         }
-        return;
+        const stateFile = resolveLifecycleFile(deps, "daemon.json");
+        if (deps.exists(stateFile)) {
+            throw new Error(`Daemon target state is unreadable; drain completion unverified. Checked ${check}; listener refused; no signal sent. Inspect ${stateFile}.`);
+        }
+        const prior = readShutdownReceipt(deps, stateFile);
+        if (prior.present && !isCleanShutdown(prior.receipt)) {
+            throw new Error(`Drain completion unverified: local shutdown evidence exists but no target state is recorded; cannot attribute it to ${target}. Checked ${check}; listener refused. Inspect ${prior.receiptPath}.`);
+        }
+        // No target is not a clean-drain verdict, including after an earlier clean stop.
+        return "no-target";
     }
     const stateFile = resolveLifecycleFile(deps, "daemon.json");
     const pidState = await checkPid(state, deps);
-    if (pidState === "dead") {
-        // Already dead — clean up stale state
-        deps.removeFile(stateFile);
-        return;
-    }
     if (pidState === "not_openrig") {
-        // PID alive but not our daemon (reused PID) — clean up state, don't kill
-        deps.removeFile(stateFile);
-        return;
+        throw new Error(`Cannot stop safely: PID ${state.pid} is present but identity is not confirmed at ${check}; no signal sent, state preserved.`);
     }
-    // pidState === "openrig" or "unresponsive" — safe to SIGTERM
-    deps.kill(state.pid, "SIGTERM");
-    // Wait briefly for process to exit
-    let exited = false;
-    for (let i = 0; i < 20; i++) {
-        if (!deps.isProcessAlive(state.pid)) {
-            exited = true;
-            break;
+    let notBefore = Date.parse(state.startedAt);
+    if (pidState !== "dead") {
+        notBefore = Date.now();
+        deps.kill(state.pid, "SIGTERM");
+        // One signal. An already-exited target goes straight to the same judgment.
+        const deadline = Date.now() + DAEMON_STOP_WAIT_MS;
+        while (deps.isProcessAlive(state.pid) && Date.now() < deadline) {
+            await new Promise((r) => setTimeout(r, 100));
         }
-        await new Promise((r) => setTimeout(r, 100));
     }
-    if (exited) {
-        deps.removeFile(stateFile);
+    const present = deps.isProcessAlive(state.pid);
+    const effect = await listener();
+    const observation = `targeted ${target}; checked ${check}; PID ${state.pid} ${present ? "present" : "absent"}; listener ${effect}`;
+    if (present) {
+        throw new Error(`Daemon did not exit after SIGTERM within ${DAEMON_STOP_WAIT_MS}ms; ${observation}` +
+            (effect === "responding" ? " (still listening)" : "") + "; state file preserved.");
     }
-    else {
-        throw new Error(`Daemon (pid ${state.pid}) did not exit after SIGTERM — state file preserved`);
+    if (effect !== "refused")
+        throw new Error(`Daemon stop verification is unverified: ${observation}; state preserved.`);
+    const { receipt, receiptPath } = readShutdownReceipt(deps, stateFile);
+    if (!receiptMatchesState(receipt, state, notBefore)) {
+        throw new Error(`Daemon process stopped; ${observation}; drain completion unverified (no matching shutdown receipt); state preserved. Inspect ${path.join(path.dirname(stateFile), "daemon.log")}.`);
     }
+    if (!isCleanShutdown(receipt)) {
+        throw new Error(`Daemon stopped with incomplete shutdown: ${receipt.outcome}; phase=${receipt.phase}; ${observation}. Pending effects are unverified; state preserved; inspect ${receiptPath}.`);
+    }
+    removeMatchingState(deps, stateFile, state);
+    return "stopped";
 }
 /** RULING 1ae863d2 — positive-down evidence classifier (lockstep with the daemon's
  *  crash-cart-detect semantics): ONLY a connection refusal is strong down evidence;
@@ -635,7 +791,7 @@ function findSiblingHome(deps) {
     }
     return undefined;
 }
-export async function getDaemonStatus(deps) {
+export async function getDaemonStatus(deps, options = {}) {
     // If OPENRIG_URL is set, bypass daemon.json and probe that URL directly
     const openrigUrl = readOpenRigEnv("OPENRIG_URL", "RIGGED_URL");
     if (openrigUrl) {
@@ -675,8 +831,12 @@ export async function getDaemonStatus(deps) {
         }
     }
     if (!deps.isProcessAlive(state.pid)) {
-        // Process dead — stale state
-        deps.removeFile(resolveLifecycleFile(deps, "daemon.json"));
+        // A status read must not erase the identity needed to judge a failed stop.
+        const stateFile = resolveLifecycleFile(deps, "daemon.json");
+        const { receipt } = readShutdownReceipt(deps, stateFile);
+        if (options.cleanupStaleState !== false && receiptMatchesState(receipt, state) && isCleanShutdown(receipt)) {
+            removeMatchingState(deps, stateFile, state);
+        }
         return { state: "stale" };
     }
     // Process alive — check healthz
@@ -816,32 +976,9 @@ export async function fetchSelfHostIdentity(deps, url) {
         return undefined;
     }
 }
-/**
- * A4 HTTP-path origin-triple carry: resolve THIS host's `selfHostId` for a REMOTE-targeting client,
- * so the stamped X-OpenRig-Session becomes the origin TRIPLE (member@rig@selfHostId) and the remote
- * daemon renders the ORIGIN host. The id comes from the LOCAL daemon's /healthz (env OPENRIG_URL,
- * else the running local daemon), via the shipped fail-open `fetchSelfHostId`. C1 fail-open all the
- * way down: no env URL and no running local daemon ⇒ `undefined` ⇒ the 2-part header stamps (today's
- * behavior, no new failure mode). This is THIS host's own derived id, never a caller-supplied string.
- */
-export async function resolveOriginSelfHostId(deps) {
-    // C1 fail-open around the WHOLE resolution, not just fetchSelfHostId: a remote op must NEVER depend on
-    // local daemon health. getDaemonStatus can throw (down / mid-restart / minimal test deps); ANY failure
-    // ⇒ undefined ⇒ the 2-part header stamps (today's behavior). Pin 5: no new failure mode on the remote path.
-    try {
-        let localUrl = readOpenRigEnv("OPENRIG_URL", "RIGGED_URL");
-        if (!localUrl) {
-            const status = await getDaemonStatus(deps);
-            if (status.state === "running" && status.port !== undefined)
-                localUrl = getDaemonUrl(status);
-        }
-        if (!localUrl)
-            return undefined;
-        return await fetchSelfHostId(deps, localUrl);
-    }
-    catch {
-        return undefined;
-    }
+/** Resolve this instance's persisted identity even during an outage; never read it from the target. */
+export async function resolveOriginSelfHostId(_deps) {
+    return readLocalOrigin();
 }
 const defaultSleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 /**