@platless/axom-cli 0.6.36 → 0.6.52

package/dist/workstation/daemon.js

@@ -1,40 +1,32 @@
-import { claimDaemonIdentity } from './control/daemonIdentity.js';
-import { openRuntimeHost } from './control/runtimeHost.js';
-import { stoppedRuntime } from './control/protocol.js';
-import { normalizeWorkstationServer } from './control/serverIdentity.js';
+import { claimDeviceDaemonIdentity } from './control/daemonIdentity.js';
+import { openDeviceRuntimeHost } from './control/runtimeHost.js';
+import { applyDeviceEnrollment, applyDeviceRemoval, inspectDeviceState } from './control/deviceCommands.js';
+import { RegistrationRemovalController } from './registrations/removal.js';
+import { LocalControlError } from './control/protocol.js';
+import { DeviceRuntime } from './runtime/deviceRuntime.js';
+import { createRegistrationRuntime } from './runtime/registrationRuntime.js';
+import { createDeviceServices } from './runtime/deviceServices.js';
+import { readLegacyRegistrationSources } from './registrations/migration.js';
 import { promises as fs } from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { AGENT_WIRE_MIN_VERSION } from './protocol/agent.js';
-import { clientDir, loadClientConfig, updateServiceContext } from './config.js';
-import { AgentSessionManager } from './agentSessions.js';
-import { AcpAgents } from './acp/acpAgents.js';
-import { ConnectionSupervisor } from './connection/supervisor.js';
-import { ManagementChannel } from './channels/management.js';
-import { ComputerChannel } from './channels/computer.js';
-import { AgentChannel, dispatchAgentFrame as dispatchAgentChannelFrame } from './channels/agent.js';
-import { TaskRegistry } from './update/taskRegistry.js';
-import { RdUpkeep } from './rd/upkeep.js';
+import { clientDir, updateServiceContext } from './config.js';
+import { dispatchAgentFrame as dispatchAgentChannelFrame } from './channels/agent.js';
 import { createUpdateCoordinator } from './update/runUpdate.js';
-import { resolveCliPath } from './daemonctl.js';
-import { SystemMetricsSampler } from './systemMetrics.js';
-import { cachedPtyStatus, preflightOptionalPty } from './update/ptyPreflight.js';
-import { FilesHostClient } from './files/client.js';
-import { ToolsClient } from './tools/client.js';
-import { WorkstationTools } from './tools/router.js';
-import { aggregateToolsInfo, computeFilesInfo } from './tools/info.js';
-import { defaultDistDir, KeeperLauncher } from './keepers/kit/launcher.js';
-import { readKeeperManifest } from './keepers/kit/bundle.js';
-import { KEEPER_POLICY_TICK_MS, KeeperPolicy, oneShotDrain, oneShotProbe } from './keepers/policy.js';
-import { TerminalGenerations } from './keepers/terminal/generations.js';
-import { AcpKeeperClient } from './keepers/acp/client.js';
-import { KeeperTransport } from './acp/processor/transport/keeper.js';
-import { keeperGenerations } from './acp/processor/transport/generations.js';
-import { ExecPolicy } from './exec/policy.js';
-import { LegacyToolsKeeper } from './keepers/legacy.js';
-import { TerminalRouter, terminalEnv, terminalShell } from './tools/terminalRouter.js';
-import { ToolchainProbe } from './toolchain.js';
+import { CLIENT_VERSION } from './version.js';
+import { captureStartupPackageEvidence, deviceHealthExpectationSchema } from './update/deviceHealth.js';
+import { readDeviceBootstrapRecovery } from './update/recoveryPlan.js';
+import { readLegacyBridge, releaseLegacyBridge, prepareLegacyContainerBridge, recoverLegacyContainer, legacyBridgeUpdateSnapshot, resumeLegacyManagedBridge } from './update/legacyBridge.js';
+import { prepareLegacyRdReadiness } from './rd/migrationReadiness.js';
+import { createDeviceRecoveryTick } from './update/deviceRecoveryLifecycle.js';
+import { UpdateStateStore } from './update/stateStore.js';
+import { prepareDeviceRollbackHandoff } from './update/deviceRollback.js';
+import { RdUpkeep } from './rd/upkeep.js';
+import { adoptBundledRd, synchronizeRd } from './rd/update.js';
+import { readRdState } from './rd/state.js';
+import { resolveCliPath, serviceContext } from './daemonctl.js';
 /**
  * The path `runDaemon` hands `createUpdateCoordinator` as `cliPath`, used to re-provision the OS
  * service after an update (see runUpdate.ts's `provisionService`).
@@ -240,8 +232,6 @@ export async function existingDirectories(roots) {
 }
 /** How often the daemon re-reads the workspaces config (and root existence) to restart the files host on a change. */
 export const FILES_ROOTS_POLL_MS = 10_000;
-/** How often the legacy tools keeper is re-probed and checked for retirement (keepers/legacy.ts). */
-export const LEGACY_TICK_MS = 30_000;
 /**
  * Builds the object `ManagementChannelOptions.keepers` reports (Task 26): the policy's statuses, never a rejection (a failure is
  * `null`, which the channel also guarantees). `countedExecs` (final review minor 7): keeper-terminal execs `activeShellTasks` also
@@ -256,7 +246,7 @@ export async function buildKeeperStatuses(policy, countedExecs = () => 0) {
     catch {
         return null;
     }
-    const terminals = statuses.filter((status) => status.kind === 'terminal' && !status.legacy);
+    const terminals = statuses.filter((status) => status.kind === 'terminal');
     const target = terminals.find((status) => status.replacement === 'none') ?? terminals[0];
     if (!target)
         return statuses;
@@ -287,342 +277,254 @@ export function startExclusivePoll(poll, intervalMs) {
     return () => clearInterval(timer);
 }
 export async function runDaemon(options = {}) {
-    const directory = clientDir();
-    const shutdown = new AbortController();
-    const state = { snapshot: async () => ({ ...stoppedRuntime(), connection: 'connecting' }) };
-    const { host, identity } = await claimDaemonIdentity(directory, async (identity) => {
-        const config = identity.config;
-        const host = await openRuntimeHost({ directory, binding: { server: normalizeWorkstationServer(config.server), workstationId: config.workstationId, ...(config.ownerUserId ? { ownerUserId: config.ownerUserId } : {}) },
-            mode: options.supervisedByServiceManager ? 'launchd' : 'foreground', snapshot: () => state.snapshot(), shutdown: async () => { shutdown.abort(); },
-            update: async (release, operationId) => {
-                if (!state.update)
-                    return { phase: 'BUSY', commandId: operationId };
-                void state.update.handle({ commandId: operationId, release, force: false }).catch(error => console.error('[update] local request failed', error));
-                return { phase: 'REQUESTED', commandId: operationId, version: release.version };
-            },
-        });
-        return { host, identity };
-    });
     try {
-        await runOwnedDaemon(options, shutdown, state, identity);
+        await runDeviceDaemon(options);
     }
-    finally {
-        await host.close();
+    catch (error) {
+        const bridge = await readLegacyBridge(options.directory ?? clientDir());
+        if (bridge?.lifecycle !== 'container')
+            throw error;
+        console.error('[device] Container migration startup failed; restoring the verified predecessor', error instanceof Error ? error.message : String(error));
+        await recoverLegacyContainer(bridge);
     }
 }
-async function runOwnedDaemon(options, shutdown, localState, identity) {
-    // Last line of defence for the whole process. Node's default for an unhandled rejection is to
-    // *exit*, and this daemon is the only thing keeping every session on this workstation alive —
-    // dying because one async callback rejected is strictly worse than logging and carrying on.
-    // Registered once, on the daemon path only (the CLI's one-shot commands keep the default).
-    process.on('unhandledRejection', (reason) => {
-        const detail = reason instanceof Error ? (reason.stack ?? reason.message) : String(reason);
-        console.error(`[daemon] unhandled rejection (ignored, daemon stays up): ${detail}`);
-    });
-    const dir = clientDir();
-    const cfg = identity.config;
-    let activateRdAfterReadiness;
-    if (process.platform === 'linux') {
-        const { synchronizeRd } = await import('./rd/update.js');
-        activateRdAfterReadiness = await synchronizeRd(dir, cfg.server);
-    }
-    const { NativeProvider } = await import('./desktopControl/nativeProvider.js');
-    const { DeviceSockets } = await import('./desktopControl/deviceSockets.js');
-    const { DesktopSessionSupervisor } = await import('./desktopControl/supervisor.js');
-    const { MacProvider } = await import('./desktopControl/macProvider.js');
-    const { LinuxDesktopProvider } = await import('./rd/provider.js');
-    const legacyDesktop = cfg.desktopProvider ? new NativeProvider({ ...cfg.desktopProvider, validateSession: async () => {
-            const { readRdState } = await import('./rd/state.js');
-            if (await readRdState(dir))
-                throw new Error('Remote desktop configuration changed');
-        } }) : undefined;
-    const desktopProvider = options.desktopProvider ?? (process.platform === 'linux' ? new LinuxDesktopProvider(dir, cfg.server, legacyDesktop) :
-        legacyDesktop ?? (process.platform === 'darwin' && process.arch === 'arm64' ? new MacProvider(dir, cfg) : undefined));
-    const { clientKey, serverPub } = identity;
-    // Repair the first fixed release even when it was installed by an older ignore-scripts updater,
-    // before a newly started keeper-terminal snapshots native dependency availability.
-    await preflightOptionalPty(updateServiceContext(dir));
-    const tasks = new TaskRegistry();
-    // Attaches both the server-driven update path (onUpdate below) and axom update's manual path to
-    // the same coordinator assembly — see runUpdate.ts.
-    const updates = createUpdateCoordinator({
-        dir, server: cfg.server, tasks,
-        cliPath: daemonCliPath(),
-        // launchd/systemd is configured with KeepAlive/Restart=always, and a container has its own
-        // restart policy. Exiting is therefore the atomic hand-off from the old package to the freshly
-        // installed daemon.
-        //
-        // Passed unconditionally on purpose: `createUpdateCoordinator` drops it for the one lifecycle
-        // that has nothing to hand off to (`'none'` — see `lifecyclePolicy().restartsOnHandoff`),
-        // alongside the other three policy decisions. Gating it here instead would put a fourth copy of
-        // the same string comparison at a call site, which is exactly where the first three were
-        // deliberately taken out of.
-        restart: async () => { process.exit(0); },
-        // The daemon is the service manager's own supervised process: it is the one caller that must
-        // rewrite the service definition and arm the rollback watchdog. See RunDaemonOptions and
-        // resolveServiceLifecycle above for how that treatment is keyed on *how this process was
-        // invoked*, not on what the host merely supports.
-        serviceLifecycle: resolveServiceLifecycle(options),
-    });
-    localState.update = updates;
-    // One ACP client for every external agent; the roster it reports is the ACP agent registry, keyed
-    // by registry agent id (ruling R2) — the same key `agent_open.bridge` now carries.
-    // Live sessions run in keeper-acp (spec §5.3) — the adapters outlive the daemon there — or, when it cannot be reached, in the
-    // daemon itself through the local fallback (§5.7). Short-lived connections (list, delete, verify, login) stay direct children.
-    const acpLauncher = new KeeperLauncher({ configDir: dir, workstationId: cfg.workstationId, server: cfg.server });
-    const acpTransport = new KeeperTransport(new AcpKeeperClient({ launcher: acpLauncher }));
-    // Sessions keeper-acp still runs from a previous daemon (a restart, an upgrade, a crash) are adopted where they are — across
-    // keeper-acp generations (spec §5.5, §6.3) — before the agent channel's reconnect offer is answered.
-    const acpGenerations = keeperGenerations({ launcher: acpLauncher, current: acpTransport });
-    const acp = new AcpAgents({ cacheDir: dir, serverOrigin: cfg.server, transports: { keeper: acpTransport }, keeperGenerations: acpGenerations });
-    const agents = new AgentSessionManager(acp, null, path.join(dir, 'agents'), tasks);
-    void agents.adoptSessions();
-    let bridges = await acp.roster();
-    // A scan's roster (and a pushed one) also carries the adapter builds live sessions run and how many could move now (spec §6.4,
-    // Task 25): keeper-acp's process labels joined with this daemon's sessions. The hello's roster above does not — it is not a scan.
-    const scanRoster = () => acp.roster({ sessions: (session) => agents.rosterSessionState(session) });
-    let supervisor;
-    // Plaintext WebSockets are only for an explicitly opted-in local development fixture. Production
-    // ticket handshakes must be WSS because the ticket is the data-channel key derivation material.
-    const allowInsecureWs = process.env.AXOM_WORKSTATION_ALLOW_INSECURE_WS === '1';
-    // Files: one daemon-owned host process (files/host.ts) serves file_*_request frames and files.* tool requests.
-    const home = os.homedir();
-    const playgroundCwd = path.join(home, '.axom', 'playground');
-    await fs.mkdir(playgroundCwd, { recursive: true });
-    let roots = workspaceRoots(cfg, home);
-    let hostRoots = [];
-    const filesHost = new FilesHostClient({
-        configDir: dir,
-        options: async () => { hostRoots = await existingDirectories(roots); return { home, roots: hostRoots }; },
-        onActivityChanged: () => tasks.externalActivityChanged(),
-        log: (line) => console.error(`${new Date().toISOString()} ${line}`),
-    });
-    tasks.externalActivity = () => filesHost.activity();
-    filesHost.start();
-    const stopRootsPoll = startExclusivePoll(async () => {
+async function runDeviceDaemon(options) {
+    const directory = options.directory ?? clientDir();
+    const lifecycle = resolveServiceLifecycle(options);
+    if (lifecycle === 'container')
+        await prepareLegacyContainerBridge(directory, { ...serviceContext(), configDir: directory });
+    const packageRoot = updateServiceContext(directory).packageRoot;
+    const startupPackage = await captureStartupPackageEvidence(packageRoot, CLIENT_VERSION);
+    const legacyBridge = await readLegacyBridge(directory, startupPackage);
+    if (legacyBridge?.lifecycle === 'managed')
+        await resumeLegacyManagedBridge(directory, startupPackage);
+    let legacyStartupHeld = !!legacyBridge;
+    if (options.desktopProvider || options.onDesktopCommand)
+        throw new LocalControlError('UNSUPPORTED_PROTOCOL', 'Device remote desktop integration is unavailable until the physical isolation contract is integrated');
+    const shutdown = new AbortController();
+    const services = options.deviceServices ?? createDeviceServices({ root: directory });
+    const previousUpdateSnapshot = services.updates.snapshot.bind(services.updates);
+    services.updates.snapshot = async (registrationId) => await legacyBridgeUpdateSnapshot(directory) ?? previousUpdateSnapshot(registrationId);
+    let device;
+    let removal;
+    let generation = '';
+    let fullyInitialized = false;
+    let recoveryLease;
+    let rollbackLease;
+    let rollbackPreparation;
+    let rollbackBinding;
+    let rdUpkeep;
+    let stopRdPoll = () => { };
+    const mode = options.supervisedByServiceManager ? 'launchd' : 'foreground';
+    const snapshot = async () => ({ ...await inspectDeviceState({ store, device, generation, mode }), desktop: services.desktopFacts?.() });
+    let store;
+    let initialized;
+    let initializationFailed;
+    const initialization = new Promise((resolve, reject) => { initialized = resolve; initializationFailed = reject; });
+    void initialization.catch(() => { });
+    let preparing;
+    let preparedMode;
+    const prepareStop = (stopMode) => {
+        if (preparedMode)
+            return preparedMode === 'terminate' || preparedMode === stopMode ? Promise.resolve() : Promise.reject(new LocalControlError('OUTCOME_UNKNOWN', 'Detached work requires verified termination before the device can be stopped'));
+        if (preparing)
+            return preparing.then(() => prepareStop(stopMode));
+        const retiring = device?.stop(stopMode);
+        void retiring?.catch(() => { });
+        preparing = (async () => {
+            await initialization;
+            if (retiring)
+                await retiring;
+            else
+                await device?.stop(stopMode);
+            preparedMode = stopMode;
+        })().catch(error => { preparing = undefined; throw error; });
+        return preparing;
+    };
+    let stopping;
+    const stop = (stopMode) => {
+        fullyInitialized = false;
+        stopping ??= (async () => {
+            stopRdPoll();
+            await rdUpkeep?.stop();
+            await prepareStop(stopMode);
+            await services.stop();
+            shutdown.abort();
+        })().catch(error => { stopping = undefined; throw error; });
+        return stopping;
+    };
+    const host = await claimDeviceDaemonIdentity(directory, async (identity) => {
+        store = identity.store;
+        return openDeviceRuntimeHost({ directory, mode, snapshot,
+            shutdown: stop,
+            prepareShutdown: prepareStop,
+            addRegistration: async (request) => {
+                if (!fullyInitialized || !device || preparing || stopping)
+                    throw new LocalControlError('BUSY', 'Device lifecycle transition is in progress');
+                const finishMutation = device.beginMembershipMutation();
+                let result;
+                try {
+                    result = await applyDeviceEnrollment(request, directory, snapshot, () => device.assertMutationAllowed());
+                }
+                finally {
+                    finishMutation();
+                }
+                await device.reconcile();
+                return result;
+            },
+            removeRegistration: async (request) => {
+                if (!fullyInitialized || !removal || preparing || stopping)
+                    throw new LocalControlError('BUSY', 'Device lifecycle transition is in progress');
+                return applyDeviceRemoval(request, { controller: removal, snapshot });
+            },
+            reconcile: async () => { if (!fullyInitialized || !device)
+                throw new LocalControlError('BUSY', 'Device initialization is in progress'); await device.reconcile(); },
+            update: async (release, operationId, source) => { if (!fullyInitialized)
+                throw new LocalControlError('BUSY', 'Device initialization is in progress'); return services.updates.local(operationId, release, source); },
+            updateHealth: (request, currentGeneration) => services.updates.health(request, currentGeneration),
+            prepareUpdateRollback: async (request, currentGeneration) => {
+                if (!fullyInitialized || !device)
+                    throw new LocalControlError('OUTCOME_UNKNOWN', 'Original target initialization is incomplete');
+                const binding = JSON.stringify(deviceHealthExpectationSchema.parse(request));
+                if (rollbackBinding && rollbackBinding !== binding)
+                    throw new LocalControlError('BINDING_CONFLICT', 'Original rollback preparation request changed');
+                rollbackBinding = binding;
+                rollbackPreparation ??= prepareDeviceRollbackHandoff({ root: directory, generation: currentGeneration, startup: startupPackage,
+                    lease: () => { rollbackLease ??= recoveryLease ?? device.acquireMaintenance({ transactionId: request.transactionId }); return rollbackLease; },
+                }, request).catch(error => { rollbackPreparation = undefined; throw error; });
+                return rollbackPreparation;
+            },
+        });
+    }, startupPackage);
+    generation = host.generation;
+    let stopPoll = () => { };
+    const signalStop = () => { void stop('detach').catch(error => console.error('[device] shutdown needs verification', error)); };
+    const rejection = (reason) => console.error('[device] unhandled rejection', reason instanceof Error ? reason.message : 'unknown');
+    process.on('unhandledRejection', rejection);
+    process.once('SIGINT', signalStop);
+    process.once('SIGTERM', signalStop);
+    try {
+        let bootstrap;
         try {
-            roots = workspaceRoots(await loadClientConfig(dir), home);
-            const current = await existingDirectories(roots);
-            if (JSON.stringify(current) !== JSON.stringify(hostRoots))
-                filesHost.reconfigure();
+            bootstrap = await readDeviceBootstrapRecovery(directory, startupPackage);
         }
-        catch { /* an unreadable config keeps the current host */ }
-    }, FILES_ROOTS_POLL_MS);
-    // tools.info is aggregated here and starts no keeper: its terminal fields come from keeper-terminal's hello when that keeper
-    // already runs, else from the cached node-pty check. terminal.* go through the TerminalRouter (keeper-terminal, or a legacy
-    // tools keeper an older CLI left running with live PTYs: served until they end, then stopped). browser.* keep the
-    // browser-kind ToolsClient path. Nothing here constructs a terminal-kind ToolsClient: its request() would start the legacy keeper.
-    const toolsConfig = { configDir: dir, workstationId: cfg.workstationId, server: cfg.server, roots, browserBinding: cfg.browserBinding };
-    const browserTools = new ToolsClient(toolsConfig, 'browser');
-    const ptyStatus = cachedPtyStatus();
-    // keeper-terminal generations (Task 26): new work goes to the serving generation; PTYs and execs an older generation still runs
-    // after an upgrade are routed to it by owner until the replacement policy retires it.
-    const terminalLauncher = new KeeperLauncher({ configDir: dir, workstationId: cfg.workstationId, server: cfg.server });
-    const terminalKeepers = new TerminalGenerations({ launcher: terminalLauncher });
-    const legacyKeeper = new LegacyToolsKeeper({
-        tools: toolsConfig,
-        recoverUploads: (uploads) => filesHost.recoverUploads(uploads),
-        log: (line) => console.error(`${new Date().toISOString()} ${line}`),
-    });
-    void legacyKeeper.detect();
-    const stopLegacyPoll = startExclusivePoll(() => legacyKeeper.tick(), LEGACY_TICK_MS);
-    const terminals = new TerminalRouter({
-        kits: terminalKeepers,
-        legacy: legacyKeeper,
-        launch: async (cwd) => ({ cwd: await filesHost.terminalCwd(cwd), shell: terminalShell(), env: terminalEnv() }),
-    });
-    const workstationTools = new WorkstationTools({
-        files: filesHost,
-        terminal: (method, params) => terminals.request(method, params),
-        browser: (method, params) => browserTools.request(method, params),
-        info: () => aggregateToolsInfo({
-            files: async () => filesHost.info() ?? computeFilesInfo(home, roots),
-            terminal: () => terminalKeepers.terminalStatus(ptyStatus),
-            browser: (method, params) => browserTools.request(method, params),
-        }),
-    });
-    // exec_request: keeper-terminal (durable) when available, else in this process; argv/env/deadline/shaping decided here.
-    // Execs a previous daemon left in keeper-terminal are recovered first: wire ≤ 4 ones are stopped (their channel is gone), wire v5
-    // ones are followed for the server to re-attach (exec_attach on the next computer channel).
-    // Keeper replacement (spec §8.3, Task 26): what the heartbeat reports of each keeper generation, and what happens to an older one.
-    const drainKeeper = oneShotDrain((kind, gen) => (kind === 'acp' ? acpLauncher : terminalLauncher).pathsFor(kind, gen));
-    const keeperPolicy = new KeeperPolicy({
-        dir: path.join(dir, 'keepers'),
-        probe: oneShotProbe((kind, gen) => (kind === 'acp' ? acpLauncher : terminalLauncher).pathsFor(kind, gen)),
-        terminal: {
-            currentGen: () => terminalKeepers.currentGen(),
-            live: async () => (await terminalKeepers.running()).map((generation) => generation.gen),
-            manifest: () => terminalKeepers.manifest(),
-            stop: async (gen, mode) => {
-                const result = await terminalLauncher.stop('terminal', gen, mode);
-                if (result.stopped)
-                    terminalKeepers.forget(gen);
-                return result;
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+        }
+        if (legacyBridge && process.platform === 'linux') {
+            try {
+                const readiness = await prepareLegacyRdReadiness(directory);
+                if (readiness.kind === 'unavailable')
+                    console.warn(`[rd] ${readiness.reason}`);
+                else if (readiness.kind === 'staged')
+                    console.warn('[rd] Compatible desktop runtime staged; activation is deferred until the original desktop authority is retired and physically accepted.');
+            }
+            catch (error) {
+                console.warn('[rd] Legacy desktop configuration remains unavailable', error instanceof Error ? error.message : String(error));
+            }
+        }
+        await services.start();
+        device = new DeviceRuntime({ store, desktopActivity: () => services.desktopActivity?.() ?? { known: false, consumers: 1 }, factory: async (identity) => createRegistrationRuntime({ ...identity,
+                registrationRoot: store.root,
+                startupHeld: legacyStartupHeld || !!bootstrap && (bootstrap.transaction.phase === 'RESTARTING' || !!bootstrap.transaction.installedRollback && !!bootstrap.transaction.recoveryRequired),
+                paths: { legacySources: await readLegacyRegistrationSources(directory, identity.registration.id) }, deviceServices: services,
+            }) });
+        services.updates.configure({ directory, device, generation, lifecycle, startupPackage, packageRoot, initialized: () => fullyInitialized,
+            execute: (command, context) => createUpdateCoordinator({ dir: directory, server: context.source, cliPath: daemonCliPath(), serviceLifecycle: lifecycle, deviceUpdate: context, restart: async () => { await stop('detach'); } }).handle(command),
+            completeRecovery: async (persist) => {
+                if (!recoveryLease) {
+                    await persist();
+                    return;
+                }
+                const original = recoveryLease;
+                await original.release(async () => {
+                    const recovery = await readDeviceBootstrapRecovery(directory, startupPackage);
+                    if (!recovery)
+                        throw new LocalControlError('OUTCOME_UNKNOWN', 'Original device restart recovery evidence is missing');
+                    await new UpdateStateStore(directory).save({ phase: 'SUCCEEDED', commandId: recovery.transaction.transactionId, version: recovery.transaction.release.version, releaseSha512: recovery.transaction.release.sha512, remoteForcePolicy: 'drain-only' });
+                    await persist();
+                });
+                if (recoveryLease === original)
+                    recoveryLease = undefined;
             },
-            reachable: async (gen) => (await terminalKeepers.client(gen)).runningHello(),
-            drain: (gen) => drainKeeper('terminal', gen),
-        },
-        legacy: legacyKeeper,
-        acp: {
-            currentGen: () => acpGenerations.current(),
-            live: () => acpGenerations.live(),
-            manifest: () => readKeeperManifest(path.join(defaultDistDir(), 'acp')),
-            stop: (gen, mode) => acpLauncher.stop('acp', gen, mode),
-            moveOff: (gens) => agents.moveOffOlderKeeperGenerations(undefined, gens),
-            cancelMoves: async (refs) => { for (const sessionRef of refs)
-                await agents.cancelSwitch({ sessionRef }); },
-            retireIdle: () => acp.retireIdleGenerations(),
-            session: (ref) => agents.sessionView(ref),
-        },
-        agentName: (agentId) => bridges.find((bridge) => bridge.type === agentId)?.displayName || agentId,
-        legacyShell: () => terminalShell(),
-        log: (line) => console.error(`${new Date().toISOString()} ${line}`),
-    });
-    terminalKeepers.picker = (current, older) => keeperPolicy.terminalServing(current, older);
-    const stopKeeperPolicy = startExclusivePoll(() => keeperPolicy.tick(), KEEPER_POLICY_TICK_MS);
-    // Spec §3.1: keeper sockets that fell back to /tmp (a long configDir path) are touched so a /tmp cleaner never reaps them.
-    const stopSocketTouch = startExclusivePoll(async () => {
-        await acpLauncher.touchSockets('acp');
-        await terminalLauncher.touchSockets('terminal');
-    }, KEEPER_POLICY_TICK_MS);
-    void keeperPolicy.tick();
-    const execPolicy = new ExecPolicy({ generations: terminalKeepers, log: (line) => console.error(`${new Date().toISOString()} ${line}`) });
-    void execPolicy.recover();
-    const computer = new ComputerChannel({ server: cfg.server, allowInsecureWs, taskRegistry: tasks, browserBinding: cfg.browserBinding,
-        runExec: (request, onOutput, signal, hooks) => execPolicy.run(request, onOutput, signal, hooks),
-        execs: execPolicy, log: (line) => console.error(`${new Date().toISOString()} ${line}`),
-        tools: (method, params) => workstationTools.request(method, params),
-        runFrame: (request, signal) => workstationTools.runFrame(request, signal),
-    });
-    const metrics = new SystemMetricsSampler(cfg.workspaces ?? []);
-    await metrics.start();
-    const toolchain = new ToolchainProbe(() => terminalShell(), () => terminalEnv());
-    toolchain.start();
-    const desktopSupervisor = desktopProvider && !options.onDesktopCommand ? new DesktopSessionSupervisor({ provider: desktopProvider,
-        sockets: new DeviceSockets(cfg.server, process.env.AXOM_DESKTOP_ALLOW_PRIVATE_WS === '1'),
-        report: (generation, frame) => management.sendDesktopState(generation, frame),
-        refreshCapabilities: generation => management.refreshDesktopCapabilities(generation), }) : undefined;
-    let rdGeneration;
-    const rdUpkeep = process.platform === 'linux' && desktopSupervisor ? new RdUpkeep({
-        synchronize: async () => {
-            if (!rdGeneration || shutdown.signal.aborted)
-                return;
-            const { synchronizeRd } = await import('./rd/update.js');
-            return synchronizeRd(dir, cfg.server, { deferActivation: true });
-        },
-        whenIdle: operation => desktopSupervisor.whenIdle(async () => {
-            if (!tasks.canUpdate() || !rdGeneration || shutdown.signal.aborted)
-                return;
-            await operation();
-        }),
-        refresh: () => { if (rdGeneration)
-            management.refreshDesktopCapabilities(rdGeneration); },
-        log: message => console.error(`${new Date().toISOString()} ${message}`),
-    }) : undefined;
-    const stopRdUpkeep = rdUpkeep ? startExclusivePoll(() => rdUpkeep.tick(), 60_000) : () => { };
-    const management = new ManagementChannel({
-        server: cfg.server, workstationId: cfg.workstationId, workstation: cfg.workstationId, clientKey, serverPub,
-        bridges: () => bridges,
-        workspaces: cfg.workspaces,
-        playgroundCwd,
-        metrics: () => metrics.snapshot(),
-        toolchain: () => toolchain.current(),
-        allowInsecureWs,
-        onReady: async (ready) => {
-            await updates.managementReady(ready.release, ready.generation);
-            await activateRdAfterReadiness?.();
-            if (ready.selectedWire >= 9)
-                desktopSupervisor?.managementReady(ready.generation);
-            rdGeneration = ready.selectedWire >= 9 ? ready.generation : undefined;
-            void rdUpkeep?.tick();
-        },
-        desktopProvider,
-        onDesktopCommand: options.onDesktopCommand ?? ((frame, generation) => desktopSupervisor?.dispatch(frame, generation) ?? Promise.resolve()),
-        onClosed: generation => {
-            if (rdGeneration === generation)
-                rdGeneration = undefined;
-            desktopSupervisor?.managementClosed(generation);
-            options.onDesktopManagementClosed?.(generation);
-        },
-        onUpdate: (command) => updates.handle(command),
-        onExternalAgentsScan: async () => {
-            bridges = await scanRoster();
-            return bridges;
-        },
-        snapshot: () => buildManagementSnapshot(supervisor, tasks, updates),
-        keepers: () => buildKeeperStatuses(keeperPolicy, () => tasks.countedKeeperExecs),
-        onKeeperControl: (frame) => keeperPolicy.control(frame),
-    });
-    options.onDesktopManagement?.(management);
-    const agent = new AgentChannel({ server: cfg.server, agents, bridges: () => bridges, allowInsecureWs });
-    // Spec §6.2: first take over what an older CLI left (`_npx` copies, pre-build binary dirs) so agents
-    // that worked keep working; then §6.1: a version this CLI certifies (runtime.json/catalog pin) or a
-    // changed patch set moves an installed agent's current build forward by itself ("Updated by Axom").
-    // In the background: either may copy or download, an open of an agent not done yet waits on that
-    // agent's lock, and running sessions keep the build they were spawned from either way. A changed
-    // roster reaches the server the way a scan's does; offline, the next hello carries it.
-    void maintainAdapterBuilds(acp, async () => {
-        bridges = await scanRoster();
-        management.pushRoster(bridges);
-    });
-    // A quota capability learned mid-flight (this process's first spawn of an agent) changes what the
-    // roster would say; push it the way a build change does. Coalesced: several agents flipping
-    // around one burst of opens share a single scan, and a flip during that scan queues one more.
-    let rosterPushQueued = false;
-    acp.onRosterChanged(() => {
-        if (rosterPushQueued)
+        });
+        removal = new RegistrationRemovalController({ store, device, generation });
+        const finishInitialization = device.beginMembershipMutation();
+        try {
+            await device.reconcile();
+        }
+        finally {
+            finishInitialization();
+        }
+        let legacyLease;
+        if (legacyBridge) {
+            legacyLease = device.acquireMaintenance({ transactionId: legacyBridge.commandId });
+            await legacyLease.ready;
+        }
+        if (bootstrap && (bootstrap.transaction.phase === 'RESTARTING' || bootstrap.transaction.installedRollback && bootstrap.transaction.recoveryRequired)) {
+            recoveryLease = device.acquireMaintenance({ transactionId: bootstrap.transaction.transactionId });
+            await recoveryLease.ready;
+        }
+        const rdSource = async () => (await readRdState(directory))?.artifactSource ?? services.rdSource?.();
+        let pinnedRdSource;
+        rdUpkeep = new RdUpkeep({ device,
+            adopt: async () => { pinnedRdSource = await rdSource(); if (pinnedRdSource)
+                await adoptBundledRd(directory, pinnedRdSource); },
+            synchronize: async () => pinnedRdSource ? synchronizeRd(directory, pinnedRdSource, { deferActivation: true }) : undefined,
+            whenIdle: async (operation) => { await operation(); return true; }, refresh: () => services.publishToolState?.(), log: message => console.warn(message),
+        });
+        const tickRd = async () => { if (process.platform === 'linux' && await rdSource())
+            await rdUpkeep.tick(); };
+        await tickRd();
+        fullyInitialized = true;
+        initialized();
+        if (stopping)
+            await stopping.catch(() => { });
+        if (shutdown.signal.aborted)
             return;
-        rosterPushQueued = true;
-        void Promise.resolve().then(async () => {
-            rosterPushQueued = false;
-            bridges = await scanRoster();
-            management.pushRoster(bridges);
-        }).catch((error) => {
-            console.warn(`[acp-builds] roster push after capability change failed: ${String(error)}`);
+        stopRdPoll = startExclusivePoll(tickRd, 30_000);
+        const recoveryTick = createDeviceRecoveryTick({ root: directory, startup: startupPackage, generation, bootstrap, signal: shutdown.signal,
+            initialized: () => fullyInitialized, lease: () => recoveryLease,
+            released: original => { if (recoveryLease === original)
+                recoveryLease = undefined; }, reconcile: () => device.reconcile(),
         });
-    });
-    supervisor = new ConnectionSupervisor({
-        management, computer, agent,
-        // Timestamped here rather than inside the supervisor: the daemon owns this log's shape. The
-        // stamp is not decoration -- when the 2026-09-03 outage was diagnosed, the moment the tunnel
-        // died had to be recovered from the log *file's* mtime, because not one line carried a time.
-        log: (message) => console.log(`${new Date().toISOString()} ${message}`),
-    });
-    const stopIdleSweep = startIdleSweep(agents);
-    const stopSwitchUpkeep = startSwitchUpkeep(agents, acp);
-    localState.snapshot = async () => {
-        const channels = supervisor.channelSnapshot();
-        const active = await buildManagementSnapshot(supervisor, tasks, updates);
-        const keepers = await buildKeeperStatuses(keeperPolicy, () => tasks.countedKeeperExecs);
-        const sum = (key) => keepers?.reduce((n, k) => n + (k.metrics[key] ?? 0), 0) ?? 0;
-        return { ...stoppedRuntime(), connection: channels.management === 'CONNECTED' ? 'online' : 'reconnecting',
-            activity: keepers === null ? null : { commands: Math.max(0, active.activeShellTasks + sum('execRunning') - sum('execCounted')), terminals: sum('ptyOpen'), agents: active.activeAgentTasks + sum('sessions'), transfers: 0 } };
-    };
-    const stop = () => shutdown.abort();
-    process.once('SIGINT', stop);
-    process.once('SIGTERM', stop);
-    try {
-        await supervisor.run(shutdown.signal);
+        stopPoll = startExclusivePoll(async () => {
+            if (legacyLease && await releaseLegacyBridge(directory, startupPackage, generation, complete => legacyLease.release(complete))) {
+                legacyLease = undefined;
+                legacyStartupHeld = false;
+                await device.reconcile();
+            }
+            await recoveryTick();
+        }, 2_000);
+        if (!shutdown.signal.aborted)
+            await new Promise(resolve => shutdown.signal.addEventListener('abort', () => resolve(), { once: true }));
+    }
+    catch (error) {
+        initializationFailed(error);
+        throw error;
     }
     finally {
-        stopRdUpkeep();
-        rdUpkeep?.stop();
-        await desktopSupervisor?.close();
-        process.removeListener('SIGINT', stop);
-        process.removeListener('SIGTERM', stop);
-        stopIdleSweep();
-        stopSwitchUpkeep();
-        metrics.stop();
-        toolchain.stop();
-        stopRootsPoll();
-        stopLegacyPoll();
-        stopKeeperPolicy();
-        stopSocketTouch();
-        terminalKeepers.disconnect(); // only the connections: keeper-terminal and its PTYs outlive the daemon
-        // keeper-hosted sessions are detached (head checkpoint, adapter untouched, no failed turn); the others checkpoint (spec §5.5.5)
-        await agents.detachAll();
-        acp.closeTransports(); // keeper-acp's adapters outlive the daemon; local-fallback adapters die with it (spec §5.7)
-        // Bounded: a graceful host shutdown, then SIGKILL (a hung IO cannot hold the daemon's exit).
-        await filesHost.stop();
+        stopRdPoll();
+        stopPoll();
+        process.removeListener('SIGINT', signalStop);
+        process.removeListener('SIGTERM', signalStop);
+        process.removeListener('unhandledRejection', rejection);
+        try {
+            await rdUpkeep?.stop();
+        }
+        finally {
+            try {
+                await device?.stop('detach');
+            }
+            finally {
+                try {
+                    await services.stop();
+                }
+                finally {
+                    await host.close();
+                }
+            }
+        }
     }
 }