@quickchatai/quickreview 0.0.0-stage → 1.1.0

package/src/tui/prpause.ts

@@ -0,0 +1,150 @@
+// The operator's per-PR dispatch lever client — `qcr pause-pr` / `qcr resume-pr`.
+//
+// The same narrow channel as the deploy drain and the lesson kill switch
+// (src/tui/deploy-drain.ts, src/tui/lessonswitch.ts): one command file written
+// as root into the root-sealed `commands/operator/` (`docker exec -u 0`,
+// payload on stdin, tmp+mv), then the daemon's own result file read back as the
+// receipt. From that sealed directory a pause is the OPERATOR's: it carries no
+// expiry and stands until resumed (src/levers.ts), and no session can lift it.
+// A file the daemon finds unsealed is served as a session's, which bounds the
+// pause; the result's `issuer` says so and this client reports it — it never
+// infers acceptance from a successful write.
+//
+// The cutover wizard (scripts/cutover.sh stage 9) is the first caller: it
+// pauses every tracked PR but one before it lifts the drain, so the board's
+// first worker round is one PR's, and resumes exactly those PRs afterwards.
+import { randomUUID } from "node:crypto";
+import { validateCommand, type Command } from "../commands.js";
+import type { TuiConfig } from "../config.js";
+import type { SshRunner } from "./remote.js";
+import { commandResultArgv, commandWriteArgv, resultReason } from "./unwedge.js";
+import { resolveLayout } from "./layout.js";
+
+/** The two payloads, read from the daemon's own `Command`. */
+export type PrLeverCommand = Extract<Command, { command: "pause-pr" | "resume-pr" }>;
+
+export interface PrLeverOutcome {
+  ok: boolean;
+  reason?: string;
+  /** Who the daemon decided the writer was. `session` means the operator
+   * directory was not sealed: a pause was bounded like a session's. */
+  issuer?: "operator" | "session";
+  /** The pause's ledger outcome (`unchanged` when it already stood). */
+  outcome?: string;
+  /** When a bounded pause lapses; absent for the operator's until-resumed one. */
+  expires_at?: string;
+}
+
+/** The exact daemon-validated payload; throws on a command the daemon's own
+ * validator would refuse from the operator channel. */
+export function prLeverPayload(cmd: PrLeverCommand): string {
+  const v = validateCommand(cmd, { issuer: "operator" });
+  if (!v.ok) throw new Error(v.reason);
+  return `${JSON.stringify(cmd, null, 2)}\n`;
+}
+
+export function prLeverFileName(now: Date, clientId: string, seq: number): string {
+  const ts = now.toISOString().replace(/[:.]/g, "-");
+  return `${ts}-cli-prlever-${clientId}-${String(seq).padStart(4, "0")}.json`;
+}
+
+export class PrLeverSender {
+  private seq = 0;
+  private readonly clientId = randomUUID().slice(0, 12);
+
+  constructor(
+    private readonly cfg: TuiConfig,
+    private readonly ssh: SshRunner,
+    private readonly now: () => Date = () => new Date(),
+    private readonly sleep: (ms: number) => Promise<void> = (ms) =>
+      new Promise((resolve) => setTimeout(resolve, ms)),
+  ) {}
+
+  async send(cmd: PrLeverCommand): Promise<PrLeverOutcome> {
+    await resolveLayout(this.cfg, this.ssh);
+    let payload: string;
+    try {
+      payload = prLeverPayload(cmd);
+    } catch (err) {
+      return { ok: false, reason: (err as Error).message };
+    }
+    const name = prLeverFileName(this.now(), this.clientId, this.seq++);
+    const write = await this.ssh(this.cfg.ssh_host, commandWriteArgv(this.cfg, name), {
+      stdin: payload,
+    });
+    if (!write.ok)
+      return {
+        ok: false,
+        reason: `command write failed (${write.stderr.trim() || `exit ${write.code}`})`,
+      };
+    const deadline = this.now().getTime() + this.cfg.msg_timeout_s * 1000;
+    while (this.now().getTime() < deadline) {
+      await this.sleep(2000);
+      const probe = await this.ssh(this.cfg.ssh_host, commandResultArgv(this.cfg, name));
+      if (!probe.ok) continue;
+      const body = probe.stdout.trim();
+      if (body === "" || body === "pending") continue;
+      let v: Record<string, unknown>;
+      try {
+        v = JSON.parse(body) as Record<string, unknown>;
+      } catch {
+        // A concurrent reader can see the daemon still writing its receipt.
+        continue;
+      }
+      if (typeof v !== "object" || v === null || Array.isArray(v)) continue;
+      const issuer =
+        v["issuer"] === "operator" || v["issuer"] === "session" ? v["issuer"] : undefined;
+      if (v["ok"] !== true)
+        return {
+          ok: false,
+          reason: resultReason(v["reason"], "no reason given"),
+          ...(issuer ? { issuer } : {}),
+        };
+      // Untrusted like the reason: the result sits in a session-writable dir.
+      const outcome = typeof v["outcome"] === "string" ? resultReason(v["outcome"], "") : "";
+      const expires = typeof v["expires_at"] === "string" ? resultReason(v["expires_at"], "") : "";
+      return {
+        ok: true,
+        ...(issuer ? { issuer } : {}),
+        ...(outcome ? { outcome } : {}),
+        ...(expires ? { expires_at: expires } : {}),
+      };
+    }
+    return { ok: false, reason: "no result before timeout (daemon down?)" };
+  }
+}
+
+/** What the CLI prints for a lever's answer, and its exit code. A pause that
+ * came back bounded (the directory unsealed) is a failure: the operator asked
+ * for a pause that stands until resumed, and a lapsing one would let the PR's
+ * rounds start on their own. */
+export function renderPrLever(
+  cmd: PrLeverCommand,
+  out: PrLeverOutcome,
+): { lines: string[]; code: number } {
+  const pr = `#${cmd.pr}`;
+  if (!out.ok) {
+    const lines = [`✖ ${cmd.command} ${pr} refused: ${out.reason ?? "no reason given"}`];
+    if (out.issuer === "session")
+      lines.push(
+        "  the daemon found commands/operator/ UNSEALED (writable by its own uid), so it served the file as a session's — check the directory is root-owned 0755 in the container",
+      );
+    return { lines, code: 1 };
+  }
+  if (cmd.command === "resume-pr") return { lines: [`✓ ${pr} resumed`], code: 0 };
+  if (out.issuer !== "operator") {
+    return {
+      lines: [
+        `✖ ${pr} paused, but NOT as the operator's: the daemon bounded it like a session's — lapses ${out.expires_at ?? "(unknown)"}`,
+        "  check commands/operator/ is root-owned 0755 in the container (not a symlink), then pause again",
+      ],
+      code: 1,
+    };
+  }
+  return {
+    lines: [
+      `✓ ${pr} ${out.outcome === "unchanged" ? "already paused" : "paused"} by the operator until resumed (qcr resume-pr ${cmd.pr})`,
+    ],
+    code: 0,
+  };
+}

package/src/tui/reload.ts

@@ -0,0 +1,436 @@
+// TUI hot-reload. The TUI re-execs in place when a whole build has landed,
+// restoring tab + selected PR + scroll from a small state file. Three signals
+// say so, and nothing else does:
+//   - the app's dist/, watched recursively. `tsc -b` builds the review core
+//     (packages/pi-plugin) first and the app last, so the app's dist/ changes
+//     only once every project compiled;
+//   - the build stamp (BUILD_STAMP, written by scripts/build-stamp.mjs), for a
+//     core-only change that leaves the app's output alone. Every build route
+//     writes it only after a whole pass succeeded;
+//   - a core change followed by a clean app build info, for the same change
+//     built by a route that writes no stamp (below).
+// The core's own dist/ never reloads by itself. `noEmitOnError` holds per
+// project, so a core edit that breaks the app still rewrites
+// packages/pi-plugin/dist, and even a clean build writes it seconds before the
+// app's: reloading on it would re-exec onto new core code beside old app code.
+//
+// But only the build routes of package.json write the stamp, so a core-only
+// change built by a raw `tsc -b` or an IDE would never reload. For that case
+// the core's dist/ is watched WITHOUT acting: a change there marks a core
+// change pending, and the reload happens once the app's build info
+// (tsconfig.json `tsBuildInfoFile`) is written after that change and records
+// no errors and nothing left to check or emit. `tsc -b` writes the app's
+// build info last, on success and on failure alike, so its contents decide —
+// a half-written file does not parse and a failed build records its errors,
+// and neither reloads.
+//
+// Why this is safe: a failed build touches neither signal (the app does not
+// emit on error, and the stamp follows only a clean pass), so a broken edit
+// leaves the running TUI untouched — the reload path can only be entered by a
+// build that compiled, all of it.
+//
+// Every build reloads, unconditionally — there is no busy/defer check and one
+// must never be added (the hot-reload decision, docs/tui.md). A busy check
+// keyed on `App.isBusy()` would hold a reload exactly while the companion
+// column is focused editing the TUI, and the change would silently never
+// appear. A reload at an awkward moment is visible and recoverable; a reload
+// that never happens is neither. If a surface cannot survive a re-exec, fix
+// that surface — do not add a condition here.
+//
+// The chain stays two processes deep. Node cannot replace its own image, so a
+// re-exec runs the new build as a child and waits for it; done at every
+// reload, each generation would sit frozen inside `spawnSync` under the next,
+// still holding whatever its teardown had not released. So the first process
+// to reload becomes the supervisor: it runs each new build as its child, in a
+// loop, and a child that wants a reload exits with `RELOAD_EXIT_CODE` after
+// its teardown — the supervisor runs the next build beside it, never under
+// it. Depth: the supervisor plus the live TUI, whatever the number of
+// reloads. There is no condition on when a reload fires; only on how it is
+// executed.
+import { spawnSync } from "node:child_process";
+import {
+  mkdirSync,
+  readFileSync,
+  rmSync,
+  statSync,
+  watch as fsWatch,
+  writeFileSync,
+  type FSWatcher,
+} from "node:fs";
+import { basename, dirname, join } from "node:path";
+
+export interface ReloadState {
+  tab: string;
+  /** Selected PR number, when the board had one. */
+  pr?: number;
+  eventsScroll: number;
+  eventsFocus: boolean;
+  /** Expanded companion width, borders included. */
+  sidebarWidth?: number;
+  saved_at: string;
+}
+
+export type WatchFn = (
+  dir: string,
+  opts: { recursive: boolean },
+  cb: (event: string, filename: string | null) => void,
+) => FSWatcher;
+
+/** The build stamp, relative to the checkout: written after a whole build
+ * succeeded (scripts/build-stamp.mjs names the same path). */
+export const BUILD_STAMP = "state/build-complete";
+
+/** The review core's build output, relative to the checkout: watched, never
+ * acted on by itself (see the header). */
+export const CORE_DIST = "packages/pi-plugin/dist";
+
+/** The app project's build info, relative to the checkout — tsconfig.json's
+ * `tsBuildInfoFile`, outside every dist/. */
+export const APP_BUILD_INFO = "node_modules/.cache/qcr-tsbuildinfo";
+
+/**
+ * Does this build info record a whole, clean compile? Only a file that parses
+ * and carries none of tsc's unfinished-business markers: `errors` (a failed
+ * compile), `checkPending`, files still holding or awaiting diagnostics, and
+ * files whose emit is pending or failed. Anything unreadable is not clean.
+ * VERIFY-ON-PIN (typescript 6.0): the markers are tsc's incremental
+ * program's own field names. Re-read on the 6.0.3 bump against fresh build
+ * info: the names are unchanged from 5.9, a clean build writes none of them,
+ * and a failed compile writes `semanticDiagnosticsPerFile` and
+ * `affectedFilesPendingEmit`.
+ */
+export function buildInfoClean(text: string | undefined): boolean {
+  if (text === undefined || text.trim() === "") return false;
+  let info: unknown;
+  try {
+    info = JSON.parse(text);
+  } catch {
+    return false;
+  }
+  if (typeof info !== "object" || info === null || Array.isArray(info)) return false;
+  const o = info as Record<string, unknown>;
+  if (typeof o["version"] !== "string") return false;
+  if (o["errors"] === true || o["checkPending"] === true) return false;
+  const pending = (key: string): boolean => {
+    const v = o[key];
+    return Array.isArray(v) ? v.length > 0 : v !== undefined && v !== null && v !== false;
+  };
+  return ![
+    "semanticDiagnosticsPerFile",
+    "emitDiagnosticsPerFile",
+    "affectedFilesPendingEmit",
+    "changeFileSet",
+    "pendingEmit",
+  ].some(pending);
+}
+
+export interface ReloaderOptions {
+  /** The app's build output, whose mtime tree signals "a new build landed". */
+  distDir: string;
+  /** The build stamp's absolute path: a change to it signals the same, for a
+   * core-only build that leaves `distDir` alone. Its directory is watched,
+   * not recursively, for that one name; a missing directory is skipped, as a
+   * missing `distDir` is. */
+  buildStamp?: string;
+  /** The review core's build output (`CORE_DIST`): watched recursively, and
+   * a change there only marks a core change pending — see the header. Needs
+   * `appBuildInfo`; either missing leaves this route off. */
+  coreDistDir?: string;
+  /** The app's build info (`APP_BUILD_INFO`): its directory is watched for
+   * that one name, and a write newer than the pending core change that
+   * `buildInfoClean` accepts reloads. */
+  appBuildInfo?: string;
+  /** File text, or undefined when unreadable. Injectable for tests. */
+  readText?: (path: string) => string | undefined;
+  /** A file's mtime in ms, or undefined when it is not there. */
+  mtimeMs?: (path: string) => number | undefined;
+  /** Where the pre-re-exec snapshot is written. */
+  stateFile: string;
+  /** Snapshot of what must survive the re-exec. */
+  snapshot: () => ReloadState;
+  /** Perform the re-exec; receives the path the state was persisted to. */
+  reexec: (stateFile: string) => void;
+  debounceMs?: number;
+  watch?: WatchFn;
+  writeState?: (path: string, body: string) => void;
+  now?: () => Date;
+}
+
+const DEBOUNCE_MS = 400;
+
+/** Watches dist/ and re-execs the process when a new build lands. */
+export class HotReloader {
+  private watchers: FSWatcher[] = [];
+  private debounce: NodeJS.Timeout | undefined;
+  private fired = false;
+  /** The newest core change not yet carried by a clean app build (ms), or
+   * undefined when none is pending. */
+  private coreChangedAt: number | undefined;
+  private readonly opts: Required<ReloaderOptions>;
+
+  constructor(opts: ReloaderOptions) {
+    this.opts = {
+      ...opts,
+      buildStamp: opts.buildStamp ?? "",
+      coreDistDir: opts.coreDistDir ?? "",
+      appBuildInfo: opts.appBuildInfo ?? "",
+      readText:
+        opts.readText ??
+        ((path) => {
+          try {
+            return readFileSync(path, "utf8");
+          } catch {
+            return undefined;
+          }
+        }),
+      mtimeMs: opts.mtimeMs ?? ((path) => statSync(path, { throwIfNoEntry: false })?.mtimeMs),
+      debounceMs: opts.debounceMs ?? DEBOUNCE_MS,
+      watch: opts.watch ?? fsWatch,
+      writeState:
+        opts.writeState ??
+        ((path, body) => {
+          mkdirSync(dirname(path), { recursive: true });
+          writeFileSync(path, body);
+        }),
+      now: opts.now ?? (() => new Date()),
+    };
+  }
+
+  start(): void {
+    if (this.watchers.length > 0) return;
+    this.watchOne(this.opts.distDir, true, () => true);
+    const stamp = this.opts.buildStamp;
+    if (stamp) this.watchOne(dirname(stamp), false, (name) => name === basename(stamp));
+    const core = this.opts.coreDistDir;
+    const info = this.opts.appBuildInfo;
+    if (core && info) {
+      this.watchOne(core, true, (name) => {
+        this.noteCoreChange(name);
+        return this.coreBuildLanded();
+      });
+      this.watchOne(
+        dirname(info),
+        false,
+        (name) => name === basename(info) && this.coreBuildLanded(),
+      );
+    }
+  }
+
+  /** A write under the core's dist/: pending until a clean app build after
+   * it. Dated by the file's own mtime, so an event that arrives after the
+   * app's build info was written still counts as before it. */
+  private noteCoreChange(name: string | null): void {
+    const at =
+      (name ? this.opts.mtimeMs(join(this.opts.coreDistDir, name)) : undefined) ??
+      this.opts.now().getTime();
+    this.coreChangedAt = Math.max(this.coreChangedAt ?? at, at);
+  }
+
+  /** A core change is pending, and the app's build info is newer than it and
+   * records a whole, clean build. */
+  private coreBuildLanded(): boolean {
+    if (this.coreChangedAt === undefined) return false;
+    const info = this.opts.appBuildInfo;
+    const written = this.opts.mtimeMs(info);
+    if (written === undefined || written <= this.coreChangedAt) return false;
+    return buildInfoClean(this.opts.readText(info));
+  }
+
+  private watchOne(dir: string, recursive: boolean, counts: (name: string | null) => boolean) {
+    try {
+      this.watchers.push(
+        this.opts.watch(dir, { recursive }, (_event, name) => {
+          if (counts(name)) this.onChange();
+        }),
+      );
+    } catch {
+      // No dist/ (running from source, e.g. vitest or tsx) — hot-reload is a
+      // convenience, never a startup requirement.
+    }
+  }
+
+  stop(): void {
+    for (const w of this.watchers) w.close();
+    this.watchers = [];
+    if (this.debounce) clearTimeout(this.debounce);
+    this.debounce = undefined;
+  }
+
+  private onChange(): void {
+    if (this.fired) return;
+    if (this.debounce) clearTimeout(this.debounce);
+    this.debounce = setTimeout(() => {
+      this.debounce = undefined;
+      this.attempt();
+    }, this.opts.debounceMs);
+  }
+
+  private attempt(): void {
+    if (this.fired) return;
+    this.fired = true;
+    this.stop();
+    const state: ReloadState = { ...this.opts.snapshot(), saved_at: this.opts.now().toISOString() };
+    this.opts.writeState(this.opts.stateFile, `${JSON.stringify(state, null, 2)}\n`);
+    this.opts.reexec(this.opts.stateFile);
+  }
+}
+
+/** The snapshot file name of one TUI process. */
+function resumeStateName(pid: number): string {
+  return `tui-resume-${pid}.json`;
+}
+
+/** Where this process writes its hot-reload snapshot. Per pid, never one
+ * shared name: two TUIs on one install watch the same dist/ and reload within
+ * ms of each other on one tsc emit, so a shared file would let one clobber
+ * the other's view and the first reader consume it. The path reaches the new
+ * build through `--resume-state`, which deletes it on read. */
+export function resumeStatePath(root: string, pid: number = process.pid): string {
+  return join(root, "state", resumeStateName(pid));
+}
+
+/** The snapshot path of process `pid`, beside `file` — how a supervisor finds
+ * the snapshot its child wrote (the child wrote it with `resumeStatePath`
+ * under the same root, so the directory is the supervisor's own). */
+export function resumeStatePathBeside(file: string, pid: number): string {
+  return join(dirname(file), resumeStateName(pid));
+}
+
+/** `--resume-state <path>` out of an argv, plus the argv with it removed. */
+export function parseResumeArg(argv: string[]): { stateFile?: string; rest: string[] } {
+  const i = argv.indexOf("--resume-state");
+  if (i < 0 || argv[i + 1] === undefined)
+    return { rest: argv.filter((a) => a !== "--resume-state") };
+  return { stateFile: argv[i + 1], rest: [...argv.slice(0, i), ...argv.slice(i + 2)] };
+}
+
+/** Reads and consumes a resume file. Unreadable/garbled → undefined (a bad
+ * snapshot must never keep the TUI from starting). */
+export function readResumeState(path: string, remove = true): ReloadState | undefined {
+  let raw: string;
+  try {
+    raw = readFileSync(path, "utf8");
+  } catch {
+    return undefined;
+  }
+  if (remove) {
+    try {
+      rmSync(path);
+    } catch {
+      /* best effort */
+    }
+  }
+  try {
+    const parsed = JSON.parse(raw) as Partial<ReloadState>;
+    return {
+      tab: typeof parsed.tab === "string" ? parsed.tab : "board",
+      pr: typeof parsed.pr === "number" ? parsed.pr : undefined,
+      eventsScroll: typeof parsed.eventsScroll === "number" ? parsed.eventsScroll : 0,
+      eventsFocus: Boolean(parsed.eventsFocus),
+      ...(typeof parsed.sidebarWidth === "number" ? { sidebarWidth: parsed.sidebarWidth } : {}),
+      saved_at: typeof parsed.saved_at === "string" ? parsed.saved_at : "",
+    };
+  } catch {
+    return undefined;
+  }
+}
+
+/** The argv a re-exec should run: same entry point, same flags, one
+ * `--resume-state <file>` (never duplicated across successive reloads). */
+export function reexecArgv(argv: string[], stateFile: string): string[] {
+  const [entry, ...args] = argv;
+  const { rest } = parseResumeArg(args);
+  return [entry!, ...rest, "--resume-state", stateFile];
+}
+
+/** The exit code a supervised TUI uses to say "run the new build". 75 is
+ * EX_TEMPFAIL, "try again" — distinct from every exit the TUI
+ * makes on its own (0 quit, 1 crash, 2 no terminal, 130/143 on a signal). */
+export const RELOAD_EXIT_CODE = 75;
+
+/** Set on every TUI a supervisor runs: the supervisor's pid. A TUI follows the
+ * exit protocol only when that pid is its own parent, so the variable leaking
+ * into something the TUI starts (a shell on the real terminal, the companion)
+ * can never make an unsupervised TUI exit instead of reloading. */
+export const SUPERVISOR_ENV = "QCR_TUI_SUPERVISOR_PID";
+
+/** What the re-exec touches — real process calls in production, fakes in
+ * tests. `argv` is `process.argv.slice(1)`: the entry point, then the flags. */
+export interface ReexecIo {
+  argv: string[];
+  env: NodeJS.ProcessEnv;
+  pid: number;
+  ppid: number;
+  /** Run the build to completion with the terminal inherited. */
+  spawn: (argv: string[], env: NodeJS.ProcessEnv) => { status: number | null; pid?: number };
+  exit: (code: number) => void;
+}
+
+function processIo(): ReexecIo {
+  return {
+    argv: process.argv.slice(1),
+    env: process.env,
+    pid: process.pid,
+    ppid: process.ppid,
+    spawn: (argv, env) => {
+      const res = spawnSync(process.execPath, argv, { stdio: "inherit", env });
+      return { status: res.status, pid: res.pid };
+    },
+    exit: (code) => process.exit(code),
+  };
+}
+
+/** Is this TUI the child of a reload supervisor (and so should EXIT to
+ * reload)? Only when the supervisor named in the env is its parent. */
+export function isSupervised(io: Pick<ReexecIo, "env" | "ppid">): boolean {
+  const raw = io.env[SUPERVISOR_ENV];
+  if (raw === undefined || raw.trim() === "") return false;
+  return Number(raw) === io.ppid;
+}
+
+/**
+ * The supervisor's loop: run the build, and while it exits asking for a
+ * reload, run the next one with the snapshot that child wrote. Returns the
+ * last child's exit code (a signal death counts as 0).
+ * One process deep beneath the supervisor, however many reloads.
+ */
+export function superviseReloads(firstStateFile: string, io: ReexecIo): number {
+  const env = { ...io.env, [SUPERVISOR_ENV]: String(io.pid) };
+  let stateFile = firstStateFile;
+  for (;;) {
+    const res = io.spawn(reexecArgv(io.argv, stateFile), env);
+    if (res.status !== RELOAD_EXIT_CODE || res.pid === undefined) return res.status ?? 0;
+    stateFile = resumeStatePathBeside(stateFile, res.pid);
+  }
+}
+
+/**
+ * Production re-exec. A TUI under a supervisor exits with `RELOAD_EXIT_CODE`
+ * and the supervisor runs the new build; the first TUI to reload becomes the
+ * supervisor, running every later build as its child (see the header), then
+ * exits with the last one's code. spawnSync keeps the terminal on one process
+ * at a time.
+ *
+ * `teardown` is the last code this generation runs. `app.quit()` only resolves
+ * a promise, so `App.teardown()` is a microtask — and the `spawnSync` below
+ * blocks the stack before any microtask can run, which means this process
+ * freezes with its listeners still registered and its event loop stopped for
+ * good. Anything that must happen before that freeze has to happen
+ * synchronously inside `teardown`, and that specifically includes killing
+ * in-flight ssh children: their timeouts live on the loop that is about to
+ * stop (see `killInFlightSsh` in remote.ts).
+ */
+export function realReexec(
+  stateFile: string,
+  teardown?: () => void,
+  io: ReexecIo = processIo(),
+): void {
+  teardown?.();
+  if (isSupervised(io)) {
+    // The snapshot is already on disk (HotReloader wrote it before calling
+    // us); the supervisor finds it by our pid.
+    io.exit(RELOAD_EXIT_CODE);
+    return;
+  }
+  io.exit(superviseReloads(stateFile, io));
+}