@timurproko/a1 0.1.0 → 0.1.1-dev.10

package/dist/src/foundation/process-containment/windows-process-inspector.js

@@ -0,0 +1,53 @@
+import { execFile } from "node:child_process";
+export class WindowsNativeProcessInspector {
+    helperPath;
+    runner;
+    constructor(helperPath, runner = defaultRunner) {
+        this.helperPath = helperPath;
+        this.runner = runner;
+        if (!helperPath || helperPath.includes("\0"))
+            throw new TypeError("process guardian helper path is invalid");
+    }
+    async observe(pid) {
+        if (!Number.isSafeInteger(pid) || pid <= 0)
+            throw new TypeError("inspected PID must be a positive safe integer");
+        const result = await this.runner.run(this.helperPath, ["--inspect-pid", String(pid)]);
+        if (result.exitCode === 3)
+            return null;
+        if (result.exitCode !== 0) {
+            const detail = result.stderr.trim() || `helper exited ${result.exitCode}`;
+            throw Object.assign(new Error(`cannot inspect native process identity: ${detail}`), { code: "PROCESS_INSPECTION_FAILED" });
+        }
+        let value;
+        try {
+            value = JSON.parse(result.stdout);
+        }
+        catch {
+            throw Object.assign(new Error("process guardian returned malformed identity data"), { code: "PROCESS_INSPECTION_INVALID" });
+        }
+        if (!isIdentity(value) || value.pid !== pid || !value.startIdentity.startsWith("windows-filetime:")) {
+            throw Object.assign(new Error("process guardian returned mismatched identity data"), { code: "PROCESS_INSPECTION_INVALID" });
+        }
+        return value;
+    }
+    async matches(identity) {
+        const observed = await this.observe(identity.pid);
+        return observed !== null && observed.startIdentity === identity.startIdentity;
+    }
+}
+const defaultRunner = {
+    async run(executable, arguments_) {
+        return await new Promise(resolvePromise => {
+            execFile(executable, [...arguments_], { windowsHide: true, timeout: 2_000, maxBuffer: 8 * 1_024 }, (error, stdout, stderr) => {
+                const exitCode = error && "code" in error && typeof error.code === "number" ? error.code : error ? 1 : 0;
+                resolvePromise({ exitCode, stdout, stderr });
+            });
+        });
+    },
+};
+function isIdentity(value) {
+    return typeof value === "object" && value !== null
+        && "pid" in value && Number.isSafeInteger(value.pid) && Number(value.pid) > 0
+        && "startIdentity" in value && typeof value.startIdentity === "string"
+        && value.startIdentity.length > 0 && value.startIdentity.length <= 512 && !value.startIdentity.includes("\0");
+}

package/dist/src/foundation/protocol/client.d.ts

@@ -1,7 +1,8 @@
 import { EventEmitter } from "node:events";
-import type { CommandResult, SupervisorCommand, SupervisorSnapshot } from "../lifecycle/index.js";
+import type { CommandResult, LaunchInstanceStopIntent, SupervisorCommand, SupervisorSnapshot } from "../lifecycle/index.js";
 interface ClientEvents {
     snapshot: [SupervisorSnapshot];
+    stopIntent: [LaunchInstanceStopIntent];
     disconnect: [];
 }
 export declare class SupervisorClient extends EventEmitter<ClientEvents> {
@@ -14,4 +15,3 @@ export declare class SupervisorClient extends EventEmitter<ClientEvents> {
     close(): void;
 }
 export {};
-//# sourceMappingURL=client.d.ts.map

package/dist/src/foundation/protocol/client.js

@@ -91,6 +91,9 @@ export class SupervisorClient extends EventEmitter {
                                 pending.resolve(message.result);
                             }
                         }
+                        else if (message.type === "stop-launch-instance" && message.instanceId && message.requestId && message.reason) {
+                            this.emit("stopIntent", message);
+                        }
                         else if (message.type === "protocol-error") {
                             fail(new Error(message.message ?? "protocol error"));
                         }
@@ -124,4 +127,3 @@ function isTransientEndpointError(error) {
 function transientError(message, code) {
     return Object.assign(new Error(message), { code });
 }
-//# sourceMappingURL=client.js.map

package/dist/src/foundation/protocol/index.d.ts

@@ -1,3 +1,2 @@
 export * from "./client.js";
 export * from "./messages.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/src/foundation/protocol/index.js

@@ -1,3 +1,2 @@
 export * from "./client.js";
 export * from "./messages.js";
-//# sourceMappingURL=index.js.map

package/dist/src/foundation/protocol/messages.d.ts

@@ -1,7 +1,7 @@
-import type { CommandResult, SupervisorCommand, SupervisorSnapshot } from "../lifecycle/index.js";
-export declare const CONTROL_ENVELOPE: "addone-control-envelope";
+import type { CommandResult, LaunchInstanceStopIntent, SupervisorCommand, SupervisorSnapshot } from "../lifecycle/index.js";
+export declare const CONTROL_ENVELOPE: string;
 export declare const CONTROL_ENVELOPE_REVISION: 1;
-export declare const REQUIRED_CONTROL_FEATURES: readonly ["handshake.features.v1", "snapshot.revision.v1", "commands.request-identity.v1", "generation.lifecycle.v1", "terminal.foreground-lease.v1"];
+export declare const REQUIRED_CONTROL_FEATURES: readonly ["handshake.features.v1", "snapshot.revision.v1", "commands.request-identity.v1", "generation.lifecycle.v1", "launch.instance-lifecycle.v1"];
 export declare const OPTIONAL_CONTROL_FEATURES: readonly ["messages.unknown-additive-ignore.v1", "snapshot.resynchronize.v1"];
 export type ControlFeature = string;
 export declare const GENERATED_CONTRACT_DIGEST: string;
@@ -41,12 +41,12 @@ export type ServerMessage = {
     readonly type: "release-ownership-result";
     readonly released: boolean;
     readonly reason: string;
-    readonly liveGenerationIds: readonly string[];
+    readonly liveInstanceIds: readonly string[];
 } | {
     readonly type: "release-update-result";
     readonly accepted: boolean;
     readonly reason: string;
-    readonly liveGenerationIds: readonly string[];
+    readonly liveInstanceIds: readonly string[];
 } | ({
     readonly type: "server-hello";
     readonly supervisorId: string;
@@ -60,7 +60,7 @@ export type ServerMessage = {
 } | {
     readonly type: "command-result";
     readonly result: CommandResult;
-} | {
+} | LaunchInstanceStopIntent | {
     readonly type: "protocol-error";
     readonly code: string;
     readonly message: string;
@@ -87,4 +87,3 @@ export declare function isControlHello(value: unknown): value is {
 export declare function isCommandMessage(value: unknown): value is Extract<ClientMessage, {
     type: "command";
 }>;
-//# sourceMappingURL=messages.d.ts.map

package/dist/src/foundation/protocol/messages.js

@@ -1,12 +1,13 @@
 import { createHash } from "node:crypto";
-export const CONTROL_ENVELOPE = "addone-control-envelope";
+import { PRODUCT_IDENTITY } from "../../product-identity.js";
+export const CONTROL_ENVELOPE = PRODUCT_IDENTITY.protocol.controlEnvelope;
 export const CONTROL_ENVELOPE_REVISION = 1;
 export const REQUIRED_CONTROL_FEATURES = [
     "handshake.features.v1",
     "snapshot.revision.v1",
     "commands.request-identity.v1",
     "generation.lifecycle.v1",
-    "terminal.foreground-lease.v1",
+    "launch.instance-lifecycle.v1",
 ];
 export const OPTIONAL_CONTROL_FEATURES = [
     "messages.unknown-additive-ignore.v1",
@@ -96,4 +97,3 @@ function isRecord(value) {
 function isStringArray(value) {
     return Array.isArray(value) && value.every(item => typeof item === "string" && item.length > 0);
 }
-//# sourceMappingURL=messages.js.map

package/dist/src/foundation/release/bootstrap.d.ts

@@ -2,7 +2,7 @@ import { type OwnershipProbe } from "./cohort-selection.js";
 import { type SupervisorEndpointMetadata } from "./cohort-state.js";
 import { type LaunchProfileId } from "../lifecycle/index.js";
 import { cleanupProvenIdleOwner } from "./process-cleanup.js";
-import { type MaterializedRelease } from "./release-store.js";
+import { type MaterializedRelease, type VerifyMaterializedReleaseOptions } from "./release-store.js";
 export interface BootstrapOptions {
     readonly packageRoot: string;
     readonly launchIntent?: {
@@ -15,7 +15,7 @@ export interface BootstrapOptions {
     readonly output?: Pick<NodeJS.WriteStream, "write">;
 }
 export declare function runBootstrap(options: BootstrapOptions): Promise<number>;
-export declare function certifyMaterializedRelease(release: MaterializedRelease, dataDir: string): Promise<string>;
+export declare function certifyMaterializedRelease(release: MaterializedRelease, dataDir: string, verification?: VerifyMaterializedReleaseOptions): Promise<string>;
 export declare function startSupervisor(release: MaterializedRelease, environment: NodeJS.ProcessEnv): Promise<void>;
 export declare function releaseEnvironment(environment: NodeJS.ProcessEnv, release: MaterializedRelease): NodeJS.ProcessEnv;
 export declare function waitForVerifiedEndpoint(path: string, release: MaterializedRelease, timeoutMs: number): Promise<void>;
@@ -27,4 +27,3 @@ export declare function releaseVerifiedIdleOwner(metadata: SupervisorEndpointMet
 }): Promise<boolean>;
 export declare function waitForProcessExit(pid: number, timeoutMs: number): Promise<void>;
 export declare function removeEndpointArtifacts(metadataPath: string, endpoint: string): Promise<void>;
-//# sourceMappingURL=bootstrap.d.ts.map

package/dist/src/foundation/release/bootstrap.js

@@ -5,41 +5,65 @@ import { platform } from "node:os";
 import { resolve } from "node:path";
 import { selectCohortLaunch } from "./cohort-selection.js";
 import { CohortStateStore } from "./cohort-state.js";
-import { assertLaunchProfileId, resolveAddOnePaths } from "../lifecycle/index.js";
+import { assertLaunchProfileId, resolveProductPaths } from "../lifecycle/index.js";
 import { encodeFrame, LineFrameDecoder } from "../protocol/index.js";
 import { cleanupProvenIdleOwner, processIsAlive } from "./process-cleanup.js";
-import { materializeRelease, readMaterializedRelease, resolveReleaseEntryPoint, verifyMaterializedRelease } from "./release-store.js";
+import { consumeMaterializationProof, materializeRelease, readCertifiedReleaseManifest, readMaterializedRelease, resolveReleaseEntryPoint, verifyMaterializedRelease } from "./release-store.js";
+import { PRODUCT_IDENTITY, PRODUCT_TEXT } from "../../product-identity.js";
 export async function runBootstrap(options) {
     const environment = { ...(options.environment ?? process.env) };
-    const launchProfileId = options.launchIntent?.profile.id ?? "addone";
+    const launchProfileId = options.launchIntent?.profile.id ?? "a1";
     assertLaunchProfileId(launchProfileId);
-    environment.ADDONE_LAUNCH_PROFILE = launchProfileId;
+    environment[PRODUCT_IDENTITY.environment.launchProfile] = launchProfileId;
     const output = options.output ?? process.stderr;
-    const paths = resolveAddOnePaths(environment);
+    const paths = resolveProductPaths(environment);
     await mkdir(paths.runtimeDir, { recursive: true, mode: 0o700 });
-    const candidate = await materializeRelease(options.packageRoot, paths.dataDir);
     const stateStore = new CohortStateStore(paths.dataDir);
-    await stateStore.recordCandidate(candidate);
     let state = await stateStore.read();
+    let endpoint = await readEndpointMetadata(paths.endpointMetadataPath);
+    let probe = endpoint ? await probeOwnership(endpoint) : "dead";
+    const installedVersion = await readInstalledVersion(options.packageRoot);
+    const activeId = state.references.active;
+    const active = activeId === null ? undefined : state.releases[activeId];
+    if (active?.approval === "approved" && active.packageVersion === installedVersion) {
+        const endpointMatches = endpoint?.releaseId === active.releaseId
+            && endpoint.releaseRoot === active.releaseRoot
+            && endpoint.contentDigest === active.contentDigest;
+        if (endpointMatches && probe === "live-verified") {
+            const retained = await readCertifiedReleaseManifest(active, resolve(paths.dataDir, "releases"));
+            return await launchUi(retained, environment);
+        }
+        if (endpoint === null || probe === "dead") {
+            if (endpoint)
+                await removeEndpointArtifacts(paths.endpointMetadataPath, paths.endpoint);
+            const retained = await readMaterializedRelease(active.releaseRoot);
+            await startSupervisor(retained, environment);
+            await waitForVerifiedEndpoint(paths.endpointMetadataPath, retained, 8_000);
+            return await launchUi(retained, environment);
+        }
+    }
+    const candidate = await materializeRelease(options.packageRoot, paths.dataDir);
+    await stateStore.recordCandidate(candidate);
+    state = await stateStore.read();
     if (!state.references.active) {
         const diagnosticsPath = await certifyMaterializedRelease(candidate, paths.dataDir);
         await stateStore.approve(candidate.releaseId, diagnosticsPath);
         await stateStore.activate(candidate.releaseId);
         state = await stateStore.read();
     }
-    const endpoint = await readEndpointMetadata(paths.endpointMetadataPath);
-    const probe = endpoint ? await probeOwnership(endpoint) : "dead";
+    endpoint = await readEndpointMetadata(paths.endpointMetadataPath);
+    probe = endpoint ? await probeOwnership(endpoint) : "dead";
     let decision = selectCohortLaunch(candidate, state, endpoint, probe);
     if (decision.action === "blocked") {
-        await stateStore.blockPending(decision.reason, endpoint?.ownership.liveGenerationIds ?? []);
-        output.write(`AddOne startup is blocked to preserve uncertain live ownership: ${decision.reason}\n`);
+        await stateStore.blockPending(decision.reason, endpoint?.ownership.liveInstanceIds ?? []);
+        output.write(`${PRODUCT_TEXT.diagnostic(`startup is blocked to preserve uncertain live ownership: ${decision.reason}`)}\n`);
         return 1;
     }
     if (decision.action === "clean-stale-owner" && endpoint) {
         const diagnostics = await cleanupProvenIdleOwner(endpoint);
         await writeFile(resolve(paths.dataDir, `cleanup-${Date.now()}.json`), JSON.stringify(diagnostics, null, 2));
         if (!diagnostics.terminated)
-            throw new Error(`could not safely clean stale AddOne supervisor ${endpoint.pid}`);
+            throw new Error(`could not safely clean stale ${PRODUCT_TEXT.displayName} supervisor ${endpoint.pid}`);
         await removeEndpointArtifacts(paths.endpointMetadataPath, paths.endpoint);
         decision = selectCohortLaunch(candidate, await stateStore.read(), null, "dead");
     }
@@ -49,7 +73,7 @@ export async function runBootstrap(options) {
     if (decision.action === "launch-retained-ui") {
         const retained = await verifyMaterializedRelease(decision.releaseRoot, undefined, resolve(paths.dataDir, "releases"));
         if (decision.recordPending && endpoint) {
-            await stateStore.blockPending("candidate activation deferred by live non-resumable generations", endpoint.ownership.nonResumableGenerationIds);
+            await stateStore.blockPending("candidate activation deferred by live non-resumable instances", endpoint.ownership.nonResumableInstanceIds);
         }
         const code = await launchUi(retained, environment);
         if (decision.recordPending)
@@ -61,13 +85,13 @@ export async function runBootstrap(options) {
         await stateStore.approve(candidate.releaseId, diagnosticsPath);
         const released = await requestIdleOwnershipRelease(endpoint, candidate.releaseId, 2_000);
         if (!released) {
-            await stateStore.blockPending("idle supervisor did not verify ownership release", endpoint.ownership.liveGenerationIds);
-            output.write("AddOne could not verify idle cohort ownership release; the retained release remains selected.\n");
+            await stateStore.blockPending("idle supervisor did not verify ownership release", endpoint.ownership.liveInstanceIds);
+            output.write(`${PRODUCT_TEXT.diagnostic("could not verify idle cohort ownership release; the retained release remains selected.")}\n`);
             return 1;
         }
         if (!await releaseVerifiedIdleOwner(endpoint, paths.dataDir)) {
-            await stateStore.blockPending("idle supervisor acknowledged release but did not terminate", endpoint.ownership.liveGenerationIds);
-            output.write("AddOne could not complete bounded idle cohort shutdown; the candidate remains pending.\n");
+            await stateStore.blockPending("idle supervisor acknowledged release but did not terminate", endpoint.ownership.liveInstanceIds);
+            output.write(`${PRODUCT_TEXT.diagnostic("could not complete bounded idle cohort shutdown; the candidate remains pending.")}\n`);
             return 1;
         }
         await removeEndpointArtifacts(paths.endpointMetadataPath, paths.endpoint);
@@ -92,10 +116,20 @@ export async function runBootstrap(options) {
     await waitForVerifiedEndpoint(paths.endpointMetadataPath, selected, 8_000);
     return await launchUi(selected, environment);
 }
-export async function certifyMaterializedRelease(release, dataDir) {
-    await verifyMaterializedRelease(release.releaseRoot, release, resolve(dataDir, "releases"));
+async function readInstalledVersion(packageRoot) {
+    const manifest = JSON.parse(await readFile(resolve(packageRoot, "package.json"), "utf8"));
+    if (typeof manifest.version !== "string" || manifest.version.length === 0) {
+        throw new Error(PRODUCT_TEXT.diagnostic("package metadata has no version"));
+    }
+    return manifest.version;
+}
+export async function certifyMaterializedRelease(release, dataDir, verification = {}) {
+    if (!consumeMaterializationProof(release)) {
+        await verifyMaterializedRelease(release.releaseRoot, release, resolve(dataDir, "releases"), verification);
+    }
     const path = resolve(dataDir, `certification-${release.releaseId}.json`);
     await writeFile(path, JSON.stringify({
+        schema: PRODUCT_IDENTITY.evidence.releaseCertificationSchema,
         releaseId: release.releaseId,
         contentDigest: release.contentDigest,
         verifiedAt: new Date().toISOString(),
@@ -104,7 +138,7 @@ export async function certifyMaterializedRelease(release, dataDir) {
     return path;
 }
 export async function startSupervisor(release, environment) {
-    const entry = await resolveReleaseEntryPoint(release, "bin/addone-supervisor.js");
+    const entry = await resolveReleaseEntryPoint(release, "bin/supervisor.js");
     const child = spawn(process.execPath, [entry], {
         detached: true,
         env: releaseEnvironment(environment, release),
@@ -118,7 +152,7 @@ export async function startSupervisor(release, environment) {
     child.unref();
 }
 async function launchUi(release, environment) {
-    const entry = await resolveReleaseEntryPoint(release, "bin/addone-ui.js");
+    const entry = await resolveReleaseEntryPoint(release, "bin/guardian.js");
     return await new Promise((resolvePromise, rejectPromise) => {
         const child = spawn(process.execPath, [entry], {
             env: releaseEnvironment(environment, release),
@@ -132,9 +166,9 @@ async function launchUi(release, environment) {
 export function releaseEnvironment(environment, release) {
     return {
         ...environment,
-        ADDONE_RELEASE_ID: release.releaseId,
-        ADDONE_RELEASE_ROOT: release.releaseRoot,
-        ADDONE_RELEASE_DIGEST: release.contentDigest,
+        [PRODUCT_IDENTITY.environment.releaseId]: release.releaseId,
+        [PRODUCT_IDENTITY.environment.releaseRoot]: release.releaseRoot,
+        [PRODUCT_IDENTITY.environment.releaseDigest]: release.contentDigest,
     };
 }
 export async function waitForVerifiedEndpoint(path, release, timeoutMs) {
@@ -145,18 +179,34 @@ export async function waitForVerifiedEndpoint(path, release, timeoutMs) {
             return;
         await new Promise(resolvePromise => setTimeout(resolvePromise, 40));
     }
-    throw new Error(`AddOne supervisor did not publish verified endpoint metadata within ${timeoutMs}ms`);
+    throw new Error(PRODUCT_TEXT.diagnostic(`supervisor did not publish verified endpoint metadata within ${timeoutMs}ms`));
 }
 export async function readEndpointMetadata(path) {
     try {
         const value = JSON.parse(await readFile(path, "utf8"));
-        if (!value || typeof value.supervisorId !== "string" || typeof value.endpoint !== "string" || !Number.isSafeInteger(value.pid)
+        const ownership = value.ownership;
+        const liveInstanceIds = Array.isArray(ownership?.liveInstanceIds)
+            ? ownership.liveInstanceIds
+            : Array.isArray(ownership?.liveGenerationIds) ? ownership.liveGenerationIds : null;
+        const nonResumableInstanceIds = Array.isArray(ownership?.nonResumableInstanceIds)
+            ? ownership.nonResumableInstanceIds
+            : Array.isArray(ownership?.nonResumableGenerationIds) ? ownership.nonResumableGenerationIds : null;
+        const uncertainInstanceIds = Array.isArray(ownership?.uncertainInstanceIds) ? ownership.uncertainInstanceIds : [];
+        if (!value || value.schema !== PRODUCT_IDENTITY.protocol.supervisorSchema || typeof value.supervisorId !== "string" || typeof value.endpoint !== "string" || !Number.isSafeInteger(value.pid)
             || typeof value.pidStartIdentity !== "string" || typeof value.bootNonce !== "string" || typeof value.releaseId !== "string"
-            || typeof value.releaseRoot !== "string" || typeof value.contentDigest !== "string" || !value.ownership
-            || !Array.isArray(value.ownership.liveGenerationIds) || !Array.isArray(value.ownership.nonResumableGenerationIds)) {
+            || typeof value.releaseRoot !== "string" || typeof value.contentDigest !== "string" || !ownership
+            || !isStringArray(liveInstanceIds) || !isStringArray(nonResumableInstanceIds) || !isStringArray(uncertainInstanceIds)) {
             return null;
         }
-        return value;
+        return {
+            ...value,
+            ownership: {
+                ...ownership,
+                liveInstanceIds,
+                nonResumableInstanceIds,
+                uncertainInstanceIds,
+            },
+        };
     }
     catch {
         return null;
@@ -209,11 +259,11 @@ async function activatePendingAfterBlockerExit(candidate, stateStore, paths, env
     let endpoint = null;
     while (Date.now() < deadline) {
         endpoint = await readEndpointMetadata(paths.endpointMetadataPath);
-        if (!endpoint || endpoint.ownership.liveGenerationIds.length === 0)
+        if (!endpoint || endpoint.ownership.liveInstanceIds.length === 0)
             break;
         await new Promise(resolvePromise => setTimeout(resolvePromise, 40));
     }
-    if (!endpoint || endpoint.ownership.liveGenerationIds.length > 0 || await probeOwnership(endpoint) !== "live-verified")
+    if (!endpoint || endpoint.ownership.liveInstanceIds.length > 0 || await probeOwnership(endpoint) !== "live-verified")
         return;
     const diagnosticsPath = await certifyMaterializedRelease(candidate, paths.dataDir);
     await stateStore.approve(candidate.releaseId, diagnosticsPath);
@@ -266,6 +316,9 @@ async function requestIdleOwnershipRelease(metadata, candidateReleaseId, timeout
         setTimeout(() => finish(false), timeoutMs).unref();
     });
 }
+function isStringArray(value) {
+    return Array.isArray(value) && value.every(item => typeof item === "string" && item.length > 0);
+}
 export async function waitForProcessExit(pid, timeoutMs) {
     const deadline = Date.now() + timeoutMs;
     while (Date.now() < deadline) {
@@ -273,11 +326,10 @@ export async function waitForProcessExit(pid, timeoutMs) {
             return;
         await new Promise(resolvePromise => setTimeout(resolvePromise, 25));
     }
-    throw new Error(`AddOne supervisor ${pid} did not release process ownership within ${timeoutMs}ms`);
+    throw new Error(PRODUCT_TEXT.diagnostic(`supervisor ${pid} did not release process ownership within ${timeoutMs}ms`));
 }
 export async function removeEndpointArtifacts(metadataPath, endpoint) {
     await rm(metadataPath, { force: true });
     if (platform() !== "win32")
         await rm(endpoint, { force: true });
 }
-//# sourceMappingURL=bootstrap.js.map

package/dist/src/foundation/release/cohort-selection.d.ts

@@ -37,4 +37,3 @@ export type CohortLaunchDecision = {
     readonly pid: number | null;
 };
 export declare function selectCohortLaunch(candidate: MaterializedRelease, state: CohortState, endpoint: SupervisorEndpointMetadata | null, probe: OwnershipProbe): CohortLaunchDecision;
-//# sourceMappingURL=cohort-selection.d.ts.map

package/dist/src/foundation/release/cohort-selection.js

@@ -10,7 +10,7 @@ export function selectCohortLaunch(candidate, state, endpoint, probe) {
                 pid: endpoint.pid,
             };
         }
-        if (endpoint.releaseId !== candidate.releaseId && endpoint.ownership.liveGenerationIds.length === 0) {
+        if (endpoint.releaseId !== candidate.releaseId && endpoint.ownership.liveInstanceIds.length === 0) {
             return {
                 action: "replace-idle-cohort",
                 releaseId: candidate.releaseId,
@@ -30,12 +30,12 @@ export function selectCohortLaunch(candidate, state, endpoint, probe) {
         };
     }
     if (endpoint && probe === "unresponsive") {
-        if (endpoint.ownership.liveGenerationIds.length > 0 || endpoint.ownership.nonResumableGenerationIds.length > 0) {
+        if (endpoint.ownership.liveInstanceIds.length > 0 || endpoint.ownership.nonResumableInstanceIds.length > 0) {
             return {
                 action: "blocked",
                 releaseId: endpoint.releaseId,
                 releaseRoot: endpoint.releaseRoot,
-                reason: "ownership of live generations is uncertain; preserving the unresponsive supervisor",
+                reason: "ownership of live launch instances is uncertain; preserving the unresponsive supervisor",
                 pid: endpoint.pid,
             };
         }
@@ -73,4 +73,3 @@ export function selectCohortLaunch(candidate, state, endpoint, probe) {
         reason: "candidate is not approved; retaining the active release",
     };
 }
-//# sourceMappingURL=cohort-selection.js.map

package/dist/src/foundation/release/cohort-state.d.ts

@@ -1,4 +1,5 @@
 import type { MaterializedRelease } from "./release-store.js";
+export declare const RELEASE_COHORT_SCHEMA: string;
 export type ReleaseApproval = "candidate" | "approved" | "rejected";
 export interface ReleaseRecord {
     readonly releaseId: string;
@@ -18,7 +19,7 @@ export interface ReleaseReferences {
     readonly retention: readonly string[];
 }
 export interface CohortState {
-    readonly schemaVersion: 1;
+    readonly schema: typeof RELEASE_COHORT_SCHEMA;
     readonly revision: number;
     readonly releases: Readonly<Record<string, ReleaseRecord>>;
     readonly references: ReleaseReferences;
@@ -31,10 +32,12 @@ export interface CohortState {
 }
 export interface EndpointOwnership {
     readonly state: "idle" | "busy" | "draining" | "released" | "blocked";
-    readonly liveGenerationIds: readonly string[];
-    readonly nonResumableGenerationIds: readonly string[];
+    readonly liveInstanceIds: readonly string[];
+    readonly nonResumableInstanceIds: readonly string[];
+    readonly uncertainInstanceIds: readonly string[];
 }
 export interface SupervisorEndpointMetadata {
+    readonly schema: string;
     readonly supervisorId: string;
     readonly endpoint: string;
     readonly pid: number;
@@ -65,4 +68,3 @@ export declare class CohortStateStore {
     removeUnreferencedRelease(releaseId: string, externalReferences: readonly string[]): Promise<CohortState>;
 }
 export declare function emptyState(): CohortState;
-//# sourceMappingURL=cohort-state.d.ts.map

package/dist/src/foundation/release/cohort-state.js

@@ -1,6 +1,8 @@
 import { randomUUID } from "node:crypto";
 import { mkdir, open, readFile, rename, rm } from "node:fs/promises";
 import { dirname, resolve } from "node:path";
+import { PRODUCT_IDENTITY } from "../../product-identity.js";
+export const RELEASE_COHORT_SCHEMA = PRODUCT_IDENTITY.protocol.releaseCohortSchema;
 export class CohortStateStore {
     path;
     constructor(dataDir) {
@@ -153,7 +155,7 @@ export class CohortStateStore {
 }
 export function emptyState() {
     return {
-        schemaVersion: 1,
+        schema: RELEASE_COHORT_SCHEMA,
         revision: 0,
         releases: {},
         references: { active: null, pending: null, approved: null, rollback: null, retention: [] },
@@ -184,7 +186,7 @@ async function acquireLock(path) {
     }
 }
 function validateState(state) {
-    if (state.schemaVersion !== 1 || !Number.isSafeInteger(state.revision) || state.revision < 0)
+    if (state.schema !== RELEASE_COHORT_SCHEMA || !Number.isSafeInteger(state.revision) || state.revision < 0)
         throw new Error("invalid release cohort state");
     for (const reference of [state.references.active, state.references.pending, state.references.approved, state.references.rollback]) {
         if (reference !== null && !state.releases[reference])
@@ -193,9 +195,8 @@ function validateState(state) {
 }
 function validateTransition(current, next) {
     validateState(next);
-    if (next.schemaVersion !== current.schemaVersion)
+    if (next.schema !== current.schema)
         throw new Error("release cohort schema cannot change during a state update");
     if (next.revision !== current.revision)
         throw new Error("release cohort revision is controlled by the state store");
 }
-//# sourceMappingURL=cohort-state.js.map

package/dist/src/foundation/release/concurrency.d.ts

@@ -0,0 +1 @@
+export declare function mapWithConcurrency<Value, Result>(values: readonly Value[], concurrency: number, operation: (value: Value, index: number) => Promise<Result>): Promise<Result[]>;

package/dist/src/foundation/release/concurrency.js

@@ -0,0 +1,17 @@
+export async function mapWithConcurrency(values, concurrency, operation) {
+    if (!Number.isSafeInteger(concurrency) || concurrency < 1)
+        throw new RangeError("concurrency must be a positive safe integer");
+    const results = new Array(values.length);
+    let nextIndex = 0;
+    const worker = async () => {
+        while (true) {
+            const index = nextIndex;
+            nextIndex += 1;
+            if (index >= values.length)
+                return;
+            results[index] = await operation(values[index], index);
+        }
+    };
+    await Promise.all(Array.from({ length: Math.min(concurrency, values.length) }, worker));
+    return results;
+}

package/dist/src/foundation/release/development-preview-release.d.ts

@@ -1,3 +1,4 @@
+export declare const PREVIEW_RELEASE_SCHEMA: string;
 export interface DevelopmentPreviewCandidate {
     readonly version: string;
     readonly requiresVersionCommit: boolean;
@@ -27,7 +28,7 @@ export interface UncertifiedDevelopmentPreviewEvidenceInput {
     readonly recordedAt: string;
 }
 export interface UncertifiedDevelopmentPreviewEvidence extends UncertifiedDevelopmentPreviewEvidenceInput {
-    readonly schema: "addone-development-preview-certification-v2";
+    readonly schema: typeof PREVIEW_RELEASE_SCHEMA;
     readonly channel: "next";
     readonly certificationStatus: "uncertified-development-preview";
     readonly terminalCapability: "owned-ui";
@@ -46,4 +47,3 @@ export declare function selectDevelopmentPreviewCandidate(currentVersion: string
 export declare function publishDevelopmentPreviewWithRecovery(publish: () => Promise<void>, verify: () => Promise<void>): Promise<DevelopmentPreviewPublishResult>;
 export declare function verifyDevelopmentPreviewRegistry(version: string, observe: () => Promise<DevelopmentPreviewRegistryState>, repairNextTag: () => Promise<void>, options?: DevelopmentPreviewVerificationOptions): Promise<void>;
 export declare function developmentPreviewTarballName(packageName: string, version: string): string;
-//# sourceMappingURL=development-preview-release.d.ts.map

package/dist/src/foundation/release/development-preview-release.js

@@ -1,11 +1,13 @@
 import { compare, inc, prerelease, valid } from "semver";
+import { PRODUCT_IDENTITY } from "../../product-identity.js";
+export const PREVIEW_RELEASE_SCHEMA = PRODUCT_IDENTITY.evidence.previewReleaseSchema;
 export function createUncertifiedDevelopmentPreviewEvidence(input) {
     const prereleaseParts = prerelease(input.version);
     if (valid(input.version) === null || prereleaseParts?.[0] !== "dev") {
         throw new Error(`uncertified preview requires a development prerelease: ${input.version}`);
     }
     return {
-        schema: "addone-development-preview-certification-v2",
+        schema: PREVIEW_RELEASE_SCHEMA,
         channel: "next",
         certificationStatus: "uncertified-development-preview",
         terminalCapability: "owned-ui",
@@ -110,4 +112,3 @@ export function developmentPreviewTarballName(packageName, version) {
         throw new Error(`invalid package name: ${packageName}`);
     return `${unscopedName}-${version}.tgz`;
 }
-//# sourceMappingURL=development-preview-release.js.map

package/dist/src/foundation/release/index.d.ts

@@ -9,4 +9,3 @@ export * from "./release-store.js";
 export * from "./stable-release.js";
 export * from "./update.js";
 export * from "./update-transaction.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/src/foundation/release/index.js

@@ -9,4 +9,3 @@ export * from "./release-store.js";
 export * from "./stable-release.js";
 export * from "./update.js";
 export * from "./update-transaction.js";
-//# sourceMappingURL=index.js.map

package/dist/src/foundation/release/process-cleanup.d.ts

@@ -9,7 +9,6 @@ export declare function processIsAlive(pid: number): boolean;
 export declare function cleanupProvenIdleOwner(metadata: SupervisorEndpointMetadata, graceMs?: number): Promise<CleanupDiagnostics>;
 export declare function cleanupVerifiedOwner(metadata: SupervisorEndpointMetadata, options?: {
     readonly graceMs?: number;
-    readonly allowLiveGenerations?: boolean;
+    readonly allowLiveInstances?: boolean;
     readonly reason?: "stale-idle-owner" | "explicit-update" | "legacy-mutable-install";
 }): Promise<CleanupDiagnostics>;
-//# sourceMappingURL=process-cleanup.d.ts.map

package/dist/src/foundation/release/process-cleanup.js

@@ -11,11 +11,11 @@ export function processIsAlive(pid) {
     }
 }
 export async function cleanupProvenIdleOwner(metadata, graceMs = 1_500) {
-    return await cleanupVerifiedOwner(metadata, { graceMs, allowLiveGenerations: false });
+    return await cleanupVerifiedOwner(metadata, { graceMs, allowLiveInstances: false });
 }
 export async function cleanupVerifiedOwner(metadata, options = {}) {
     const graceMs = options.graceMs ?? 1_500;
-    if (!options.allowLiveGenerations && (metadata.ownership.liveGenerationIds.length > 0 || metadata.ownership.nonResumableGenerationIds.length > 0)) {
+    if (!options.allowLiveInstances && (metadata.ownership.liveInstanceIds.length > 0 || metadata.ownership.nonResumableInstanceIds.length > 0)) {
         throw new Error("refusing to terminate an owner with recorded live generations");
     }
     const started = Date.now();
@@ -64,4 +64,3 @@ async function waitUntilDead(pid, timeoutMs) {
     }
     return !processIsAlive(pid);
 }
-//# sourceMappingURL=process-cleanup.js.map

package/dist/src/foundation/release/release-gc.d.ts

@@ -3,4 +3,3 @@ import { CohortStateStore } from "./cohort-state.js";
  * retention, process, agent, or migration reference. State is detached first;
  * a filesystem failure can leave a safe orphan but never a dangling selector. */
 export declare function collectRelease(store: CohortStateStore, dataDir: string, releaseId: string, externalReferences: readonly string[]): Promise<void>;
-//# sourceMappingURL=release-gc.d.ts.map