@timurproko/a1 0.1.1-dev.1 → 0.1.1-dev.11

package/dist/src/foundation/release/update.js

@@ -40,7 +40,7 @@ export function createNpmProcessRunner(platform = process.platform) {
         } });
     });
 }
-export function createUpdateLifecycleCoordinator(environment = process.env, fileSystem = defaultFileSystem) {
+export function createUpdateLifecycleCoordinator(environment = process.env, fileSystem = defaultFileSystem, output = defaultOutput) {
     const paths = resolveProductPaths(environment);
     const stateStore = new CohortStateStore(paths.dataDir);
     return {
@@ -71,7 +71,7 @@ export function createUpdateLifecycleCoordinator(environment = process.env, file
                 // Explicit update consent permits bounded cleanup of an authenticated
                 // older owner that predates the update-shutdown message.
                 const cleanup = await cleanupVerifiedOwner(endpoint, {
-                    allowLiveGenerations: true,
+                    allowLiveInstances: true,
                     reason: legacyMutableInstall ? "legacy-mutable-install" : "explicit-update",
                 });
                 if (!cleanup.terminated)
@@ -80,7 +80,7 @@ export function createUpdateLifecycleCoordinator(environment = process.env, file
             else if (identity.accepted) {
                 await waitForProcessExit(endpoint.pid, 3_000).catch(async () => {
                     const cleanup = await cleanupVerifiedOwner(endpoint, {
-                        allowLiveGenerations: true,
+                        allowLiveInstances: true,
                         reason: legacyMutableInstall ? "legacy-mutable-install" : "explicit-update",
                     });
                     if (!cleanup.terminated)
@@ -121,15 +121,91 @@ export function createUpdateLifecycleCoordinator(environment = process.env, file
         },
     };
 }
+const PROGRESS_BAR_WIDTH = 39;
+const PROGRESS_TICK_MS = 200;
+const ACTIVATION_PROGRESS = {
+    materialized: { at: 85, creepTo: 90 },
+    certified: { at: 90, creepTo: 95 },
+    "active-reference-committed": { at: 95, creepTo: 99 },
+};
+function renderProgressBar(percent) {
+    const bounded = Math.min(100, Math.max(0, Math.round(percent)));
+    const filled = Math.round((bounded / 100) * PROGRESS_BAR_WIDTH);
+    return `${"█".repeat(filled)}${"░".repeat(PROGRESS_BAR_WIDTH - filled)} ${bounded}%`;
+}
+function createUpdateProgress(output, enabled) {
+    let visible = false;
+    let current = 0;
+    let shown = -1;
+    let timer = null;
+    const draw = () => {
+        const rounded = Math.round(current);
+        if (rounded === shown)
+            return;
+        shown = rounded;
+        visible = true;
+        output.stdout(`\r${renderProgressBar(rounded)}`);
+    };
+    const stopCreep = () => {
+        if (timer !== null) {
+            clearInterval(timer);
+            timer = null;
+        }
+    };
+    return {
+        set(percent, creepTo = percent) {
+            if (!enabled)
+                return;
+            stopCreep();
+            current = Math.max(current, percent);
+            shown = -1;
+            draw();
+            if (creepTo <= current)
+                return;
+            // Creep asymptotically toward (but never reach) the next milestone so
+            // long opaque phases such as npm install still show visible motion.
+            timer = setInterval(() => {
+                current = Math.min(creepTo - 0.5, current + (creepTo - current) * 0.04);
+                draw();
+            }, PROGRESS_TICK_MS);
+            timer.unref?.();
+        },
+        finish() {
+            stopCreep();
+            if (!visible)
+                return;
+            output.stdout(`\r${renderProgressBar(100)}\n`);
+            visible = false;
+        },
+        clear() {
+            stopCreep();
+            if (!visible)
+                return;
+            output.stdout(`\r${" ".repeat(PROGRESS_BAR_WIDTH + 6)}\r`);
+            visible = false;
+            shown = -1;
+        },
+    };
+}
 export async function runSelfUpdate(options) {
     const fileSystem = options.fileSystem ?? defaultFileSystem;
     const output = options.output ?? defaultOutput;
     const runner = options.runner ?? createNpmProcessRunner();
     const channel = options.channel ?? "stable";
     const distTag = UPDATE_DIST_TAGS[channel];
+    const now = options.now ?? (() => performance.now());
+    const measure = async (phase, operation) => {
+        const startedAt = now();
+        try {
+            return await operation();
+        }
+        finally {
+            options.onPhaseTiming?.({ phase, durationMs: Math.max(0, now() - startedAt) });
+        }
+    };
     let runningVersion;
     try {
-        const packageJson = JSON.parse(await fileSystem.readFile(resolve(options.packageRoot, "package.json")));
+        const packageJson = JSON.parse(await measure("package-version", async () => await fileSystem.readFile(resolve(options.packageRoot, "package.json"))));
         const parsedVersion = typeof packageJson.version === "string" ? validSemver(packageJson.version) : null;
         if (parsedVersion === null)
             throw new Error("package.json does not contain a valid semantic version");
@@ -139,7 +215,7 @@ export async function runSelfUpdate(options) {
         output.stderr(`${PRODUCT_TEXT.diagnostic(`could not read its running package version: ${errorMessage(error)}`)}\n`);
         return 1;
     }
-    const targetLookup = await runNpm(runner, ["view", `${PRODUCT_PACKAGE}@${distTag}`, "version"], true, output, `query the npm ${distTag} channel`);
+    const targetLookup = await measure("target-resolution", async () => await runNpm(runner, ["view", `${PRODUCT_PACKAGE}@${distTag}`, "version"], true, output, `query the npm ${distTag} channel`));
     if (targetLookup.result === null)
         return targetLookup.exitCode;
     const targetVersion = validSemver(targetLookup.result.stdout.trim());
@@ -147,8 +223,9 @@ export async function runSelfUpdate(options) {
         output.stderr(`${PRODUCT_TEXT.diagnostic(`received a malformed ${distTag} version from npm: ${JSON.stringify(targetLookup.result.stdout.trim())}.`)}\n`);
         return 1;
     }
-    output.stdout(`${PRODUCT_TEXT.diagnostic(`update (${channel}): ${runningVersion} → ${targetVersion}.`)}\n`);
-    const rootLookup = await runNpm(runner, ["root", "--global"], true, output, "resolve npm's global package root");
+    output.stdout(`${PRODUCT_TEXT.commandName} update (${channel}): ${runningVersion} → ${targetVersion}.\n`);
+    const progress = createUpdateProgress(output, options.progress ?? (options.output === undefined && process.stdout.isTTY === true));
+    const rootLookup = await measure("global-root", async () => await runNpm(runner, ["root", "--global"], true, output, "resolve npm's global package root"));
     if (rootLookup.result === null)
         return rootLookup.exitCode;
     if (rootLookup.result.stdout.trim().length === 0) {
@@ -170,7 +247,7 @@ export async function runSelfUpdate(options) {
     }
     const environment = options.environment ?? process.env;
     const paths = resolveProductPaths(environment);
-    const lifecycle = options.lifecycle ?? createUpdateLifecycleCoordinator(environment, fileSystem);
+    const lifecycle = options.lifecycle ?? createUpdateLifecycleCoordinator(environment, fileSystem, output);
     const transactionStore = options.transactionStore ?? new UpdateTransactionStore(paths.dataDir);
     let transaction = await transactionStore.read();
     try {
@@ -180,9 +257,11 @@ export async function runSelfUpdate(options) {
                 await transactionStore.finish("completed");
             }
             await transactionStore.clearCompleted();
-            output.stdout(`${PRODUCT_TEXT.diagnostic("is already current and active for this channel; no installation was changed.")}\n`);
+            output.stdout(`${PRODUCT_TEXT.commandName} is up to date — no update needed.\n`);
             return 0;
         }
+        // The bar first appears here so a no-change run never flashes it.
+        progress.set(3, 15);
         const cohortState = await new CohortStateStore(paths.dataDir).read();
         transaction = await transactionStore.begin({
             channel,
@@ -191,27 +270,49 @@ export async function runSelfUpdate(options) {
             priorActiveReleaseId: cohortState.references.active,
         });
         if (phaseBefore(transaction.phase, "ownership-released")) {
-            await lifecycle.shutdownVerifiedOwners(targetVersion);
-            await lifecycle.verifyPackageUnlocked(packageRoot);
+            await measure("ownership-release", async () => {
+                await lifecycle.shutdownVerifiedOwners(targetVersion);
+                await lifecycle.verifyPackageUnlocked(packageRoot);
+            });
             transaction = await transactionStore.advance("ownership-released");
         }
+        progress.set(15, 70);
         if (phaseBefore(transaction.phase, "package-installed")) {
-            output.stdout(`${PRODUCT_TEXT.diagnostic(`is installing ${PRODUCT_TEXT.packageName}@${targetVersion}.`)}\n`);
-            const installation = await runNpm(runner, ["install", "--global", `${PRODUCT_PACKAGE}@${targetVersion}`], false, output, "start the global npm installation", false);
+            const installation = await measure("npm-install", async () => await runNpm(runner, ["install", "--global", "--loglevel=error", "--no-fund", "--no-audit", `${PRODUCT_PACKAGE}@${targetVersion}`], true, output, "start the global npm installation", false));
             if (installation.result === null)
                 throw new UpdateFailure(installation.exitCode, "npm process failed");
-            if (installation.result.code !== 0)
+            if (installation.result.code !== 0) {
+                if (installation.result.stdout.trim().length > 0)
+                    output.stderr(`${installation.result.stdout.trimEnd()}\n`);
                 throw new UpdateFailure(unsuccessfulCode(installation.result.code), `npm exited with status ${formatExitCode(installation.result.code)}`);
+            }
             transaction = await transactionStore.advance("package-installed");
         }
-        await lifecycle.activateInstalled(packageRoot, targetVersion, async (phase) => { transaction = await transactionStore.advance(phase); });
+        progress.set(70, 75);
+        // Ownership can be reacquired after an interrupted installation (for
+        // example, if bare A1 is launched before the update is resumed). Recheck
+        // immediately before activation so recovery cannot start a second cohort.
+        await measure("ownership-release", async () => { await lifecycle.shutdownVerifiedOwners(targetVersion); });
+        progress.set(75, 85);
+        let activationPhaseStartedAt = now();
+        await lifecycle.activateInstalled(packageRoot, targetVersion, async (phase) => {
+            options.onPhaseTiming?.({ phase, durationMs: Math.max(0, now() - activationPhaseStartedAt) });
+            transaction = await transactionStore.advance(phase);
+            progress.set(ACTIVATION_PROGRESS[phase].at, ACTIVATION_PROGRESS[phase].creepTo);
+            activationPhaseStartedAt = now();
+        });
+        options.onPhaseTiming?.({ phase: "supervisor-verified", durationMs: Math.max(0, now() - activationPhaseStartedAt) });
+        const transactionStartedAt = now();
         await transactionStore.advance("supervisor-verified");
         await transactionStore.finish("completed");
         await transactionStore.clearCompleted();
-        output.stdout(`${PRODUCT_TEXT.diagnostic(`updated successfully: ${targetVersion} (${channel}).`)}\n`);
+        options.onPhaseTiming?.({ phase: "transaction-complete", durationMs: Math.max(0, now() - transactionStartedAt) });
+        progress.finish();
+        output.stdout(`${PRODUCT_TEXT.commandName} updated successfully: ${targetVersion} (${channel}).\n`);
         return 0;
     }
     catch (error) {
+        progress.clear();
         const message = errorMessage(error);
         const rollback = options.lifecycle
             ? "previous test lifecycle retained"
@@ -222,6 +323,21 @@ export async function runSelfUpdate(options) {
         return error instanceof UpdateFailure ? error.exitCode : 1;
     }
 }
+export function assertUpdatePerformanceBudget(evidence, maximumPostNpmDurationMs = 30_000) {
+    const failures = [];
+    if (evidence.fileCount < 1)
+        failures.push("fixture contains no payload files");
+    if (evidence.sourceReads !== evidence.fileCount)
+        failures.push(`source payload read count is ${evidence.sourceReads} for ${evidence.fileCount} files`);
+    if (evidence.candidateWrites !== evidence.fileCount)
+        failures.push(`candidate payload write count is ${evidence.candidateWrites} for ${evidence.fileCount} files`);
+    if (evidence.verificationReads > 0)
+        failures.push(`fresh certification reread ${evidence.verificationReads} candidate files`);
+    if (evidence.postNpmDurationMs > maximumPostNpmDurationMs)
+        failures.push(`post-npm activation took ${Math.round(evidence.postNpmDurationMs)}ms; budget is ${maximumPostNpmDurationMs}ms`);
+    if (failures.length > 0)
+        throw new Error(`update performance budget failed: ${failures.join("; ")}`);
+}
 async function requestUpdateShutdown(metadata, targetVersion, timeoutMs) {
     if (!processIsAlive(metadata.pid))
         return { accepted: false, reason: "recorded owner is dead" };

package/dist/src/foundation/storage/control-store.d.ts

@@ -1,6 +1,6 @@
 import { DatabaseSync } from "node:sqlite";
 import type { ManagedAgentDescriptor, PaneId, AgentRecoveryAuthority, RecoveryReferenceId, TerminalSessionLaunch, TerminalTopologySnapshot } from "../workspace-contracts/index.js";
-import type { ForegroundTerminalLease, ForegroundTerminalLeaseId, GenerationId, NativeProcessIdentity, TransparentTerminalLifecycleOutcome } from "../lifecycle/index.js";
+import type { LaunchInstance, LaunchInstanceId, LaunchInstanceOutcome, NativeProcessIdentity, ProcessContainmentIdentity } from "../lifecycle/index.js";
 export declare const DEFAULT_WORKSPACE_ID = "workspace-default";
 export interface WorkspaceAgentPresentation {
     readonly unreadActivity: number;
@@ -21,12 +21,13 @@ export declare class ControlStore {
     constructor(path: string, bootNonce?: string | null);
     migrate(): void;
     reconcilePriorBootGenerations(bootNonce: string): number;
-    acquireForegroundTerminalLease(lease: ForegroundTerminalLease): void;
-    activateForegroundTerminalLease(leaseId: ForegroundTerminalLeaseId, generationId: GenerationId, processIdentity: NativeProcessIdentity, heartbeatAt: string): boolean;
-    heartbeatForegroundTerminalLease(leaseId: ForegroundTerminalLeaseId, processIdentity: NativeProcessIdentity, heartbeatAt: string): boolean;
-    releaseForegroundTerminalLease(leaseId: ForegroundTerminalLeaseId, processIdentity: NativeProcessIdentity | null, outcome: TransparentTerminalLifecycleOutcome, releasedAt: string): boolean;
-    loadLiveForegroundTerminalLease(): ForegroundTerminalLease | null;
-    reconcilePriorBootForegroundTerminalLeases(bootNonce: string, reconciledAt?: string): number;
+    createLaunchInstance(instance: LaunchInstance): void;
+    activateLaunchInstance(instanceId: LaunchInstanceId, ownerClientId: string, rootIdentity: NativeProcessIdentity, containmentIdentity: ProcessContainmentIdentity, activatedAt: string): boolean;
+    beginLaunchInstanceStop(instanceId: LaunchInstanceId, ownerClientId: string, stoppingAt: string): boolean;
+    completeLaunchInstance(instanceId: LaunchInstanceId, ownerClientId: string, terminalState: "completed" | "interrupted", outcome: LaunchInstanceOutcome, completedAt: string): boolean;
+    loadActiveLaunchInstances(): LaunchInstance[];
+    loadLaunchInstance(instanceId: LaunchInstanceId): LaunchInstance | null;
+    reconcilePriorBootLaunchInstances(bootNonce: string, reconciledAt?: string): number;
     persistWorkspaceAgent(agent: ManagedAgentDescriptor, updatedAt?: string): void;
     persistWorkspaceAgentRecord(record: StoredWorkspaceAgent, updatedAt?: string): void;
     replaceWorkspaceAgentRecords(records: readonly StoredWorkspaceAgent[], selectedAgentId: string | null, revision: number, updatedAt?: string): void;

package/dist/src/foundation/storage/control-store.js

@@ -3,6 +3,7 @@ import { mkdirSync } from "node:fs";
 import { dirname } from "node:path";
 import { PRODUCT_IDENTITY } from "../../product-identity.js";
 import { assertManagedAgentDescriptor, assertRecoveryAuthority, assertTerminalSessionLaunch, assertTerminalTopologySnapshot, } from "../workspace-contracts/index.js";
+import { assertLaunchInstance, assertLaunchInstanceOutcome, assertNativeProcessIdentity, assertProcessContainmentIdentity, } from "../lifecycle/index.js";
 export const DEFAULT_WORKSPACE_ID = "workspace-default";
 const INITIAL_WORKSPACE_ID = DEFAULT_WORKSPACE_ID;
 export class ControlStore {
@@ -18,7 +19,7 @@ export class ControlStore {
             this.migrate();
             if (bootNonce !== null) {
                 this.reconcilePriorBootGenerations(bootNonce);
-                this.reconcilePriorBootForegroundTerminalLeases(bootNonce);
+                this.reconcilePriorBootLaunchInstances(bootNonce);
             }
         }
         catch (error) {
@@ -29,8 +30,8 @@ export class ControlStore {
     migrate() {
         const versionRow = this.database.prepare("PRAGMA user_version").get();
         const version = versionRow.user_version;
-        if (version > 4)
-            throw new Error(`control database version ${version} is newer than supported version 4`);
+        if (version > 5)
+            throw new Error(`control database version ${version} is newer than supported version 5`);
         if (version !== 0)
             this.#assertCurrentControlSchema();
         if (version === 0) {
@@ -172,6 +173,41 @@ export class ControlStore {
         ALTER TABLE workspaces ADD COLUMN revision INTEGER NOT NULL DEFAULT 0 CHECK (revision >= 0);
         PRAGMA user_version = 4;
         COMMIT;
+      `);
+        }
+        if (version <= 4) {
+            this.database.exec(`
+        BEGIN IMMEDIATE;
+        UPDATE foreground_terminal_leases
+          SET state = 'interrupted',
+              released_at = COALESCE(released_at, strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
+              outcome_json = '{"kind":"interrupted","reason":"legacy-migration","message":"legacy foreground ownership cannot prove current launch-instance liveness"}'
+          WHERE state IN ('requested', 'active');
+        DROP INDEX IF EXISTS idx_one_live_foreground_lease;
+        CREATE TABLE launch_instances (
+          id TEXT PRIMARY KEY,
+          owner_client_id TEXT NOT NULL,
+          profile_id TEXT NOT NULL CHECK (profile_id IN ('a1', 'pi', 'sandbox')),
+          state TEXT NOT NULL CHECK (state IN ('requested', 'active', 'stopping', 'completed', 'interrupted')),
+          shutdown_policy TEXT NOT NULL CHECK (shutdown_policy = 'terminate-tree-on-close'),
+          guardian_identity_json TEXT NOT NULL CHECK (json_valid(guardian_identity_json)),
+          root_identity_json TEXT CHECK (root_identity_json IS NULL OR json_valid(root_identity_json)),
+          containment_identity_json TEXT CHECK (containment_identity_json IS NULL OR json_valid(containment_identity_json)),
+          created_at TEXT NOT NULL,
+          activated_at TEXT,
+          stopping_at TEXT,
+          completed_at TEXT,
+          outcome_json TEXT CHECK (outcome_json IS NULL OR json_valid(outcome_json)),
+          owner_boot_nonce TEXT NOT NULL,
+          CHECK ((state = 'requested' AND root_identity_json IS NULL AND containment_identity_json IS NULL AND activated_at IS NULL AND stopping_at IS NULL AND completed_at IS NULL AND outcome_json IS NULL)
+            OR (state = 'active' AND root_identity_json IS NOT NULL AND containment_identity_json IS NOT NULL AND activated_at IS NOT NULL AND stopping_at IS NULL AND completed_at IS NULL AND outcome_json IS NULL)
+            OR (state = 'stopping' AND root_identity_json IS NOT NULL AND containment_identity_json IS NOT NULL AND activated_at IS NOT NULL AND stopping_at IS NOT NULL AND completed_at IS NULL AND outcome_json IS NULL)
+            OR (state IN ('completed', 'interrupted') AND completed_at IS NOT NULL AND outcome_json IS NOT NULL))
+        );
+        CREATE INDEX idx_launch_instances_owner ON launch_instances(owner_client_id, state);
+        CREATE INDEX idx_launch_instances_boot ON launch_instances(owner_boot_nonce, state);
+        PRAGMA user_version = 5;
+        COMMIT;
       `);
         }
         if (version === 0) {
@@ -199,61 +235,70 @@ export class ControlStore {
             return Number(result.changes);
         });
     }
-    acquireForegroundTerminalLease(lease) {
+    createLaunchInstance(instance) {
         if (this.bootNonce === null)
-            throw new Error("foreground lease storage requires a supervisor boot identity");
-        if (lease.state !== "requested" || lease.generationId !== null || lease.processIdentity !== null || lease.releasedAt !== null || lease.outcome !== null) {
-            throw new Error("new foreground lease must be requested and unactivated");
-        }
-        try {
-            this.database.prepare(`INSERT INTO foreground_terminal_leases
-        (id, owner_id, profile_json, state, generation_id, process_identity_json, acquired_at, heartbeat_at, released_at, outcome_json, owner_boot_nonce)
-        VALUES (?, ?, ?, 'requested', NULL, NULL, ?, NULL, NULL, NULL, ?)`)
-                .run(lease.id, lease.ownerId, JSON.stringify(lease.profile), lease.acquiredAt, this.bootNonce);
-        }
-        catch (error) {
-            if (error instanceof Error && /UNIQUE constraint failed/i.test(error.message))
-                throw new Error("an exclusive foreground terminal lease is already live");
-            throw error;
-        }
+            throw new Error("launch instance storage requires a supervisor boot identity");
+        assertLaunchInstance(instance);
+        if (instance.state !== "requested")
+            throw new Error("new launch instance must be requested");
+        this.database.prepare(`INSERT INTO launch_instances
+      (id, owner_client_id, profile_id, state, shutdown_policy, guardian_identity_json, root_identity_json, containment_identity_json,
+       created_at, activated_at, stopping_at, completed_at, outcome_json, owner_boot_nonce)
+      VALUES (?, ?, ?, 'requested', ?, ?, NULL, NULL, ?, NULL, NULL, NULL, NULL, ?)`)
+            .run(instance.id, instance.ownerClientId, instance.profileId, instance.shutdownPolicy, JSON.stringify(instance.guardianIdentity), instance.createdAt, this.bootNonce);
     }
-    activateForegroundTerminalLease(leaseId, generationId, processIdentity, heartbeatAt) {
+    activateLaunchInstance(instanceId, ownerClientId, rootIdentity, containmentIdentity, activatedAt) {
         if (this.bootNonce === null)
-            throw new Error("foreground lease storage requires a supervisor boot identity");
-        const result = this.database.prepare(`UPDATE foreground_terminal_leases
-      SET state = 'active', generation_id = ?, process_identity_json = ?, heartbeat_at = ?
-      WHERE id = ? AND state = 'requested' AND owner_boot_nonce = ?`)
-            .run(generationId, JSON.stringify(processIdentity), heartbeatAt, leaseId, this.bootNonce);
+            throw new Error("launch instance storage requires a supervisor boot identity");
+        assertNativeProcessIdentity(rootIdentity);
+        assertProcessContainmentIdentity(containmentIdentity);
+        const result = this.database.prepare(`UPDATE launch_instances
+      SET state = 'active', root_identity_json = ?, containment_identity_json = ?, activated_at = ?
+      WHERE id = ? AND owner_client_id = ? AND owner_boot_nonce = ? AND state = 'requested'`)
+            .run(JSON.stringify(rootIdentity), JSON.stringify(containmentIdentity), activatedAt, instanceId, ownerClientId, this.bootNonce);
         return Number(result.changes) === 1;
     }
-    heartbeatForegroundTerminalLease(leaseId, processIdentity, heartbeatAt) {
+    beginLaunchInstanceStop(instanceId, ownerClientId, stoppingAt) {
         if (this.bootNonce === null)
-            throw new Error("foreground lease storage requires a supervisor boot identity");
-        const result = this.database.prepare(`UPDATE foreground_terminal_leases SET heartbeat_at = ?
-      WHERE id = ? AND state = 'active' AND owner_boot_nonce = ? AND process_identity_json = ?`)
-            .run(heartbeatAt, leaseId, this.bootNonce, JSON.stringify(processIdentity));
+            throw new Error("launch instance storage requires a supervisor boot identity");
+        const result = this.database.prepare(`UPDATE launch_instances SET state = 'stopping', stopping_at = ?
+      WHERE id = ? AND owner_client_id = ? AND owner_boot_nonce = ? AND state = 'active'`)
+            .run(stoppingAt, instanceId, ownerClientId, this.bootNonce);
         return Number(result.changes) === 1;
     }
-    releaseForegroundTerminalLease(leaseId, processIdentity, outcome, releasedAt) {
+    completeLaunchInstance(instanceId, ownerClientId, terminalState, outcome, completedAt) {
         if (this.bootNonce === null)
-            throw new Error("foreground lease storage requires a supervisor boot identity");
-        const expectedIdentity = processIdentity === null ? null : JSON.stringify(processIdentity);
-        const result = this.database.prepare(`UPDATE foreground_terminal_leases
-      SET state = 'released', released_at = ?, outcome_json = ?
-      WHERE id = ? AND state IN ('requested', 'active') AND owner_boot_nonce = ?
-        AND ((process_identity_json IS NULL AND ? IS NULL) OR process_identity_json = ?)`)
-            .run(releasedAt, JSON.stringify(outcome), leaseId, this.bootNonce, expectedIdentity, expectedIdentity);
+            throw new Error("launch instance storage requires a supervisor boot identity");
+        assertLaunchInstanceOutcome(outcome);
+        if (terminalState === "completed" && outcome.kind === "interrupted")
+            throw new Error("completed launch instance cannot carry an interrupted outcome");
+        if (terminalState === "interrupted" && outcome.kind !== "interrupted" && outcome.kind !== "cleanup-error") {
+            throw new Error("interrupted launch instance requires an interrupted or cleanup-error outcome");
+        }
+        const result = this.database.prepare(`UPDATE launch_instances
+      SET state = ?, completed_at = ?, outcome_json = ?
+      WHERE id = ? AND owner_client_id = ? AND owner_boot_nonce = ? AND state IN ('requested', 'active', 'stopping')`)
+            .run(terminalState, completedAt, JSON.stringify(outcome), instanceId, ownerClientId, this.bootNonce);
         return Number(result.changes) === 1;
     }
-    loadLiveForegroundTerminalLease() {
-        const row = this.database.prepare("SELECT * FROM foreground_terminal_leases WHERE state IN ('requested', 'active') LIMIT 1").get();
-        return row ? foregroundLeaseFromRow(row) : null;
+    loadActiveLaunchInstances() {
+        return this.database.prepare(`SELECT * FROM launch_instances
+      WHERE state IN ('requested', 'active', 'stopping') ORDER BY created_at, id`).all()
+            .map(launchInstanceFromRow);
     }
-    reconcilePriorBootForegroundTerminalLeases(bootNonce, reconciledAt = new Date().toISOString()) {
-        const outcome = { kind: "broker-error", message: "foreground lease owner ended before a terminal outcome", code: "stale-owner-boot" };
-        const result = this.database.prepare(`UPDATE foreground_terminal_leases
-      SET state = 'released', released_at = ?, outcome_json = ?
-      WHERE state IN ('requested', 'active') AND owner_boot_nonce <> ?`)
+    loadLaunchInstance(instanceId) {
+        const row = this.database.prepare("SELECT * FROM launch_instances WHERE id = ?").get(instanceId);
+        return row ? launchInstanceFromRow(row) : null;
+    }
+    reconcilePriorBootLaunchInstances(bootNonce, reconciledAt = new Date().toISOString()) {
+        const outcome = {
+            kind: "interrupted",
+            reason: "supervisor-disconnect",
+            message: "launch instance ownership ended with a prior supervisor boot",
+        };
+        const result = this.database.prepare(`UPDATE launch_instances
+      SET state = 'interrupted', completed_at = ?, outcome_json = ?
+      WHERE state IN ('requested', 'active', 'stopping') AND owner_boot_nonce <> ?`)
             .run(reconciledAt, JSON.stringify(outcome), bootNonce);
         return Number(result.changes);
     }
@@ -464,17 +509,22 @@ function assertWorkspaceAgentPresentation(presentation) {
         }
     }
 }
-function foregroundLeaseFromRow(row) {
-    return {
+function launchInstanceFromRow(row) {
+    const instance = {
         id: row.id,
-        ownerId: row.owner_id,
-        profile: JSON.parse(row.profile_json),
+        ownerClientId: row.owner_client_id,
+        profileId: row.profile_id,
         state: row.state,
-        generationId: row.generation_id,
-        processIdentity: row.process_identity_json ? JSON.parse(row.process_identity_json) : null,
-        acquiredAt: row.acquired_at,
-        heartbeatAt: row.heartbeat_at,
-        releasedAt: row.released_at,
+        shutdownPolicy: row.shutdown_policy,
+        guardianIdentity: JSON.parse(row.guardian_identity_json),
+        rootIdentity: row.root_identity_json ? JSON.parse(row.root_identity_json) : null,
+        containmentIdentity: row.containment_identity_json ? JSON.parse(row.containment_identity_json) : null,
+        createdAt: row.created_at,
+        activatedAt: row.activated_at,
+        stoppingAt: row.stopping_at,
+        completedAt: row.completed_at,
         outcome: row.outcome_json ? JSON.parse(row.outcome_json) : null,
     };
+    assertLaunchInstance(instance);
+    return instance;
 }

package/dist/src/foundation/supervision/main.js

@@ -1,6 +1,7 @@
 import { randomUUID } from "node:crypto";
 import { appendFileSync, mkdirSync } from "node:fs";
-import { assertImmutableExecutionRoot, readMaterializedRelease } from "../release/index.js";
+import { resolve } from "node:path";
+import { assertImmutableExecutionRoot, readCertifiedReleaseManifest } from "../release/index.js";
 import { ControlStore } from "../storage/index.js";
 import { resolveProductPaths } from "./paths.js";
 import { SupervisorServer } from "./server.js";
@@ -10,11 +11,11 @@ export async function runSupervisor() {
     mkdirSync(paths.runtimeDir, { recursive: true, mode: 0o700 });
     const log = (message) => appendFileSync(paths.supervisorLogPath, `${new Date().toISOString()} ${message}\n`);
     const releaseRoot = process.env[PRODUCT_IDENTITY.environment.releaseRoot];
-    if (!releaseRoot)
+    const releaseId = process.env[PRODUCT_IDENTITY.environment.releaseId];
+    const contentDigest = process.env[PRODUCT_IDENTITY.environment.releaseDigest];
+    if (!releaseRoot || !releaseId || !contentDigest)
         throw new Error(PRODUCT_TEXT.diagnostic("supervisor must be launched from a verified immutable release"));
-    const release = await readMaterializedRelease(releaseRoot);
-    if (process.env[PRODUCT_IDENTITY.environment.releaseId] !== release.releaseId)
-        throw new Error(PRODUCT_TEXT.diagnostic("selected release identity does not match its verified manifest"));
+    const release = await readCertifiedReleaseManifest({ releaseRoot, releaseId, contentDigest }, resolve(paths.dataDir, "releases"));
     await assertImmutableExecutionRoot(release, paths.dataDir);
     const bootNonce = randomUUID();
     const store = new ControlStore(paths.databasePath, bootNonce);

package/dist/src/foundation/supervision/server.d.ts

@@ -1,5 +1,5 @@
 import { type SupervisorSnapshot } from "../lifecycle/index.js";
-import type { MaterializedRelease } from "../release/index.js";
+import { type MaterializedRelease } from "../release/index.js";
 import { ControlStore } from "../storage/index.js";
 import { type ProductPaths } from "./paths.js";
 export declare class SupervisorServer {
@@ -7,12 +7,14 @@ export declare class SupervisorServer {
     readonly store: ControlStore;
     readonly release: MaterializedRelease;
     readonly terminateProcess: (code: number) => void;
+    readonly reconciliationDeadlineMs: number;
+    readonly shutdownDeadlineMs: number;
     readonly id: `${string}-${string}-${string}-${string}-${string}`;
     readonly bootNonce: string;
     readonly pidStartIdentity: string;
     readonly startedAt: string;
     readonly paths: ProductPaths;
-    constructor(store: ControlStore, paths: ProductPaths | undefined, release: MaterializedRelease, bootNonce?: string, terminateProcess?: (code: number) => void);
+    constructor(store: ControlStore, paths: ProductPaths | undefined, release: MaterializedRelease, bootNonce?: string, terminateProcess?: (code: number) => void, reconciliationDeadlineMs?: number, shutdownDeadlineMs?: number);
     snapshot(): SupervisorSnapshot;
     listen(): Promise<void>;
     close(stopAgents?: boolean): Promise<void>;