@timurproko/a1 0.1.8-dev.560 → 0.1.8-dev.563

package/bin/guardian.js

@@ -26,6 +26,11 @@ Promise.resolve().then(() => runLaunchGuardian({
 })).then(
   code => { process.exitCode = code; },
   error => {
+    if (error instanceof Error && "code" in error && error.code === "release-superseded" && typeof process.send === "function") {
+      process.send({ type: "a1-release-reselection" });
+      process.exitCode = 1;
+      return;
+    }
     console.error(error instanceof Error ? error.message : String(error));
     process.exitCode = 1;
   },

package/dist/app/session-shell/session-shell-root.js

@@ -687,11 +687,13 @@ export class OwnedUiSessionShellRoot {
             .flatMap(diagnostic => renderPiShellPackageUpdateNotice(diagnostic.message.split("\n").filter(line => line.startsWith("- ")).map(line => line.slice(2)), width)));
         rows.push(...diagnostics
             .filter(diagnostic => diagnostic.code === "changelog-collapsed" || diagnostic.code === "changelog-expanded")
-            // Rationale: the custom viewport shows the new entries on the What's New screen, so its feed
-            // carries only the hint for either diagnostic; the pinned layout keeps the full document.
-            .flatMap(diagnostic => diagnostic.code === "changelog-collapsed" || this.#customViewport
-            ? createPiShellCollapsedChangelog().render(width)
-            : createPiShellChangelog(diagnostic.message).render(width)));
+            // Rationale: bare A1 translates either startup diagnostic into transient dock chrome;
+            // the pinned layout retains Pi's collapsed hint or expanded document.
+            .flatMap(diagnostic => this.#customViewport
+            ? []
+            : diagnostic.code === "changelog-collapsed"
+                ? createPiShellCollapsedChangelog().render(width)
+                : createPiShellChangelog(diagnostic.message).render(width)));
         rows.push(...diagnostics
             .filter(diagnostic => diagnostic.code !== "engine-startup" && diagnostic.code !== "package-updates"
             && diagnostic.code !== "changelog-collapsed" && diagnostic.code !== "changelog-expanded")

package/dist/app/session-shell/session-shell.js

@@ -16,7 +16,6 @@ import { SKILLS_COMMAND_NAME, findSkillByArgument, rewriteSkillsTunnelSubmission
 import { createPiQueuedInputStatus, createPiShellFooter, createPiShellHeader, createPiShellLoadedResources, createPiShellStatus, } from "../../integrations/pi/components/shell-footer-status.js";
 import { createPiShellArmin, createPiShellAuthProviderSelector, createPiShellDaxnuts, createPiShellDialog, createPiShellEarendilAnnouncement, createPiShellExtensionSelector, createPiShellLoginDialog, createPiShellModelSelector, createPiShellModelsDialog, createPiShellOperationLoader, createPiShellReloadBox, createPiShellScopedModelsSelector, createPiShellSelector, createPiShellSessionSelector, createPiShellSettingsSelector, createPiShellSkillsSelector, createPiShellTreeSelector, createPiShellTrustSelector, createPiShellUserMessageSelector, } from "../../integrations/pi/components/shell-selectors-dialogs.js";
 import { createPiShellChangelog, createPiShellHotkeys, createPiShellSessionInfo, renderPiShellStatusText, } from "../../integrations/pi/components/shell-presenters-info.js";
-import { CHANGELOG_ROUTE } from "../../features/owned-ui/reference-routes.js";
 import { createPiShellTranscriptComponent, renderPiShellPackageUpdateNotice, renderPiShellStartupDiagnostic, renderPiShellTranscriptBlock, } from "../../integrations/pi/components/shell-presenters-transcript.js";
 import { onPiThemeChange, piTheme } from "../../integrations/pi/components/upstream/theme/theme.js";
 import { DamageAwareTerminalAdapter } from "../../integrations/pi/tui-runtime/damage-aware-terminal.js";
@@ -56,7 +55,7 @@ export class OwnedUiSessionShell {
     #shutdownPromise;
     #disposePromise;
     #pointerReporting = false;
-    // Invariant: the startup release notes open at most once per shell, whatever the view does later.
+    // Invariant: the startup release-note diagnostic creates at most one dock notice per shell.
     #startupChangelogHandled = false;
     #customViewport;
     #responseCopy;
@@ -1689,22 +1688,17 @@ export class OwnedUiSessionShell {
             listener(view);
         return view;
     }
-    // Rationale: the engine has already stored the current version when the diagnostic arrives, so the
-    // entries newer than the last acknowledged one exist only in its message; the screen shows exactly those.
+    // Rationale: release details stay one explicit command away; startup needs only the same quiet,
+    // non-transcript acknowledgement that bare A1 uses for model and thinking changes.
     #presentStartupChangelog(view) {
-        if (this.#startupChangelogHandled || !this.#customViewport || this.#routeHost === null)
+        if (this.#startupChangelogHandled || !this.#customViewport)
             return;
-        const diagnostic = view.diagnostics.find(candidate => candidate.code === "changelog-expanded");
+        const diagnostic = view.diagnostics.find(candidate => candidate.code === "changelog-collapsed" || candidate.code === "changelog-expanded");
         // Invariant: a view synchronized before the runtime starts is not the moment of arrival; start() replays it.
         if (diagnostic === undefined || !this.runtime.active)
             return;
         this.#startupChangelogHandled = true;
-        // Invariant: a dialog, selector, or owned screen already up keeps the screen; the hint stays in the feed.
-        if (this.#dialogHandle !== undefined || !this.root.usesDefaultInputSurface())
-            return;
-        if (!this.#routeHost.claims(CHANGELOG_ROUTE))
-            return;
-        this.#openOwnedRoute(CHANGELOG_ROUTE, { document: diagnostic.message });
+        this.root.appendWorkflowStatus(STARTUP_CHANGELOG_NOTICE);
     }
     #openOwnedRoute(route, input) {
         const surface = this.#routeHost?.open(route, input) ?? null;
@@ -2117,6 +2111,7 @@ function workflowAdapterResult(result) {
 const INTERRUPT = "\u0003";
 const INTERRUPT_CHORD_MS = 1_500;
 const RELOAD_SURFACE_MIN_VISIBLE_MS = 400;
+const STARTUP_CHANGELOG_NOTICE = "Run /changelog to view the full release notes.";
 // Rationale: the outro is not configurable; the switch only decides whether this plan plays.
 const QUIT_OUTRO_EFFECT = "fall";
 const QUIT_OUTRO_DURATION_MS = 800;

package/dist/foundation/launch-guardian/main.js

@@ -2,10 +2,9 @@ import { randomUUID } from "node:crypto";
 import { PRODUCT_TEXT } from "../../product-identity.js";
 import { readLaunchContext } from "../launch-context/index.js";
 import { resolve } from "node:path";
-import { assertLaunchProfileId, sessionSelectionArguments } from "../lifecycle/index.js";
+import { assertLaunchProfileId, resolveCohortEndpoint, resolveProductPaths, sessionSelectionArguments } from "../lifecycle/index.js";
 import { closeVerifiedContainment, DarwinNativeProcessInspector, LinuxNativeProcessInspector, NativeGuardianContainment, resolveProcessGuardianPath, verifyProcessGuardianArtifact, WindowsNativeProcessInspector, } from "../process-containment/index.js";
 import { SupervisorClient } from "../protocol/index.js";
-import { resolveCohortEndpoint, resolveProductPaths } from "../supervision/index.js";
 import { markStartupPhase } from "../startup/index.js";
 export async function runLaunchGuardian(options) {
     assertLaunchProfileId(options.profileId);

package/dist/foundation/lifecycle/model.d.ts

@@ -54,7 +54,7 @@ export interface CommandResult {
     readonly ok: boolean;
     readonly revision: number;
     readonly error?: {
-        readonly code: "invalid-command" | "not-found" | "stale-generation" | "capability-error" | "containment-unsupported" | "ownership-error" | "driver-error";
+        readonly code: "invalid-command" | "not-found" | "stale-generation" | "capability-error" | "containment-unsupported" | "ownership-error" | "release-superseded" | "driver-error";
         readonly message: string;
     };
 }

package/dist/foundation/release/bootstrap.js

@@ -5,6 +5,7 @@ import { connect } from "node:net";
 import { platform } from "node:os";
 import { resolve } from "node:path";
 import { selectCohortLaunch } from "./cohort-selection.js";
+import { selectOrdinaryLaunchReleaseId } from "./ordinary-launch-selection.js";
 import { CohortStateStore } from "./cohort-state.js";
 import { assertLaunchProfileId, createSupervisorStartupAttempt, readSupervisorStartupResult, resolveCohortEndpoint, resolveProductPaths, sessionSelectionArguments } from "../lifecycle/index.js";
 import { encodeFrame, LineFrameDecoder } from "../protocol/index.js";
@@ -18,7 +19,11 @@ import { createRestartSeal, readRestartCertifiedRelease, releaseCertificationDoc
 import { PRODUCT_IDENTITY, PRODUCT_TEXT } from "../../product-identity.js";
 import { markStartupPhase } from "../startup/index.js";
 import { launchContractTarget, readLaunchContext, withLaunchContext } from "../launch-context/index.js";
+const RELEASE_RESELECTION_MESSAGE = "a1-release-reselection";
 export async function runBootstrap(options) {
+    return await runBootstrapAttempt(options, 1);
+}
+async function runBootstrapAttempt(options, retriesRemaining) {
     const environment = withLaunchContext(options.environment ?? process.env, { launchProfile: options.launchIntent?.profileId ?? "a1" });
     await markStartupPhase(environment, "bootstrap-start");
     const launchProfileId = options.launchIntent?.profileId ?? "a1";
@@ -29,6 +34,15 @@ export async function runBootstrap(options) {
     const output = options.output ?? process.stderr;
     const paths = resolveProductPaths(environment);
     await mkdir(paths.runtimeDir, { recursive: true, mode: 0o700 });
+    const launchSelected = async (release) => {
+        const result = await launchUi(release, environment, sessionArgs);
+        if (!result.releaseSuperseded)
+            return result.code;
+        if (retriesRemaining > 0)
+            return await runBootstrapAttempt(options, retriesRemaining - 1);
+        output.write(`${PRODUCT_TEXT.diagnostic("active release changed repeatedly during startup; launch could not converge")}\n`);
+        return 1;
+    };
     const stateStore = new CohortStateStore(paths.dataDir);
     let state = await stateStore.read();
     const launchDuringUpdate = async () => {
@@ -41,7 +55,7 @@ export async function runBootstrap(options) {
             return null;
         const retained = await readCertifiedReleaseManifest(prior, resolve(paths.dataDir, "releases"));
         await ensureSupervisor(retained, environment);
-        return await launchUi(retained, environment, sessionArgs);
+        return await launchSelected(retained);
     };
     const duringUpdate = await launchDuringUpdate();
     if (duringUpdate !== null)
@@ -82,7 +96,7 @@ export async function runBootstrap(options) {
             && endpoint.contentDigest === active.contentDigest;
         if (endpointMatches && probe === "live-verified") {
             const retained = await readCertifiedReleaseManifest(active, resolve(paths.dataDir, "releases"));
-            return await launchUi(retained, environment, sessionArgs);
+            return await launchSelected(retained);
         }
         if (endpoint === null || probe === "dead") {
             if (endpoint)
@@ -100,7 +114,7 @@ export async function runBootstrap(options) {
             await markStartupPhase(environment, "replacement-supervisor-start");
             await ensureSupervisor(retained, environment);
             await markStartupPhase(environment, "replacement-supervisor-ready");
-            return await launchUi(retained, environment, sessionArgs);
+            return await launchSelected(retained);
         }
     }
     // Concurrency: an installation being replaced is not a reason to refuse a launch. While
@@ -112,7 +126,7 @@ export async function runBootstrap(options) {
         candidate = await materializeRelease(options.packageRoot, paths.dataDir);
     }
     catch (error) {
-        const fallback = await launchRetainedActive(state, paths, environment, sessionArgs, output);
+        const fallback = await launchRetainedActive(state, paths, environment, launchSelected);
         if (fallback === null)
             throw error;
         return fallback;
@@ -121,24 +135,32 @@ export async function runBootstrap(options) {
     const afterMaterialization = await launchDuringUpdate();
     if (afterMaterialization !== null)
         return afterMaterialization;
+    state = await stateStore.read();
+    const ordinarySelection = !activeIsLaunchable
+        ? candidate.releaseId
+        : selectOrdinaryLaunchReleaseId(candidate, state.references.active === null ? undefined : state.releases[state.references.active]);
+    if (ordinarySelection !== candidate.releaseId) {
+        const retainedRecord = state.releases[ordinarySelection];
+        if (!retainedRecord || retainedRecord.approval !== "approved")
+            throw new Error("selected active release is not approved");
+        const retained = await readCertifiedReleaseManifest(retainedRecord, resolve(paths.dataDir, "releases"));
+        await ensureSupervisor(retained, environment);
+        return await launchSelected(retained);
+    }
     await stateStore.recordCandidate(candidate);
     state = await stateStore.read();
-    if (!state.references.active) {
+    if (state.releases[candidate.releaseId]?.approval !== "approved") {
         const diagnosticsPath = await certifyMaterializedRelease(candidate, paths.dataDir);
         await stateStore.approve(candidate.releaseId, diagnosticsPath);
-        await stateStore.activate(candidate.releaseId);
-        state = await stateStore.read();
     }
-    else if (!activeIsLaunchable && candidate.releaseId !== activeId
-        && state.releases[candidate.releaseId]?.approval !== "approved") {
-        // Invariant: the active reference points at a copy that cannot launch, so reusing it
-        // is off the table — but an unapproved candidate would lose the selection
-        // below to that same broken active (`start-active`). Approving the healed
-        // candidate here lets ordinary cohort selection activate it, while a live
-        // busy cohort still wins the endpoint checks and keeps its sessions.
-        const diagnosticsPath = await certifyMaterializedRelease(candidate, paths.dataDir);
-        await stateStore.approve(candidate.releaseId, diagnosticsPath);
-        state = await stateStore.read();
+    state = await stateStore.activateForLaunch(candidate.releaseId, !activeIsLaunchable ? activeId ?? undefined : undefined);
+    if (state.references.active !== candidate.releaseId) {
+        const retainedRecord = state.references.active === null ? undefined : state.releases[state.references.active];
+        if (!retainedRecord || retainedRecord.approval !== "approved")
+            throw new Error("ordinary launch has no approved active release");
+        const retained = await readCertifiedReleaseManifest(retainedRecord, resolve(paths.dataDir, "releases"));
+        await ensureSupervisor(retained, environment);
+        return await launchSelected(retained);
     }
     // Protocol: the candidate's own endpoint decides whether this launch attaches or starts a supervisor.
     // A cohort other than this one is not in the way: it listens somewhere else.
@@ -146,7 +168,7 @@ export async function runBootstrap(options) {
     endpoint = await readEndpointMetadata(endpointPaths.endpointMetadataPath);
     if (endpoint === null) {
         const legacy = await readEndpointMetadata(paths.endpointMetadataPath);
-        if (legacy !== null) {
+        if (legacy?.releaseId === candidate.releaseId) {
             endpoint = legacy;
             endpointPaths = { endpoint: paths.endpoint, endpointMetadataPath: paths.endpointMetadataPath };
         }
@@ -170,11 +192,14 @@ export async function runBootstrap(options) {
         await removeEndpointArtifacts(endpointPaths.endpointMetadataPath, endpointPaths.endpoint);
     }
     if (decision.action === "launch-retained-ui") {
-        const retained = await verifyMaterializedRelease(decision.releaseRoot, undefined, resolve(paths.dataDir, "releases"));
+        const retainedRecord = state.releases[decision.releaseId];
+        const retained = retainedRecord?.approval === "approved"
+            ? await readCertifiedReleaseManifest(retainedRecord, resolve(paths.dataDir, "releases"))
+            : await verifyMaterializedRelease(decision.releaseRoot, undefined, resolve(paths.dataDir, "releases"));
         if (decision.recordPending && endpoint) {
             await stateStore.blockPending("candidate activation deferred by live non-resumable instances", endpoint.ownership.nonResumableInstanceIds);
         }
-        const code = await launchUi(retained, environment, sessionArgs);
+        const code = await launchSelected(retained);
         if (decision.recordPending)
             await activatePendingAfterBlockerExit(candidate, stateStore, paths, environment);
         return code;
@@ -204,15 +229,23 @@ export async function runBootstrap(options) {
             const diagnosticsPath = await certifyMaterializedRelease(candidate, paths.dataDir);
             await stateStore.approve(candidate.releaseId, diagnosticsPath);
         }
-        if ((await stateStore.read()).references.active !== candidate.releaseId)
-            await stateStore.activate(candidate.releaseId);
-        selected = candidate;
+        const activated = (await stateStore.read()).references.active === candidate.releaseId
+            ? await stateStore.read()
+            : await stateStore.activateForLaunch(candidate.releaseId);
+        if (activated.references.active === candidate.releaseId)
+            selected = candidate;
+        else {
+            const retainedRecord = activated.references.active === null ? undefined : activated.releases[activated.references.active];
+            if (!retainedRecord || retainedRecord.approval !== "approved")
+                throw new Error("ordinary launch has no approved active release");
+            selected = await readCertifiedReleaseManifest(retainedRecord, resolve(paths.dataDir, "releases"));
+        }
     }
     else {
         selected = await readMaterializedRelease(decision.releaseRoot);
     }
     await ensureSupervisor(selected, environment);
-    return await launchUi(selected, environment, sessionArgs);
+    return await launchSelected(selected);
 }
 /**
  * Start the retained active cohort when the installed payload cannot be taken. The
@@ -220,7 +253,7 @@ export async function runBootstrap(options) {
  * certifying anything new, and reports no selection when there is nothing safe
  * to fall back to.
  */
-async function launchRetainedActive(state, paths, environment, sessionArgs, output) {
+async function launchRetainedActive(state, paths, environment, launch) {
     const activeId = state.references.active;
     const active = activeId === null ? undefined : state.releases[activeId];
     if (!active || active.approval !== "approved")
@@ -228,8 +261,7 @@ async function launchRetainedActive(state, paths, environment, sessionArgs, outp
     try {
         const retained = await readCertifiedReleaseManifest(active, resolve(paths.dataDir, "releases"));
         await ensureSupervisor(retained, environment);
-        output.write(`${PRODUCT_TEXT.diagnostic(`installation is being replaced; starting the retained release ${retained.packageVersion}`)}\n`);
-        return await launchUi(retained, environment, sessionArgs);
+        return await launch(retained);
     }
     catch {
         return null;
@@ -300,13 +332,24 @@ async function launchUi(release, environment, sessionArgs) {
     await markStartupPhase(environment, "bootstrap-selected");
     const entry = await resolveReleaseEntryPoint(release, "bin/guardian.js");
     return await new Promise((resolvePromise, rejectPromise) => {
+        let releaseSuperseded = false;
         const child = spawn(process.execPath, [entry, ...sessionArgs], {
             env: releaseEnvironment(environment, release, readLaunchContext(environment, "profile").launchProfile),
-            stdio: "inherit",
+            stdio: ["inherit", "inherit", "inherit", "ipc"],
             windowsHide: false,
         });
+        child.on("message", message => {
+            if (message && typeof message === "object" && "type" in message && message.type === RELEASE_RESELECTION_MESSAGE) {
+                releaseSuperseded = true;
+            }
+        });
         child.once("error", rejectPromise);
-        child.once("close", (code, signal) => resolvePromise(restoreAfterOwnedExit(readLaunchContext(environment).launchProfile === "a1", code, signal)));
+        child.once("close", (code, signal) => resolvePromise({
+            code: releaseSuperseded
+                ? code ?? 1
+                : restoreAfterOwnedExit(readLaunchContext(environment).launchProfile === "a1", code, signal),
+            releaseSuperseded,
+        }));
     });
 }
 /**

package/dist/foundation/release/cohort-state.d.ts

@@ -140,6 +140,8 @@ export declare class CohortStateStore {
     recordCandidate(release: MaterializedRelease): Promise<CohortState>;
     approve(releaseId: string, diagnosticsPath: string): Promise<CohortState>;
     activate(releaseId: string): Promise<CohortState>;
+    /** Atomically advances ordinary launch without allowing an older installation to roll active state back. */
+    activateForLaunch(releaseId: string, replaceUnlaunchableActiveId?: string): Promise<CohortState>;
     blockPending(reason: string, blockerGenerationIds: readonly string[]): Promise<CohortState>;
     rollback(ownershipReleased: boolean): Promise<CohortState>;
     setRetention(releaseIds: readonly string[]): Promise<CohortState>;

package/dist/foundation/release/cohort-state.js

@@ -1,6 +1,7 @@
 import { randomUUID } from "node:crypto";
 import { mkdir, open, readFile, rename, rm, stat } from "node:fs/promises";
 import { dirname, resolve } from "node:path";
+import { selectOrdinaryLaunchReleaseId } from "./ordinary-launch-selection.js";
 import { PRODUCT_IDENTITY } from "../../product-identity.js";
 export const RELEASE_COHORT_SCHEMA = PRODUCT_IDENTITY.protocol.releaseCohortSchema;
 const RELEASE_ID_PATTERN = /^[0-9A-Za-z.+_-]+-[a-f0-9]{20}$/;
@@ -135,6 +136,40 @@ export class CohortStateStore {
             };
         });
     }
+    /** Atomically advances ordinary launch without allowing an older installation to roll active state back. */
+    async activateForLaunch(releaseId, replaceUnlaunchableActiveId) {
+        return await this.update(current => {
+            const release = requiredRelease(current, releaseId);
+            if (release.approval !== "approved")
+                throw new Error(`cannot activate unverified release ${releaseId}`);
+            const selectedId = current.references.active === replaceUnlaunchableActiveId
+                ? releaseId
+                : selectOrdinaryLaunchReleaseId(release, current.references.active === null ? undefined : current.releases[current.references.active]);
+            if (selectedId !== releaseId) {
+                return {
+                    ...current,
+                    references: {
+                        ...current.references,
+                        pending: current.references.pending === releaseId ? null : current.references.pending,
+                        approved: selectedId,
+                    },
+                    activation: activation("idle", null),
+                };
+            }
+            const prior = current.references.active;
+            return {
+                ...current,
+                references: {
+                    ...current.references,
+                    active: releaseId,
+                    pending: null,
+                    approved: releaseId,
+                    rollback: prior && prior !== releaseId ? prior : current.references.rollback,
+                },
+                activation: activation("idle", null),
+            };
+        });
+    }
     async blockPending(reason, blockerGenerationIds) {
         return await this.update(current => ({ ...current, activation: { ...activation("blocked", reason), blockerGenerationIds: [...blockerGenerationIds] } }));
     }

package/dist/foundation/release/index.d.ts

@@ -1,6 +1,7 @@
 export { certifyMaterializedRelease, ensureSupervisor, recordParentCertifiedRelease, releaseEnvironment, releaseVerifiedIdleOwner, runBootstrap, startSupervisor, waitForProcessExit, waitForVerifiedEndpoint, } from "./bootstrap.js";
 export type { BootstrapOptions, SupervisorStartupAttempt } from "./bootstrap.js";
 export { selectCohortLaunch } from "./cohort-selection.js";
+export { selectOrdinaryLaunchReleaseId } from "./ordinary-launch-selection.js";
 export type { CohortLaunchDecision, OwnershipProbe } from "./cohort-selection.js";
 export { CohortStateStore, RELEASE_COHORT_SCHEMA, emptyState, planProtectedReleases } from "./cohort-state.js";
 export type { ActiveReleaseTransactionReference, CohortState, EndpointOwnership, ExternalReleaseHold, ExternalReleaseHoldAuthority, OrphanReleaseDisposition, ProtectedReleaseInputs, ProtectedReleasePlan, ReleaseApproval, ReleaseCleanupDiagnostic, ReleaseCleanupDisposition, ReleaseCleanupStage, ReleaseCleanupState, ReleaseCleanupWorkerRun, ReleaseCleanupWorkerStatus, ReleaseCleanupWorkerSummary, ReleaseRecord, ReleaseReferences, ReleaseRetentionReconciliation, SupervisorEndpointMetadata, } from "./cohort-state.js";

package/dist/foundation/release/index.js

@@ -1,5 +1,6 @@
 export { certifyMaterializedRelease, ensureSupervisor, recordParentCertifiedRelease, releaseEnvironment, releaseVerifiedIdleOwner, runBootstrap, startSupervisor, waitForProcessExit, waitForVerifiedEndpoint, } from "./bootstrap.js";
 export { selectCohortLaunch } from "./cohort-selection.js";
+export { selectOrdinaryLaunchReleaseId } from "./ordinary-launch-selection.js";
 export { CohortStateStore, RELEASE_COHORT_SCHEMA, emptyState, planProtectedReleases } from "./cohort-state.js";
 export { DEPENDENCY_LAYER_MANIFEST, DEPENDENCY_LAYER_SCHEMA, RUNTIME_PAYLOAD_INVENTORY, dependencyLayerCertificationPath, dependencyReference, generateDependencyRuntimePayload, legacyDependencyLayerCertificationPath, materializeDependencyLayer, readCertifiedDependencyLayer, selectDependencyRuntimePayload, selectPublishedDependencyRuntimePayload, verifyDependencyLayer, } from "./dependency-layer.js";
 export { listRecordedEndpoints, liveReleaseIds, probeOwnership, readEndpointMetadata, removeEndpointArtifacts, sweepDeadEndpoints } from "./endpoints.js";

package/dist/foundation/release/ordinary-launch-selection.d.ts

@@ -0,0 +1,14 @@
+interface OrdinaryLaunchRelease {
+    readonly releaseId: string;
+    readonly packageVersion: string;
+}
+interface ApprovedOrdinaryLaunchRelease extends OrdinaryLaunchRelease {
+    readonly approval: string;
+}
+/**
+ * Ordinary launch has no rollback authority: it may advance to its installed package, but an
+ * older package installation must follow a newer approved active release instead of moving the
+ * shared selector backward. Explicit update/rollback uses CohortStateStore.activate directly.
+ */
+export declare function selectOrdinaryLaunchReleaseId(candidate: OrdinaryLaunchRelease, active?: ApprovedOrdinaryLaunchRelease): string;
+export {};

package/dist/foundation/release/ordinary-launch-selection.js

@@ -0,0 +1,15 @@
+import { compare, valid as validSemver } from "semver";
+/**
+ * Ordinary launch has no rollback authority: it may advance to its installed package, but an
+ * older package installation must follow a newer approved active release instead of moving the
+ * shared selector backward. Explicit update/rollback uses CohortStateStore.activate directly.
+ */
+export function selectOrdinaryLaunchReleaseId(candidate, active) {
+    if (!active || active.approval !== "approved")
+        return candidate.releaseId;
+    const candidateVersion = validSemver(candidate.packageVersion);
+    const activeVersion = validSemver(active.packageVersion);
+    if (!candidateVersion || !activeVersion)
+        throw new Error("ordinary launch release versions must be valid semantic versions");
+    return compare(activeVersion, candidateVersion) >= 0 ? active.releaseId : candidate.releaseId;
+}

package/dist/foundation/supervision/server.js

@@ -271,7 +271,7 @@ export class SupervisorServer {
         let result;
         try {
             if (command.type === "create-launch-instance")
-                this.#createLaunchInstance(command, socket, clientId);
+                await this.#createLaunchInstance(command, socket, clientId);
             if (command.type === "activate-launch-instance")
                 this.#activateLaunchInstance(command, socket, clientId);
             if (command.type === "begin-launch-instance-stop")
@@ -289,17 +289,28 @@ export class SupervisorServer {
         }
         catch (error) {
             const message = error instanceof Error ? error.message : String(error);
-            const code = /not found/i.test(message) ? "not-found" : /owner|ownership|authenticated/i.test(message) ? "ownership-error" : "driver-error";
+            const explicitCode = error instanceof Error && "code" in error ? error.code : undefined;
+            const code = explicitCode === "release-superseded"
+                ? "release-superseded"
+                : /not found/i.test(message) ? "not-found"
+                    : /owner|ownership|authenticated/i.test(message) ? "ownership-error" : "driver-error";
             result = { requestId: command.requestId, ok: false, revision: this.#revision, error: { code, message } };
         }
         this.#results.set(resultKey, result);
         this.#send(socket, { type: "command-result", result });
     }
-    #createLaunchInstance(command, socket, clientId) {
+    async #createLaunchInstance(command, socket, clientId) {
         assertNativeProcessIdentity(command.guardianIdentity);
         const existing = this.store.loadLaunchInstance(command.instanceId);
+        if (!existing && this.readActiveReleaseId) {
+            const active = await this.readActiveReleaseId().catch(() => null);
+            if (active !== null)
+                this.#superseded = active !== this.release.releaseId;
+        }
         if (this.#superseded && !existing) {
-            throw new Error(PRODUCT_TEXT.diagnostic(`release ${this.release.releaseId} is no longer the release new sessions start on`));
+            throw Object.assign(new Error(PRODUCT_TEXT.diagnostic(`release ${this.release.releaseId} is no longer active for new sessions`)), {
+                code: "release-superseded",
+            });
         }
         if (existing) {
             if (existing.ownerClientId !== clientId

package/dist/native/darwin-arm64/manifest.json

@@ -5,7 +5,7 @@
   "platform": "darwin",
   "architecture": "arm64",
   "capability": "supported",
-  "builtAt": "2026-09-23T11:36:01.359Z",
+  "builtAt": "2026-09-23T16:42:04.513Z",
   "artifact": {
     "filename": "process-guardian",
     "sha256": "9db1726bbe3fc2e8292f2ead1e7e9d0fd4d7d0dc9217b372582bf354b0f565dc",

package/dist/native/linux-x64/manifest.json

@@ -5,7 +5,7 @@
   "platform": "linux",
   "architecture": "x64",
   "capability": "supported",
-  "builtAt": "2026-09-23T11:35:47.633Z",
+  "builtAt": "2026-09-23T16:42:11.967Z",
   "artifact": {
     "filename": "process-guardian",
     "sha256": "d8cda6b0c7cb36c0cc41e90802aceebf6c02eaebbc08a83d7d963d2e918dbd7a",

package/dist/native/win32-x64/manifest.json

@@ -5,10 +5,10 @@
   "platform": "win32",
   "architecture": "x64",
   "capability": "supported",
-  "builtAt": "2026-09-23T11:36:31.857Z",
+  "builtAt": "2026-09-23T16:43:16.752Z",
   "artifact": {
     "filename": "process-guardian.exe",
-    "sha256": "b164cd202e968ec2a0a5d94d3ffbdbe10d94372ba44675086fb6a948e0100990",
+    "sha256": "051b57f8b1980f1cf2accf7d9f102941e5fcf74b4264f9375d924581e950b0d6",
     "size": 177664
   },
   "provenance": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@timurproko/a1",
-  "version": "0.1.8-dev.560",
+  "version": "0.1.8-dev.563",
   "description": "Standalone terminal workspace for supervised native and managed agents",
   "type": "module",
   "privateLaunchContract": "neutral-launch-v1",