@timurproko/a1 0.1.8-dev.560 → 0.1.8-dev.572

package/dist/cli/package-messages.d.ts

@@ -1,6 +1,7 @@
 import chalk from "chalk";
 /** Supported subset of pinned Pi's package-manager CLI presentation. */
 export type PackageCliVerb = "install" | "remove" | "list" | "update";
+export type PackageCommandNamespace = "direct" | "pi";
 export type PackageSyntaxDiagnostic = {
     readonly verb: PackageCliVerb;
     readonly kind: "missing-source";
@@ -18,9 +19,9 @@ export type PackageSyntaxDiagnostic = {
     readonly message: string;
 };
 type MessageStyle = Pick<typeof chalk, "red" | "dim" | "bold">;
-export declare function packageCommandUsage(verb: PackageCliVerb): string;
+export declare function packageCommandUsage(verb: PackageCliVerb, namespace?: PackageCommandNamespace): string;
 /** Diagnostic facts stay unstyled until the terminal boundary decides color support. */
-export declare function renderPackageSyntax(diagnostic: PackageSyntaxDiagnostic, style?: MessageStyle): string;
+export declare function renderPackageSyntax(diagnostic: PackageSyntaxDiagnostic, namespace?: PackageCommandNamespace, style?: MessageStyle): string;
 /** Pi's help layout, with unsupported options and examples deliberately absent. */
-export declare function packageCommandHelp(verb: PackageCliVerb, style?: MessageStyle): string;
+export declare function packageCommandHelp(verb: PackageCliVerb, namespace?: PackageCommandNamespace, style?: MessageStyle): string;
 export {};

package/dist/cli/package-messages.js

@@ -2,21 +2,26 @@
 // at 914cf1472e715297caa30db4b9535d534a9eb718 (MIT); grammar is restricted to A1's supported subset.
 import chalk from "chalk";
 import { PRODUCT_TEXT } from "../product-identity.js";
-export function packageCommandUsage(verb) {
-    const command = `${PRODUCT_TEXT.commandName} pi ${verb}`;
+export function packageCommandUsage(verb, namespace = "pi") {
+    const command = namespace === "direct"
+        ? `${PRODUCT_TEXT.commandName} ${verb}`
+        : `${PRODUCT_TEXT.commandName} pi ${verb}`;
     if (verb === "install" || verb === "remove")
         return `${command} <source>`;
+    if (verb === "update" && namespace === "direct") {
+        return `${command} [--develop [preview-or-version]|--models|--extensions|source]`;
+    }
     if (verb === "update")
         return `${command} [source|--extensions|--models]`;
     return command;
 }
 /** Diagnostic facts stay unstyled until the terminal boundary decides color support. */
-export function renderPackageSyntax(diagnostic, style = chalk) {
-    const usage = packageCommandUsage(diagnostic.verb);
+export function renderPackageSyntax(diagnostic, namespace = "pi", style = chalk) {
+    const usage = packageCommandUsage(diagnostic.verb, namespace);
     let message;
     if (diagnostic.kind === "unknown-option") {
         return `${style.red(`Unknown option ${diagnostic.value} for "${diagnostic.verb}".`)}\n`
-            + `${style.dim(`Use "${PRODUCT_TEXT.commandName} --help" or "${usage}".`)}\n`;
+            + `${style.dim(`Use "${PRODUCT_TEXT.commandName} help" or "${usage}".`)}\n`;
     }
     if (diagnostic.kind === "missing-source")
         message = `Missing ${diagnostic.verb} source.`;
@@ -27,9 +32,16 @@ export function renderPackageSyntax(diagnostic, style = chalk) {
     return `${style.red(message)}\n${style.dim(`Usage: ${usage}`)}\n`;
 }
 /** Pi's help layout, with unsupported options and examples deliberately absent. */
-export function packageCommandHelp(verb, style = chalk) {
-    const command = `${PRODUCT_TEXT.commandName} pi`;
-    const header = `${style.bold("Usage:")}\n  ${packageCommandUsage(verb)}\n\n`;
+export function packageCommandHelp(verb, namespace = "pi", style = chalk) {
+    const command = namespace === "direct" ? PRODUCT_TEXT.commandName : `${PRODUCT_TEXT.commandName} pi`;
+    const header = verb === "update" && namespace === "direct"
+        ? `${style.bold("Usage:")}\n`
+            + `  ${command} update\n`
+            + `  ${command} update --develop [preview-or-version]\n`
+            + `  ${command} update --models\n`
+            + `  ${command} update --extensions\n`
+            + `  ${command} update <source>\n\n`
+        : `${style.bold("Usage:")}\n  ${packageCommandUsage(verb, namespace)}\n\n`;
     switch (verb) {
         case "install":
             return header + `Install a package and add it to settings.
@@ -55,14 +67,14 @@ Examples:
         case "list":
             return header + "List installed packages from user settings.\n\n";
         case "update":
-            return header + `Update installed packages or model catalogs.
+            return header + `${namespace === "direct" ? "Update A1, installed packages, or model catalogs." : "Update installed packages or model catalogs."}
 
 Options:
-  --extensions            Update installed packages only
+${namespace === "direct" ? "  --develop [target]     Update to the development channel or one preview\n" : ""}  --extensions            Update installed packages only
   --models                Refresh model catalogs only
 
 Short forms:
-  ${command} update --extensions   Update installed packages only
+${namespace === "direct" ? `  ${command} update                Update A1 to the stable release\n  ${command} update --develop      Update A1 to the development preview\n` : ""}  ${command} update --extensions   Update installed packages only
   ${command} update --models       Refresh model catalogs only
   ${command} update <source>       Update one package
 

package/dist/foundation/launch-guardian/main.js

@@ -2,10 +2,9 @@ import { randomUUID } from "node:crypto";
 import { PRODUCT_TEXT } from "../../product-identity.js";
 import { readLaunchContext } from "../launch-context/index.js";
 import { resolve } from "node:path";
-import { assertLaunchProfileId, sessionSelectionArguments } from "../lifecycle/index.js";
+import { assertLaunchProfileId, resolveCohortEndpoint, resolveProductPaths, sessionSelectionArguments } from "../lifecycle/index.js";
 import { closeVerifiedContainment, DarwinNativeProcessInspector, LinuxNativeProcessInspector, NativeGuardianContainment, resolveProcessGuardianPath, verifyProcessGuardianArtifact, WindowsNativeProcessInspector, } from "../process-containment/index.js";
 import { SupervisorClient } from "../protocol/index.js";
-import { resolveCohortEndpoint, resolveProductPaths } from "../supervision/index.js";
 import { markStartupPhase } from "../startup/index.js";
 export async function runLaunchGuardian(options) {
     assertLaunchProfileId(options.profileId);

package/dist/foundation/lifecycle/model.d.ts

@@ -54,7 +54,7 @@ export interface CommandResult {
     readonly ok: boolean;
     readonly revision: number;
     readonly error?: {
-        readonly code: "invalid-command" | "not-found" | "stale-generation" | "capability-error" | "containment-unsupported" | "ownership-error" | "driver-error";
+        readonly code: "invalid-command" | "not-found" | "stale-generation" | "capability-error" | "containment-unsupported" | "ownership-error" | "release-superseded" | "driver-error";
         readonly message: string;
     };
 }

package/dist/foundation/release/bootstrap.js

@@ -5,6 +5,7 @@ import { connect } from "node:net";
 import { platform } from "node:os";
 import { resolve } from "node:path";
 import { selectCohortLaunch } from "./cohort-selection.js";
+import { selectOrdinaryLaunchReleaseId } from "./ordinary-launch-selection.js";
 import { CohortStateStore } from "./cohort-state.js";
 import { assertLaunchProfileId, createSupervisorStartupAttempt, readSupervisorStartupResult, resolveCohortEndpoint, resolveProductPaths, sessionSelectionArguments } from "../lifecycle/index.js";
 import { encodeFrame, LineFrameDecoder } from "../protocol/index.js";
@@ -18,7 +19,11 @@ import { createRestartSeal, readRestartCertifiedRelease, releaseCertificationDoc
 import { PRODUCT_IDENTITY, PRODUCT_TEXT } from "../../product-identity.js";
 import { markStartupPhase } from "../startup/index.js";
 import { launchContractTarget, readLaunchContext, withLaunchContext } from "../launch-context/index.js";
+const RELEASE_RESELECTION_MESSAGE = "a1-release-reselection";
 export async function runBootstrap(options) {
+    return await runBootstrapAttempt(options, 1);
+}
+async function runBootstrapAttempt(options, retriesRemaining) {
     const environment = withLaunchContext(options.environment ?? process.env, { launchProfile: options.launchIntent?.profileId ?? "a1" });
     await markStartupPhase(environment, "bootstrap-start");
     const launchProfileId = options.launchIntent?.profileId ?? "a1";
@@ -29,6 +34,15 @@ export async function runBootstrap(options) {
     const output = options.output ?? process.stderr;
     const paths = resolveProductPaths(environment);
     await mkdir(paths.runtimeDir, { recursive: true, mode: 0o700 });
+    const launchSelected = async (release) => {
+        const result = await launchUi(release, environment, sessionArgs);
+        if (!result.releaseSuperseded)
+            return result.code;
+        if (retriesRemaining > 0)
+            return await runBootstrapAttempt(options, retriesRemaining - 1);
+        output.write(`${PRODUCT_TEXT.diagnostic("active release changed repeatedly during startup; launch could not converge")}\n`);
+        return 1;
+    };
     const stateStore = new CohortStateStore(paths.dataDir);
     let state = await stateStore.read();
     const launchDuringUpdate = async () => {
@@ -41,7 +55,7 @@ export async function runBootstrap(options) {
             return null;
         const retained = await readCertifiedReleaseManifest(prior, resolve(paths.dataDir, "releases"));
         await ensureSupervisor(retained, environment);
-        return await launchUi(retained, environment, sessionArgs);
+        return await launchSelected(retained);
     };
     const duringUpdate = await launchDuringUpdate();
     if (duringUpdate !== null)
@@ -82,7 +96,7 @@ export async function runBootstrap(options) {
             && endpoint.contentDigest === active.contentDigest;
         if (endpointMatches && probe === "live-verified") {
             const retained = await readCertifiedReleaseManifest(active, resolve(paths.dataDir, "releases"));
-            return await launchUi(retained, environment, sessionArgs);
+            return await launchSelected(retained);
         }
         if (endpoint === null || probe === "dead") {
             if (endpoint)
@@ -100,7 +114,7 @@ export async function runBootstrap(options) {
             await markStartupPhase(environment, "replacement-supervisor-start");
             await ensureSupervisor(retained, environment);
             await markStartupPhase(environment, "replacement-supervisor-ready");
-            return await launchUi(retained, environment, sessionArgs);
+            return await launchSelected(retained);
         }
     }
     // Concurrency: an installation being replaced is not a reason to refuse a launch. While
@@ -112,7 +126,7 @@ export async function runBootstrap(options) {
         candidate = await materializeRelease(options.packageRoot, paths.dataDir);
     }
     catch (error) {
-        const fallback = await launchRetainedActive(state, paths, environment, sessionArgs, output);
+        const fallback = await launchRetainedActive(state, paths, environment, launchSelected);
         if (fallback === null)
             throw error;
         return fallback;
@@ -121,24 +135,32 @@ export async function runBootstrap(options) {
     const afterMaterialization = await launchDuringUpdate();
     if (afterMaterialization !== null)
         return afterMaterialization;
+    state = await stateStore.read();
+    const ordinarySelection = !activeIsLaunchable
+        ? candidate.releaseId
+        : selectOrdinaryLaunchReleaseId(candidate, state.references.active === null ? undefined : state.releases[state.references.active]);
+    if (ordinarySelection !== candidate.releaseId) {
+        const retainedRecord = state.releases[ordinarySelection];
+        if (!retainedRecord || retainedRecord.approval !== "approved")
+            throw new Error("selected active release is not approved");
+        const retained = await readCertifiedReleaseManifest(retainedRecord, resolve(paths.dataDir, "releases"));
+        await ensureSupervisor(retained, environment);
+        return await launchSelected(retained);
+    }
     await stateStore.recordCandidate(candidate);
     state = await stateStore.read();
-    if (!state.references.active) {
+    if (state.releases[candidate.releaseId]?.approval !== "approved") {
         const diagnosticsPath = await certifyMaterializedRelease(candidate, paths.dataDir);
         await stateStore.approve(candidate.releaseId, diagnosticsPath);
-        await stateStore.activate(candidate.releaseId);
-        state = await stateStore.read();
     }
-    else if (!activeIsLaunchable && candidate.releaseId !== activeId
-        && state.releases[candidate.releaseId]?.approval !== "approved") {
-        // Invariant: the active reference points at a copy that cannot launch, so reusing it
-        // is off the table — but an unapproved candidate would lose the selection
-        // below to that same broken active (`start-active`). Approving the healed
-        // candidate here lets ordinary cohort selection activate it, while a live
-        // busy cohort still wins the endpoint checks and keeps its sessions.
-        const diagnosticsPath = await certifyMaterializedRelease(candidate, paths.dataDir);
-        await stateStore.approve(candidate.releaseId, diagnosticsPath);
-        state = await stateStore.read();
+    state = await stateStore.activateForLaunch(candidate.releaseId, !activeIsLaunchable ? activeId ?? undefined : undefined);
+    if (state.references.active !== candidate.releaseId) {
+        const retainedRecord = state.references.active === null ? undefined : state.releases[state.references.active];
+        if (!retainedRecord || retainedRecord.approval !== "approved")
+            throw new Error("ordinary launch has no approved active release");
+        const retained = await readCertifiedReleaseManifest(retainedRecord, resolve(paths.dataDir, "releases"));
+        await ensureSupervisor(retained, environment);
+        return await launchSelected(retained);
     }
     // Protocol: the candidate's own endpoint decides whether this launch attaches or starts a supervisor.
     // A cohort other than this one is not in the way: it listens somewhere else.
@@ -146,7 +168,7 @@ export async function runBootstrap(options) {
     endpoint = await readEndpointMetadata(endpointPaths.endpointMetadataPath);
     if (endpoint === null) {
         const legacy = await readEndpointMetadata(paths.endpointMetadataPath);
-        if (legacy !== null) {
+        if (legacy?.releaseId === candidate.releaseId) {
             endpoint = legacy;
             endpointPaths = { endpoint: paths.endpoint, endpointMetadataPath: paths.endpointMetadataPath };
         }
@@ -170,11 +192,14 @@ export async function runBootstrap(options) {
         await removeEndpointArtifacts(endpointPaths.endpointMetadataPath, endpointPaths.endpoint);
     }
     if (decision.action === "launch-retained-ui") {
-        const retained = await verifyMaterializedRelease(decision.releaseRoot, undefined, resolve(paths.dataDir, "releases"));
+        const retainedRecord = state.releases[decision.releaseId];
+        const retained = retainedRecord?.approval === "approved"
+            ? await readCertifiedReleaseManifest(retainedRecord, resolve(paths.dataDir, "releases"))
+            : await verifyMaterializedRelease(decision.releaseRoot, undefined, resolve(paths.dataDir, "releases"));
         if (decision.recordPending && endpoint) {
             await stateStore.blockPending("candidate activation deferred by live non-resumable instances", endpoint.ownership.nonResumableInstanceIds);
         }
-        const code = await launchUi(retained, environment, sessionArgs);
+        const code = await launchSelected(retained);
         if (decision.recordPending)
             await activatePendingAfterBlockerExit(candidate, stateStore, paths, environment);
         return code;
@@ -204,15 +229,23 @@ export async function runBootstrap(options) {
             const diagnosticsPath = await certifyMaterializedRelease(candidate, paths.dataDir);
             await stateStore.approve(candidate.releaseId, diagnosticsPath);
         }
-        if ((await stateStore.read()).references.active !== candidate.releaseId)
-            await stateStore.activate(candidate.releaseId);
-        selected = candidate;
+        const activated = (await stateStore.read()).references.active === candidate.releaseId
+            ? await stateStore.read()
+            : await stateStore.activateForLaunch(candidate.releaseId);
+        if (activated.references.active === candidate.releaseId)
+            selected = candidate;
+        else {
+            const retainedRecord = activated.references.active === null ? undefined : activated.releases[activated.references.active];
+            if (!retainedRecord || retainedRecord.approval !== "approved")
+                throw new Error("ordinary launch has no approved active release");
+            selected = await readCertifiedReleaseManifest(retainedRecord, resolve(paths.dataDir, "releases"));
+        }
     }
     else {
         selected = await readMaterializedRelease(decision.releaseRoot);
     }
     await ensureSupervisor(selected, environment);
-    return await launchUi(selected, environment, sessionArgs);
+    return await launchSelected(selected);
 }
 /**
  * Start the retained active cohort when the installed payload cannot be taken. The
@@ -220,7 +253,7 @@ export async function runBootstrap(options) {
  * certifying anything new, and reports no selection when there is nothing safe
  * to fall back to.
  */
-async function launchRetainedActive(state, paths, environment, sessionArgs, output) {
+async function launchRetainedActive(state, paths, environment, launch) {
     const activeId = state.references.active;
     const active = activeId === null ? undefined : state.releases[activeId];
     if (!active || active.approval !== "approved")
@@ -228,8 +261,7 @@ async function launchRetainedActive(state, paths, environment, sessionArgs, outp
     try {
         const retained = await readCertifiedReleaseManifest(active, resolve(paths.dataDir, "releases"));
         await ensureSupervisor(retained, environment);
-        output.write(`${PRODUCT_TEXT.diagnostic(`installation is being replaced; starting the retained release ${retained.packageVersion}`)}\n`);
-        return await launchUi(retained, environment, sessionArgs);
+        return await launch(retained);
     }
     catch {
         return null;
@@ -300,13 +332,24 @@ async function launchUi(release, environment, sessionArgs) {
     await markStartupPhase(environment, "bootstrap-selected");
     const entry = await resolveReleaseEntryPoint(release, "bin/guardian.js");
     return await new Promise((resolvePromise, rejectPromise) => {
+        let releaseSuperseded = false;
         const child = spawn(process.execPath, [entry, ...sessionArgs], {
             env: releaseEnvironment(environment, release, readLaunchContext(environment, "profile").launchProfile),
-            stdio: "inherit",
+            stdio: ["inherit", "inherit", "inherit", "ipc"],
             windowsHide: false,
         });
+        child.on("message", message => {
+            if (message && typeof message === "object" && "type" in message && message.type === RELEASE_RESELECTION_MESSAGE) {
+                releaseSuperseded = true;
+            }
+        });
         child.once("error", rejectPromise);
-        child.once("close", (code, signal) => resolvePromise(restoreAfterOwnedExit(readLaunchContext(environment).launchProfile === "a1", code, signal)));
+        child.once("close", (code, signal) => resolvePromise({
+            code: releaseSuperseded
+                ? code ?? 1
+                : restoreAfterOwnedExit(readLaunchContext(environment).launchProfile === "a1", code, signal),
+            releaseSuperseded,
+        }));
     });
 }
 /**

package/dist/foundation/release/cohort-state.d.ts

@@ -140,6 +140,8 @@ export declare class CohortStateStore {
     recordCandidate(release: MaterializedRelease): Promise<CohortState>;
     approve(releaseId: string, diagnosticsPath: string): Promise<CohortState>;
     activate(releaseId: string): Promise<CohortState>;
+    /** Atomically advances ordinary launch without allowing an older installation to roll active state back. */
+    activateForLaunch(releaseId: string, replaceUnlaunchableActiveId?: string): Promise<CohortState>;
     blockPending(reason: string, blockerGenerationIds: readonly string[]): Promise<CohortState>;
     rollback(ownershipReleased: boolean): Promise<CohortState>;
     setRetention(releaseIds: readonly string[]): Promise<CohortState>;

package/dist/foundation/release/cohort-state.js

@@ -1,6 +1,7 @@
 import { randomUUID } from "node:crypto";
 import { mkdir, open, readFile, rename, rm, stat } from "node:fs/promises";
 import { dirname, resolve } from "node:path";
+import { selectOrdinaryLaunchReleaseId } from "./ordinary-launch-selection.js";
 import { PRODUCT_IDENTITY } from "../../product-identity.js";
 export const RELEASE_COHORT_SCHEMA = PRODUCT_IDENTITY.protocol.releaseCohortSchema;
 const RELEASE_ID_PATTERN = /^[0-9A-Za-z.+_-]+-[a-f0-9]{20}$/;
@@ -135,6 +136,40 @@ export class CohortStateStore {
             };
         });
     }
+    /** Atomically advances ordinary launch without allowing an older installation to roll active state back. */
+    async activateForLaunch(releaseId, replaceUnlaunchableActiveId) {
+        return await this.update(current => {
+            const release = requiredRelease(current, releaseId);
+            if (release.approval !== "approved")
+                throw new Error(`cannot activate unverified release ${releaseId}`);
+            const selectedId = current.references.active === replaceUnlaunchableActiveId
+                ? releaseId
+                : selectOrdinaryLaunchReleaseId(release, current.references.active === null ? undefined : current.releases[current.references.active]);
+            if (selectedId !== releaseId) {
+                return {
+                    ...current,
+                    references: {
+                        ...current.references,
+                        pending: current.references.pending === releaseId ? null : current.references.pending,
+                        approved: selectedId,
+                    },
+                    activation: activation("idle", null),
+                };
+            }
+            const prior = current.references.active;
+            return {
+                ...current,
+                references: {
+                    ...current.references,
+                    active: releaseId,
+                    pending: null,
+                    approved: releaseId,
+                    rollback: prior && prior !== releaseId ? prior : current.references.rollback,
+                },
+                activation: activation("idle", null),
+            };
+        });
+    }
     async blockPending(reason, blockerGenerationIds) {
         return await this.update(current => ({ ...current, activation: { ...activation("blocked", reason), blockerGenerationIds: [...blockerGenerationIds] } }));
     }

package/dist/foundation/release/index.d.ts

@@ -1,6 +1,7 @@
 export { certifyMaterializedRelease, ensureSupervisor, recordParentCertifiedRelease, releaseEnvironment, releaseVerifiedIdleOwner, runBootstrap, startSupervisor, waitForProcessExit, waitForVerifiedEndpoint, } from "./bootstrap.js";
 export type { BootstrapOptions, SupervisorStartupAttempt } from "./bootstrap.js";
 export { selectCohortLaunch } from "./cohort-selection.js";
+export { selectOrdinaryLaunchReleaseId } from "./ordinary-launch-selection.js";
 export type { CohortLaunchDecision, OwnershipProbe } from "./cohort-selection.js";
 export { CohortStateStore, RELEASE_COHORT_SCHEMA, emptyState, planProtectedReleases } from "./cohort-state.js";
 export type { ActiveReleaseTransactionReference, CohortState, EndpointOwnership, ExternalReleaseHold, ExternalReleaseHoldAuthority, OrphanReleaseDisposition, ProtectedReleaseInputs, ProtectedReleasePlan, ReleaseApproval, ReleaseCleanupDiagnostic, ReleaseCleanupDisposition, ReleaseCleanupStage, ReleaseCleanupState, ReleaseCleanupWorkerRun, ReleaseCleanupWorkerStatus, ReleaseCleanupWorkerSummary, ReleaseRecord, ReleaseReferences, ReleaseRetentionReconciliation, SupervisorEndpointMetadata, } from "./cohort-state.js";

package/dist/foundation/release/index.js

@@ -1,5 +1,6 @@
 export { certifyMaterializedRelease, ensureSupervisor, recordParentCertifiedRelease, releaseEnvironment, releaseVerifiedIdleOwner, runBootstrap, startSupervisor, waitForProcessExit, waitForVerifiedEndpoint, } from "./bootstrap.js";
 export { selectCohortLaunch } from "./cohort-selection.js";
+export { selectOrdinaryLaunchReleaseId } from "./ordinary-launch-selection.js";
 export { CohortStateStore, RELEASE_COHORT_SCHEMA, emptyState, planProtectedReleases } from "./cohort-state.js";
 export { DEPENDENCY_LAYER_MANIFEST, DEPENDENCY_LAYER_SCHEMA, RUNTIME_PAYLOAD_INVENTORY, dependencyLayerCertificationPath, dependencyReference, generateDependencyRuntimePayload, legacyDependencyLayerCertificationPath, materializeDependencyLayer, readCertifiedDependencyLayer, selectDependencyRuntimePayload, selectPublishedDependencyRuntimePayload, verifyDependencyLayer, } from "./dependency-layer.js";
 export { listRecordedEndpoints, liveReleaseIds, probeOwnership, readEndpointMetadata, removeEndpointArtifacts, sweepDeadEndpoints } from "./endpoints.js";

package/dist/foundation/release/ordinary-launch-selection.d.ts

@@ -0,0 +1,14 @@
+interface OrdinaryLaunchRelease {
+    readonly releaseId: string;
+    readonly packageVersion: string;
+}
+interface ApprovedOrdinaryLaunchRelease extends OrdinaryLaunchRelease {
+    readonly approval: string;
+}
+/**
+ * Ordinary launch has no rollback authority: it may advance to its installed package, but an
+ * older package installation must follow a newer approved active release instead of moving the
+ * shared selector backward. Explicit update/rollback uses CohortStateStore.activate directly.
+ */
+export declare function selectOrdinaryLaunchReleaseId(candidate: OrdinaryLaunchRelease, active?: ApprovedOrdinaryLaunchRelease): string;
+export {};

package/dist/foundation/release/ordinary-launch-selection.js

@@ -0,0 +1,15 @@
+import { compare, valid as validSemver } from "semver";
+/**
+ * Ordinary launch has no rollback authority: it may advance to its installed package, but an
+ * older package installation must follow a newer approved active release instead of moving the
+ * shared selector backward. Explicit update/rollback uses CohortStateStore.activate directly.
+ */
+export function selectOrdinaryLaunchReleaseId(candidate, active) {
+    if (!active || active.approval !== "approved")
+        return candidate.releaseId;
+    const candidateVersion = validSemver(candidate.packageVersion);
+    const activeVersion = validSemver(active.packageVersion);
+    if (!candidateVersion || !activeVersion)
+        throw new Error("ordinary launch release versions must be valid semantic versions");
+    return compare(activeVersion, candidateVersion) >= 0 ? active.releaseId : candidate.releaseId;
+}

package/dist/foundation/supervision/server.js

@@ -271,7 +271,7 @@ export class SupervisorServer {
         let result;
         try {
             if (command.type === "create-launch-instance")
-                this.#createLaunchInstance(command, socket, clientId);
+                await this.#createLaunchInstance(command, socket, clientId);
             if (command.type === "activate-launch-instance")
                 this.#activateLaunchInstance(command, socket, clientId);
             if (command.type === "begin-launch-instance-stop")
@@ -289,17 +289,28 @@ export class SupervisorServer {
         }
         catch (error) {
             const message = error instanceof Error ? error.message : String(error);
-            const code = /not found/i.test(message) ? "not-found" : /owner|ownership|authenticated/i.test(message) ? "ownership-error" : "driver-error";
+            const explicitCode = error instanceof Error && "code" in error ? error.code : undefined;
+            const code = explicitCode === "release-superseded"
+                ? "release-superseded"
+                : /not found/i.test(message) ? "not-found"
+                    : /owner|ownership|authenticated/i.test(message) ? "ownership-error" : "driver-error";
             result = { requestId: command.requestId, ok: false, revision: this.#revision, error: { code, message } };
         }
         this.#results.set(resultKey, result);
         this.#send(socket, { type: "command-result", result });
     }
-    #createLaunchInstance(command, socket, clientId) {
+    async #createLaunchInstance(command, socket, clientId) {
         assertNativeProcessIdentity(command.guardianIdentity);
         const existing = this.store.loadLaunchInstance(command.instanceId);
+        if (!existing && this.readActiveReleaseId) {
+            const active = await this.readActiveReleaseId().catch(() => null);
+            if (active !== null)
+                this.#superseded = active !== this.release.releaseId;
+        }
         if (this.#superseded && !existing) {
-            throw new Error(PRODUCT_TEXT.diagnostic(`release ${this.release.releaseId} is no longer the release new sessions start on`));
+            throw Object.assign(new Error(PRODUCT_TEXT.diagnostic(`release ${this.release.releaseId} is no longer active for new sessions`)), {
+                code: "release-superseded",
+            });
         }
         if (existing) {
             if (existing.ownerClientId !== clientId

package/dist/integrations/pi/components/shell-footer-status.d.ts

@@ -1,7 +1,8 @@
 import type { OwnedUiSessionViewModel } from "../../../contracts/owned-ui/index.js";
-import { type PiShellViewComponentPort, type PiShellStatusPort, type PiShellQueuedInputPort, type PiShellHeaderPort, type PiShellResourceEntry, type PiShellLoadedResourcesPort, type PiShellHeaderOptions, type PiShellEditorOptions } from "./shell-shared-facade.js";
+import { type KeybindingsConfig } from "./upstream/adjacent/core/keybindings.js";
+import { type PiShellViewComponentPort, type PiShellStatusPort, type PiShellProgressStatusPresentation, type PiShellQueuedInputPort, type PiShellHeaderPort, type PiShellResourceEntry, type PiShellLoadedResourcesPort, type PiShellHeaderOptions, type PiShellEditorOptions } from "./shell-shared-facade.js";
 export declare function createPiShellHeader(options?: PiShellHeaderOptions): PiShellHeaderPort;
 export declare function createPiShellLoadedResources(resources: readonly PiShellResourceEntry[], initialExpanded?: boolean): PiShellLoadedResourcesPort;
-export declare function createPiShellStatus(view: OwnedUiSessionViewModel, formatProgressStatus: (message: string) => string, runtime?: Pick<PiShellEditorOptions, "getColumns" | "getRows" | "requestRender">): PiShellStatusPort;
+export declare function createPiShellStatus(view: OwnedUiSessionViewModel, progressStatus: PiShellProgressStatusPresentation, runtime?: Pick<PiShellEditorOptions, "getColumns" | "getRows" | "requestRender">): PiShellStatusPort;
 export declare function createPiShellFooter(view: OwnedUiSessionViewModel, cwd: string, profile?: "pi" | "a1", showLevel?: () => boolean): PiShellViewComponentPort;
-export declare function createPiQueuedInputStatus(submissions: readonly string[], presentation?: "pinned" | "custom-viewport"): PiShellQueuedInputPort;
+export declare function createPiQueuedInputStatus(submissions: readonly string[], presentation?: "pinned" | "custom-viewport", getKeybindings?: () => KeybindingsConfig): PiShellQueuedInputPort;