@timurproko/a1 0.2.7-dev.1245 → 0.2.7-dev.1252

package/dist/foundation/release/cohort-state.js

@@ -5,31 +5,32 @@ import { selectOrdinaryLaunchReleaseId } from "./ordinary-launch-selection.js";
 import { PRODUCT_IDENTITY } from "../../product-identity.js";
 export const RELEASE_COHORT_SCHEMA = PRODUCT_IDENTITY.protocol.releaseCohortSchema;
 const RELEASE_ID_PATTERN = /^[0-9A-Za-z.+_-]+-[a-f0-9]{20}$/;
+/** How long a release stays on disk after its approval, so processes started from it keep their files. */
+export const RELEASE_RETENTION_MS = 7 * 24 * 60 * 60 * 1_000;
 /**
- * Derive protection exclusively from current selectors and ownership authorities.
- * The historical retention snapshot is deliberately not an input to this plan.
+ * Age-based retention. A release stays while a selector names it (active, its rollback, or a
+ * candidate still being certified), while an unfinished update may return to it, while the
+ * reconciling command runs from it, or while its approval is younger than the retention window.
+ * Nothing asks which processes are running: a session that outlives the window and two updates
+ * can lose its release files, which is the documented trade-off.
  */
 export function planProtectedReleases(state, inputs = {}) {
-    const holds = inputs.externalHolds ?? [];
-    for (const hold of holds) {
-        if (hold.authority !== "agent" && hold.authority !== "migration" && hold.authority !== "resident")
-            throw new Error(`unknown release hold authority: ${String(hold.authority)}`);
-        if (!state.releases[hold.releaseId] && !state.cleanup.pending[hold.releaseId]) {
-            throw new Error(`external ${hold.authority} hold names unknown release ${hold.releaseId}`);
-        }
-    }
     const protectedIds = new Set();
     for (const id of [state.references.active, state.references.pending, state.references.approved, state.references.rollback]) {
         if (id !== null)
             protectedIds.add(id);
     }
-    for (const id of inputs.liveReleaseIds ?? [])
+    for (const id of inputs.ownReleaseIds ?? [])
         protectedIds.add(id);
-    for (const hold of holds)
-        protectedIds.add(hold.releaseId);
     if (inputs.transaction?.status === "active" && inputs.transaction.priorActiveReleaseId !== null) {
         protectedIds.add(inputs.transaction.priorActiveReleaseId);
     }
+    const now = inputs.now ?? Date.now();
+    const window = inputs.retentionMs ?? RELEASE_RETENTION_MS;
+    for (const release of Object.values(state.releases)) {
+        if (withinRetention(release, now, window))
+            protectedIds.add(release.releaseId);
+    }
     const protectedReleaseIds = [...protectedIds].sort();
     const known = Object.keys(state.releases).sort();
     return {
@@ -38,6 +39,18 @@ export function planProtectedReleases(state, inputs = {}) {
         collectibleReleaseIds: known.filter(id => !protectedIds.has(id)),
     };
 }
+/**
+ * Whether a release is young enough to keep. An approved release counts from its approval; a
+ * candidate still awaiting certification counts from its materialization so concurrent work is
+ * not collected under it. A record without a readable timestamp is treated as old.
+ */
+export function withinRetention(release, now, retentionMs = RELEASE_RETENTION_MS) {
+    if (release.approval === "rejected")
+        return false;
+    const stamp = release.approval === "approved" ? release.certifiedAt : release.materializedAt;
+    const at = stamp === null ? Number.NaN : Date.parse(stamp);
+    return Number.isFinite(at) && now - at < retentionMs;
+}
 /** Serializes validated cohort-state revisions under a lock and commits each update atomically. */
 export class CohortStateStore {
     path;
@@ -103,7 +116,6 @@ export class CohortStateStore {
                     ...current.references,
                     pending: current.references.active === release.releaseId ? current.references.pending : release.releaseId,
                 },
-                activation: activation("pending", "candidate awaits certification and safe activation"),
             };
         });
     }
@@ -132,7 +144,6 @@ export class CohortStateStore {
                     approved: releaseId,
                     rollback: prior && prior !== releaseId ? prior : current.references.rollback,
                 },
-                activation: activation("idle", null),
             };
         });
     }
@@ -153,7 +164,6 @@ export class CohortStateStore {
                         pending: current.references.pending === releaseId ? null : current.references.pending,
                         approved: selectedId,
                     },
-                    activation: activation("idle", null),
                 };
             }
             const prior = current.references.active;
@@ -166,16 +176,10 @@ export class CohortStateStore {
                     approved: releaseId,
                     rollback: prior && prior !== releaseId ? prior : current.references.rollback,
                 },
-                activation: activation("idle", null),
             };
         });
     }
-    async blockPending(reason, blockerGenerationIds) {
-        return await this.update(current => ({ ...current, activation: { ...activation("blocked", reason), blockerGenerationIds: [...blockerGenerationIds] } }));
-    }
-    async rollback(ownershipReleased) {
-        if (!ownershipReleased)
-            throw new Error("cannot roll back before current cohort ownership is released");
+    async rollback() {
         return await this.update(current => {
             const rollbackId = current.references.rollback;
             if (!rollbackId)
@@ -192,17 +196,9 @@ export class CohortStateStore {
                     approved: rollbackId,
                     rollback: current.references.active,
                 },
-                activation: activation("idle", null),
             };
         });
     }
-    async setRetention(releaseIds) {
-        return await this.update(current => {
-            for (const releaseId of releaseIds)
-                requiredRelease(current, releaseId);
-            return { ...current, references: { ...current.references, retention: unique(releaseIds) } };
-        });
-    }
     /** Atomically replace legacy retention history and detach every currently collectible record. */
     async reconcileRetention(resolveInputs, orphans = []) {
         let plan = null;
@@ -318,31 +314,6 @@ export class CohortStateStore {
             error: error === null ? null : boundedError(error),
         })));
     }
-    async removeUnreferencedRelease(releaseId, externalReferences) {
-        return await this.update(current => {
-            const release = requiredRelease(current, releaseId);
-            const protectedIds = new Set([
-                current.references.active,
-                current.references.pending,
-                current.references.approved,
-                current.references.rollback,
-                ...current.references.retention,
-                ...externalReferences,
-            ].filter((value) => value !== null));
-            if (protectedIds.has(releaseId))
-                throw new Error(`release ${releaseId} is still referenced and cannot be collected`);
-            const releases = { ...current.releases };
-            delete releases[releaseId];
-            return {
-                ...current,
-                releases,
-                cleanup: {
-                    ...current.cleanup,
-                    pending: { ...current.cleanup.pending, [releaseId]: cleanupDisposition(release, "detached", null) },
-                },
-            };
-        });
-    }
 }
 export function emptyState() {
     return {
@@ -351,7 +322,6 @@ export function emptyState() {
         releases: {},
         references: { active: null, pending: null, approved: null, rollback: null, retention: [] },
         cleanup: { pending: {}, diagnostics: [], workerRuns: [] },
-        activation: activation("idle", null),
     };
 }
 function cleanupDisposition(release, stage, trashPath) {
@@ -382,16 +352,12 @@ function replaceCleanupWorkerRun(current, runId, operation) {
         : [...current.cleanup.workerRuns, operation(undefined)];
     return { ...current, cleanup: { ...current.cleanup, workerRuns: workerRuns.slice(-16) } };
 }
-function activation(state, reason) {
-    return { state, reason, blockerGenerationIds: [], updatedAt: new Date().toISOString() };
-}
 function requiredRelease(state, releaseId) {
     const release = state.releases[releaseId];
     if (!release)
         throw new Error(`unknown release ${releaseId}`);
     return release;
 }
-function unique(values) { return [...new Set(values)]; }
 async function acquireLock(path) {
     const deadline = Date.now() + 5_000;
     while (true) {
@@ -452,7 +418,9 @@ async function reclaimAbandonedLock(path) {
 function normalizeState(value) {
     if (!value || typeof value !== "object")
         return value;
-    const state = value;
+    // Compatibility: state written while supervisors coordinated activation carries an
+    // `activation` record that nothing reads any more; it is dropped on the next write.
+    const { activation: _activation, ...state } = value;
     const cleanup = state.cleanup;
     return {
         ...state,

package/dist/foundation/release/dependency-certification.d.ts

@@ -4,7 +4,7 @@ type LayerIdentity = {
     readonly contentDigest: string;
 };
 export interface ReadDependencyCertificationOptions {
-    /** Only authenticated parent-started supervisors may upgrade missing platform evidence. */
+    /** Only an authenticated parent certifying the exact release may upgrade missing platform evidence. */
     readonly allowLegacyParentCertification?: boolean;
     /** Cleanup must validate canonical evidence without migrating or falling back. */
     readonly canonicalOnly?: boolean;

package/dist/foundation/release/index.d.ts

@@ -1,21 +1,14 @@
-export { certifyMaterializedRelease, ensureSupervisor, recordParentCertifiedRelease, releaseEnvironment, releaseVerifiedIdleOwner, runBootstrap, startSupervisor, waitForProcessExit, waitForVerifiedEndpoint, } from "./bootstrap.js";
-export type { BootstrapOptions, SupervisorStartupAttempt } from "./bootstrap.js";
-export { selectCohortLaunch } from "./cohort-selection.js";
+export { certifyMaterializedRelease, recordParentCertifiedRelease, releaseEnvironment, runBootstrap, } from "./bootstrap.js";
+export type { BootstrapOptions } from "./bootstrap.js";
 export { selectOrdinaryLaunchReleaseId } from "./ordinary-launch-selection.js";
-export type { CohortLaunchDecision, OwnershipProbe } from "./cohort-selection.js";
-export { CohortStateStore, RELEASE_COHORT_SCHEMA, emptyState, planProtectedReleases } from "./cohort-state.js";
-export type { ActiveReleaseTransactionReference, CohortState, EndpointOwnership, ExternalReleaseHold, ExternalReleaseHoldAuthority, OrphanReleaseDisposition, ProtectedReleaseInputs, ProtectedReleasePlan, ReleaseApproval, ReleaseCleanupDiagnostic, ReleaseCleanupDisposition, ReleaseCleanupStage, ReleaseCleanupState, ReleaseCleanupWorkerRun, ReleaseCleanupWorkerStatus, ReleaseCleanupWorkerSummary, ReleaseRecord, ReleaseReferences, ReleaseRetentionReconciliation, SupervisorEndpointMetadata, } from "./cohort-state.js";
+export { CohortStateStore, RELEASE_COHORT_SCHEMA, RELEASE_RETENTION_MS, emptyState, planProtectedReleases, withinRetention } from "./cohort-state.js";
+export type { ActiveReleaseTransactionReference, CohortState, OrphanReleaseDisposition, ProtectedReleaseInputs, ProtectedReleasePlan, ReleaseApproval, ReleaseCleanupDiagnostic, ReleaseCleanupDisposition, ReleaseCleanupStage, ReleaseCleanupState, ReleaseCleanupWorkerRun, ReleaseCleanupWorkerStatus, ReleaseCleanupWorkerSummary, ReleaseRecord, ReleaseReferences, ReleaseRetentionReconciliation, } from "./cohort-state.js";
 export { DEPENDENCY_LAYER_MANIFEST, DEPENDENCY_LAYER_SCHEMA, RUNTIME_PAYLOAD_INVENTORY, dependencyLayerCertificationPath, dependencyReference, generateDependencyRuntimePayload, legacyDependencyLayerCertificationPath, materializeDependencyLayer, readCertifiedDependencyLayer, selectDependencyRuntimePayload, selectPublishedDependencyRuntimePayload, verifyDependencyLayer, } from "./dependency-layer.js";
 export type { DependencyLayerIdentity, DependencyLayerOperationEvent, DependencyLayerReference, GeneratedRuntimePayload, MaterializeDependencyLayerOptions, MaterializedDependencyLayer, PublishedRuntimeFileClassification, PublishedRuntimePayload, ReadCertifiedDependencyLayerOptions, RuntimePayloadExclusion, RuntimePayloadInventory, SelectedRuntimePayload, } from "./dependency-layer.js";
-export { listRecordedEndpoints, liveReleaseIds, probeOwnership, readEndpointMetadata, removeEndpointArtifacts, sweepDeadEndpoints } from "./endpoints.js";
-export { currentSupervisorStartIdentity, observeSupervisorProcess, supervisorProcessState } from "./supervisor-identity.js";
-export { withEndpointLock } from "./endpoint-lock.js";
-export type { RecordedEndpoint } from "./endpoints.js";
-export { cleanupProvenIdleOwner, cleanupVerifiedOwner, processIsAlive } from "./process-cleanup.js";
-export type { CleanupDiagnostics } from "./process-cleanup.js";
+export { processIsAlive } from "./process-liveness.js";
 export { PRODUCT_PACKAGE_NAME, createReleaseIdentity, deriveReleaseIdentity, digestManifestFiles, discoverReleasePayload, packageRootFromModule, releaseFileIdentity, resolveWithin, } from "./release.js";
 export type { DiscoverReleasePayloadOptions, DiscoveredReleasePayload, ReleaseFileIdentity, ReleaseIdentity } from "./release.js";
-export { collectRelease, prepareReleaseCleanup, runBoundedReleaseCleanup, runReleaseCleanupWorker, scheduleReleaseCleanup } from "./release-gc.js";
+export { prepareReleaseCleanup, runBoundedReleaseCleanup, runReleaseCleanupWorker, scheduleReleaseCleanup } from "./release-gc.js";
 export type { ReleaseCleanupLimits, ReleaseCleanupOperations, ReleaseCleanupOptions, ReleaseCleanupResult, ReleaseCleanupWorkerOptions } from "./release-gc.js";
 export { RELEASE_MANIFEST_FILENAME, ReleaseRepairUnavailableError, assertCertifiedFilesPresent, assertImmutableExecutionRoot, consumeMaterializationProof, materializeRelease, readCertifiedReleaseManifest, readMaterializedRelease, repairMaterializedRelease, resolveReleaseEntryPoint, verifyMaterializedRelease, } from "./release-store.js";
 export type { CertifiedReleaseRecord, MaterializeReleaseOptions, MaterializedRelease, ReadCertifiedReleaseManifestOptions, ReleaseContentOperation, ReleaseContentOperationEvent, VerifyMaterializedReleaseOptions, } from "./release-store.js";
@@ -23,11 +16,11 @@ export { createRestartSeal, readRestartCertifiedRelease, releaseCertificationDoc
 export type { RestartSeal, RestartValidationEvent } from "./restart-certification.js";
 export { STABLE_RELEASE_SCHEMA, createStableReleaseEvidence, verifyStableRegistry } from "./stable-release.js";
 export type { StableRegistryState, StableRegistryVerificationOptions, StableReleaseEvidence, StableReleaseEvidenceInput } from "./stable-release.js";
-export { PACKAGE_UNLOCK_PATIENCE_MS, UPDATE_ACTIVATION_BLOCKED_EXIT_CODE, UPDATE_ALREADY_RUNNING_EXIT_CODE, PRODUCT_PACKAGE, assertUpdatePerformanceBudget, createNpmProcessRunner, createUpdateLifecycleCoordinator, isPackageLockError, lockedPackageDiagnostic, planUpdateOwnership, renderUpdateProgressBar, runSelfUpdate, } from "./update.js";
-export type { ProcessRequest, ProcessResult, SelfUpdateOptions, UpdateActivationPhase, UpdateChannel, UpdateFileMetadata, UpdateFileSystem, UpdateLifecycleCoordinator, UpdateMaterializationProgress, UpdateMeasuredPhase, UpdateOutput, UpdateOwnershipAction, UpdatePackageReplacementInput, UpdatePerformanceEvidence, UpdatePhaseTimingEvent, UpdateProcessRunner, UpdateTransactionJournal, UpdateUnlockPatience, } from "./update.js";
-export { UPDATE_ACTIVATION_CONTRACT, UPDATE_ACTIVATION_ENTRY, UPDATE_ACTIVATION_MANIFEST_FIELD, UpdateActivationBlockedError, activateInstalledRelease, delegateActivation, readActivationContracts, runActivationEntry, } from "./update-activation.js";
+export { PACKAGE_UNLOCK_PATIENCE_MS, UPDATE_ALREADY_RUNNING_EXIT_CODE, PRODUCT_PACKAGE, assertUpdatePerformanceBudget, createNpmProcessRunner, createUpdateLifecycleCoordinator, isPackageLockError, lockedPackageDiagnostic, renderUpdateProgressBar, runSelfUpdate, } from "./update.js";
+export type { ProcessRequest, ProcessResult, SelfUpdateOptions, UpdateActivationPhase, UpdateChannel, UpdateFileMetadata, UpdateFileSystem, UpdateLifecycleCoordinator, UpdateMaterializationProgress, UpdateMeasuredPhase, UpdateOutput, UpdatePackageReplacementInput, UpdatePerformanceEvidence, UpdatePhaseTimingEvent, UpdateProcessRunner, UpdateTransactionJournal, UpdateUnlockPatience, } from "./update.js";
+export { UPDATE_ACTIVATION_CONTRACT, UPDATE_ACTIVATION_ENTRY, UPDATE_ACTIVATION_MANIFEST_FIELD, activateInstalledRelease, delegateActivation, readActivationContracts, runActivationEntry, } from "./update-activation.js";
 export type { UpdateActivationCallbacks, UpdateActivationEvent, UpdateActivationRequest } from "./update-activation.js";
-export { selectSupervisorLaunchReleaseId, selectUpdateLaunchRelease } from "./update-launch.js";
+export { selectUpdateLaunchRelease } from "./update-launch.js";
 export { UPDATE_RECOVERY_SCHEMA, cleanupUpdateRecoveryCapsules, inspectUpdateLauncherSet, npmPrefixForGlobalRoot, prepareUpdateRecoveryCapsule, readUpdateRecoveryCapsule, removeUpdateRecoveryCapsule, resolveNpmCli, runProtectedPackageReplacement, updateLauncherPaths, updateNpmInstallArguments, } from "./update-recovery.js";
 export type { ProtectedPackageReplacementOptions, ProtectedPackageReplacementResult, UpdateRecoveryCapsule, UpdateRecoveryResult } from "./update-recovery.js";
 export { UPDATE_JOURNAL_SCHEMA, UpdateTransactionStore } from "./update-transaction.js";

package/dist/foundation/release/index.js

@@ -1,20 +1,16 @@
-export { certifyMaterializedRelease, ensureSupervisor, recordParentCertifiedRelease, releaseEnvironment, releaseVerifiedIdleOwner, runBootstrap, startSupervisor, waitForProcessExit, waitForVerifiedEndpoint, } from "./bootstrap.js";
-export { selectCohortLaunch } from "./cohort-selection.js";
+export { certifyMaterializedRelease, recordParentCertifiedRelease, releaseEnvironment, runBootstrap, } from "./bootstrap.js";
 export { selectOrdinaryLaunchReleaseId } from "./ordinary-launch-selection.js";
-export { CohortStateStore, RELEASE_COHORT_SCHEMA, emptyState, planProtectedReleases } from "./cohort-state.js";
+export { CohortStateStore, RELEASE_COHORT_SCHEMA, RELEASE_RETENTION_MS, emptyState, planProtectedReleases, withinRetention } from "./cohort-state.js";
 export { DEPENDENCY_LAYER_MANIFEST, DEPENDENCY_LAYER_SCHEMA, RUNTIME_PAYLOAD_INVENTORY, dependencyLayerCertificationPath, dependencyReference, generateDependencyRuntimePayload, legacyDependencyLayerCertificationPath, materializeDependencyLayer, readCertifiedDependencyLayer, selectDependencyRuntimePayload, selectPublishedDependencyRuntimePayload, verifyDependencyLayer, } from "./dependency-layer.js";
-export { listRecordedEndpoints, liveReleaseIds, probeOwnership, readEndpointMetadata, removeEndpointArtifacts, sweepDeadEndpoints } from "./endpoints.js";
-export { currentSupervisorStartIdentity, observeSupervisorProcess, supervisorProcessState } from "./supervisor-identity.js";
-export { withEndpointLock } from "./endpoint-lock.js";
-export { cleanupProvenIdleOwner, cleanupVerifiedOwner, processIsAlive } from "./process-cleanup.js";
+export { processIsAlive } from "./process-liveness.js";
 export { PRODUCT_PACKAGE_NAME, createReleaseIdentity, deriveReleaseIdentity, digestManifestFiles, discoverReleasePayload, packageRootFromModule, releaseFileIdentity, resolveWithin, } from "./release.js";
-export { collectRelease, prepareReleaseCleanup, runBoundedReleaseCleanup, runReleaseCleanupWorker, scheduleReleaseCleanup } from "./release-gc.js";
+export { prepareReleaseCleanup, runBoundedReleaseCleanup, runReleaseCleanupWorker, scheduleReleaseCleanup } from "./release-gc.js";
 export { RELEASE_MANIFEST_FILENAME, ReleaseRepairUnavailableError, assertCertifiedFilesPresent, assertImmutableExecutionRoot, consumeMaterializationProof, materializeRelease, readCertifiedReleaseManifest, readMaterializedRelease, repairMaterializedRelease, resolveReleaseEntryPoint, verifyMaterializedRelease, } from "./release-store.js";
 export { createRestartSeal, readRestartCertifiedRelease, releaseCertificationDocument, restartSealDigest } from "./restart-certification.js";
 export { STABLE_RELEASE_SCHEMA, createStableReleaseEvidence, verifyStableRegistry } from "./stable-release.js";
-export { PACKAGE_UNLOCK_PATIENCE_MS, UPDATE_ACTIVATION_BLOCKED_EXIT_CODE, UPDATE_ALREADY_RUNNING_EXIT_CODE, PRODUCT_PACKAGE, assertUpdatePerformanceBudget, createNpmProcessRunner, createUpdateLifecycleCoordinator, isPackageLockError, lockedPackageDiagnostic, planUpdateOwnership, renderUpdateProgressBar, runSelfUpdate, } from "./update.js";
-export { UPDATE_ACTIVATION_CONTRACT, UPDATE_ACTIVATION_ENTRY, UPDATE_ACTIVATION_MANIFEST_FIELD, UpdateActivationBlockedError, activateInstalledRelease, delegateActivation, readActivationContracts, runActivationEntry, } from "./update-activation.js";
-export { selectSupervisorLaunchReleaseId, selectUpdateLaunchRelease } from "./update-launch.js";
+export { PACKAGE_UNLOCK_PATIENCE_MS, UPDATE_ALREADY_RUNNING_EXIT_CODE, PRODUCT_PACKAGE, assertUpdatePerformanceBudget, createNpmProcessRunner, createUpdateLifecycleCoordinator, isPackageLockError, lockedPackageDiagnostic, renderUpdateProgressBar, runSelfUpdate, } from "./update.js";
+export { UPDATE_ACTIVATION_CONTRACT, UPDATE_ACTIVATION_ENTRY, UPDATE_ACTIVATION_MANIFEST_FIELD, activateInstalledRelease, delegateActivation, readActivationContracts, runActivationEntry, } from "./update-activation.js";
+export { selectUpdateLaunchRelease } from "./update-launch.js";
 export { UPDATE_RECOVERY_SCHEMA, cleanupUpdateRecoveryCapsules, inspectUpdateLauncherSet, npmPrefixForGlobalRoot, prepareUpdateRecoveryCapsule, readUpdateRecoveryCapsule, removeUpdateRecoveryCapsule, resolveNpmCli, runProtectedPackageReplacement, updateLauncherPaths, updateNpmInstallArguments, } from "./update-recovery.js";
 export { UPDATE_JOURNAL_SCHEMA, UpdateTransactionStore } from "./update-transaction.js";
 export { warmMaterializedRelease } from "./warmup.js";

package/dist/foundation/release/latest-release.d.ts

@@ -1,6 +1,6 @@
 /** Published release channels: stable `X.Y.Z` on dist-tag `latest`, development `X.Y.Z-dev.N` on `next`. */
 export type ReleaseChannel = "stable" | "development";
-export type StartupUpdateMode = "auto" | "notify" | "no";
+export type StartupUpdateMode = "auto" | "no";
 export interface DistTagVersions {
     readonly release: string | null;
     readonly develop: string | null;
@@ -21,7 +21,6 @@ export interface AvailableRelease {
 }
 export declare const DEFAULT_NPM_REGISTRY = "https://registry.npmjs.org";
 export declare const UPDATE_CHECK_INTERVAL_MS: number;
-export declare const NOTIFY_CHECK_INTERVAL_MS: number;
 /** One published version with the pull request its manifest records, when it records one. */
 export interface PublishedVersion {
     readonly version: string;

package/dist/foundation/release/latest-release.js

@@ -6,7 +6,6 @@ import lockfile from "proper-lockfile";
 import { PRODUCT_IDENTITY, PRODUCT_TEXT } from "../../product-identity.js";
 export const DEFAULT_NPM_REGISTRY = "https://registry.npmjs.org";
 export const UPDATE_CHECK_INTERVAL_MS = 15 * 60_000;
-export const NOTIFY_CHECK_INTERVAL_MS = 24 * 60 * 60_000;
 const STARTUP_FETCH_TIMEOUT_MS = 3_000;
 const CACHE_FILENAME = "update-check.json";
 const CACHE_VERSION = 2;
@@ -146,7 +145,7 @@ export async function checkForNewerRelease(options) {
     const now = options.now ?? Date.now;
     const cachePath = join(options.configDir, CACHE_FILENAME);
     try {
-        const interval = options.settingMode === "notify" ? NOTIFY_CHECK_INTERVAL_MS : UPDATE_CHECK_INTERVAL_MS;
+        const interval = UPDATE_CHECK_INTERVAL_MS;
         const latest = await withCacheLock(options.configDir, async () => {
             if (options.signal?.aborted)
                 return null;

package/dist/foundation/release/process-liveness.d.ts

@@ -0,0 +1,2 @@
+/** Whether a process with this id exists; a permission refusal still proves it is running. */
+export declare function processIsAlive(pid: number): boolean;

package/dist/foundation/release/process-liveness.js

@@ -0,0 +1,12 @@
+/** Whether a process with this id exists; a permission refusal still proves it is running. */
+export function processIsAlive(pid) {
+    if (!Number.isSafeInteger(pid) || pid <= 0)
+        return false;
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        return error instanceof Error && "code" in error && error.code === "EPERM";
+    }
+}

package/dist/foundation/release/release-gc.d.ts

@@ -1,8 +1,7 @@
 import { rename, rm } from "node:fs/promises";
-import { CohortStateStore, type ExternalReleaseHold, type OrphanReleaseDisposition } from "./cohort-state.js";
+import { CohortStateStore, type OrphanReleaseDisposition } from "./cohort-state.js";
 import type { ProductPaths } from "../lifecycle/index.js";
 import { UpdateTransactionStore } from "./update-transaction.js";
-import { type ResidentReleaseHoldReport } from "../resident-tabs/index.js";
 export interface ReleaseCleanupLimits {
     readonly maxItems: number;
     readonly maxDurationMs: number;
@@ -13,7 +12,15 @@ export interface ReleaseCleanupOperations {
     readonly remove?: typeof rm;
 }
 export interface ReleaseCleanupOptions {
-    readonly externalHolds?: readonly ExternalReleaseHold[];
+    /**
+     * Releases the command that started cleanup runs from. Defaults to the release named by this
+     * process's launch context, so a command never collects the files it is running.
+     */
+    readonly ownReleaseIds?: readonly string[];
+    /** Age window measured from approval; defaults to seven days. */
+    readonly retentionMs?: number;
+    /** Wall clock the retention window is measured against; `now` only paces a batch. */
+    readonly wallClock?: () => number;
     readonly transactionStore?: Pick<UpdateTransactionStore, "read">;
     readonly limits?: Partial<ReleaseCleanupLimits>;
     readonly candidateAgeMs?: number;
@@ -22,8 +29,6 @@ export interface ReleaseCleanupOptions {
     readonly operations?: ReleaseCleanupOperations;
     /** Process-start seam for scheduler and continuation tests. */
     readonly workerSpawner?: (entry: string, environment: NodeJS.ProcessEnv) => Promise<void>;
-    /** Resident-tab inspection seam; the default asks a verified installed terminal host. */
-    readonly residentHolds?: (dataDir: string, releaseRoots: readonly string[]) => Promise<ResidentReleaseHoldReport>;
 }
 export interface ReleaseCleanupWorkerOptions {
     readonly cleanup?: ReleaseCleanupOptions;
@@ -53,10 +58,10 @@ interface DiscoveredCleanupInputs {
     }[];
 }
 /**
- * Reconcile current ownership under the cohort-state lock and durably detach obsolete releases.
+ * Reconcile age-based retention under the cohort-state lock and durably detach obsolete releases.
  * This operation intentionally reads only manifests and directory metadata, never payload bytes.
  */
-export declare function prepareReleaseCleanup(dataDir: string, paths?: ProductPaths, options?: ReleaseCleanupOptions): Promise<{
+export declare function prepareReleaseCleanup(dataDir: string, _paths?: ProductPaths, options?: ReleaseCleanupOptions): Promise<{
     readonly store: CohortStateStore;
     readonly discovered: DiscoveredCleanupInputs;
 }>;
@@ -69,6 +74,4 @@ export declare function runBoundedReleaseCleanup(dataDir: string, paths?: Produc
 export declare function scheduleReleaseCleanup(dataDir: string, paths: ProductPaths, options?: ReleaseCleanupOptions): Promise<void>;
 /** Entry used by the private cleanup executable shipped in every immutable release. */
 export declare function runReleaseCleanupWorker(environment?: NodeJS.ProcessEnv, workerOptions?: ReleaseCleanupWorkerOptions): Promise<ReleaseCleanupResult>;
-/** Compatibility helper: detach one requested release and execute a one-item pass. */
-export declare function collectRelease(store: CohortStateStore, dataDir: string, releaseId: string, externalReferences: readonly string[], paths?: ProductPaths): Promise<void>;
 export {};

package/dist/foundation/release/release-gc.js

@@ -4,7 +4,6 @@ import { lstat, mkdir, open, readFile, readdir, realpath, rename, rm, stat } fro
 import { dirname, isAbsolute, relative, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
 import { CohortStateStore, } from "./cohort-state.js";
-import { liveReleaseIds } from "./endpoints.js";
 import { resolveProductPaths } from "../lifecycle/index.js";
 import { RELEASE_MANIFEST_FILENAME } from "./release-store.js";
 import { DEPENDENCY_LAYER_MANIFEST, readCertifiedDependencyLayer } from "./dependency-layer.js";
@@ -14,24 +13,25 @@ import { UpdateTransactionStore } from "./update-transaction.js";
 import { cleanupUpdateRecoveryCapsules } from "./update-recovery.js";
 import { PRODUCT_IDENTITY } from "../../product-identity.js";
 import { collectCompileCaches, startupCompileCachePath } from "../startup/index.js";
-import { readResidentReleaseHolds } from "../resident-tabs/index.js";
+import { readLaunchContext } from "../launch-context/index.js";
+import { processIsAlive } from "./process-liveness.js";
 const DEFAULT_CANDIDATE_AGE_MS = 60 * 60 * 1_000;
 const DEFAULT_LIMITS = { maxItems: 8, maxDurationMs: 2_000, concurrency: 1 };
 const DEFAULT_WORKER_DURATION_MS = 10 * 60 * 1_000;
 const DEFAULT_NO_PROGRESS_BATCHES = 5;
 const DEFAULT_RETRY_DELAY_MS = 500;
-const WORKER_HOLDS_ENV = "RELEASE_CLEANUP_HOLDS";
+const WORKER_KEEP_ENV = "RELEASE_CLEANUP_KEEP";
 const WORKER_RUN_ID_ENV = "RELEASE_CLEANUP_RUN_ID";
 const WORKER_LEASE_FILENAME = "release-cleanup-worker.lock";
 /**
- * Reconcile current ownership under the cohort-state lock and durably detach obsolete releases.
+ * Reconcile age-based retention under the cohort-state lock and durably detach obsolete releases.
  * This operation intentionally reads only manifests and directory metadata, never payload bytes.
  */
-export async function prepareReleaseCleanup(dataDir, paths, options = {}) {
+export async function prepareReleaseCleanup(dataDir, _paths, options = {}) {
     const store = new CohortStateStore(dataDir);
     const discovered = await discoverCleanupInputs(dataDir, store, options);
     const transactionStore = options.transactionStore ?? new UpdateTransactionStore(dataDir);
-    await store.reconcileRetention(async () => await protectionInputs(dataDir, paths, transactionStore, options.externalHolds ?? [], options.residentHolds), discovered.orphans);
+    await store.reconcileRetention(async () => await protectionInputs(transactionStore, options), discovered.orphans);
     for (const diagnostic of discovered.diagnostics.slice(0, 16)) {
         await store.recordCleanupFailure(diagnostic.releaseId, diagnostic.stage, diagnostic.error);
     }
@@ -42,7 +42,7 @@ export async function runBoundedReleaseCleanup(dataDir, paths, options = {}) {
     const now = options.now ?? Date.now;
     const limits = normalizeLimits(options.limits);
     const { store, discovered } = await prepareReleaseCleanup(dataDir, paths, options);
-    // Performance: The physical-work allowance begins after discovery, ownership probes, and the
+    // Performance: The physical-work allowance begins after discovery and the
     // durable reconciliation write. A slow preparation phase must not starve every worker invocation.
     const startedAt = now();
     const initial = await store.read();
@@ -67,7 +67,7 @@ export async function runBoundedReleaseCleanup(dataDir, paths, options = {}) {
             pendingOffset += size;
             maximum -= size;
             attempted += batch.length;
-            const results = await Promise.all(batch.map(async (disposition) => await collectDisposition(store, dataDir, paths, disposition, options)));
+            const results = await Promise.all(batch.map(async (disposition) => await collectDisposition(store, dataDir, disposition, options)));
             completed += results.filter(Boolean).length;
             guaranteed = false;
         }
@@ -78,7 +78,7 @@ export async function runBoundedReleaseCleanup(dataDir, paths, options = {}) {
             maximum -= 1;
             const certificationId = certificationReleaseId(artifact);
             if (certificationId !== null) {
-                const inputs = await protectionInputs(dataDir, paths, transactionStore, options.externalHolds ?? [], options.residentHolds);
+                const inputs = await protectionInputs(transactionStore, options);
                 if (isProtectedDetachedRelease(await store.read(), inputs, certificationId))
                     continue;
             }
@@ -137,7 +137,7 @@ export async function scheduleReleaseCleanup(dataDir, paths, options = {}) {
         ...process.env,
         [PRODUCT_IDENTITY.environment.dataDir]: dataDir,
         [PRODUCT_IDENTITY.environment.runtimeDir]: paths.runtimeDir,
-        [WORKER_HOLDS_ENV]: JSON.stringify(options.externalHolds ?? []),
+        [WORKER_KEEP_ENV]: JSON.stringify(ownReleaseIds(options)),
         [WORKER_RUN_ID_ENV]: runId,
     };
     try {
@@ -158,7 +158,7 @@ export async function runReleaseCleanupWorker(environment = process.env, workerO
     const sleep = workerOptions.sleep ?? (async (durationMs) => await new Promise(resolvePromise => setTimeout(resolvePromise, durationMs)));
     const cleanupOptions = {
         ...workerOptions.cleanup,
-        externalHolds: workerOptions.cleanup?.externalHolds ?? parseWorkerHolds(environment[WORKER_HOLDS_ENV]),
+        ownReleaseIds: workerOptions.cleanup?.ownReleaseIds ?? parseWorkerKeep(environment[WORKER_KEEP_ENV]),
     };
     const summary = { batches: 0, attempted: 0, completed: 0, remaining: Object.keys((await store.read()).cleanup.pending).length };
     let lease = null;
@@ -227,24 +227,10 @@ export async function runReleaseCleanupWorker(environment = process.env, workerO
         durationMs: Math.max(0, now() - startedAt),
     };
 }
-/** Compatibility helper: detach one requested release and execute a one-item pass. */
-export async function collectRelease(store, dataDir, releaseId, externalReferences, paths) {
-    const holds = externalReferences.map(referenced => ({ authority: "migration", releaseId: referenced }));
-    const state = await store.read();
-    if (!state.releases[releaseId])
-        throw new Error(`unknown release ${releaseId}`);
-    await store.reconcileRetention(async () => ({ ...(await protectionInputs(dataDir, paths, new UpdateTransactionStore(dataDir), holds)) }));
-    const disposition = (await store.read()).cleanup.pending[releaseId];
-    if (!disposition)
-        throw new Error(`release ${releaseId} is still referenced and cannot be collected`);
-    const removed = await collectDisposition(store, dataDir, paths, disposition, { externalHolds: holds, limits: { maxItems: 1 } });
-    if (!removed)
-        throw new Error(`release ${releaseId} could not be collected`);
-}
-async function collectDisposition(store, dataDir, paths, disposition, options) {
+async function collectDisposition(store, dataDir, disposition, options) {
     const releaseId = disposition.release.releaseId;
     try {
-        const inputs = await protectionInputs(dataDir, paths, options.transactionStore ?? new UpdateTransactionStore(dataDir), options.externalHolds ?? [], options.residentHolds);
+        const inputs = await protectionInputs(options.transactionStore ?? new UpdateTransactionStore(dataDir), options);
         const current = await store.read();
         if (isProtectedDetachedRelease(current, inputs, releaseId))
             return false;
@@ -285,67 +271,30 @@ async function collectDisposition(store, dataDir, paths, disposition, options) {
 function isProtectedDetachedRelease(state, inputs, releaseId) {
     const selected = [state.references.active, state.references.pending, state.references.approved, state.references.rollback]
         .some(reference => reference === releaseId);
+    // Concurrency: a launch may have recorded the same release again after it was detached.
     return selected
-        || (inputs.liveReleaseIds ?? []).includes(releaseId)
-        || (inputs.externalHolds ?? []).some(hold => hold.releaseId === releaseId)
+        || state.releases[releaseId] !== undefined
+        || (inputs.ownReleaseIds ?? []).includes(releaseId)
         || (inputs.transaction?.status === "active" && inputs.transaction.priorActiveReleaseId === releaseId);
 }
-async function protectionInputs(dataDir, paths, transactionStore, externalHolds, residentHolds) {
-    const [liveIds, transaction, resident] = await Promise.all([
-        paths ? liveReleaseIds(paths) : Promise.resolve([]),
-        transactionStore.read(),
-        residentReleaseHolds(dataDir, residentHolds),
-    ]);
-    return { liveReleaseIds: liveIds, externalHolds: [...externalHolds, ...resident], transaction: transactionReference(transaction) };
+async function protectionInputs(transactionStore, options) {
+    return {
+        ownReleaseIds: ownReleaseIds(options),
+        transaction: transactionReference(await transactionStore.read()),
+        now: (options.wallClock ?? Date.now)(),
+        ...(options.retentionMs === undefined ? {} : { retentionMs: options.retentionMs }),
+    };
 }
-/**
- * Holds every release a live resident server, holder, or tab child runs from. Retention fails
- * closed: an incomplete report, or a recorded root inside the release store that names no known
- * release, holds every known release.
- */
-async function residentReleaseHolds(dataDir, reader) {
-    const state = await new CohortStateStore(dataDir).read();
-    const records = [
-        ...Object.values(state.releases),
-        ...Object.values(state.cleanup.pending).map(disposition => disposition.release),
-    ];
-    const preferred = [state.references.active, state.references.rollback]
-        .flatMap(id => id && state.releases[id] ? [state.releases[id].releaseRoot] : []);
-    const roots = [...new Set([...preferred, ...Object.values(state.releases).map(record => record.releaseRoot)])];
-    const report = await (reader ?? ((directory, releaseRoots) => readResidentReleaseHolds({ dataDir: directory, releaseRoots })))(dataDir, roots);
-    const everything = () => [...new Set(records.map(record => record.releaseId))].map(releaseId => ({ authority: "resident", releaseId }));
-    if (!report.complete)
-        return everything();
-    if (report.releaseRoots.length === 0)
+function ownReleaseIds(options) {
+    if (options.ownReleaseIds !== undefined)
+        return options.ownReleaseIds;
+    try {
+        const own = readLaunchContext(process.env).releaseId;
+        return own === undefined ? [] : [own];
+    }
+    catch {
         return [];
-    // Rationale: native Windows extended paths and Unix aliases must match the catalog's spelling.
-    const byRoot = new Map();
-    for (const record of records) {
-        const canonical = await realpath(record.releaseRoot).catch(() => record.releaseRoot);
-        byRoot.set(comparablePath(canonical), record.releaseId);
-    }
-    const directory = await realpath(resolve(dataDir, "releases")).catch(() => null);
-    if (directory === null)
-        return everything();
-    const store = comparablePath(directory);
-    const holds = new Set();
-    for (const root of report.releaseRoots) {
-        // Security: an unresolved live root may alias managed content; uncertainty must retain it.
-        const canonical = await realpath(root).catch(() => null);
-        if (canonical === null)
-            return everything();
-        const key = comparablePath(canonical);
-        const releaseId = byRoot.get(key);
-        if (releaseId)
-            holds.add(releaseId);
-        else if (key.startsWith(`${store}${sep}`))
-            return everything();
-    }
-    return [...holds].sort().map(releaseId => ({ authority: "resident", releaseId }));
-}
-function comparablePath(path) {
-    const absolute = resolve(path);
-    return process.platform === "win32" ? absolute.toLowerCase() : absolute;
+    }
 }
 function transactionReference(transaction) {
     return transaction === null ? null : { status: transaction.status, priorActiveReleaseId: transaction.priorActiveReleaseId };
@@ -779,25 +728,12 @@ async function readWorkerLease(path) {
         return null;
     }
 }
-function processIsAlive(pid) {
-    try {
-        process.kill(pid, 0);
-        return true;
-    }
-    catch (error) {
-        return error instanceof Error && "code" in error && error.code === "EPERM";
-    }
-}
-function parseWorkerHolds(value) {
+function parseWorkerKeep(value) {
     if (!value)
         return [];
     try {
         const parsed = JSON.parse(value);
-        if (!Array.isArray(parsed))
-            return [];
-        return parsed.filter((hold) => Boolean(hold) && typeof hold === "object"
-            && ["agent", "migration", "resident"].includes(hold.authority)
-            && typeof hold.releaseId === "string");
+        return Array.isArray(parsed) ? parsed.filter((id) => typeof id === "string" && id.length > 0) : [];
     }
     catch {
         return [];

package/dist/foundation/release/release-store.d.ts

@@ -51,8 +51,8 @@ export declare function assertCertifiedFilesPresent(releaseRoot: string): Promis
 export declare function repairMaterializedRelease(packageRoot: string, releaseRoot: string): Promise<MaterializedRelease>;
 /**
  * Load metadata for a release whose bytes were already certified by the
- * current parent process or an authenticated live supervisor. Callers must
- * establish one of those preconditions; untrusted releases require full
+ * current parent process or recorded by an authenticated certification. Callers must
+ * establish that precondition; untrusted releases require full
  * verification.
  */
 export declare function readCertifiedReleaseManifest(record: CertifiedReleaseRecord, selectedStoreRoot: string, options?: ReadCertifiedReleaseManifestOptions): Promise<MaterializedRelease>;