@timurproko/a1 0.2.7-dev.1249 → 0.2.7-dev.1252

package/dist/foundation/release/bootstrap.js

@@ -1,17 +1,11 @@
 import { spawn } from "node:child_process";
-import { RESIDENT_DETACH_INTERVAL_MS, restoreAfterOwnedExit } from "../terminal-cleanup/index.js";
-import { chmod, mkdir, readFile, rm, writeFile } from "node:fs/promises";
-import { connect } from "node:net";
+import { randomUUID } from "node:crypto";
+import { deliverExitNotice, restoreAfterOwnedExit } from "../terminal-cleanup/index.js";
+import { chmod, mkdir, readFile, writeFile } from "node:fs/promises";
 import { resolve } from "node:path";
-import { selectCohortLaunch } from "./cohort-selection.js";
-import { recoverSupervisorEndpoint } from "./endpoint-recovery.js";
 import { selectOrdinaryLaunchReleaseId } from "./ordinary-launch-selection.js";
-import { releaseChannelOf } from "./latest-release.js";
 import { CohortStateStore } from "./cohort-state.js";
-import { assertLaunchProfileId, createSupervisorStartupAttempt, readSupervisorStartupResult, resolveCohortEndpoint, resolveProductPaths, sessionSelectionArguments } from "../lifecycle/index.js";
-import { encodeFrame, LineFrameDecoder } from "../protocol/index.js";
-import { cleanupProvenIdleOwner, processIsAlive } from "./process-cleanup.js";
-import { probeOwnership, readEndpointMetadata, removeEndpointArtifacts, sweepDeadEndpoints } from "./endpoints.js";
+import { assertLaunchProfileId, resolveProductPaths, sessionSelectionArguments } from "../lifecycle/index.js";
 import { UpdateTransactionStore } from "./update-transaction.js";
 import { selectUpdateLaunchRelease } from "./update-launch.js";
 import { assertCertifiedFilesPresent, consumeMaterializationProof, materializeRelease, readCertifiedReleaseManifest, readMaterializedRelease, repairMaterializedRelease, resolveReleaseEntryPoint, verifyMaterializedRelease } from "./release-store.js";
@@ -19,25 +13,14 @@ import { scheduleReleaseCleanup } from "./release-gc.js";
 import { createRestartSeal, readRestartCertifiedRelease, releaseCertificationDocument } from "./restart-certification.js";
 import { PRODUCT_IDENTITY, PRODUCT_TEXT } from "../../product-identity.js";
 import { markStartupPhase } from "../startup/index.js";
-import { PRIVATE_ENVIRONMENT, isCurrentLaunchContract, launchContractTarget, readLaunchContext, withLaunchContext } from "../launch-context/index.js";
-import { assertResidentContinuity, ensureTerminalHost, readResidentTabLaunchSettings, selectResidentHost } from "../resident-tabs/index.js";
+import { launchContractTarget, readLaunchContext, withLaunchContext } from "../launch-context/index.js";
 const RELEASE_RESELECTION_MESSAGE = "a1-release-reselection";
 export async function runBootstrap(options) {
-    try {
-        return await runBootstrapAttempt(options, 1);
-    }
-    catch (error) {
-        if (!(error instanceof Error && "code" in error && typeof error.code === "string" && error.code.startsWith("SUPERVISOR_RECOVERY_")))
-            throw error;
-        // Rationale: actionable recovery failures are a single line, not an uncaught Node stack trace.
-        (options.output ?? process.stderr).write(`${PRODUCT_TEXT.diagnostic(error.message)}\n`);
-        return 1;
-    }
+    return await runBootstrapAttempt(options, 1);
 }
 async function runBootstrapAttempt(options, retriesRemaining) {
     const launchProfileId = options.launchIntent?.profileId ?? "a1";
-    const launchMode = options.launchIntent?.launchMode ?? (launchProfileId === "a1" ? "tabs" : "solo");
-    const environment = withLaunchContext(options.environment ?? process.env, { launchProfile: launchProfileId, launchMode });
+    const environment = withLaunchContext(options.environment ?? process.env, { launchProfile: launchProfileId });
     await markStartupPhase(environment, "bootstrap-start");
     assertLaunchProfileId(launchProfileId);
     const sessionArgs = sessionSelectionArguments(options.launchIntent?.sessionSelection);
@@ -48,8 +31,7 @@ async function runBootstrapAttempt(options, retriesRemaining) {
     const paths = resolveProductPaths(environment);
     await mkdir(paths.runtimeDir, { recursive: true, mode: 0o700 });
     const launchSelected = async (release) => {
-        const residentContext = await residentLaunchContext(options, release, environment);
-        const result = await launchUi(release, environment, sessionArgs, residentContext);
+        const result = await launchUi(release, environment, sessionArgs, paths.runtimeDir);
         if (!result.releaseSuperseded)
             return result.code;
         if (retriesRemaining > 0)
@@ -68,41 +50,16 @@ async function runBootstrapAttempt(options, retriesRemaining) {
         if (!prior)
             return null;
         const retained = await readCertifiedReleaseManifest(prior, resolve(paths.dataDir, "releases"));
-        await ensureSupervisor(retained, environment);
         return await launchSelected(retained);
     };
     const duringUpdate = await launchDuringUpdate();
     if (duringUpdate !== null)
         return duringUpdate;
-    // Invariant: records left by cohorts whose processes are gone say nothing about ownership, and there
-    // can now be several of them. Clearing them first keeps the decision below about what is
-    // actually running.
-    await sweepDeadEndpoints(paths).catch(() => []);
     // Performance: reconciliation is serialized by cohort state, but launch never awaits a physical
     // backlog. The scheduler commits a plan and starts a detached bounded worker.
     const scheduleMaintenance = options.scheduleMaintenance ?? scheduleReleaseCleanup;
     void scheduleMaintenance(paths.dataDir, paths).catch(() => { });
-    // Protocol: each cohort keeps its own endpoint, so a launch looks for the endpoint of the release it
-    // is about to run rather than for the one endpoint the runtime directory used to have.
-    const activeReleaseId = state.references.active;
-    let endpointPaths = activeReleaseId === null
-        ? { endpoint: paths.endpoint, endpointMetadataPath: paths.endpointMetadataPath }
-        : resolveCohortEndpoint(paths, activeReleaseId, environment);
-    let endpoint = await readEndpointMetadata(endpointPaths.endpointMetadataPath);
-    if (endpoint === null) {
-        // Compatibility: a release that predates cohort-scoped endpoints published one endpoint for the whole
-        // runtime directory. Recognizing it is what lets a session started by that release keep
-        // working through the first launch that knows about cohorts.
-        const legacy = await readEndpointMetadata(paths.endpointMetadataPath);
-        if (legacy !== null) {
-            endpoint = legacy;
-            endpointPaths = { endpoint: paths.endpoint, endpointMetadataPath: paths.endpointMetadataPath };
-        }
-    }
-    let probe = endpoint ? await probeOwnership(endpoint) : "dead";
     const installedVersion = await readInstalledVersion(options.packageRoot);
-    if (releaseChannelOf(installedVersion) !== null)
-        environment[PRIVATE_ENVIRONMENT.updateVersion] = installedVersion;
     const activeId = state.references.active;
     const active = activeId === null ? undefined : state.releases[activeId];
     let activeIsLaunchable = active === undefined || (options.releaseIsLaunchable?.(active.releaseRoot) ?? true);
@@ -123,16 +80,7 @@ async function runBootstrapAttempt(options, retriesRemaining) {
         }
     }
     if (activeIsLaunchable && active?.approval === "approved" && active.packageVersion === installedVersion) {
-        const endpointMatches = endpoint?.releaseId === active.releaseId
-            && endpoint.releaseRoot === active.releaseRoot
-            && endpoint.contentDigest === active.contentDigest;
-        if (endpointMatches && probe === "live-verified") {
-            const retained = await readCertifiedReleaseManifest(active, resolve(paths.dataDir, "releases"));
-            return await launchSelected(retained);
-        }
-        if (endpoint === null || probe === "dead") {
-            if (endpoint)
-                await removeEndpointArtifacts(endpointPaths.endpointMetadataPath, endpointPaths.endpoint, endpoint);
+        {
             await markStartupPhase(environment, "durable-validation-start");
             const retained = await readRestartCertifiedRelease(active, paths.dataDir).catch(async () => {
                 let verified;
@@ -149,9 +97,6 @@ async function runBootstrapAttempt(options, retriesRemaining) {
             }).catch(() => null);
             if (retained !== null) {
                 await markStartupPhase(environment, "durable-validation-complete");
-                await markStartupPhase(environment, "replacement-supervisor-start");
-                await ensureSupervisor(retained, environment);
-                await markStartupPhase(environment, "replacement-supervisor-ready");
                 return await launchSelected(retained);
             }
             activeIsLaunchable = false;
@@ -167,7 +112,7 @@ async function runBootstrapAttempt(options, retriesRemaining) {
         candidate = await materializeRelease(options.packageRoot, paths.dataDir);
     }
     catch (error) {
-        const fallback = await launchRetainedActive(state, paths, environment, launchSelected, excludedRetainedReleaseId);
+        const fallback = await launchRetainedActive(state, paths, launchSelected, excludedRetainedReleaseId);
         if (fallback === null)
             throw error;
         return fallback;
@@ -185,7 +130,6 @@ async function runBootstrapAttempt(options, retriesRemaining) {
         if (!retainedRecord || retainedRecord.approval !== "approved")
             throw new Error("selected active release is not approved");
         const retained = await readCertifiedReleaseManifest(retainedRecord, resolve(paths.dataDir, "releases"));
-        await ensureSupervisor(retained, environment);
         return await launchSelected(retained);
     }
     await stateStore.recordCandidate(candidate);
@@ -194,133 +138,15 @@ async function runBootstrapAttempt(options, retriesRemaining) {
         const diagnosticsPath = await certifyMaterializedRelease(candidate, paths.dataDir);
         await stateStore.approve(candidate.releaseId, diagnosticsPath);
     }
-    try {
-        await assertResidentContinuity({ releaseRoot: candidate.releaseRoot, dataDir: paths.dataDir, environment,
-            profileRoot: environment[PRODUCT_IDENTITY.environment.profileHome] ?? paths.configDir, runtimeDir: paths.runtimeDir });
-    }
-    catch (error) {
-        const fallback = await launchRetainedActive(await stateStore.read(), paths, environment, launchSelected, excludedRetainedReleaseId);
-        if (fallback !== null)
-            return fallback;
-        throw error;
-    }
     state = await stateStore.activateForLaunch(candidate.releaseId, !activeIsLaunchable ? activeId ?? undefined : undefined);
     if (state.references.active !== candidate.releaseId) {
         const retainedRecord = state.references.active === null ? undefined : state.releases[state.references.active];
         if (!retainedRecord || retainedRecord.approval !== "approved")
             throw new Error("ordinary launch has no approved active release");
         const retained = await readCertifiedReleaseManifest(retainedRecord, resolve(paths.dataDir, "releases"));
-        await ensureSupervisor(retained, environment);
         return await launchSelected(retained);
     }
-    // Protocol: the candidate's own endpoint decides whether this launch attaches or starts a supervisor.
-    // A cohort other than this one is not in the way: it listens somewhere else.
-    endpointPaths = resolveCohortEndpoint(paths, candidate.releaseId, environment);
-    endpoint = await readEndpointMetadata(endpointPaths.endpointMetadataPath);
-    if (endpoint === null) {
-        const legacy = await readEndpointMetadata(paths.endpointMetadataPath);
-        if (legacy?.releaseId === candidate.releaseId) {
-            endpoint = legacy;
-            endpointPaths = { endpoint: paths.endpoint, endpointMetadataPath: paths.endpointMetadataPath };
-        }
-    }
-    probe = endpoint ? await probeOwnership(endpoint) : "dead";
-    let decision = selectCohortLaunch(candidate, state, endpoint, probe);
-    if (decision.action === "blocked") {
-        // Concurrency: reread through the common recovery path rather than fail on an old snapshot.
-        await ensureSupervisor(candidate, environment);
-        return await launchSelected(candidate);
-    }
-    if (endpoint && probe === "dead") {
-        await removeEndpointArtifacts(endpointPaths.endpointMetadataPath, endpointPaths.endpoint, endpoint);
-    }
-    if (decision.action === "launch-retained-ui") {
-        const retainedRecord = state.releases[decision.releaseId];
-        const retained = retainedRecord?.approval === "approved"
-            ? await readCertifiedReleaseManifest(retainedRecord, resolve(paths.dataDir, "releases"))
-            : await verifyMaterializedRelease(decision.releaseRoot, undefined, resolve(paths.dataDir, "releases"));
-        if (decision.recordPending && endpoint) {
-            await stateStore.blockPending("candidate activation deferred by live non-resumable instances", endpoint.ownership.nonResumableInstanceIds);
-        }
-        const code = await launchSelected(retained);
-        if (decision.recordPending)
-            await activatePendingAfterBlockerExit(candidate, stateStore, paths, environment);
-        return code;
-    }
-    if (decision.action === "replace-idle-cohort" && endpoint) {
-        const diagnosticsPath = await certifyMaterializedRelease(candidate, paths.dataDir);
-        await stateStore.approve(candidate.releaseId, diagnosticsPath);
-        const released = await requestIdleOwnershipRelease(endpoint, candidate.releaseId, 2_000);
-        if (!released) {
-            await stateStore.blockPending("idle supervisor did not verify ownership release", endpoint.ownership.liveInstanceIds);
-            output.write(`${PRODUCT_TEXT.diagnostic("could not verify idle cohort ownership release; the retained release remains selected.")}\n`);
-            return 1;
-        }
-        if (!await releaseVerifiedIdleOwner(endpoint, paths.dataDir)) {
-            await stateStore.blockPending("idle supervisor acknowledged release but did not terminate", endpoint.ownership.liveInstanceIds);
-            output.write(`${PRODUCT_TEXT.diagnostic("could not complete bounded idle cohort shutdown; the candidate remains pending.")}\n`);
-            return 1;
-        }
-        await removeEndpointArtifacts(endpointPaths.endpointMetadataPath, endpointPaths.endpoint, endpoint);
-        await stateStore.activate(candidate.releaseId);
-        decision = { action: "activate-candidate", releaseId: candidate.releaseId, releaseRoot: candidate.releaseRoot, reason: "idle cohort released ownership" };
-    }
-    let selected;
-    if (decision.action === "activate-candidate") {
-        const current = await stateStore.read();
-        if (current.releases[candidate.releaseId]?.approval !== "approved") {
-            const diagnosticsPath = await certifyMaterializedRelease(candidate, paths.dataDir);
-            await stateStore.approve(candidate.releaseId, diagnosticsPath);
-        }
-        const activated = (await stateStore.read()).references.active === candidate.releaseId
-            ? await stateStore.read()
-            : await stateStore.activateForLaunch(candidate.releaseId);
-        if (activated.references.active === candidate.releaseId)
-            selected = candidate;
-        else {
-            const retainedRecord = activated.references.active === null ? undefined : activated.releases[activated.references.active];
-            if (!retainedRecord || retainedRecord.approval !== "approved")
-                throw new Error("ordinary launch has no approved active release");
-            selected = await readCertifiedReleaseManifest(retainedRecord, resolve(paths.dataDir, "releases"));
-        }
-    }
-    else {
-        selected = await readMaterializedRelease(decision.releaseRoot);
-    }
-    await ensureSupervisor(selected, environment);
-    return await launchSelected(selected);
-}
-/** Select only client routing; a resident reconnect never asks execution to restart. */
-async function residentLaunchContext(options, release, environment) {
-    const paths = resolveProductPaths(environment);
-    const profileId = options.launchIntent?.profileId ?? "a1";
-    const mode = options.launchIntent?.launchMode ?? (profileId === "a1" ? "tabs" : "solo");
-    const agentProfileDir = environment.PI_CODING_AGENT_DIR ?? paths.configDir;
-    const residentLaunchSettings = profileId === "a1" ? readResidentTabLaunchSettings(agentProfileDir, PRODUCT_IDENTITY.commandName, paths.configDir, profileId) : null;
-    const resident = await selectResidentHost({
-        profileId, currentLaunchContract: isCurrentLaunchContract(release), solo: mode === "solo",
-        interactive: options.interactiveTerminal ?? (process.stdin.isTTY === true && process.stdout.isTTY === true),
-        ensureHost: async () => (options.ensureTerminalHost ?? ensureTerminalHost)({
-            releaseRoot: release.releaseRoot, profileRoot: environment[PRODUCT_IDENTITY.environment.profileHome] ?? paths.configDir,
-            dataDir: paths.dataDir, runtimeDir: paths.runtimeDir, environment,
-            maxConcurrentStarts: (await residentLaunchSettings).maxConcurrentStarts, unresponsiveRestartSeconds: (await residentLaunchSettings).unresponsiveRestartSeconds,
-        }),
-    });
-    if (resident === null)
-        return {};
-    if (resident.status !== "ready")
-        return { residentFallback: resident.reason };
-    return {
-        residentRootExecutable: resident.executable.executable,
-        residentRootArguments: JSON.stringify([
-            resident.executable.entry, "attach", "--workspace", "--endpoint", resident.endpoint,
-            "--cwd", process.cwd(), "--clear-exit-ms", String(RESIDENT_DETACH_INTERVAL_MS),
-            "--profile", environment[PRODUCT_IDENTITY.environment.profileHome] ?? paths.configDir,
-            "--settings-file", resolve(agentProfileDir, "settings.json"), "--accent-color", (await residentLaunchSettings).accentColor,
-            "--data-dir", paths.dataDir, "--runtime-dir", paths.runtimeDir,
-            "--release-root", release.releaseRoot, "--node-executable", process.execPath,
-        ]),
-    };
+    return await launchSelected(candidate);
 }
 /**
  * Start the retained active cohort when the installed payload cannot be taken. The
@@ -328,14 +154,13 @@ async function residentLaunchContext(options, release, environment) {
  * certifying anything new, and reports no selection when there is nothing safe
  * to fall back to.
  */
-async function launchRetainedActive(state, paths, environment, launch, excludedReleaseId) {
+async function launchRetainedActive(state, paths, launch, excludedReleaseId) {
     const activeId = state.references.active;
     const active = activeId === null ? undefined : state.releases[activeId];
     if (!active || active.approval !== "approved" || active.releaseId === excludedReleaseId)
         return null;
     try {
         const retained = await readCertifiedReleaseManifest(active, resolve(paths.dataDir, "releases"));
-        await ensureSupervisor(retained, environment);
         return await launch(retained);
     }
     catch {
@@ -376,50 +201,23 @@ export async function recordParentCertifiedRelease(release, dataDir) {
     await chmod(path, 0o400);
     return path;
 }
-/** Reuse a verified owner, or join the winner if another launch starts the same cohort first. */
-export async function ensureSupervisor(release, environment) {
-    const paths = resolveCohortEndpoint(resolveProductPaths(environment), release.releaseId, environment);
-    await recoverSupervisorEndpoint({
-        metadataPath: paths.endpointMetadataPath,
-        endpoint: paths.endpoint,
-        matches: metadata => endpointMatchesRelease(metadata, release),
-        startAndWait: async () => {
-            const startup = await startSupervisor(release, environment);
-            await waitForVerifiedEndpoint(paths.endpointMetadataPath, release, 8_000, startup);
-        },
-    });
-}
-function endpointMatchesRelease(metadata, release) {
-    return metadata.releaseId === release.releaseId && metadata.releaseRoot === release.releaseRoot
-        && metadata.contentDigest === release.contentDigest;
-}
-export async function startSupervisor(release, environment) {
-    const entry = await resolveReleaseEntryPoint(release, "bin/supervisor.js");
-    const paths = resolveProductPaths(environment);
-    const attempt = await createSupervisorStartupAttempt(paths.runtimeDir, release.releaseId);
-    const child = spawn(process.execPath, [entry, "--startup-attempt", attempt.attemptId], {
-        detached: true,
-        env: releaseEnvironment(environment, release),
-        stdio: "ignore",
-        windowsHide: true,
-    });
-    const childOutcome = new Promise(resolvePromise => {
-        child.once("close", (exitCode, signal) => resolvePromise({ exitCode, signal }));
-    });
-    await new Promise((resolvePromise, rejectPromise) => {
-        child.once("spawn", resolvePromise);
-        child.once("error", rejectPromise);
-    });
-    child.unref();
-    return { ...attempt, childOutcome };
-}
-async function launchUi(release, environment, sessionArgs, residentContext = {}) {
+/**
+ * Run the selected release's UI as the one attached child. The launcher still owns the terminal,
+ * so when the child ends uncleanly it restores the terminal and prints any notice the UI left armed.
+ */
+async function launchUi(release, environment, sessionArgs, runtimeDir) {
     await markStartupPhase(environment, "bootstrap-selected");
-    const entry = await resolveReleaseEntryPoint(release, "bin/guardian.js");
+    const entry = await resolveReleaseEntryPoint(release, "bin/ui.js");
+    const ownsTerminal = readLaunchContext(environment).launchProfile === "a1";
+    const noticeDirectory = resolve(runtimeDir, "exit-notices");
+    const noticePath = resolve(noticeDirectory, `${randomUUID()}.notice`);
+    if (ownsTerminal)
+        await mkdir(noticeDirectory, { recursive: true, mode: 0o700 });
+    const launchEnvironment = releaseEnvironment(environment, release, readLaunchContext(environment, "profile").launchProfile);
+    if (ownsTerminal)
+        launchEnvironment[PRODUCT_IDENTITY.environment.exitNoticePath] = noticePath;
     return await new Promise((resolvePromise, rejectPromise) => {
         let releaseSuperseded = false;
-        const releaseEnv = releaseEnvironment(environment, release, readLaunchContext(environment, "profile").launchProfile);
-        const launchEnvironment = Object.keys(residentContext).length === 0 ? releaseEnv : withLaunchContext(releaseEnv, { ...readLaunchContext(releaseEnv), ...residentContext }, process.platform, launchContractTarget(release));
         const child = spawn(process.execPath, [entry, ...sessionArgs], {
             env: launchEnvironment,
             stdio: ["inherit", "inherit", "inherit", "ipc"],
@@ -431,12 +229,13 @@ async function launchUi(release, environment, sessionArgs, residentContext = {})
             }
         });
         child.once("error", rejectPromise);
-        child.once("close", (code, signal) => resolvePromise({
-            code: releaseSuperseded
-                ? code ?? 1
-                : restoreAfterOwnedExit(readLaunchContext(environment).launchProfile === "a1", code, signal),
-            releaseSuperseded,
-        }));
+        child.once("close", (code, signal) => {
+            const outcome = releaseSuperseded ? code ?? 1 : restoreAfterOwnedExit(ownsTerminal, code, signal);
+            // Invariant: the UI removes its notice on a clean exit; one still armed means the UI died.
+            if (ownsTerminal)
+                deliverExitNotice(noticePath, message => process.stderr.write(message));
+            resolvePromise({ code: outcome, releaseSuperseded });
+        });
     });
 }
 /**
@@ -445,121 +244,11 @@ async function launchUi(release, environment, sessionArgs, residentContext = {})
  * version instead of failing while an installation is being replaced.
  */
 export function releaseEnvironment(environment, release, profile) {
-    const context = readLaunchContext(environment);
     return withLaunchContext(environment, {
         releaseId: release.releaseId,
         releaseLayers: (release.dependencyLayers ?? []).map(layer => layer.layerId).join(","),
         releaseRoot: release.releaseRoot,
         releaseDigest: release.contentDigest,
         ...(profile === undefined ? {} : { launchProfile: profile }),
-        ...(context.launchMode === undefined ? {} : { launchMode: context.launchMode }),
-        ...(context.updateVersion === undefined ? {} : { updateVersion: context.updateVersion }),
     }, process.platform, launchContractTarget(release));
 }
-export async function waitForVerifiedEndpoint(path, release, timeoutMs, startup) {
-    const deadline = Date.now() + timeoutMs;
-    let childOutcome = null;
-    let collision = null;
-    void startup?.childOutcome.then(outcome => { childOutcome = outcome; });
-    while (Date.now() < deadline) {
-        const metadata = await readEndpointMetadata(path);
-        if (metadata && endpointMatchesRelease(metadata, release) && await probeOwnership(metadata, { attempts: 1 }) === "live-verified") {
-            if (startup)
-                await rm(startup.resultPath, { force: true });
-            return;
-        }
-        if (startup) {
-            const result = await readSupervisorStartupResult(startup.resultPath, startup.attemptId, startup.releaseId);
-            if (result?.outcome === "failure") {
-                const error = Object.assign(new Error(PRODUCT_TEXT.diagnostic(`supervisor startup failed at ${result.stage}: ${result.message}`)), {
-                    code: result.code ?? "SUPERVISOR_STARTUP_FAILED",
-                });
-                if (result.code !== "EADDRINUSE")
-                    throw error;
-                // Concurrency: the winning process may not have published its authenticated metadata yet.
-                collision = error;
-            }
-        }
-        if (childOutcome && !collision)
-            throw new Error(PRODUCT_TEXT.diagnostic(`supervisor exited before readiness: ${JSON.stringify(childOutcome)}`));
-        await new Promise(resolvePromise => setTimeout(resolvePromise, 40));
-    }
-    if (collision)
-        throw collision;
-    throw new Error(PRODUCT_TEXT.diagnostic(`supervisor did not publish verified endpoint metadata within ${timeoutMs}ms`));
-}
-async function activatePendingAfterBlockerExit(candidate, stateStore, paths, environment) {
-    const deadline = Date.now() + 2_000;
-    let endpoint = null;
-    while (Date.now() < deadline) {
-        endpoint = await readEndpointMetadata(paths.endpointMetadataPath);
-        if (!endpoint || endpoint.ownership.liveInstanceIds.length === 0)
-            break;
-        await new Promise(resolvePromise => setTimeout(resolvePromise, 40));
-    }
-    if (!endpoint || endpoint.ownership.liveInstanceIds.length > 0 || await probeOwnership(endpoint) !== "live-verified")
-        return;
-    const diagnosticsPath = await certifyMaterializedRelease(candidate, paths.dataDir);
-    await stateStore.approve(candidate.releaseId, diagnosticsPath);
-    await assertResidentContinuity({ releaseRoot: candidate.releaseRoot, dataDir: paths.dataDir, environment,
-        profileRoot: environment[PRODUCT_IDENTITY.environment.profileHome] ?? paths.configDir, runtimeDir: paths.runtimeDir });
-    if (!await requestIdleOwnershipRelease(endpoint, candidate.releaseId, 2_000))
-        return;
-    if (!await releaseVerifiedIdleOwner(endpoint, paths.dataDir))
-        return;
-    await removeEndpointArtifacts(paths.endpointMetadataPath, paths.endpoint, endpoint);
-    await stateStore.activate(candidate.releaseId);
-    await ensureSupervisor(candidate, environment);
-}
-export async function releaseVerifiedIdleOwner(metadata, dataDir, operations = {}) {
-    try {
-        // Protocol: the owner rechecks its boot nonce and live instances before cooperative exit.
-        // A durable idle snapshot alone never authorizes a signal to a still-live process.
-        await requestIdleOwnershipRelease(metadata, metadata.releaseId, 2_000);
-        await (operations.waitForExit ?? waitForProcessExit)(metadata.pid, 3_000);
-        return true;
-    }
-    catch {
-        // Security: a lingering Windows handle can keep numeric PID probes positive after exit.
-        // Native observation may retire that exact dead boot, but never signals a still-live owner.
-        const diagnostics = await (operations.cleanup ?? cleanupProvenIdleOwner)(metadata);
-        await writeFile(resolve(dataDir, `cleanup-${Date.now()}.json`), JSON.stringify(diagnostics, null, 2));
-        return diagnostics.terminated;
-    }
-}
-async function requestIdleOwnershipRelease(metadata, candidateReleaseId, timeoutMs) {
-    return await new Promise(resolvePromise => {
-        const socket = connect(metadata.endpoint);
-        const decoder = new LineFrameDecoder();
-        let settled = false;
-        const finish = (released) => {
-            if (settled)
-                return;
-            settled = true;
-            socket.destroy();
-            resolvePromise(released);
-        };
-        socket.once("error", () => finish(false));
-        socket.once("connect", () => socket.write(encodeFrame({ type: "release-idle-ownership", bootNonce: metadata.bootNonce, candidateReleaseId })));
-        socket.on("data", chunk => {
-            try {
-                const message = decoder.push(chunk)[0];
-                if (message?.type === "release-ownership-result")
-                    finish(message.released === true);
-            }
-            catch {
-                finish(false);
-            }
-        });
-        setTimeout(() => finish(false), timeoutMs).unref();
-    });
-}
-export async function waitForProcessExit(pid, timeoutMs) {
-    const deadline = Date.now() + timeoutMs;
-    while (Date.now() < deadline) {
-        if (!processIsAlive(pid))
-            return;
-        await new Promise(resolvePromise => setTimeout(resolvePromise, 25));
-    }
-    throw new Error(PRODUCT_TEXT.diagnostic(`supervisor ${pid} did not release process ownership within ${timeoutMs}ms`));
-}

package/dist/foundation/release/cohort-state.d.ts

@@ -1,5 +1,7 @@
 import type { MaterializedRelease } from "./release-store.js";
 export declare const RELEASE_COHORT_SCHEMA: string;
+/** How long a release stays on disk after its approval, so processes started from it keep their files. */
+export declare const RELEASE_RETENTION_MS: number;
 export type ReleaseApproval = "candidate" | "approved" | "rejected";
 export interface ReleaseRecord {
     readonly releaseId: string;
@@ -9,6 +11,7 @@ export interface ReleaseRecord {
     readonly launchContract?: string;
     readonly approval: ReleaseApproval;
     readonly materializedAt: string;
+    /** When the release was approved; retention measures its age from this instant. */
     readonly certifiedAt: string | null;
     readonly diagnosticsPath: string | null;
 }
@@ -19,12 +22,6 @@ export interface ReleaseReferences {
     readonly rollback: string | null;
     readonly retention: readonly string[];
 }
-export type ExternalReleaseHoldAuthority = "agent" | "migration" | "resident";
-/** A current hold supplied by an authority that must participate in every reconciliation. */
-export interface ExternalReleaseHold {
-    readonly authority: ExternalReleaseHoldAuthority;
-    readonly releaseId: string;
-}
 export interface ActiveReleaseTransactionReference {
     readonly status: "active" | "completed" | "rolled-back" | "failed";
     readonly priorActiveReleaseId: string | null;
@@ -75,43 +72,15 @@ export interface CohortState {
     readonly releases: Readonly<Record<string, ReleaseRecord>>;
     readonly references: ReleaseReferences;
     readonly cleanup: ReleaseCleanupState;
-    readonly activation: {
-        readonly state: "idle" | "pending" | "draining" | "blocked" | "failed";
-        readonly reason: string | null;
-        readonly blockerGenerationIds: readonly string[];
-        readonly updatedAt: string;
-    };
-}
-export interface EndpointOwnership {
-    readonly state: "idle" | "busy" | "draining" | "released" | "blocked";
-    readonly liveInstanceIds: readonly string[];
-    readonly nonResumableInstanceIds: readonly string[];
-    readonly uncertainInstanceIds: readonly string[];
-}
-export interface SupervisorEndpointMetadata {
-    readonly schema: string;
-    readonly supervisorId: string;
-    readonly endpoint: string;
-    readonly pid: number;
-    readonly pidStartIdentity: string;
-    /** Exact OS creation token; absent on historical supervisor metadata. */
-    readonly nativeStartIdentity?: string;
-    readonly bootNonce: string;
-    readonly startedAt: string;
-    readonly releaseId: string;
-    readonly releaseRoot: string;
-    readonly contentDigest: string;
-    readonly ownership: EndpointOwnership;
-    readonly envelope: string;
-    readonly envelopeRevision: number;
-    readonly requiredFeatures: readonly string[];
-    readonly optionalFeatures: readonly string[];
-    readonly contractDigest: string;
 }
 export interface ProtectedReleaseInputs {
-    readonly liveReleaseIds?: readonly string[];
-    readonly externalHolds?: readonly ExternalReleaseHold[];
+    /** Releases the reconciling command itself runs from; they are never collected under it. */
+    readonly ownReleaseIds?: readonly string[];
     readonly transaction?: ActiveReleaseTransactionReference | null;
+    /** Clock for the age window; defaults to the wall clock. */
+    readonly now?: number;
+    /** Age window measured from approval; defaults to seven days. */
+    readonly retentionMs?: number;
 }
 export interface ProtectedReleasePlan {
     readonly protectedReleaseIds: readonly string[];
@@ -129,10 +98,19 @@ export interface ReleaseRetentionReconciliation {
     readonly detachedReleaseIds: readonly string[];
 }
 /**
- * Derive protection exclusively from current selectors and ownership authorities.
- * The historical retention snapshot is deliberately not an input to this plan.
+ * Age-based retention. A release stays while a selector names it (active, its rollback, or a
+ * candidate still being certified), while an unfinished update may return to it, while the
+ * reconciling command runs from it, or while its approval is younger than the retention window.
+ * Nothing asks which processes are running: a session that outlives the window and two updates
+ * can lose its release files, which is the documented trade-off.
  */
 export declare function planProtectedReleases(state: CohortState, inputs?: ProtectedReleaseInputs): ProtectedReleasePlan;
+/**
+ * Whether a release is young enough to keep. An approved release counts from its approval; a
+ * candidate still awaiting certification counts from its materialization so concurrent work is
+ * not collected under it. A record without a readable timestamp is treated as old.
+ */
+export declare function withinRetention(release: ReleaseRecord, now: number, retentionMs?: number): boolean;
 /** Serializes validated cohort-state revisions under a lock and commits each update atomically. */
 export declare class CohortStateStore {
     readonly path: string;
@@ -144,9 +122,7 @@ export declare class CohortStateStore {
     activate(releaseId: string): Promise<CohortState>;
     /** Atomically advances ordinary launch without allowing an older installation to roll active state back. */
     activateForLaunch(releaseId: string, replaceUnlaunchableActiveId?: string): Promise<CohortState>;
-    blockPending(reason: string, blockerGenerationIds: readonly string[]): Promise<CohortState>;
-    rollback(ownershipReleased: boolean): Promise<CohortState>;
-    setRetention(releaseIds: readonly string[]): Promise<CohortState>;
+    rollback(): Promise<CohortState>;
     /** Atomically replace legacy retention history and detach every currently collectible record. */
     reconcileRetention(resolveInputs: (current: CohortState) => ProtectedReleaseInputs | Promise<ProtectedReleaseInputs>, orphans?: readonly OrphanReleaseDisposition[]): Promise<ReleaseRetentionReconciliation>;
     markCleanupTrash(releaseId: string, trashPath: string): Promise<CohortState>;
@@ -156,6 +132,5 @@ export declare class CohortStateStore {
     recordCleanupWorkerStarted(runId: string, pid: number): Promise<CohortState>;
     recordCleanupWorkerProgress(runId: string, summary: ReleaseCleanupWorkerSummary): Promise<CohortState>;
     recordCleanupWorkerFinished(runId: string, status: Exclude<ReleaseCleanupWorkerStatus, "scheduled" | "running">, summary: ReleaseCleanupWorkerSummary, error?: unknown): Promise<CohortState>;
-    removeUnreferencedRelease(releaseId: string, externalReferences: readonly string[]): Promise<CohortState>;
 }
 export declare function emptyState(): CohortState;