@timurproko/a1 0.2.7-dev.1249 → 0.2.7-dev.1255

package/dist/foundation/release/bootstrap.js

@@ -1,17 +1,11 @@
 import { spawn } from "node:child_process";
-import { RESIDENT_DETACH_INTERVAL_MS, restoreAfterOwnedExit } from "../terminal-cleanup/index.js";
-import { chmod, mkdir, readFile, rm, writeFile } from "node:fs/promises";
-import { connect } from "node:net";
+import { randomUUID } from "node:crypto";
+import { deliverExitNotice, restoreAfterOwnedExit } from "../terminal-cleanup/index.js";
+import { chmod, mkdir, readFile, writeFile } from "node:fs/promises";
 import { resolve } from "node:path";
-import { selectCohortLaunch } from "./cohort-selection.js";
-import { recoverSupervisorEndpoint } from "./endpoint-recovery.js";
 import { selectOrdinaryLaunchReleaseId } from "./ordinary-launch-selection.js";
-import { releaseChannelOf } from "./latest-release.js";
-import { CohortStateStore } from "./cohort-state.js";
-import { assertLaunchProfileId, createSupervisorStartupAttempt, readSupervisorStartupResult, resolveCohortEndpoint, resolveProductPaths, sessionSelectionArguments } from "../lifecycle/index.js";
-import { encodeFrame, LineFrameDecoder } from "../protocol/index.js";
-import { cleanupProvenIdleOwner, processIsAlive } from "./process-cleanup.js";
-import { probeOwnership, readEndpointMetadata, removeEndpointArtifacts, sweepDeadEndpoints } from "./endpoints.js";
+import { ReleaseStateStore } from "./release-state.js";
+import { assertLaunchProfileId, resolveProductPaths, sessionSelectionArguments } from "../lifecycle/index.js";
 import { UpdateTransactionStore } from "./update-transaction.js";
 import { selectUpdateLaunchRelease } from "./update-launch.js";
 import { assertCertifiedFilesPresent, consumeMaterializationProof, materializeRelease, readCertifiedReleaseManifest, readMaterializedRelease, repairMaterializedRelease, resolveReleaseEntryPoint, verifyMaterializedRelease } from "./release-store.js";
@@ -19,25 +13,14 @@ import { scheduleReleaseCleanup } from "./release-gc.js";
 import { createRestartSeal, readRestartCertifiedRelease, releaseCertificationDocument } from "./restart-certification.js";
 import { PRODUCT_IDENTITY, PRODUCT_TEXT } from "../../product-identity.js";
 import { markStartupPhase } from "../startup/index.js";
-import { PRIVATE_ENVIRONMENT, isCurrentLaunchContract, launchContractTarget, readLaunchContext, withLaunchContext } from "../launch-context/index.js";
-import { assertResidentContinuity, ensureTerminalHost, readResidentTabLaunchSettings, selectResidentHost } from "../resident-tabs/index.js";
+import { launchContractTarget, readLaunchContext, withLaunchContext } from "../launch-context/index.js";
 const RELEASE_RESELECTION_MESSAGE = "a1-release-reselection";
 export async function runBootstrap(options) {
-    try {
-        return await runBootstrapAttempt(options, 1);
-    }
-    catch (error) {
-        if (!(error instanceof Error && "code" in error && typeof error.code === "string" && error.code.startsWith("SUPERVISOR_RECOVERY_")))
-            throw error;
-        // Rationale: actionable recovery failures are a single line, not an uncaught Node stack trace.
-        (options.output ?? process.stderr).write(`${PRODUCT_TEXT.diagnostic(error.message)}\n`);
-        return 1;
-    }
+    return await runBootstrapAttempt(options, 1);
 }
 async function runBootstrapAttempt(options, retriesRemaining) {
     const launchProfileId = options.launchIntent?.profileId ?? "a1";
-    const launchMode = options.launchIntent?.launchMode ?? (launchProfileId === "a1" ? "tabs" : "solo");
-    const environment = withLaunchContext(options.environment ?? process.env, { launchProfile: launchProfileId, launchMode });
+    const environment = withLaunchContext(options.environment ?? process.env, { launchProfile: launchProfileId });
     await markStartupPhase(environment, "bootstrap-start");
     assertLaunchProfileId(launchProfileId);
     const sessionArgs = sessionSelectionArguments(options.launchIntent?.sessionSelection);
@@ -48,8 +31,7 @@ async function runBootstrapAttempt(options, retriesRemaining) {
     const paths = resolveProductPaths(environment);
     await mkdir(paths.runtimeDir, { recursive: true, mode: 0o700 });
     const launchSelected = async (release) => {
-        const residentContext = await residentLaunchContext(options, release, environment);
-        const result = await launchUi(release, environment, sessionArgs, residentContext);
+        const result = await launchUi(release, environment, sessionArgs, paths.runtimeDir);
         if (!result.releaseSuperseded)
             return result.code;
         if (retriesRemaining > 0)
@@ -57,7 +39,7 @@ async function runBootstrapAttempt(options, retriesRemaining) {
         output.write(`${PRODUCT_TEXT.diagnostic("active release changed repeatedly during startup; launch could not converge")}\n`);
         return 1;
     };
-    const stateStore = new CohortStateStore(paths.dataDir);
+    const stateStore = new ReleaseStateStore(paths.dataDir);
     let state = await stateStore.read();
     const launchDuringUpdate = async () => {
         // Concurrency: read the journal before touching npm's mutable tree, including package.json.
@@ -68,41 +50,16 @@ async function runBootstrapAttempt(options, retriesRemaining) {
         if (!prior)
             return null;
         const retained = await readCertifiedReleaseManifest(prior, resolve(paths.dataDir, "releases"));
-        await ensureSupervisor(retained, environment);
         return await launchSelected(retained);
     };
     const duringUpdate = await launchDuringUpdate();
     if (duringUpdate !== null)
         return duringUpdate;
-    // Invariant: records left by cohorts whose processes are gone say nothing about ownership, and there
-    // can now be several of them. Clearing them first keeps the decision below about what is
-    // actually running.
-    await sweepDeadEndpoints(paths).catch(() => []);
-    // Performance: reconciliation is serialized by cohort state, but launch never awaits a physical
+    // Performance: reconciliation is serialized by the release state lock, but launch never awaits a physical
     // backlog. The scheduler commits a plan and starts a detached bounded worker.
     const scheduleMaintenance = options.scheduleMaintenance ?? scheduleReleaseCleanup;
     void scheduleMaintenance(paths.dataDir, paths).catch(() => { });
-    // Protocol: each cohort keeps its own endpoint, so a launch looks for the endpoint of the release it
-    // is about to run rather than for the one endpoint the runtime directory used to have.
-    const activeReleaseId = state.references.active;
-    let endpointPaths = activeReleaseId === null
-        ? { endpoint: paths.endpoint, endpointMetadataPath: paths.endpointMetadataPath }
-        : resolveCohortEndpoint(paths, activeReleaseId, environment);
-    let endpoint = await readEndpointMetadata(endpointPaths.endpointMetadataPath);
-    if (endpoint === null) {
-        // Compatibility: a release that predates cohort-scoped endpoints published one endpoint for the whole
-        // runtime directory. Recognizing it is what lets a session started by that release keep
-        // working through the first launch that knows about cohorts.
-        const legacy = await readEndpointMetadata(paths.endpointMetadataPath);
-        if (legacy !== null) {
-            endpoint = legacy;
-            endpointPaths = { endpoint: paths.endpoint, endpointMetadataPath: paths.endpointMetadataPath };
-        }
-    }
-    let probe = endpoint ? await probeOwnership(endpoint) : "dead";
     const installedVersion = await readInstalledVersion(options.packageRoot);
-    if (releaseChannelOf(installedVersion) !== null)
-        environment[PRIVATE_ENVIRONMENT.updateVersion] = installedVersion;
     const activeId = state.references.active;
     const active = activeId === null ? undefined : state.releases[activeId];
     let activeIsLaunchable = active === undefined || (options.releaseIsLaunchable?.(active.releaseRoot) ?? true);
@@ -123,16 +80,7 @@ async function runBootstrapAttempt(options, retriesRemaining) {
         }
     }
     if (activeIsLaunchable && active?.approval === "approved" && active.packageVersion === installedVersion) {
-        const endpointMatches = endpoint?.releaseId === active.releaseId
-            && endpoint.releaseRoot === active.releaseRoot
-            && endpoint.contentDigest === active.contentDigest;
-        if (endpointMatches && probe === "live-verified") {
-            const retained = await readCertifiedReleaseManifest(active, resolve(paths.dataDir, "releases"));
-            return await launchSelected(retained);
-        }
-        if (endpoint === null || probe === "dead") {
-            if (endpoint)
-                await removeEndpointArtifacts(endpointPaths.endpointMetadataPath, endpointPaths.endpoint, endpoint);
+        {
             await markStartupPhase(environment, "durable-validation-start");
             const retained = await readRestartCertifiedRelease(active, paths.dataDir).catch(async () => {
                 let verified;
@@ -149,9 +97,6 @@ async function runBootstrapAttempt(options, retriesRemaining) {
             }).catch(() => null);
             if (retained !== null) {
                 await markStartupPhase(environment, "durable-validation-complete");
-                await markStartupPhase(environment, "replacement-supervisor-start");
-                await ensureSupervisor(retained, environment);
-                await markStartupPhase(environment, "replacement-supervisor-ready");
                 return await launchSelected(retained);
             }
             activeIsLaunchable = false;
@@ -167,7 +112,7 @@ async function runBootstrapAttempt(options, retriesRemaining) {
         candidate = await materializeRelease(options.packageRoot, paths.dataDir);
     }
     catch (error) {
-        const fallback = await launchRetainedActive(state, paths, environment, launchSelected, excludedRetainedReleaseId);
+        const fallback = await launchRetainedActive(state, paths, launchSelected, excludedRetainedReleaseId);
         if (fallback === null)
             throw error;
         return fallback;
@@ -185,7 +130,6 @@ async function runBootstrapAttempt(options, retriesRemaining) {
         if (!retainedRecord || retainedRecord.approval !== "approved")
             throw new Error("selected active release is not approved");
         const retained = await readCertifiedReleaseManifest(retainedRecord, resolve(paths.dataDir, "releases"));
-        await ensureSupervisor(retained, environment);
         return await launchSelected(retained);
     }
     await stateStore.recordCandidate(candidate);
@@ -194,148 +138,29 @@ async function runBootstrapAttempt(options, retriesRemaining) {
         const diagnosticsPath = await certifyMaterializedRelease(candidate, paths.dataDir);
         await stateStore.approve(candidate.releaseId, diagnosticsPath);
     }
-    try {
-        await assertResidentContinuity({ releaseRoot: candidate.releaseRoot, dataDir: paths.dataDir, environment,
-            profileRoot: environment[PRODUCT_IDENTITY.environment.profileHome] ?? paths.configDir, runtimeDir: paths.runtimeDir });
-    }
-    catch (error) {
-        const fallback = await launchRetainedActive(await stateStore.read(), paths, environment, launchSelected, excludedRetainedReleaseId);
-        if (fallback !== null)
-            return fallback;
-        throw error;
-    }
     state = await stateStore.activateForLaunch(candidate.releaseId, !activeIsLaunchable ? activeId ?? undefined : undefined);
     if (state.references.active !== candidate.releaseId) {
         const retainedRecord = state.references.active === null ? undefined : state.releases[state.references.active];
         if (!retainedRecord || retainedRecord.approval !== "approved")
             throw new Error("ordinary launch has no approved active release");
         const retained = await readCertifiedReleaseManifest(retainedRecord, resolve(paths.dataDir, "releases"));
-        await ensureSupervisor(retained, environment);
         return await launchSelected(retained);
     }
-    // Protocol: the candidate's own endpoint decides whether this launch attaches or starts a supervisor.
-    // A cohort other than this one is not in the way: it listens somewhere else.
-    endpointPaths = resolveCohortEndpoint(paths, candidate.releaseId, environment);
-    endpoint = await readEndpointMetadata(endpointPaths.endpointMetadataPath);
-    if (endpoint === null) {
-        const legacy = await readEndpointMetadata(paths.endpointMetadataPath);
-        if (legacy?.releaseId === candidate.releaseId) {
-            endpoint = legacy;
-            endpointPaths = { endpoint: paths.endpoint, endpointMetadataPath: paths.endpointMetadataPath };
-        }
-    }
-    probe = endpoint ? await probeOwnership(endpoint) : "dead";
-    let decision = selectCohortLaunch(candidate, state, endpoint, probe);
-    if (decision.action === "blocked") {
-        // Concurrency: reread through the common recovery path rather than fail on an old snapshot.
-        await ensureSupervisor(candidate, environment);
-        return await launchSelected(candidate);
-    }
-    if (endpoint && probe === "dead") {
-        await removeEndpointArtifacts(endpointPaths.endpointMetadataPath, endpointPaths.endpoint, endpoint);
-    }
-    if (decision.action === "launch-retained-ui") {
-        const retainedRecord = state.releases[decision.releaseId];
-        const retained = retainedRecord?.approval === "approved"
-            ? await readCertifiedReleaseManifest(retainedRecord, resolve(paths.dataDir, "releases"))
-            : await verifyMaterializedRelease(decision.releaseRoot, undefined, resolve(paths.dataDir, "releases"));
-        if (decision.recordPending && endpoint) {
-            await stateStore.blockPending("candidate activation deferred by live non-resumable instances", endpoint.ownership.nonResumableInstanceIds);
-        }
-        const code = await launchSelected(retained);
-        if (decision.recordPending)
-            await activatePendingAfterBlockerExit(candidate, stateStore, paths, environment);
-        return code;
-    }
-    if (decision.action === "replace-idle-cohort" && endpoint) {
-        const diagnosticsPath = await certifyMaterializedRelease(candidate, paths.dataDir);
-        await stateStore.approve(candidate.releaseId, diagnosticsPath);
-        const released = await requestIdleOwnershipRelease(endpoint, candidate.releaseId, 2_000);
-        if (!released) {
-            await stateStore.blockPending("idle supervisor did not verify ownership release", endpoint.ownership.liveInstanceIds);
-            output.write(`${PRODUCT_TEXT.diagnostic("could not verify idle cohort ownership release; the retained release remains selected.")}\n`);
-            return 1;
-        }
-        if (!await releaseVerifiedIdleOwner(endpoint, paths.dataDir)) {
-            await stateStore.blockPending("idle supervisor acknowledged release but did not terminate", endpoint.ownership.liveInstanceIds);
-            output.write(`${PRODUCT_TEXT.diagnostic("could not complete bounded idle cohort shutdown; the candidate remains pending.")}\n`);
-            return 1;
-        }
-        await removeEndpointArtifacts(endpointPaths.endpointMetadataPath, endpointPaths.endpoint, endpoint);
-        await stateStore.activate(candidate.releaseId);
-        decision = { action: "activate-candidate", releaseId: candidate.releaseId, releaseRoot: candidate.releaseRoot, reason: "idle cohort released ownership" };
-    }
-    let selected;
-    if (decision.action === "activate-candidate") {
-        const current = await stateStore.read();
-        if (current.releases[candidate.releaseId]?.approval !== "approved") {
-            const diagnosticsPath = await certifyMaterializedRelease(candidate, paths.dataDir);
-            await stateStore.approve(candidate.releaseId, diagnosticsPath);
-        }
-        const activated = (await stateStore.read()).references.active === candidate.releaseId
-            ? await stateStore.read()
-            : await stateStore.activateForLaunch(candidate.releaseId);
-        if (activated.references.active === candidate.releaseId)
-            selected = candidate;
-        else {
-            const retainedRecord = activated.references.active === null ? undefined : activated.releases[activated.references.active];
-            if (!retainedRecord || retainedRecord.approval !== "approved")
-                throw new Error("ordinary launch has no approved active release");
-            selected = await readCertifiedReleaseManifest(retainedRecord, resolve(paths.dataDir, "releases"));
-        }
-    }
-    else {
-        selected = await readMaterializedRelease(decision.releaseRoot);
-    }
-    await ensureSupervisor(selected, environment);
-    return await launchSelected(selected);
-}
-/** Select only client routing; a resident reconnect never asks execution to restart. */
-async function residentLaunchContext(options, release, environment) {
-    const paths = resolveProductPaths(environment);
-    const profileId = options.launchIntent?.profileId ?? "a1";
-    const mode = options.launchIntent?.launchMode ?? (profileId === "a1" ? "tabs" : "solo");
-    const agentProfileDir = environment.PI_CODING_AGENT_DIR ?? paths.configDir;
-    const residentLaunchSettings = profileId === "a1" ? readResidentTabLaunchSettings(agentProfileDir, PRODUCT_IDENTITY.commandName, paths.configDir, profileId) : null;
-    const resident = await selectResidentHost({
-        profileId, currentLaunchContract: isCurrentLaunchContract(release), solo: mode === "solo",
-        interactive: options.interactiveTerminal ?? (process.stdin.isTTY === true && process.stdout.isTTY === true),
-        ensureHost: async () => (options.ensureTerminalHost ?? ensureTerminalHost)({
-            releaseRoot: release.releaseRoot, profileRoot: environment[PRODUCT_IDENTITY.environment.profileHome] ?? paths.configDir,
-            dataDir: paths.dataDir, runtimeDir: paths.runtimeDir, environment,
-            maxConcurrentStarts: (await residentLaunchSettings).maxConcurrentStarts, unresponsiveRestartSeconds: (await residentLaunchSettings).unresponsiveRestartSeconds,
-        }),
-    });
-    if (resident === null)
-        return {};
-    if (resident.status !== "ready")
-        return { residentFallback: resident.reason };
-    return {
-        residentRootExecutable: resident.executable.executable,
-        residentRootArguments: JSON.stringify([
-            resident.executable.entry, "attach", "--workspace", "--endpoint", resident.endpoint,
-            "--cwd", process.cwd(), "--clear-exit-ms", String(RESIDENT_DETACH_INTERVAL_MS),
-            "--profile", environment[PRODUCT_IDENTITY.environment.profileHome] ?? paths.configDir,
-            "--settings-file", resolve(agentProfileDir, "settings.json"), "--accent-color", (await residentLaunchSettings).accentColor,
-            "--data-dir", paths.dataDir, "--runtime-dir", paths.runtimeDir,
-            "--release-root", release.releaseRoot, "--node-executable", process.execPath,
-        ]),
-    };
+    return await launchSelected(candidate);
 }
 /**
- * Start the retained active cohort when the installed payload cannot be taken. The
+ * Start the retained active release when the installed payload cannot be taken. The
  * release already carries certified evidence, so this reuses it rather than
  * certifying anything new, and reports no selection when there is nothing safe
  * to fall back to.
  */
-async function launchRetainedActive(state, paths, environment, launch, excludedReleaseId) {
+async function launchRetainedActive(state, paths, launch, excludedReleaseId) {
     const activeId = state.references.active;
     const active = activeId === null ? undefined : state.releases[activeId];
     if (!active || active.approval !== "approved" || active.releaseId === excludedReleaseId)
         return null;
     try {
         const retained = await readCertifiedReleaseManifest(active, resolve(paths.dataDir, "releases"));
-        await ensureSupervisor(retained, environment);
         return await launch(retained);
     }
     catch {
@@ -376,50 +201,23 @@ export async function recordParentCertifiedRelease(release, dataDir) {
     await chmod(path, 0o400);
     return path;
 }
-/** Reuse a verified owner, or join the winner if another launch starts the same cohort first. */
-export async function ensureSupervisor(release, environment) {
-    const paths = resolveCohortEndpoint(resolveProductPaths(environment), release.releaseId, environment);
-    await recoverSupervisorEndpoint({
-        metadataPath: paths.endpointMetadataPath,
-        endpoint: paths.endpoint,
-        matches: metadata => endpointMatchesRelease(metadata, release),
-        startAndWait: async () => {
-            const startup = await startSupervisor(release, environment);
-            await waitForVerifiedEndpoint(paths.endpointMetadataPath, release, 8_000, startup);
-        },
-    });
-}
-function endpointMatchesRelease(metadata, release) {
-    return metadata.releaseId === release.releaseId && metadata.releaseRoot === release.releaseRoot
-        && metadata.contentDigest === release.contentDigest;
-}
-export async function startSupervisor(release, environment) {
-    const entry = await resolveReleaseEntryPoint(release, "bin/supervisor.js");
-    const paths = resolveProductPaths(environment);
-    const attempt = await createSupervisorStartupAttempt(paths.runtimeDir, release.releaseId);
-    const child = spawn(process.execPath, [entry, "--startup-attempt", attempt.attemptId], {
-        detached: true,
-        env: releaseEnvironment(environment, release),
-        stdio: "ignore",
-        windowsHide: true,
-    });
-    const childOutcome = new Promise(resolvePromise => {
-        child.once("close", (exitCode, signal) => resolvePromise({ exitCode, signal }));
-    });
-    await new Promise((resolvePromise, rejectPromise) => {
-        child.once("spawn", resolvePromise);
-        child.once("error", rejectPromise);
-    });
-    child.unref();
-    return { ...attempt, childOutcome };
-}
-async function launchUi(release, environment, sessionArgs, residentContext = {}) {
+/**
+ * Run the selected release's UI as the one attached child. The launcher still owns the terminal,
+ * so when the child ends uncleanly it restores the terminal and prints any notice the UI left armed.
+ */
+async function launchUi(release, environment, sessionArgs, runtimeDir) {
     await markStartupPhase(environment, "bootstrap-selected");
-    const entry = await resolveReleaseEntryPoint(release, "bin/guardian.js");
+    const entry = await resolveReleaseEntryPoint(release, "bin/ui.js");
+    const ownsTerminal = readLaunchContext(environment).launchProfile === "a1";
+    const noticeDirectory = resolve(runtimeDir, "exit-notices");
+    const noticePath = resolve(noticeDirectory, `${randomUUID()}.notice`);
+    if (ownsTerminal)
+        await mkdir(noticeDirectory, { recursive: true, mode: 0o700 });
+    const launchEnvironment = releaseEnvironment(environment, release, readLaunchContext(environment, "profile").launchProfile);
+    if (ownsTerminal)
+        launchEnvironment[PRODUCT_IDENTITY.environment.exitNoticePath] = noticePath;
     return await new Promise((resolvePromise, rejectPromise) => {
         let releaseSuperseded = false;
-        const releaseEnv = releaseEnvironment(environment, release, readLaunchContext(environment, "profile").launchProfile);
-        const launchEnvironment = Object.keys(residentContext).length === 0 ? releaseEnv : withLaunchContext(releaseEnv, { ...readLaunchContext(releaseEnv), ...residentContext }, process.platform, launchContractTarget(release));
         const child = spawn(process.execPath, [entry, ...sessionArgs], {
             env: launchEnvironment,
             stdio: ["inherit", "inherit", "inherit", "ipc"],
@@ -431,12 +229,13 @@ async function launchUi(release, environment, sessionArgs, residentContext = {})
             }
         });
         child.once("error", rejectPromise);
-        child.once("close", (code, signal) => resolvePromise({
-            code: releaseSuperseded
-                ? code ?? 1
-                : restoreAfterOwnedExit(readLaunchContext(environment).launchProfile === "a1", code, signal),
-            releaseSuperseded,
-        }));
+        child.once("close", (code, signal) => {
+            const outcome = releaseSuperseded ? code ?? 1 : restoreAfterOwnedExit(ownsTerminal, code, signal);
+            // Invariant: the UI removes its notice on a clean exit; one still armed means the UI died.
+            if (ownsTerminal)
+                deliverExitNotice(noticePath, message => process.stderr.write(message));
+            resolvePromise({ code: outcome, releaseSuperseded });
+        });
     });
 }
 /**
@@ -445,121 +244,11 @@ async function launchUi(release, environment, sessionArgs, residentContext = {})
  * version instead of failing while an installation is being replaced.
  */
 export function releaseEnvironment(environment, release, profile) {
-    const context = readLaunchContext(environment);
     return withLaunchContext(environment, {
         releaseId: release.releaseId,
         releaseLayers: (release.dependencyLayers ?? []).map(layer => layer.layerId).join(","),
         releaseRoot: release.releaseRoot,
         releaseDigest: release.contentDigest,
         ...(profile === undefined ? {} : { launchProfile: profile }),
-        ...(context.launchMode === undefined ? {} : { launchMode: context.launchMode }),
-        ...(context.updateVersion === undefined ? {} : { updateVersion: context.updateVersion }),
     }, process.platform, launchContractTarget(release));
 }
-export async function waitForVerifiedEndpoint(path, release, timeoutMs, startup) {
-    const deadline = Date.now() + timeoutMs;
-    let childOutcome = null;
-    let collision = null;
-    void startup?.childOutcome.then(outcome => { childOutcome = outcome; });
-    while (Date.now() < deadline) {
-        const metadata = await readEndpointMetadata(path);
-        if (metadata && endpointMatchesRelease(metadata, release) && await probeOwnership(metadata, { attempts: 1 }) === "live-verified") {
-            if (startup)
-                await rm(startup.resultPath, { force: true });
-            return;
-        }
-        if (startup) {
-            const result = await readSupervisorStartupResult(startup.resultPath, startup.attemptId, startup.releaseId);
-            if (result?.outcome === "failure") {
-                const error = Object.assign(new Error(PRODUCT_TEXT.diagnostic(`supervisor startup failed at ${result.stage}: ${result.message}`)), {
-                    code: result.code ?? "SUPERVISOR_STARTUP_FAILED",
-                });
-                if (result.code !== "EADDRINUSE")
-                    throw error;
-                // Concurrency: the winning process may not have published its authenticated metadata yet.
-                collision = error;
-            }
-        }
-        if (childOutcome && !collision)
-            throw new Error(PRODUCT_TEXT.diagnostic(`supervisor exited before readiness: ${JSON.stringify(childOutcome)}`));
-        await new Promise(resolvePromise => setTimeout(resolvePromise, 40));
-    }
-    if (collision)
-        throw collision;
-    throw new Error(PRODUCT_TEXT.diagnostic(`supervisor did not publish verified endpoint metadata within ${timeoutMs}ms`));
-}
-async function activatePendingAfterBlockerExit(candidate, stateStore, paths, environment) {
-    const deadline = Date.now() + 2_000;
-    let endpoint = null;
-    while (Date.now() < deadline) {
-        endpoint = await readEndpointMetadata(paths.endpointMetadataPath);
-        if (!endpoint || endpoint.ownership.liveInstanceIds.length === 0)
-            break;
-        await new Promise(resolvePromise => setTimeout(resolvePromise, 40));
-    }
-    if (!endpoint || endpoint.ownership.liveInstanceIds.length > 0 || await probeOwnership(endpoint) !== "live-verified")
-        return;
-    const diagnosticsPath = await certifyMaterializedRelease(candidate, paths.dataDir);
-    await stateStore.approve(candidate.releaseId, diagnosticsPath);
-    await assertResidentContinuity({ releaseRoot: candidate.releaseRoot, dataDir: paths.dataDir, environment,
-        profileRoot: environment[PRODUCT_IDENTITY.environment.profileHome] ?? paths.configDir, runtimeDir: paths.runtimeDir });
-    if (!await requestIdleOwnershipRelease(endpoint, candidate.releaseId, 2_000))
-        return;
-    if (!await releaseVerifiedIdleOwner(endpoint, paths.dataDir))
-        return;
-    await removeEndpointArtifacts(paths.endpointMetadataPath, paths.endpoint, endpoint);
-    await stateStore.activate(candidate.releaseId);
-    await ensureSupervisor(candidate, environment);
-}
-export async function releaseVerifiedIdleOwner(metadata, dataDir, operations = {}) {
-    try {
-        // Protocol: the owner rechecks its boot nonce and live instances before cooperative exit.
-        // A durable idle snapshot alone never authorizes a signal to a still-live process.
-        await requestIdleOwnershipRelease(metadata, metadata.releaseId, 2_000);
-        await (operations.waitForExit ?? waitForProcessExit)(metadata.pid, 3_000);
-        return true;
-    }
-    catch {
-        // Security: a lingering Windows handle can keep numeric PID probes positive after exit.
-        // Native observation may retire that exact dead boot, but never signals a still-live owner.
-        const diagnostics = await (operations.cleanup ?? cleanupProvenIdleOwner)(metadata);
-        await writeFile(resolve(dataDir, `cleanup-${Date.now()}.json`), JSON.stringify(diagnostics, null, 2));
-        return diagnostics.terminated;
-    }
-}
-async function requestIdleOwnershipRelease(metadata, candidateReleaseId, timeoutMs) {
-    return await new Promise(resolvePromise => {
-        const socket = connect(metadata.endpoint);
-        const decoder = new LineFrameDecoder();
-        let settled = false;
-        const finish = (released) => {
-            if (settled)
-                return;
-            settled = true;
-            socket.destroy();
-            resolvePromise(released);
-        };
-        socket.once("error", () => finish(false));
-        socket.once("connect", () => socket.write(encodeFrame({ type: "release-idle-ownership", bootNonce: metadata.bootNonce, candidateReleaseId })));
-        socket.on("data", chunk => {
-            try {
-                const message = decoder.push(chunk)[0];
-                if (message?.type === "release-ownership-result")
-                    finish(message.released === true);
-            }
-            catch {
-                finish(false);
-            }
-        });
-        setTimeout(() => finish(false), timeoutMs).unref();
-    });
-}
-export async function waitForProcessExit(pid, timeoutMs) {
-    const deadline = Date.now() + timeoutMs;
-    while (Date.now() < deadline) {
-        if (!processIsAlive(pid))
-            return;
-        await new Promise(resolvePromise => setTimeout(resolvePromise, 25));
-    }
-    throw new Error(PRODUCT_TEXT.diagnostic(`supervisor ${pid} did not release process ownership within ${timeoutMs}ms`));
-}

package/dist/foundation/release/dependency-certification.d.ts

@@ -1,10 +1,9 @@
-export declare const DEPENDENCY_CERTIFICATIONS_DIRECTORY = "dependency-certifications";
 type LayerIdentity = {
     readonly layerId: string;
     readonly contentDigest: string;
 };
 export interface ReadDependencyCertificationOptions {
-    /** Only authenticated parent-started supervisors may upgrade missing platform evidence. */
+    /** Only an authenticated parent certifying the exact release may upgrade missing platform evidence. */
     readonly allowLegacyParentCertification?: boolean;
     /** Cleanup must validate canonical evidence without migrating or falling back. */
     readonly canonicalOnly?: boolean;

package/dist/foundation/release/dependency-certification.js

@@ -3,7 +3,7 @@ import { chmod, lstat, mkdir, readFile, readdir, realpath, rename, rm, writeFile
 import { basename, dirname, resolve } from "node:path";
 import { PRODUCT_IDENTITY } from "../../product-identity.js";
 import { immutablePlatformPolicy } from "./immutable-platform.js";
-export const DEPENDENCY_CERTIFICATIONS_DIRECTORY = "dependency-certifications";
+const DEPENDENCY_CERTIFICATIONS_DIRECTORY = "dependency-certifications";
 /** Derive the canonical record path without accepting path components as layer identities. */
 export function dependencyLayerCertificationPath(dataDir, layerId) {
     assertLayerId(layerId);

package/dist/foundation/release/early-accent.d.ts

@@ -1,6 +1,6 @@
 type UiAccentColor = "blue" | "purple" | "cyan" | "green" | "orange" | "pink";
-export type EarlyAccentAppearance = "dark" | "light";
-export type EarlyAccentMode = "truecolor" | "256color";
+type EarlyAccentAppearance = "dark" | "light";
+type EarlyAccentMode = "truecolor" | "256color";
 /** Read only global profile data, never project settings or the interactive resource pipeline. */
 export declare function resolveEarlyAccentColor(environment?: NodeJS.ProcessEnv, home?: () => string): UiAccentColor;
 export declare function earlyAccentPalette(color: UiAccentColor, appearance?: EarlyAccentAppearance, mode?: EarlyAccentMode): {

package/dist/foundation/release/early-accent.js

@@ -2,7 +2,7 @@ import { readFileSync, statSync } from "node:fs";
 import { homedir } from "node:os";
 import { isAbsolute, join } from "node:path";
 import { PRODUCT_IDENTITY } from "../../product-identity.js";
-import { SHARED_PROGRESS_PALETTE } from "./progress-palette.generated.js";
+import { SHARED_PROGRESS_PALETTE } from "../../contracts/presentation/index.js";
 const MAX_SETTINGS_BYTES = 256 * 1024;
 /** Read only global profile data, never project settings or the interactive resource pipeline. */
 export function resolveEarlyAccentColor(environment = process.env, home = homedir) {

package/dist/foundation/release/index.d.ts

@@ -1,21 +1,14 @@
-export { certifyMaterializedRelease, ensureSupervisor, recordParentCertifiedRelease, releaseEnvironment, releaseVerifiedIdleOwner, runBootstrap, startSupervisor, waitForProcessExit, waitForVerifiedEndpoint, } from "./bootstrap.js";
-export type { BootstrapOptions, SupervisorStartupAttempt } from "./bootstrap.js";
-export { selectCohortLaunch } from "./cohort-selection.js";
+export { certifyMaterializedRelease, recordParentCertifiedRelease, releaseEnvironment, runBootstrap, } from "./bootstrap.js";
+export type { BootstrapOptions } from "./bootstrap.js";
 export { selectOrdinaryLaunchReleaseId } from "./ordinary-launch-selection.js";
-export type { CohortLaunchDecision, OwnershipProbe } from "./cohort-selection.js";
-export { CohortStateStore, RELEASE_COHORT_SCHEMA, emptyState, planProtectedReleases } from "./cohort-state.js";
-export type { ActiveReleaseTransactionReference, CohortState, EndpointOwnership, ExternalReleaseHold, ExternalReleaseHoldAuthority, OrphanReleaseDisposition, ProtectedReleaseInputs, ProtectedReleasePlan, ReleaseApproval, ReleaseCleanupDiagnostic, ReleaseCleanupDisposition, ReleaseCleanupStage, ReleaseCleanupState, ReleaseCleanupWorkerRun, ReleaseCleanupWorkerStatus, ReleaseCleanupWorkerSummary, ReleaseRecord, ReleaseReferences, ReleaseRetentionReconciliation, SupervisorEndpointMetadata, } from "./cohort-state.js";
+export { ReleaseStateStore, RELEASE_STATE_SCHEMA, RELEASE_RETENTION_MS, emptyState, planProtectedReleases, withinRetention } from "./release-state.js";
+export type { ActiveReleaseTransactionReference, ReleaseState, OrphanReleaseDisposition, ProtectedReleaseInputs, ProtectedReleasePlan, ReleaseApproval, ReleaseCleanupDiagnostic, ReleaseCleanupDisposition, ReleaseCleanupStage, ReleaseCleanupState, ReleaseCleanupWorkerRun, ReleaseCleanupWorkerStatus, ReleaseCleanupWorkerSummary, ReleaseRecord, ReleaseReferences, ReleaseRetentionReconciliation, } from "./release-state.js";
 export { DEPENDENCY_LAYER_MANIFEST, DEPENDENCY_LAYER_SCHEMA, RUNTIME_PAYLOAD_INVENTORY, dependencyLayerCertificationPath, dependencyReference, generateDependencyRuntimePayload, legacyDependencyLayerCertificationPath, materializeDependencyLayer, readCertifiedDependencyLayer, selectDependencyRuntimePayload, selectPublishedDependencyRuntimePayload, verifyDependencyLayer, } from "./dependency-layer.js";
 export type { DependencyLayerIdentity, DependencyLayerOperationEvent, DependencyLayerReference, GeneratedRuntimePayload, MaterializeDependencyLayerOptions, MaterializedDependencyLayer, PublishedRuntimeFileClassification, PublishedRuntimePayload, ReadCertifiedDependencyLayerOptions, RuntimePayloadExclusion, RuntimePayloadInventory, SelectedRuntimePayload, } from "./dependency-layer.js";
-export { listRecordedEndpoints, liveReleaseIds, probeOwnership, readEndpointMetadata, removeEndpointArtifacts, sweepDeadEndpoints } from "./endpoints.js";
-export { currentSupervisorStartIdentity, observeSupervisorProcess, supervisorProcessState } from "./supervisor-identity.js";
-export { withEndpointLock } from "./endpoint-lock.js";
-export type { RecordedEndpoint } from "./endpoints.js";
-export { cleanupProvenIdleOwner, cleanupVerifiedOwner, processIsAlive } from "./process-cleanup.js";
-export type { CleanupDiagnostics } from "./process-cleanup.js";
+export { processIsAlive } from "./process-liveness.js";
 export { PRODUCT_PACKAGE_NAME, createReleaseIdentity, deriveReleaseIdentity, digestManifestFiles, discoverReleasePayload, packageRootFromModule, releaseFileIdentity, resolveWithin, } from "./release.js";
 export type { DiscoverReleasePayloadOptions, DiscoveredReleasePayload, ReleaseFileIdentity, ReleaseIdentity } from "./release.js";
-export { collectRelease, prepareReleaseCleanup, runBoundedReleaseCleanup, runReleaseCleanupWorker, scheduleReleaseCleanup } from "./release-gc.js";
+export { prepareReleaseCleanup, runBoundedReleaseCleanup, runReleaseCleanupWorker, scheduleReleaseCleanup } from "./release-gc.js";
 export type { ReleaseCleanupLimits, ReleaseCleanupOperations, ReleaseCleanupOptions, ReleaseCleanupResult, ReleaseCleanupWorkerOptions } from "./release-gc.js";
 export { RELEASE_MANIFEST_FILENAME, ReleaseRepairUnavailableError, assertCertifiedFilesPresent, assertImmutableExecutionRoot, consumeMaterializationProof, materializeRelease, readCertifiedReleaseManifest, readMaterializedRelease, repairMaterializedRelease, resolveReleaseEntryPoint, verifyMaterializedRelease, } from "./release-store.js";
 export type { CertifiedReleaseRecord, MaterializeReleaseOptions, MaterializedRelease, ReadCertifiedReleaseManifestOptions, ReleaseContentOperation, ReleaseContentOperationEvent, VerifyMaterializedReleaseOptions, } from "./release-store.js";
@@ -23,11 +16,11 @@ export { createRestartSeal, readRestartCertifiedRelease, releaseCertificationDoc
 export type { RestartSeal, RestartValidationEvent } from "./restart-certification.js";
 export { STABLE_RELEASE_SCHEMA, createStableReleaseEvidence, verifyStableRegistry } from "./stable-release.js";
 export type { StableRegistryState, StableRegistryVerificationOptions, StableReleaseEvidence, StableReleaseEvidenceInput } from "./stable-release.js";
-export { PACKAGE_UNLOCK_PATIENCE_MS, UPDATE_ACTIVATION_BLOCKED_EXIT_CODE, UPDATE_ALREADY_RUNNING_EXIT_CODE, PRODUCT_PACKAGE, assertUpdatePerformanceBudget, createNpmProcessRunner, createUpdateLifecycleCoordinator, isPackageLockError, lockedPackageDiagnostic, planUpdateOwnership, renderUpdateProgressBar, runSelfUpdate, } from "./update.js";
-export type { ProcessRequest, ProcessResult, SelfUpdateOptions, UpdateActivationPhase, UpdateChannel, UpdateFileMetadata, UpdateFileSystem, UpdateLifecycleCoordinator, UpdateMaterializationProgress, UpdateMeasuredPhase, UpdateOutput, UpdateOwnershipAction, UpdatePackageReplacementInput, UpdatePerformanceEvidence, UpdatePhaseTimingEvent, UpdateProcessRunner, UpdateTransactionJournal, UpdateUnlockPatience, } from "./update.js";
-export { UPDATE_ACTIVATION_CONTRACT, UPDATE_ACTIVATION_ENTRY, UPDATE_ACTIVATION_MANIFEST_FIELD, UpdateActivationBlockedError, activateInstalledRelease, delegateActivation, readActivationContracts, runActivationEntry, } from "./update-activation.js";
+export { PACKAGE_UNLOCK_PATIENCE_MS, UPDATE_ALREADY_RUNNING_EXIT_CODE, PRODUCT_PACKAGE, assertUpdatePerformanceBudget, createNpmProcessRunner, createUpdateLifecycleCoordinator, isPackageLockError, lockedPackageDiagnostic, renderUpdateProgressBar, runSelfUpdate, } from "./update.js";
+export type { ProcessRequest, ProcessResult, SelfUpdateOptions, UpdateActivationPhase, UpdateChannel, UpdateFileMetadata, UpdateFileSystem, UpdateLifecycleCoordinator, UpdateMaterializationProgress, UpdateMeasuredPhase, UpdateOutput, UpdatePackageReplacementInput, UpdatePerformanceEvidence, UpdatePhaseTimingEvent, UpdateProcessRunner, UpdateTransactionJournal, UpdateUnlockPatience, } from "./update.js";
+export { UPDATE_ACTIVATION_CONTRACT, UPDATE_ACTIVATION_ENTRY, UPDATE_ACTIVATION_MANIFEST_FIELD, activateInstalledRelease, delegateActivation, readActivationContracts, runActivationEntry, } from "./update-activation.js";
 export type { UpdateActivationCallbacks, UpdateActivationEvent, UpdateActivationRequest } from "./update-activation.js";
-export { selectSupervisorLaunchReleaseId, selectUpdateLaunchRelease } from "./update-launch.js";
+export { selectUpdateLaunchRelease } from "./update-launch.js";
 export { UPDATE_RECOVERY_SCHEMA, cleanupUpdateRecoveryCapsules, inspectUpdateLauncherSet, npmPrefixForGlobalRoot, prepareUpdateRecoveryCapsule, readUpdateRecoveryCapsule, removeUpdateRecoveryCapsule, resolveNpmCli, runProtectedPackageReplacement, updateLauncherPaths, updateNpmInstallArguments, } from "./update-recovery.js";
 export type { ProtectedPackageReplacementOptions, ProtectedPackageReplacementResult, UpdateRecoveryCapsule, UpdateRecoveryResult } from "./update-recovery.js";
 export { UPDATE_JOURNAL_SCHEMA, UpdateTransactionStore } from "./update-transaction.js";