@timurproko/a1 0.2.7-dev.1249 → 0.2.7-dev.1255

package/dist/foundation/release/index.js

@@ -1,20 +1,16 @@
-export { certifyMaterializedRelease, ensureSupervisor, recordParentCertifiedRelease, releaseEnvironment, releaseVerifiedIdleOwner, runBootstrap, startSupervisor, waitForProcessExit, waitForVerifiedEndpoint, } from "./bootstrap.js";
-export { selectCohortLaunch } from "./cohort-selection.js";
+export { certifyMaterializedRelease, recordParentCertifiedRelease, releaseEnvironment, runBootstrap, } from "./bootstrap.js";
 export { selectOrdinaryLaunchReleaseId } from "./ordinary-launch-selection.js";
-export { CohortStateStore, RELEASE_COHORT_SCHEMA, emptyState, planProtectedReleases } from "./cohort-state.js";
+export { ReleaseStateStore, RELEASE_STATE_SCHEMA, RELEASE_RETENTION_MS, emptyState, planProtectedReleases, withinRetention } from "./release-state.js";
 export { DEPENDENCY_LAYER_MANIFEST, DEPENDENCY_LAYER_SCHEMA, RUNTIME_PAYLOAD_INVENTORY, dependencyLayerCertificationPath, dependencyReference, generateDependencyRuntimePayload, legacyDependencyLayerCertificationPath, materializeDependencyLayer, readCertifiedDependencyLayer, selectDependencyRuntimePayload, selectPublishedDependencyRuntimePayload, verifyDependencyLayer, } from "./dependency-layer.js";
-export { listRecordedEndpoints, liveReleaseIds, probeOwnership, readEndpointMetadata, removeEndpointArtifacts, sweepDeadEndpoints } from "./endpoints.js";
-export { currentSupervisorStartIdentity, observeSupervisorProcess, supervisorProcessState } from "./supervisor-identity.js";
-export { withEndpointLock } from "./endpoint-lock.js";
-export { cleanupProvenIdleOwner, cleanupVerifiedOwner, processIsAlive } from "./process-cleanup.js";
+export { processIsAlive } from "./process-liveness.js";
 export { PRODUCT_PACKAGE_NAME, createReleaseIdentity, deriveReleaseIdentity, digestManifestFiles, discoverReleasePayload, packageRootFromModule, releaseFileIdentity, resolveWithin, } from "./release.js";
-export { collectRelease, prepareReleaseCleanup, runBoundedReleaseCleanup, runReleaseCleanupWorker, scheduleReleaseCleanup } from "./release-gc.js";
+export { prepareReleaseCleanup, runBoundedReleaseCleanup, runReleaseCleanupWorker, scheduleReleaseCleanup } from "./release-gc.js";
 export { RELEASE_MANIFEST_FILENAME, ReleaseRepairUnavailableError, assertCertifiedFilesPresent, assertImmutableExecutionRoot, consumeMaterializationProof, materializeRelease, readCertifiedReleaseManifest, readMaterializedRelease, repairMaterializedRelease, resolveReleaseEntryPoint, verifyMaterializedRelease, } from "./release-store.js";
 export { createRestartSeal, readRestartCertifiedRelease, releaseCertificationDocument, restartSealDigest } from "./restart-certification.js";
 export { STABLE_RELEASE_SCHEMA, createStableReleaseEvidence, verifyStableRegistry } from "./stable-release.js";
-export { PACKAGE_UNLOCK_PATIENCE_MS, UPDATE_ACTIVATION_BLOCKED_EXIT_CODE, UPDATE_ALREADY_RUNNING_EXIT_CODE, PRODUCT_PACKAGE, assertUpdatePerformanceBudget, createNpmProcessRunner, createUpdateLifecycleCoordinator, isPackageLockError, lockedPackageDiagnostic, planUpdateOwnership, renderUpdateProgressBar, runSelfUpdate, } from "./update.js";
-export { UPDATE_ACTIVATION_CONTRACT, UPDATE_ACTIVATION_ENTRY, UPDATE_ACTIVATION_MANIFEST_FIELD, UpdateActivationBlockedError, activateInstalledRelease, delegateActivation, readActivationContracts, runActivationEntry, } from "./update-activation.js";
-export { selectSupervisorLaunchReleaseId, selectUpdateLaunchRelease } from "./update-launch.js";
+export { PACKAGE_UNLOCK_PATIENCE_MS, UPDATE_ALREADY_RUNNING_EXIT_CODE, PRODUCT_PACKAGE, assertUpdatePerformanceBudget, createNpmProcessRunner, createUpdateLifecycleCoordinator, isPackageLockError, lockedPackageDiagnostic, renderUpdateProgressBar, runSelfUpdate, } from "./update.js";
+export { UPDATE_ACTIVATION_CONTRACT, UPDATE_ACTIVATION_ENTRY, UPDATE_ACTIVATION_MANIFEST_FIELD, activateInstalledRelease, delegateActivation, readActivationContracts, runActivationEntry, } from "./update-activation.js";
+export { selectUpdateLaunchRelease } from "./update-launch.js";
 export { UPDATE_RECOVERY_SCHEMA, cleanupUpdateRecoveryCapsules, inspectUpdateLauncherSet, npmPrefixForGlobalRoot, prepareUpdateRecoveryCapsule, readUpdateRecoveryCapsule, removeUpdateRecoveryCapsule, resolveNpmCli, runProtectedPackageReplacement, updateLauncherPaths, updateNpmInstallArguments, } from "./update-recovery.js";
 export { UPDATE_JOURNAL_SCHEMA, UpdateTransactionStore } from "./update-transaction.js";
 export { warmMaterializedRelease } from "./warmup.js";

package/dist/foundation/release/latest-release.d.ts

@@ -1,11 +1,6 @@
 /** Published release channels: stable `X.Y.Z` on dist-tag `latest`, development `X.Y.Z-dev.N` on `next`. */
 export type ReleaseChannel = "stable" | "development";
-export type StartupUpdateMode = "auto" | "notify" | "no";
-export interface DistTagVersions {
-    readonly release: string | null;
-    readonly develop: string | null;
-    readonly error: string | null;
-}
+export type StartupUpdateMode = "auto" | "manual";
 export type RegistryFetcher = (url: string) => Promise<{
     readonly ok: boolean;
     readonly status: number;
@@ -19,15 +14,13 @@ export interface AvailableRelease {
     /** The GitHub Release page; development releases have none. */
     readonly changelogUrl: string | null;
 }
-export declare const DEFAULT_NPM_REGISTRY = "https://registry.npmjs.org";
 export declare const UPDATE_CHECK_INTERVAL_MS: number;
-export declare const NOTIFY_CHECK_INTERVAL_MS: number;
 /** One published version with the pull request its manifest records, when it records one. */
 export interface PublishedVersion {
     readonly version: string;
     readonly pullRequest: number | null;
 }
-export interface PublishedVersions {
+interface PublishedVersions {
     readonly versions: readonly PublishedVersion[];
     readonly error: string | null;
 }
@@ -38,23 +31,14 @@ export interface PublishedVersions {
 export declare function releaseChannelOf(version: string): ReleaseChannel | null;
 /** True only when both versions are valid semver and the candidate sorts strictly above the current one. */
 export declare function isNewerRelease(candidate: string, current: string): boolean;
-export declare function distTagsUrl(registry?: string): string;
-/** Read `latest` (required) and `next` (optional) from a dist-tags object. */
-export declare function parseDistTags(metadata: unknown, source: string): DistTagVersions;
-export declare function queryRegistryDistTags(fetcher: RegistryFetcher, registry?: string): Promise<DistTagVersions>;
-export declare function packageDocumentUrl(registry?: string): string;
-/** The pull request a published or installed manifest records under `publication.pullRequest`, when valid. */
-export declare function recordedPullRequest(manifest: unknown): number | null;
 /**
  * Every published version with its recorded pull request, read from the registry's full package
  * document: its per-version manifests keep the publication metadata that version lists and the
  * abbreviated install document leave out.
  */
 export declare function queryPublishedVersions(fetcher: RegistryFetcher, registry?: string): Promise<PublishedVersions>;
-export declare function parsePublishedVersions(document: unknown): PublishedVersions;
 /** Forget the startup release check so the next interactive launch asks the registry again. */
 export declare function invalidateReleaseCheckCache(configDir: string): Promise<void>;
-export declare function unavailableDistTags(error: string): DistTagVersions;
 export declare function createRegistryFetcher(timeoutMs: number, signal?: AbortSignal): RegistryFetcher;
 export interface StartupReleaseCheckOptions {
     readonly runningVersion: string;
@@ -78,4 +62,4 @@ export declare function startupReleaseCheckSkipReason(options: StartupReleaseChe
  * answer replaces the cache. Every failure resolves to null: the notice is best-effort.
  */
 export declare function checkForNewerRelease(options: StartupReleaseCheckOptions): Promise<AvailableRelease | null>;
-export declare function availableRelease(channel: ReleaseChannel, version: string): AvailableRelease;
+export {};

package/dist/foundation/release/latest-release.js

@@ -4,9 +4,8 @@ import { join } from "node:path";
 import { gt, prerelease, valid as validSemver } from "semver";
 import lockfile from "proper-lockfile";
 import { PRODUCT_IDENTITY, PRODUCT_TEXT } from "../../product-identity.js";
-export const DEFAULT_NPM_REGISTRY = "https://registry.npmjs.org";
+const DEFAULT_NPM_REGISTRY = "https://registry.npmjs.org";
 export const UPDATE_CHECK_INTERVAL_MS = 15 * 60_000;
-export const NOTIFY_CHECK_INTERVAL_MS = 24 * 60 * 60_000;
 const STARTUP_FETCH_TIMEOUT_MS = 3_000;
 const CACHE_FILENAME = "update-check.json";
 const CACHE_VERSION = 2;
@@ -31,11 +30,11 @@ export function isNewerRelease(candidate, current) {
     const right = validSemver(current);
     return left !== null && right !== null && gt(left, right);
 }
-export function distTagsUrl(registry = DEFAULT_NPM_REGISTRY) {
+function distTagsUrl(registry = DEFAULT_NPM_REGISTRY) {
     return `${registry.replace(/\/+$/u, "")}/-/package/${encodeURIComponent(PRODUCT_TEXT.packageName)}/dist-tags`;
 }
 /** Read `latest` (required) and `next` (optional) from a dist-tags object. */
-export function parseDistTags(metadata, source) {
+function parseDistTags(metadata, source) {
     if (typeof metadata !== "object" || metadata === null || Array.isArray(metadata)) {
         return unavailableDistTags(`${source} returned a non-object dist-tags value`);
     }
@@ -49,7 +48,7 @@ export function parseDistTags(metadata, source) {
         return unavailableDistTags(errorMessage(error));
     }
 }
-export async function queryRegistryDistTags(fetcher, registry) {
+async function queryRegistryDistTags(fetcher, registry) {
     try {
         const response = await fetcher(distTagsUrl(registry));
         if (!response.ok)
@@ -60,11 +59,11 @@ export async function queryRegistryDistTags(fetcher, registry) {
         return unavailableDistTags(errorMessage(error));
     }
 }
-export function packageDocumentUrl(registry = DEFAULT_NPM_REGISTRY) {
+function packageDocumentUrl(registry = DEFAULT_NPM_REGISTRY) {
     return `${registry.replace(/\/+$/u, "")}/${encodeURIComponent(PRODUCT_TEXT.packageName)}`;
 }
 /** The pull request a published or installed manifest records under `publication.pullRequest`, when valid. */
-export function recordedPullRequest(manifest) {
+function recordedPullRequest(manifest) {
     if (typeof manifest !== "object" || manifest === null)
         return null;
     const publication = manifest.publication;
@@ -92,7 +91,7 @@ export async function queryPublishedVersions(fetcher, registry) {
         return { versions: [], error: errorMessage(error) };
     }
 }
-export function parsePublishedVersions(document) {
+function parsePublishedVersions(document) {
     if (typeof document !== "object" || document === null || Array.isArray(document)) {
         return { versions: [], error: "registry returned a non-object package document" };
     }
@@ -109,7 +108,7 @@ export function parsePublishedVersions(document) {
 export async function invalidateReleaseCheckCache(configDir) {
     await withCacheLock(configDir, async () => { await rm(join(configDir, CACHE_FILENAME), { force: true }); });
 }
-export function unavailableDistTags(error) {
+function unavailableDistTags(error) {
     return { release: null, develop: null, error };
 }
 export function createRegistryFetcher(timeoutMs, signal) {
@@ -127,7 +126,7 @@ export function startupReleaseCheckSkipReason(options) {
         return "ci";
     if (!options.interactive)
         return "not-interactive";
-    if (options.settingMode === "no")
+    if (options.settingMode === "manual")
         return "disabled-by-setting";
     if (releaseChannelOf(options.runningVersion) === null)
         return "unpublished-version";
@@ -146,7 +145,7 @@ export async function checkForNewerRelease(options) {
     const now = options.now ?? Date.now;
     const cachePath = join(options.configDir, CACHE_FILENAME);
     try {
-        const interval = options.settingMode === "notify" ? NOTIFY_CHECK_INTERVAL_MS : UPDATE_CHECK_INTERVAL_MS;
+        const interval = UPDATE_CHECK_INTERVAL_MS;
         const latest = await withCacheLock(options.configDir, async () => {
             if (options.signal?.aborted)
                 return null;
@@ -171,7 +170,7 @@ export async function checkForNewerRelease(options) {
         return null;
     }
 }
-export function availableRelease(channel, version) {
+function availableRelease(channel, version) {
     return {
         channel,
         version,

package/dist/foundation/release/ordinary-launch-selection.d.ts

@@ -8,7 +8,7 @@ interface ApprovedOrdinaryLaunchRelease extends OrdinaryLaunchRelease {
 /**
  * Ordinary launch has no rollback authority: it may advance to its installed package, but an
  * older package installation must follow a newer approved active release instead of moving the
- * shared selector backward. Explicit update/rollback uses CohortStateStore.activate directly.
+ * shared selector backward. Explicit update/rollback uses ReleaseStateStore.activate directly.
  */
 export declare function selectOrdinaryLaunchReleaseId(candidate: OrdinaryLaunchRelease, active?: ApprovedOrdinaryLaunchRelease): string;
 export {};

package/dist/foundation/release/ordinary-launch-selection.js

@@ -2,7 +2,7 @@ import { compare, valid as validSemver } from "semver";
 /**
  * Ordinary launch has no rollback authority: it may advance to its installed package, but an
  * older package installation must follow a newer approved active release instead of moving the
- * shared selector backward. Explicit update/rollback uses CohortStateStore.activate directly.
+ * shared selector backward. Explicit update/rollback uses ReleaseStateStore.activate directly.
  */
 export function selectOrdinaryLaunchReleaseId(candidate, active) {
     if (!active || active.approval !== "approved")

package/dist/foundation/release/process-liveness.d.ts

@@ -0,0 +1,2 @@
+/** Whether a process with this id exists; a permission refusal still proves it is running. */
+export declare function processIsAlive(pid: number): boolean;

package/dist/foundation/release/process-liveness.js

@@ -0,0 +1,12 @@
+/** Whether a process with this id exists; a permission refusal still proves it is running. */
+export function processIsAlive(pid) {
+    if (!Number.isSafeInteger(pid) || pid <= 0)
+        return false;
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        return error instanceof Error && "code" in error && error.code === "EPERM";
+    }
+}

package/dist/foundation/release/release-gc.d.ts

@@ -1,8 +1,7 @@
 import { rename, rm } from "node:fs/promises";
-import { CohortStateStore, type ExternalReleaseHold, type OrphanReleaseDisposition } from "./cohort-state.js";
+import { ReleaseStateStore, type OrphanReleaseDisposition } from "./release-state.js";
 import type { ProductPaths } from "../lifecycle/index.js";
 import { UpdateTransactionStore } from "./update-transaction.js";
-import { type ResidentReleaseHoldReport } from "../resident-tabs/index.js";
 export interface ReleaseCleanupLimits {
     readonly maxItems: number;
     readonly maxDurationMs: number;
@@ -13,7 +12,15 @@ export interface ReleaseCleanupOperations {
     readonly remove?: typeof rm;
 }
 export interface ReleaseCleanupOptions {
-    readonly externalHolds?: readonly ExternalReleaseHold[];
+    /**
+     * Releases the command that started cleanup runs from. Defaults to the release named by this
+     * process's launch context, so a command never collects the files it is running.
+     */
+    readonly ownReleaseIds?: readonly string[];
+    /** Age window measured from approval; defaults to seven days. */
+    readonly retentionMs?: number;
+    /** Wall clock the retention window is measured against; `now` only paces a batch. */
+    readonly wallClock?: () => number;
     readonly transactionStore?: Pick<UpdateTransactionStore, "read">;
     readonly limits?: Partial<ReleaseCleanupLimits>;
     readonly candidateAgeMs?: number;
@@ -22,8 +29,6 @@ export interface ReleaseCleanupOptions {
     readonly operations?: ReleaseCleanupOperations;
     /** Process-start seam for scheduler and continuation tests. */
     readonly workerSpawner?: (entry: string, environment: NodeJS.ProcessEnv) => Promise<void>;
-    /** Resident-tab inspection seam; the default asks a verified installed terminal host. */
-    readonly residentHolds?: (dataDir: string, releaseRoots: readonly string[]) => Promise<ResidentReleaseHoldReport>;
 }
 export interface ReleaseCleanupWorkerOptions {
     readonly cleanup?: ReleaseCleanupOptions;
@@ -53,11 +58,11 @@ interface DiscoveredCleanupInputs {
     }[];
 }
 /**
- * Reconcile current ownership under the cohort-state lock and durably detach obsolete releases.
+ * Reconcile age-based retention under the release-state lock and durably detach obsolete releases.
  * This operation intentionally reads only manifests and directory metadata, never payload bytes.
  */
-export declare function prepareReleaseCleanup(dataDir: string, paths?: ProductPaths, options?: ReleaseCleanupOptions): Promise<{
-    readonly store: CohortStateStore;
+export declare function prepareReleaseCleanup(dataDir: string, _paths?: ProductPaths, options?: ReleaseCleanupOptions): Promise<{
+    readonly store: ReleaseStateStore;
     readonly discovered: DiscoveredCleanupInputs;
 }>;
 /** Run a bounded, restart-safe physical cleanup pass over detached releases and abandoned artifacts. */
@@ -69,6 +74,4 @@ export declare function runBoundedReleaseCleanup(dataDir: string, paths?: Produc
 export declare function scheduleReleaseCleanup(dataDir: string, paths: ProductPaths, options?: ReleaseCleanupOptions): Promise<void>;
 /** Entry used by the private cleanup executable shipped in every immutable release. */
 export declare function runReleaseCleanupWorker(environment?: NodeJS.ProcessEnv, workerOptions?: ReleaseCleanupWorkerOptions): Promise<ReleaseCleanupResult>;
-/** Compatibility helper: detach one requested release and execute a one-item pass. */
-export declare function collectRelease(store: CohortStateStore, dataDir: string, releaseId: string, externalReferences: readonly string[], paths?: ProductPaths): Promise<void>;
 export {};

package/dist/foundation/release/release-gc.js

@@ -3,8 +3,7 @@ import { spawn } from "node:child_process";
 import { lstat, mkdir, open, readFile, readdir, realpath, rename, rm, stat } from "node:fs/promises";
 import { dirname, isAbsolute, relative, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
-import { CohortStateStore, } from "./cohort-state.js";
-import { liveReleaseIds } from "./endpoints.js";
+import { ReleaseStateStore, } from "./release-state.js";
 import { resolveProductPaths } from "../lifecycle/index.js";
 import { RELEASE_MANIFEST_FILENAME } from "./release-store.js";
 import { DEPENDENCY_LAYER_MANIFEST, readCertifiedDependencyLayer } from "./dependency-layer.js";
@@ -14,24 +13,25 @@ import { UpdateTransactionStore } from "./update-transaction.js";
 import { cleanupUpdateRecoveryCapsules } from "./update-recovery.js";
 import { PRODUCT_IDENTITY } from "../../product-identity.js";
 import { collectCompileCaches, startupCompileCachePath } from "../startup/index.js";
-import { readResidentReleaseHolds } from "../resident-tabs/index.js";
+import { readLaunchContext } from "../launch-context/index.js";
+import { processIsAlive } from "./process-liveness.js";
 const DEFAULT_CANDIDATE_AGE_MS = 60 * 60 * 1_000;
 const DEFAULT_LIMITS = { maxItems: 8, maxDurationMs: 2_000, concurrency: 1 };
 const DEFAULT_WORKER_DURATION_MS = 10 * 60 * 1_000;
 const DEFAULT_NO_PROGRESS_BATCHES = 5;
 const DEFAULT_RETRY_DELAY_MS = 500;
-const WORKER_HOLDS_ENV = "RELEASE_CLEANUP_HOLDS";
+const WORKER_KEEP_ENV = "RELEASE_CLEANUP_KEEP";
 const WORKER_RUN_ID_ENV = "RELEASE_CLEANUP_RUN_ID";
 const WORKER_LEASE_FILENAME = "release-cleanup-worker.lock";
 /**
- * Reconcile current ownership under the cohort-state lock and durably detach obsolete releases.
+ * Reconcile age-based retention under the release-state lock and durably detach obsolete releases.
  * This operation intentionally reads only manifests and directory metadata, never payload bytes.
  */
-export async function prepareReleaseCleanup(dataDir, paths, options = {}) {
-    const store = new CohortStateStore(dataDir);
+export async function prepareReleaseCleanup(dataDir, _paths, options = {}) {
+    const store = new ReleaseStateStore(dataDir);
     const discovered = await discoverCleanupInputs(dataDir, store, options);
     const transactionStore = options.transactionStore ?? new UpdateTransactionStore(dataDir);
-    await store.reconcileRetention(async () => await protectionInputs(dataDir, paths, transactionStore, options.externalHolds ?? [], options.residentHolds), discovered.orphans);
+    await store.reconcileRetention(async () => await protectionInputs(transactionStore, options), discovered.orphans);
     for (const diagnostic of discovered.diagnostics.slice(0, 16)) {
         await store.recordCleanupFailure(diagnostic.releaseId, diagnostic.stage, diagnostic.error);
     }
@@ -42,7 +42,7 @@ export async function runBoundedReleaseCleanup(dataDir, paths, options = {}) {
     const now = options.now ?? Date.now;
     const limits = normalizeLimits(options.limits);
     const { store, discovered } = await prepareReleaseCleanup(dataDir, paths, options);
-    // Performance: The physical-work allowance begins after discovery, ownership probes, and the
+    // Performance: The physical-work allowance begins after discovery and the
     // durable reconciliation write. A slow preparation phase must not starve every worker invocation.
     const startedAt = now();
     const initial = await store.read();
@@ -67,7 +67,7 @@ export async function runBoundedReleaseCleanup(dataDir, paths, options = {}) {
             pendingOffset += size;
             maximum -= size;
             attempted += batch.length;
-            const results = await Promise.all(batch.map(async (disposition) => await collectDisposition(store, dataDir, paths, disposition, options)));
+            const results = await Promise.all(batch.map(async (disposition) => await collectDisposition(store, dataDir, disposition, options)));
             completed += results.filter(Boolean).length;
             guaranteed = false;
         }
@@ -78,7 +78,7 @@ export async function runBoundedReleaseCleanup(dataDir, paths, options = {}) {
             maximum -= 1;
             const certificationId = certificationReleaseId(artifact);
             if (certificationId !== null) {
-                const inputs = await protectionInputs(dataDir, paths, transactionStore, options.externalHolds ?? [], options.residentHolds);
+                const inputs = await protectionInputs(transactionStore, options);
                 if (isProtectedDetachedRelease(await store.read(), inputs, certificationId))
                     continue;
             }
@@ -137,7 +137,7 @@ export async function scheduleReleaseCleanup(dataDir, paths, options = {}) {
         ...process.env,
         [PRODUCT_IDENTITY.environment.dataDir]: dataDir,
         [PRODUCT_IDENTITY.environment.runtimeDir]: paths.runtimeDir,
-        [WORKER_HOLDS_ENV]: JSON.stringify(options.externalHolds ?? []),
+        [WORKER_KEEP_ENV]: JSON.stringify(ownReleaseIds(options)),
         [WORKER_RUN_ID_ENV]: runId,
     };
     try {
@@ -152,13 +152,13 @@ export async function scheduleReleaseCleanup(dataDir, paths, options = {}) {
 /** Entry used by the private cleanup executable shipped in every immutable release. */
 export async function runReleaseCleanupWorker(environment = process.env, workerOptions = {}) {
     const paths = resolveProductPaths(environment);
-    const store = new CohortStateStore(paths.dataDir);
+    const store = new ReleaseStateStore(paths.dataDir);
     const runId = environment[WORKER_RUN_ID_ENV] ?? randomUUID();
     const now = workerOptions.now ?? Date.now;
     const sleep = workerOptions.sleep ?? (async (durationMs) => await new Promise(resolvePromise => setTimeout(resolvePromise, durationMs)));
     const cleanupOptions = {
         ...workerOptions.cleanup,
-        externalHolds: workerOptions.cleanup?.externalHolds ?? parseWorkerHolds(environment[WORKER_HOLDS_ENV]),
+        ownReleaseIds: workerOptions.cleanup?.ownReleaseIds ?? parseWorkerKeep(environment[WORKER_KEEP_ENV]),
     };
     const summary = { batches: 0, attempted: 0, completed: 0, remaining: Object.keys((await store.read()).cleanup.pending).length };
     let lease = null;
@@ -227,24 +227,10 @@ export async function runReleaseCleanupWorker(environment = process.env, workerO
         durationMs: Math.max(0, now() - startedAt),
     };
 }
-/** Compatibility helper: detach one requested release and execute a one-item pass. */
-export async function collectRelease(store, dataDir, releaseId, externalReferences, paths) {
-    const holds = externalReferences.map(referenced => ({ authority: "migration", releaseId: referenced }));
-    const state = await store.read();
-    if (!state.releases[releaseId])
-        throw new Error(`unknown release ${releaseId}`);
-    await store.reconcileRetention(async () => ({ ...(await protectionInputs(dataDir, paths, new UpdateTransactionStore(dataDir), holds)) }));
-    const disposition = (await store.read()).cleanup.pending[releaseId];
-    if (!disposition)
-        throw new Error(`release ${releaseId} is still referenced and cannot be collected`);
-    const removed = await collectDisposition(store, dataDir, paths, disposition, { externalHolds: holds, limits: { maxItems: 1 } });
-    if (!removed)
-        throw new Error(`release ${releaseId} could not be collected`);
-}
-async function collectDisposition(store, dataDir, paths, disposition, options) {
+async function collectDisposition(store, dataDir, disposition, options) {
     const releaseId = disposition.release.releaseId;
     try {
-        const inputs = await protectionInputs(dataDir, paths, options.transactionStore ?? new UpdateTransactionStore(dataDir), options.externalHolds ?? [], options.residentHolds);
+        const inputs = await protectionInputs(options.transactionStore ?? new UpdateTransactionStore(dataDir), options);
         const current = await store.read();
         if (isProtectedDetachedRelease(current, inputs, releaseId))
             return false;
@@ -285,67 +271,30 @@ async function collectDisposition(store, dataDir, paths, disposition, options) {
 function isProtectedDetachedRelease(state, inputs, releaseId) {
     const selected = [state.references.active, state.references.pending, state.references.approved, state.references.rollback]
         .some(reference => reference === releaseId);
+    // Concurrency: a launch may have recorded the same release again after it was detached.
     return selected
-        || (inputs.liveReleaseIds ?? []).includes(releaseId)
-        || (inputs.externalHolds ?? []).some(hold => hold.releaseId === releaseId)
+        || state.releases[releaseId] !== undefined
+        || (inputs.ownReleaseIds ?? []).includes(releaseId)
         || (inputs.transaction?.status === "active" && inputs.transaction.priorActiveReleaseId === releaseId);
 }
-async function protectionInputs(dataDir, paths, transactionStore, externalHolds, residentHolds) {
-    const [liveIds, transaction, resident] = await Promise.all([
-        paths ? liveReleaseIds(paths) : Promise.resolve([]),
-        transactionStore.read(),
-        residentReleaseHolds(dataDir, residentHolds),
-    ]);
-    return { liveReleaseIds: liveIds, externalHolds: [...externalHolds, ...resident], transaction: transactionReference(transaction) };
+async function protectionInputs(transactionStore, options) {
+    return {
+        ownReleaseIds: ownReleaseIds(options),
+        transaction: transactionReference(await transactionStore.read()),
+        now: (options.wallClock ?? Date.now)(),
+        ...(options.retentionMs === undefined ? {} : { retentionMs: options.retentionMs }),
+    };
 }
-/**
- * Holds every release a live resident server, holder, or tab child runs from. Retention fails
- * closed: an incomplete report, or a recorded root inside the release store that names no known
- * release, holds every known release.
- */
-async function residentReleaseHolds(dataDir, reader) {
-    const state = await new CohortStateStore(dataDir).read();
-    const records = [
-        ...Object.values(state.releases),
-        ...Object.values(state.cleanup.pending).map(disposition => disposition.release),
-    ];
-    const preferred = [state.references.active, state.references.rollback]
-        .flatMap(id => id && state.releases[id] ? [state.releases[id].releaseRoot] : []);
-    const roots = [...new Set([...preferred, ...Object.values(state.releases).map(record => record.releaseRoot)])];
-    const report = await (reader ?? ((directory, releaseRoots) => readResidentReleaseHolds({ dataDir: directory, releaseRoots })))(dataDir, roots);
-    const everything = () => [...new Set(records.map(record => record.releaseId))].map(releaseId => ({ authority: "resident", releaseId }));
-    if (!report.complete)
-        return everything();
-    if (report.releaseRoots.length === 0)
+function ownReleaseIds(options) {
+    if (options.ownReleaseIds !== undefined)
+        return options.ownReleaseIds;
+    try {
+        const own = readLaunchContext(process.env).releaseId;
+        return own === undefined ? [] : [own];
+    }
+    catch {
         return [];
-    // Rationale: native Windows extended paths and Unix aliases must match the catalog's spelling.
-    const byRoot = new Map();
-    for (const record of records) {
-        const canonical = await realpath(record.releaseRoot).catch(() => record.releaseRoot);
-        byRoot.set(comparablePath(canonical), record.releaseId);
-    }
-    const directory = await realpath(resolve(dataDir, "releases")).catch(() => null);
-    if (directory === null)
-        return everything();
-    const store = comparablePath(directory);
-    const holds = new Set();
-    for (const root of report.releaseRoots) {
-        // Security: an unresolved live root may alias managed content; uncertainty must retain it.
-        const canonical = await realpath(root).catch(() => null);
-        if (canonical === null)
-            return everything();
-        const key = comparablePath(canonical);
-        const releaseId = byRoot.get(key);
-        if (releaseId)
-            holds.add(releaseId);
-        else if (key.startsWith(`${store}${sep}`))
-            return everything();
-    }
-    return [...holds].sort().map(releaseId => ({ authority: "resident", releaseId }));
-}
-function comparablePath(path) {
-    const absolute = resolve(path);
-    return process.platform === "win32" ? absolute.toLowerCase() : absolute;
+    }
 }
 function transactionReference(transaction) {
     return transaction === null ? null : { status: transaction.status, priorActiveReleaseId: transaction.priorActiveReleaseId };
@@ -779,25 +728,12 @@ async function readWorkerLease(path) {
         return null;
     }
 }
-function processIsAlive(pid) {
-    try {
-        process.kill(pid, 0);
-        return true;
-    }
-    catch (error) {
-        return error instanceof Error && "code" in error && error.code === "EPERM";
-    }
-}
-function parseWorkerHolds(value) {
+function parseWorkerKeep(value) {
     if (!value)
         return [];
     try {
         const parsed = JSON.parse(value);
-        if (!Array.isArray(parsed))
-            return [];
-        return parsed.filter((hold) => Boolean(hold) && typeof hold === "object"
-            && ["agent", "migration", "resident"].includes(hold.authority)
-            && typeof hold.releaseId === "string");
+        return Array.isArray(parsed) ? parsed.filter((id) => typeof id === "string" && id.length > 0) : [];
     }
     catch {
         return [];