@timurproko/a1 0.2.7-dev.1249 → 0.2.7-dev.1255

package/dist/foundation/release/{cohort-state.d.ts → release-state.d.ts}

@@ -1,5 +1,7 @@
 import type { MaterializedRelease } from "./release-store.js";
-export declare const RELEASE_COHORT_SCHEMA: string;
+export declare const RELEASE_STATE_SCHEMA: string;
+/** How long a release stays on disk after its approval, so processes started from it keep their files. */
+export declare const RELEASE_RETENTION_MS: number;
 export type ReleaseApproval = "candidate" | "approved" | "rejected";
 export interface ReleaseRecord {
     readonly releaseId: string;
@@ -9,6 +11,7 @@ export interface ReleaseRecord {
     readonly launchContract?: string;
     readonly approval: ReleaseApproval;
     readonly materializedAt: string;
+    /** When the release was approved; retention measures its age from this instant. */
     readonly certifiedAt: string | null;
     readonly diagnosticsPath: string | null;
 }
@@ -19,12 +22,6 @@ export interface ReleaseReferences {
     readonly rollback: string | null;
     readonly retention: readonly string[];
 }
-export type ExternalReleaseHoldAuthority = "agent" | "migration" | "resident";
-/** A current hold supplied by an authority that must participate in every reconciliation. */
-export interface ExternalReleaseHold {
-    readonly authority: ExternalReleaseHoldAuthority;
-    readonly releaseId: string;
-}
 export interface ActiveReleaseTransactionReference {
     readonly status: "active" | "completed" | "rolled-back" | "failed";
     readonly priorActiveReleaseId: string | null;
@@ -69,49 +66,21 @@ export interface ReleaseCleanupState {
     readonly diagnostics: readonly ReleaseCleanupDiagnostic[];
     readonly workerRuns: readonly ReleaseCleanupWorkerRun[];
 }
-export interface CohortState {
-    readonly schema: typeof RELEASE_COHORT_SCHEMA;
+export interface ReleaseState {
+    readonly schema: typeof RELEASE_STATE_SCHEMA;
     readonly revision: number;
     readonly releases: Readonly<Record<string, ReleaseRecord>>;
     readonly references: ReleaseReferences;
     readonly cleanup: ReleaseCleanupState;
-    readonly activation: {
-        readonly state: "idle" | "pending" | "draining" | "blocked" | "failed";
-        readonly reason: string | null;
-        readonly blockerGenerationIds: readonly string[];
-        readonly updatedAt: string;
-    };
-}
-export interface EndpointOwnership {
-    readonly state: "idle" | "busy" | "draining" | "released" | "blocked";
-    readonly liveInstanceIds: readonly string[];
-    readonly nonResumableInstanceIds: readonly string[];
-    readonly uncertainInstanceIds: readonly string[];
-}
-export interface SupervisorEndpointMetadata {
-    readonly schema: string;
-    readonly supervisorId: string;
-    readonly endpoint: string;
-    readonly pid: number;
-    readonly pidStartIdentity: string;
-    /** Exact OS creation token; absent on historical supervisor metadata. */
-    readonly nativeStartIdentity?: string;
-    readonly bootNonce: string;
-    readonly startedAt: string;
-    readonly releaseId: string;
-    readonly releaseRoot: string;
-    readonly contentDigest: string;
-    readonly ownership: EndpointOwnership;
-    readonly envelope: string;
-    readonly envelopeRevision: number;
-    readonly requiredFeatures: readonly string[];
-    readonly optionalFeatures: readonly string[];
-    readonly contractDigest: string;
 }
 export interface ProtectedReleaseInputs {
-    readonly liveReleaseIds?: readonly string[];
-    readonly externalHolds?: readonly ExternalReleaseHold[];
+    /** Releases the reconciling command itself runs from; they are never collected under it. */
+    readonly ownReleaseIds?: readonly string[];
     readonly transaction?: ActiveReleaseTransactionReference | null;
+    /** Clock for the age window; defaults to the wall clock. */
+    readonly now?: number;
+    /** Age window measured from approval; defaults to seven days. */
+    readonly retentionMs?: number;
 }
 export interface ProtectedReleasePlan {
     readonly protectedReleaseIds: readonly string[];
@@ -124,38 +93,44 @@ export interface OrphanReleaseDisposition {
     readonly trashPath?: string | null;
 }
 export interface ReleaseRetentionReconciliation {
-    readonly state: CohortState;
+    readonly state: ReleaseState;
     readonly plan: ProtectedReleasePlan;
     readonly detachedReleaseIds: readonly string[];
 }
 /**
- * Derive protection exclusively from current selectors and ownership authorities.
- * The historical retention snapshot is deliberately not an input to this plan.
+ * Age-based retention. A release stays while a selector names it (active, its rollback, or a
+ * candidate still being certified), while an unfinished update may return to it, while the
+ * reconciling command runs from it, or while its approval is younger than the retention window.
+ * Nothing asks which processes are running: a session that outlives the window and two updates
+ * can lose its release files, which is the documented trade-off.
  */
-export declare function planProtectedReleases(state: CohortState, inputs?: ProtectedReleaseInputs): ProtectedReleasePlan;
-/** Serializes validated cohort-state revisions under a lock and commits each update atomically. */
-export declare class CohortStateStore {
+export declare function planProtectedReleases(state: ReleaseState, inputs?: ProtectedReleaseInputs): ProtectedReleasePlan;
+/**
+ * Whether a release is young enough to keep. An approved release counts from its approval; a
+ * candidate still awaiting certification counts from its materialization so concurrent work is
+ * not collected under it. A record without a readable timestamp is treated as old.
+ */
+export declare function withinRetention(release: ReleaseRecord, now: number, retentionMs?: number): boolean;
+/** Serializes validated release-state revisions under a lock and commits each update atomically. */
+export declare class ReleaseStateStore {
     readonly path: string;
     constructor(dataDir: string);
-    read(): Promise<CohortState>;
-    update(operation: (current: CohortState) => CohortState | Promise<CohortState>): Promise<CohortState>;
-    recordCandidate(release: MaterializedRelease): Promise<CohortState>;
-    approve(releaseId: string, diagnosticsPath: string): Promise<CohortState>;
-    activate(releaseId: string): Promise<CohortState>;
+    read(): Promise<ReleaseState>;
+    update(operation: (current: ReleaseState) => ReleaseState | Promise<ReleaseState>): Promise<ReleaseState>;
+    recordCandidate(release: MaterializedRelease): Promise<ReleaseState>;
+    approve(releaseId: string, diagnosticsPath: string): Promise<ReleaseState>;
+    activate(releaseId: string): Promise<ReleaseState>;
     /** Atomically advances ordinary launch without allowing an older installation to roll active state back. */
-    activateForLaunch(releaseId: string, replaceUnlaunchableActiveId?: string): Promise<CohortState>;
-    blockPending(reason: string, blockerGenerationIds: readonly string[]): Promise<CohortState>;
-    rollback(ownershipReleased: boolean): Promise<CohortState>;
-    setRetention(releaseIds: readonly string[]): Promise<CohortState>;
+    activateForLaunch(releaseId: string, replaceUnlaunchableActiveId?: string): Promise<ReleaseState>;
+    rollback(): Promise<ReleaseState>;
     /** Atomically replace legacy retention history and detach every currently collectible record. */
-    reconcileRetention(resolveInputs: (current: CohortState) => ProtectedReleaseInputs | Promise<ProtectedReleaseInputs>, orphans?: readonly OrphanReleaseDisposition[]): Promise<ReleaseRetentionReconciliation>;
-    markCleanupTrash(releaseId: string, trashPath: string): Promise<CohortState>;
-    recordCleanupFailure(releaseId: string, stage: string, error: unknown): Promise<CohortState>;
-    completeCleanup(releaseId: string): Promise<CohortState>;
-    recordCleanupWorkerScheduled(runId: string): Promise<CohortState>;
-    recordCleanupWorkerStarted(runId: string, pid: number): Promise<CohortState>;
-    recordCleanupWorkerProgress(runId: string, summary: ReleaseCleanupWorkerSummary): Promise<CohortState>;
-    recordCleanupWorkerFinished(runId: string, status: Exclude<ReleaseCleanupWorkerStatus, "scheduled" | "running">, summary: ReleaseCleanupWorkerSummary, error?: unknown): Promise<CohortState>;
-    removeUnreferencedRelease(releaseId: string, externalReferences: readonly string[]): Promise<CohortState>;
-}
-export declare function emptyState(): CohortState;
+    reconcileRetention(resolveInputs: (current: ReleaseState) => ProtectedReleaseInputs | Promise<ProtectedReleaseInputs>, orphans?: readonly OrphanReleaseDisposition[]): Promise<ReleaseRetentionReconciliation>;
+    markCleanupTrash(releaseId: string, trashPath: string): Promise<ReleaseState>;
+    recordCleanupFailure(releaseId: string, stage: string, error: unknown): Promise<ReleaseState>;
+    completeCleanup(releaseId: string): Promise<ReleaseState>;
+    recordCleanupWorkerScheduled(runId: string): Promise<ReleaseState>;
+    recordCleanupWorkerStarted(runId: string, pid: number): Promise<ReleaseState>;
+    recordCleanupWorkerProgress(runId: string, summary: ReleaseCleanupWorkerSummary): Promise<ReleaseState>;
+    recordCleanupWorkerFinished(runId: string, status: Exclude<ReleaseCleanupWorkerStatus, "scheduled" | "running">, summary: ReleaseCleanupWorkerSummary, error?: unknown): Promise<ReleaseState>;
+}
+export declare function emptyState(): ReleaseState;

package/dist/foundation/release/{cohort-state.js → release-state.js}

@@ -3,33 +3,34 @@ import { mkdir, open, readFile, rename, rm, stat } from "node:fs/promises";
 import { dirname, resolve } from "node:path";
 import { selectOrdinaryLaunchReleaseId } from "./ordinary-launch-selection.js";
 import { PRODUCT_IDENTITY } from "../../product-identity.js";
-export const RELEASE_COHORT_SCHEMA = PRODUCT_IDENTITY.protocol.releaseCohortSchema;
+export const RELEASE_STATE_SCHEMA = PRODUCT_IDENTITY.protocol.releaseCohortSchema;
 const RELEASE_ID_PATTERN = /^[0-9A-Za-z.+_-]+-[a-f0-9]{20}$/;
+/** How long a release stays on disk after its approval, so processes started from it keep their files. */
+export const RELEASE_RETENTION_MS = 7 * 24 * 60 * 60 * 1_000;
 /**
- * Derive protection exclusively from current selectors and ownership authorities.
- * The historical retention snapshot is deliberately not an input to this plan.
+ * Age-based retention. A release stays while a selector names it (active, its rollback, or a
+ * candidate still being certified), while an unfinished update may return to it, while the
+ * reconciling command runs from it, or while its approval is younger than the retention window.
+ * Nothing asks which processes are running: a session that outlives the window and two updates
+ * can lose its release files, which is the documented trade-off.
  */
 export function planProtectedReleases(state, inputs = {}) {
-    const holds = inputs.externalHolds ?? [];
-    for (const hold of holds) {
-        if (hold.authority !== "agent" && hold.authority !== "migration" && hold.authority !== "resident")
-            throw new Error(`unknown release hold authority: ${String(hold.authority)}`);
-        if (!state.releases[hold.releaseId] && !state.cleanup.pending[hold.releaseId]) {
-            throw new Error(`external ${hold.authority} hold names unknown release ${hold.releaseId}`);
-        }
-    }
     const protectedIds = new Set();
     for (const id of [state.references.active, state.references.pending, state.references.approved, state.references.rollback]) {
         if (id !== null)
             protectedIds.add(id);
     }
-    for (const id of inputs.liveReleaseIds ?? [])
+    for (const id of inputs.ownReleaseIds ?? [])
         protectedIds.add(id);
-    for (const hold of holds)
-        protectedIds.add(hold.releaseId);
     if (inputs.transaction?.status === "active" && inputs.transaction.priorActiveReleaseId !== null) {
         protectedIds.add(inputs.transaction.priorActiveReleaseId);
     }
+    const now = inputs.now ?? Date.now();
+    const window = inputs.retentionMs ?? RELEASE_RETENTION_MS;
+    for (const release of Object.values(state.releases)) {
+        if (withinRetention(release, now, window))
+            protectedIds.add(release.releaseId);
+    }
     const protectedReleaseIds = [...protectedIds].sort();
     const known = Object.keys(state.releases).sort();
     return {
@@ -38,8 +39,20 @@ export function planProtectedReleases(state, inputs = {}) {
         collectibleReleaseIds: known.filter(id => !protectedIds.has(id)),
     };
 }
-/** Serializes validated cohort-state revisions under a lock and commits each update atomically. */
-export class CohortStateStore {
+/**
+ * Whether a release is young enough to keep. An approved release counts from its approval; a
+ * candidate still awaiting certification counts from its materialization so concurrent work is
+ * not collected under it. A record without a readable timestamp is treated as old.
+ */
+export function withinRetention(release, now, retentionMs = RELEASE_RETENTION_MS) {
+    if (release.approval === "rejected")
+        return false;
+    const stamp = release.approval === "approved" ? release.certifiedAt : release.materializedAt;
+    const at = stamp === null ? Number.NaN : Date.parse(stamp);
+    return Number.isFinite(at) && now - at < retentionMs;
+}
+/** Serializes validated release-state revisions under a lock and commits each update atomically. */
+export class ReleaseStateStore {
     path;
     constructor(dataDir) {
         this.path = resolve(dataDir, "release-state.json");
@@ -103,7 +116,6 @@ export class CohortStateStore {
                     ...current.references,
                     pending: current.references.active === release.releaseId ? current.references.pending : release.releaseId,
                 },
-                activation: activation("pending", "candidate awaits certification and safe activation"),
             };
         });
     }
@@ -132,7 +144,6 @@ export class CohortStateStore {
                     approved: releaseId,
                     rollback: prior && prior !== releaseId ? prior : current.references.rollback,
                 },
-                activation: activation("idle", null),
             };
         });
     }
@@ -153,7 +164,6 @@ export class CohortStateStore {
                         pending: current.references.pending === releaseId ? null : current.references.pending,
                         approved: selectedId,
                     },
-                    activation: activation("idle", null),
                 };
             }
             const prior = current.references.active;
@@ -166,16 +176,10 @@ export class CohortStateStore {
                     approved: releaseId,
                     rollback: prior && prior !== releaseId ? prior : current.references.rollback,
                 },
-                activation: activation("idle", null),
             };
         });
     }
-    async blockPending(reason, blockerGenerationIds) {
-        return await this.update(current => ({ ...current, activation: { ...activation("blocked", reason), blockerGenerationIds: [...blockerGenerationIds] } }));
-    }
-    async rollback(ownershipReleased) {
-        if (!ownershipReleased)
-            throw new Error("cannot roll back before current cohort ownership is released");
+    async rollback() {
         return await this.update(current => {
             const rollbackId = current.references.rollback;
             if (!rollbackId)
@@ -192,17 +196,9 @@ export class CohortStateStore {
                     approved: rollbackId,
                     rollback: current.references.active,
                 },
-                activation: activation("idle", null),
             };
         });
     }
-    async setRetention(releaseIds) {
-        return await this.update(current => {
-            for (const releaseId of releaseIds)
-                requiredRelease(current, releaseId);
-            return { ...current, references: { ...current.references, retention: unique(releaseIds) } };
-        });
-    }
     /** Atomically replace legacy retention history and detach every currently collectible record. */
     async reconcileRetention(resolveInputs, orphans = []) {
         let plan = null;
@@ -318,40 +314,14 @@ export class CohortStateStore {
             error: error === null ? null : boundedError(error),
         })));
     }
-    async removeUnreferencedRelease(releaseId, externalReferences) {
-        return await this.update(current => {
-            const release = requiredRelease(current, releaseId);
-            const protectedIds = new Set([
-                current.references.active,
-                current.references.pending,
-                current.references.approved,
-                current.references.rollback,
-                ...current.references.retention,
-                ...externalReferences,
-            ].filter((value) => value !== null));
-            if (protectedIds.has(releaseId))
-                throw new Error(`release ${releaseId} is still referenced and cannot be collected`);
-            const releases = { ...current.releases };
-            delete releases[releaseId];
-            return {
-                ...current,
-                releases,
-                cleanup: {
-                    ...current.cleanup,
-                    pending: { ...current.cleanup.pending, [releaseId]: cleanupDisposition(release, "detached", null) },
-                },
-            };
-        });
-    }
 }
 export function emptyState() {
     return {
-        schema: RELEASE_COHORT_SCHEMA,
+        schema: RELEASE_STATE_SCHEMA,
         revision: 0,
         releases: {},
         references: { active: null, pending: null, approved: null, rollback: null, retention: [] },
         cleanup: { pending: {}, diagnostics: [], workerRuns: [] },
-        activation: activation("idle", null),
     };
 }
 function cleanupDisposition(release, stage, trashPath) {
@@ -382,16 +352,12 @@ function replaceCleanupWorkerRun(current, runId, operation) {
         : [...current.cleanup.workerRuns, operation(undefined)];
     return { ...current, cleanup: { ...current.cleanup, workerRuns: workerRuns.slice(-16) } };
 }
-function activation(state, reason) {
-    return { state, reason, blockerGenerationIds: [], updatedAt: new Date().toISOString() };
-}
 function requiredRelease(state, releaseId) {
     const release = state.releases[releaseId];
     if (!release)
         throw new Error(`unknown release ${releaseId}`);
     return release;
 }
-function unique(values) { return [...new Set(values)]; }
 async function acquireLock(path) {
     const deadline = Date.now() + 5_000;
     while (true) {
@@ -452,7 +418,9 @@ async function reclaimAbandonedLock(path) {
 function normalizeState(value) {
     if (!value || typeof value !== "object")
         return value;
-    const state = value;
+    // Compatibility: state written while supervisors coordinated activation carries an
+    // `activation` record that nothing reads any more; it is dropped on the next write.
+    const { activation: _activation, ...state } = value;
     const cleanup = state.cleanup;
     return {
         ...state,
@@ -462,11 +430,11 @@ function normalizeState(value) {
     };
 }
 function validateState(state) {
-    if (!state || state.schema !== RELEASE_COHORT_SCHEMA || !Number.isSafeInteger(state.revision) || state.revision < 0
+    if (!state || state.schema !== RELEASE_STATE_SCHEMA || !Number.isSafeInteger(state.revision) || state.revision < 0
         || !state.releases || typeof state.releases !== "object" || !state.references || !Array.isArray(state.references.retention)
         || !state.cleanup || typeof state.cleanup.pending !== "object" || !Array.isArray(state.cleanup.diagnostics)
         || !Array.isArray(state.cleanup.workerRuns)) {
-        throw new Error("invalid release cohort state");
+        throw new Error("invalid release state");
     }
     for (const run of state.cleanup.workerRuns) {
         if (!run || typeof run.runId !== "string" || run.runId.length === 0
@@ -501,9 +469,9 @@ function validateReleaseRecord(releaseId, release) {
 function validateTransition(current, next) {
     validateState(next);
     if (next.schema !== current.schema)
-        throw new Error("release cohort schema cannot change during a state update");
+        throw new Error("release schema cannot change during a state update");
     if (next.revision !== current.revision)
-        throw new Error("release cohort revision is controlled by the state store");
+        throw new Error("release revision is controlled by the state store");
 }
 function boundedError(error) {
     return (error instanceof Error ? error.message : String(error)).replace(/[\r\n]+/g, " ").slice(0, 1_000);

package/dist/foundation/release/release-store.d.ts

@@ -51,8 +51,8 @@ export declare function assertCertifiedFilesPresent(releaseRoot: string): Promis
 export declare function repairMaterializedRelease(packageRoot: string, releaseRoot: string): Promise<MaterializedRelease>;
 /**
  * Load metadata for a release whose bytes were already certified by the
- * current parent process or an authenticated live supervisor. Callers must
- * establish one of those preconditions; untrusted releases require full
+ * current parent process or recorded by an authenticated certification. Callers must
+ * establish that precondition; untrusted releases require full
  * verification.
  */
 export declare function readCertifiedReleaseManifest(record: CertifiedReleaseRecord, selectedStoreRoot: string, options?: ReadCertifiedReleaseManifestOptions): Promise<MaterializedRelease>;

package/dist/foundation/release/release-store.js

@@ -167,8 +167,8 @@ export async function repairMaterializedRelease(packageRoot, releaseRoot) {
 }
 /**
  * Load metadata for a release whose bytes were already certified by the
- * current parent process or an authenticated live supervisor. Callers must
- * establish one of those preconditions; untrusted releases require full
+ * current parent process or recorded by an authenticated certification. Callers must
+ * establish that precondition; untrusted releases require full
  * verification.
  */
 export async function readCertifiedReleaseManifest(record, selectedStoreRoot, options = {}) {

package/dist/foundation/release/restart-certification.js

@@ -10,7 +10,7 @@ import { PRODUCT_PACKAGE_NAME } from "./release.js";
 import { RELEASE_MANIFEST_FILENAME } from "./release-store.js";
 import { UpdateTransactionStore } from "./update-transaction.js";
 const RESTART_SEAL_VERSION = 1;
-const REQUIRED_LAUNCH_ENTRIES = ["bin/supervisor.js", "bin/guardian.js"];
+const REQUIRED_LAUNCH_ENTRIES = ["bin/ui.js"];
 /** Build compact restart authority after complete content verification established read-only payload files. */
 export async function createRestartSeal(release, dataDir) {
     const policy = immutablePlatformPolicy();

package/dist/foundation/release/update-activation.d.ts

@@ -1,4 +1,3 @@
-import type { ContinuityOptions } from "../resident-tabs/index.js";
 /**
  * The one activation contract an installed tree can offer the updater that installed it.
  * The updater knows nothing else about the tree: the manifest names the contracts the tree
@@ -9,10 +8,6 @@ export declare const UPDATE_ACTIVATION_ENTRY = "bin/activate.js";
 /** Manifest field listing the activation contracts an installed tree serves. */
 export declare const UPDATE_ACTIVATION_MANIFEST_FIELD = "updateActivationContracts";
 export type UpdateActivationPhase = "materialized" | "certified" | "active-reference-committed";
-/** A certified candidate is safe to retain, but resident control continuity blocks selection. */
-export declare class UpdateActivationBlockedError extends Error {
-    readonly code: "resident-continuity-blocked";
-}
 /**
  * Copying the release is the longest step with nothing to say for itself, so it
  * reports the files it has written against the files it must write. A caller that
@@ -49,12 +44,11 @@ export type UpdateActivationEvent = {
 } | {
     readonly event: "failed";
     readonly message: string;
-    readonly code?: UpdateActivationBlockedError["code"];
 };
 /**
  * Activate the installed tree at `packageRoot` with this process's own release code:
- * materialize it into the immutable store, certify, warm, verify supervision, and only
- * then move the active reference. This is what the installed tree runs for itself through
+ * materialize it into the immutable store, certify, warm, and only then move the active
+ * reference. This is what the installed tree runs for itself through
  * its activation entry, and what an updater runs in-process for a tree older than the contract.
  */
 export declare function activateInstalledRelease(request: UpdateActivationRequest, callbacks: UpdateActivationCallbacks): Promise<void>;
@@ -76,4 +70,3 @@ export declare function delegateActivation(request: UpdateActivationRequest, cal
 export declare function runActivationEntry(argv: readonly string[], entryUrl: string, io?: {
     write(line: string): void;
 }, environment?: NodeJS.ProcessEnv): Promise<number>;
-export declare function assertContinuityOrBlock(context: ContinuityOptions): Promise<void>;

package/dist/foundation/release/update-activation.js

@@ -2,10 +2,9 @@ import { spawn } from "node:child_process";
 import { readFile } from "node:fs/promises";
 import { resolve } from "node:path";
 import { fileURLToPath } from "node:url";
-import { PRODUCT_IDENTITY, PRODUCT_TEXT } from "../../product-identity.js";
-import { certifyMaterializedRelease, ensureSupervisor } from "./bootstrap.js";
-import { CohortStateStore } from "./cohort-state.js";
-import { encodeFrame, LineFrameDecoder } from "../protocol/index.js";
+import { PRODUCT_TEXT } from "../../product-identity.js";
+import { certifyMaterializedRelease } from "./bootstrap.js";
+import { ReleaseStateStore } from "./release-state.js";
 import { resolveProductPaths } from "../lifecycle/index.js";
 import { materializeRelease } from "./release-store.js";
 import { warmMaterializedRelease } from "./warmup.js";
@@ -19,18 +18,16 @@ export const UPDATE_ACTIVATION_ENTRY = "bin/activate.js";
 /** Manifest field listing the activation contracts an installed tree serves. */
 export const UPDATE_ACTIVATION_MANIFEST_FIELD = "updateActivationContracts";
 const ACTIVATION_DIAGNOSTIC_LIMIT = 2_000;
-/** A certified candidate is safe to retain, but resident control continuity blocks selection. */
-export class UpdateActivationBlockedError extends Error {
-    code = "resident-continuity-blocked";
-}
+/** Bound on one progress line; the activator's events are all far shorter. */
+const ACTIVATION_LINE_LIMIT = 64 * 1_024;
 /**
  * Activate the installed tree at `packageRoot` with this process's own release code:
- * materialize it into the immutable store, certify, warm, verify supervision, and only
- * then move the active reference. This is what the installed tree runs for itself through
+ * materialize it into the immutable store, certify, warm, and only then move the active
+ * reference. This is what the installed tree runs for itself through
  * its activation entry, and what an updater runs in-process for a tree older than the contract.
  */
 export async function activateInstalledRelease(request, callbacks) {
-    const stateStore = new CohortStateStore(request.dataDir);
+    const stateStore = new ReleaseStateStore(request.dataDir);
     let total = 0;
     let completed = 0;
     const candidate = await materializeRelease(request.packageRoot, request.dataDir, {
@@ -55,16 +52,6 @@ export async function activateInstalledRelease(request, callbacks) {
     callbacks.onWarmup?.("started");
     await warmMaterializedRelease(candidate, request.environment);
     callbacks.onWarmup?.("completed");
-    await completeActivation(candidate, request, callbacks, stateStore);
-}
-async function completeActivation(candidate, request, callbacks, stateStore) {
-    const paths = resolveProductPaths(request.environment);
-    const continuity = { releaseRoot: candidate.releaseRoot, dataDir: request.dataDir, environment: request.environment,
-        profileRoot: request.environment[PRODUCT_IDENTITY.environment.profileHome] ?? paths.configDir, runtimeDir: paths.runtimeDir };
-    await assertContinuityOrBlock(continuity);
-    await ensureSupervisor(candidate, request.environment);
-    // Invariant: revalidate after supervision, before committing client activation or restart readiness.
-    await assertContinuityOrBlock(continuity);
     await stateStore.activate(candidate.releaseId);
     await callbacks.phase("active-reference-committed");
 }
@@ -94,7 +81,7 @@ export async function delegateActivation(request, callbacks) {
         stdio: ["ignore", "pipe", "pipe"],
         windowsHide: true,
     });
-    const decoder = new LineFrameDecoder();
+    let pending = "";
     let diagnostics = "";
     let failure = null;
     let completed = false;
@@ -102,14 +89,25 @@ export async function delegateActivation(request, callbacks) {
     let relay = Promise.resolve();
     child.stderr?.setEncoding("utf8");
     child.stderr?.on("data", chunk => { diagnostics = `${diagnostics}${chunk}`.slice(-ACTIVATION_DIAGNOSTIC_LIMIT); });
+    child.stdout?.setEncoding("utf8");
     child.stdout?.on("data", chunk => {
-        let events;
-        try {
-            events = decoder.push(chunk);
+        const lines = `${pending}${String(chunk)}`.split("\n");
+        pending = lines.pop() ?? "";
+        if (pending.length > ACTIVATION_LINE_LIMIT) {
+            failure ??= new Error("activation event exceeds the line limit");
+            pending = "";
         }
-        catch (error) {
-            failure ??= new Error(errorMessage(error));
-            return;
+        const events = [];
+        for (const line of lines) {
+            if (line.trim().length === 0)
+                continue;
+            try {
+                events.push(JSON.parse(line));
+            }
+            catch (error) {
+                failure ??= new Error(errorMessage(error));
+                return;
+            }
         }
         for (const event of events) {
             relay = relay.then(async () => {
@@ -127,9 +125,7 @@ export async function delegateActivation(request, callbacks) {
                 else if (parsed.event === "completed")
                     completed = true;
                 else
-                    failure ??= parsed.code === "resident-continuity-blocked"
-                        ? new UpdateActivationBlockedError(parsed.message)
-                        : new Error(parsed.message);
+                    failure ??= new Error(parsed.message);
             }).catch(error => { failure ??= new Error(errorMessage(error)); });
         }
     });
@@ -150,7 +146,7 @@ export async function delegateActivation(request, callbacks) {
  * writing one progress event per line so the updater that started it can follow along.
  */
 export async function runActivationEntry(argv, entryUrl, io = { write: line => process.stdout.write(line) }, environment = process.env) {
-    const emit = (event) => io.write(encodeFrame(event));
+    const emit = (event) => io.write(`${JSON.stringify(event)}\n`);
     try {
         const arguments_ = parseEntryArguments(argv);
         const packageRoot = resolve(fileURLToPath(new URL("..", entryUrl)));
@@ -168,7 +164,7 @@ export async function runActivationEntry(argv, entryUrl, io = { write: line => p
         return 0;
     }
     catch (error) {
-        emit({ event: "failed", message: errorMessage(error), ...(error instanceof UpdateActivationBlockedError ? { code: error.code } : {}) });
+        emit({ event: "failed", message: errorMessage(error) });
         return 1;
     }
 }
@@ -206,22 +202,11 @@ function parseActivationEvent(value) {
         case "completed":
             return { event: "completed" };
         case "failed":
-            return typeof record.message === "string" && (record.code === undefined || record.code === "resident-continuity-blocked")
-                ? { event: "failed", message: record.message, ...(record.code === undefined ? {} : { code: record.code }) }
-                : null;
+            return typeof record.message === "string" ? { event: "failed", message: record.message } : null;
         default:
             return null;
     }
 }
-export async function assertContinuityOrBlock(context) {
-    const { assertResidentContinuity } = await import("../resident-tabs/index.js");
-    try {
-        await assertResidentContinuity(context);
-    }
-    catch (error) {
-        throw new UpdateActivationBlockedError(errorMessage(error), { cause: error });
-    }
-}
 function summarize(text) {
     const lines = text.split(/\r?\n/).map(line => line.trim()).filter(line => line.length > 0);
     return lines.length === 0 ? "" : `: ${lines.slice(0, 4).join(" | ")}`;

package/dist/foundation/release/update-execution-lease.d.ts

@@ -1,8 +1,7 @@
 import type { UpdateChannel } from "./types.js";
 import { type UpdateTransaction } from "./update-transaction.js";
-export declare const UPDATE_EXECUTION_LEASE_FILENAME = "update-execution.json";
 declare const LEASE_SCHEMA = 1;
-export type UpdateExecutionMode = "manual" | "automatic";
+type UpdateExecutionMode = "manual" | "automatic";
 export interface UpdateExecutionOwner {
     readonly schema: typeof LEASE_SCHEMA;
     readonly ownerId: string;
@@ -14,7 +13,7 @@ export interface UpdateExecutionOwner {
     readonly mode: UpdateExecutionMode;
     readonly acquiredAt: string;
 }
-export type UpdateExecutionLeaseResult = {
+type UpdateExecutionLeaseResult = {
     readonly status: "acquired";
     readonly owner: UpdateExecutionOwner;
     release(): Promise<void>;

package/dist/foundation/release/update-execution-lease.js

@@ -2,9 +2,9 @@ import { randomUUID } from "node:crypto";
 import { mkdir, open, readFile, rename, rm } from "node:fs/promises";
 import { dirname, resolve } from "node:path";
 import lockfile from "proper-lockfile";
-import { processIsAlive } from "./process-cleanup.js";
+import { processIsAlive } from "./process-liveness.js";
 import { UpdateTransactionStore } from "./update-transaction.js";
-export const UPDATE_EXECUTION_LEASE_FILENAME = "update-execution.json";
+const UPDATE_EXECUTION_LEASE_FILENAME = "update-execution.json";
 const LEASE_SCHEMA = 1;
 const MAX_LEASE_BYTES = 8_192;
 /**

package/dist/foundation/release/update-launch.d.ts

@@ -1,6 +1,4 @@
-import type { CohortState, ReleaseRecord } from "./cohort-state.js";
+import type { ReleaseState, ReleaseRecord } from "./release-state.js";
 import type { UpdateTransaction } from "./update-transaction.js";
 /** Keep interactive launches on the last successful release until the update commits success. */
-export declare function selectUpdateLaunchRelease(state: CohortState, transaction: UpdateTransaction | null): ReleaseRecord | null;
-/** Pause cohort retirement during preparation; afterward only the successful launch release admits new sessions. */
-export declare function selectSupervisorLaunchReleaseId(state: CohortState, transaction: UpdateTransaction | null): string | null;
+export declare function selectUpdateLaunchRelease(state: ReleaseState, transaction: UpdateTransaction | null): ReleaseRecord | null;