@timurproko/a1 0.2.7-dev.1275 → 0.2.7-dev.1285

package/dist/foundation/release/bootstrap.js

@@ -4,6 +4,7 @@ import { deliverExitNotice, restoreAfterOwnedExit } from "../terminal-cleanup/in
 import { chmod, mkdir, readFile, writeFile } from "node:fs/promises";
 import { resolve } from "node:path";
 import { selectOrdinaryLaunchReleaseId } from "./ordinary-launch-selection.js";
+import { acquireReleaseUse } from "./release-use.js";
 import { ReleaseStateStore } from "./release-state.js";
 import { assertLaunchProfileId, resolveProductPaths, sessionSelectionArguments } from "../lifecycle/index.js";
 import { UpdateTransactionStore } from "./update-transaction.js";
@@ -31,7 +32,7 @@ async function runBootstrapAttempt(options, retriesRemaining) {
     const paths = resolveProductPaths(environment);
     await mkdir(paths.runtimeDir, { recursive: true, mode: 0o700 });
     const launchSelected = async (release) => {
-        const result = await launchUi(release, environment, sessionArgs, paths.runtimeDir);
+        const result = await launchUi(release, environment, sessionArgs, paths.runtimeDir, paths.dataDir);
         if (!result.releaseSuperseded)
             return result.code;
         if (retriesRemaining > 0)
@@ -205,7 +206,16 @@ export async function recordParentCertifiedRelease(release, dataDir) {
  * Run the selected release's UI as the one attached child. The launcher still owns the terminal,
  * so when the child ends uncleanly it restores the terminal and prints any notice the UI left armed.
  */
-async function launchUi(release, environment, sessionArgs, runtimeDir) {
+async function launchUi(release, environment, sessionArgs, runtimeDir, dataDir) {
+    const use = await acquireReleaseUse(dataDir, release.releaseId);
+    try {
+        return await launchClaimedUi(release, environment, sessionArgs, runtimeDir, use);
+    }
+    finally {
+        await use.release().catch(() => undefined);
+    }
+}
+async function launchClaimedUi(release, environment, sessionArgs, runtimeDir, use) {
     await markStartupPhase(environment, "bootstrap-selected");
     const entry = await resolveReleaseEntryPoint(release, "bin/ui.js");
     const ownsTerminal = readLaunchContext(environment).launchProfile === "a1";
@@ -223,13 +233,19 @@ async function launchUi(release, environment, sessionArgs, runtimeDir) {
             stdio: ["inherit", "inherit", "inherit", "ipc"],
             windowsHide: false,
         });
+        let handoff = Promise.resolve();
+        child.once("spawn", () => {
+            // Security: failure keeps the durable launching reservation rather than guessing the child dead.
+            handoff = use.started(child.pid).catch(() => undefined);
+        });
         child.on("message", message => {
             if (message && typeof message === "object" && "type" in message && message.type === RELEASE_RESELECTION_MESSAGE) {
                 releaseSuperseded = true;
             }
         });
         child.once("error", rejectPromise);
-        child.once("close", (code, signal) => {
+        child.once("close", async (code, signal) => {
+            await handoff;
             const outcome = releaseSuperseded ? code ?? 1 : restoreAfterOwnedExit(ownsTerminal, code, signal);
             // Invariant: the UI removes its notice on a clean exit; one still armed means the UI died.
             if (ownsTerminal)

package/dist/foundation/release/release-gc.js

@@ -1,9 +1,9 @@
 import { randomUUID } from "node:crypto";
-import { spawn } from "node:child_process";
+import { spawnReleaseEntry } from "./release-use.js";
 import { lstat, mkdir, open, readFile, readdir, realpath, rename, rm, stat } from "node:fs/promises";
 import { dirname, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
-import { ReleaseStateStore, } from "./release-state.js";
+import { ReleaseStateStore, releaseUseIsLive, } from "./release-state.js";
 import { resolveProductPaths } from "../lifecycle/index.js";
 import { RELEASE_MANIFEST_FILENAME } from "./release-store.js";
 import { DEPENDENCY_LAYER_MANIFEST, readCertifiedDependencyLayer } from "./dependency-layer.js";
@@ -233,7 +233,8 @@ async function collectDisposition(store, dataDir, disposition, options) {
     try {
         const inputs = await protectionInputs(options.transactionStore ?? new UpdateTransactionStore(dataDir), options);
         const current = await store.read();
-        if (isProtectedDetachedRelease(current, inputs, releaseId))
+        if (isProtectedDetachedRelease(current, inputs, releaseId)
+            || (disposition.release.approval === "approved" && disposition.release.lifetimeClaims !== true))
             return false;
         const storeRoot = await canonicalReleaseStore(dataDir);
         const trashRoot = await canonicalTrashRoot(storeRoot);
@@ -252,7 +253,19 @@ async function collectDisposition(store, dataDir, disposition, options) {
             else {
                 await assertReleaseDirectory(source, storeRoot, disposition.release, releaseId);
                 trashPath = resolve(trashRoot, `${releaseId}--${randomUUID()}`);
-                await (options.operations?.rename ?? rename)(source, trashPath);
+                let moved = false;
+                const destination = trashPath;
+                // Concurrency: claim admission and destructive rename share the state gate. A launch recorded
+                // after discovery cannot slip between the last protection read and deletion.
+                await store.update(async (latest) => {
+                    if (!isProtectedDetachedRelease(latest, inputs, releaseId)) {
+                        await (options.operations?.rename ?? rename)(source, destination);
+                        moved = true;
+                    }
+                    return latest;
+                });
+                if (!moved)
+                    return false;
             }
             await store.markCleanupTrash(releaseId, trashPath);
         }
@@ -274,6 +287,7 @@ function isProtectedDetachedRelease(state, inputs, releaseId) {
         .some(reference => reference === releaseId);
     // Concurrency: a launch may have recorded the same release again after it was detached.
     return selected
+        || Object.values(state.uses ?? {}).some(claim => claim.releaseId === releaseId && releaseUseIsLive(claim))
         || state.releases[releaseId] !== undefined
         || (inputs.ownReleaseIds ?? []).includes(releaseId)
         || (inputs.transaction?.status === "active" && inputs.transaction.priorActiveReleaseId === releaseId);
@@ -392,6 +406,7 @@ async function readReleaseRecord(path, parent, expectedName, dataDir) {
         releaseRoot: resolve(parent, manifest.releaseId),
         packageVersion: manifest.packageVersion,
         contentDigest: manifest.contentDigest,
+        ...(Array.isArray(manifest.files) && manifest.files.some(file => file?.path === "dist/foundation/release/release-use.js") ? { lifetimeClaims: true } : {}),
         approval: "approved",
         materializedAt: new Date(0).toISOString(),
         certifiedAt: null,
@@ -661,7 +676,7 @@ function sortArtifacts(artifacts, state) {
         || artifactName(left).localeCompare(artifactName(right)));
 }
 async function spawnCleanupWorker(entry, environment) {
-    const child = spawn(process.execPath, [entry], {
+    const child = await spawnReleaseEntry(entry, [], {
         detached: true,
         windowsHide: true,
         stdio: "ignore",

package/dist/foundation/release/release-state.d.ts

@@ -1,6 +1,6 @@
 import type { MaterializedRelease } from "./release-store.js";
 export declare const RELEASE_STATE_SCHEMA: string;
-/** How long a release stays on disk after its approval, so processes started from it keep their files. */
+/** Minimum age retention; live, uncertain, and legacy ownership independently overrides age. */
 export declare const RELEASE_RETENTION_MS: number;
 export type ReleaseApproval = "candidate" | "approved" | "rejected";
 export interface ReleaseRecord {
@@ -9,6 +9,8 @@ export interface ReleaseRecord {
     readonly packageVersion: string;
     readonly contentDigest: string;
     readonly launchContract?: string;
+    /** Only binaries implementing launch claims may become age-collectible. */
+    readonly lifetimeClaims?: true;
     readonly approval: ReleaseApproval;
     readonly materializedAt: string;
     /** When the release was approved; retention measures its age from this instant. */
@@ -66,12 +68,19 @@ export interface ReleaseCleanupState {
     readonly diagnostics: readonly ReleaseCleanupDiagnostic[];
     readonly workerRuns: readonly ReleaseCleanupWorkerRun[];
 }
+export interface ReleaseUseClaim {
+    readonly releaseId: string;
+    readonly pid: number;
+    /** An interrupted handoff is uncertain and must remain protected. */
+    readonly phase: "launching" | "running";
+}
 export interface ReleaseState {
     readonly schema: typeof RELEASE_STATE_SCHEMA;
     readonly revision: number;
     readonly releases: Readonly<Record<string, ReleaseRecord>>;
     readonly references: ReleaseReferences;
     readonly cleanup: ReleaseCleanupState;
+    readonly uses?: Readonly<Record<string, ReleaseUseClaim>>;
 }
 export interface ProtectedReleaseInputs {
     /** Releases the reconciling command itself runs from; they are never collected under it. */
@@ -101,8 +110,7 @@ export interface ReleaseRetentionReconciliation {
  * Age-based retention. A release stays while a selector names it (active, its rollback, or a
  * candidate still being certified), while an unfinished update may return to it, while the
  * reconciling command runs from it, or while its approval is younger than the retention window.
- * Nothing asks which processes are running: a session that outlives the window and two updates
- * can lose its release files, which is the documented trade-off.
+ * Process-lifetime claims override age; legacy approved binaries remain conservatively retained.
  */
 export declare function planProtectedReleases(state: ReleaseState, inputs?: ProtectedReleaseInputs): ProtectedReleasePlan;
 /**
@@ -134,3 +142,4 @@ export declare class ReleaseStateStore {
     recordCleanupWorkerFinished(runId: string, status: Exclude<ReleaseCleanupWorkerStatus, "scheduled" | "running">, summary: ReleaseCleanupWorkerSummary, error?: unknown): Promise<ReleaseState>;
 }
 export declare function emptyState(): ReleaseState;
+export declare function releaseUseIsLive(claim: ReleaseUseClaim): boolean;

package/dist/foundation/release/release-state.js

@@ -1,21 +1,23 @@
 import { randomUUID } from "node:crypto";
-import { mkdir, open, readFile, rename, rm, stat } from "node:fs/promises";
+import { mkdir, open, readFile, rename, rm } from "node:fs/promises";
 import { dirname, resolve } from "node:path";
 import { selectOrdinaryLaunchReleaseId } from "./ordinary-launch-selection.js";
 import { PRODUCT_IDENTITY } from "../../product-identity.js";
 export const RELEASE_STATE_SCHEMA = PRODUCT_IDENTITY.protocol.releaseCohortSchema;
 const RELEASE_ID_PATTERN = /^[0-9A-Za-z.+_-]+-[a-f0-9]{20}$/;
-/** How long a release stays on disk after its approval, so processes started from it keep their files. */
+/** Minimum age retention; live, uncertain, and legacy ownership independently overrides age. */
 export const RELEASE_RETENTION_MS = 7 * 24 * 60 * 60 * 1_000;
 /**
  * Age-based retention. A release stays while a selector names it (active, its rollback, or a
  * candidate still being certified), while an unfinished update may return to it, while the
  * reconciling command runs from it, or while its approval is younger than the retention window.
- * Nothing asks which processes are running: a session that outlives the window and two updates
- * can lose its release files, which is the documented trade-off.
+ * Process-lifetime claims override age; legacy approved binaries remain conservatively retained.
  */
 export function planProtectedReleases(state, inputs = {}) {
     const protectedIds = new Set();
+    for (const claim of Object.values(state.uses ?? {}))
+        if (releaseUseIsLive(claim))
+            protectedIds.add(claim.releaseId);
     for (const id of [state.references.active, state.references.pending, state.references.approved, state.references.rollback]) {
         if (id !== null)
             protectedIds.add(id);
@@ -28,7 +30,7 @@ export function planProtectedReleases(state, inputs = {}) {
     const now = inputs.now ?? Date.now();
     const window = inputs.retentionMs ?? RELEASE_RETENTION_MS;
     for (const release of Object.values(state.releases)) {
-        if (withinRetention(release, now, window))
+        if (withinRetention(release, now, window) || (release.approval === "approved" && release.lifetimeClaims !== true))
             protectedIds.add(release.releaseId);
     }
     const protectedReleaseIds = [...protectedIds].sort();
@@ -104,6 +106,7 @@ export class ReleaseStateStore {
                 packageVersion: release.packageVersion,
                 contentDigest: release.contentDigest,
                 ...(release.launchContract === undefined ? {} : { launchContract: release.launchContract }),
+                ...(release.files.some(file => file.path === "dist/foundation/release/release-use.js") ? { lifetimeClaims: true } : {}),
                 approval: "candidate",
                 materializedAt: new Date().toISOString(),
                 certifiedAt: null,
@@ -363,7 +366,7 @@ async function acquireLock(path) {
     while (true) {
         try {
             const lock = await open(path, "wx", 0o600);
-            await lock.writeFile(JSON.stringify({ pid: process.pid, createdAt: new Date().toISOString() }));
+            await lock.writeFile(JSON.stringify({ pid: process.pid, token: randomUUID(), createdAt: new Date().toISOString() }));
             await lock.sync();
             return lock;
         }
@@ -382,31 +385,35 @@ async function acquireLock(path) {
     }
 }
 async function reclaimAbandonedLock(path) {
-    let abandoned = false;
+    let owner;
     try {
-        const value = JSON.parse(await readFile(path, "utf8"));
-        if (typeof value.pid === "number") {
-            try {
-                process.kill(value.pid, 0);
-            }
-            catch (error) {
-                abandoned = !(error instanceof Error && "code" in error && error.code === "EPERM");
-            }
+        owner = await readFile(path, "utf8");
+        const value = JSON.parse(owner);
+        if (!Number.isSafeInteger(value.pid) || value.pid <= 0)
+            return false;
+        try {
+            process.kill(value.pid, 0);
+            return false;
+        }
+        catch (error) {
+            if (!(error instanceof Error && "code" in error && error.code === "ESRCH"))
+                return false;
         }
     }
     catch {
-        const metadata = await stat(path).catch(() => null);
-        abandoned = metadata !== null && Date.now() - metadata.mtimeMs > 10_000;
+        return false;
+    } // Security: unknown ownership never becomes safe merely through age.
+    const gate = `${path}.reclaim`;
+    try {
+        await mkdir(gate);
     }
-    if (!abandoned)
+    catch {
         return false;
-    const quarantine = `${path}.abandoned`;
-    const oldQuarantine = await stat(quarantine).catch(() => null);
-    if (oldQuarantine && Date.now() - oldQuarantine.mtimeMs > 10_000)
-        await rm(quarantine, { force: true });
+    }
     try {
-        // Concurrency: the fixed destination lets exactly one waiter claim the stale lock;
-        // another waiter cannot accidentally rename a newly acquired replacement.
+        if (await readFile(path, "utf8") !== owner)
+            return false;
+        const quarantine = `${path}.abandoned-${randomUUID()}`;
         await rename(path, quarantine);
         await rm(quarantine, { force: true });
         return true;
@@ -414,6 +421,9 @@ async function reclaimAbandonedLock(path) {
     catch {
         return false;
     }
+    finally {
+        await rm(gate, { recursive: true, force: true });
+    }
 }
 function normalizeState(value) {
     if (!value || typeof value !== "object")
@@ -424,6 +434,8 @@ function normalizeState(value) {
     const cleanup = state.cleanup;
     return {
         ...state,
+        // Compatibility: one-way control-state upgrade fences pre-claim cleanup workers; session files are untouched.
+        ...(state.schema === "a1-release-cohort-v1" ? { schema: RELEASE_STATE_SCHEMA } : {}),
         cleanup: cleanup
             ? { ...cleanup, workerRuns: cleanup.workerRuns ?? [] }
             : { pending: {}, diagnostics: [], workerRuns: [] },
@@ -436,6 +448,13 @@ function validateState(state) {
         || !Array.isArray(state.cleanup.workerRuns)) {
         throw new Error("invalid release state");
     }
+    if (state.uses !== undefined && (state.uses === null || typeof state.uses !== "object" || Array.isArray(state.uses)))
+        throw new Error("invalid release use claims");
+    for (const [token, claim] of Object.entries(state.uses ?? {})) {
+        if (!/^[a-f0-9-]{36}$/.test(token) || !claim || !RELEASE_ID_PATTERN.test(claim.releaseId)
+            || !Number.isSafeInteger(claim.pid) || claim.pid <= 0 || !["launching", "running"].includes(claim.phase))
+            throw new Error("invalid release use claim");
+    }
     for (const run of state.cleanup.workerRuns) {
         if (!run || typeof run.runId !== "string" || run.runId.length === 0
             || !["scheduled", "running", "completed", "blocked", "continued", "failed", "skipped"].includes(run.status)
@@ -473,6 +492,18 @@ function validateTransition(current, next) {
     if (next.revision !== current.revision)
         throw new Error("release revision is controlled by the state store");
 }
+export function releaseUseIsLive(claim) {
+    if (claim.phase === "launching")
+        return true;
+    // Security: PID reuse only over-retains: no live/uncertain process identity ever proves a claim dead.
+    try {
+        process.kill(claim.pid, 0);
+        return true;
+    }
+    catch (error) {
+        return !(error instanceof Error && "code" in error && error.code === "ESRCH");
+    }
+}
 function boundedError(error) {
     return (error instanceof Error ? error.message : String(error)).replace(/[\r\n]+/g, " ").slice(0, 1_000);
 }

package/dist/foundation/release/release-use.d.ts

@@ -0,0 +1,10 @@
+import { type ChildProcess, type SpawnOptions } from "node:child_process";
+export declare function spawnReleaseEntry(entry: string, args: readonly string[], options: SpawnOptions): Promise<ChildProcess & {
+    releaseSettled: Promise<void>;
+}>;
+/** A durable launch reservation closes selection/collection and spawn/handoff races. */
+export declare function acquireReleaseUse(dataDir: string, releaseId: string): Promise<{
+    track(child: ChildProcess): Promise<void>;
+    started(pid: number): Promise<void>;
+    release(): Promise<void>;
+}>;

package/dist/foundation/release/release-use.js

@@ -0,0 +1,70 @@
+import { randomUUID } from "node:crypto";
+import { realpath } from "node:fs/promises";
+import { spawn } from "node:child_process";
+import { basename, dirname, resolve } from "node:path";
+import { resolveProductPaths } from "../lifecycle/index.js";
+import { ReleaseStateStore, releaseUseIsLive } from "./release-state.js";
+/** Mutable installed entries are not GC-managed; immutable helper processes need their own claim. */
+async function claimReleaseEntry(entry, environment) {
+    const dataDir = resolveProductPaths(environment).dataDir;
+    const root = await realpath(dirname(dirname(resolve(entry))));
+    const storeRoot = await realpath(resolve(dataDir, "releases")).catch(() => undefined);
+    if (dirname(root) !== storeRoot)
+        return undefined;
+    return acquireReleaseUse(dataDir, basename(root));
+}
+export async function spawnReleaseEntry(entry, args, options) {
+    const use = await claimReleaseEntry(entry, options.env ?? process.env);
+    try {
+        const child = spawn(process.execPath, [entry, ...args], options);
+        const releaseSettled = use?.track(child) ?? Promise.resolve();
+        // Concurrency: detached callers need no waiter; awaited callers still observe release failures.
+        void releaseSettled.catch(() => undefined);
+        return Object.assign(child, { releaseSettled });
+    }
+    catch (error) {
+        await use?.release();
+        throw error;
+    }
+}
+/** A durable launch reservation closes selection/collection and spawn/handoff races. */
+export async function acquireReleaseUse(dataDir, releaseId) {
+    const store = new ReleaseStateStore(dataDir);
+    const token = randomUUID();
+    await store.update(state => {
+        if (!state.releases[releaseId])
+            throw new Error("Selected release is no longer available for launch");
+        const uses = Object.fromEntries(Object.entries(state.uses ?? {}).filter(([, claim]) => releaseUseIsLive(claim)));
+        return { ...state, uses: { ...uses, [token]: { releaseId, pid: process.pid, phase: "launching" } } };
+    });
+    let released = false;
+    return {
+        track(child) {
+            let handoff = Promise.resolve();
+            child.once("spawn", () => { handoff = this.started(child.pid).catch(() => undefined); });
+            return new Promise((resolve, reject) => {
+                child.once("close", () => { void handoff.then(() => this.release()).then(resolve, reject); });
+            });
+        },
+        async started(pid) {
+            if (!Number.isSafeInteger(pid) || pid <= 0 || released)
+                throw new Error("Invalid release process handoff");
+            await store.update(state => {
+                if (!state.uses?.[token])
+                    throw new Error("Release launch reservation was lost");
+                const claim = { releaseId, pid, phase: "running" };
+                return { ...state, uses: { ...state.uses, [token]: claim } };
+            });
+        },
+        async release() {
+            if (released)
+                return;
+            await store.update(state => {
+                const uses = { ...state.uses };
+                delete uses[token];
+                return { ...state, uses };
+            });
+            released = true;
+        },
+    };
+}

package/dist/foundation/release/update-activation.js

@@ -1,4 +1,4 @@
-import { spawn } from "node:child_process";
+import { spawnReleaseEntry } from "./release-use.js";
 import { readFile } from "node:fs/promises";
 import { resolve } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -77,7 +77,7 @@ export async function readActivationContracts(packageRoot, read = path => readFi
  */
 export async function delegateActivation(request, callbacks) {
     const entry = resolve(request.packageRoot, UPDATE_ACTIVATION_ENTRY);
-    const child = spawn(process.execPath, [entry, "--data-dir", request.dataDir, "--target-version", request.targetVersion], {
+    const child = await spawnReleaseEntry(entry, ["--data-dir", request.dataDir, "--target-version", request.targetVersion], {
         env: request.environment,
         stdio: ["ignore", "pipe", "pipe"],
         windowsHide: true,

package/dist/foundation/release/update-recovery.js

@@ -1,5 +1,5 @@
 import { createHash, randomUUID } from "node:crypto";
-import { spawn } from "node:child_process";
+import { spawnReleaseEntry } from "./release-use.js";
 import { chmod, lstat, mkdir, open, readFile, readdir, realpath, rename, rm, writeFile } from "node:fs/promises";
 import { basename, dirname, isAbsolute, relative, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -303,7 +303,7 @@ export async function cleanupUpdateRecoveryCapsules(dataDir) {
     }
 }
 async function spawnRecoveryWorker(entry, manifestPath, environment) {
-    const child = spawn(process.execPath, [entry, "--worker", manifestPath], { detached: true, stdio: "ignore", windowsHide: true, env: environment });
+    const child = await spawnReleaseEntry(entry, ["--worker", manifestPath], { detached: true, stdio: "ignore", windowsHide: true, env: environment });
     await new Promise((resolvePromise, rejectPromise) => {
         child.once("spawn", resolvePromise);
         child.once("error", rejectPromise);

package/dist/foundation/release/update.js

@@ -164,7 +164,7 @@ export function renderUpdateProgressBar(percent, accent = SHARED_PROGRESS_ACCENT
     // percentage retain the update meter's neutral treatment.
     const gray = "\u001b[38;2;128;128;128m";
     const track = "\u001b[38;2;102;102;102m";
-    return `${accent}${"━".repeat(filled)}${track}${"─".repeat(PROGRESS_BAR_WIDTH - filled)}${gray} ${bounded}%\u001b[39m`;
+    return `${accent}${"━".repeat(filled)}${track}${"━".repeat(PROGRESS_BAR_WIDTH - filled)}${gray} ${bounded}%\u001b[39m`;
 }
 function updateProgressAccent(environment) {
     return earlyAccentPalette(resolveEarlyAccentColor(environment), earlyTerminalAppearance(environment), earlyTerminalColorMode(environment)).accent;

package/dist/foundation/release/warmup.js

@@ -1,4 +1,4 @@
-import { spawn } from "node:child_process";
+import { spawnReleaseEntry } from "./release-use.js";
 import { resolveReleaseEntryPoint } from "./release-store.js";
 import { releaseEnvironment } from "./bootstrap.js";
 import { launchContractTarget, launchEnvironmentKeys } from "../launch-context/index.js";
@@ -11,15 +11,13 @@ function warmupDiagnostics(text) {
 /** Import the exact immutable startup graph in a terminal-free bounded child process. */
 export async function warmMaterializedRelease(release, environment, timeoutMs = 30_000) {
     const entry = await resolveReleaseEntryPoint(release, "bin/warmup.js");
+    const child = await spawnReleaseEntry(entry, [], {
+        env: { ...releaseEnvironment(environment, release), [launchEnvironmentKeys(launchContractTarget(release)).immutableWarmup]: "1" },
+        stdio: ["ignore", "ignore", "pipe"],
+        windowsHide: true,
+    });
     await new Promise((resolvePromise, rejectPromise) => {
-        // Rationale: the child still gets no terminal, but a discarded failure reason leaves an
-        // update reporting only an exit status. Its own diagnostics are read and bounded so the
-        // transaction journal records why the graph could not be imported.
-        const child = spawn(process.execPath, [entry], {
-            env: { ...releaseEnvironment(environment, release), [launchEnvironmentKeys(launchContractTarget(release)).immutableWarmup]: "1" },
-            stdio: ["ignore", "ignore", "pipe"],
-            windowsHide: true,
-        });
+        // Rationale: bounded diagnostics explain graph-import failures without attaching a terminal.
         let diagnostics = "";
         child.stderr?.setEncoding("utf8");
         child.stderr?.on("data", chunk => { diagnostics = `${diagnostics}${chunk}`.slice(-WARMUP_DIAGNOSTIC_LIMIT); });
@@ -44,4 +42,5 @@ export async function warmMaterializedRelease(release, environment, timeoutMs =
         }, timeoutMs);
         timer.unref?.();
     });
+    await child.releaseSettled;
 }

package/dist/foundation/session-writer-lock/index.d.ts

@@ -20,8 +20,8 @@ export interface SessionWriterHandle {
     release(): void;
 }
 /**
- * A crashed writer is not released by the kernel; its lock becomes stale once its holder stops
- * refreshing it. The bound keeps resume after a crash a matter of seconds.
+ * Heartbeats diagnose ownership loss, but never authorize takeover of a live writer.
+ * Dead owners are recovered by process absence; legacy or uncertain owners stay protected.
  */
 export declare const SESSION_WRITER_STALE_MS = 10000;
 /**

package/dist/foundation/session-writer-lock/index.js

@@ -1,7 +1,7 @@
-import { existsSync, mkdirSync, realpathSync, statSync } from "node:fs";
+import { existsSync, mkdirSync, realpathSync, statSync, readFileSync, writeFileSync, unlinkSync, rmdirSync, utimesSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { basename, dirname, join, resolve } from "node:path";
-import { createHash } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import lockfile from "proper-lockfile";
 /** Reports that a canonical session identity already has a live writer. */
 export class SessionWriterConflict extends Error {
@@ -15,8 +15,8 @@ export class SessionWriterConflict extends Error {
     }
 }
 /**
- * A crashed writer is not released by the kernel; its lock becomes stale once its holder stops
- * refreshing it. The bound keeps resume after a crash a matter of seconds.
+ * Heartbeats diagnose ownership loss, but never authorize takeover of a live writer.
+ * Dead owners are recovered by process absence; legacy or uncertain owners stay protected.
  */
 export const SESSION_WRITER_STALE_MS = 10_000;
 let backendOverride;
@@ -35,15 +35,37 @@ export function lockfileBackend(root = join(tmpdir(), "a1-session-writer-locks")
     };
     const acquireAuthority = (path) => {
         mkdirSync(root, { recursive: true, mode: 0o700 });
-        // Rationale: the lock directory is the authority; no target file exists or is needed.
-        return lockfile.lockSync(path, {
-            realpath: false,
-            lockfilePath: path,
-            stale: staleMs,
-            // Rationale: a missed refresh means this process stalled; the next writer takes over, and the
-            // stalled one must not crash for it.
-            onCompromised: () => { },
+        // Compatibility: the nonempty owner record also prevents legacy heartbeat-only clients from reclaiming
+        // a stalled live writer: proper-lockfile removes directories non-recursively.
+        reclaimDeadWriter(path);
+        const release = lockfile.lockSync(path, {
+            realpath: false, lockfilePath: path, stale: staleMs,
+            onCompromised: () => { throw new Error("Session writer ownership was lost; execution has been stopped."); },
         });
+        const owner = { pid: process.pid, token: randomUUID() };
+        const stamp = statSync(path).mtime;
+        try {
+            writeFileSync(join(path, "owner.json"), JSON.stringify(owner), { flag: "wx", mode: 0o600 });
+            // Concurrency: creating the owner record must not masquerade as a foreign heartbeat.
+            utimesSync(path, stamp, stamp);
+        }
+        catch (error) {
+            try {
+                unlinkSync(join(path, "owner.json"));
+                release();
+            }
+            catch { /* Security: retain uncertain ownership. */ }
+            throw error;
+        }
+        return () => {
+            if (readWriterOwner(path)?.token !== owner.token)
+                throw new Error("Session writer ownership was lost");
+            // Concurrency: a legacy contender must not reclaim the short empty-directory release interval.
+            const now = new Date();
+            utimesSync(path, now, now);
+            unlinkSync(join(path, "owner.json"));
+            release();
+        };
     };
     return {
         acquire(requested) {
@@ -92,6 +114,54 @@ export function lockfileBackend(root = join(tmpdir(), "a1-session-writer-locks")
         },
     };
 }
+function readWriterOwner(path) {
+    try {
+        const source = readFileSync(join(path, "owner.json"), "utf8");
+        if (source.length > 1024)
+            return null;
+        const value = JSON.parse(source);
+        return Number.isSafeInteger(value.pid) && value.pid > 0 && typeof value.token === "string"
+            && /^[a-f0-9-]{36}$/.test(value.token) ? value : null;
+    }
+    catch {
+        return null;
+    }
+}
+function writerAbsent(pid) {
+    try {
+        process.kill(pid, 0);
+        return false;
+    }
+    catch (error) {
+        return error instanceof Error && "code" in error && error.code === "ESRCH";
+    }
+}
+function reclaimDeadWriter(path) {
+    if (!existsSync(path))
+        return;
+    const owner = readWriterOwner(path);
+    // Security: age and malformed/legacy records cannot prove that a writer is absent.
+    if (owner === null || !writerAbsent(owner.pid))
+        throw new Error("Session writer is live or unverifiable");
+    const gate = join(path, ".reclaim");
+    mkdirSync(gate);
+    try {
+        if (readWriterOwner(path)?.token !== owner.token || !writerAbsent(owner.pid))
+            throw new Error("Session writer changed during recovery");
+        const now = new Date();
+        utimesSync(path, now, now);
+        unlinkSync(join(path, "owner.json"));
+        rmdirSync(gate);
+        rmdirSync(path);
+    }
+    catch (error) {
+        try {
+            rmdirSync(gate);
+        }
+        catch { /* Security: a partial recovery remains conservatively blocked. */ }
+        throw error;
+    }
+}
 function backend() {
     return backendOverride ?? (cachedBackend ??= lockfileBackend());
 }

package/dist/foundation/startup/startup-descriptor.js

@@ -10,7 +10,7 @@ export const STARTUP_DESCRIPTOR = Object.freeze({
   ],
   "generatedArtifact": {
     "path": "dist/integrations/pi/startup-public.js",
-    "sha256": "e6a12f0ec3c5f2ada12bb29f8a02584f0724b37d107c29608b6629a4196cca13"
+    "sha256": "c1fca0ab0fe9d078a80faac1dad7d9f719cfc553645e38c2244a9c9ad381c205"
   },
   "dependencyLayerIdentity": {
     "source": "A1_RELEASE_LAYERS",
@@ -19,7 +19,7 @@ export const STARTUP_DESCRIPTOR = Object.freeze({
   "compileCacheNamespace": {
     "strategy": "node-abi-version-and-ordered-layer-sha256-v1"
   },
-  "identity": "1823698969cb8a551539b6351a7ba7b0756121369e6f9bf898347080d7892ece"
+  "identity": "3a54e70a22a20fa71dc2916cff394d4b06a3359677b3423002ff5b2dfbdccd70"
 });
 
 export function loadDeclaredStartupGraph() {

package/dist/foundation/terminal-cleanup/fatal-diagnostic.d.ts

@@ -0,0 +1,2 @@
+/** Loaded only on a failure; persistence must never impede terminal restoration. */
+export declare function writeFatalDiagnostic(directory: string, origin: string, error: unknown, releaseId?: string): Promise<string | null>;