frizz 0.12.12 → 0.13.0

package/dist/frizz.js

@@ -4175,10 +4175,10 @@ var require_resolve_block_map = __commonJS({
       let offset = bm.offset;
       let commentEnd = null;
       for (const collItem of bm.items) {
-        const { start, key, sep: sep4, value } = collItem;
+        const { start, key, sep: sep5, value } = collItem;
         const keyProps = resolveProps.resolveProps(start, {
           indicator: "explicit-key-ind",
-          next: key ?? sep4?.[0],
+          next: key ?? sep5?.[0],
           offset,
           onError,
           parentIndent: bm.indent,
@@ -4192,7 +4192,7 @@ var require_resolve_block_map = __commonJS({
             else if ("indent" in key && key.indent !== bm.indent)
               onError(offset, "BAD_INDENT", startColMsg);
           }
-          if (!keyProps.anchor && !keyProps.tag && !sep4) {
+          if (!keyProps.anchor && !keyProps.tag && !sep5) {
             commentEnd = keyProps.end;
             if (keyProps.comment) {
               if (map.comment)
@@ -4216,7 +4216,7 @@ var require_resolve_block_map = __commonJS({
         ctx.atKey = false;
         if (utilMapIncludes.mapIncludes(ctx, map.items, keyNode))
           onError(keyStart, "DUPLICATE_KEY", "Map keys must be unique");
-        const valueProps = resolveProps.resolveProps(sep4 ?? [], {
+        const valueProps = resolveProps.resolveProps(sep5 ?? [], {
           indicator: "map-value-ind",
           next: value,
           offset: keyNode.range[2],
@@ -4232,7 +4232,7 @@ var require_resolve_block_map = __commonJS({
             if (ctx.options.strict && keyProps.start < valueProps.found.offset - 1024)
               onError(keyNode.range, "KEY_OVER_1024_CHARS", "The : indicator must be at most 1024 chars after the start of an implicit block mapping key");
           }
-          const valueNode = value ? composeNode(ctx, value, valueProps, onError) : composeEmptyNode(ctx, offset, sep4, null, valueProps, onError);
+          const valueNode = value ? composeNode(ctx, value, valueProps, onError) : composeEmptyNode(ctx, offset, sep5, null, valueProps, onError);
           if (ctx.schema.compat)
             utilFlowIndentCheck.flowIndentCheck(bm.indent, value, onError);
           offset = valueNode.range[2];
@@ -4323,7 +4323,7 @@ var require_resolve_end = __commonJS({
       let comment = "";
       if (end) {
         let hasSpace = false;
-        let sep4 = "";
+        let sep5 = "";
         for (const token of end) {
           const { source, type } = token;
           switch (type) {
@@ -4337,13 +4337,13 @@ var require_resolve_end = __commonJS({
               if (!comment)
                 comment = cb;
               else
-                comment += sep4 + cb;
-              sep4 = "";
+                comment += sep5 + cb;
+              sep5 = "";
               break;
             }
             case "newline":
               if (comment)
-                sep4 += source;
+                sep5 += source;
               hasSpace = true;
               break;
             default:
@@ -4386,18 +4386,18 @@ var require_resolve_flow_collection = __commonJS({
       let offset = fc.offset + fc.start.source.length;
       for (let i = 0; i < fc.items.length; ++i) {
         const collItem = fc.items[i];
-        const { start, key, sep: sep4, value } = collItem;
+        const { start, key, sep: sep5, value } = collItem;
         const props = resolveProps.resolveProps(start, {
           flow: fcName,
           indicator: "explicit-key-ind",
-          next: key ?? sep4?.[0],
+          next: key ?? sep5?.[0],
           offset,
           onError,
           parentIndent: fc.indent,
           startOnNewline: false
         });
         if (!props.found) {
-          if (!props.anchor && !props.tag && !sep4 && !value) {
+          if (!props.anchor && !props.tag && !sep5 && !value) {
             if (i === 0 && props.comma)
               onError(props.comma, "UNEXPECTED_TOKEN", `Unexpected , in ${fcName}`);
             else if (i < fc.items.length - 1)
@@ -4451,8 +4451,8 @@ var require_resolve_flow_collection = __commonJS({
             }
           }
         }
-        if (!isMap && !sep4 && !props.found) {
-          const valueNode = value ? composeNode(ctx, value, props, onError) : composeEmptyNode(ctx, props.end, sep4, null, props, onError);
+        if (!isMap && !sep5 && !props.found) {
+          const valueNode = value ? composeNode(ctx, value, props, onError) : composeEmptyNode(ctx, props.end, sep5, null, props, onError);
           coll.items.push(valueNode);
           offset = valueNode.range[2];
           if (isBlock(value))
@@ -4464,7 +4464,7 @@ var require_resolve_flow_collection = __commonJS({
           if (isBlock(key))
             onError(keyNode.range, "BLOCK_IN_FLOW", blockMsg);
           ctx.atKey = false;
-          const valueProps = resolveProps.resolveProps(sep4 ?? [], {
+          const valueProps = resolveProps.resolveProps(sep5 ?? [], {
             flow: fcName,
             indicator: "map-value-ind",
             next: value,
@@ -4475,8 +4475,8 @@ var require_resolve_flow_collection = __commonJS({
           });
           if (valueProps.found) {
             if (!isMap && !props.found && ctx.options.strict) {
-              if (sep4)
-                for (const st of sep4) {
+              if (sep5)
+                for (const st of sep5) {
                   if (st === valueProps.found)
                     break;
                   if (st.type === "newline") {
@@ -4493,7 +4493,7 @@ var require_resolve_flow_collection = __commonJS({
             else
               onError(valueProps.start, "MISSING_CHAR", `Missing , or : between ${fcName} items`);
           }
-          const valueNode = value ? composeNode(ctx, value, valueProps, onError) : valueProps.found ? composeEmptyNode(ctx, valueProps.end, sep4, null, valueProps, onError) : null;
+          const valueNode = value ? composeNode(ctx, value, valueProps, onError) : valueProps.found ? composeEmptyNode(ctx, valueProps.end, sep5, null, valueProps, onError) : null;
           if (valueNode) {
             if (isBlock(value))
               onError(valueNode.range, "BLOCK_IN_FLOW", blockMsg);
@@ -4673,7 +4673,7 @@ var require_resolve_block_scalar = __commonJS({
           chompStart = i + 1;
       }
       let value = "";
-      let sep4 = "";
+      let sep5 = "";
       let prevMoreIndented = false;
       for (let i = 0; i < contentStart; ++i)
         value += lines[i][0].slice(trimIndent) + "\n";
@@ -4690,24 +4690,24 @@ var require_resolve_block_scalar = __commonJS({
           indent = "";
         }
         if (type === Scalar.Scalar.BLOCK_LITERAL) {
-          value += sep4 + indent.slice(trimIndent) + content;
-          sep4 = "\n";
+          value += sep5 + indent.slice(trimIndent) + content;
+          sep5 = "\n";
         } else if (indent.length > trimIndent || content[0] === "	") {
-          if (sep4 === " ")
-            sep4 = "\n";
-          else if (!prevMoreIndented && sep4 === "\n")
-            sep4 = "\n\n";
-          value += sep4 + indent.slice(trimIndent) + content;
-          sep4 = "\n";
+          if (sep5 === " ")
+            sep5 = "\n";
+          else if (!prevMoreIndented && sep5 === "\n")
+            sep5 = "\n\n";
+          value += sep5 + indent.slice(trimIndent) + content;
+          sep5 = "\n";
           prevMoreIndented = true;
         } else if (content === "") {
-          if (sep4 === "\n")
+          if (sep5 === "\n")
             value += "\n";
           else
-            sep4 = "\n";
+            sep5 = "\n";
         } else {
-          value += sep4 + content;
-          sep4 = " ";
+          value += sep5 + content;
+          sep5 = " ";
           prevMoreIndented = false;
         }
       }
@@ -4889,25 +4889,25 @@ var require_resolve_flow_scalar = __commonJS({
       if (!match)
         return source;
       let res = match[1];
-      let sep4 = " ";
+      let sep5 = " ";
       let pos = first.lastIndex;
       line.lastIndex = pos;
       while (match = line.exec(source)) {
         if (match[1] === "") {
-          if (sep4 === "\n")
-            res += sep4;
+          if (sep5 === "\n")
+            res += sep5;
           else
-            sep4 = "\n";
+            sep5 = "\n";
         } else {
-          res += sep4 + match[1];
-          sep4 = " ";
+          res += sep5 + match[1];
+          sep5 = " ";
         }
         pos = line.lastIndex;
       }
       const last = /[ \t]*(.*)/sy;
       last.lastIndex = pos;
       match = last.exec(source);
-      return res + sep4 + (match?.[1] ?? "");
+      return res + sep5 + (match?.[1] ?? "");
     }
     function doubleQuotedValue(source, onError) {
       let res = "";
@@ -5717,14 +5717,14 @@ var require_cst_stringify = __commonJS({
         }
       }
     }
-    function stringifyItem({ start, key, sep: sep4, value }) {
+    function stringifyItem({ start, key, sep: sep5, value }) {
       let res = "";
       for (const st of start)
         res += st.source;
       if (key)
         res += stringifyToken(key);
-      if (sep4)
-        for (const st of sep4)
+      if (sep5)
+        for (const st of sep5)
           res += st.source;
       if (value)
         res += stringifyToken(value);
@@ -6891,18 +6891,18 @@ var require_parser = __commonJS({
         if (this.type === "map-value-ind") {
           const prev = getPrevProps(this.peek(2));
           const start = getFirstKeyStartProps(prev);
-          let sep4;
+          let sep5;
           if (scalar.end) {
-            sep4 = scalar.end;
-            sep4.push(this.sourceToken);
+            sep5 = scalar.end;
+            sep5.push(this.sourceToken);
             delete scalar.end;
           } else
-            sep4 = [this.sourceToken];
+            sep5 = [this.sourceToken];
           const map = {
             type: "block-map",
             offset: scalar.offset,
             indent: scalar.indent,
-            items: [{ start, key: scalar, sep: sep4 }]
+            items: [{ start, key: scalar, sep: sep5 }]
           };
           this.onKeyLine = true;
           this.stack[this.stack.length - 1] = map;
@@ -7055,15 +7055,15 @@ var require_parser = __commonJS({
                 } else if (isFlowToken(it.key) && !includesToken(it.sep, "newline")) {
                   const start2 = getFirstKeyStartProps(it.start);
                   const key = it.key;
-                  const sep4 = it.sep;
-                  sep4.push(this.sourceToken);
+                  const sep5 = it.sep;
+                  sep5.push(this.sourceToken);
                   delete it.key;
                   delete it.sep;
                   this.stack.push({
                     type: "block-map",
                     offset: this.offset,
                     indent: this.indent,
-                    items: [{ start: start2, key, sep: sep4 }]
+                    items: [{ start: start2, key, sep: sep5 }]
                   });
                 } else if (start.length > 0) {
                   it.sep = it.sep.concat(start, this.sourceToken);
@@ -7257,13 +7257,13 @@ var require_parser = __commonJS({
             const prev = getPrevProps(parent);
             const start = getFirstKeyStartProps(prev);
             fixFlowSeqItems(fc);
-            const sep4 = fc.end.splice(1, fc.end.length);
-            sep4.push(this.sourceToken);
+            const sep5 = fc.end.splice(1, fc.end.length);
+            sep5.push(this.sourceToken);
             const map = {
               type: "block-map",
               offset: fc.offset,
               indent: fc.indent,
-              items: [{ start, key: fc, sep: sep4 }]
+              items: [{ start, key: fc, sep: sep5 }]
             };
             this.onKeyLine = true;
             this.stack[this.stack.length - 1] = map;
@@ -16829,7 +16829,7 @@ var require_websocket = __commonJS({
     var http = __require("http");
     var net = __require("net");
     var tls = __require("tls");
-    var { randomBytes: randomBytes2, createHash: createHash4 } = __require("crypto");
+    var { randomBytes: randomBytes2, createHash: createHash5 } = __require("crypto");
     var { Duplex, Readable } = __require("stream");
     var { URL: URL2 } = __require("url");
     var PerMessageDeflate2 = require_permessage_deflate();
@@ -17497,7 +17497,7 @@ var require_websocket = __commonJS({
           abortHandshake(websocket, socket, "Invalid Upgrade header");
           return;
         }
-        const digest = createHash4("sha1").update(key + GUID).digest("base64");
+        const digest = createHash5("sha1").update(key + GUID).digest("base64");
         if (res.headers["sec-websocket-accept"] !== digest) {
           abortHandshake(websocket, socket, "Invalid Sec-WebSocket-Accept header");
           return;
@@ -17866,7 +17866,7 @@ var require_websocket_server = __commonJS({
     var EventEmitter = __require("events");
     var http = __require("http");
     var { Duplex } = __require("stream");
-    var { createHash: createHash4 } = __require("crypto");
+    var { createHash: createHash5 } = __require("crypto");
     var extension2 = require_extension();
     var PerMessageDeflate2 = require_permessage_deflate();
     var subprotocol2 = require_subprotocol();
@@ -18173,7 +18173,7 @@ var require_websocket_server = __commonJS({
           );
         }
         if (this._state > RUNNING) return abortHandshake(socket, 503);
-        const digest = createHash4("sha1").update(key + GUID).digest("base64");
+        const digest = createHash5("sha1").update(key + GUID).digest("base64");
         const headers = [
           "HTTP/1.1 101 Switching Protocols",
           "Upgrade: websocket",
@@ -18341,11 +18341,11 @@ function pruneRunLogs(dir, keep = RETAINED_RUNS, days = RETAINED_DAYS, now = Dat
     }
   }
 }
-function formatDiskLine(record) {
-  const at = new Date(record.at);
+function formatDiskLine(record2) {
+  const at = new Date(record2.at);
   const pad = (value, width = 2) => String(value).padStart(width, "0");
   const clock = `${pad(at.getHours())}:${pad(at.getMinutes())}:${pad(at.getSeconds())}.${pad(at.getMilliseconds(), 3)}`;
-  return `${clock}  ${record.level.toUpperCase().padEnd(5)}  ${record.scope.padEnd(12)}  ${record.message}
+  return `${clock}  ${record2.level.toUpperCase().padEnd(5)}  ${record2.scope.padEnd(12)}  ${record2.message}
 `;
 }
 function openLogFile(path) {
@@ -18372,10 +18372,10 @@ function createLogger(options2 = {}) {
   const listeners = /* @__PURE__ */ new Set();
   const emit = (recordLevel, scope, message) => {
     if (LEVEL_ORDER[recordLevel] < threshold) return;
-    const record = { at: now(), level: recordLevel, scope, message };
+    const record2 = { at: now(), level: recordLevel, scope, message };
     if (fd !== null) {
       try {
-        const line = formatDiskLine(record);
+        const line = formatDiskLine(record2);
         if (written + line.length > maxBytes) {
           writeSync(fd, `--- log truncated at ${maxBytes} bytes ---
 `);
@@ -18390,7 +18390,7 @@ function createLogger(options2 = {}) {
     }
     for (const listener of listeners) {
       try {
-        listener(record);
+        listener(record2);
       } catch {
       }
     }
@@ -18417,13 +18417,13 @@ function setAmbientLogger(logger2) {
   ambient = logger2;
   return logger2;
 }
-function formatFeedLine(record) {
-  return formatDiskLine(record).trimEnd();
+function formatFeedLine(record2) {
+  return formatDiskLine(record2).trimEnd();
 }
 function attachTerminalMirror(logger2, enabled = process.env.FRIZZ_DEBUG === "1") {
   if (!enabled) return () => {
   };
-  return logger2.onRecord((record) => process.stderr.write(`${formatFeedLine(record)}
+  return logger2.onRecord((record2) => process.stderr.write(`${formatFeedLine(record2)}
 `));
 }
 function ambientLogger() {
@@ -19120,13 +19120,13 @@ function acquireMutationGuard(stateDir, timeoutMs = GUARD_TIMEOUT_MS, adapter =
     let fd;
     try {
       fd = openSync3(path, "wx", 384);
-      const record = {
+      const record2 = {
         version: 1,
         token,
         at: new Date(adapter.now()).toISOString(),
         ...generation
       };
-      writeFileSync6(fd, `${JSON.stringify(record)}
+      writeFileSync6(fd, `${JSON.stringify(record2)}
 `, "utf8");
       fsyncSync2(fd);
       closeSync2(fd);
@@ -19170,13 +19170,13 @@ function parseDelegates(value) {
   const seen = /* @__PURE__ */ new Set();
   for (const candidate of value) {
     if (!candidate || typeof candidate !== "object") return null;
-    const record = candidate;
-    const generation = parseGeneration(record);
-    if (!generation || !validDelegateRole(record.role) || !validText(record.registeredAt, 128)) return null;
+    const record2 = candidate;
+    const generation = parseGeneration(record2);
+    if (!generation || !validDelegateRole(record2.role) || !validText(record2.registeredAt, 128)) return null;
     const key = `${generation.pid}:${generation.processStart}`;
     if (seen.has(key)) return null;
     seen.add(key);
-    delegates.push({ ...generation, role: record.role, registeredAt: record.registeredAt });
+    delegates.push({ ...generation, role: record2.role, registeredAt: record2.registeredAt });
   }
   return delegates;
 }
@@ -19210,11 +19210,11 @@ function projectLaunchOwnerPath(stateDir) {
 function readProjectLaunchOwner(stateDir) {
   return parseOwner(projectLaunchOwnerPath(stateDir));
 }
-function sameTarget(record, target2) {
-  return record.projectId === target2.projectId && record.projectDir === target2.projectDir;
+function sameTarget(record2, target2) {
+  return record2.projectId === target2.projectId && record2.projectDir === target2.projectDir;
 }
-function sameProjectIdentity(record, target2) {
-  return record.projectId === target2.projectId;
+function sameProjectIdentity(record2, target2) {
+  return record2.projectId === target2.projectId;
 }
 function projectLaunchTokenProof(target2, token) {
   if (!UUID_RE.test(token)) throw new Error("invalid Frizz project launch owner token");
@@ -19230,11 +19230,11 @@ function removeStatusesForToken(stateDir, token) {
     }
   }
 }
-function writeNewOwner(path, record) {
+function writeNewOwner(path, record2) {
   let fd;
   try {
     fd = openSync3(path, "wx", 384);
-    writeFileSync6(fd, `${JSON.stringify(record)}
+    writeFileSync6(fd, `${JSON.stringify(record2)}
 `, "utf8");
     fsyncSync2(fd);
     closeSync2(fd);
@@ -19250,21 +19250,21 @@ function writeNewOwner(path, record) {
     throw error;
   }
 }
-function makeLease(target2, record, adapter) {
+function makeLease(target2, record2, adapter) {
   let released = false;
   return {
     target: target2,
-    token: record.token,
-    pid: record.pid,
-    processStart: record.processStart,
-    role: record.role,
+    token: record2.token,
+    pid: record2.pid,
+    processStart: record2.processStart,
+    role: record2.role,
     release: () => {
       if (released) return false;
       const unlock = acquireMutationGuard(target2.stateDir, GUARD_TIMEOUT_MS, adapter);
       try {
         const path = projectLaunchOwnerPath(target2.stateDir);
         const current = parseOwner(path);
-        if (!current || !sameTarget(current, target2) || current.token !== record.token || current.pid !== record.pid || current.processStart !== record.processStart) {
+        if (!current || !sameTarget(current, target2) || current.token !== record2.token || current.pid !== record2.pid || current.processStart !== record2.processStart) {
           released = true;
           return false;
         }
@@ -19299,15 +19299,15 @@ function newOwnerRecord(target2, role, adapter) {
 }
 function installNewOwner(target2, role, adapter) {
   const path = projectLaunchOwnerPath(target2.stateDir);
-  const record = newOwnerRecord(target2, role, adapter);
+  const record2 = newOwnerRecord(target2, role, adapter);
   try {
-    writeNewOwner(path, record);
+    writeNewOwner(path, record2);
   } catch (error) {
     if (errorCode3(error) === "EEXIST") return { kind: "contended", owner: parseOwner(path) };
     throw error;
   }
   const committed = parseOwner(path);
-  if (!committed || committed.token !== record.token) return { kind: "contended", owner: committed };
+  if (!committed || committed.token !== record2.token) return { kind: "contended", owner: committed };
   return { kind: "acquired", lease: makeLease(target2, committed, adapter) };
 }
 function drainDelegates(delegates, options2) {
@@ -19828,12 +19828,19 @@ var init_project_registry = __esm({
   }
 });
 
+// packages/server/src/native-helper.ts
+var init_native_helper = __esm({
+  "packages/server/src/native-helper.ts"() {
+    "use strict";
+  }
+});
+
 // src/production.ts
 init_local_origin();
-import { readFileSync as readFileSync13 } from "node:fs";
+import { readFileSync as readFileSync15 } from "node:fs";
 import { homedir as homedir11 } from "node:os";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
-import { join as join16 } from "node:path";
+import { join as join17 } from "node:path";
 
 // src/browser.ts
 import { spawn, execFile } from "node:child_process";
@@ -19995,12 +20002,12 @@ function manifestIdFor(url) {
   return url.endsWith("/") ? url : `${url}/`;
 }
 function execFileP(cmd, args2) {
-  return new Promise((resolve6, reject) => {
+  return new Promise((resolve7, reject) => {
     execFile(
       cmd,
       args2,
       { encoding: "utf8", timeout: 1e4 },
-      (err, stdout) => err ? reject(err) : resolve6(stdout)
+      (err, stdout) => err ? reject(err) : resolve7(stdout)
     );
   });
 }
@@ -20079,9 +20086,9 @@ function openCdpSession(browserPath, dataPath) {
   cmdPipe.on("error", failAll);
   resPipe.on("error", failAll);
   child.on("exit", () => failAll(new Error("chrome exited before the CDP handshake completed")));
-  const call2 = (method, params = {}, timeoutMs = 2e4) => new Promise((resolve6, reject) => {
+  const call2 = (method, params = {}, timeoutMs = 2e4) => new Promise((resolve7, reject) => {
     const id = ++seq;
-    pending.set(id, { resolve: resolve6, reject });
+    pending.set(id, { resolve: resolve7, reject });
     cmdPipe.write(JSON.stringify({ id, method, params }) + "\0");
     setTimeout(() => {
       if (pending.has(id)) {
@@ -20094,15 +20101,15 @@ function openCdpSession(browserPath, dataPath) {
     await call2("Browser.close").catch(() => {
     });
     if (child.exitCode !== null || child.signalCode !== null) return;
-    await new Promise((resolve6) => {
+    await new Promise((resolve7) => {
       const t = setTimeout(() => {
         child.kill();
-        resolve6();
+        resolve7();
       }, 1e4);
       t.unref();
       child.once("exit", () => {
         clearTimeout(t);
-        resolve6();
+        resolve7();
       });
     });
   };
@@ -22619,6 +22626,7 @@ var RestartSupervisorProxy = class {
   status() {
     const delegated = this.options.status?.();
     const updateVersion = this.options.updateVersion?.();
+    const version = typeof this.options.version === "function" ? this.options.version() : this.options.version;
     const owner = { state: this.state, ...this.message ? { message: this.message } : {} };
     const reported = this.transition === "update" && delegated ? { ...delegated, ...delegated.state === "ready" ? { preparing: true } : {} } : this.restartInFlight !== null || this.state === "failed" ? owner : delegated ?? owner;
     return {
@@ -22630,9 +22638,10 @@ var RestartSupervisorProxy = class {
       // Sent ONLY when the launcher can actually answer it, so an older client — and frizz-dev, which
       // has no notion of "already current" — keeps today's behaviour on its absence.
       ...this.options.updateAvailable ? { updateAvailable: this.options.updateAvailable() === true } : {},
-      // Version numbers ride the same launcher-only contract: absent for frizz-dev and legacy
-      // supervisors, so their clients render exactly what they render today.
-      ...this.options.version ? { version: this.options.version } : {},
+      // The active SERVER version changes on a child-only update. Its absence keeps frizz-dev and
+      // old monolithic supervisors' status payload and versionless UI exactly as they were.
+      ...version ? { version } : {},
+      ...this.options.launcherVersion ? { launcherVersion: this.options.launcherVersion } : {},
       ...updateVersion ? { updateVersion } : {},
       // Sent only when TRUE, so a published Frizz's payload is byte-identical to what it sends today
       // and an older client is unaffected. Absent therefore means "not a development build".
@@ -23288,7 +23297,7 @@ function serveRelayRequest(frame, options2) {
   const publicUrl = new URL(options2.publicOrigin);
   let cancelled = false;
   let abort;
-  const done = new Promise((resolve6) => {
+  const done = new Promise((resolve7) => {
     const send = (upFrame) => {
       if (!cancelled) options2.send(upFrame);
     };
@@ -23322,11 +23331,11 @@ function serveRelayRequest(frame, options2) {
           });
           res.on("end", () => {
             send({ t: "res-end", id: frame.id });
-            resolve6();
+            resolve7();
           });
           res.on("error", () => {
             send({ t: "res-end", id: frame.id });
-            resolve6();
+            resolve7();
           });
           return;
         }
@@ -23343,7 +23352,7 @@ function serveRelayRequest(frame, options2) {
               ...body.byteLength > 0 ? { body: encodeBody(new Uint8Array(body)) } : {},
               end: true
             });
-            resolve6();
+            resolve7();
             return;
           }
           send({ t: "res", id: frame.id, status: res.statusCode ?? 502, headers: outHeaders, end: false });
@@ -23355,11 +23364,11 @@ function serveRelayRequest(frame, options2) {
             });
           }
           send({ t: "res-end", id: frame.id });
-          resolve6();
+          resolve7();
         });
         res.on("error", () => {
           send({ t: "res", id: frame.id, status: 502, headers: [], end: true });
-          resolve6();
+          resolve7();
         });
       }
     );
@@ -23372,13 +23381,13 @@ function serveRelayRequest(frame, options2) {
         body: encodeBody(new TextEncoder().encode(`Frizz is not answering on this machine: ${error.message}`)),
         end: true
       });
-      resolve6();
+      resolve7();
     });
     if (frame.body) req.write(Buffer.from(decodeBody(frame.body)));
     req.end();
     abort = () => {
       req.destroy();
-      resolve6();
+      resolve7();
     };
   });
   return {
@@ -23512,9 +23521,9 @@ function connectRelay(options2) {
   };
   const scheduleRetry = (reason) => {
     if (stopped) return;
-    const delay4 = backoff(attempt++);
-    options2.onStatus?.("retrying", `${reason}; retrying in ${Math.round(delay4 / 1e3)}s`);
-    retryHandle = setTimer(() => void open(), delay4);
+    const delay3 = backoff(attempt++);
+    options2.onStatus?.("retrying", `${reason}; retrying in ${Math.round(delay3 / 1e3)}s`);
+    retryHandle = setTimer(() => void open(), delay3);
   };
   const open = async () => {
     if (stopped) return;
@@ -23937,9 +23946,9 @@ function createRemoteController(options2) {
 import { execFile as execFile3 } from "node:child_process";
 var PROBE_TIMEOUT_MS = 4e3;
 function run2(command, args2) {
-  return new Promise((resolve6) => {
+  return new Promise((resolve7) => {
     execFile3(command, args2, { encoding: "utf8", timeout: PROBE_TIMEOUT_MS }, (error, stdout) => {
-      resolve6(error ? null : stdout);
+      resolve7(error ? null : stdout);
     });
   });
 }
@@ -25183,6 +25192,8 @@ var DEV_CRASH_STABLE_MS = 5e3;
 var DEV_CRASH_RETRY_BASE_MS = 500;
 var DEV_CRASH_RETRY_MAX_MS = 1e4;
 var CHILD_STOP_TIMEOUT_MS = 15e3;
+var STABLE_UPDATE_READY_TIMEOUT_MS = 3e4;
+var STABLE_UPDATE_STABILIZE_MS = 1e3;
 var CHILD_KILL_GRACE_MS = 5e3;
 var SOURCE_EXTENSIONS = /* @__PURE__ */ new Set([".ts", ".tsx", ".js", ".mjs", ".cjs", ".json"]);
 var CONFIG_NAMES = /* @__PURE__ */ new Set(["package.json", "pnpm-lock.yaml", "pnpm-workspace.yaml", ".npmrc"]);
@@ -25389,6 +25400,12 @@ var Supervisor = class {
   debounce = null;
   restartRunning = false;
   restartAgain = false;
+  /** Resolves when a pre-existing watcher restart has released the one child slot. */
+  restartCompletion = null;
+  /** Serializes an update candidate with watcher/browser restart requests. */
+  updateChildRunning = false;
+  /** A candidate never joins crash-retry until its selection has committed. */
+  updateCandidate = null;
   reloadLauncher = false;
   crashAttempts = 0;
   crashStableTimer = null;
@@ -25424,6 +25441,10 @@ var Supervisor = class {
   lastActivity;
   publicProxy;
   updateRestart;
+  updateMode;
+  commitUpdate;
+  updateReadyTimeoutMs;
+  updateStabilizeMs;
   rollbackUpdate;
   durableReexec;
   /** Environment of the generation that actually reached ready, never merely the latest pointer. */
@@ -25464,6 +25485,10 @@ var Supervisor = class {
     this.errorLine = opts.error ?? ((line) => log.error("supervisor", stripPrefix(line)));
     this.onActivity = opts.onActivity;
     this.updateRestart = opts.updateRestart;
+    this.updateMode = opts.updateMode ?? "durableReexec";
+    this.commitUpdate = opts.commitUpdate;
+    this.updateReadyTimeoutMs = Math.max(1, opts.updateReadyTimeoutMs ?? STABLE_UPDATE_READY_TIMEOUT_MS);
+    this.updateStabilizeMs = Math.max(0, opts.updateStabilizeMs ?? STABLE_UPDATE_STABILIZE_MS);
     this.rollbackUpdate = opts.rollbackUpdate;
     this.durableReexec = opts.durableReexec;
     this.publicProxy = new RestartSupervisorProxy({
@@ -25479,6 +25504,7 @@ var Supervisor = class {
       updateRestart: this.updateRestart ? () => this.updateFromBrowser() : void 0,
       updateAvailable: opts.updateAvailable,
       version: opts.version,
+      launcherVersion: opts.launcherVersion,
       updateVersion: opts.updateVersion,
       dev: opts.dev,
       status: () => {
@@ -25570,6 +25596,10 @@ var Supervisor = class {
   }
   requestRestart(reason, immediate = false, reloadLauncher = false, delayMs = this.debounceMs) {
     if (this.closed) return;
+    if (this.updateChildRunning) {
+      this.restartAgain = true;
+      return;
+    }
     this.reloadLauncher ||= reloadLauncher;
     if (this.debounce) clearTimeout(this.debounce);
     const run3 = () => {
@@ -25585,11 +25615,20 @@ var Supervisor = class {
     else this.debounce = setTimeout(run3, delayMs);
   }
   async restart() {
+    if (this.updateChildRunning) {
+      this.restartAgain = true;
+      return;
+    }
     if (this.restartRunning) {
       this.restartAgain = true;
       return;
     }
     this.restartRunning = true;
+    let completeRestart;
+    const completion = new Promise((resolveCompletion) => {
+      completeRestart = resolveCompletion;
+    });
+    this.restartCompletion = completion;
     try {
       let shouldReloadLauncher = false;
       do {
@@ -25597,7 +25636,7 @@ var Supervisor = class {
         shouldReloadLauncher ||= this.reloadLauncher;
         this.reloadLauncher = false;
         await this.stopChild();
-        if (!this.closed) {
+        if (!this.closed && !this.updateChildRunning) {
           const ready = await this.spawnChild();
           if (!ready) return;
         }
@@ -25605,6 +25644,8 @@ var Supervisor = class {
       if (shouldReloadLauncher && !this.closed) await this.reexecLauncher();
     } finally {
       this.restartRunning = false;
+      completeRestart();
+      if (this.restartCompletion === completion) this.restartCompletion = null;
     }
   }
   /** Called only by the public supervisor control endpoint, never by ordinary document reloads. */
@@ -25635,6 +25676,7 @@ var Supervisor = class {
   }
   async updateFromBrowser() {
     if (!this.updateRestart) return { state: "failed", message: "Update & Restart is unavailable in this launcher mode" };
+    if (this.updateMode === "child") return this.updateChildFromBrowser();
     this.emitActivity("updating", "preparing the update \u2014 the running Frizz is untouched until it is ready");
     const candidate = await this.updateRestart();
     if (candidate.state !== "ready") {
@@ -25661,6 +25703,114 @@ var Supervisor = class {
       this.handoffDraining = false;
     }
   }
+  /**
+   * Update only the disposable application server while retaining the public listener and launcher.
+   * There is deliberately no blue/green overlap: a Frizz child opens SQLite, tailers and schedulers
+   * before it can report ready, so a candidate is started only after the old child is fully gone.
+   */
+  async updateChildFromBrowser() {
+    if (!this.commitUpdate || !this.rollbackUpdate) {
+      return { state: "failed", message: "child-only Update & Restart requires commit and rollback callbacks" };
+    }
+    this.updateChildRunning = true;
+    try {
+      await this.restartCompletion;
+      this.emitActivity("updating", "preparing the new build \u2014 the running one is untouched until it is ready");
+      let prepared;
+      try {
+        prepared = await this.updateRestart();
+      } catch (error) {
+        return this.failChildUpdate(`the update could not be prepared: ${error instanceof Error ? error.message : error}`, false);
+      }
+      if (prepared.state !== "ready") {
+        return this.failChildUpdate(prepared.message ?? "the update could not be prepared", false);
+      }
+      if (this.closed) return this.failChildUpdate("Frizz supervisor stopped while preparing the update", false);
+      if (prepared.message) this.emitActivity("updating", prepared.message);
+      this.handoffDraining = true;
+      await this.stopChild();
+      if (this.closed) return this.failChildUpdate("Frizz supervisor stopped while starting the update", true);
+      const ready = await this.spawnChild({
+        updateCandidate: true,
+        readinessTimeoutMs: this.updateReadyTimeoutMs
+      });
+      const candidate = this.child;
+      if (!ready || !candidate) {
+        return this.failChildUpdate(this.lastRestartFailure ?? "the update candidate did not become ready", true);
+      }
+      if (!await this.stabilizeUpdateCandidate(candidate)) {
+        return this.failChildUpdate("the update candidate stopped before it became stable", true);
+      }
+      try {
+        await this.commitUpdate();
+      } catch (error) {
+        return this.failChildUpdate(`the update could not be committed: ${error instanceof Error ? error.message : error}`, true);
+      }
+      if (this.closed || this.child !== candidate || candidate.exitCode !== null || candidate.signalCode !== null) {
+        return this.failChildUpdate("the update candidate stopped while committing the update", true);
+      }
+      this.updateCandidate = null;
+      this.lastRestartFailure = void 0;
+      return { state: "ready" };
+    } finally {
+      this.updateChildRunning = false;
+      this.handoffDraining = false;
+      if (this.restartAgain && !this.closed) {
+        this.restartAgain = false;
+        this.requestRestart("changes received while updating", true);
+      }
+    }
+  }
+  /** Wait past a ready event so an immediate post-boot crash cannot be made durable. */
+  async stabilizeUpdateCandidate(candidate) {
+    if (this.child !== candidate || candidate.exitCode !== null || candidate.signalCode !== null) return false;
+    if (this.updateStabilizeMs === 0) return true;
+    return new Promise((resolveStable) => {
+      let settled = false;
+      const finish = (stable) => {
+        if (settled) return;
+        settled = true;
+        clearTimeout(timer);
+        candidate.removeListener("exit", exited);
+        resolveStable(stable);
+      };
+      const exited = () => finish(false);
+      const timer = setTimeout(() => finish(this.child === candidate && !this.closed), this.updateStabilizeMs);
+      timer.unref();
+      candidate.once("exit", exited);
+    });
+  }
+  /** Restore the prepared selection and, if it was drained, put the known-good child back. */
+  async failChildUpdate(message, restoreChild) {
+    const failures = [];
+    const candidate = this.updateCandidate;
+    if (candidate && this.child === candidate) await this.stopChild();
+    this.updateCandidate = null;
+    let rolledBack = false;
+    if (!this.rollbackUpdate) failures.push("rollback callback is unavailable");
+    else {
+      try {
+        await this.rollbackUpdate();
+        rolledBack = true;
+      } catch (error) {
+        failures.push(`rollback failed: ${error instanceof Error ? error.message : error}`);
+      }
+    }
+    if (restoreChild && rolledBack && !this.closed) {
+      try {
+        const restored = await this.spawnChild();
+        if (!restored) failures.push(`control plane recovery failed: ${this.lastRestartFailure ?? "the previous child did not become ready"}`);
+      } catch (error) {
+        failures.push(`control plane recovery failed: ${error instanceof Error ? error.message : error}`);
+      }
+    } else if (restoreChild && !rolledBack) {
+      failures.push("control plane was not restarted because rollback did not restore a known-good selection");
+    }
+    const detail = failures.length > 0 ? `${message}; ${failures.join("; ")}` : message;
+    this.errorLine(`[frizz] ${detail}`);
+    if (!this.closed) this.writeStatus("failed", detail, this.boot);
+    return { state: "failed", message: detail };
+  }
   /**
    * A promoted pointer is not committed until its durable owner has actually been replaced.  If
    * that handoff cannot happen, put the previous pointer back before reporting the failure.  When
@@ -25709,7 +25859,7 @@ var Supervisor = class {
     await this.publicProxy.close();
     this.writeStatus("restarting", "immutable artifact promoted; re-executing durable supervisor", null);
   }
-  async spawnChild() {
+  async spawnChild(options2 = {}) {
     const privatePort = await allocatePrivateDevPort(this.port);
     let launch;
     try {
@@ -25748,16 +25898,34 @@ var Supervisor = class {
         return;
       }
       this.child = child;
+      if (options2.updateCandidate) this.updateCandidate = child;
       this.childPort = privatePort;
       this.boot = null;
       let started = false;
       let ownershipRejected = false;
       let spawnSettled = false;
+      let readinessTimer;
       const settleSpawn = (ready) => {
         if (spawnSettled) return;
         spawnSettled = true;
+        if (readinessTimer) clearTimeout(readinessTimer);
         settled(ready);
       };
+      if (options2.readinessTimeoutMs !== void 0) {
+        readinessTimer = setTimeout(() => {
+          if (spawnSettled) return;
+          const message = `update candidate did not become ready within ${options2.readinessTimeoutMs}ms`;
+          this.lastRestartFailure = message;
+          this.errorLine(`[frizz] ${message}`);
+          this.writeStatus("failed", message, null);
+          try {
+            child.kill("SIGTERM");
+          } catch {
+          }
+          settleSpawn(false);
+        }, options2.readinessTimeoutMs);
+        readinessTimer.unref();
+      }
       child.on("message", (message) => {
         if (stopOwnerMessage(message) && message.token === this.ownerToken) {
           this.resolveStopRequested();
@@ -25799,7 +25967,7 @@ var Supervisor = class {
           this.boot = null;
           this.activeChildEnvironment = {};
         }
-        const expected2 = this.closed || this.stopping === child || ownershipRejected;
+        const expected2 = this.closed || this.stopping === child || ownershipRejected || this.updateCandidate === child;
         this.clearCrashStability();
         if (!expected2) {
           const why = signal ? `signal ${signal}` : `exit ${code ?? "unknown"}`;
@@ -26012,15 +26180,11 @@ async function startDevSupervisor(opts) {
 }
 
 // src/production-update.ts
-init_src();
 import { execFile as execFile4, spawn as spawn3 } from "node:child_process";
 import { existsSync as existsSync7 } from "node:fs";
 import { dirname as dirname12, isAbsolute as isAbsolute5, join as join14 } from "node:path";
-import { setTimeout as delay3 } from "node:timers/promises";
+init_src();
 var PRODUCTION_REEXEC_FLAG = "--_frizz-production-reexec";
-function canReexecInPlace(platform = process.platform, execve = process.execve) {
-  return platform !== "win32" && typeof execve === "function";
-}
 var PRODUCTION_PRINT_LAUNCHER_FLAG = "--_frizz-print-launcher";
 function resolveNpmInvocation(env = process.env, execPath = process.execPath, exists = existsSync7, platform = process.platform) {
   const nodeDir = dirname12(execPath);
@@ -26040,9 +26204,11 @@ function resolveNpmInvocation(env = process.env, execPath = process.execPath, ex
 }
 function compareReleaseVersions(a, b) {
   const parse2 = (value) => {
-    const match = /^v?(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/u.exec(value);
+    const match = /^v?(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/u.exec(value);
     if (!match) return null;
-    return { numeric: [Number(match[1]), Number(match[2]), Number(match[3])], prerelease: match[4] };
+    const prerelease = match[4]?.split(".");
+    if (prerelease?.some((part) => /^0\d+$/u.test(part))) return null;
+    return { numeric: [BigInt(match[1]), BigInt(match[2]), BigInt(match[3])], prerelease };
   };
   const left = parse2(a);
   const right = parse2(b);
@@ -26051,26 +26217,22 @@ function compareReleaseVersions(a, b) {
     const delta = left.numeric[index] - right.numeric[index];
     if (delta) return delta < 0 ? -1 : 1;
   }
-  if (left.prerelease === right.prerelease) return 0;
+  if (!left.prerelease && !right.prerelease) return 0;
   if (!left.prerelease) return 1;
   if (!right.prerelease) return -1;
-  return comparePrerelease(left.prerelease, right.prerelease);
-}
-function comparePrerelease(a, b) {
-  const left = a.split(".");
-  const right = b.split(".");
-  for (let index = 0; index < Math.min(left.length, right.length); index++) {
-    const l = left[index];
-    const r = right[index];
-    if (l === r) continue;
-    const lNumeric = /^\d+$/u.test(l);
-    const rNumeric = /^\d+$/u.test(r);
-    if (lNumeric && rNumeric) return Number(l) < Number(r) ? -1 : 1;
-    if (lNumeric !== rNumeric) return lNumeric ? -1 : 1;
-    return l < r ? -1 : 1;
-  }
-  if (left.length === right.length) return 0;
-  return left.length < right.length ? -1 : 1;
+  for (let index = 0; index < Math.max(left.prerelease.length, right.prerelease.length); index++) {
+    const a2 = left.prerelease[index];
+    const b2 = right.prerelease[index];
+    if (a2 === b2) continue;
+    if (a2 === void 0) return -1;
+    if (b2 === void 0) return 1;
+    const aNumeric = /^\d+$/u.test(a2);
+    const bNumeric = /^\d+$/u.test(b2);
+    if (aNumeric && bNumeric) return BigInt(a2) < BigInt(b2) ? -1 : 1;
+    if (aNumeric !== bNumeric) return aNumeric ? -1 : 1;
+    return a2 < b2 ? -1 : 1;
+  }
+  return 0;
 }
 async function planRegistryUpdate(packageName, currentVersion, adapter) {
   const latestVersion = (await adapter.latestVersion(packageName)).trim();
@@ -26080,9 +26242,6 @@ async function planRegistryUpdate(packageName, currentVersion, adapter) {
   if (comparison >= 0) return null;
   return { packageName, currentVersion, latestVersion, packageSpec: `${packageName}@${latestVersion}` };
 }
-function successorArgs(port) {
-  return [PRODUCTION_REEXEC_FLAG, "--port", String(port)];
-}
 function reexecArgv(rawArgs2) {
   const kept = [];
   for (let index = 0; index < rawArgs2.length; index++) {
@@ -26097,110 +26256,6 @@ function reexecArgv(rawArgs2) {
   }
   return kept;
 }
-async function resolveRegistrySuccessor(plan, request, adapter) {
-  const result = await adapter.npmExec({
-    packageSpec: plan.packageSpec,
-    // The published bin name tracks the package name (frizz). Never hardcode a stale bin here or
-    // a renamed release would resolve the new package but invoke a bin that no longer exists.
-    bin: plan.packageName,
-    args: [PRODUCTION_PRINT_LAUNCHER_FLAG],
-    cwd: request.cwd,
-    env: request.env
-  });
-  if (result.code !== 0) {
-    const how = result.signal ? `signal ${result.signal}` : `exit ${result.code}`;
-    const tail = result.stderr.trim().split("\n").slice(-6).join("\n").trim();
-    throw new Error(`npm exec ${plan.packageSpec} failed (${how})${tail ? `: ${tail}` : ""}`);
-  }
-  const entry = result.stdout.trim().split("\n").map((line) => line.trim()).filter(Boolean).at(-1) ?? "";
-  if (!isAbsolute5(entry) || !existsSync7(entry))
-    throw new Error(`${plan.packageSpec} did not report its launcher entry (got ${JSON.stringify(entry)})`);
-  return { plan, entry };
-}
-function reexecIntoRegistrySuccessor(successor, request, execve = process.execve.bind(process)) {
-  return execve(process.execPath, [process.execPath, successor.entry, ...successorArgs(request.port)], {
-    ...request.env,
-    FRIZZ_REGISTRY_PACKAGE: successor.plan.packageName,
-    FRIZZ_REGISTRY_VERSION: successor.plan.latestVersion
-  });
-}
-function handoffToRegistrySuccessor(successor, request, adapter) {
-  const child = adapter.spawnDetached({
-    entry: successor.entry,
-    args: successorArgs(request.port),
-    cwd: request.cwd,
-    env: {
-      ...request.env,
-      FRIZZ_REGISTRY_PACKAGE: successor.plan.packageName,
-      FRIZZ_REGISTRY_VERSION: successor.plan.latestVersion
-    }
-  });
-  child.once("error", () => {
-  });
-  if (child.pid === void 0) throw new Error(`could not start Frizz ${successor.plan.latestVersion} from ${successor.entry}`);
-  child.unref();
-  return child;
-}
-var SUCCESSOR_READY_TIMEOUT_MS = 6e4;
-async function awaitRegistrySuccessor(child, expected2, watch) {
-  const deadlineMs = watch.deadlineMs ?? SUCCESSOR_READY_TIMEOUT_MS;
-  const intervalMs = watch.intervalMs ?? 250;
-  const now = watch.now ?? Date.now;
-  const sleep = watch.sleep ?? ((ms) => delay3(ms));
-  const where = expected2.logFile ? `; its log is ${expected2.logFile}` : "";
-  let exited = child.exitCode !== null || child.signalCode !== null ? describeExit(child.exitCode, child.signalCode) : void 0;
-  const onExit = (code, signal) => {
-    exited = describeExit(code, signal);
-  };
-  child.once("exit", onExit);
-  try {
-    const started = now();
-    for (; ; ) {
-      if (exited) throw new Error(`Frizz ${expected2.version} exited (${exited}) before it answered on port ${expected2.port}${where}`);
-      const status = await watch.status();
-      if (status?.version === expected2.version) return;
-      if (now() - started >= deadlineMs) {
-        try {
-          child.kill();
-        } catch {
-        }
-        throw new Error(
-          `Frizz ${expected2.version} did not answer on port ${expected2.port} within ${Math.round(deadlineMs / 1e3)}s${where}`
-        );
-      }
-      await sleep(intervalMs);
-    }
-  } finally {
-    child.off("exit", onExit);
-  }
-}
-function describeExit(code, signal) {
-  return signal ? `signal ${signal}` : `exit ${code ?? "unknown"}`;
-}
-function launcherControlHeaders(port) {
-  return { origin: `http://127.0.0.1:${port}`, "cache-control": "no-store" };
-}
-async function readLauncherStatus(port, fetcher = fetch) {
-  const controller = new AbortController();
-  const timeout = setTimeout(() => controller.abort(), 1e3);
-  timeout.unref?.();
-  try {
-    const response = await fetcher(`http://127.0.0.1:${port}${FRIZZ_ROUTE_PREFIX}/control/status`, {
-      signal: controller.signal,
-      headers: launcherControlHeaders(port)
-    });
-    if (!response.ok) return void 0;
-    const body = await response.json();
-    return {
-      ...typeof body.version === "string" ? { version: body.version } : {},
-      ...typeof body.state === "string" ? { state: body.state } : {}
-    };
-  } catch {
-    return void 0;
-  } finally {
-    clearTimeout(timeout);
-  }
-}
 function isGlobalInstall(bundleDir, env = process.env) {
   if (env.npm_execpath) return false;
   const segments = bundleDir.split(/[\\/]/u);
@@ -26294,11 +26349,386 @@ npm exec ${packageSpec} did not finish within ${formatTimeout(execTimeoutMs)} an
 }
 var npmRegistryReleaseAdapter = createNpmRegistryReleaseAdapter();
 
+// src/server-release.ts
+init_frizz_paths();
+import { execFile as execFile5 } from "node:child_process";
+import { createHash as createHash4, randomUUID as randomUUID6 } from "node:crypto";
+import {
+  closeSync as closeSync5,
+  existsSync as existsSync8,
+  fsyncSync as fsyncSync5,
+  mkdirSync as mkdirSync12,
+  openSync as openSync6,
+  readFileSync as readFileSync13,
+  realpathSync as realpathSync6,
+  renameSync as renameSync6,
+  rmSync as rmSync9,
+  statSync as statSync5,
+  writeFileSync as writeFileSync11
+} from "node:fs";
+import { delimiter as delimiter2, dirname as dirname13, isAbsolute as isAbsolute6, join as join15, relative as relative3, resolve as resolve6, sep as sep4 } from "node:path";
+var SERVER_PROTOCOL = 1;
+var SERVER_DATA_EPOCH = 1;
+var VERSION = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/u;
+var PACKAGE = /^(?:@[a-z0-9][a-z0-9._-]*\/)?[a-z0-9][a-z0-9._-]*$/u;
+var GENERATION = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/u;
+var CURRENT_COMPATIBILITY = { protocol: SERVER_PROTOCOL, dataEpoch: SERVER_DATA_EPOCH };
+function assertSpecShape(spec) {
+  if (typeof spec.package !== "string" || typeof spec.version !== "string" || !PACKAGE.test(spec.package) || !VERSION.test(spec.version))
+    throw new Error("invalid exact Frizz server package/version");
+  if (!Number.isSafeInteger(spec.protocol) || spec.protocol < 1 || !Number.isSafeInteger(spec.dataEpoch) || spec.dataEpoch < 1)
+    throw new Error("invalid Frizz server protocol/data epoch");
+}
+function assertSpec(spec, compatibility = CURRENT_COMPATIBILITY) {
+  assertSpecShape(spec);
+  if (spec.protocol !== compatibility.protocol || spec.dataEpoch !== compatibility.dataEpoch)
+    throw new Error("this Frizz server requires a newer launcher or a data migration; restart with a compatible Frizz release");
+}
+function readJson(path) {
+  return JSON.parse(readFileSync13(path, "utf8"));
+}
+function record(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("invalid Frizz server manifest");
+  return value;
+}
+function serverReleaseSpec(manifest, packageOverride) {
+  const metadata = record(record(manifest).frizzServer);
+  const spec = {
+    package: packageOverride ?? metadata.package,
+    version: metadata.version,
+    protocol: metadata.protocol,
+    dataEpoch: metadata.dataEpoch
+  };
+  assertSpec(spec);
+  return spec;
+}
+function containedFile(root, name, directory = false) {
+  const path = realpathSync6(join15(root, name));
+  const rel = relative3(realpathSync6(root), path);
+  if (rel === ".." || rel.startsWith(`..${sep4}`) || isAbsolute6(rel))
+    throw new Error(`Frizz server artifact escapes its package: ${name}`);
+  const stat = statSync5(path);
+  if (directory ? !stat.isDirectory() : !stat.isFile()) throw new Error(`invalid Frizz server artifact: ${name}`);
+  return path;
+}
+function validateServerGeneration(root, spec, id, compatibility = CURRENT_COMPATIBILITY) {
+  assertSpec(spec, compatibility);
+  if (!GENERATION.test(id)) throw new Error("invalid Frizz server generation id");
+  const manifest = record(readJson(join15(root, "package.json")));
+  const metadata = record(manifest.frizzServer);
+  if (manifest.name !== spec.package || manifest.version !== spec.version)
+    throw new Error(`Frizz server install did not contain ${spec.package}@${spec.version}`);
+  if (metadata.protocol !== spec.protocol || metadata.dataEpoch !== spec.dataEpoch)
+    throw new Error("Frizz server protocol/data epoch is incompatible; the current server has not been stopped");
+  const entry = containedFile(root, "dist/dev-child.js");
+  containedFile(root, "dist/codex-app-server-daemon.js");
+  containedFile(root, "dist/claude-agent-broker.js");
+  containedFile(root, "web-dist/index.html");
+  containedFile(root, "runtime/board/index.mjs");
+  containedFile(root, "runtime/cc-worker/.claude-plugin/plugin.json");
+  return { ...spec, id, root: realpathSync6(root), entry };
+}
+function serverGenerationLaunch(generation) {
+  return {
+    entry: generation.entry,
+    environment: {
+      FRIZZ_STABLE_ARTIFACT: `npm:${generation.package}@${generation.version}`,
+      FRIZZ_STABLE_WEB_DIST: join15(generation.root, "web-dist"),
+      FRIZZ_SCRIPTS_DIR: join15(generation.root, "runtime/board"),
+      FRIZZ_WORKER_PLUGIN_DIR: join15(generation.root, "runtime/cc-worker")
+    }
+  };
+}
+function resolveNpmCli(env = process.env, executable = process.execPath) {
+  const candidates = [];
+  if (env.npm_execpath?.endsWith("npm-cli.js")) candidates.push(env.npm_execpath);
+  for (const directory of [dirname13(executable), ...(env.PATH ?? env.Path ?? "").split(delimiter2).filter(Boolean)]) {
+    candidates.push(join15(directory, "node_modules/npm/bin/npm-cli.js"), join15(directory, "../lib/node_modules/npm/bin/npm-cli.js"));
+    try {
+      const path = realpathSync6(join15(directory, "npm"));
+      if (path.endsWith("npm-cli.js")) candidates.push(path);
+    } catch {
+    }
+  }
+  const found = candidates.find((path) => existsSync8(path) && statSync5(path).isFile());
+  if (!found) throw new Error("npm was not found beside Node or on PATH; install Node with npm to install Frizz server releases");
+  return resolve6(found);
+}
+function npmServerPackageInstaller(env = process.env) {
+  const run3 = (args2, cwd) => new Promise((resolveOutput, reject) => {
+    let cli;
+    try {
+      cli = resolveNpmCli(env);
+    } catch (error) {
+      reject(error);
+      return;
+    }
+    execFile5(process.execPath, [cli, ...args2], {
+      env,
+      cwd,
+      encoding: "utf8",
+      windowsHide: true,
+      timeout: 18e4,
+      killSignal: "SIGKILL",
+      maxBuffer: 4 * 1024 * 1024
+    }, (error, stdout, stderr) => {
+      if (error) {
+        const tail = stderr.trim().split("\n").slice(-8).join("\n");
+        reject(new Error(`Frizz server npm operation failed: ${tail || error.message}`));
+      } else resolveOutput(stdout);
+    });
+  });
+  return {
+    async install(prefix, spec) {
+      assertSpec(spec);
+      await run3([
+        "install",
+        "--prefix",
+        prefix,
+        "--global=false",
+        "--ignore-scripts",
+        "--no-audit",
+        "--no-fund",
+        "--engine-strict",
+        "--install-strategy=hoisted",
+        "--include=optional",
+        "--omit=dev",
+        "--save-exact",
+        `${spec.package}@${spec.version}`
+      ], prefix);
+    },
+    async latestVersion(packageName) {
+      if (!PACKAGE.test(packageName)) throw new Error("invalid Frizz server package name");
+      const version = JSON.parse(await run3(["view", `${packageName}@latest`, "version", "--json"]));
+      if (typeof version !== "string" || !VERSION.test(version)) throw new Error("npm returned an invalid Frizz server version");
+      return version;
+    }
+  };
+}
+function atomicJson2(path, value) {
+  mkdirSync12(dirname13(path), { recursive: true, mode: 448 });
+  const temp = `${path}.${randomUUID6()}.tmp`;
+  try {
+    const fd = openSync6(temp, "wx", 384);
+    try {
+      writeFileSync11(fd, `${JSON.stringify(value)}
+`);
+      fsyncSync5(fd);
+    } finally {
+      closeSync5(fd);
+    }
+    renameSync6(temp, path);
+    try {
+      const directory = openSync6(dirname13(path), "r");
+      try {
+        fsyncSync5(directory);
+      } finally {
+        closeSync5(directory);
+      }
+    } catch {
+    }
+  } finally {
+    rmSync9(temp, { force: true });
+  }
+}
+var ServerReleaseStore = class {
+  constructor(spec, installer, roots = frizzPaths(), compatibility = CURRENT_COMPATIBILITY) {
+    this.spec = spec;
+    this.installer = installer;
+    this.roots = roots;
+    this.compatibility = compatibility;
+    assertSpec(spec, compatibility);
+    const key = createHash4("sha256").update(spec.package).digest("hex").slice(0, 16);
+    this.generations = join15(roots.cache, "server-releases", key);
+    this.selection = join15(roots.state, "server-releases", key, "active.json");
+    this.compatibilityMarker = join15(roots.state, "server-releases", "data-compatibility.json");
+  }
+  generations;
+  selection;
+  /** One global data marker: every package override opens the same Frizz databases. */
+  compatibilityMarker;
+  packageRoot(id) {
+    return join15(this.generations, id, "node_modules", this.spec.package);
+  }
+  readCompatibilityMarker() {
+    if (!existsSync8(this.compatibilityMarker)) return void 0;
+    try {
+      const marker = record(readJson(this.compatibilityMarker));
+      const compatibility = { protocol: marker.protocol, dataEpoch: marker.dataEpoch };
+      assertSpecShape({ package: this.spec.package, version: this.spec.version, ...compatibility });
+      return compatibility;
+    } catch {
+      throw new Error("invalid saved Frizz server data compatibility marker; refusing to risk a data downgrade");
+    }
+  }
+  assertMarkerIsSupported() {
+    const marker = this.readCompatibilityMarker();
+    if (!marker) return;
+    if (marker.protocol !== this.compatibility.protocol || marker.dataEpoch > this.compatibility.dataEpoch)
+      throw new Error("this Frizz server requires a newer launcher or a data migration; restart with a compatible Frizz release");
+  }
+  /**
+   * Advance the global epoch only after the exact replacement has been staged and validated, but
+   * before handing it to the caller that can launch it. A crash before first boot must never let an
+   * older shell reopen the database the candidate may already have migrated.
+   */
+  markCompatibilityBeforeLaunch() {
+    const marker = this.readCompatibilityMarker();
+    if (marker?.protocol !== void 0 && marker.protocol !== this.compatibility.protocol)
+      throw new Error("this Frizz server requires a newer launcher or a data migration; restart with a compatible Frizz release");
+    if ((marker?.dataEpoch ?? 0) > this.compatibility.dataEpoch)
+      throw new Error("this Frizz server requires a newer launcher or a data migration; restart with a compatible Frizz release");
+    if (marker?.dataEpoch === this.compatibility.dataEpoch) return;
+    atomicJson2(this.compatibilityMarker, this.compatibility);
+  }
+  async prepareInitial(version) {
+    const generation = await this.prepare(version);
+    this.markCompatibilityBeforeLaunch();
+    return generation;
+  }
+  async load() {
+    this.assertMarkerIsSupported();
+    if (!existsSync8(this.selection)) return this.prepareInitial(this.spec.version);
+    const selected = record(readJson(this.selection));
+    const spec = selected;
+    assertSpecShape(spec);
+    if (spec.package !== this.spec.package || typeof selected.id !== "string" || !GENERATION.test(selected.id))
+      throw new Error("invalid saved Frizz server selection; refusing to fall back to an older server");
+    if (spec.protocol !== this.compatibility.protocol)
+      throw new Error("this Frizz server requires a newer launcher or a data migration; restart with a compatible Frizz release");
+    if (spec.dataEpoch < this.compatibility.dataEpoch) return this.prepareInitial(this.spec.version);
+    if (spec.dataEpoch > this.compatibility.dataEpoch)
+      throw new Error("this Frizz server requires a newer launcher or a data migration; restart with a compatible Frizz release");
+    const root = this.packageRoot(selected.id);
+    const generation = !existsSync8(root) ? await this.prepare(spec.version) : validateServerGeneration(root, spec, selected.id, this.compatibility);
+    this.markCompatibilityBeforeLaunch();
+    return generation;
+  }
+  async prepare(version) {
+    const spec = { ...this.spec, version };
+    assertSpec(spec, this.compatibility);
+    mkdirSync12(this.generations, { recursive: true, mode: 448 });
+    const id = randomUUID6();
+    const staging = join15(this.generations, `${id}.staging`);
+    const destination = join15(this.generations, id);
+    mkdirSync12(staging, { mode: 448 });
+    try {
+      writeFileSync11(join15(staging, "package.json"), '{"private":true}\n', { mode: 384 });
+      await this.installer.install(staging, spec);
+      validateServerGeneration(join15(staging, "node_modules", spec.package), spec, id, this.compatibility);
+      renameSync6(staging, destination);
+      return validateServerGeneration(this.packageRoot(id), spec, id, this.compatibility);
+    } finally {
+      rmSync9(staging, { recursive: true, force: true });
+    }
+  }
+  commit(generation) {
+    if (generation.package !== this.spec.package || generation.root !== realpathSync6(this.packageRoot(generation.id)))
+      throw new Error("cannot select a Frizz server outside this release store");
+    validateServerGeneration(generation.root, generation, generation.id, this.compatibility);
+    const { package: packageName, version, protocol, dataEpoch, id } = generation;
+    atomicJson2(this.selection, { package: packageName, version, protocol, dataEpoch, id });
+  }
+};
+
+// src/server-owner.ts
+init_frizz_paths();
+init_project_launch();
+import { randomUUID as randomUUID7 } from "node:crypto";
+import { mkdirSync as mkdirSync13, readFileSync as readFileSync14, realpathSync as realpathSync7 } from "node:fs";
+import { join as join16 } from "node:path";
+var STABLE_SERVER_OWNER_NAME = "frizz-server";
+var STABLE_SERVER_OWNER_PROJECT_ID = "c1fd5810-0f8a-4c1d-91a0-6d7445d28e5a";
+var ADDRESS_NAME = "address.json";
+var UUID_RE2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/iu;
+function rootsFor(roots) {
+  return roots ?? frizzPaths();
+}
+function stableServerOwnerTarget(roots) {
+  const resolved = rootsFor(roots);
+  mkdirSync13(resolved.data, { recursive: true, mode: 448 });
+  return {
+    projectId: STABLE_SERVER_OWNER_PROJECT_ID,
+    projectDir: realpathSync7(resolved.data),
+    stateDir: join16(resolved.state, STABLE_SERVER_OWNER_NAME)
+  };
+}
+function matchingTarget(owner, target2) {
+  return owner.projectId === target2.projectId && owner.projectDir === target2.projectDir;
+}
+function readAddress(path) {
+  try {
+    const value = JSON.parse(readFileSync14(path, "utf8"));
+    if (value.version !== 1 || typeof value.ownerToken !== "string" || !UUID_RE2.test(value.ownerToken) || typeof value.publisherToken !== "string" || !UUID_RE2.test(value.publisherToken) || typeof value.pid !== "number" || !Number.isInteger(value.pid) || value.pid <= 0 || typeof value.processStart !== "string" || value.processStart.length === 0 || typeof value.port !== "number" || !Number.isInteger(value.port) || value.port < 1 || value.port > 65535) return null;
+    return value;
+  } catch {
+    return null;
+  }
+}
+function readStableServerOwner(roots) {
+  const target2 = stableServerOwnerTarget(roots);
+  const owner = readProjectLaunchOwner(target2.stateDir);
+  if (!owner || !matchingTarget(owner, target2) || processGenerationIsStale(owner)) return { kind: "idle" };
+  const address = readAddress(join16(target2.stateDir, ADDRESS_NAME));
+  if (!address || address.ownerToken !== owner.token || address.pid !== owner.pid || address.processStart !== owner.processStart) return { kind: "busy", owner };
+  return { kind: "running", port: address.port, owner };
+}
+function wrapLease(lease) {
+  return {
+    target: lease.target,
+    token: lease.token,
+    pid: lease.pid,
+    processStart: lease.processStart,
+    publisherToken: randomUUID7()
+  };
+}
+function acquireStableServerOwner(roots) {
+  const target2 = stableServerOwnerTarget(roots);
+  const attempt = tryAcquireProjectLaunchOwner(target2, "server");
+  if (attempt.kind === "acquired") return { kind: "acquired", lease: holdLease(attempt.lease) };
+  const observed = readStableServerOwner(roots);
+  return observed.kind === "running" || observed.kind === "busy" ? observed : { kind: "busy", owner: attempt.owner };
+}
+function publishStableServerAddress(lease, port) {
+  if (!Number.isInteger(port) || port < 1 || port > 65535) throw new Error(`invalid stable Frizz server port: ${port}`);
+  const owner = readProjectLaunchOwner(lease.target.stateDir);
+  if (!owner || !matchingTarget(owner, lease.target) || owner.token !== lease.token || owner.pid !== lease.pid || owner.processStart !== lease.processStart || processGenerationIsStale(owner)) throw new Error("cannot publish an address without the exact live stable Frizz server owner");
+  writeProjectStatus(join16(lease.target.stateDir, ADDRESS_NAME), {
+    version: 1,
+    ownerToken: lease.token,
+    pid: lease.pid,
+    processStart: lease.processStart,
+    publisherToken: lease.publisherToken,
+    port
+  });
+}
+function releaseStableServerOwner(lease) {
+  return releaseHeldLease(lease);
+}
+var heldLeases = /* @__PURE__ */ new Map();
+function holdLease(lease) {
+  const wrapped = wrapLease(lease);
+  heldLeases.set(wrapped.publisherToken, lease);
+  return wrapped;
+}
+function releaseHeldLease(lease) {
+  const held = heldLeases.get(lease.publisherToken);
+  if (!held || held.token !== lease.token || held.pid !== lease.pid || held.processStart !== lease.processStart) return false;
+  const released = held.release();
+  if (!released) return false;
+  heldLeases.delete(lease.publisherToken);
+  removeProjectStatus(join16(lease.target.stateDir, ADDRESS_NAME), {
+    ownerToken: lease.token,
+    pid: lease.pid,
+    processStart: lease.processStart,
+    publisherToken: lease.publisherToken
+  });
+  return true;
+}
+
 // src/preflight.ts
+init_native_helper();
 import { spawnSync } from "node:child_process";
-import { chmodSync as chmodSync2, statSync as statSync5 } from "node:fs";
-import { createRequire } from "node:module";
-import { dirname as dirname13, join as join15 } from "node:path";
 var SUPPORTED_NODE_LINES = [
   { major: 22, minor: 13 },
   { major: 23, minor: 4 }
@@ -26342,25 +26772,6 @@ function assertLaunchPrerequisites(options2 = {}) {
     );
   assertRequiredExecutables(options2.command ?? commandIsAvailable);
 }
-function ensureNativeHelperPermissions(options2 = {}) {
-  const platform = options2.platform ?? process.platform;
-  if (platform === "win32") return;
-  const stat = options2.stat ?? ((path) => statSync5(path));
-  const chmod = options2.chmod ?? ((path, mode) => chmodSync2(path, mode));
-  const resolvePty = options2.resolvePty ?? (() => createRequire(import.meta.url).resolve("node-pty/package.json"));
-  try {
-    const helper = join15(
-      dirname13(resolvePty()),
-      "prebuilds",
-      `${platform}-${options2.arch ?? process.arch}`,
-      "spawn-helper"
-    );
-    const mode = stat(helper).mode;
-    if ((mode & 73) === 73) return;
-    chmod(helper, mode | 493);
-  } catch {
-  }
-}
 
 // src/production.ts
 init_src();
@@ -26369,7 +26780,7 @@ init_project_identity();
 var PACKAGE_NAME = process.env.FRIZZ_REGISTRY_PACKAGE ?? "frizz";
 function resolvePackageVersion() {
   try {
-    const manifest = JSON.parse(readFileSync13(join16(import.meta.dirname, "..", "package.json"), "utf8"));
+    const manifest = JSON.parse(readFileSync15(join17(import.meta.dirname, "..", "package.json"), "utf8"));
     if (typeof manifest.version === "string" && manifest.version.trim()) return manifest.version.trim();
   } catch {
   }
@@ -26433,10 +26844,13 @@ var sandbox = options.sandbox ? prepareSandbox() : null;
 if (sandbox) process.on("exit", () => cleanupSandbox(sandbox.home));
 var remote = null;
 var paneHost = null;
-var rearmPaneHost = null;
 var globalInstall = process.env[GLOBAL_INSTALL_ENV] === "1" || isGlobalInstall(import.meta.dirname);
 var accessPane = null;
 var activeAccessLink = null;
+var serverOwner;
+process.on("exit", () => {
+  if (serverOwner) releaseStableServerOwner(serverOwner);
+});
 var launchIntent;
 var workspace = (() => {
   try {
@@ -26522,15 +26936,15 @@ if (options.link) {
 var logger = setAmbientLogger(
   process.env.FRIZZ_LOG_FILE ? createLogger({ file: process.env.FRIZZ_LOG_FILE, owner: false }) : createLogger({ file: runLogPath(workspace.stateDir) })
 );
-var readout = reexec || process.env.FRIZZ_PRODUCTION_SUPERVISOR === "1" ? void 0 : new Readout({ debug: options.debug, version: PACKAGE_VERSION });
-var activityReadout = readout ?? (reexec && process.stdout.isTTY ? noticeOnlyReadout({ version: PACKAGE_VERSION }) : void 0);
+var readout = reexec || process.env.FRIZZ_PRODUCTION_SUPERVISOR === "1" ? void 0 : new Readout({ debug: options.debug });
+var activityReadout = readout ?? (reexec && process.stdout.isTTY ? noticeOnlyReadout({}) : void 0);
 attachTerminalMirror(logger, options.debug || process.env.FRIZZ_DEBUG === "1");
 readout?.plan([
   { key: "server", label: "Server" },
   { key: "browser", label: options.noApp ? "Address" : "Browser" }
 ]);
 readout?.begin("server", "starting");
-logger.info("launcher", `frizz ${PACKAGE_VERSION} starting for ${workspace.root}`);
+logger.info("launcher", `Frizz launcher ${PACKAGE_VERSION} starting for ${workspace.root}`);
 var target = workspaceLaunchTarget(workspace);
 var expected = expectedOwnerHealth(target, readProjectLaunchOwner(workspace.stateDir));
 async function existingPort() {
@@ -26579,7 +26993,7 @@ async function openOrPrint(port, reused, path = "") {
     readout?.begin("browser", options.appMode ? "requesting app window" : "requesting default browser");
     try {
       if (options.appMode) {
-        await launchApp(url, { dataPath: join16(workspace.stateDir, "browser-profile") });
+        await launchApp(url, { dataPath: join17(workspace.stateDir, "browser-profile") });
         browser = reused ? "focused the Frizz app window" : "opened the Frizz app window";
       } else {
         await launchBrowserTab(url);
@@ -26598,7 +27012,7 @@ async function openOrPrint(port, reused, path = "") {
   const warnings = [];
   if (sandbox) warnings.push(`Sandbox: everything here is throwaway (${sandbox.home}) and is deleted when this terminal closes.`);
   if (!readout) {
-    console.log(`${reused ? "reusing" : "started"} Frizz ${PACKAGE_VERSION} for ${workspace.root}`);
+    console.log(`${reused ? "reusing" : "started"} Frizz for ${workspace.root}`);
     console.log(url);
     if (publicOrigin) console.log(activeAccessLink?.url ?? `${publicOrigin}/`);
     for (const warning of warnings) console.log(warning);
@@ -26623,31 +27037,40 @@ async function openOrPrint(port, reused, path = "") {
     }
   );
 }
-async function runSupervisor(port, token) {
+async function runSupervisor(port, token, onPrepared = () => {
+}) {
   assertLaunchPrerequisites();
-  ensureNativeHelperPermissions();
+  if (!serverOwner) throw new Error("stable server launch is missing global ownership");
   const owner = adoptProjectLaunchOwner(target, token, "supervisor");
   const env = projectLaunchEnvironment(
     {
       ...process.env,
       FRIZZ_PRODUCTION_SUPERVISOR: "1",
+      FRIZZ_SERVER_OWNERSHIP: JSON.stringify(projectLaunchEnvironment({}, serverOwner.target, serverOwner.token)),
       ...logEnvironment(logger, options.debug ? "debug" : "info"),
       ...options.debug ? { FRIZZ_DEBUG: "1" } : {}
     },
     target,
     owner.token
   );
-  const webDist = join16(import.meta.dirname, "..", "web-dist");
-  const runtimeDir = join16(import.meta.dirname, "..", "runtime");
-  const scriptsDir = join16(runtimeDir, "board");
-  const workerPluginDir = join16(runtimeDir, "cc-worker");
-  const childEntry = fileURLToPath2(new URL("./dev-child.js", import.meta.url));
-  let plannedSuccessor;
+  const spec = serverReleaseSpec(
+    JSON.parse(readFileSync15(join17(import.meta.dirname, "..", "package.json"), "utf8")),
+    process.env.FRIZZ_SERVER_PACKAGE
+  );
+  const installer = npmServerPackageInstaller(env);
+  const store = new ServerReleaseStore(spec, installer);
+  activityReadout?.notice("progress", "Starting", "loading the selected Frizz server release");
+  let active = await store.load();
+  let pending;
+  let previous = active;
+  onPrepared();
   let updateAvailable = false;
   let updateVersion;
   const refreshUpdateAvailable = async () => {
     try {
-      const plan = await planRegistryUpdate(PACKAGE_NAME, PACKAGE_VERSION, npmRegistryReleaseAdapter);
+      const checkedVersion = active.version;
+      const plan = await planRegistryUpdate(spec.package, checkedVersion, installer);
+      if (active.version !== checkedVersion) return;
       updateAvailable = plan !== null;
       updateVersion = plan?.latestVersion;
     } catch {
@@ -26673,83 +27096,48 @@ async function runSupervisor(port, token) {
     launchOwnerToken: owner.token,
     env,
     watch: false,
-    childEntry,
-    childEnvironment: () => ({ FRIZZ_STABLE_WEB_DIST: webDist, FRIZZ_STABLE_ARTIFACT: `npm:${PACKAGE_NAME}@${PACKAGE_VERSION}`, FRIZZ_SCRIPTS_DIR: scriptsDir, FRIZZ_WORKER_PLUGIN_DIR: workerPluginDir }),
+    childLaunchProvider: () => serverGenerationLaunch(pending ?? active),
+    updateMode: "child",
     updateAvailable: () => updateAvailable,
-    version: PACKAGE_VERSION,
+    version: () => active.version,
+    launcherVersion: PACKAGE_VERSION,
     updateVersion: () => updateVersion,
     // The terminal that owns the board says so when the board goes down and comes back. Everything
     // here is triggered from a browser tab or by a crash, so without this the foreground process is
     // the last place to learn what happened to it.
     onActivity: (event) => renderSupervisorActivity(activityReadout, event),
     updateRestart: async () => {
+      previous = active;
       try {
-        const plan = await planRegistryUpdate(PACKAGE_NAME, PACKAGE_VERSION, npmRegistryReleaseAdapter);
+        const plan = await planRegistryUpdate(spec.package, active.version, installer);
         if (!plan) {
           updateAvailable = false;
           updateVersion = void 0;
-          return { state: "failed", message: `Frizz ${PACKAGE_VERSION} is already current` };
+          return { state: "failed", message: `Frizz ${active.version} is already current` };
         }
+        updateAvailable = true;
         updateVersion = plan.latestVersion;
-        plannedSuccessor = await resolveRegistrySuccessor(plan, { cwd: workspace.root, env }, npmRegistryReleaseAdapter);
-        return { state: "ready", message: `Frizz ${plan.latestVersion} is installed in its own npm execution cache` };
+        pending = await store.prepare(plan.latestVersion);
+        return { state: "ready", message: `Frizz ${plan.latestVersion} is installed and compatible` };
       } catch (error) {
         return { state: "failed", message: error instanceof Error ? error.message : String(error) };
       }
     },
-    // The registry launcher promotes no pointer — the release sits in npm's own execution cache and
-    // the running package is never touched — so there is nothing to roll back. Present and empty
-    // rather than absent: the supervisor appends "rollback callback is unavailable" to every failed
-    // handoff it cannot roll back, which for this launcher was noise on a message that already said
-    // what went wrong (audit 2026-09-11, finding 4).
-    rollbackUpdate: () => {
+    commitUpdate: () => {
+      if (!pending) throw new Error("no server update was prepared");
+      store.commit(pending);
+      active = pending;
+      pending = void 0;
+      updateAvailable = false;
+      updateVersion = void 0;
     },
-    durableReexec: async () => {
-      const successor = plannedSuccessor;
-      if (!successor) throw new Error("no update was prepared");
-      const { plan } = successor;
-      const successorEnv = {
-        ...env,
-        FRIZZ_REGISTRY_PACKAGE: plan.packageName,
-        FRIZZ_REGISTRY_VERSION: plan.latestVersion,
-        ...globalInstall ? { [GLOBAL_INSTALL_ENV]: "1" } : {}
-      };
-      if (canReexecInPlace()) {
-        activityReadout?.notice("progress", "Updating", `reloading this launcher in place on Frizz ${plan.latestVersion}`);
-        paneHost?.dispose();
-        remote?.stop();
-        try {
-          reexecIntoRegistrySuccessor(successor, { port, env: successorEnv });
-        } catch (error) {
-          rearmPaneHost?.();
-          try {
-            await remote?.serveSaved();
-          } catch (remoteError) {
-            const message = remoteError instanceof Error ? remoteError.message : String(remoteError);
-            logger.error("remote", `could not re-arm the saved remote setup after a failed update: ${message}`);
-          }
-          throw error;
-        }
-      }
-      const child = handoffToRegistrySuccessor(successor, { port, cwd: workspace.root, env: successorEnv }, npmRegistryReleaseAdapter);
-      activityReadout?.notice("progress", "Updating", `starting Frizz ${plan.latestVersion} in the background and waiting for it to answer on port ${port}`);
-      await awaitRegistrySuccessor(
-        child,
-        { version: plan.latestVersion, port, logFile: successorEnv.FRIZZ_LOG_FILE },
-        { status: () => readLauncherStatus(port) }
-      );
-      paneHost?.dispose();
-      remote?.stop();
-      activityReadout?.notice("done", "Updated", `Frizz ${plan.latestVersion} is serving on port ${port}`);
-      activityReadout?.note(
-        `
-  Frizz ${plan.latestVersion} now runs in the background \u2014 ctrl-c here no longer reaches it. Stop it with ${PACKAGE_NAME} --stop.${globalInstall ? `
-  Update: ${keepUpdateHint(PACKAGE_NAME, plan.latestVersion)}.` : ""}
-`
-      );
-      process.exit(0);
+    rollbackUpdate: () => {
+      if (active.id !== previous.id) store.commit(previous);
+      active = previous;
+      pending = void 0;
     }
   });
+  publishStableServerAddress(serverOwner, port);
   remote = createRemoteController({ host: supervisor, port, log: logger, say: (message) => console.error(`frizz: ${message}`) });
   try {
     await remote.serveSaved();
@@ -26770,16 +27158,14 @@ async function runSupervisor(port, token) {
     onChanged: (config) => logger.info("remote", config ? `reached at https://${config.hostname}` : "loopback only"),
     sandbox: sandbox !== null
   });
-  const bindings = { l: accessPane, L: accessPane, r: remotePane, R: remotePane };
-  const armPaneHost = () => {
-    paneHost = installPaneHost({ bindings });
-  };
-  armPaneHost();
-  rearmPaneHost = armPaneHost;
+  paneHost = installPaneHost({ bindings: { l: accessPane, L: accessPane, r: remotePane, R: remotePane } });
   const stop = createSupervisorShutdownHandler({
     close: () => supervisor.close(),
     force: () => supervisor.forceStop(),
-    release: () => owner.release(),
+    release: () => {
+      owner.release();
+      if (serverOwner) releaseStableServerOwner(serverOwner);
+    },
     // Acknowledge the first signal on the spot; the drain that follows is bounded but not instant.
     onStop: () => {
       logger.info("launcher", "stop signal received; draining the control plane");
@@ -26809,17 +27195,28 @@ async function runSupervisor(port, token) {
   process.on("SIGHUP", stop);
   void supervisor.stopRequested.then(stop);
   await supervisor.firstBoot;
+  store.commit(active);
+  activityReadout?.notice("done", "Server", `${active.version} \xB7 launcher ${PACKAGE_VERSION}`);
   if (reexec) {
     activityReadout?.notice(
       "done",
       "Updated",
-      `Frizz ${PACKAGE_VERSION} is serving on port ${port} \xB7 ctrl-c to stop${globalInstall ? ` \xB7 ${keepUpdateHint(PACKAGE_NAME, PACKAGE_VERSION)}` : ""}`
+      `Frizz ${active.version} is serving on port ${port} \xB7 ctrl-c to stop${globalInstall ? ` \xB7 ${keepUpdateHint(PACKAGE_NAME, PACKAGE_VERSION)}` : ""}`
     );
   }
   return await new Promise(() => {
   });
 }
 try {
+  const globalClaim = acquireStableServerOwner();
+  if (globalClaim.kind === "busy") throw new Error("Frizz is starting or recovering on this machine; retry shortly");
+  if (globalClaim.kind === "running") {
+    if (options.port && options.port !== globalClaim.port)
+      throw new Error(`Frizz is already running on port ${globalClaim.port}; --port cannot change a running server`);
+    await openOrPrint(globalClaim.port, true, slugPath());
+    process.exit(0);
+  }
+  serverOwner = globalClaim.lease;
   if (process.env.FRIZZ_PRODUCTION_SUPERVISOR === "1" || reexec) {
     if (!options.port) throw new Error("internal registry supervisor launch is missing --port");
     const token = projectLaunchOwnerTokenFromEnvironment(process.env);
@@ -26844,9 +27241,14 @@ try {
     const allocation = await allocatePort(options.port, readPreferredPort(workspace.stateDir), { host: LOOPBACK_BIND_HOST });
     const port = allocation.port;
     portReservation = allocation.release;
-    const running = runSupervisor(port, claim.lease.token);
+    let didPrepare;
+    const prepared = new Promise((resolve7) => {
+      didPrepare = resolve7;
+    });
+    const running = runSupervisor(port, claim.lease.token, didPrepare);
     release();
     release = void 0;
+    await Promise.race([prepared, running]);
     await Promise.race([
       waitForWorkspace(
         port,