livedesk 0.1.462 → 0.1.464

package/README.md

@@ -72,29 +72,49 @@ reboot; the generated startup command uses the unified launcher.
 ## macOS physical diagnostic
 
 On a Mac with two connected displays, stop every running LiveDesk runtime,
-show visibly different content on the two displays, grant Screen Recording and
-Accessibility permissions, then run:
+start visibly different continuously moving content on both displays, grant
+Screen Recording and Accessibility permissions, then explicitly confirm that
+the motion is already running:
 
 ```bash
-npx -y --prefer-online livedesk@latest diagnose mac-physical
+npx -y --prefer-online livedesk@latest diagnose mac-physical --confirm-active-motion
 ```
 
 This command branches before role resolution, state migration, and the normal
 runtime lock. It refuses to overlap an existing LiveDesk runtime or capture
 helper, and normal macOS startup reciprocally refuses an active diagnostic
-lease. It starts only an isolated loopback Hub and temporary RemoteFast Client
-and stops only the exact children it created. Ctrl+C and termination signals
-join the same owned cleanup before exit. The default JSON report is written to
+lease. The lease owner authorizes exactly one direct-child production unified
+Hub launcher and one direct-child production unified Client launcher using the
+lease PID, parent PID, and token, then each launcher consumes and removes that
+capability before starting descendants. The Client therefore runs
+the normal Client bootstrap and starts its normal RemoteFast child instead of
+testing RemoteFast in isolation. All state and network discovery remain
+isolated. Cleanup joins those exact launcher roots after their Hub, RemoteFast,
+and ScreenCaptureKit descendants drain. Ctrl+C and termination signals join the
+same owned cleanup before exit. The default JSON report is written to
 one final path after cleanup, and run/cleanup errors always produce a failed
 result. It is written under `~/.livedesk/diagnostics`. To select a path relative
 to the directory where the command was invoked:
 
 ```bash
-npx -y --prefer-online livedesk@latest diagnose mac-physical --report ./mac-result.json
+npx -y --prefer-online livedesk@latest diagnose mac-physical --confirm-active-motion --report ./mac-result.json
 ```
 
 Use `diagnose mac-physical --help` to inspect requirements without starting a
-runtime or changing cached role/account state.
+runtime or changing cached role/account state. The confirmation flag is not
+treated as proof by itself: each display must also show two different decoded
+pixel hashes while native capture/compression/stdout counters advance at the
+active cadence. Diagnostic ffmpeg observers run sequentially after product
+CPU/RSS/process sampling, are labeled as diagnostic observers, and are excluded
+from those product budgets. Product resource evidence covers both unified
+launcher roots plus the Hub, RemoteFast, and ScreenCaptureKit descendants.
+VideoToolbox ownership comes from native active and terminal telemetry. The
+terminal v4 record must match the exact final restored-Wall helper observation,
+PID, profile, start time, capture generation, purpose, and stream, and must be
+newer than that stream's stop request. Its PID must equal the single OS helper
+sampled at that exact restored-Wall ready point; an earlier aggregate PID sighting
+is insufficient. A stale/ownerless/internal-only terminal record or a retired
+helper process alone is not accepted as encoder-session cleanup proof.
 
 ## Physical transport diagnostic
 

package/bin/livedesk.js

@@ -150,9 +150,33 @@ function isPidAlive(pid) {
 
 async function assertNoActiveMacPhysicalDiagnosticLease() {
   if (os.platform() !== 'darwin') return;
-  const lease = await inspectMacDiagnosticLease();
+  const lease = await inspectMacDiagnosticLease({ includeOwnerToken: true });
   if (lease.status === 'missing' || lease.status === 'stale') return;
   if (lease.status === 'active') {
+    const diagnosticOwnerPid = Number(
+      process.env.LIVEDESK_MAC_PHYSICAL_DIAGNOSTIC_OWNER_PID || 0
+    );
+    const diagnosticOwnerToken = String(
+      process.env.LIVEDESK_MAC_PHYSICAL_DIAGNOSTIC_OWNER_TOKEN || ''
+    ).trim();
+    const isExactDiagnosticChild = process.env.LIVEDESK_MAC_PHYSICAL_DIAGNOSTIC_CHILD === '1'
+      && Number.isInteger(diagnosticOwnerPid)
+      && diagnosticOwnerPid > 1
+      && diagnosticOwnerPid === Number(lease.pid)
+      && Number(process.ppid) === diagnosticOwnerPid
+      && diagnosticOwnerToken.length >= 16
+      && diagnosticOwnerToken === String(lease.ownerToken || '');
+    if (isExactDiagnosticChild) {
+      // The public diagnostic must exercise this same production launcher.
+      // Only the coordinator that owns the active lease can authorize its
+      // isolated Hub/Client roots; no neighboring normal startup is admitted.
+      // Do not propagate the lease capability into Hub, Client, RemoteFast,
+      // capture-helper, or utility descendants after this exact admission.
+      delete process.env.LIVEDESK_MAC_PHYSICAL_DIAGNOSTIC_CHILD;
+      delete process.env.LIVEDESK_MAC_PHYSICAL_DIAGNOSTIC_OWNER_PID;
+      delete process.env.LIVEDESK_MAC_PHYSICAL_DIAGNOSTIC_OWNER_TOKEN;
+      return;
+    }
     throw new Error(
       `Mac physical diagnostic is running (pid ${lease.pid}); normal LiveDesk startup was not started. `
       + 'Wait for its owned cleanup to finish or stop the diagnostic with Ctrl+C.'
@@ -337,7 +361,7 @@ Usage:
   npx -y --prefer-online livedesk@latest
   npx -y --prefer-online livedesk@latest --force-role hub
   npx -y --prefer-online livedesk@latest --force-role client
-  npx -y --prefer-online livedesk@latest diagnose mac-physical
+  npx -y --prefer-online livedesk@latest diagnose mac-physical --confirm-active-motion
   npx -y --prefer-online livedesk@latest diagnose transport-physical
 
 Commands:
@@ -377,26 +401,29 @@ function printMacPhysicalDiagnosticHelp() {
 LiveDesk macOS physical diagnostic
 
 Usage:
-  npx -y --prefer-online livedesk@latest diagnose mac-physical
-  npx -y --prefer-online livedesk@latest diagnose mac-physical --report ./mac-result.json
+  npx -y --prefer-online livedesk@latest diagnose mac-physical --confirm-active-motion
+  npx -y --prefer-online livedesk@latest diagnose mac-physical --confirm-active-motion --report ./mac-result.json
 
 Requirements:
-  macOS with two connected displays showing visibly different content.
+  macOS with two connected displays showing visibly different, continuously moving content.
   Screen Recording permission for the terminal/LiveDesk capture helper.
   Accessibility permission for the terminal/LiveDesk input helper.
   Stop every existing LiveDesk Hub, Client, and desktop runtime first.
+  --confirm-active-motion attests that motion is already running on both displays;
+  measured decoded-pixel change and native cadence must still prove it.
 
 Behavior:
-  Starts one isolated loopback Hub and one temporary RemoteFast Client.
+  Starts one production unified Hub root and one production unified Client root
+  with isolated loopback state; the Client starts its normal RemoteFast child.
   Refuses to overlap a running LiveDesk runtime or capture helper.
-  Stops only the exact child processes created by this diagnostic.
+  Stops only those exact launcher roots after their descendants drain.
   Writes the default report under ~/.livedesk/diagnostics.
 
 Options:
   --report <path>  Write the JSON report relative to the invocation directory.
   --monitor <n>    Initial zero-based display index. Default: 0.
-  --width <px>     Requested capture width. Default: 1920.
-  --height <px>    Requested capture height. Default: 1080.
+  --width <px>     Requested capture width. Release gate: exactly 960.
+  --height <px>    Requested capture height. Release gate: exactly 540.
   --help           Show this help without resolving a role or acquiring a runtime lock.
 `.trimStart());
 }