English
Goal
Replace the incorrect Linux = systemd model with one managed Runtime Host deployment contract for native hosts, SSH on-demand hosts, WSL environments, and supervised providers. One State Root must never have two eligible lifecycle owners.
Invariants
- Users choose lifecycle semantics; a provider only implements a proven capability.
- Supervised never silently falls back to on-demand.
- Provider, availability, and reconciliation trigger are persisted and change only through explicit migration.
runtime-host-deployment.json is the only lifecycle authority. Its active/transition/blocked records contain all recovery facts; there is no second journal.- Provider artifacts are deterministic projections of that authority, never recovery state.
- The one-shot reconciler is the only package-update authority; schedulers and activation only trigger it.
- Supervisors launch the persisted exact Node and package CLI. Runtime Host never updates itself.
- Desktop, CLI, TUI, and
maka run share activation and connection contracts.
- WSL is a credential-free local environment, not an SSH remote.
- Uninstall preserves State Root data.
Architecture
- Canonical deployment record: deployment/root identity, exact package, listeners, lifecycle, provider, availability, and reconciliation trigger.
- State Root lifecycle fence checked by every managed launch path before election.
- Separate supervisor and reconciliation-trigger drivers coordinated by one transaction primitive.
- Stable operator surface for inspect/status/activate/connect/retire/configure/logs/update/uninstall/repair.
- Profile schema supporting local, WSL environment, SSH connect-only, and SSH operator activation.
- Generic Desktop deployment bindings that store identity and control route without copying Host lifecycle truth.
Lifecycle transitions retire the current Host, acquire the State Root fence, publish a self-contained transition record, remove the old eligible projection, converge the desired projection, and commit the active record. Any ordinary failure deterministically restores from. A commit-unknown result preserves the record, projection, and exact package for the next read; it never guesses or destructively rolls back.
Delivery
WSL supervised mode is intentionally excluded from the first release: systemd cannot keep a WSL instance alive. The initial product guarantee is on-demand; a future environment-scoped supervised option may only promise availability while that distribution is running.
From this WSL checkout, Windows-view integration can run Windows node.exe, spawn the real C:\Windows\System32\wsl.exe with shell: false, pass hostile argv as argv, and validate raw framed stdio. Destructive wsl --terminate, systemd-off, and Alpine cases require disposable distributions so the active development distribution is never terminated.
Test principle
Keep only a few tests that prove merge-changing invariants: single-owner election, exact launch binding, deterministic recovery across provider mutation boundaries, commit-unknown preservation, active-work refusal, true-idle exit, strict bounded framing, and State Root preservation. Do not create tests for getters, field forwarding, journal phases, or behavior already proven at a lower authority boundary.
中文
目标
用统一的 managed Runtime Host deployment contract 替换错误的 Linux = systemd 模型，覆盖 native Host、SSH on-demand、WSL environment 与 supervised provider。一个 State Root 绝不能同时存在两个具备启动资格的 lifecycle owner。
不变量
- 用户选择生命周期语义；provider 只负责兑现已证明的能力。
- supervised 绝不静默降级为 on-demand。
- provider、availability 与 reconciliation trigger 必须持久化，且只能显式迁移。
runtime-host-deployment.json 是唯一 lifecycle authority；active/transition/blocked record 已包含全部恢复事实，不再引入第二份 journal。- provider artifact 只是 authority 的确定性投影，不保存恢复状态。
- one-shot reconciler 是唯一 package update authority；scheduler 与 activation 只是触发器。
- supervisor 直接启动持久化的 exact Node 与 package CLI；Runtime Host 不自更新。
- Desktop、CLI、TUI 与
maka run 共用 activation/connection contract。
- WSL 是不保存凭据的本地环境，不是 SSH remote。
- uninstall 保留 State Root 数据。
架构
- canonical deployment record 保存 deployment/root identity、exact package、listener、lifecycle、provider、availability 与 reconciliation trigger。
- 所有 managed launch path 在 election 前检查同一个 State Root lifecycle fence。
- supervisor 与 reconciliation-trigger driver 分离，由一个 transaction primitive 组合。
- 稳定 operator surface：inspect/status/activate/connect/retire/configure/logs/update/uninstall/repair。
- profile schema 覆盖 local、WSL environment、SSH connect-only 与 SSH operator activation。
- Desktop 只保存 deployment identity 与 control route，不复制 Host lifecycle truth。
lifecycle transition 先退休当前 Host、取得 State Root fence、发布自包含 transition record、撤销旧 eligible projection、收敛目标 projection，再提交 active record。普通失败始终确定性恢复 from。commit unknown 时保留 record、projection 与 exact package，交给下一次读取裁决，绝不猜测或破坏性回滚。
交付
首版有意不提供 WSL supervised：systemd 无法让 WSL 实例持续存活。初始产品保证是 on-demand；未来 environment-scoped supervised 也只能承诺“发行版运行期间可用”。
当前 WSL checkout 可以从 Windows 视角运行 Windows node.exe，以 shell: false 启动真实 C:\Windows\System32\wsl.exe，验证恶意 argv 与原始 framed stdio。wsl --terminate、systemd-off 与 Alpine 等破坏性场景必须使用一次性发行版，绝不终止当前开发环境。
测试原则
只保留少量能改变合并判断的不变量测试：唯一 owner election、exact launch binding、provider mutation boundary 的确定性恢复、commit-unknown 保留、active-work refusal、true-idle exit、严格有界 framing 与 State Root 保留。不为 getter、字段透传、journal phase 或下层 authority 已证明的行为重复写测试。
English
Goal
Replace the incorrect
Linux = systemdmodel with one managed Runtime Host deployment contract for native hosts, SSH on-demand hosts, WSL environments, and supervised providers. One State Root must never have two eligible lifecycle owners.Invariants
runtime-host-deployment.jsonis the only lifecycle authority. Its active/transition/blocked records contain all recovery facts; there is no second journal.maka runshare activation and connection contracts.Architecture
Lifecycle transitions retire the current Host, acquire the State Root fence, publish a self-contained transition record, remove the old eligible projection, converge the desired projection, and commit the active record. Any ordinary failure deterministically restores
from. A commit-unknown result preserves the record, projection, and exact package for the next read; it never guesses or destructively rolls back.Delivery
WSL supervised mode is intentionally excluded from the first release: systemd cannot keep a WSL instance alive. The initial product guarantee is on-demand; a future environment-scoped supervised option may only promise availability while that distribution is running.
From this WSL checkout, Windows-view integration can run Windows
node.exe, spawn the realC:\Windows\System32\wsl.exewithshell: false, pass hostile argv as argv, and validate raw framed stdio. Destructivewsl --terminate, systemd-off, and Alpine cases require disposable distributions so the active development distribution is never terminated.Test principle
Keep only a few tests that prove merge-changing invariants: single-owner election, exact launch binding, deterministic recovery across provider mutation boundaries, commit-unknown preservation, active-work refusal, true-idle exit, strict bounded framing, and State Root preservation. Do not create tests for getters, field forwarding, journal phases, or behavior already proven at a lower authority boundary.
中文
目标
用统一的 managed Runtime Host deployment contract 替换错误的
Linux = systemd模型，覆盖 native Host、SSH on-demand、WSL environment 与 supervised provider。一个 State Root 绝不能同时存在两个具备启动资格的 lifecycle owner。不变量
runtime-host-deployment.json是唯一 lifecycle authority；active/transition/blocked record 已包含全部恢复事实，不再引入第二份 journal。maka run共用 activation/connection contract。架构
lifecycle transition 先退休当前 Host、取得 State Root fence、发布自包含 transition record、撤销旧 eligible projection、收敛目标 projection，再提交 active record。普通失败始终确定性恢复
from。commit unknown 时保留 record、projection 与 exact package，交给下一次读取裁决，绝不猜测或破坏性回滚。交付
首版有意不提供 WSL supervised：systemd 无法让 WSL 实例持续存活。初始产品保证是 on-demand；未来 environment-scoped supervised 也只能承诺“发行版运行期间可用”。
当前 WSL checkout 可以从 Windows 视角运行 Windows
node.exe，以shell: false启动真实C:\Windows\System32\wsl.exe，验证恶意 argv 与原始 framed stdio。wsl --terminate、systemd-off 与 Alpine 等破坏性场景必须使用一次性发行版，绝不终止当前开发环境。测试原则
只保留少量能改变合并判断的不变量测试：唯一 owner election、exact launch binding、provider mutation boundary 的确定性恢复、commit-unknown 保留、active-work refusal、true-idle exit、严格有界 framing 与 State Root 保留。不为 getter、字段透传、journal phase 或下层 authority 已证明的行为重复写测试。