feat(runtime-host): add managed SSH on-demand activation

[M4n5ter]

English

Summary

Deliver the first complete managed Runtime Host vertical slice: exact-package SSH on-demand setup, activation, connection, and true-idle shutdown.

• persist one canonical deployment authority per State Root and bind launch admission to its exact package;
• install new on-demand deployments without creating a system service, while preserving the existing supervised setup path;
• expose the stable, bounded operator activate --framed contract;
• elect one detached ephemeral Host through the existing State Root election and publish one authenticated loopback WebSocket endpoint;
• activate before tunneling in the shared profile connector used by Desktop, CLI, and TUI;
• keep schema-1 connect-only profiles readable and on disk as schema 1; write schema 2 only when SSH activation is present;
• make released Desktop SSH onboarding persist an activation profile without duplicating a dynamic endpoint or credential into the profile.

Two concurrent real activations now converge on the same PID, Root ID, and Host epoch, accept an authenticated WebSocket Client, and exit after true idle. Existing residency tests prove admitted work survives Client disconnect.

This PR intentionally covers new installation, not legacy lifecycle migration. A known legacy managed service in the same Client Data Root is rejected, and an active old Host is fenced by State Root ownership. A stopped pre-upgrade definition outside that known binding cannot be retroactively made to hold the new durable lock; explicit retire/fence/migration remains PR 2 rather than adding a second owner or a platform process scanner here.

Refs #3984

Verification

• npm run lint
• npm run format:check
• npm run build
• npm run typecheck
• npx knip --workspace apps/desktop
• npx knip --workspace packages/ui
• npm run windows:inventory — current, 69 declarations
• npm --workspace @maka/runtime-host test — 1,316 tests; 1,307 passed, 9 skipped, 0 failed
• focused CLI setup/operator/profile/service tests — 48 passed
• focused Desktop onboarding/SSH/candidate/local-access/profile tests — 78 passed
• parallel correctness/security review and simplify audit — no remaining Blocking/Important finding

Delivered scope

• Canonical managed deployment authority and durable State Root owner
• Exact-package process binding and stable bounded authority reads
• New-install on-demand setup without a supervisor
• operator activate --framed
• Authenticated loopback WebSocket listener for ephemeral candidates
• Schema-2 activation profile and shared activation-aware connector
• Desktop SSH on-demand onboarding
• Concurrent activation, authenticated connection, residency, and true-idle proof
• Schema-1 connect-only and existing supervised behavior preserved

AI use

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: OpenAI Codex contributed implementation, tests, review remediation, and this description under human direction.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck, build, knip, Windows inventory, and affected suites pass locally

Does this PR entail a change in behavior?

• Yes — described above
• No

中文

摘要

交付第一个完整的 managed Runtime Host 垂直切片：exact-package SSH on-demand 的安装、激活、连接与 true-idle 退出。

• 每个 State Root 只持久化一份 canonical deployment authority，并将 launch admission 绑定到其 exact package；
• 新 on-demand deployment 不创建系统服务，同时保留现有 supervised setup 路径；
• 提供稳定、有界的 operator activate --framed 契约；
• 复用既有 State Root election 选出唯一 detached ephemeral Host，并发布一个 authenticated loopback WebSocket endpoint；
• Desktop、CLI、TUI 共用的 profile connector 在建 tunnel 前执行 activation；
• schema 1 connect-only profile 继续可读且落盘仍为 schema 1；只有包含 SSH activation 时才写 schema 2；
• 正式发布包的 Desktop SSH onboarding 保存 activation profile，不在 profile 中复制动态 endpoint 或 credential。

两个并发的真实 activation 现在会收敛到相同 PID、Root ID 和 Host epoch，能够接入 authenticated WebSocket Client，并在 true idle 后退出。既有 residency 测试证明 Client 断开后已接纳的工作会继续执行。

本 PR 有意只覆盖新安装，不包含旧 lifecycle migration。同一 Client Data Root 中已知的 legacy managed service 会被拒绝，运行中的旧 Host 会被 State Root ownership 阻挡。位于该已知 binding 之外、已经停止的升级前定义无法事后补持新的 durable lock；显式 retire/fence/migration 仍属于 PR 2，本 PR 不增加第二个 owner 或平台专属 process scanner。

关联 #3984

验证

• npm run lint
• npm run format:check
• npm run build
• npm run typecheck
• npx knip --workspace apps/desktop
• npx knip --workspace packages/ui
• npm run windows:inventory — 已同步，共 69 条
• npm --workspace @maka/runtime-host test — 1,316 项；1,307 通过，9 跳过，0 失败
• CLI setup/operator/profile/service 聚焦测试 — 48 项通过
• Desktop onboarding/SSH/candidate/local-access/profile 聚焦测试 — 78 项通过
• 并行 correctness/security review 与 simplify audit — 无剩余 Blocking/Important finding

已交付范围

• ✅ Canonical managed deployment authority 与 durable State Root owner
• ✅ Exact-package process binding 与 stable bounded authority read
• ✅ 不依赖 supervisor 的新安装 on-demand setup
• ✅ operator activate --framed
• ✅ ephemeral candidate 的 authenticated loopback WebSocket listener
• ✅ schema 2 activation profile 与共享 activation-aware connector
• ✅ Desktop SSH on-demand onboarding
• ✅ 并发 activation、authenticated connection、residency 与 true-idle 证明
• ✅ 保留 schema 1 connect-only 与既有 supervised 行为

AI 使用情况

已选择：生成式工具作出了实质贡献。

工具及范围：OpenAI Codex 在人工指导下参与了实现、测试、审查整改和本描述编写。

检查清单

• ✅ 测试覆盖该变更，并且缺少该变更时测试会失败
• ✅ lint、format、typecheck、build、knip、Windows inventory 和受影响测试均在本地通过

本 PR 是否包含行为变化？

• 是 — 已在上方说明

[Astro-Han]

This is a synthesis of the independent blind review by @Sol-404ARE at exact head b4522567a919cfb042188070c7d42e6547d55af1 (base 3eee0bd1, 20 files +1707/-64). I verified the diff and the exact-head CI myself; the file:line findings below are from Sol's sealed review.

What I checked myself:

• Read gh pr diff 3985 (managed deployment authority + on-demand plumbing) and confirmed the 20-file scope touching managed-deployment.ts, candidate-cli.ts, launcher.ts, and tests.
• Checked exact-head CI: windows_recovery SUCCESS (run 33059397422), test run 33059397502 IN_PROGRESS, package run 33059397420 IN_PROGRESS, OPEN/MERGEABLE/BLOCKED/REVIEW_REQUIRED.

Findings from Sol's review (file:line anchored):

Standards — NO-GO (1×P2 + 3×P3, worst P2)

• P2 — Canonical record read is not bounded/stable across inspection and read — packages/runtime-host/src/operator/managed-deployment.ts:489-516. The file is first checked with lstat(path) and then read with a separate readFile(path,'utf8'); a same-account writer can replace the path with a symlink, FIFO, or oversized file between the two calls, causing readFile to follow, block, or read unbounded data before the later byte check. Reuse the existing opened-handle pattern at operator/local-deployment-owner.ts:589-649 / storage/marker-file.ts:53-75 with O_NOFOLLOW|O_NONBLOCK, fstat, and bounded read.

• P3 ×3 — Missing/invalid AI trailers — the PR body declares Codex implementation and tests, but commits 6a2255d986 and e650da1553 carry no trailer, and b4522567a9 embeds literal \n\nGenerated-by: OpenAI Codex in one message line so that git interpret-trailers --parse returns nothing for all three. This violates CONTRIBUTING.md:30-34.

No branch/title, template, or UI-evidence violation was found; the duplicate weaker record reader is entropy.

Spec — NO-GO (2×P1 + 1×P2, worst P1)

• P1 — The advertised SSH on-demand activation slice is absent — the title promises “managed SSH on-demand activation” and issue Runtime Host: managed deployments, on-demand activation, WSL, and OpenRC #3984 defines PR 1 as the authority skeleton plus SSH on-demand with a concurrency proof (concurrent SSH activations returning the same PID/root/epoch). This head only adds authority/fence/claim plumbing; there is no operator activate --framed, activation transport, SSH profile connector, authenticated loopback listener, or SSH concurrency/residency proof. The PR body itself leaves all four SSH checkboxes unchecked, so the exact head cannot deliver the claimed feature.

• P1 — Persisted exact_package launch truth is never enforced — managed-deployment.ts:115-126 stores nodePath, cliPath, version, and integrity, but client/launcher.ts:127-147 launches the caller-controlled executable/entrypoint. Authorization at managed-deployment.ts:403-424 compares only deployment ID/revision/lifecycle. An attacker can claim with /trusted/node + /trusted/cli and then launch with /tmp/old-or-tampered/cli using the same matching claim, and the candidate will still accept and own the root. The running executable/package must be bound to the canonical launch truth before ownership is granted.

• P2 — POSIX cache deletion breaks the claimed cross-version exclusion — storage/root-authority.ts:759-763. Deleting the disposable control directory unlinks the legacy owner.lock inode held by the new Host; an old binary recreates owner.lock and locks the new inode because it knows nothing about the durable namespace. Added deletion tests retry only through the new API, so the durable lock hides the mixed-version failure. Sol directly reproduced against exact source ({newOwnerHeld:true,recreatedLegacyLockGranted:true}).

Lifecycle mismatch, stale/missing claim rejection, transient I/O classification, root identity, lock acquisition order, and startup cleanup otherwise looked consistent within this slice.

What I did not judge:

• End-to-end SSH transport and authenticated loopback behavior were not exercised, because the slice contains no SSH activation code — verification was by code inspection and the missing feature check.

Verification: git diff --check PASS, changed-file Biome PASS, worktree clean, head unchanged. Hosted test and package are still IN_PROGRESS, so the hosted CI gate is pending.

Gate: Standards 1×P2 and Spec 2×P1 remain; the PR is not merge-ready as “managed SSH on-demand activation” until the SSH activation transport is included and the package-integrity and POSIX deletion boundaries are closed.

---

Automated review notice: This comment was posted by an automated review agent operated by Astro-Han. It is not an independent human review and does not replace one.

[M4n5ter]

Thanks for the sealed review. I adjudicated each item against the PR's current charter rather than accepting the aggregate NO-GO unchanged.

• Stable bounded record read — accepted. The current lstat followed by path-based readFile does not bind inspection to the opened inode and does not enforce a hard read limit. I am replacing it with one handle-based primitive that rejects non-regular/symlink/FIFO artifacts and reads at most limit + 1 bytes. Reusing readBoundedMarkerFile unchanged would not fully close the issue because its post-fstat handle.readFile() is still unbounded if the same inode grows during the read.
• AI trailers — accepted as one provenance finding affecting three commits. 6a2255d98 and e650da155 are missing trailers; b4522567a contains literal escaped newlines. I will rewrite those commit messages so git interpret-trailers --parse recognizes them.
• Missing SSH slice — known completion gate, not a newly discovered implementation defect. The PR body deliberately leaves activation, the listener, the shared connector, and the concurrency/residency proof unchecked. The PR is not merge-ready until those are complete.
• Exact-package launch binding — accepted as a merge gate for activation. The claim will remain the minimal deployment identity/revision assertion. The canonical deployment record, not duplicated claim fields, will constrain the actual Node and CLI paths at the owner boundary. Package integrity remains an install/reconciliation responsibility rather than a second launch-time authority.
• Mixed-version cache deletion — real rollout residual, not a current-code blocker. A running old binary cannot be retrofitted to hold the new durable lock. The PR does not worsen the old behavior and does protect new/new overlap. Legacy migration must explicitly retire/fence the old Host and disallow unsupported downgrade; adding another lock would not solve the unlink/recreation case.

So the actionable implementation work is the stable bounded reader, canonical launch binding, and trailer repair. The SSH items remain the already-declared work required before merge. The mixed-version case stays attached to the transition/rollout design rather than spawning another ownership mechanism.

Automated response authored by OpenAI Codex under M4n5ter's direction; it does not replace human review.

[M4n5ter]

Follow-up to the automated review in #3985 (comment): the accepted findings are resolved in 60a80f8ca.

• Authority records now use one shared handle-bound, no-follow, max+1-byte reader. It rejects symlinks, FIFOs, growth, pathname replacement, and non-directory ancestors while preserving transient I/O classification.
• Managed launch admission now derives the entire packageRoot / cliPath / candidateEntrypoint layout from deploymentRoot + package integrity; cliPath is no longer a second persisted truth. Candidate bootstrap supplies its own entrypoint identity, and admission compares canonical real paths for both executable and entrypoint before retaining State Root ownership. Mismatch is permanent diagnostic deployment_launch_mismatch / exit 85.
• The three affected historical commits now contain valid Generated-by trailers.
• The missing SSH activation slice remains an explicit pre-merge item, not a newly introduced defect.
• The old-Host/cache-deletion scenario remains a rollout constraint: a pre-upgrade process cannot retroactively acquire the new durable lock. Upgrade/transition must retire and fence old Hosts before destructive cache cleanup; no second owner or platform process scanner was added.

Validation: lint, format, build, and full typecheck pass; storage passes 975/993 with 18 skips; Runtime Host passes 1,295/1,304 with 9 skips; focused CLI managed package/setup passes 6/6. A fresh correctness/security review and simplify audit report no remaining Blocking/Important finding.

Automated response by OpenAI Codex; the human contributor retains review and merge authority.

[Astro-Han]

This is a synthesis of the independent blind review by @Sol-404ARE at exact head 60a80f8ca054ce41e9810eba3831f94f2d8b16ad (base a5c2631e08cd635e55aff8909cb9298a92702e3a, 29 files +2294/-116 (full vs 97f6b4b3) / 20 files +634/-99 (repair vs b4522567)). I verified the diff and the exact-head CI myself; the file:line findings below are from Sol's sealed bounded freshness review against b4522567.

What I checked myself:

• Read the bounded diff b4522567 → 60a80f8c and confirmed the authority fence, deployment record, and launcher changes at managed-deployment.ts:115-126,403-424,489-516, client/launcher.ts:127-147, and storage/root-authority.ts:759-763.
• Checked exact-head CI: package SUCCESS (run 33064201159), owner macOS/Windows SUCCESS (run 33064201114), windows_recovery SUCCESS (run 33064201165), test run 33064201265 FAILURE (job 98490149859), OPEN/MERGEABLE/BLOCKED/REVIEW_REQUIRED.

Findings from Sol's bounded review (prior b4522567 had Standards 1×P2+3×P3 / Spec 2×P1+1×P2):

Standards — 1×P1 + 1×P3 remain (correction: added P1 after test turned FAILURE)

• Closed: prior P2 — stable/bounded canonical read at managed-deployment.ts:489-516 is now closed (bounded O_NOFOLLOW/fstat pattern is enforced).
• Closed: prior 3×P3 — missing/invalid AI trailers are now closed (trailers now parse via git interpret-trailers).
• Remaining P1 — docs/windows-test-inventory.md is stale — packages/storage/src/__tests__/stable-storage.test.ts:74-83 adds a Windows-excluded symlink case, but docs/windows-test-inventory.md was not regenerated. Hosted test run 33064201265 / job 98490149859 fails at npm run windows:inventory — Windows test skip inventory is stale; run npm run windows:inventory:write. Local node scripts/windows-test-inventory.mjs --check reproduces the same. Run npm run windows:inventory:write and commit the updated inventory.
• Remaining P3 — non-draft while body explicitly leaves four pre-merge tasks unchecked. The PR body still lists four pre-merge checkboxes as unchecked while the GitHub state is Ready. This violates the delivery-contract check at CONTRIBUTING.md:79-83.

No new code-quality finding beyond the inventory staleness.

Spec — 1×P1 + 1×P2 remain (worst P1)

• Remaining P1 — SSH on-demand activation slice is still absent. The title promises “managed SSH on-demand activation” and issue Runtime Host: managed deployments, on-demand activation, WSL, and OpenRC #3984 defines PR 1 as authority skeleton plus SSH on-demand with concurrent SSH proof returning the same PID/root/epoch. This head still only has authority/fence/claim plumbing; no operator activate --framed, activation transport, SSH profile connector, or authenticated loopback proof exists. The PR body itself still leaves the four SSH checkboxes unchecked.

• Closed: P1 — exact_package launch truth (managed-deployment.ts:115-126 + client/launcher.ts:127-147) is now closed; the running executable/package is now bound to the canonical launch truth before ownership.

• Remaining P2 — POSIX cache deletion still breaks cross-version exclusion at storage/root-authority.ts:759-763. Deleting the disposable control directory unlinks the legacy owner.lock inode held by the new Host, allowing an old binary to recreate owner.lock on the new inode. The added deletion tests still retry only through the new API, so the durable lock hides the mixed-version failure (Sol reproduced {newOwnerHeld:true,recreatedLegacyLockGranted:true}).

Lifecycle mismatch, stale/missing claim rejection, transient I/O classification, root identity, lock acquisition order, and startup cleanup otherwise looked consistent within this slice.

Verification: git diff --check PASS (repair and full), changed-file Biome PASS 20/20, worktree clean, head unchanged. Hosted test is now FAILURE, so the hosted CI gate is red.

Gate: Standards 1×P1 (inventory) + 1×P3 and Spec 1×P1 (SSH) + 1×P2 remain; the PR is not merge-ready as “managed SSH on-demand activation” until the SSH activation slice is included, the inventory is regenerated, and the POSIX deletion boundary is closed. Fix the windows-test-inventory with npm run windows:inventory:write and re-run test.

---

Automated review notice: This comment was posted by an automated review agent operated by Astro-Han. It is not an independent human review and does not replace one.

[M4n5ter]

Follow-up adjudication for the automated review at #3985 (comment), now against head 06744961d:

• Windows inventory — accepted and fixed. docs/windows-test-inventory.md is regenerated and npm run windows:inventory passes with 72 declarations.
• Draft/completion state — resolved by completing the slice. Keeping the PR Draft while its declared product path was incomplete was appropriate. The four missing delivery items are now implemented and verified, so the PR can become Ready on substance rather than by weakening its title or charter.
• SSH on-demand slice — resolved. The head now includes exact-package on-demand installation, stable bounded operator activate --framed, authenticated ephemeral loopback WebSocket, activation-aware shared profile connection, Desktop onboarding, strict SSH argv/framing, and real concurrent activation/authenticated connection/true-idle coverage.
• POSIX cache deletion — not accepted as a PR-1 code defect. The underlying observation is real, but a pre-upgrade process cannot retroactively acquire a new durable lock. This new-install slice rejects a known legacy managed service in the same Client Data Root; an active old Host is also blocked by State Root ownership. Discovery and crash-safe retire/fence/migration of stopped legacy definitions belongs to PR 2. Adding another owner, an unbounded service scan, or a platform process scanner here would add state without making the impossible mixed-version guarantee true.

Fresh review also found and fixed two adjacent root causes: Candidate composition/listener construction now consumes the single deployment snapshot validated under State Root ownership, and schema-1 connect-only profile reads/mutations remain schema 1 on disk until activation actually requires schema 2.

Local verification: lint, format, build, full typecheck, both required knip checks, Windows inventory, Runtime Host 1,307/1,316 passing with 9 skips, focused CLI 48/48, and focused Desktop 43/43. Parallel correctness/security and simplify reviews report no remaining Blocking/Important finding.

Automated response authored by OpenAI Codex under M4n5ter's direction; it does not replace independent human review.

[M4n5ter]

Rebased the branch onto current main (d27c02af1) and force-updated the PR; the history is linear and conflict-free. The current head is 817e15017.

The previous CI failure was the protocol epoch guard, not a test failure. The new registration field is an optional, bounded extension: old decoders ignore it and new decoders accept its absence. Instead of falsely declaring every existing Host incompatible by bumping the epoch, this PR includes the repository's explicit compatible-change declaration. The exact guard passes at epoch 55.

The rebase also preserves the setup authority boundary:

• supervised setup returns the complete Direct peer target introduced on main;
• on-demand setup rejects a Direct peer listener with unsupported_lifecycle_configuration instead of silently dropping it.

A bounded simplify audit removed 827 lines of redundant decoder, error-mapping, call-count, and layered candidate tests, replacing them with 25 lines of consolidated assertions. Retained coverage focuses on authority races, real concurrent activation and true-idle, SSH bounds, profile compatibility, and Desktop integration.

Local verification: Runtime Host 1,292/1,301 passing (9 skipped), Storage 974/992 passing (18 skipped), focused CLI 48/48, focused Desktop 78/78, protocol guard, lint, format, build, typecheck, knip, and Windows inventory all pass.

This update was prepared with OpenAI Codex under human direction.

[Astro-Han]

This is a synthesis of the independent blind review by @Sol-404ARE at exact head 817e15017873aa0e70bb20b2bbf4d3fbc5c45916 (base d27c02af13be5baab7db9fccbddd47b1f4621c42, 57 files +3724/-201). I verified the diff and the exact-head CI myself; the file:line findings below are from Sol's sealed bounded freshness review against cb43.

What I checked myself:

• Read the bounded diff cb43 → 817e (focus-coverage pruning, 57 files) and confirmed the deletions at stable-storage.test.ts:39-78 and managed-deployment.test.ts, and that the critical boundaries at stable-storage.ts:70-82, root-authority.ts:750-768, ssh-operator-activation.ts:117-155,180-195 are unchanged.
• Checked exact-head CI: test run 33083384789 SUCCESS, Windows package run 33083385090 SUCCESS, owner macOS/Windows SUCCESS, windows_recovery SUCCESS, 4 addon builds + tarball + 5 CLI validations SUCCESS, OPEN/MERGEABLE/BLOCKED/REVIEW_REQUIRED.

Findings from Sol's review:

Standards — NO-GO — 1×P2 (worst P2)

• P2 — “Focus coverage” pruning removed the only regression oracles for a TOCTOU and durability — 817e1501 deletes from packages/storage/src/__tests__/stable-storage.test.ts:39-78 the injected test that mutates the same inode in-place after open to verify the post-read snapshot/growth guard at stable-storage.ts:70-82 would reject it. No other readStableBoundedFile in-place-growth test remains. In the same commit it also removes from managed-deployment.test.ts two unique durability edges: deleting the disposable control cache while holding ownership still stays exclusive, and a concurrent first claim with a directory-sync failure does not admit an undurabled directory. The remaining decoder/error-mapping/call-count deletions were found to be covered by retained strict-frame/concurrent-activation/launch-claim/profile/Desktop integration coverage, so they are not flagged. Restore the non-redundant mutation/durability oracles.

• Prior epoch P1 remains CLOSED — compatible-change declaration is retained and the base guard is green.

No other Standards regression was found.

Spec — NO-GO — 2×P2 (worst P2)

• P2 — Mixed-version legacy-lock hole remains open — packages/storage/src/root-authority.ts:750-768 is byte-unchanged in this increment. Deleting the control directory still unlinks the held legacy owner.lock inode, allowing an old binary to recreate and acquire a distinct inode concurrently. The existing repro remains {newOwnerHeld:true,recreatedLegacyLockGranted:true} and still violates Runtime Host: managed deployments, on-demand activation, WSL, and OpenRC #3984's at-most-one eligible lifecycle-owner invariant.

• P2 — SSH activation decodes stdout immediately after the child exit promise — packages/runtime-host/src/client/ssh-operator-activation.ts:117-155,180-195 is unchanged. Node guarantees stdio drain only at close, not exit. A valid final frame that arrives after exit is misread as empty/truncated even though the remote Host has started. A deterministic injected-process repro (resolve exited, then end a PassThrough with a valid frame on setImmediate) is still rejected because the current code decodes before data arrives. Await stdout end / child close (while retaining the byte cap) before decoding.

No new Spec regression was found in this increment; prior SSH slice (Candidate launch, root/PID/epoch/endpoint, strict SSH invocation, schema-v2 profile, tunnel reuse, framed result) remains closed as previously delivered.

Verification: bounded/full git diff --check PASS, delta Biome 14 files PASS, full Biome 55 files PASS, Windows inventory 70 PASS, epoch guard PASS, worktree clean, head unchanged.

What I did not judge: a full Windows/macOS cross-version mixed-ownership run and a real SSH tunnel with late-arriving frame were not executed beyond the byte and repro inspections — verification was by code inspection and the targeted checks noted above.

Gate: Standards 1×P2 and Spec 2×P2 remain; despite all 15 expected hosted checks green (Eval validation skipped by design), head 817e is not merge-ready as “managed SSH on-demand activation” until the pruned durability oracles are restored and the legacy-lock and SSH-drain boundaries are closed. Seal: notes/pr-3985-817e-freshness-provisional.md.

---

Automated review notice: This comment was posted by an automated review agent operated by Astro-Han. It is not an independent human review and does not replace one.

[M4n5ter]

Follow-up adjudication for #3985 (comment) (exact head 6e6d3d5c2):

Accepted and fixed:

• SSH stdout drain race: activation now waits for both child exit and stdout completion before decoding the bounded frame. The existing happy-path test deterministically emits the final frame after exit.
• Stable-file in-place growth oracle: restored inside the existing bounded-snapshot test; this uniquely protects the TOCTOU read boundary.
• Concurrent first-claim durability oracle: restored one focused test proving a claimant cannot adopt an authority directory whose first durable sync failed.

Not restored / not a PR 1 blocker:

• Managed cache-deletion test: redundant with the retained lower-level State Root ownership test, which already proves cache deletion cannot admit a second owner. The managed path delegates to that authority.
• Mixed-version legacy owner.lock: the factual limitation remains, but a pre-upgrade binary cannot retroactively honor a lock introduced by this version. PR 1 rejects known legacy bindings and active old Hosts are fenced by State Root ownership. Retiring/fencing stopped unknown legacy definitions requires the explicit migration transaction tracked for PR 2 in Runtime Host: managed deployments, on-demand activation, WSL, and OpenRC #3984; adding another owner or platform process scanner here would create competing authority without closing the mixed-version boundary.

Exact-head verification:

• format, lint, build, typecheck, Windows inventory, and protocol epoch guard pass;
• Runtime Host: 1,313 tests, 1,304 passed, 9 skipped, 0 failed.

This keeps the two unique regression oracles while avoiding restoration of duplicate coverage.

[Astro-Han]

This is a synthesis of the independent blind review by @Sol-404ARE at exact head 6e6d3d5c286954fc8c4648ef491c43502a9b54c6 (base 52ee634c175c788ff883f3dc94b901756695348e, 57 files +3795/-201). I verified the diff and the exact-head CI myself; the file:line findings below are from Sol's sealed bounded freshness review against 817e.

What I checked myself:

• Read the bounded diff 817e → 6e6d (repair 6e6d3d5c 4 files +78/-7) and confirmed the restored oracles at stable-storage.test.ts:39-68 and managed-deployment.test.ts:343-383, and the fixed SSH drain at ssh-operator-activation.ts:138-141,148-159, while root-authority.ts:750-768 remains unchanged.
• Checked exact-head CI: test run 33089582855 SUCCESS, package run 33089582210 SUCCESS, owner macOS/Windows SUCCESS, windows_recovery SUCCESS, 4 addon builds + tarball + 5 CLI validations SUCCESS, run 33089582855 includes Runtime Host tests, Desktop E2E, Browser smoke, alignment audit, and release validation — all 15 expected checks green, OPEN/MERGEABLE/BLOCKED/REVIEW_REQUIRED.

Findings from Sol's review:

Standards — GO — 0 P0/P1/P2/P3

• Prior pruning P2 is now CLOSED — stable-storage.test.ts:39-68 restores the open-after-in-place-growth oracle proving the snapshot/growth guard at stable-storage.ts:70-82 works; managed-deployment.test.ts:343-383 restores the concurrent first-claim plus directory-sync failure durability oracle. The cache-deletion/layered decoder/error-mapping deletions were found to remain covered by retained State Root cache-deletion proof and authority-race/concurrent-activation/SSH framing/profile/integration coverage. No new Standards regression; epoch-55 declaration remains green.

Spec — NO-GO — 1×P2 (worst P2)

• P2 — Mixed-version legacy-lock hole remains open — packages/storage/src/root-authority.ts:750-768 is unchanged in this increment. Deleting the disposable control directory still unlinks the held legacy owner.lock inode, allowing an old binary to recreate and acquire a distinct inode concurrently. The deterministic repro remains {newOwnerHeld:true,recreatedLegacyLockGranted:true}.

• Closed: SSH exit-before-stdio-drain P2 — ssh-operator-activation.ts:138-141 now Promise.all waits for child exit and finished(stdout, {cleanup:true}); :148-159 only decodes after EOF, and ssh-operator-activation.test.ts:47-65,131-140 now resolves exit then emits/ends a valid frame via setImmediate and asserts success, covering the prior repro.

No new Spec regression was found in this increment.

Verification: bounded/full git diff --check PASS, repair Biome 4 files PASS, full Biome 55 files PASS, Windows inventory 70 PASS, epoch guard PASS, worktree clean, head unchanged.

What I did not judge: a true cross-version mixed-ownership run with an old binary concurrently acquiring owner.lock on a distinct inode was not executed beyond the deterministic repro — verification was by code inspection and the targeted suites noted above.

Gate: Standards 0 and Spec 1×P2 (legacy-lock) remain; despite all 15 expected hosted checks green, head 6e6d is not merge-ready as “managed SSH on-demand activation” until the POSIX legacy-lock deletion boundary is closed. Seal: notes/pr-3985-6e6d-freshness-provisional.md.

---

Automated review notice: This comment was posted by an automated review agent operated by Astro-Han. It is not an independent human review and does not replace one.

[M4n5ter]

Adjudication of #3985 (comment):

• The deterministic result is accepted as a real mixed-version migration constraint under its stated prerequisites.
• Its classification as a PR 1 P2 / merge blocker is rejected. Issue Runtime Host: managed deployments, on-demand activation, WSL, and OpenRC #3984 explicitly assigns legacy migration + lifecycle/provider transaction and recovery to PR 2, while this PR's frozen charter covers new installation.
• The repro requires all three out-of-scope conditions: a pre-upgrade binary remains launch-eligible, the disposable legacy control directory is removed while the new owner is active, and that old binary launches again. Closing that boundary requires the PR 2 retire/fence/migration transaction and downgrade policy. Code confined to the new owner cannot make an already-shipped binary honor a lock it does not know about.
• PR 1 still acquires the legacy lock as a compatibility fence, rejects a known legacy service in the same Client Data Root, blocks an already-running old Host, and preserves new/new exclusion after cache deletion. No second owner or platform process scanner is justified here.

The new comment supplies no evidence beyond the already-adjudicated repro, so the ledger remains follow-up: PR 2, not open for PR 1. No runtime change was made for it.

Separately, the branch was rebased onto current main (3e98eb225). The exact head is 6c3ba50e0; build, typecheck, format, lint, Windows inventory (69), protocol epoch guard (56), and Runtime Host tests (1,316 total; 1,307 passed; 9 skipped; 0 failed) pass locally.

[jackwener]

Approved at exact head 6c3ba50e0e5d6ac827ff7c12c910e0730a25be3a. I found no P0–P3 issues in the PR 1 scope.

I rechecked the branch after its rebase onto current main (3e98eb225a78289b9b8f7ac76bb1014c8777ac78). The reviewed patch series is preserved; the only new semantic commit updates the compatible registration-extension declaration from epoch 55 to the current base epoch 56. The protocol epoch guard accepts that declaration, and the head tree is already directly based on current main.

The production path is coherent: managed deployment records are read through one stable bounded file handle; launch admission is bound to the canonical package layout; operator activate --framed has strict bounded framing; the shared profile connector activates before opening the SSH tunnel; and the real concurrent-activation test converges on one Host and verifies true-idle exit. The documented pre-upgrade legacy migration case remains work for PR 2; this slice rejects known legacy service bindings and fences an already-running old Host without introducing a second lifecycle owner.

Local verification passed the full repository build, 91 focused Runtime Host tests, 32 focused Storage authority/snapshot tests (3 platform skips), the Windows test inventory, the protocol epoch guard, and git diff --check. Hosted owner checks, windows_recovery, addon builds, and immutable-tarball build are green. The required test, package, and installed-CLI jobs are still running; this approval does not waive them, and merge should wait for every required exact-head check to finish successfully.

---

Posted by an automated review agent operated by @WAWQAQ. This is not an
independent human review and does not satisfy the committer review required by
CONTRIBUTING.md. A human is accountable for this comment — please push back if
anything here is wrong.

简体中文

本条评论由 @WAWQAQ 运行的自动化审查程序发出。它不构成 CONTRIBUTING.md
所要求的独立人类审查，也不能替代人类审查。有人类对本条评论负责，如有错误请直接指出。