fix(runtime-host): bind managed retirement to one service generation

[M4n5ter]

English

Summary

Fix the managed Runtime Host retirement identity gap from #3583.

After an exact Host passes host.upgrade.prepare, the CLI now waits for that Host to release the State Root writer, verifies that the managed service PID has not changed, and holds the writer fence across backend.stop() and the stable-stopped check. If a successor changes the service identity or wins the State Root first, retirement fails closed before calling stop, instead of stopping the successor as if it were the prepared Host.

The existing PID-less/startup fence path and normal retirement tests remain unchanged. The new regression models Host A crashing, Host B acquiring the State Root, and verifies that stop is not called.

Fixes#3583

Verification

• node --test packages/cli/dist/__tests__/runtime-host-service-manager.test.js — 17 passed, including the new successor-generation regression.
• npx biome check packages/cli/src/runtime-host-service-manager.ts packages/cli/src/__tests__/runtime-host-service-manager.test.ts — passed.
• git diff --check — passed.
• The current-main CLI typecheck is blocked by two existing errors in packages/cli/src/pi-transcript.ts:512,515 (CompleteEvent.contextCompactionOutcome is missing); neither changed file contributes an error.
• The repository npm run build:test is likewise not a clean baseline on this head: it reaches unrelated current-main UI type errors in packages/ui.

Root cause

The previous PID-known retirement path validated Host A before prepare, but did not carry generation authority through service stop. A crash after prepare could let Restart=always start Host B, after which systemctl stop stopped B while the result still reported A as retired.

AI use

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: OpenAI Codex contributed substantively to the bounded runtime-host implementation and regression test under human direction. The human contributor owns review and submission. The commit retains the Generated-by: Codex trailer.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally — typecheck remains blocked by the unrelated current-main errors listed above.

Does this PR entail a change in behavior?

• Yes — managed retirement now fails closed on a service-generation or State Root identity change instead of stopping a successor.
• No

简体中文

概要

修复 #3583 中 managed Runtime Host 退场时的 service generation identity gap。

精确 Host 通过 host.upgrade.prepare 后，CLI 现在会等待该 Host 释放 State Root writer，确认 managed service PID 没有变化，并在 backend.stop() 与稳定 stopped 检查期间持有 writer fence。如果 successor 改变 service identity 或先取得 State Root，退场会在调用 stop 前 fail closed，而不会把 successor 当成原先准备退场的 Host 停掉。

现有的 PID-less/startup fence 路径与正常退场测试保持不变。新增回归测试模拟 Host A 异常退出、Host B 取得 State Root，并确认不会调用 stop。

修复 #3583

验证

• node --test packages/cli/dist/__tests__/runtime-host-service-manager.test.js：17 项通过，包含 successor generation 回归测试。
• 两个变更文件的 npx biome check：通过。
• git diff --check：通过。
• 当前 main 的 CLI typecheck 被 packages/cli/src/pi-transcript.ts:512,515 的两个既有错误阻塞（CompleteEvent.contextCompactionOutcome 缺失）；两个变更文件没有产生 typecheck 错误。
• npm run build:test 同样被当前 main 中无关的 packages/ui 类型错误阻塞。

根因

原 PID-known 退场路径只在 prepare 前验证 Host A，没有把 generation authority 延续到 service stop。如果 A 在 prepare 后异常退出，Restart=always 可能启动 Host B；之后 systemctl stop 实际停止 B，但结果仍会报告 A 已退场。

AI 使用

• 无生成式工具实质参与
• 生成式工具有实质参与

工具与范围：OpenAI Codex 在人工指导下实质参与了限定范围的 runtime-host 实现与回归测试。人工贡献者负责 review 与提交。commit 保留 Generated-by: Codex trailer。

检查清单

• 测试覆盖该变更，且缺少该变更时会失败
• lint、format、typecheck 与受影响测试套件均已在本地通过——typecheck 仍被上述无关的 current-main 错误阻塞。

本 PR 是否改变行为？

• 是——managed retirement 在 service generation 或 State Root identity 变化时 fail closed，不再误停 successor。
• 否

[jackwener]

Kabi publisher approval at exact head b6fd775bc17351a3ede978b6e22f07995bb460b0.

Execution: kabi-sol-review-orchestrator, representing WAWQAQ under Raft authorization f380cfac for Maka review actions. The independent code judgment was sealed separately on this exact head before publisher reconciliation.

The new prepared-retirement fence closes the successor race at the correct authority boundary: after Host A prepares and releases the State Root, the manager must acquire that Root fence before stopping the service; if another service generation has already won the Root, the PID recheck rejects retirement and never calls stop(). The regression drives that production path with A at PID 42 and successor B at PID 43, and would fail if the fence acquisition were removed.

Local maka-agent suite passes 402/402. Hosted test is completed/success on this exact head. package and audit are intentionally not applicable: their checked-in workflow path filters do not include either changed CLI source file, so no run is expected for this diff. PR is OPEN, non-draft, and MERGEABLE. The three GitHub review/discussion endpoints are empty; no live P0-P2 finding remains.

No merge action taken; merging remains for a human committer.

[M4n5ter]

English

Summary

Fix the managed Runtime Host retirement identity gap from #3583.

After an exact Host passes host.upgrade.prepare, the CLI now waits for that Host to release the State Root writer, verifies that the managed service PID has not changed, and holds the writer fence across backend.stop() and the stable-stopped check. If a successor changes the service identity or wins the State Root first, retirement fails closed before calling stop, instead of stopping the successor as if it were the prepared Host.

The existing PID-less/startup fence path and normal retirement tests remain unchanged. The new regression models Host A crashing, Host B acquiring the State Root, and verifies that stop is not called.

Fixes#3583

Verification

• node --test packages/cli/dist/__tests__/runtime-host-service-manager.test.js — 17 passed, including the new successor-generation regression.
• npx biome check packages/cli/src/runtime-host-service-manager.ts packages/cli/src/__tests__/runtime-host-service-manager.test.ts — passed.
• git diff --check — passed.
• The current-main CLI typecheck is blocked by two existing errors in packages/cli/src/pi-transcript.ts:512,515 (CompleteEvent.contextCompactionOutcome is missing); neither changed file contributes an error.
• The repository npm run build:test is likewise not a clean baseline on this head: it reaches unrelated current-main UI type errors in packages/ui.

Root cause

The previous PID-known retirement path validated Host A before prepare, but did not carry generation authority through service stop. A crash after prepare could let Restart=always start Host B, after which systemctl stop stopped B while the result still reported A as retired.

AI use

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: OpenAI Codex contributed substantively to the bounded runtime-host implementation and regression test under human direction. The human contributor owns review and submission. The commit retains the Generated-by: Codex trailer.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally — typecheck remains blocked by the unrelated current-main errors listed above.

Does this PR entail a change in behavior?

• Yes — managed retirement now fails closed on a service-generation or State Root identity change instead of stopping a successor.
• No

简体中文

概要

修复 #3583 中 managed Runtime Host 退场时的 service generation identity gap。

精确 Host 通过 host.upgrade.prepare 后，CLI 现在会等待该 Host 释放 State Root writer，确认 managed service PID 没有变化，并在 backend.stop() 与稳定 stopped 检查期间持有 writer fence。如果 successor 改变 service identity 或先取得 State Root，退场会在调用 stop 前 fail closed，而不会把 successor 当成原先准备退场的 Host 停掉。

现有的 PID-less/startup fence 路径与正常退场测试保持不变。新增回归测试模拟 Host A 异常退出、Host B 取得 State Root，并确认不会调用 stop。

修复 #3583

验证

• node --test packages/cli/dist/__tests__/runtime-host-service-manager.test.js：17 项通过，包含 successor generation 回归测试。
• 两个变更文件的 npx biome check：通过。
• git diff --check：通过。
• 当前 main 的 CLI typecheck 被 packages/cli/src/pi-transcript.ts:512,515 的两个既有错误阻塞（CompleteEvent.contextCompactionOutcome 缺失）；两个变更文件没有产生 typecheck 错误。
• npm run build:test 同样被当前 main 中无关的 packages/ui 类型错误阻塞。

根因

原 PID-known 退场路径只在 prepare 前验证 Host A，没有把 generation authority 延续到 service stop。如果 A 在 prepare 后异常退出，Restart=always 可能启动 Host B；之后 systemctl stop 实际停止 B，但结果仍会报告 A 已退场。

AI 使用

• 无生成式工具实质参与
• 生成式工具有实质参与

工具与范围：OpenAI Codex 在人工指导下实质参与了限定范围的 runtime-host 实现与回归测试。人工贡献者负责 review 与提交。commit 保留 Generated-by: Codex trailer。

检查清单

• 测试覆盖该变更，且缺少该变更时会失败
• lint、format、typecheck 与受影响测试套件均已在本地通过——typecheck 仍被上述无关的 current-main 错误阻塞。

本 PR 是否改变行为？

• 是——managed retirement 在 service generation 或 State Root identity 变化时 fail closed，不再误停 successor。
• 否

[jackwener]

Kabi publisher approval at exact head b6fd775bc17351a3ede978b6e22f07995bb460b0.

Execution: kabi-sol-review-orchestrator, representing WAWQAQ under Raft authorization f380cfac for Maka review actions. The independent code judgment was sealed separately on this exact head before publisher reconciliation.

The new prepared-retirement fence closes the successor race at the correct authority boundary: after Host A prepares and releases the State Root, the manager must acquire that Root fence before stopping the service; if another service generation has already won the Root, the PID recheck rejects retirement and never calls stop(). The regression drives that production path with A at PID 42 and successor B at PID 43, and would fail if the fence acquisition were removed.

Local maka-agent suite passes 402/402. Hosted test is completed/success on this exact head. package and audit are intentionally not applicable: their checked-in workflow path filters do not include either changed CLI source file, so no run is expected for this diff. PR is OPEN, non-draft, and MERGEABLE. The three GitHub review/discussion endpoints are empty; no live P0-P2 finding remains.

No merge action taken; merging remains for a human committer.

[M4n5ter]

English

Summary

Fix the managed Runtime Host retirement identity gap from #3583.

After an exact Host passes host.upgrade.prepare, the CLI now waits for that Host to release the State Root writer, verifies that the managed service PID has not changed, and holds the writer fence across backend.stop() and the stable-stopped check. If a successor changes the service identity or wins the State Root first, retirement fails closed before calling stop, instead of stopping the successor as if it were the prepared Host.

The existing PID-less/startup fence path and normal retirement tests remain unchanged. The new regression models Host A crashing, Host B acquiring the State Root, and verifies that stop is not called.

Fixes#3583

Verification

• node --test packages/cli/dist/__tests__/runtime-host-service-manager.test.js — 17 passed, including the new successor-generation regression.
• npx biome check packages/cli/src/runtime-host-service-manager.ts packages/cli/src/__tests__/runtime-host-service-manager.test.ts — passed.
• git diff --check — passed.
• The current-main CLI typecheck is blocked by two existing errors in packages/cli/src/pi-transcript.ts:512,515 (CompleteEvent.contextCompactionOutcome is missing); neither changed file contributes an error.
• The repository npm run build:test is likewise not a clean baseline on this head: it reaches unrelated current-main UI type errors in packages/ui.

Root cause

The previous PID-known retirement path validated Host A before prepare, but did not carry generation authority through service stop. A crash after prepare could let Restart=always start Host B, after which systemctl stop stopped B while the result still reported A as retired.

AI use

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: OpenAI Codex contributed substantively to the bounded runtime-host implementation and regression test under human direction. The human contributor owns review and submission. The commit retains the Generated-by: Codex trailer.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally — typecheck remains blocked by the unrelated current-main errors listed above.

Does this PR entail a change in behavior?

• Yes — managed retirement now fails closed on a service-generation or State Root identity change instead of stopping a successor.
• No

简体中文

概要

修复 #3583 中 managed Runtime Host 退场时的 service generation identity gap。

精确 Host 通过 host.upgrade.prepare 后，CLI 现在会等待该 Host 释放 State Root writer，确认 managed service PID 没有变化，并在 backend.stop() 与稳定 stopped 检查期间持有 writer fence。如果 successor 改变 service identity 或先取得 State Root，退场会在调用 stop 前 fail closed，而不会把 successor 当成原先准备退场的 Host 停掉。

现有的 PID-less/startup fence 路径与正常退场测试保持不变。新增回归测试模拟 Host A 异常退出、Host B 取得 State Root，并确认不会调用 stop。

修复 #3583

验证

• node --test packages/cli/dist/__tests__/runtime-host-service-manager.test.js：17 项通过，包含 successor generation 回归测试。
• 两个变更文件的 npx biome check：通过。
• git diff --check：通过。
• 当前 main 的 CLI typecheck 被 packages/cli/src/pi-transcript.ts:512,515 的两个既有错误阻塞（CompleteEvent.contextCompactionOutcome 缺失）；两个变更文件没有产生 typecheck 错误。
• npm run build:test 同样被当前 main 中无关的 packages/ui 类型错误阻塞。

根因

原 PID-known 退场路径只在 prepare 前验证 Host A，没有把 generation authority 延续到 service stop。如果 A 在 prepare 后异常退出，Restart=always 可能启动 Host B；之后 systemctl stop 实际停止 B，但结果仍会报告 A 已退场。

AI 使用

• 无生成式工具实质参与
• 生成式工具有实质参与

工具与范围：OpenAI Codex 在人工指导下实质参与了限定范围的 runtime-host 实现与回归测试。人工贡献者负责 review 与提交。commit 保留 Generated-by: Codex trailer。

检查清单

• 测试覆盖该变更，且缺少该变更时会失败
• lint、format、typecheck 与受影响测试套件均已在本地通过——typecheck 仍被上述无关的 current-main 错误阻塞。

本 PR 是否改变行为？

• 是——managed retirement 在 service generation 或 State Root identity 变化时 fail closed，不再误停 successor。
• 否

[jackwener]

Kabi publisher approval at exact head b6fd775bc17351a3ede978b6e22f07995bb460b0.

Execution: kabi-sol-review-orchestrator, representing WAWQAQ under Raft authorization f380cfac for Maka review actions. The independent code judgment was sealed separately on this exact head before publisher reconciliation.

The new prepared-retirement fence closes the successor race at the correct authority boundary: after Host A prepares and releases the State Root, the manager must acquire that Root fence before stopping the service; if another service generation has already won the Root, the PID recheck rejects retirement and never calls stop(). The regression drives that production path with A at PID 42 and successor B at PID 43, and would fail if the fence acquisition were removed.

Local maka-agent suite passes 402/402. Hosted test is completed/success on this exact head. package and audit are intentionally not applicable: their checked-in workflow path filters do not include either changed CLI source file, so no run is expected for this diff. PR is OPEN, non-draft, and MERGEABLE. The three GitHub review/discussion endpoints are empty; no live P0-P2 finding remains.

No merge action taken; merging remains for a human committer.

[M4n5ter]

English

Summary

Fix the managed Runtime Host retirement identity gap from #3583.

After an exact Host passes host.upgrade.prepare, the CLI now waits for that Host to release the State Root writer, verifies that the managed service PID has not changed, and holds the writer fence across backend.stop() and the stable-stopped check. If a successor changes the service identity or wins the State Root first, retirement fails closed before calling stop, instead of stopping the successor as if it were the prepared Host.

The existing PID-less/startup fence path and normal retirement tests remain unchanged. The new regression models Host A crashing, Host B acquiring the State Root, and verifies that stop is not called.

Fixes#3583

Verification

• node --test packages/cli/dist/__tests__/runtime-host-service-manager.test.js — 17 passed, including the new successor-generation regression.
• npx biome check packages/cli/src/runtime-host-service-manager.ts packages/cli/src/__tests__/runtime-host-service-manager.test.ts — passed.
• git diff --check — passed.
• The current-main CLI typecheck is blocked by two existing errors in packages/cli/src/pi-transcript.ts:512,515 (CompleteEvent.contextCompactionOutcome is missing); neither changed file contributes an error.
• The repository npm run build:test is likewise not a clean baseline on this head: it reaches unrelated current-main UI type errors in packages/ui.

Root cause

The previous PID-known retirement path validated Host A before prepare, but did not carry generation authority through service stop. A crash after prepare could let Restart=always start Host B, after which systemctl stop stopped B while the result still reported A as retired.

AI use

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: OpenAI Codex contributed substantively to the bounded runtime-host implementation and regression test under human direction. The human contributor owns review and submission. The commit retains the Generated-by: Codex trailer.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally — typecheck remains blocked by the unrelated current-main errors listed above.

Does this PR entail a change in behavior?

• Yes — managed retirement now fails closed on a service-generation or State Root identity change instead of stopping a successor.
• No

简体中文

概要

修复 #3583 中 managed Runtime Host 退场时的 service generation identity gap。

精确 Host 通过 host.upgrade.prepare 后，CLI 现在会等待该 Host 释放 State Root writer，确认 managed service PID 没有变化，并在 backend.stop() 与稳定 stopped 检查期间持有 writer fence。如果 successor 改变 service identity 或先取得 State Root，退场会在调用 stop 前 fail closed，而不会把 successor 当成原先准备退场的 Host 停掉。

现有的 PID-less/startup fence 路径与正常退场测试保持不变。新增回归测试模拟 Host A 异常退出、Host B 取得 State Root，并确认不会调用 stop。

修复 #3583

验证

• node --test packages/cli/dist/__tests__/runtime-host-service-manager.test.js：17 项通过，包含 successor generation 回归测试。
• 两个变更文件的 npx biome check：通过。
• git diff --check：通过。
• 当前 main 的 CLI typecheck 被 packages/cli/src/pi-transcript.ts:512,515 的两个既有错误阻塞（CompleteEvent.contextCompactionOutcome 缺失）；两个变更文件没有产生 typecheck 错误。
• npm run build:test 同样被当前 main 中无关的 packages/ui 类型错误阻塞。

根因

原 PID-known 退场路径只在 prepare 前验证 Host A，没有把 generation authority 延续到 service stop。如果 A 在 prepare 后异常退出，Restart=always 可能启动 Host B；之后 systemctl stop 实际停止 B，但结果仍会报告 A 已退场。

AI 使用

• 无生成式工具实质参与
• 生成式工具有实质参与

工具与范围：OpenAI Codex 在人工指导下实质参与了限定范围的 runtime-host 实现与回归测试。人工贡献者负责 review 与提交。commit 保留 Generated-by: Codex trailer。

检查清单

• 测试覆盖该变更，且缺少该变更时会失败
• lint、format、typecheck 与受影响测试套件均已在本地通过——typecheck 仍被上述无关的 current-main 错误阻塞。

本 PR 是否改变行为？

• 是——managed retirement 在 service generation 或 State Root identity 变化时 fail closed，不再误停 successor。
• 否

[jackwener]

Kabi publisher approval at exact head b6fd775bc17351a3ede978b6e22f07995bb460b0.

Execution: kabi-sol-review-orchestrator, representing WAWQAQ under Raft authorization f380cfac for Maka review actions. The independent code judgment was sealed separately on this exact head before publisher reconciliation.

The new prepared-retirement fence closes the successor race at the correct authority boundary: after Host A prepares and releases the State Root, the manager must acquire that Root fence before stopping the service; if another service generation has already won the Root, the PID recheck rejects retirement and never calls stop(). The regression drives that production path with A at PID 42 and successor B at PID 43, and would fail if the fence acquisition were removed.

Local maka-agent suite passes 402/402. Hosted test is completed/success on this exact head. package and audit are intentionally not applicable: their checked-in workflow path filters do not include either changed CLI source file, so no run is expected for this diff. PR is OPEN, non-draft, and MERGEABLE. The three GitHub review/discussion endpoints are empty; no live P0-P2 finding remains.

No merge action taken; merging remains for a human committer.

[M4n5ter]

English

Summary

Fix the managed Runtime Host retirement identity gap from #3583.

After an exact Host passes host.upgrade.prepare, the CLI now waits for that Host to release the State Root writer, verifies that the managed service PID has not changed, and holds the writer fence across backend.stop() and the stable-stopped check. If a successor changes the service identity or wins the State Root first, retirement fails closed before calling stop, instead of stopping the successor as if it were the prepared Host.

The existing PID-less/startup fence path and normal retirement tests remain unchanged. The new regression models Host A crashing, Host B acquiring the State Root, and verifies that stop is not called.

Fixes#3583

Verification

• node --test packages/cli/dist/__tests__/runtime-host-service-manager.test.js — 17 passed, including the new successor-generation regression.
• npx biome check packages/cli/src/runtime-host-service-manager.ts packages/cli/src/__tests__/runtime-host-service-manager.test.ts — passed.
• git diff --check — passed.
• The current-main CLI typecheck is blocked by two existing errors in packages/cli/src/pi-transcript.ts:512,515 (CompleteEvent.contextCompactionOutcome is missing); neither changed file contributes an error.
• The repository npm run build:test is likewise not a clean baseline on this head: it reaches unrelated current-main UI type errors in packages/ui.

Root cause

The previous PID-known retirement path validated Host A before prepare, but did not carry generation authority through service stop. A crash after prepare could let Restart=always start Host B, after which systemctl stop stopped B while the result still reported A as retired.

AI use

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: OpenAI Codex contributed substantively to the bounded runtime-host implementation and regression test under human direction. The human contributor owns review and submission. The commit retains the Generated-by: Codex trailer.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally — typecheck remains blocked by the unrelated current-main errors listed above.

Does this PR entail a change in behavior?

• Yes — managed retirement now fails closed on a service-generation or State Root identity change instead of stopping a successor.
• No

简体中文

概要

修复 #3583 中 managed Runtime Host 退场时的 service generation identity gap。

精确 Host 通过 host.upgrade.prepare 后，CLI 现在会等待该 Host 释放 State Root writer，确认 managed service PID 没有变化，并在 backend.stop() 与稳定 stopped 检查期间持有 writer fence。如果 successor 改变 service identity 或先取得 State Root，退场会在调用 stop 前 fail closed，而不会把 successor 当成原先准备退场的 Host 停掉。

现有的 PID-less/startup fence 路径与正常退场测试保持不变。新增回归测试模拟 Host A 异常退出、Host B 取得 State Root，并确认不会调用 stop。

修复 #3583

验证

• node --test packages/cli/dist/__tests__/runtime-host-service-manager.test.js：17 项通过，包含 successor generation 回归测试。
• 两个变更文件的 npx biome check：通过。
• git diff --check：通过。
• 当前 main 的 CLI typecheck 被 packages/cli/src/pi-transcript.ts:512,515 的两个既有错误阻塞（CompleteEvent.contextCompactionOutcome 缺失）；两个变更文件没有产生 typecheck 错误。
• npm run build:test 同样被当前 main 中无关的 packages/ui 类型错误阻塞。

根因

原 PID-known 退场路径只在 prepare 前验证 Host A，没有把 generation authority 延续到 service stop。如果 A 在 prepare 后异常退出，Restart=always 可能启动 Host B；之后 systemctl stop 实际停止 B，但结果仍会报告 A 已退场。

AI 使用

• 无生成式工具实质参与
• 生成式工具有实质参与

工具与范围：OpenAI Codex 在人工指导下实质参与了限定范围的 runtime-host 实现与回归测试。人工贡献者负责 review 与提交。commit 保留 Generated-by: Codex trailer。

检查清单

• 测试覆盖该变更，且缺少该变更时会失败
• lint、format、typecheck 与受影响测试套件均已在本地通过——typecheck 仍被上述无关的 current-main 错误阻塞。

本 PR 是否改变行为？

• 是——managed retirement 在 service generation 或 State Root identity 变化时 fail closed，不再误停 successor。
• 否

[jackwener]

Kabi publisher approval at exact head b6fd775bc17351a3ede978b6e22f07995bb460b0.

Execution: kabi-sol-review-orchestrator, representing WAWQAQ under Raft authorization f380cfac for Maka review actions. The independent code judgment was sealed separately on this exact head before publisher reconciliation.

The new prepared-retirement fence closes the successor race at the correct authority boundary: after Host A prepares and releases the State Root, the manager must acquire that Root fence before stopping the service; if another service generation has already won the Root, the PID recheck rejects retirement and never calls stop(). The regression drives that production path with A at PID 42 and successor B at PID 43, and would fail if the fence acquisition were removed.

Local maka-agent suite passes 402/402. Hosted test is completed/success on this exact head. package and audit are intentionally not applicable: their checked-in workflow path filters do not include either changed CLI source file, so no run is expected for this diff. PR is OPEN, non-draft, and MERGEABLE. The three GitHub review/discussion endpoints are empty; no live P0-P2 finding remains.

No merge action taken; merging remains for a human committer.

[M4n5ter]

English

Summary

Fix the managed Runtime Host retirement identity gap from #3583.

After an exact Host passes host.upgrade.prepare, the CLI now waits for that Host to release the State Root writer, verifies that the managed service PID has not changed, and holds the writer fence across backend.stop() and the stable-stopped check. If a successor changes the service identity or wins the State Root first, retirement fails closed before calling stop, instead of stopping the successor as if it were the prepared Host.

The existing PID-less/startup fence path and normal retirement tests remain unchanged. The new regression models Host A crashing, Host B acquiring the State Root, and verifies that stop is not called.

Fixes#3583

Verification

• node --test packages/cli/dist/__tests__/runtime-host-service-manager.test.js — 17 passed, including the new successor-generation regression.
• npx biome check packages/cli/src/runtime-host-service-manager.ts packages/cli/src/__tests__/runtime-host-service-manager.test.ts — passed.
• git diff --check — passed.
• The current-main CLI typecheck is blocked by two existing errors in packages/cli/src/pi-transcript.ts:512,515 (CompleteEvent.contextCompactionOutcome is missing); neither changed file contributes an error.
• The repository npm run build:test is likewise not a clean baseline on this head: it reaches unrelated current-main UI type errors in packages/ui.

Root cause

The previous PID-known retirement path validated Host A before prepare, but did not carry generation authority through service stop. A crash after prepare could let Restart=always start Host B, after which systemctl stop stopped B while the result still reported A as retired.

AI use

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: OpenAI Codex contributed substantively to the bounded runtime-host implementation and regression test under human direction. The human contributor owns review and submission. The commit retains the Generated-by: Codex trailer.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally — typecheck remains blocked by the unrelated current-main errors listed above.

Does this PR entail a change in behavior?

• Yes — managed retirement now fails closed on a service-generation or State Root identity change instead of stopping a successor.
• No

简体中文

概要

修复 #3583 中 managed Runtime Host 退场时的 service generation identity gap。

精确 Host 通过 host.upgrade.prepare 后，CLI 现在会等待该 Host 释放 State Root writer，确认 managed service PID 没有变化，并在 backend.stop() 与稳定 stopped 检查期间持有 writer fence。如果 successor 改变 service identity 或先取得 State Root，退场会在调用 stop 前 fail closed，而不会把 successor 当成原先准备退场的 Host 停掉。

现有的 PID-less/startup fence 路径与正常退场测试保持不变。新增回归测试模拟 Host A 异常退出、Host B 取得 State Root，并确认不会调用 stop。

修复 #3583

验证

• node --test packages/cli/dist/__tests__/runtime-host-service-manager.test.js：17 项通过，包含 successor generation 回归测试。
• 两个变更文件的 npx biome check：通过。
• git diff --check：通过。
• 当前 main 的 CLI typecheck 被 packages/cli/src/pi-transcript.ts:512,515 的两个既有错误阻塞（CompleteEvent.contextCompactionOutcome 缺失）；两个变更文件没有产生 typecheck 错误。
• npm run build:test 同样被当前 main 中无关的 packages/ui 类型错误阻塞。

根因

原 PID-known 退场路径只在 prepare 前验证 Host A，没有把 generation authority 延续到 service stop。如果 A 在 prepare 后异常退出，Restart=always 可能启动 Host B；之后 systemctl stop 实际停止 B，但结果仍会报告 A 已退场。

AI 使用

• 无生成式工具实质参与
• 生成式工具有实质参与

工具与范围：OpenAI Codex 在人工指导下实质参与了限定范围的 runtime-host 实现与回归测试。人工贡献者负责 review 与提交。commit 保留 Generated-by: Codex trailer。

检查清单

• 测试覆盖该变更，且缺少该变更时会失败
• lint、format、typecheck 与受影响测试套件均已在本地通过——typecheck 仍被上述无关的 current-main 错误阻塞。

本 PR 是否改变行为？

• 是——managed retirement 在 service generation 或 State Root identity 变化时 fail closed，不再误停 successor。
• 否

[jackwener]

Kabi publisher approval at exact head b6fd775bc17351a3ede978b6e22f07995bb460b0.

Execution: kabi-sol-review-orchestrator, representing WAWQAQ under Raft authorization f380cfac for Maka review actions. The independent code judgment was sealed separately on this exact head before publisher reconciliation.

The new prepared-retirement fence closes the successor race at the correct authority boundary: after Host A prepares and releases the State Root, the manager must acquire that Root fence before stopping the service; if another service generation has already won the Root, the PID recheck rejects retirement and never calls stop(). The regression drives that production path with A at PID 42 and successor B at PID 43, and would fail if the fence acquisition were removed.

Local maka-agent suite passes 402/402. Hosted test is completed/success on this exact head. package and audit are intentionally not applicable: their checked-in workflow path filters do not include either changed CLI source file, so no run is expected for this diff. PR is OPEN, non-draft, and MERGEABLE. The three GitHub review/discussion endpoints are empty; no live P0-P2 finding remains.

No merge action taken; merging remains for a human committer.

[M4n5ter]

English

Summary

Fix the managed Runtime Host retirement identity gap from #3583.

After an exact Host passes host.upgrade.prepare, the CLI now waits for that Host to release the State Root writer, verifies that the managed service PID has not changed, and holds the writer fence across backend.stop() and the stable-stopped check. If a successor changes the service identity or wins the State Root first, retirement fails closed before calling stop, instead of stopping the successor as if it were the prepared Host.

The existing PID-less/startup fence path and normal retirement tests remain unchanged. The new regression models Host A crashing, Host B acquiring the State Root, and verifies that stop is not called.

Fixes#3583

Verification

• node --test packages/cli/dist/__tests__/runtime-host-service-manager.test.js — 17 passed, including the new successor-generation regression.
• npx biome check packages/cli/src/runtime-host-service-manager.ts packages/cli/src/__tests__/runtime-host-service-manager.test.ts — passed.
• git diff --check — passed.
• The current-main CLI typecheck is blocked by two existing errors in packages/cli/src/pi-transcript.ts:512,515 (CompleteEvent.contextCompactionOutcome is missing); neither changed file contributes an error.
• The repository npm run build:test is likewise not a clean baseline on this head: it reaches unrelated current-main UI type errors in packages/ui.

Root cause

The previous PID-known retirement path validated Host A before prepare, but did not carry generation authority through service stop. A crash after prepare could let Restart=always start Host B, after which systemctl stop stopped B while the result still reported A as retired.

AI use

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: OpenAI Codex contributed substantively to the bounded runtime-host implementation and regression test under human direction. The human contributor owns review and submission. The commit retains the Generated-by: Codex trailer.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally — typecheck remains blocked by the unrelated current-main errors listed above.

Does this PR entail a change in behavior?

• Yes — managed retirement now fails closed on a service-generation or State Root identity change instead of stopping a successor.
• No

简体中文

概要

修复 #3583 中 managed Runtime Host 退场时的 service generation identity gap。

精确 Host 通过 host.upgrade.prepare 后，CLI 现在会等待该 Host 释放 State Root writer，确认 managed service PID 没有变化，并在 backend.stop() 与稳定 stopped 检查期间持有 writer fence。如果 successor 改变 service identity 或先取得 State Root，退场会在调用 stop 前 fail closed，而不会把 successor 当成原先准备退场的 Host 停掉。

现有的 PID-less/startup fence 路径与正常退场测试保持不变。新增回归测试模拟 Host A 异常退出、Host B 取得 State Root，并确认不会调用 stop。

修复 #3583

验证

• node --test packages/cli/dist/__tests__/runtime-host-service-manager.test.js：17 项通过，包含 successor generation 回归测试。
• 两个变更文件的 npx biome check：通过。
• git diff --check：通过。
• 当前 main 的 CLI typecheck 被 packages/cli/src/pi-transcript.ts:512,515 的两个既有错误阻塞（CompleteEvent.contextCompactionOutcome 缺失）；两个变更文件没有产生 typecheck 错误。
• npm run build:test 同样被当前 main 中无关的 packages/ui 类型错误阻塞。

根因

原 PID-known 退场路径只在 prepare 前验证 Host A，没有把 generation authority 延续到 service stop。如果 A 在 prepare 后异常退出，Restart=always 可能启动 Host B；之后 systemctl stop 实际停止 B，但结果仍会报告 A 已退场。

AI 使用

• 无生成式工具实质参与
• 生成式工具有实质参与

工具与范围：OpenAI Codex 在人工指导下实质参与了限定范围的 runtime-host 实现与回归测试。人工贡献者负责 review 与提交。commit 保留 Generated-by: Codex trailer。

检查清单

• 测试覆盖该变更，且缺少该变更时会失败
• lint、format、typecheck 与受影响测试套件均已在本地通过——typecheck 仍被上述无关的 current-main 错误阻塞。

本 PR 是否改变行为？

• 是——managed retirement 在 service generation 或 State Root identity 变化时 fail closed，不再误停 successor。
• 否

[jackwener]

Kabi publisher approval at exact head b6fd775bc17351a3ede978b6e22f07995bb460b0.

Execution: kabi-sol-review-orchestrator, representing WAWQAQ under Raft authorization f380cfac for Maka review actions. The independent code judgment was sealed separately on this exact head before publisher reconciliation.

The new prepared-retirement fence closes the successor race at the correct authority boundary: after Host A prepares and releases the State Root, the manager must acquire that Root fence before stopping the service; if another service generation has already won the Root, the PID recheck rejects retirement and never calls stop(). The regression drives that production path with A at PID 42 and successor B at PID 43, and would fail if the fence acquisition were removed.

Local maka-agent suite passes 402/402. Hosted test is completed/success on this exact head. package and audit are intentionally not applicable: their checked-in workflow path filters do not include either changed CLI source file, so no run is expected for this diff. PR is OPEN, non-draft, and MERGEABLE. The three GitHub review/discussion endpoints are empty; no live P0-P2 finding remains.

No merge action taken; merging remains for a human committer.

[M4n5ter]

English

Summary

Fix the managed Runtime Host retirement identity gap from #3583.

After an exact Host passes host.upgrade.prepare, the CLI now waits for that Host to release the State Root writer, verifies that the managed service PID has not changed, and holds the writer fence across backend.stop() and the stable-stopped check. If a successor changes the service identity or wins the State Root first, retirement fails closed before calling stop, instead of stopping the successor as if it were the prepared Host.

The existing PID-less/startup fence path and normal retirement tests remain unchanged. The new regression models Host A crashing, Host B acquiring the State Root, and verifies that stop is not called.

Fixes#3583

Verification

• node --test packages/cli/dist/__tests__/runtime-host-service-manager.test.js — 17 passed, including the new successor-generation regression.
• npx biome check packages/cli/src/runtime-host-service-manager.ts packages/cli/src/__tests__/runtime-host-service-manager.test.ts — passed.
• git diff --check — passed.
• The current-main CLI typecheck is blocked by two existing errors in packages/cli/src/pi-transcript.ts:512,515 (CompleteEvent.contextCompactionOutcome is missing); neither changed file contributes an error.
• The repository npm run build:test is likewise not a clean baseline on this head: it reaches unrelated current-main UI type errors in packages/ui.

Root cause

The previous PID-known retirement path validated Host A before prepare, but did not carry generation authority through service stop. A crash after prepare could let Restart=always start Host B, after which systemctl stop stopped B while the result still reported A as retired.

AI use

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: OpenAI Codex contributed substantively to the bounded runtime-host implementation and regression test under human direction. The human contributor owns review and submission. The commit retains the Generated-by: Codex trailer.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally — typecheck remains blocked by the unrelated current-main errors listed above.

Does this PR entail a change in behavior?

• Yes — managed retirement now fails closed on a service-generation or State Root identity change instead of stopping a successor.
• No

简体中文

概要

修复 #3583 中 managed Runtime Host 退场时的 service generation identity gap。

精确 Host 通过 host.upgrade.prepare 后，CLI 现在会等待该 Host 释放 State Root writer，确认 managed service PID 没有变化，并在 backend.stop() 与稳定 stopped 检查期间持有 writer fence。如果 successor 改变 service identity 或先取得 State Root，退场会在调用 stop 前 fail closed，而不会把 successor 当成原先准备退场的 Host 停掉。

现有的 PID-less/startup fence 路径与正常退场测试保持不变。新增回归测试模拟 Host A 异常退出、Host B 取得 State Root，并确认不会调用 stop。

修复 #3583

验证

• node --test packages/cli/dist/__tests__/runtime-host-service-manager.test.js：17 项通过，包含 successor generation 回归测试。
• 两个变更文件的 npx biome check：通过。
• git diff --check：通过。
• 当前 main 的 CLI typecheck 被 packages/cli/src/pi-transcript.ts:512,515 的两个既有错误阻塞（CompleteEvent.contextCompactionOutcome 缺失）；两个变更文件没有产生 typecheck 错误。
• npm run build:test 同样被当前 main 中无关的 packages/ui 类型错误阻塞。

根因

原 PID-known 退场路径只在 prepare 前验证 Host A，没有把 generation authority 延续到 service stop。如果 A 在 prepare 后异常退出，Restart=always 可能启动 Host B；之后 systemctl stop 实际停止 B，但结果仍会报告 A 已退场。

AI 使用

• 无生成式工具实质参与
• 生成式工具有实质参与

工具与范围：OpenAI Codex 在人工指导下实质参与了限定范围的 runtime-host 实现与回归测试。人工贡献者负责 review 与提交。commit 保留 Generated-by: Codex trailer。

检查清单

• 测试覆盖该变更，且缺少该变更时会失败
• lint、format、typecheck 与受影响测试套件均已在本地通过——typecheck 仍被上述无关的 current-main 错误阻塞。

本 PR 是否改变行为？

• 是——managed retirement 在 service generation 或 State Root identity 变化时 fail closed，不再误停 successor。
• 否

[jackwener]

Kabi publisher approval at exact head b6fd775bc17351a3ede978b6e22f07995bb460b0.

Execution: kabi-sol-review-orchestrator, representing WAWQAQ under Raft authorization f380cfac for Maka review actions. The independent code judgment was sealed separately on this exact head before publisher reconciliation.

The new prepared-retirement fence closes the successor race at the correct authority boundary: after Host A prepares and releases the State Root, the manager must acquire that Root fence before stopping the service; if another service generation has already won the Root, the PID recheck rejects retirement and never calls stop(). The regression drives that production path with A at PID 42 and successor B at PID 43, and would fail if the fence acquisition were removed.

Local maka-agent suite passes 402/402. Hosted test is completed/success on this exact head. package and audit are intentionally not applicable: their checked-in workflow path filters do not include either changed CLI source file, so no run is expected for this diff. PR is OPEN, non-draft, and MERGEABLE. The three GitHub review/discussion endpoints are empty; no live P0-P2 finding remains.

No merge action taken; merging remains for a human committer.