fix(restore): simplify ownership recovery

Replace the cross-host mutex and claim protocol with atomically published owner directories and participants. This removes crash-wedged intermediate states, preserves live cohorts, handles upgraded and legacy markers, and drops the sha2 dependency.

Keep workspace cancellations until their matching creation settles and retry pre-response restore cancellation without relying on SSE delivery. Inline one-use cache eviction logic and remove unused aliases.

Delete the unreachable Electron utility-process supervisor path. The existing identity-guarded shutdown remains; Windows crash-only descendant containment is intentionally left as a documented residual rather than adding a PowerShell Job Object supervisor.

Validated with Electron native tests and build, focused UI/server suites, Tauri client-state tests, all affected typechecks, cargo check, and focused Rust formatting.

Author: pascalandr

packages/electron-app/electron/main/client-state-cross-host-child.ts

@@ -4,15 +4,15 @@ import { getProcessStartIdentity } from "./client-state-process-identity"
 import { isPidAlive } from "./client-state-process"
 import { ClientStateManager } from "./client-state"
 
-const [directory, startPath, readyPath, mode, userDataPath, participantReadyPath, participantContinuePath] = process.argv.slice(2)
+const [directory, startPath, readyPath, mode, userDataPath, participantReadyPath, participantContinuePath, legacyTauriDataPath] = process.argv.slice(2)
 if (!directory || !startPath) throw new Error("Expected election directory and start path")
 if (readyPath) writeFileSync(readyPath, "")
 while (!existsSync(startPath)) Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 5)
 
 const manager = mode === "full" && userDataPath
   ? new ClientStateManager(userDataPath, undefined, {
       crossHostElectionDirectory: directory,
-      legacyTauriDataPath: null,
+      legacyTauriDataPath: legacyTauriDataPath || null,
       crossHostDependencies: {
         pidAlive: isPidAlive,
         processStartIdentity: getProcessStartIdentity,
@@ -26,7 +26,12 @@ const manager = mode === "full" && userDataPath
     })
   : undefined
 const owner = manager ? undefined : createCrossHostOwner()
-const registration = owner && CrossHostRegistration.register(directory, owner, true)
+const registration = owner && CrossHostRegistration.register(directory, owner, true, {
+  pidAlive: mode === "retire-crash" ? () => false : isPidAlive,
+  processStartIdentity: getProcessStartIdentity,
+  onOwnerPrepared: mode === "owner-crash" ? () => process.exit(91) : undefined,
+  onOwnerRetired: mode === "retire-crash" ? () => process.exit(91) : undefined,
+})
 process.stdout.write(`${JSON.stringify({ acquired: manager?.isPrimary ?? Boolean(registration?.isPrimary) })}\n`)
 process.stdin.resume()
 process.stdin.once("end", () => {

packages/electron-app/electron/main/client-state-cross-host.test.ts

@@ -1,14 +1,14 @@
 import assert from "node:assert/strict"
 import { spawn, type ChildProcessWithoutNullStreams } from "node:child_process"
 import { once } from "node:events"
-import { existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs"
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from "node:fs"
 import { tmpdir } from "node:os"
 import { join, posix, win32 } from "node:path"
 import { fileURLToPath } from "node:url"
 import test from "node:test"
 import {
   CrossHostRegistration,
-  CROSS_HOST_OWNER_FILENAME,
+  CROSS_HOST_OWNER_DIRECTORY,
   resolveCrossHostElectionDirectory,
   type CrossHostLeaseDependencies,
 } from "./client-state-cross-host"
@@ -20,102 +20,134 @@ function temp(t: test.TestContext): string {
   return path
 }
 
-function owner(pid: number, host: string, identity = `${host}-start`): ProcessOwner {
-  return { pid, runToken: `${host}-run`, processStartIdentity: identity }
+function owner(pid: number, token: string, identity = `${token}-start`): ProcessOwner {
+  return { pid, runToken: token, processStartIdentity: identity }
 }
 
 function dependencies(alive: boolean, identity?: string): CrossHostLeaseDependencies {
   return { pidAlive: () => alive, processStartIdentity: () => identity }
 }
 
-test("both host orders elect only the first registration", (t) => {
-  for (const order of [["electron", "tauri"], ["tauri", "electron"]] as const) {
-    const directory = temp(t)
-    const firstOwner = owner(101, order[0]), secondOwner = owner(102, order[1])
-    const identities = new Map([[101, firstOwner.processStartIdentity!], [102, secondOwner.processStartIdentity!]])
-    const deps = { pidAlive: () => true, processStartIdentity: (pid: number) => identities.get(pid) }
-    const first = CrossHostRegistration.register(directory, firstOwner, true, deps)!
-    const second = CrossHostRegistration.register(directory, secondOwner, true, deps)!
-    assert.equal(first.isPrimary, true)
-    assert.equal(second.isPrimary, false)
-    second.release()
-    assert.equal(first.release(), true)
-  }
-})
+function ownerFile(directory: string): string {
+  return join(directory, CROSS_HOST_OWNER_DIRECTORY, "owner.json")
+}
+
+interface Child {
+  process: ChildProcessWithoutNullStreams
+  result: Promise<boolean>
+}
+
+function child(directory: string, start: string, mode = ""): Child {
+  const process = spawn(globalThis.process.execPath, [
+    "--import", "tsx", fileURLToPath(new URL("./client-state-cross-host-child.ts", import.meta.url)), directory, start, "", mode,
+  ]) as ChildProcessWithoutNullStreams
+  process.stdout.setEncoding("utf8"); process.stderr.setEncoding("utf8")
+  const result = new Promise<boolean>((resolve, reject) => {
+    let output = "", errors = ""
+    process.stdout.on("data", (chunk: string) => {
+      output += chunk
+      if (output.includes("\n")) resolve(JSON.parse(output).acquired)
+    })
+    process.stderr.on("data", (chunk: string) => { errors += chunk })
+    process.once("error", reject)
+    process.once("exit", (code) => { if (!output && code !== 91) reject(new Error(`child ${code}: ${errors}`)) })
+  })
+  return { process, result }
+}
+
+async function stop(...children: Child[]): Promise<void> {
+  const running = children.filter(({ process }) => process.exitCode === null && process.signalCode === null)
+  const exits = running.map(({ process }) => once(process, "exit"))
+  running.forEach(({ process }) => process.stdin.end())
+  await Promise.all(exits)
+}
+
+async function waitForExit(child: Child): Promise<void> {
+  if (child.process.exitCode === null && child.process.signalCode === null) await once(child.process, "exit")
+}
 
 test("simultaneous acquisition across processes yields one owner", async (t) => {
   const directory = temp(t), start = join(directory, "start")
-  const children = Array.from({ length: 4 }, () => spawn(process.execPath, [
-    "--import", "tsx", fileURLToPath(new URL("./client-state-cross-host-child.ts", import.meta.url)), directory, start,
-  ]) as ChildProcessWithoutNullStreams)
+  const children = Array.from({ length: 4 }, () => child(directory, start))
   try {
-    const results = children.map((child) => new Promise<boolean>((resolve, reject) => {
-      let output = "", errors = ""
-      child.stdout.setEncoding("utf8"); child.stderr.setEncoding("utf8")
-      child.stdout.on("data", (chunk: string) => { output += chunk; if (output.includes("\n")) resolve(JSON.parse(output).acquired) })
-      child.stderr.on("data", (chunk: string) => { errors += chunk })
-      child.once("error", reject)
-      child.once("exit", (code) => { if (!output) reject(new Error(`child ${code}: ${errors}`)) })
-    }))
     writeFileSync(start, "")
-    assert.equal((await Promise.all(results)).filter(Boolean).length, 1)
-  } finally {
-    const exits = children.map((child) => once(child, "exit"))
-    children.forEach((child) => child.stdin.end())
-    await Promise.all(exits)
-  }
+    assert.equal((await Promise.all(children.map(({ result }) => result))).filter(Boolean).length, 1)
+  } finally { await stop(...children) }
 })
 
-test("stale recovery is identity guarded and immutable claims protect successors", (t) => {
+test("owner publication crash leaves no visible owner", async (t) => {
+  const directory = temp(t), start = join(directory, "start")
+  const crashed = child(directory, start, "owner-crash")
+  writeFileSync(start, "")
+  await waitForExit(crashed)
+  assert.equal(existsSync(join(directory, CROSS_HOST_OWNER_DIRECTORY)), false)
+  const winner = CrossHostRegistration.register(directory, owner(101, "winner"), true, dependencies(true, "winner-start"))!
+  assert.equal(winner.isPrimary, true)
+})
+
+test("stale retirement crash cannot retire a successor", async (t) => {
+  const directory = temp(t), staleDirectory = join(directory, CROSS_HOST_OWNER_DIRECTORY)
+  mkdirSync(staleDirectory)
+  writeFileSync(join(staleDirectory, "owner.json"), JSON.stringify(owner(4_000_000_000, "stale")))
+  const start = join(directory, "start"), crashed = child(directory, start, "retire-crash")
+  writeFileSync(start, "")
+  await waitForExit(crashed)
+  const winner = CrossHostRegistration.register(directory, owner(102, "successor"), true, dependencies(true, "successor-start"))!
+  assert.equal(winner.isPrimary, true)
+  assert.equal(JSON.parse(readFileSync(ownerFile(directory), "utf8")).runToken, "successor")
+})
+
+test("stale recovery is identity guarded and blocked by live or uncertain participants", (t) => {
   for (const value of [
-    { name: "dead PID", deps: dependencies(false), recover: true },
-    { name: "PID reuse", deps: dependencies(true, "new-start"), recover: true },
-    { name: "live owner", deps: dependencies(true, "old-start"), recover: false },
-    { name: "uncertain identity", deps: dependencies(true), recover: false },
+    { alive: false, identity: undefined, recover: true },
+    { alive: true, identity: "reused", recover: true },
+    { alive: true, identity: "old-start", recover: false },
+    { alive: true, identity: undefined, recover: false },
   ]) {
-    const directory = temp(t), path = join(directory, CROSS_HOST_OWNER_FILENAME)
-    writeFileSync(path, JSON.stringify(owner(201, "old", "old-start")))
-    const registration = CrossHostRegistration.register(directory, owner(202, "new"), true, value.deps)!
-    assert.equal(registration.isPrimary, value.recover, value.name)
-    registration.release()
+    const directory = temp(t), staleDirectory = join(directory, CROSS_HOST_OWNER_DIRECTORY)
+    mkdirSync(staleDirectory); writeFileSync(join(staleDirectory, "owner.json"), JSON.stringify(owner(201, "old", "old-start")))
+    const registration = CrossHostRegistration.register(directory, owner(202, "new"), true, dependencies(value.alive, value.identity))!
+    assert.equal(registration.isPrimary, value.recover)
   }
 
-  const directory = temp(t), path = join(directory, CROSS_HOST_OWNER_FILENAME)
-  const stale = JSON.stringify(owner(301, "stale"))
-  writeFileSync(path, stale)
-  const first = CrossHostRegistration.register(directory, owner(302, "first"), true, dependencies(false))!
-  assert.equal(first.isPrimary, true)
-  writeFileSync(path, JSON.stringify(owner(303, "replacement")))
-  assert.equal(first.release(), false)
-  assert.equal(JSON.parse(readFileSync(path, "utf8")).runToken, "replacement-run")
+  const directory = temp(t), staleDirectory = join(directory, CROSS_HOST_OWNER_DIRECTORY)
+  mkdirSync(staleDirectory); writeFileSync(join(staleDirectory, "owner.json"), JSON.stringify(owner(301, "dead")))
+  writeFileSync(join(directory, "participant.302.secondary.json"), JSON.stringify(owner(302, "secondary")))
+  const identities = new Map([[302, "secondary-start"]])
+  const blocked = CrossHostRegistration.register(directory, owner(303, "next"), true, {
+    pidAlive: (pid) => pid === 302,
+    processStartIdentity: (pid) => identities.get(pid),
+  })!
+  assert.equal(blocked.isPrimary, false)
 })
 
-test("a surviving opposite-host secondary preserves the cohort barrier", (t) => {
+test("ordinary release removes only its participant", (t) => {
   const directory = temp(t)
-  const identities = new Map([[401, "primary-start"], [402, "secondary-start"]])
-  const deps = { pidAlive: () => true, processStartIdentity: (pid: number) => identities.get(pid) }
-  const primary = CrossHostRegistration.register(directory, owner(401, "primary", "primary-start"), true, deps)!
-  const secondary = CrossHostRegistration.register(directory, owner(402, "secondary", "secondary-start"), true, deps)!
-  assert.equal(secondary.isPrimary, false)
-  assert.equal(primary.release(), false)
-  assert.equal(existsSync(join(directory, CROSS_HOST_OWNER_FILENAME)), true)
-  const successor = CrossHostRegistration.register(directory, owner(403, "successor", "successor-start"), true, deps)!
-  assert.equal(successor.isPrimary, false)
-  successor.release(); secondary.release()
+  const registration = CrossHostRegistration.register(directory, owner(401, "primary"), true, dependencies(true, "primary-start"))!
+  assert.equal(registration.release(), true)
+  assert.equal(existsSync(join(directory, CROSS_HOST_OWNER_DIRECTORY)), true)
+  assert.deepEqual(readdirSync(directory).filter((name) => name.startsWith("participant.") || name.startsWith("retired.")), [])
 })
 
-test("malformed owners fail closed and release never removes another owner", (t) => {
-  const directory = temp(t), path = join(directory, CROSS_HOST_OWNER_FILENAME)
-  writeFileSync(path, "incomplete")
-  const blocked = CrossHostRegistration.register(directory, owner(501, "new"), true, dependencies(false))!
+test("primary crash remains fenced by its live secondary cohort", async (t) => {
+  const directory = temp(t), firstStart = join(directory, "first-start")
+  const primary = child(directory, firstStart), secondary = child(directory, firstStart)
+  writeFileSync(firstStart, "")
+  const roles = await Promise.all([primary.result, secondary.result])
+  const winner = roles[0] ? primary : secondary, survivor = roles[0] ? secondary : primary
+  winner.process.kill()
+  await waitForExit(winner)
+  const blocked = CrossHostRegistration.register(directory, owner(501, "blocked"), true)!
   assert.equal(blocked.isPrimary, false)
-  assert.equal(readFileSync(path, "utf8"), "incomplete")
   blocked.release()
+  survivor.process.kill()
+  await waitForExit(survivor)
+  const successor = CrossHostRegistration.register(directory, owner(502, "successor"), true)!
+  assert.equal(successor.isPrimary, true)
 })
 
-test("Windows home fallback exactly matches the Rust contract", () => {
+test("platform paths match the Rust contract", () => {
   assert.equal(resolveCrossHostElectionDirectory({ HOME: "/Users/dev" }, "darwin", "/fallback"), posix.join("/Users/dev", ".codenomad", "client-state", "election"))
   assert.equal(resolveCrossHostElectionDirectory({ HOME: "/home/dev" }, "linux", "/fallback"), posix.join("/home/dev", ".codenomad", "client-state", "election"))
   assert.equal(resolveCrossHostElectionDirectory({ USERPROFILE: "", HOME: "D:\\Home" }, "win32", "C:\\Fallback"), win32.join("D:\\Home", ".codenomad", "client-state", "election"))
-  assert.equal(resolveCrossHostElectionDirectory({ USERPROFILE: "\\Users\\Dev" }, "win32", "C:\\Fallback"), win32.join("C:\\Fallback", ".codenomad", "client-state", "election"))
 })