test(lifecycle): verify interruption recovery

Author: TrentBrown

docs/issues/tb-portreeve-desktop-lifecycle-service/issues.md

@@ -61,7 +61,7 @@ copyable renderer-safe failures.
 
 ## I-5 - Verify packaging and both JavaScript runtimes
 
-- **Status:** in-review
+- **Status:** closed
 - **Estimate:** 1d
 - **Plan steps:** P6
 - **Rubric criteria:** R1, R3, R8
@@ -74,7 +74,7 @@ packaged smoke behavior.
 
 ## I-6 - Complete native lifecycle and interruption verification
 
-- **Status:** open
+- **Status:** in-progress
 - **Estimate:** 1.5d
 - **Plan steps:** P7
 - **Rubric criteria:** R1, R2, R3, R4, R5, R6, R7, R8

docs/issues/tb-portreeve-desktop-lifecycle-service/scratchpad.md

@@ -113,3 +113,21 @@ Inspect only minified bundle strings - rejected because string presence cannot
 prove which source modules entered the bundle. Exercise lifecycle mutations from
 the package smoke - rejected because packaging verification must be safe on a
 developer's ordinary machine; isolated native mutation coverage belongs to P7.
+
+## [8] Separate interruption recovery from native host mutation evidence
+
+[ ] **Promote**
+
+**Confidence:** HIGH
+
+**Blast Radius:** Final lifecycle verification, cross-process fixtures, Desktop close integration tests, and release evidence
+
+Verify caller death at the shared lifecycle-service boundary with a real second process holding the Unix listener lease: a contender must receive lifecycle_busy while status and purge preview remain available, then SIGKILL the holder and prove a new service instance recovers through fresh status evidence and completes a mutation. Separately bind the real Desktop coordinator to both window and application close guards during a pending direct-controller mutation. Use the existing isolated native release matrix for real launchd and systemd-user mutations. Together these tests cover distinct authorities without adding a dangerous packaged-app mutation backdoor.
+
+**Triggered by:** P7 requires force-interruption recovery, live Desktop close protection, and real launchd/systemd-user evidence without pretending a normal close can prevent SIGKILL
+
+**Alternatives considered:**
+Treat the existing raw lock test as sufficient - rejected because it does not
+exercise canonical busy results, concurrent reads, or service-owned recovery.
+Add a mutation-capable packaged Desktop test hook - rejected because it would
+ship unnecessary privileged mutation authority solely for verification.

docs/issues/tb-portreeve-desktop-lifecycle-service/tracker.md

@@ -60,7 +60,7 @@
 ### PR #41 - Desktop packaging and runtime parity
 
 - **Scope:** I-5; P6; advances R1, R3, and R8.
-- **Status:** In review; feature-level rubric criteria remain `NOT YET` until
+- **Status:** Merged; feature-level rubric criteria remain `NOT YET` until
   final native lifecycle and interruption verification completes.
 - **Evidence:** [PR 41 boundary packet](pr-41/boundary.json)
 - **Decision:** Fail packaging on controller/artifact drift, inspect the final

test/desktop/window-refresh.test.js

@@ -7,6 +7,8 @@ import {
   bindWindowCloseGuard,
   bindWindowRefresh,
 } from '../../apps/desktop/main/window.js';
+import { createStateCoordinator } from '../../apps/desktop/main/coordinator.js';
+import { lifecycleSnapshot, provisionalArtifact, timestamp } from './fixtures.js';
 
 test('refreshes on focus and pauses polling while hidden or minimized', async () => {
   const events = new EventEmitter();
@@ -129,3 +131,80 @@ test('blocks application quit while a lifecycle mutation is active', () => {
   unbind();
   expect(events.listenerCount('before-quit')).toBe(0);
 });
+
+test('binds both close guards to a real pending coordinator lifecycle mutation', async () => {
+  /** @type {(value?: void) => void} */
+  let releaseStart = () => {};
+  const startGate = new Promise((resolvePromise) => {
+    releaseStart = resolvePromise;
+  });
+  const coordinator = createStateCoordinator({
+    artifact: provisionalArtifact(),
+    lifecycle: {
+      clearPurgePreview() {},
+      async start() {
+        await startGate;
+        const status = lifecycleSnapshot();
+        return {
+          operation: 'start',
+          outcome: 'succeeded',
+          changed: true,
+          startedAt: timestamp,
+          completedAt: timestamp,
+          before: status,
+          after: status,
+          error: null,
+        };
+      },
+      status: async () => lifecycleSnapshot(),
+    },
+    inventory: { listPorts: async () => [] },
+    now: () => new Date(timestamp),
+  });
+  const windowEvents = new EventEmitter();
+  const applicationEvents = new EventEmitter();
+  /** @type {unknown[]} */
+  const blocked = [];
+  bindWindowCloseGuard(/** @type {any} */ (windowEvents), coordinator, (state) =>
+    blocked.push(state),
+  );
+  const unbindApplication = bindApplicationCloseGuard(
+    /** @type {any} */ (applicationEvents),
+    coordinator,
+    (state) => blocked.push(state),
+  );
+  let prevented = 0;
+  const event = {
+    preventDefault() {
+      prevented += 1;
+    },
+  };
+
+  const mutation = coordinator.startService();
+  await Bun.sleep(0);
+  windowEvents.emit('close', event);
+  applicationEvents.emit('before-quit', event);
+  expect(prevented).toBe(2);
+  expect(blocked).toHaveLength(2);
+  expect(blocked).toEqual([
+    {
+      schemaVersion: 1,
+      allowed: false,
+      lifecycle: { operation: 'start', startedAt: timestamp },
+      attached: [],
+    },
+    {
+      schemaVersion: 1,
+      allowed: false,
+      lifecycle: { operation: 'start', startedAt: timestamp },
+      attached: [],
+    },
+  ]);
+
+  releaseStart();
+  await mutation;
+  windowEvents.emit('close', event);
+  applicationEvents.emit('before-quit', event);
+  expect(prevented).toBe(2);
+  unbindApplication();
+});

test/fixtures/lifecycle-service-holder.js

@@ -0,0 +1,21 @@
+// @ts-check
+
+import { createLifecycleService } from '../../src/supervision/service.js';
+import { lifecycleSnapshot } from '../desktop/fixtures.js';
+
+const lockPath = process.argv[2];
+if (lockPath === undefined) throw new Error('Lifecycle lock path is required.');
+
+const service = createLifecycleService({
+  manager: /** @type {any} */ ({
+    paths: { lifecycleLockPath: lockPath },
+    status: async () => lifecycleSnapshot(),
+    async restart() {
+      process.stdout.write('mutating\n');
+      await new Promise(() => {});
+    },
+  }),
+  operationTimeoutMilliseconds: 10 * 60 * 1000,
+});
+
+await service.restart();

test/supervision/lifecycle-process.test.js

@@ -0,0 +1,141 @@
+// @ts-check
+
+import { expect, test } from 'bun:test';
+import { spawn } from 'node:child_process';
+import { mkdtemp, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { createLifecycleService } from '../../src/supervision/service.js';
+import { lifecycleSnapshot, timestamp } from '../desktop/fixtures.js';
+
+test.skipIf(process.platform === 'win32')(
+  'refuses a real process contender, keeps reads live, and recovers after SIGKILL',
+  async () => {
+    const directory = await mkdtemp(join(tmpdir(), 'portreeve-service-process-'));
+    const lockPath = join(directory, 'runtime', 'lifecycle.sock');
+    const helper = fileURLToPath(
+      new URL('../fixtures/lifecycle-service-holder.js', import.meta.url),
+    );
+    const holder = spawn(process.execPath, [helper, lockPath], {
+      stdio: ['ignore', 'pipe', 'pipe'],
+    });
+    try {
+      await waitForOutput(holder, 'mutating\n');
+      let enteredStop = false;
+      const contender = serviceFor(lockPath, {
+        async stop() {
+          enteredStop = true;
+          return { changed: true };
+        },
+      });
+      const startedAt = performance.now();
+      const refused = await contender.stop();
+      expect(performance.now() - startedAt).toBeLessThan(1_000);
+      expect(enteredStop).toBe(false);
+      expect(refused).toMatchObject({
+        operation: 'stop',
+        outcome: 'refused',
+        changed: false,
+        error: { code: 'lifecycle_busy' },
+      });
+      expect((await contender.status()).mode).toBe('supervised');
+      expect(await contender.previewPurge()).toMatchObject({
+        operation: 'purge',
+        dryRun: true,
+        allowed: true,
+      });
+
+      holder.kill('SIGKILL');
+      await waitForExit(holder);
+
+      let enteredRestart = false;
+      const nextLaunch = serviceFor(lockPath, {
+        async restart() {
+          enteredRestart = true;
+        },
+      });
+      expect(await nextLaunch.restart()).toMatchObject({
+        operation: 'restart',
+        outcome: 'succeeded',
+        changed: true,
+        error: null,
+      });
+      expect(enteredRestart).toBe(true);
+      expect((await nextLaunch.status()).mode).toBe('supervised');
+    } finally {
+      if (holder.exitCode === null && holder.signalCode === null) {
+        holder.kill('SIGKILL');
+        await waitForExit(holder);
+      }
+      await rm(directory, { recursive: true, force: true });
+    }
+  },
+);
+
+/** @param {string} lockPath @param {Record<string, unknown>} operations */
+function serviceFor(lockPath, operations) {
+  return createLifecycleService({
+    manager: /** @type {any} */ ({
+      paths: { lifecycleLockPath: lockPath },
+      status: async () => lifecycleSnapshot(),
+      previewPurge: async () => ({
+        operation: 'purge',
+        dryRun: true,
+        allowed: true,
+        confirmationToken: 'a'.repeat(64),
+        root: '/isolated/portreeve',
+        marker: null,
+        status: lifecycleSnapshot(),
+        paths: [],
+        refused: [],
+      }),
+      ...operations,
+    }),
+    operationTimeoutMilliseconds: 5_000,
+    readTimeoutMilliseconds: 2_000,
+    recoveryTimeoutMilliseconds: 2_000,
+    now: () => new Date(timestamp),
+  });
+}
+
+/** @param {import('node:child_process').ChildProcess} child @param {string} expected */
+function waitForOutput(child, expected) {
+  return new Promise((resolvePromise, reject) => {
+    let output = '';
+    let settled = false;
+    const timeout = setTimeout(
+      () => reject(new Error(`Lifecycle holder did not emit ${expected.trim()}.`)),
+      3_000,
+    );
+    /** @param {() => void} callback */
+    const settle = (callback) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timeout);
+      child.removeListener('exit', onExit);
+      callback();
+    };
+    /** @param {number|null} code @param {NodeJS.Signals|null} signal */
+    const onExit = (code, signal) =>
+      settle(() =>
+        reject(
+          new Error(
+            `Lifecycle holder exited before readiness (${String(code ?? signal)}).`,
+          ),
+        ),
+      );
+    child.stdout?.setEncoding('utf8');
+    child.stdout?.on('data', (chunk) => {
+      output += chunk;
+      if (output.includes(expected)) settle(() => resolvePromise(undefined));
+    });
+    child.once('exit', onExit);
+  });
+}
+
+/** @param {import('node:child_process').ChildProcess} child */
+function waitForExit(child) {
+  if (child.exitCode !== null || child.signalCode !== null) return Promise.resolve();
+  return new Promise((resolvePromise) => child.once('exit', resolvePromise));
+}