fix: fence session admission and runtime hint cleanup

[thymikee]

Summary

Carry the opened lifetime into foreground snapshot resolution and derive its artifact address there. Runtime clear uses the latest matching record before its native effect and refuses to clear a successor’s hints afterward. Pre-open configuration remains address-scoped; shutdown captures hints from the stored address before teardown.

Clipboard refuses retirement before admission and binding. A retired point-touch response skips its optional frame probe without emitting a warning. Correct the replay fixture’s journal address and patch-callback descriptions.

Eighteen files changed. Part of #3116, stacked on #3153; addresses comments on #3150 and #3151.

Validation

Validated 6dbfec9a4b: 57 focused controls across seven files pass; eight new regression cases failed before their fixes. Concrete mutations of runtime-clear lifetime and latest-record checks fail; original bytes restored. Quick checks pass. Fallow reports no new findings; independent read-only review found none.

pnpm check:affected --base refactor/session-fixture-lifetimes-routes --run passes all selected runnable gates and 2,108 tests across 319 files. CI is pending; live evidence for the underlying device routes remains tracked on their owning PRs.

[github-actions]

Size Report

Metric	Base	Current	Diff
Installed (including dependencies)	4.96 MB	4.96 MB	+299 B
Package (unpacked)	4.96 MB	4.96 MB	+299 B
Package (download)	1.49 MB	1.49 MB	+66 B

Startup median (7 runs, lower is better):

Scenario	Base	Current	Diff
CLI --version	25.7 ms	26.2 ms	+0.6 ms
CLI --help	75.9 ms	81.0 ms	+5.1 ms

[cubic-dev-ai]

All reported issues were addressed across 18 files

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[thymikee]

Reviewed 6dbfec9. The shutdown fix has a gap: implicit sessions are not covered by a test or a live run, so this is not ready to merge.

daemon-runtime.ts:461 now finds hints by the store key, so an implicit session (key cwd:<id>:...) is no longer passed empty hints at shutdown. That is the right fix. It also means shutdown now picks finalizeApplicationCloseWithRuntimeHintClearUse and clears Metro and bundle hints on the device for every implicit-session user who ran runtime set. This PR introduces that device-visible effect, so "tracked on owning PRs" does not cover it. No test reaches the closure in startDaemonRuntime. Please add a regression test that drives teardownDaemonSession, or a small exported helper it calls. It should use an implicit cwd-scoped address with transport hints set, and assert that finalize receives those hints, which fails on base. Then please run the route live. Open an implicit Android or iOS session, run runtime set --metro-host X, and stop the daemon. Show the shutdown lifecycle calling clearRuntimeHints with those values in the daemon or request log, and the app's Metro host pref or default gone afterwards. A plain close or an explicit --session run is a neighbouring route and does not count.

Not blocking, take or leave: the test at snapshot-command-runtime.test.ts:151 feeds a retired sessionRef directly, and composeOpenWithInitialSnapshot could not reach that state on base, so this reads as a structural change and not a race fix. ref! at session-runtime-command.ts:139 can narrow on ref instead of session, and hint deletion now has two spellings, setRuntimeHints(addr, undefined) and clearRuntimeHints(ref).

The cubic-dev-ai P3 thread on the single liveness check in touch response still applies: #3154 (comment)

Coverage and two Smoke Tests jobs are still pending, and Repo Guards, Integration, Typecheck and two Smoke jobs pass at this commit. Nothing has failed, and Smoke covers the open, snapshot and click routes this diff touches, so a failure there would count. I ran no tests and read the code only. I also did not confirm live that implicit sessions publish with a name different from the address. I inferred it from the cwd scoping in session-routing.ts and from the scoped-address fixtures in this PR. No conflicts. Before merge, the implicit-session shutdown test and the live run are needed.

[thymikee]

Implemented the owning-helper correction in #3170 (07a82a682374f970abb80edac24330ac582881a7) and completed the implicit-session shutdown control on the owned iOS Simulator.

The regression tests pass a cwd-scoped ref alongside a separate public-name slot with different hints. Shutdown captures the scoped values before awaiting cleanup. A retired ref cannot adopt a successor's hints. Four cases failed before the fixes; all 28 focused controls now pass. The full deterministic gate also passes: 12,241 unit tests plus tooling, packaging, leak checks and smoke controls.

Live sequence, with no --session and no close:

node bin/agent-device.mjs open settings --platform ios \
  --udid 39177FA7-6B35-4A10-84BB-23DA353990FD \
  --state-dir /private/tmp/3116-live-shutdown \
  --metro-host ownership-3116.invalid --metro-port 8123 --foreground --json
# runtime set over the authenticated client transport to this existing daemon
node bin/agent-device.mjs daemon stop \
  --state-dir /private/tmp/3116-live-shutdown --clean --json

The transport probe asserted that PID/start-time identity stayed unchanged. It sent command: "runtime", positionals: ["set"], session: "default", the same platform/hints and the checkout's meta.cwd; it did not set meta.sessionExplicit. runtime has no public CLI command.

Observed results:

{
  "head": "07a82a682374f970abb80edac24330ac582881a7",
  "session": {"name": "default", "address": "cwd:bd54d58de95a06c0:ios"},
  "runtimeSet": {"daemonUnchanged": true, "ok": true, "session": "cwd:bd54d58de95a06c0:ios", "metroHost": "ownership-3116.invalid", "metroPort": 8123},
  "nativeBefore": {"RCT_jsLocation": "ownership-3116.invalid:8123", "RCT_packager_scheme": "http"},
  "stop": {"stopped": true, "mode": "graceful", "cleanupConfidence": "known", "claimsReleased": 1, "warnings": [], "clean": true},
  "nativeAfter": {"RCT_jsLocation": "missing (defaults exit 1)", "RCT_packager_scheme": "missing (defaults exit 1)"}
}

The open request log records both native defaults write effects. The before/after reads prove shutdown reached native hint clearing; the tests assert the values passed at the helper boundary. The owned daemon and runner were cleaned. This establishes the scoped shutdown behavior, without claiming unchecked replacement schedules occur in ordinary locked requests.

[thymikee]

Thanks for the live run. It covers the shutdown route I asked about: the implicit session's Metro hints were set, and after daemon stop the native values were gone. The regression tests live in #3170, which I reviewed as ready at 07a82a6. This PR at 6dbfec9 still has no test that reaches the shutdown closure, so it is ready once #3170 lands with it or its tests move here.

[thymikee]

Consolidated into #3144 as part of reducing #3116 to seven PRs. The composition preserves the complete pre-consolidation source tree, including tests and later review corrections. This PR is superseded; its review discussion and native evidence remain available. Outstanding findings transfer to the owning keeper in the implementation record.

[github-actions]

PR Preview Action v1.8.1
Preview removed because the pull request was closed.
2026-10-03 21:19 UTC