rushd: WS3/WS4 integration with Reporter prerequisites

[Sean Larkin (TheLarkInn)]

Purpose

Implementation for #5894, focused on WS3 (#5898) and WS4 (#5899), with the Reporter prerequisites from #5858.

Tracks #5898 and #5899. The reviewed correction checkpoint has passed hosted validation; issue closure and merging remain subject to maintainer acceptance of the documented scope and subsequent upstream reconciliation.

Acceptance review status

A fresh review of all 14 PRs identified 23 actionable findings, posted on their owning PRs before fixes. Correction commits are now published on their owning Reporter PRs and integrated here at f338af94aa563b93690720c2e226e8cfb6346bdf. This includes unexpected aggregate cleanup failures, sticky mutation-worker ownership, client terminal/admission/log-follow behavior, real opt-in production telemetry, and the Reporter foundation, presentation, bootstrap, Heft, qualification and documentation corrections.

All 16 Reporter component/follow-up findings have passed corrected-head six-platform validation and are resolved. #5991's single investigated unchanged-benchmark retry passed without a source or threshold change. #5999's actual Windows output correction is published at f637c707c5; its first new-head run 34390898209 passed all six complete workflows. The original Windows ratio failure and setup-timeout evidence remain recorded rather than being relabeled as passes.

All 23 review findings are now fixed, published, verified and resolved. The seven integration findings passed CI 34396595826 on f338af94aa, with all six complete workflows, CodeQL and CLA successful. This head includes the actual-platform follow-ups and main@968beba488 from #5941. Independent component reviews and merge/release gates remain separate.

Upstream subsequently advanced to main@67ca939091 (#5939, rush-lib native-private members) while that matrix was running. Its bounded reconciliation is published as 111aa48943811a873e600b178d029a138628fd7f, with parents f338af94aa and 67ca939091. That exact head has now also passed all six complete workflows in CI 34407038542, plus CodeQL and CLA. No prior checkpoint result is substituted for the current-head result.

The existing rush and rushx defaults are unchanged. The separate rush-client and rushx-client binaries remain opt-in. This does not perform the Rush 6 cutover or close the full epic.

Implemented

• Native warm build/rebuild execution and real Rushx package scripts, with immutable request inputs, byte-preserving global streams, stdin credits/EOF, cancellation, queue controls, and fail-closed no-replay behavior.
• Generation-safe fingerprint reloads, bounded pre-execution restart retry, attested version-selected launchers, detached startup/crash handoff, idle shutdown, and native install/update results delivered before cleanup and successor startup.
• Generation-fenced structured graph commands, automatic warm-controller ownership, deterministic LRU/telemetry retention, observation-only daemon.watch, and live generation/reload/resource status without initializing a cold graph.
• Reporter integration and reviewed fixes for bootstrap control ownership, structured output capture, watch presentation, and reporter timer cleanup.

Reporter dependency stack

This branch preserves all original Reporter branch histories. Their changes remain in this diff until the existing PR stack lands; this integration PR is not a substitute for reviewing that stack.

Phase	Existing PR
R2A configuration	#5987
R2B frontend controls	#5989
R3A session sink	#5988
R3B shadow events	#5991
R3C parity	#5992
R4A telemetry/privacy	#5990
R5A operation adapter	#5996
R5B reporters	#5997
R6A bootstrap handoff	#5993
R7A Heft negotiation	#6000
R8A AI qualification	#5999
R10A demo/docs	#5998

R9 (#5982), R11 (#5984), and WS5 (#5900) remain subject to their actual review, compatibility, and release/ecosystem gates. No legacy-removal or default-selection gate is bypassed.

The Reporter stack has been restacked onto main@77abfe24 with guarded pushes and preserved backup refs. The scoped follow-up fixes are in #6019. Independent approval and dependency-ordered landing remain separate from this integration PR.

This PR is ready for review. Independent approval and the Reporter prerequisite landing order still apply before merge; the opt-in clients do not require the later default-selection cutover.

Windows correction batch

• Clients, launchers, and sessions use native physical filesystem identity consistently. Rushx separately preserves validated invocation spelling, including Windows 8.3 names and junctions, for child cwd, lifecycle environment, registration diagnostics, and pnpm-sync. Exact native output assertions are retained; output is never rewritten to manufacture parity.
• The shared LockFile Windows implementation now uses actual kernel exclusive sharing instead of assuming exclusive creation remains exclusive after opening. A dirty companion preserves interrupted-owner state across close/delete handoffs. This correction applies to all Windows LockFile consumers, not only the daemon; no native addon or dependency is added.
• Native rush purge retains its own active repository lock and Windows dirty companion while removing other temporary files. The regression verifies that purging does not delete live ownership or bypass the mutex.
• Native operation environments retain case-insensitive Windows Path values. Startup handoff treats sharing-denied ownership reads as unknown, not released, and retries only within the existing deadline. Owned child resources are joined before bounded Windows fixture cleanup.
• Native IPC fixtures launch a real Node IPC child instead of relying on cmd.exe to forward the descriptor. Graph CLI scenarios are separated, Windows cancellation exercises the actual CLI signal handler, and graph reload setup is separated from its assertions. Production startup deadlines and no-replay rules are unchanged.
• Native CLI test continuations are bound to their own fixtures and joined completely before deletion, including owned graph watches registered during cleanup. Initial daemon preparation is separated from reload/restart assertions; a timed-out callback cannot start work in, or remove, the next test's repository.
• Native Rushx registration lookup is unchanged unless the caller explicitly supplies a different invocation namespace. Embedded frontend tests capture and release their real parser locks after execution; production lock lifetimes and existing native snapshots are unchanged.
• Generated Git fixtures set core.autocrlf=false locally so host-global Windows settings do not produce LF-to-CRLF warnings. User Git settings and CI warnings-as-errors are unchanged. The real native graph suite uses an explicit 15-second integration budget after repeated setup timeouts, without changing assertions, cleanup limits, or production deadlines.
• Linux global requests wait for their captured detached group/session to settle before completion, not merely for signal delivery or leader stream closure. The bounded inspection uses procps-compatible ps --sid, never resends signals while waiting, and surfaces inspection/timeout failures.
• Remaining launcher fixtures join the actual daemon PIDs returned by start/restart before bounded Windows cleanup. Graph fixtures are removed only after successful host closure. Retention-only fixtures are isolated from accumulated Jest-worker RSS; production memory defaults and dedicated pressure tests are unchanged.

Current correction validation

Current verified head: 111aa48943811a873e600b178d029a138628fd7f. Current CI: 34407038542, SUCCESS. All six platform jobs passed the complete build/test, package-manager, README, second-checkout and repeated-cache stages, with current-head CodeQL and CLA also successful. All review threads are resolved; independent maintainer approval and dependency-ordered landing remain outstanding.

The bounded rush-lib reconciliation resolves 41 conflict hunks across 12 files and checks 658 incoming native-private members, with no stale converted accesses. It retains the WeakMap-backed scoped RushSession facade state, all reviewed lifecycle/ownership behavior, public APIs, thresholds and deadlines. Local validation includes the full 971-case Rush-lib suite plus frontend, daemon, public client, renderer and SDK checks. The parent independently reran 522 coupled/full-package cases; these counts overlap and are not summed as distinct coverage.

Verified review checkpoint: f338af94aa563b93690720c2e226e8cfb6346bdf. Hosted CI: 34396595826, SUCCESS. All six platform jobs completed the full build/test, package-manager, README, second-checkout and repeated-cache stages; that exact head's CodeQL and CLA also passed. Separate local affected-package selections report 1,177 passes and no failures: 465 Reporter functional/performance, 128 frontend, 192 standalone-client, 357 daemon, 22 transport and 13 terminal-renderer cases. The daemon runner reported 358 total cases with one not executed. The local selections are not substituted for the completed hosted matrix.

The exact built local AI corpus passes all unchanged gates: 45.8605% of legacy bytes, 43.4462% of plaintext bytes, 100% actionability/privacy/full-log/determinism, and a 34,100-byte maximum invocation boundary against 65,536 bytes. Actual Windows 24 and 26 measure 48.1435% of legacy bytes and pass the same gates. Only already-superseded, unrendered metadata-only start acknowledgements are coalesced; final fields, supplied log paths, active status and watch order remain intact. All 13 comparison fixtures, both baselines, the 3% wall-time gate and the 32 MiB gate are unchanged.

The production telemetry path has real public-CLI evidence on Linux and Windows: persistent PIDs and positive measured RSS/timing, independently calculated scores, opposite score/recency order, and different actual eviction under telemetry versus LRU, including joined child/watcher cleanup. The final retention fixture selects roles from actual measurements and computes at most three unchanged public requests to establish strict opposite order without additional script execution. Real pressure work uses a one-shot live RSS barrier rather than a stale allocation estimate. Both Windows 24 and 26 also prove the reversed-label case. Production scoring, the 512 MiB test budget, the 60-second test limit and exact winner/closure assertions are unchanged; no runner, clock or RSS injection supplies the evidence.

CI 34360232913 on the preceding 36d3889452 head passed all four Linux configurations but exposed Windows log-follow cancellation behind blocked stdout. The correction now uses a bounded, acknowledged, output-only process for redirected Windows following, keeping the CLI responsive and joining the writer before exit 130. The actual Linux, Windows 24 and Windows 26 selections each pass 16 cases, including the unchanged watchdog, real handler delivery, broken pipes, file redirection and parent-loss cleanup. The CLI itself is not watchdog-killed or relabeled as a successful cancellation.

The retained-ownership fixture closes its captured listener only after joining cleanup. The output-writer owner-loss fixture now checks captured process identity and executable/resource exit within its original three-second deadline, instead of treating PID existence as liveness. A controlled Linux subreaper reproduced the old assertion failure with a resource-free zombie; the CI logs alone did not establish that state. The fix rejects live writers or retained descriptor tables and avoids following a reused PID. Production cancellation and fail-closed ownership remain unchanged.

The latest upstream private-member refactor introduced seven textual conflicts plus one auto-merged stale version-field reference. Their reconciliation retains reporter opt-in/temp-folder metadata, lifetime-owned listener release, atomic lease downgrades, failed-cleanup ownership, restart completion, streaming UTF-8 decoding, stderr/newline fidelity and shared operation headers while adopting native private members. Strict package lint rules were not suppressed or weakened.

Historical green baseline

Hosted regression acceptance passed on 7d503052a5162a572504dc4143058320cbfdd0d9, run 34288591055. This integrates main@78b650d6 (the upstream Heft/core native-private-member refactors). The three Heft conflicts were resolved without dropping negotiated child reporting or scoped diagnostic accounting.

The results below belong only to that earlier main-synchronization head, not the current correction head. The previous accepted baseline, ba5753a9f146325deccb49e5aea485c6ba5aa3e2 / run 34217211265, remains recorded separately.

Runtime	Platform	Result
Node 20	Ubuntu	PASS
Node 22	Ubuntu	PASS
Node 24	Ubuntu	PASS
Node 26	Ubuntu	PASS
Node 24	Windows	PASS
Node 26	Windows	PASS

Every job on the historical 7d503052a5 baseline completed the full repository build/test run, package-manager integration, generated README verification, second-checkout update/build/test, and repeated build-cache verification. CodeQL and license/CLA also passed on that exact head.

Coverage includes actual CLI install/update, native coexistence, same-PID reloads, new-PID successors, startup-client death, ownership failures, graph-token races, real warm policies, ordinary CLI status, native Windows mutex/purge behavior, and exact Rushx parity through physical paths and 8.3 aliases.

All blocking Reporter qualification and performance gates remain enforced. Earlier failure logs and diagnostic observations are retained separately; the historical green run used committed test budgets and the full workflow, without temporary diagnostic overrides or relaxed quality thresholds. It does not replace the fresh acceptance findings or the new correction-head checks.

The opt-in registry integration also exercised a genuine published foreign-engine installation and runtime/protocol attestation. Incompatible installed engines are refused rather than relabeled as supported.

Deliberate safety boundaries

• Unsupported native configurations and incompatible published launchers retain explicit pre-execution native fallback; transport loss or possibly executed work is never replayed.
• Persistent Node execution requires both false-default daemon.usePersistentIpcRunners and a per-operation daemonIpc descriptor. It supports unsharded incremental operations, uses raw argv without shell reinterpretation, and remains non-cacheable. Rebuild, native NoOp/missing-script behavior, preassigned shards and existing watch-only IPC behavior are preserved.
• The descriptor entrypoint must be in a dedicated implementation subdirectory, bounded to 256 entries, 16 levels and 8 MiB. Imports outside that tree, except Node built-ins, are unsupported rather than claimed as tracked; third-party implementation code must be bundled into the tree.
• Warm memory limits are best-effort sampled accounting, not a hard process-tree RSS ceiling. Active/protected work is not evicted.
• daemon.watch controls host project observation, not autonomous script execution or native Rush watch mode.
• Ambiguous pre-bind launcher failure retains its startup reservation instead of guessing that a PID can be killed or reclaimed.
• Abandoned-handoff cleanup applies only to verifiably owned dead entries. Live/current/foreign and ownership-unverifiable files remain protected, including platforms without a usable UID.
• The inherited WS1 envelope/default-renderer constraints are documented in the standalone-client README. This does not claim the later coordinated wire/default-selection cutover or close the full epic.

[Sean Larkin (TheLarkInn)]

Final review/fix handoff: all14 logical-stack PRs were reviewed against their linked issues, and all23 review findings were posted before their fixes, corrected on the owning PRs, verified, and resolved. The bounded upstream reconciliation is now published at 111aa48, including main67ca939091. CI34407038542 passed all six complete platform workflows, including both Windows runtimes, package-manager integration, README verification, second-checkout tests and repeated-cache checks. Current-head CodeQL and CLA also pass; no unresolved review threads remain.

The original output, privacy, actionability, memory/performance and cancellation gates were preserved. Scope limits remain documented: explicit opt-in Node IPC is unsharded/non-cacheable with a bounded implementation tree; ownership-unverifiable handoffs stay protected; no default-selection or full-epic cutover is claimed.

This is not an independent approval, PR merge or npm release. Required maintainer/code-owner approval, dependency-ordered landing, and retargeting #6019 away from its temporary review baseline remain separate gates.

[Sean Larkin (TheLarkInn)]

Published 6a3fc846e39dfa32ee421ce896405aad87a9856b with a test-only correction for a demonstrated IPC-retention pressure precondition defect.

A real working-set trim of the verified fixture-owned Windows 24 daemon reduced RSS between allocation sizing and admission release. Combined RSS remained below the 512 MiB budget, so maintenance correctly retained both projects while the fixture incorrectly expected one. This proves the fixture defect, not the precise cause of the uninstrumented hosted failure.

The same public IPC request now remains admitted while the fixture measures actual RSS, performs at most one bounded adjustment, and verifies real pressure plus single-runner headroom before releasing admission. All four real policy cases, exact retained/watched/generation assertions, memory budgets and existing deadlines remain unchanged. Production and API code are unchanged.

The same controlled native counterexample failed before and passed after. Normal Windows 24, Windows 26 and Linux each passed 11 focused cases, including all four real retention cases; build/types/lint passed.

Fresh full CI run 34574532587 is in progress on the new head. The previous Windows 24 failure is preserved, not waived or repeatedly retried. Independent approval and prerequisite landings remain required.

[Sean Larkin (TheLarkInn)]

Published both fixture corrections together at e380ab28ec8d38bd9b193a6c01850d1737fc6798 (atomic-publication commit 72219c9 plus the daemon-setup ownership correction).

The Linux 24 failure was a created-but-not-completely-written release JSON file. Allocation, adjustment, release, cancellation and fixture inputs now publish a closed owned temporary sibling atomically; event logs use complete NDJSON frames and current request identity. Malformed completed data still fails explicitly.

The Windows 26 failure exposed unowned initialization after a setup-hook timeout. Teardown now cancels and joins late creation and disposal before using the fixture, preserving both original setup and cleanup errors. A forced 5,000 ms timeout still fails its case, without the secondary undefined-disposal error or leaked host/folder.

The exact nine-path union is test/helpers and two type-none change notes only. Production, APIs, configuration, defaults, memory budgets, original retention assertions and all existing deadlines are unchanged.

On the actual combined head, Linux 24 passed app 36/36 and daemon 29/29; one full uninstrumented serial Windows 26 qualification passed app 36/36 and daemon 14/14. This closes the earlier local full-run qualification gap; it does not claim the prior intermittent startup/timing cause was eliminated. Previous Windows 24 evidence is reused only by exact source/runtime identity, not represented as a new combined run.

Hosted CI verified September 11 at 11:29 UTC: 34584314860 attempt 2 passed all six complete platform workflows and every current check on e380ab28. A single evidence-backed Windows 24-only retry succeeded after nested build-setup hook timeouts; the other five successful results were retained. No source, deadline, assertion or quality gate changed for that retry. Earlier failures remain archived and their timing cause is not claimed eliminated. All six remaining PRs are now CI-green, but independent approval, prerequisite landings and the proper #6019 landing base remain required.