refactor: remove unrestricted session upsert and deletion

docs/adr/0030-process-lock-exclusion.md

@@ -40,6 +40,32 @@ guard cannot constrain legacy code after its final check. The support boundary t
 requires deployment control; host-kit does not claim to detect or evict every legacy user.
 
 Daemon registration has a separate cutover boundary: keep the same `daemon.lock` path and
-refuse legacy files rather than automatically reclaiming them. Its startup tests must cover
-an already-running older daemon and concurrent old/new startup. This does not expand the
-host-kit mixed-protocol support contract.
+refuse legacy files rather than automatically reclaiming them. A legacy daemon creates an
+exclusive file; a hardened daemon creates a directory at that same path. The old acquisition
+cannot unlink a directory, and the new acquisition retains an existing file.
+
+The [registration tests](../../src/__tests__/daemon-registration-owner.test.ts) exercise real
+children using the c237027737 legacy acquisition and the current owner. They cover an older
+daemon already running, a hardened owner waiting to publish metadata, and concurrent startup.
+The client refuses an older registration before signaling or changing it. This proves the daemon
+cutover; it does not expand the host-kit mixed-protocol support contract. Older clients still
+require the deployment controls above.
+
+## Registration operations
+
+[Shared retirement](../../src/daemon-registration-owner.ts) owns verified termination, protected
+metadata inspection and removal, and release. Takeover, failed startup, replay cleanup, timeout
+reset and manual stop await its result. Abandoned recovery uses the same protected retirement
+sequence without signaling a live process. Daemon publication and shutdown use functions bound
+to their acquired claim.
+
+```mermaid
+flowchart LR
+    C[Client lifecycle and timeout] --> R[Shared retirement]
+    M[Manual stop] --> R
+    P[Abandoned recovery and pruning] --> R
+    R --> L[Acquired registration claim]
+    D[Daemon startup and shutdown] --> O[Functions bound to own claim]
+    O --> L
+    L --> F[Protected metadata and reports]
+```

packages/capture-kit/src/capture-admission/__tests__/audio-probe-session-resource.test.ts

@@ -1,3 +1,4 @@
+import { makeCaptureSessionBinding } from '../../durable-capture/session-binding.fixtures.ts';
 import fs from 'node:fs/promises';
 import path from 'node:path';
 import { expect, test, vi } from 'vitest';
@@ -44,6 +45,10 @@ test('audio-probe disposes on a failed finish because terminating the helper is
   );
   const session: DurableCaptureSessionState = {};
   sessionStore.set(sessionName, session);
+  const binding = makeCaptureSessionBinding(sessionStore, sessionName, {
+    read: (session) => session.audioProbe,
+    replace: (session, audioProbe) => ({ ...session, audioProbe }),
+  });
   const statusPath = path.join(sessionStore.resolveSessionDir(sessionName), 'audio-probe.json');
   const terminate = vi.fn(async () => {});
   let resolveExit!: (result: HostCommandResult) => void;
@@ -85,9 +90,7 @@ test('audio-probe disposes on a failed finish because terminating the helper is
   });
   await adoptStartedAudioProbe({
     admissionLedger: createAudioProbeAdmissionLedger(),
-    session,
-    sessionName,
-    sessionStore,
+    binding,
     device,
     owner: localRuntimeOwner('apple'),
     fence,
@@ -101,9 +104,7 @@ test('audio-probe disposes on a failed finish because terminating the helper is
   await expect(
     finishLiveAudioProbe({
       intent: 'capture',
-      session: sessionStore.get(sessionName) ?? session,
-      sessionName,
-      sessionStore,
+      binding,
     }),
   ).rejects.toThrow('helper exited before completing the capture');
 

packages/capture-kit/src/capture-admission/__tests__/durable-capture-resource.fixtures.ts

@@ -1,3 +1,4 @@
+import { makeCaptureSessionBinding } from '../../durable-capture/session-binding.fixtures.ts';
 import { vi } from 'vitest';
 import type { AppLogCompletion, AppLogLiveHandle } from '@agent-device/contracts/app-log-runtime';
 import type { CleanupOutcome, FinishOutcome } from '@agent-device/contracts/durable-resource';
@@ -30,19 +31,10 @@ export const testCaptureStore = createDurableCaptureResourceStore({
 export function createTestCaptureResource(
   store: DurableCaptureResourceStore<'app-log'> = testCaptureStore,
 ) {
-  return createDurableCaptureResource<
-    'app-log',
-    AppLogLiveHandle,
-    AppLogCompletion,
-    TestCaptureSession
-  >({
+  return createDurableCaptureResource<'app-log', AppLogLiveHandle, AppLogCompletion>({
     resourceKind: 'app-log',
     displayName: 'test capture',
     store,
-    sessionSlot: {
-      read: (session) => session.appLog,
-      replace: (session, appLog) => ({ ...session, appLog, appLogFailure: undefined }),
-    },
     completionMetadata: (completion) => ({
       outputPath: completion.outputPath,
       completedAt: completion.completedAt,
@@ -72,6 +64,10 @@ export function makeDurableCaptureContext(
   const session: TestCaptureSession = {};
   sessionStore.set(sessionName, session);
   return {
+    binding: makeCaptureSessionBinding(sessionStore, sessionName, {
+      read: (session) => session.appLog,
+      replace: (session, appLog) => ({ ...session, appLog, appLogFailure: undefined }),
+    }),
     admissionLedger: createDurableCaptureAdmissionLedger({ displayName: 'test capture' }),
     session,
     sessionName,

packages/capture-kit/src/capture-admission/__tests__/durable-capture-resource.test.ts

@@ -25,9 +25,7 @@ test('one coordinator exposes the typed manifest and all lifecycle entrypoints',
   await expect(
     testCaptureResource.finishLive({
       intent: 'capture',
-      session: active,
-      sessionName: context.sessionName,
-      sessionStore: context.sessionStore,
+      binding: context.binding,
     }),
   ).resolves.toMatchObject({ outputPath: '/tmp/app.log', completedAt: 2 });
   expect(context.sessionStore.get(context.sessionName)?.appLog).toBeUndefined();

packages/capture-kit/src/capture-admission/__tests__/screen-recording-boundary-faults.test.ts

@@ -1,3 +1,4 @@
+import { makeCaptureSessionBinding } from '../../durable-capture/session-binding.fixtures.ts';
 import path from 'node:path';
 import { expect, test, vi } from 'vitest';
 import { createDurableResourceEnvelope } from '../../durable-resource-envelope.ts';
@@ -187,16 +188,11 @@ function createScreenRecordingTestResource(
   return createDurableCaptureResource<
     'screen-recording',
     ScreenRecordingLiveHandle,
-    ScreenRecordingCompletion,
-    DurableCaptureSessionState
+    ScreenRecordingCompletion
   >({
     resourceKind: 'screen-recording',
     displayName: 'screen recording',
     store,
-    sessionSlot: {
-      read: (session) => session.screenRecording,
-      replace: (session, screenRecording) => ({ ...session, screenRecording }),
-    },
     completionMetadata: (completion) => ({
       backend: completion.backend,
       outputPath: completion.outPath,
@@ -217,9 +213,14 @@ function makeContext(resource: ReturnType<typeof createScreenRecordingTestResour
   const sessionName = 'recording';
   const session: DurableCaptureSessionState = {};
   sessionStore.set(sessionName, session);
+  const binding = makeCaptureSessionBinding(sessionStore, sessionName, {
+    read: (session) => session.screenRecording,
+    replace: (session, screenRecording) => ({ ...session, screenRecording }),
+  });
   return {
     admissionLedger: createDurableCaptureAdmissionLedger({ displayName: 'screen recording' }),
     session,
+    binding,
     sessionName,
     sessionStore,
     device,

packages/capture-kit/src/capture-admission/__tests__/screen-recording-session-resource.test.ts

@@ -1,3 +1,4 @@
+import { makeCaptureSessionBinding } from '../../durable-capture/session-binding.fixtures.ts';
 import { expect, test, vi } from 'vitest';
 import { PendingTransferGuard } from '@agent-device/contracts/async-lifecycle';
 import { localRuntimeOwner } from '@agent-device/contracts/platform-runtime';
@@ -35,6 +36,10 @@ test('screen recording persists durable truth before adopting only handle and en
   const sessionName = 'recording';
   const session: TestRecordingSession = { name: sessionName, device };
   sessionStore.set(sessionName, session);
+  const binding = makeCaptureSessionBinding(sessionStore, sessionName, {
+    read: (session) => session.screenRecording,
+    replace: (session, screenRecording) => ({ ...session, screenRecording }),
+  });
   const owner = localRuntimeOwner('android');
   const fence = { token: 'recording-fence', generation: 1 } as const;
   const finish = vi.fn(async () => ({
@@ -79,9 +84,7 @@ test('screen recording persists durable truth before adopting only handle and en
 
   await adoptStartedScreenRecording({
     admissionLedger: createScreenRecordingAdmissionLedger(),
-    session,
-    sessionName,
-    sessionStore,
+    binding,
     device: session.device,
     owner,
     fence,
@@ -101,9 +104,10 @@ test('screen recording persists durable truth before adopting only handle and en
 
   const active = sessionStore.get(sessionName);
   if (!active) throw new Error('Expected screen-recording session');
-  await expect(
-    finishLiveScreenRecording({ intent: 'capture', session: active, sessionName, sessionStore }),
-  ).resolves.toMatchObject({ backend: 'android', outPath: '/tmp/recording.mp4' });
+  await expect(finishLiveScreenRecording({ intent: 'capture', binding })).resolves.toMatchObject({
+    backend: 'android',
+    outPath: '/tmp/recording.mp4',
+  });
   expect(finish).toHaveBeenCalledOnce();
   expect(sessionStore.get(sessionName)?.screenRecording).toBeUndefined();
 });
@@ -115,6 +119,10 @@ test('a failed recording finish keeps the record open and never disposes the rec
   const sessionName = 'recording';
   const session: TestRecordingSession = { name: sessionName, device };
   sessionStore.set(sessionName, session);
+  const binding = makeCaptureSessionBinding(sessionStore, sessionName, {
+    read: (session) => session.screenRecording,
+    replace: (session, screenRecording) => ({ ...session, screenRecording }),
+  });
   const owner = localRuntimeOwner('android');
   const fence = { token: 'recording-fence', generation: 1 } as const;
   const finishError = new Error('failed to retrieve playable Android recording');
@@ -150,9 +158,7 @@ test('a failed recording finish keeps the record open and never disposes the rec
   });
   await adoptStartedScreenRecording({
     admissionLedger: createScreenRecordingAdmissionLedger(),
-    session,
-    sessionName,
-    sessionStore,
+    binding,
     device: session.device,
     owner,
     fence,
@@ -163,9 +169,7 @@ test('a failed recording finish keeps the record open and never disposes the rec
 
   const active = sessionStore.get(sessionName);
   if (!active) throw new Error('Expected screen-recording session');
-  await expect(
-    finishLiveScreenRecording({ intent: 'capture', session: active, sessionName, sessionStore }),
-  ).rejects.toBe(finishError);
+  await expect(finishLiveScreenRecording({ intent: 'capture', binding })).rejects.toBe(finishError);
 
   expect(forceCleanup).not.toHaveBeenCalled();
   expect(sessionStore.get(sessionName)?.screenRecording?.handle).toBe(handle);
@@ -182,6 +186,10 @@ test('a record stop that fails after collecting resumes through the fence withou
   const sessionName = 'recording';
   const session: TestRecordingSession = { name: sessionName, device };
   sessionStore.set(sessionName, session);
+  const binding = makeCaptureSessionBinding(sessionStore, sessionName, {
+    read: (session) => session.screenRecording,
+    replace: (session, screenRecording) => ({ ...session, screenRecording }),
+  });
   const owner = localRuntimeOwner('android');
   const fence = { token: 'recording-fence', generation: 1 } as const;
   const signals = vi.fn(async () => ({ observation: { recorder: 'confirmed' as const } }));
@@ -216,9 +224,7 @@ test('a record stop that fails after collecting resumes through the fence withou
   );
   await adoptStartedScreenRecording({
     admissionLedger: createScreenRecordingAdmissionLedger(),
-    session,
-    sessionName,
-    sessionStore,
+    binding,
     device: session.device,
     owner,
     fence,
@@ -239,9 +245,7 @@ test('a record stop that fails after collecting resumes through the fence withou
     if (!active) throw new Error('Expected screen-recording session');
     return finishLiveScreenRecording({
       intent: 'capture',
-      session: active,
-      sessionName,
-      sessionStore,
+      binding,
     });
   };
 

packages/capture-kit/src/capture-admission/__tests__/session-store.fixtures.ts

@@ -1,28 +1,16 @@
 import path from 'node:path';
 import { safeSessionName } from '@agent-device/host-kit/session-paths';
-import type { DurableCaptureSessionStore } from '../../durable-capture/index.ts';
 import { mkdtempForTestSync } from '../../tmp-dir.fixtures.ts';
+import { makeCaptureFixtureStore } from '../../durable-capture/session-binding.fixtures.ts';
 
-export type CaptureAdmissionSessionStore<S> = DurableCaptureSessionStore<S> &
-  Readonly<{
-    get(name: string): S | undefined;
-    sessionsDir: string;
-  }>;
+export type CaptureAdmissionSessionStore<S> = ReturnType<
+  typeof makeCaptureAdmissionSessionStore<S>
+>;
 
-/**
- * The whole of the daemon `SessionStore` these admission modules ever address — `set`,
- * `resolveSessionDir`, and the read-back a test asserts on — over a fresh temp directory, so a
- * test of this family needs no session record, store class, or daemon import.
- */
-export function makeCaptureAdmissionSessionStore<S>(
-  prefix: string,
-): CaptureAdmissionSessionStore<S> {
+export function makeCaptureAdmissionSessionStore<S>(prefix: string) {
   const sessionsDir = mkdtempForTestSync(prefix);
-  const sessions = new Map<string, S>();
-  return {
-    set: (name, session) => void sessions.set(name, session),
-    get: (name) => sessions.get(name),
-    resolveSessionDir: (name) => path.join(sessionsDir, safeSessionName(name)),
+  return Object.freeze({
+    ...makeCaptureFixtureStore<S>((name) => path.join(sessionsDir, safeSessionName(name))),
     sessionsDir,
-  };
+  });
 }

packages/capture-kit/src/capture-admission/audio-probe-session-resource.ts

@@ -9,26 +9,20 @@ import type {
   RuntimeOwnerRef,
 } from '@agent-device/contracts/platform-runtime';
 import type { DeviceInfo } from '@agent-device/kernel/device';
-import type { DurableCaptureSessionStore } from '../durable-capture/index.ts';
+import type { DurableCaptureSessionBinding } from '../durable-capture/index.ts';
 import { createDurableCaptureResource } from './durable-capture-resource.ts';
 import type { DurableCaptureFinishIntent } from './durable-capture-resource.ts';
 import type { AudioProbeAdmissionLedger } from './audio-probe-admission-ledger.ts';
 import { audioProbeResourceStore } from './audio-probe-resource-store.ts';
-import type { DurableCaptureSessionState } from './session-state-slice.ts';
 
 export const audioProbeDurableResource = createDurableCaptureResource<
   'audio-probe',
   AudioProbeLiveHandle,
-  AudioProbeCompletion,
-  DurableCaptureSessionState
+  AudioProbeCompletion
 >({
   resourceKind: 'audio-probe',
   displayName: 'audio probe',
   store: audioProbeResourceStore,
-  sessionSlot: {
-    read: (session) => session.audioProbe,
-    replace: (session, audioProbe) => ({ ...session, audioProbe }),
-  },
   completionMetadata: (completion) => ({
     backend: completion.backend ?? 'unknown',
     source: completion.source,
@@ -48,9 +42,7 @@ export const audioProbeDurableResource = createDurableCaptureResource<
 
 export function adoptStartedAudioProbe(params: {
   admissionLedger: AudioProbeAdmissionLedger;
-  session: DurableCaptureSessionState;
-  sessionName: string;
-  sessionStore: DurableCaptureSessionStore<DurableCaptureSessionState>;
+  binding: DurableCaptureSessionBinding<'audio-probe', AudioProbeLiveHandle>;
   device: DeviceInfo;
   owner: RuntimeOwnerRef;
   fence: ResourceOwnershipFence;
@@ -62,9 +54,7 @@ export function adoptStartedAudioProbe(params: {
 }
 
 export function finishLiveAudioProbe(params: {
-  session: DurableCaptureSessionState;
-  sessionName: string;
-  sessionStore: DurableCaptureSessionStore<DurableCaptureSessionState>;
+  binding: DurableCaptureSessionBinding<'audio-probe', AudioProbeLiveHandle>;
   intent: DurableCaptureFinishIntent;
 }): Promise<AudioProbeCompletion> {
   return audioProbeDurableResource.finishLive(params);