Close the last two local lifecycle-invariant items: (c) PnP cross-check, (d) unowned-backend affordance

[potpiemuncher]

Closes the two local items the Phase 3.1 gap-diff left open after 3.3: the optional hardening for invariant (c) and the diagnostics affordance for invariant (d). With (b) filed upstream as hbashton/VIIPER#7, every invariant in lifecycle-invariants.md is now Present, prevented by architecture with its residue surfaced to the user, or awaiting review elsewhere.

(c) Ask Windows before believing the backend is idle

The stop-on-exit decision proved "idle" entirely from VIIPER's census — the backend's own bookkeeping. A devnode Windows still shows after the backend has forgotten it (the problem-24 phantom the old fork's present-only SetupAPI probe existed for) would have passed it.

CmTreePnpAbsenceProbe walks the CM device tree under every present devnode carrying ROOT\USBIP_WIN2\UDE — all of them, not the first. Root hubs are descended; every non-hub node is reported as an attached device with its problem code, and not descended into. Position rather than identity, deliberately: a pad attached over USB/IP carries the same VID/PID as a real one on a physical port, and the personas VIIPER can host make an ID list a moving target.

ViiperBackendStopPolicy.Decide takes the probe as a deferred Func and consults it only after every census gate has passed — a cross-check on the final verdict, not a routine exit cost — then judges it the way this policy judges everything: devices present, unproven, a null result and a thrown exception all leave the backend running.

One intentional asymmetry with the census: a missing controller is proven absence (nothing can be attached through a controller that is not there), while a failed census stays a failure (devices can be alive behind an API that will not answer).

(d) Say something when a backend outlives the session that started it

A session that dies hard leaves its backend and pads running; the next session correctly refuses to touch them, since ownership is (pid, start time) held in memory only. That refusal was silent — a stale virtual controller with no in-app explanation.

ViiperUnownedBackendPolicy classifies the backend on the API port (managed by this session / unowned idle / unowned serving this session's pads / unowned holding unaccountable devices / unreadable), and a Backend process card in the Settings VIIPER section renders it with holdings listed.

• The card does not pretend to know more than it does: leftovers of a dead session and another program's live controllers are indistinguishable from here, so the headline gives both readings and the confirmation names what happens if the second is true.
• The stop is offered exactly when the report says so — unowned, holdings readable, none of them this session's live controller. Unreadable census ⇒ no button: consent to stop a backend is consent to what it is holding.
• The gate re-runs at commit time, so a stale card cannot stop a backend that has since started serving this session.
• The process is identified as the owner of the API port's listening socket (GetExtendedTcpTable), never by executable name.
• Startup logs one line when an unowned backend holds devices, naming the Settings path.

Deliberately not a lifecycle change: nothing happens without a click, and the exit path's refusal to touch unowned backends is untouched.

Verification

Suite: 853 passed / 0 failed (CI filter), from 812. Fresh --no-incremental rebuild: the same 17 known warnings as main, none new.

Both halves follow the pure-decision / OS-probe split, so the policies are covered by fakes: cross-check ordering and each fail-closed path, the probe's contract (including the real walk, which must answer and never throw on any machine), classification, the locator's pure half, the commit-time gate (ping/census/pid all seamed — the real port is never touched), and the card's wording.

The (d) card was also driven for real, since WPF binding failures are silent. Local isolated run against a stand-in API server serving one foreign dualsense on bus 0; verified through the UIA tree: card rendered the UnownedInUse headline with bus 0 device 7 (dualsense) - not created by this session under "What it is holding"; the confirmation carried the holdings and the losing-a-controller warning; confirming it stopped the right process and the card refreshed to "No VIIPER backend is running." with Backend stopped (... had to be killed). Both log lines fired.

That run incidentally proved why the locator reads the socket table: the stand-in was a powershell process, not viiper.exe, and GetExtendedTcpTable identified it correctly by socket ownership — name matching would have found nothing to stop.

Still open, by design

• (e)'s check-then-kill window — a point-in-time census before the stop; not closable from the client side, documented rather than hidden.
• (b) riding upstream review at usb: let only one party reply for a seqnum hbashton/VIIPER#7.

🤖 Generated with Claude Code