rushd: WS3/WS4 integration with Reporter prerequisites

[Sean Larkin (TheLarkInn)]

Purpose

Draft integration checkpoint for #5894, focused on WS3 (#5898) and WS4 (#5899), with the Reporter prerequisites from #5858.

The existing rush and rushx defaults are unchanged. The separate rush-client and rushx-client binaries remain opt-in. This does not perform the Rush 6 cutover or close the full epic.

Implemented

• Native warm build/rebuild execution and real Rushx package scripts, with immutable request inputs, byte-preserving global streams, stdin credits/EOF, cancellation, queue controls, and fail-closed no-replay behavior.
• Generation-safe fingerprint reloads, bounded pre-execution restart retry, attested version-selected launchers, detached startup/crash handoff, idle shutdown, and native install/update results delivered before cleanup and successor startup.
• Generation-fenced structured graph commands, automatic warm-controller ownership, deterministic LRU/telemetry retention, observation-only daemon.watch, and live generation/reload/resource status without initializing a cold graph.
• Reporter integration and reviewed fixes for bootstrap control ownership, structured output capture, watch presentation, and reporter timer cleanup.

Reporter dependency stack

This branch preserves all original Reporter branch histories. Their changes remain in this diff until the existing PR stack lands; this draft is not a substitute for reviewing that stack.

Phase	Existing PR
R2A configuration	#5987
R2B frontend controls	#5989
R3A session sink	#5988
R3B shadow events	#5991
R3C parity	#5992
R4A telemetry/privacy	#5990
R5A operation adapter	#5996
R5B reporters	#5997
R6A bootstrap handoff	#5993
R7A Heft negotiation	#6000
R8A AI qualification	#5999
R10A demo/docs	#5998

R9 (#5982), R11 (#5984), and WS5 (#5900) remain subject to their actual review, compatibility, and release/ecosystem gates. No legacy-removal or default-selection gate is bypassed.

The Reporter stack has been restacked onto main@77abfe24 with guarded pushes and preserved backup refs. The scoped follow-up fixes are in #6019. Independent approval and dependency-ordered landing remain separate from this integration PR.

Windows correction batch

• Clients, launchers, and sessions use native physical filesystem identity consistently. Rushx separately preserves validated invocation spelling, including Windows 8.3 names and junctions, for child cwd, lifecycle environment, registration diagnostics, and pnpm-sync. Exact native output assertions are retained; output is never rewritten to manufacture parity.
• The shared LockFile Windows implementation now uses actual kernel exclusive sharing instead of assuming exclusive creation remains exclusive after opening. A dirty companion preserves interrupted-owner state across close/delete handoffs. This correction applies to all Windows LockFile consumers, not only the daemon; no native addon or dependency is added.
• Native rush purge retains its own active repository lock and Windows dirty companion while removing other temporary files. The regression verifies that purging does not delete live ownership or bypass the mutex.
• Native operation environments retain case-insensitive Windows Path values. Startup handoff treats sharing-denied ownership reads as unknown, not released, and retries only within the existing deadline. Owned child resources are joined before bounded Windows fixture cleanup.
• Native IPC fixtures launch a real Node IPC child instead of relying on cmd.exe to forward the descriptor. Graph CLI scenarios are separated, Windows cancellation exercises the actual CLI signal handler, and graph reload setup is separated from its assertions. Production startup deadlines and no-replay rules are unchanged.
• Native CLI test continuations are bound to their own fixtures and joined completely before deletion, including owned graph watches registered during cleanup. Initial daemon preparation is separated from reload/restart assertions; a timed-out callback cannot start work in, or remove, the next test's repository.
• Native Rushx registration lookup is unchanged unless the caller explicitly supplies a different invocation namespace. Embedded frontend tests capture and release their real parser locks after execution; production lock lifetimes and existing native snapshots are unchanged.
• Generated Git fixtures set core.autocrlf=false locally so host-global Windows settings do not produce LF-to-CRLF warnings. User Git settings and CI warnings-as-errors are unchanged. The real native graph suite uses an explicit 15-second integration budget after repeated setup timeouts, without changing assertions, cleanup limits, or production deadlines.
• Linux global requests wait for their captured detached group/session to settle before completion, not merely for signal delivery or leader stream closure. The bounded inspection uses procps-compatible ps --sid, never resends signals while waiting, and surfaces inspection/timeout failures.
• Remaining launcher fixtures join the actual daemon PIDs returned by start/restart before bounded Windows cleanup. Graph fixtures are removed only after successful host closure. Retention-only fixtures are isolated from accumulated Jest-worker RSS; production memory defaults and dedicated pressure tests are unchanged.

Validation

Targeted existing builds/tests passed for Rush lib, protocol, transport, client core, daemon, CLI, and wire end-to-end conformance on Node 22.23.2. Coverage includes actual CLI install/update, native coexistence, same-PID reloads, new-PID successors, startup-client death, ownership failures, graph-token races, real warm policies, and ordinary CLI status.

The integrated correction candidate is 3053d87b75. Full affected Linux Rush lib, daemon, and standalone CLI packages pass after rebuilding their dependencies and actual RushLib bundles. The latest full Node 26 runs pass 343 daemon and 143 client cases. Native Windows coverage includes kernel locking, exact Rushx parity with genuine 8.3 TEMP paths, and the corrected lifecycle/cleanup paths.

The fixture-lifetime follow-up passed 20 of 21 targeted cases on both Windows runtimes; its sole remaining failure combined initial daemon preparation and warm-reuse assertions in one 30-second test. That preparation is now a separate bounded setup hook. The corrected case passes directly on both Windows runtimes with every original assertion and its existing execution limit. A forced-timeout diagnostic separately confirmed that the old callback and fixture are fully disposed before the following preview-engine fixture starts.

Hosted run 34188386272 on a99e83def8 exposed two additional Windows-only native entry issues: four existing Rushx snapshots received an extra registration warning, and four frontend fixtures tried to delete a still-held native parser lock. The follow-up preserves the snapshots and real lock acquisition, and passes all 4 Rushx plus 31 frontend tests on both Windows runtimes. The six daemon alias regressions also pass with the corrected native code.

Hosted run 34190820540 on 4ff0bc20b2 passed every build/test operation on Windows 26, but failed Rush's strict warning policy on generated-fixture Git warnings. Windows 24 also exposed a five-second native graph setup limit. The follow-up is warning-free with an isolated core.autocrlf=true global configuration, and all five native graph cases pass on Windows 24 and 26 under the explicit integration budget.

The additional native purge regression reproduced deletion of the active lock before the fix and now passes on Linux and Windows 24/26, preserving both live ownership and normal temporary-file removal.

Run 34195130751 completed three Linux configurations successfully. Remaining failures were two Windows fixture-deletion sites and an unchanged Reporter wall-time measurement on Linux 24. The cleanup corrections pass 41 selected daemon cases on Windows 26 and 29 launcher/Rushx boundary cases on Windows 24. The Reporter performance suite passes its unchanged thresholds locally. A prior single descendant-state assertion was retained, not weakened; deterministic delayed-completion tests and a real owned-process probe now verify the Linux completion barrier.

Run 34201327379 completed five full configurations successfully, including both Windows versions and all package-manager/cache stages. Its only failure assumed that project a must outrank b using real timing/RSS data. The final test-only correction independently calculates the expected score order from those producer measurements, verifies real eviction, and contrasts telemetry retention with LRU after requested rewarming. The production ranking formula is unchanged; all 31 warm/ranking tests pass on Linux 26 and the real telemetry case passes on Windows.

Full hosted acceptance of this final candidate is pending a fresh six-platform matrix. Earlier failed runs and diagnostic observations are retained, not relabeled as passing.

The frozen bootstrap encoder, all 14 AI qualification gates, expanded live Reporter/Heft demo, change-file verification, dependency consistency, and generated README verification also passed. AI output measured 45.89% of legacy and 48.76% of plaintext against the 50% gates.

The opt-in registry integration exercised a genuine published foreign-engine installation and its runtime/protocol attestation. Incompatible installed engines are refused rather than relabeled as supported. Hosted OS/Node matrix results still need to complete on this PR.

Deliberate safety boundaries

• Unsupported native configurations and incompatible published launchers retain explicit pre-execution native fallback; transport loss or possibly executed work is never replayed.
• Warm memory limits are best-effort sampled accounting, not a hard process-tree RSS ceiling. Active/protected work is not evicted.
• daemon.watch controls host project observation, not autonomous script execution or native Rush watch mode.
• Ambiguous pre-bind launcher failure retains its startup reservation instead of guessing that a PID can be killed or reclaimed.

[Sean Larkin (TheLarkInn)]

Pushed the focused CI correction batch in 3972ac2dc7:

• Updated the SDK snapshot for the intentional new native/daemon exports.
• Canonicalized cwd/workspace aliases before confinement and preserved native project selection; symlink escapes remain rejected.
• Corrected Windows shell expectations and inherited Heft pipe recognition without relaxing file-descriptor or ACK validation.
• Joined actual startup-helper closure, preserved caller-relative cwd, and made fixture cleanup wait for task-owned processes.
• Shortened overlong Unix socket fixture paths and isolated Node LTS warnings using native fixture configuration, without changing production output.

The combined local Node 22 suites and affected cases on actual Linux Node 24.11.1/26.7.0 pass. Fresh hosted CI is running at the new head; Windows confirmation and the remaining required gates are still pending. The PR remains draft.