fix(desktop): keep owner-only work in the process that owns the directory

Two things a launch did before it could know whether it was the host or
merely on its way to one.

The update pump swept leftovers as its first act, and the sweep discards
the relaunch marker. That marker is how a host that just applied an
update tells its own exit to reopen the new bundle, and it exists only
across the gap between the apply and the run loop returning. A launch
arriving in that gap starts its pumps before `app.run()` decides it is
secondary, so it swept the marker away and the update landed on disk
with nothing left to reopen it. The sweep moves out of the pump and onto
the owning host, which runs it once the election has named it. The pump
keeps the downloads, which only ever come from a page a forwarded launch
does not have.

The heartbeat claim gave up when it was already taken, which the elected
primary can genuinely find: a host started on the stopped-owner path
holds a claim without ever entering an election, so its claim outlives
it. The primary then ran with no heartbeat at all, and a later launch,
reading the other host's fresh stamp, would hand itself to this one
however stuck it had become — the exact failure the stamp exists to
catch. `hold` waits the other host out instead of giving up, and takes
the claim the moment it exits.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: tonyfettes

desktop/internal/host/host.mbt

@@ -86,11 +86,17 @@ pub fn new_host_state(
 ///|
 /// The background tasks behind the host ops, spawned into the caller's
 /// app-lifetime task group: the moon-check diagnostics forwarder and the
-/// self-update pump with its startup leftover sweep. These are shared by
+/// self-update download pump. These are shared by
 /// every connection;
 /// connection-owned filesystem watcher tasks start in `HostConnection::run`.
 /// Every background task is best-effort: a language-service hiccup degrades
 /// that feature, never the connection.
+///
+/// The update pump is safe to start before this process knows whether it owns
+/// the runtime directory: it only ever acts on requests from a page, and a
+/// launch that gets handed to another host never has one. The one piece of
+/// update work that touches shared state unprompted is
+/// `sweep_update_leftovers`, which is separate for exactly that reason.
 pub fn[G] spawn_host_pumps(
   group : @async.TaskGroup[G],
   state : HostState,
@@ -104,6 +110,20 @@ pub fn[G] spawn_host_pumps(
   group.spawn_bg(allow_failure=true, () => state.updates.run(emit))
 }
 
+///|
+/// Clear what a previous update left in the runtime directory. Call this only
+/// from the host that owns that directory, and only once it does: the sweep
+/// discards a relaunch marker, which belongs to the owner and may be the one
+/// it is about to act on.
+pub async fn HostState::sweep_update_leftovers(self : HostState) -> Unit {
+  self.updates.cleanup() catch {
+    error if @async.is_being_cancelled() => raise error
+    error =>
+      @xlog.warn(category="update") <?
+        { "event": "cleanup_failed", "error": "\{error}" }
+  }
+}
+
 ///|
 /// Run the filesystem watcher and PTY pump owned by this connection. Their
 /// notifications return only to the same transport instead of entering the

desktop/internal/host/pkg.generated.mbti

@@ -44,6 +44,7 @@ pub fn HostConnection::new() -> Self
 pub async fn HostConnection::run(Self, async (@protocol.Notification) -> Unit) -> Unit
 
 type HostState
+pub async fn HostState::sweep_update_leftovers(Self) -> Unit
 
 // Type aliases
 

desktop/internal/host/update_check.mbt

@@ -53,7 +53,17 @@ fn SelfUpdate::new(
 
 ///|
 /// Sweep debris a previous update may have left behind (a staging dir, the
-/// old bundle parked aside) — the host's only unprompted update work.
+/// old bundle parked aside, a relaunch marker nobody acted on) — the host's
+/// only unprompted update work.
+///
+/// The relaunch marker is why this is not pump work. The marker is shared
+/// state belonging to whichever host owns the runtime directory, and it lives
+/// exactly across the gap between that host applying an update and its run
+/// loop returning. A launch that is about to be handed to that host runs its
+/// own pumps first and would sweep the marker out from under it — the bundle
+/// swapped on disk, and nothing left to say it should reopen. So the sweep
+/// belongs to the host that owns the directory, and runs only once that is
+/// settled.
 async fn SelfUpdate::cleanup(self : SelfUpdate) -> Unit {
   if self.work_dir is Some(dir) && self.bundle_path is Some(bundle) {
     @update.cleanup_leftovers(work_dir=dir, bundle_path=bundle)
@@ -211,23 +221,18 @@ async fn SelfUpdate::download_package(
 }
 
 ///|
-/// The app-lifetime pump: sweep leftovers once, then perform accepted
-/// downloads one at a time and report each outcome as a notification. Only
-/// this task downloads and installs staged state, so `busy` stays true from
-/// acceptance until the matching completion notification.
+/// The app-lifetime pump: perform accepted downloads one at a time and report
+/// each outcome as a notification. Only this task downloads and installs
+/// staged state, so `busy` stays true from acceptance until the matching
+/// completion notification. The leftover sweep is `SelfUpdate::cleanup`,
+/// which the owning host runs separately.
 async fn SelfUpdate::run(
   self : SelfUpdate,
   emit : async (@protocol.Notification) -> Unit,
 ) -> Unit {
   // A closed queue turns later `update.download` requests into rejections
   // instead of accepted work nobody will perform.
   defer self.downloads.close()
-  self.cleanup() catch {
-    error if @async.is_being_cancelled() => raise error
-    error =>
-      @xlog.warn(category="update") <?
-        { "event": "cleanup_failed", "error": "\{error}" }
-  }
   for ;; {
     let payload = self.downloads.get()
     try self.download_package(payload, emit) catch {
@@ -339,6 +344,34 @@ async test "self-update pump reports download failures" {
   })
 }
 
+///|
+/// The relaunch marker belongs to whichever host owns the runtime directory,
+/// and it exists exactly across the gap between that host applying an update
+/// and its run loop returning. Every launch starts this pump, including one
+/// that is about to be handed straight to that host — so the pump must leave
+/// the marker alone, and only the owner's sweep may clear it.
+async test "the download pump leaves the relaunch marker to the owning host" {
+  let root : @pathx.Path = @fs.tmpdir(prefix="openseek-update-marker-")
+  let work_dir = root.to_string()
+  let bundle_path = "\{work_dir}/SeekMoon.app"
+  let updates = SelfUpdate::new(
+    Some(root),
+    Some("\{bundle_path}/Contents/MacOS/seekmoon"),
+  )
+  @update.write_relaunch_marker(work_dir~, bundle_path~)
+  @async.with_task_group(group => {
+    group.spawn_bg(allow_failure=true, () => updates.run(fn(_) {  }))
+    // Well past the point where a sweep at the pump's start would have run.
+    @async.sleep(50)
+    group.return_immediately(())
+  })
+  assert_true(@update.take_relaunch_target(work_dir~) is Some(_))
+  @update.write_relaunch_marker(work_dir~, bundle_path~)
+  updates.cleanup()
+  assert_true(@update.take_relaunch_target(work_dir~) is None)
+  @fs.rmdir(work_dir, recursive=true)
+}
+
 ///|
 async test "self-update apply refuses while a download is active" {
   let updates : SelfUpdate = {

desktop/internal/instance/instance.mbt

@@ -72,7 +72,7 @@ pub async fn identity(runtime_dir : @pathx.Path) -> String {
 /// Dropping it is the kernel's job: a host that dies — cleanly, by signal, or
 /// stuck and then killed — releases it without leaving anything to clean up,
 /// which is why the claim is a lock and not a recorded pid.
-pub struct Claim {
+priv struct Claim {
   lock : @fsx.FileLock
   runtime_dir : @pathx.Path
 }
@@ -118,14 +118,37 @@ pub async fn can_hand_off_to(runtime_dir : @pathx.Path) -> Bool {
 }
 
 ///|
-/// Take ownership of `runtime_dir` for this host, or `None` if another
-/// process holds it.
+/// Own `runtime_dir` and stamp for it for as long as this host runs, taking
+/// the claim as soon as it is free.
 ///
 /// Call this from the process that won the single-instance election and
 /// nowhere else. That is what keeps the claim and the primary the same
 /// process, so the heartbeat always describes the host a later launch would
 /// actually be handed to.
-pub async fn claim(runtime_dir : @pathx.Path) -> Claim? {
+///
+/// It waits rather than gives up, because the primary can legitimately find
+/// the claim taken: a host that started on the stopped-owner path holds no
+/// single-instance identity, so its claim outlives the election it never
+/// entered. Giving up there would leave this — the process every later launch
+/// is handed to — with no heartbeat at all, and a launch reading the other
+/// host's fresh stamp would go on handing itself to this one however stuck it
+/// became. Waiting costs nothing and ends the moment that host exits.
+pub async fn hold(
+  runtime_dir : @pathx.Path,
+  retry_interval_ms? : Int = HeartbeatIntervalMs,
+) -> Unit {
+  for ;; {
+    if claim(runtime_dir) is Some(held) {
+      return held.run()
+    }
+    @async.sleep(retry_interval_ms)
+  }
+}
+
+///|
+/// Take ownership of `runtime_dir` for this host, or `None` if another
+/// process holds it.
+async fn claim(runtime_dir : @pathx.Path) -> Claim? {
   guard @fsx.FileLock::try_acquire(heartbeat_file(runtime_dir), Exclusive)
     is Some(lock) else {
     return None
@@ -140,7 +163,7 @@ pub async fn claim(runtime_dir : @pathx.Path) -> Claim? {
 /// Restamp for as long as the host runs. Spawned on the app's task group, so
 /// the stamp advances exactly while the loop that would act on a hand-off is
 /// running — which is the whole signal.
-pub async fn Claim::run(self : Claim) -> Unit {
+async fn Claim::run(self : Claim) -> Unit {
   for ;; {
     @async.sleep(HeartbeatIntervalMs)
     stamp(self.runtime_dir)
@@ -247,6 +270,32 @@ async test "a live owner with a stopped stamp cannot be handed to" {
   @fs.rmdir(root.to_string(), recursive=true)
 }
 
+///|
+/// The primary can find the claim already taken — a host that started on the
+/// stopped-owner path holds one without ever entering an election. Giving up
+/// there would leave the process every later launch is handed to with no
+/// heartbeat at all, so it waits the other host out instead.
+async test "a primary that loses the claim takes it when the holder leaves" {
+  let root : @pathx.Path = @fs.tmpdir(prefix="openseek-instance-wait-")
+  guard claim(root) is Some(other) else { fail("expected the first claim") }
+  @async.with_task_group(group => {
+    group.spawn_bg(allow_failure=true, () => hold(root, retry_interval_ms=10))
+    // Many retries' worth of waiting changes nothing while the other host is
+    // there — the claim stays that host's.
+    @async.sleep(50)
+    assert_true(claim(root) is None)
+    other.lock.release()
+    // Now nobody else holds it, so a claim that still cannot be taken can
+    // only be the waiting host's — and it stamps, which is what makes the
+    // heartbeat describe the process a launch would be handed to.
+    @async.sleep(50)
+    assert_true(claim(root) is None)
+    assert_true(can_hand_off_to(root))
+    group.return_immediately(())
+  })
+  @fs.rmdir(root.to_string(), recursive=true)
+}
+
 ///|
 /// The probe must not keep what it takes. Two launches racing here both find
 /// the directory free and both go on to the single-instance election; if the

desktop/internal/instance/pkg.generated.mbti

@@ -2,25 +2,19 @@
 package "openseek_desktop/internal/instance"
 
 import {
-  "openseek_desktop/internal/fsx",
   "openseek_desktop/internal/pathx",
 }
 
 // Values
 pub async fn can_hand_off_to(@pathx.Path) -> Bool
 
-pub async fn claim(@pathx.Path) -> Claim?
+pub async fn hold(@pathx.Path, retry_interval_ms? : Int) -> Unit
 
 pub async fn identity(@pathx.Path) -> String
 
 // Errors
 
 // Types and methods
-pub struct Claim {
-  lock : @fsx.FileLock
-  runtime_dir : @pathx.Path
-}
-pub async fn Claim::run(Self) -> Unit
 
 // Type aliases
 

desktop/main.mbt

@@ -134,25 +134,26 @@ fn main {
           None => ()
         }
       })
-      // The heartbeat is claimed here and nowhere earlier: this hook runs
-      // only in the process that won the single-instance election, so the
-      // claim and the primary can never end up being different processes —
-      // which would leave the primary unstamped and every later launch
-      // mistaking a stopped host for a healthy one. It is spawned on the
-      // application task group so it stops exactly when the loop it is
-      // evidence of does.
+      // Everything that acts on state belonging to whoever owns the runtime
+      // directory starts here and nowhere earlier: this hook runs only in the
+      // process that won the single-instance election. A launch that is
+      // handed to another host returns from `app.run()` without ever reaching
+      // it, so it can neither stamp a heartbeat the other host's would be
+      // mistaken for, nor sweep away the relaunch marker that host is about
+      // to act on. Both are spawned on the application task group, so they
+      // stop exactly when the loop they belong to does.
       .app_lifecycle(
         on_start=async fn(context) {
           is_primary.val = true
+          let tasks = context.task_group()
           match runtime_dir {
             Some(dir) =>
-              if @instance.claim(dir) is Some(held) {
-                context
-                .task_group()
-                .spawn_bg(allow_failure=true, () => held.run())
-              }
+              tasks.spawn_bg(allow_failure=true, () => @instance.hold(dir))
             None => ()
           }
+          tasks.spawn_bg(allow_failure=true, () => {
+            state.host_state().sweep_update_leftovers()
+          })
         },
         // The claim needs no shutdown of its own: the kernel releases it when
         // the process dies, however it dies.