fix(daemon): move supervisor authority records out of $TMPDIR

[snimu]

What this fixes

Any daemon supervisor alive for more than three days wedged permanently: macOS's com.apple.bsd.dirhelper deletes files older than 3 days under $TMPDIR daily, and the supervisor's ownership registry (owner.json/scope.json, plus startup fences and the shutdown admission) lived exactly there. Once reaped, every command against that daemon failed with "no longer owns its registry entry" and the only recovery was killing it. This is a clock, not a race — it hit every long-lived daemon on macOS.

The fix: move the records, don't outrun the cleaner

The registry only lived in $TMPDIR by proximity: the daemon socket needs a short path (the ~104-byte sun_path limit), and the registry rode along in the socket dir. But these are JSON files — no path-length constraint applies, and they are durable authority records sitting in the one directory the OS is explicitly allowed to prune.

The registry now lives at ~/.prime/supervisor-owners (still one global per-user location, which cross-agent-dir conflict detection requires; the internal env override still wins). All registry tenants move together: owner records, startup fences, the shutdown admission. Nothing deletes files behind a live daemon anymore, so the failure mode is simply gone — no renewal machinery, no self-heal, no timer.

Version-overlap and migration

No record migration — ownership records are per-process-lifetime — but owner-record READS fall back to the legacy $TMPDIR location for one release (writes never do). This keeps the standard upgrade path working while a pre-move daemon is still running: the self-update coordinator's fence persist and worker auth both need to read the old daemon's record, and without the fallback a routine upgrade would drain and fence the old daemon, then abort — wedging it until manual restart. The fallback is read-only, exists only when no explicit registry dir or env override is set, and is marked for removal next release. Real socket contention is still resolved by the version-independent socket-path lease at bind. Stale records in the old location are inert and the OS cleaner removes them within 3 days.

Also in this PR

• Shutdown-admission renew loop hardened. Extracting it surfaced a real latent race on main: package-manager-cli and daemon-ps call assertOrRenew directly, bypassing the timer's single-flight promise — so release() could complete while a direct renew sat queued on the registry guard and then resurrect shutdown-admission.json for up to ~5s. The extracted lease-renew loop funnels every caller through one single-flight slot that release genuinely awaits, and re-checks stopped-state first inside the guarded section. Covered by a deterministic race test (guard held, release overtakes, admission provably not resurrected).
• The two identical "no longer owns its registry entry" messages are disambiguated (never-acquired/released vs record missing/replaced on disk) and carry the socket path, registry dir, and remedy ("restart the daemon — sessions are preserved").

Known follow-up (not this PR)

Acquire only reclaims conflicting dead owners, and nothing prunes the durable dir, so crashed daemons on never-reused socket paths leave inert .owner dirs behind — bounded growth, a natural doctor --fix candidate.

Testing

Registry derivation + env-override precedence; missing-or-mismatched record stays a coded loss with no overwrite; the admission release-race (deterministic, no sleeps); both disambiguated messages. Supervisor lifecycle/regression suites green (4600 singleton, 4603 worker recovery, package self-update, monitor, 4606 update coordinator); npm run check clean.

Net src +71 (+118/−47): the relocation is a one-line derivation change; the rest is the admission-race hardening and the error messages.

Note

Move daemon supervisor registry from $TMPDIR to ~/.prime/supervisor-owners

• Changes defaultDaemonSupervisorRegistryDir to use ~/.prime/supervisor-owners instead of a path derived from the socket directory, making ownership records durable across temp directory cleans.
• Adds legacy registry fallback in assertDaemonSupervisorOwnerCurrent and persistDaemonStartupFenceFromOwner so existing records written under the old location are still readable during transition.
• Introduces RenewableRegistryRecord to manage interval-based lease renewal in DaemonShutdownAdmission with single-flight deduplication and stop fencing.
• Enriches DaemonSupervisorOwnershipLostError with socket and registry path context to aid recovery.
• Behavioral Change: the default registry directory changes on upgrade; daemons started before the upgrade will be found via the legacy fallback (read-only) until they restart.

^{Macroscope summarized 15c7470.}

---

Note

Medium Risk
Changes durable daemon authority state location and cross-version ownership/fence behavior; incorrect legacy fallback could mis-validate owners, though changes are guarded and heavily tested.

Overview
Fixes long-lived macOS daemons wedging when supervisor authority records (ownership, startup fences, shutdown admission) were stored under $TMPDIR and reaped after ~3 days. The default registry path is now ~/.prime/supervisor-owners (env override unchanged); sockets stay short-path under temp.

Version overlap: read-only legacy registry fallback under the old socket-relative dir for owner checks and startup-fence persistence while pre-move daemons are still running—no migration of records; explicit registry args do not fall back.

Shutdown admission: lease renewal is centralized in RenewableRegistryRecord (single-flight renew, stop() awaits in-flight work, no rewrite after release) so release() cannot resurrect shutdown-admission.json when a direct assertOrRenew was queued on the registry lock.

Errors: ownership-loss messages include socket/registry paths and recovery hint; never acquired vs record missing/replaced on disk are distinguished in the supervisor.

^{Reviewed by Cursor Bugbot for commit 15c7470. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 15c7470. Configure here.}