[luvs01]

Summary

Connected-stop preflight must prove the identity of the exact local runtime before any service-manager or process-stop mutation. A named or responding loopback process is insufficient, and preflight must not disclose reusable management credentials.

This PR is stacked on #774, which owns transport-specific routing restoration. The history-preserving integration resolves the conflicting stop implementation, fixtures and documentation while retaining both behaviors:

• Pin the protected runtime record's PID, port, hostname and attestation key; require a fresh health proof before trusting the runtime's role.
• For an ordinary proxy, require a single-use method/path-bound local-read capability for GET /api/stop and a matching response proof. Native client-role listeners own their transport-specific signal cleanup.
• Share a two-second preflight deadline and 4 KiB document bounds. Missing, changed or unverified runtime evidence refuses before service/process mutation.
• Keep POST authorization separate from read capabilities. The later stop uses the shared proxy-independent transport and preserves an observed HTTP 409 refusal even if its body is truncated or stalled.
• Retain fix(link): restore owned integrations before native signal exit #774's Link-only owned-journal restoration before listener release, hub routing preservation, receipt ownership and restart handoff behavior.
• Keep the complete hub/Link × truncated/stalled-409 fixture matrix; remove the superseded duplicate fixture flag. Update documentation to describe ownership handling rather than implying every transport preserves its routing.

The base is the open #774 branch so the review diff contains the additional identity protection. After #774 lands, this child should target dev.

Verification

Current head: f5c1707baf087f53bf151ee75fc3943430a38063. Ordered parents: previous #788 head 4c0404785ae610bc3c6996b1d6fba99cd3a24059, then verified #774 head 7458fe370227ba78db0917e21792a144100f2786. Remote tree was checked against the exact local validated tree before publication; no history was rewritten.

Bun 1.4.4:

• Seven-file stop, capability, Link, drain, CLI and handled-signal regression selection — 226 passed, 0 failed; 1,233 assertions.
• Complete client restart/rollback file — 10 passed, 0 failed; 33 assertions.
• Filtered import-connected run against previous fix(cli): attest connected-stop preflight reads #788 HEAD, covering capability authentication and Link restoration — 34 passed, 0 failed; 151 assertions.
• Layout, tooling and size-ratchet gates — 38 passed, 0 failed.
• Typecheck, structure, privacy and staged whitespace checks passed. CLI executable mode remains 100755.
• Frozen docs install and build passed: 593 pages, 84,953 checked internal links.

The previous #788 head completed Cross-platform CI, Catalog async contracts, and Service lifecycle. The #774 parent completed its required current-head workflows as well. These results are historical evidence; the current combined-head results are recorded below.

Focused and filtered selections follow the repository's concurrent-worktree resource exception. No full local repository suite was rerun for the integration. Earlier bounded changed-suite attempts were incomplete and remain non-passing evidence; policy-skipped macOS/Windows jobs are not native-platform validation.

Current-head hosted CI

Head f5c1707baf087f53bf151ee75fc3943430a38063 completed Cross-platform CI, Catalog async contracts, Service lifecycle successfully. Skipped platform jobs remain outside the native acceptance evidence. The PR remains draft for maintainer security review.

Checklist

• Existing history preserved; overlapping stop changes reconciled.
• Focused regressions and scoped import-connected coverage passed.
• Owning documentation and translated lifecycle guidance are consistent.
• Current combined-head CI completed.
• Explicit maintainer security review completed.

The PR remains draft.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Deterministic PR hygiene checks passed.

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[luvs01]

The independent preflight change from 4c0404785ae610bc3c6996b1d6fba99cd3a24059 has been carried forward with its original history and refreshed validation. The Link-restoration implementation and expanded 409 matrix remain tracked in #774 at 7458fe370227ba78db0917e21792a144100f2786; integration snapshot f5c1707baf087f53bf151ee75fc3943430a38063 is retained in this branch's history.

Closing this duplicate preflight review. The separate Link-restoration review and its release hold remain in place.