[nwparker]

	Files	Added	Deleted	Net
Test	4	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​330	$\color{#cf222e}{\Huge{\mathbf{−}}}$​12	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​318
Prod	7	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​167	$\color{#cf222e}{\Huge{\mathbf{−}}}$​44	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​123

ELI5

When Orca stops its background server (orcad), it first checks that the process ID still belongs to that same orcad, and not to some other program that got the reused ID. On Linux that check compared start times worked out from a boot timestamp that can shift while the machine runs (WSL2 especially). Once that timestamp shifted, Orca decided the orcad "had already exited", skipped asking it to stop, and left it running. Now Linux uses the kernel's own start counter and boot ID, which never shift.

What Changed

Before: on a WSL2 smoke, /proc/stat btime moved by 47 s in ten minutes. orcad's computed start time then differed from the startedAtMs in orcad.lock by 110 s and later 157 s, well over the 1.5 s tolerance. completeOrcadManagedStop read that as "PID reused, so exited". It never wrote the stop request, the client deactivated the record anyway, the receipt said retirement: "unverifiable", and orcad plus its terminal daemon kept running until they exited on their own after 15 minutes of idle.

After:

• orcad.lock records two new optional fields on Linux: linuxStartTicks (field 22 of /proc/<pid>/stat) and bootId (/proc/sys/kernel/random/boot_id). startedAtMs is still written. This is the same drift-free identity the terminal daemon's pid file already uses.
• One comparison, compareOrcadProcessIdentity, answers matches / differs / unknown / unproven:
  • If the record has both ticks and boot ID, those decide. A different boot or different ticks means differs, which counts as proof. If the ticks can't be read, the answer is unknown, not proof.
  • Without them (records from older builds), wall-clock time is the fallback. On Linux a mismatch is now unproven, because that time comes from a btime that drifts. On Windows and macOS the OS stores the creation time, so a mismatch there still counts as proof of reuse, as before.
• Managed stop: differs means exited, unproven means unverifiable, and unknown keeps polling as live. A death verdict now needs a missing PID or a proven kernel-identity change. The expected ticks come from the request if it has them, otherwise from the lock, but only while the lock still names this instance by pid, start time and nonce.
• Lock acquisition (the other caller of the start-time identity) follows the same rule. Only a proven differs lets a new orcad reclaim a live holder's lock. Before this, btime drift could also let a second orcad take the lock from a live one.
• The SSH client copies linuxStartTicks/bootId from the remote lock into the stop request when both are there.

Why

Ticks plus boot ID is already the identity the terminal daemon trusts (daemon-incarnation-evidence.ts), and it involves no clock. Alternatives I rejected:

• A wider tolerance: drift has no upper bound, and a wider tolerance weakens the reuse check everywhere.
• Re-reading btime at both ends: the lock's value was captured at an earlier btime.
• Dropping the reuse check: Linux reuses PIDs too.

This also affects SSH hosts that run on VMs whose clock gets stepped or slewed, not only WSL.

Compatibility

Clients and hosts update independently. Every new field is optional, and a malformed value is salvaged to absent rather than making the lock or request unreadable.

Writer → reader	Result
New orcad lock → older desktop/SSH client	Parses. Older z.object drops the two keys, and startedAtMs is still present. Covered by a test using the older reader shape.
Older orcad lock → new client/slot	No incarnation, so wall-clock fallback. On Linux a mismatch is unverifiable, never exited.
New client request (with ticks) → older slot	Older slot's non-strict instance schema drops them. Behaves exactly as before. Covered by a test.
Older client request (no ticks) → new slot	New slot takes the ticks from the lock while the lock still names the instance. Covered by a test.
New slot completion/receipt JSON → older client	Extra instance keys are dropped. The client matches only on transactionId.

Instance matching between the running orcad and a request (sameOrcadManagedStopInstance: pid + startedAtMs + nonce) is unchanged, so no request that was accepted before is refused now.

Linked Issue

None found.

Visual Proof

N/A. This is host-side process-identity logic with no UI change.

Testing

• orcad-managed-stop-identity.test.ts covers:

  • btime drifted, ticks and boot ID match (taken from the lock or from the request): live, request written, then proven exit with a receipt
  • different ticks: exited
  • different boot ID: exited
  • ticks unreadable: live, never exited
  • older lock without ticks plus a Linux time mismatch: unverifiable, no receipt
  • compatibility in both directions for the request instance

• orcad-instance-lock.test.ts covers:

  • a drifted holder with matching ticks stays held, and different ticks lets the lock be reclaimed
  • an older Linux record with a time mismatch stays held
  • a new lock parsed by the older reader shape
  • a malformed incarnation is salvaged

• orcad-process-start-time.test.ts tests the comparison verdicts directly.

• Ran pnpm tc, the src/main/orcad + src/main/ssh + src/main/wsl suites (3577 passed), oxlint, check:code-quality:changed, check:max-lines-ratchet, check:reliability-gates, check:ts-nocheck-ratchet, audit:code-quality:type-aware, and pnpm format. All ran on macOS. The real /proc reads only run on Linux CI, and this was not re-run on a real WSL2 host.

• I manually tested these changes locally

• Automated tests added/updated, or explained why not below

AI Disclosure

Review

Agent skill upstream boundary

• Not applicable, or this change copies or mechanically translates no upstream skill-installer source, tests, fixtures, registry entries, path tables, comments, or documentation.

Notes

Ensure no issues in: Security, Cross-platoform support (Linux, Windows, Mac), Remote SSH, Mobile, general backwards compatibility, performance

Checklist

• This PR is small and focused
• I explained what changed and why (ELI5, the user-facing before/after, the mechanism, and why over the alternatives)
• Before/after screenshots or videos attached for UI changes, or N/A with reason
• Self-reviewed for correctness, security, and performance
• Cross-platform, SSH/remote, and path/shortcut impact considered (or N/A)
• pnpm lint, pnpm typecheck, pnpm test, and pnpm build pass (or CI will cover; local preferred)