fix(development): serialize lifecycle and reuse healthy managed snapshots

[adrianwebb]

Outcome

Prevent Linux boot resume and manual development commands racing on builds, snapshots, and candidate startup.

Work authority

• Work item / Issue: Serialize Linux development lifecycle and reuse healthy managed candidates #169; Serialize automatic development resume with manual runner lifecycle operations deployment#637 and #633

• Proposal / decision: Platform #467; user-directed reboot recovery before Identity cutover.

• Assignment / checkpoint: N/A — direct local user instruction, not a delegated assignment.

• Actor: Codex through authenticated adrianwebb.

• Human authority: adrianwebb authorized implementation, staging merge, release, and managed acceptance.

• Agent / capacity provider: N/A — local development task.

• Exact base ref: staging 364fbc2

• Exact head ref: codex/development-lifecycle-serialization 3705eeb

• Agent-authored under human authority

Plan

Reuse Deployment's kernel descriptor lock under separate development custody; serialize before state reads across sessions; recheck registered managed runtime; preserve healthy immutable snapshots; test subprocess owner death and actual entrypoint races.

Changes and commits

229d4f9 adds Linux lifecycle locking shared by runDevelopment and boot resume. Read-only/plan commands remain available. Healthy exact-name managed snapshots are reused; unhealthy/mismatched state requires explicit restart rather than overwrite. Non-Linux local-only behavior is unchanged. No selection expiration.

Verification

Build, file-length/architecture policy, five new tests, and protected-manager test pass locally. Full suite initially passed145/146: existing mock lacked the new status response; corrected mock and focused regression passed. Required Actions perform the complete updated suite. Real subprocess tests prove blocking and owner-death release; actual boot/manual entrypoints start exactly once.

Risk and rollback

Lock contention is bounded to60 seconds and never kills work; descriptor lives until operation completion/process death. Shared-source build/state serialization intentionally spans one operator's sessions. Explicit restart/rebuild applies source changes; use/resume retains healthy snapshots. Revert through a staging PR and restore installed CLI through managed development controls. No accounts, database schemas, credentials, or Identity cutover changes.

Completion summary

Implementation and focused verification complete; full Actions and managed concurrency/read-back remain. This does not close reboot acceptance or frozen-recipe refresh tracked under Deployment#637.

Submission checklist

• The change is bounded to the stated work item and target repository.
• Exact base and head refs are recorded and the branch is ready for review.
• Verification and compatibility evidence are recorded above.
• No plaintext secrets, credentials, machine state, or unrelated residue are included.
• Plan, status, commits, and completion summary form a complete durable record.
• Rollback or recovery steps are documented and executable.

Extracted artifact closure

Actions34404314324 passed all146 tests but rejected an unbundled Deployment import during clean package install. Commit3705eeb91c78bf5369ca390ae8830f9ac7231196 reuses the existing bundled custody boundary (no new runtime dependency, no duplicated backend). Six targeted tests now include importing and acquiring the lock from an extracted CLI with no Deployment package. Updated full Actions required before merge.