Make stop and upgrades authoritative before AOS 2026.9.0

Outcome

AOS reports stopped only after the persistent MCP gateway, Astrid daemon, provider children, listeners, and every transient marker are gone. An upgrade never exposes a mixed executable generation.

Reproduced release blockers

At exact AOS main 238b9edcd8f352612ddf929bc149e6d54993ea1c, a successful child astrid stop exit with runtime/run/system.token still present causes aos stop to return 0; immediate aos status --json fails and names the token. The wrapper confirms stopped only for one special exit-1 disconnect path and trusts ordinary exit 0.

The installer ignores old aos stop failure and replaces five executables sequentially. Its rollback is process-local temporary state, so SIGKILL or power loss can leave mixed AOS/Astrid generations.

Astrid-side daemon/gateway shutdown is tracked by astrid-runtime/astrid#1804.

Product contract

• Product stop orders authenticated MCP gateway shutdown before daemon shutdown.
• Every child result, including exit 0, passes bounded stopped-state confirmation.
• Stopped requires no system or gateway socket/PID/ready/token markers, no process/listener, and an acquirable singleton lock.
• Preserve a primary child failure while reporting cleanup/confirmation failure separately.
• Restart cannot retain an old gateway across runtime replacement.
• Installation aborts before mutation unless stopped is proven.
• Executable replacement publishes one durable generation, or uses a same-filesystem durable journal with deterministic recovery to all-old or all-new.

Required falsifiers

• Each stale marker alone and in combination after child exit 0.
• Live/wedged/recycled-PID daemon; live/dead-stale/malformed/replacement-raced gateway.
• Disabled plugin then stop leaves no gateway/attach/daemon and status is typed stopped.
• Upgrade with active attach does not retain an old process.
• Failure, SIGTERM, SIGKILL, ENOSPC, and power cuts around every executable, release directory, fsync, journal, and generation transition.
• Concurrent installer, stale lock, corrupt staging/backup, symlink substitution, downgrade/replay, and same-version retry.
• Final candidate: release/runtime identities agree and start/status/stop/status succeeds with an empty transient root.

Blocks AOS 2026.9.0. Does not authorize release publication.