feat: coordinate concurrent CBM sessions

[DeusData]

Summary

Adds one mandatory per-account coordination daemon for long-lived MCP and hook sessions.

• The first daemon-backed session starts the daemon; the final session shuts it down.
• Watchers, indexing jobs, resource state, and the optional UI are shared across Claude Code, Codex, OpenCode, and other clients.
• Work remains session-owned: disconnecting one session cancels its exclusive work while shared work continues.
• One-shot CLI commands stay local and leave no daemon behind. They use coordinated admission and per-project locks, and can be cancelled safely during maintenance.
• Interactive CLI commands show progress on stderr; stdout remains machine-safe.

Coordination and activation

All concurrent CBM processes must agree on the exact version, executable build, coordination ABI, and canonical CBM_CACHE_DIR. Conflicting processes fail before doing work, report the conflict to the launching session, and record it in daemon-conflicts.ndjson.

Native install, update, and uninstall commands:

1. download, verify, and stage the candidate;
2. publish account-wide maintenance intent;
3. cancel daemon sessions and temporary CLI operations;
4. wait for coordinated processes to exit;
5. activate atomically while holding exclusive admission barriers;
6. log the outcome and tell the user to restart open coding-agent sessions.

Windows uses a permanent launcher with an atomically replaceable payload, allowing the same lifecycle guarantees despite executable-file locking. npm, PyPI, and Go wrappers verify and publish their private cached binaries safely.

Security and observability

• Local IPC authenticates the connecting OS account using Unix peer credentials or Windows access-token checks.
• Coordination state, locks, logs, and activation files use private permissions and fail closed when ownership, ACLs, path identity, or namespace validation is unsafe.
• MCP stdout remains reserved for JSON-RPC; immediate session failures use stderr.
• Durable daemon, conflict, and activation logs are written beneath the canonical cache root.
• No third-party runtime dependency or external coordination service is introduced.

Verification

Recent local verification on the merged checkpoint line:

• Sanitizer test-runner build passed at the pushed source state.
• Subprocess 27/27, index supervisor 6/6, daemon bootstrap 21/21, daemon frontend 12/12, daemon runtime 39/39, daemon IPC 46/46, cross-repo 7/7, and MCP 178/178 passed.
• CLI 256/256 passed before the final macOS fixture-only adjustment; the adjusted fixture compiles in the current sanitizer build.
• Windows launcher/bundle contract passed.
• Portable CI lint (cppcheck, formatting, suppression policy) passed.
• Vendored integrity audit passed after updating the pinned SQLite checksum.

Current-head GitHub CI is intentionally left running on this draft PR.

Handoff / where work stopped (2026-07-18)

Pushed checkpoint: 7696b1486a10f19e231f5b8285abe6eea71b9a3c.

The latest checkpoint additionally:

• releases the bootstrap handoff when a spawned generation becomes observable and orders daemon ownership as participant → claim → lifetime, with teardown in the reverse-safe order;
• makes subprocess log delivery bounded per poll, lossless at terminal drain, cancellation-linearized, and UTF-8-path-safe on Windows;
• replaces the cross-repo cancellation polling race with a synchronous internal test seam;
• hardens the Windows guard fixture with a protected current-user DACL without weakening product ACL policy;
• fixes the MCP null-plus-zero UBSan finding and stabilizes daemon frontend timeout diagnostics;
• raises the existing vendored Unix SQLite VFS path ceiling from 512 to 4096 bytes, matching CBM's existing 4 KiB path support and fixing the Linux long-database-path regression;
• uses the running test runner as the macOS signed-update candidate instead of re-signing Apple's platform /usr/bin/true, which is policy-dependent on older macOS runners;
• merges current main and its isolated parallel-suite runner.

Known next task:

• The previous head's full Windows test job compiled successfully but its runtime suite cascaded after strict private-filesystem checks rejected the GitHub/MSYS shared temporary ancestry. Keep production checks strict. Harden a per-user profile test root with a protected current-SID DACL, then route TEMP, TMP, TMPDIR, runtime/cache paths, and the MSYS /tmp mapping through it for the full Windows harness. Re-run exact-head Windows smoke/guards/native tests afterward.

No merge was performed; the PR remains draft for the follow-up session.