Module boot 

Boot orchestration (spec §4/§5). Host is the TCP server; the worker connects back and proves itself with a token+version init handshake. A racing local process without the token is rejected and the accept loop keeps going until the boot deadline (agy risk note A: a silent stall here is often an EDR/firewall intercept of the unsigned Java process, not a code bug — check that first).

Project-lock stance (spec §4/§8.1, spike D2 — DELIBERATE, not an omission): boot does NOT parse, reclaim, or delete Ghidra’s own project .lock. That file carries no PID/owner token, so it cannot be proven stale; on channel-locking filesystems the OS releases the lock on worker death, so a same-host respawn self-heals with zero cleanup. The host’s own sidecar dual-instance lock and network-share reclaim are M1 scope (this thin slice boots -readOnly, i.e. no transactions).

Structs

BootedWorker

A fully booted worker: an authenticated framed connection, the live process handle, and the lifecycle marked Ready.

HandshakeListener

The host’s handshake listener (bound before the worker is spawned so the port is known).

TokenDir 🔒

RAII cleanup for the per-boot token directory: removes it (and the plaintext token inside) when dropped, so the secret is erased on EVERY exit from boot_worker — success, ? error, or async cancellation (the future dropped mid-await). A manual cleanup on the return paths is skipped on cancellation and leaks the token on disk (merge-gate finding).

Enums

BootError

Functions

boot_worker

Full boot: bind the listener, write the token file into a private per-boot dir, spawn the launcher, await a valid handshake, delete the token file, and mark the lifecycle Ready.

read_init_frame 🔒

Read frame 1 and parse it as the worker/init notification carrying an InitAnnounce.