Fork integration: porting MultiSeat-Extended as a four-PR sequence

[vibesoftwarecoder]

Tracking issue for porting @Dani6ca-T's work from
Dani6ca-T/MultiSeat-Extended into this repo as a
sequence of small, reviewable PRs.

This exists because the design discussion was happening on #26, which is now closed. It belongs
somewhere that outlives any single PR.

The sequence

PR	contents	status
A	the four clean fixes — atomic config writes, corrupt-preset quarantine, config-range validation, duplicate-provisioning guard	open as #27, CHANGES_REQUESTED
B	a minimal process-identity primitive only: ProcessIdentity = PID + process start time, GetProcessStartTime(pid), identity-aware liveness and termination	not opened
C	teardown / session-replacement guards, built on the SeatLifecycleGate already in this repo	not opened
D	API contract changes (18a733ca, d0446ae)	not opened

Each PR rebased on current master rather than on the fork's history.

Why B comes before C

@Dani6ca-T's dependency audit, refined in
#26 (comment):

• The teardown guards do not require the process-tracking subsystem. Their semantic prerequisite
  is SeatLifecycleGate, which is already here.
• The PID-reuse safety fixes do have a real process-identity dependency — but that dependency is
  the primitive, not the architecture around it.

We verified this independently before agreeing:

• No guard commit's production code touches ProcessTracking. The IProcessTracker references in
  those commits are all Mock.Of<IProcessTracker>() in test files satisfying ApolloManager's
  constructor.
• SeatLifecycleGate.cs is present on master.
• ProcessIdentity in the fork is a 43-line readonly record struct — ProcessId, StartedAt,
  Matches(pid, startTime). Small enough to lift on its own.
• 18a733ca, d0446ae and 526202f are not on master. 79dfced effectively is — master
  carries SeatStatus.Connecting in the transition table and the dashboard already renders
  Connecting: "Reconnecting..." — so PR D does not need it.

PID alone is ambiguous across process reuse. PID plus start time is the right primitive, and it is
what the PID-reuse fixes actually depend on.

Known cost, so it is not a surprise mid-PR

The SeatManager constructors have diverged beyond the ApolloProcessId → StreamingProcessId
rename and the transition-table enforcement:

fork	here
IAccountManager, ISessionLauncher, IVirtualDisplayManager	concrete AccountManager, SessionLauncher, VirtualDisplayManager
IStreamingProvider + IStreamingConfigurator	ApolloManager + ApolloConfigBuilder
—	Monitoring.ApolloServerQuery

Production hunks translate cleanly. The cost is in the tests, which construct SeatManager
directly and run 321–391 lines each. Worth budgeting for in PR C.

⚠️ Two changes should travel with the PR they belong to rather than riding along in a guard commit:
dbb93c7 adds LaunchedProcessId to MultiSeat.Shared/Models/SeatInfo.cs (a contract change —
PR D), and a461885 de-seals ProcessInjector and virtualises two methods for mocking (its own
decision).

⚠️ Diff each PR against master, not against #26. Some of that work already exists here under
different names — #26's four fixes were already implemented in 201d683 before it was opened, which
is why the hand-port collided.

Two carry-overs from the #27 review

• Keep the Apollo startup diagnostic. It is what distinguishes a seat that failed before Apollo came
  up from one that failed after, and it is easy to drop in a translation pass.
• If a change swaps an in-place write for a rename, re-grant the seat's ACE afterwards. That is the
  open issue on Pr1 four clean #27, and A seat's config directory is writable by every local user, including other seats #28 is the same class of problem from the other direction.

Credit

@Dani6ca-T is credited in the release notes of whatever version carries 201d683 and 287a9c7,
independently of how any of these PRs land. Recorded in #25 and unchanged by this plan.

[vibesoftwarecoder]

Status update — PR A has landed.

A merged as #27 on 2026-09-08. The table above still lists it as "open as #27, CHANGES_REQUESTED", which is now out of date.

B, C and D remain unopened, and the ordering argument is unchanged. Both halves of it re-verified against master today:

• ProcessIdentity and GetProcessStartTime are not on master, so B is still genuinely outstanding rather than quietly absorbed by another PR.
• SeatLifecycleGate.cs is on master, so C's semantic prerequisite still holds and B is still not a blocker for it.

Worth noting so nothing gets double-counted: #30 and #31 merged the seat config ACL work from #28, and #36/#37 covered RDP Wrapper diagnostics and the dashboard dependency refresh. None of those belong to the A–D sequence.

Leaving this open — three of the four PRs are still real work.

[vibesoftwarecoder]

B has landed as #39, merged to master as ea309d8.

Scope held to the primitive as planned: ProcessIdentity (PID + OS start time + Matches), identity-verified liveness and termination in ApolloManager. No IProcessTracker, no ProcessTracking namespace.

One gap left open deliberately: Stop after a service restart has no instance record and only a bare PID on SeatInfo. It now checks the PID still names an Apollo before killing, which is weaker than the identity check, not equivalent. Carrying identity on SeatInfo closes it and remains PR D's work — flagged here so it is not mistaken for done.

C and D remain. C's cost is still the tests, which construct SeatManager directly and run 321–391 lines each.

[vibesoftwarecoder]

C has landed as #40, merged as 5dbf939.

Both races closed: the TOCTOU across the gate (all lifecycle operations now re-resolve the seat after acquisition, and four that had no gate at all now take one), and teardown's deregister-before-gate ordering.

D is the only one left, and it now carries a second job. PR B deliberately left Stop unverified when no instance record exists — after a service restart, only a bare PID survives on SeatInfo, so the kill falls back to a process-name check rather than an identity match. Carrying ProcessIdentity on SeatInfo is what closes that, and it is D's contract change.

Also not ported, and worth deciding on separately rather than folding into D: 526202f (explicit launched-app cleanup during teardown). It depends on ProcessTracking/LaunchedProcessCleanup — the subsystem this port scoped out — at 796 insertions across 8 files.

[vibesoftwarecoder]

Sequence complete. All four PRs have landed.

PR	what	merged
A	four clean fixes — atomic config writes, corrupt-preset quarantine, config-range validation, duplicate-provisioning guard	#27
B	ProcessIdentity — PID + OS start time, identity-verified liveness and termination	#39
C	teardown and session-replacement guards on SeatLifecycleGate	#40
D	API status semantics (503 / 409 / 404), and ApolloIdentity on SeatInfo	#41

Each was diffed against master rather than against #26, which is what this issue existed to make possible — #26 collided because work already here under different names was re-applied blind.

Two pieces were deliberately left out, and neither is forgotten:

• 526202f — explicit launched-app cleanup during teardown. Depends on ProcessTracking/LaunchedProcessCleanup, the subsystem this port scoped away, at 796 insertions across 8 files.
• dbb93c7's LaunchedProcessId — a SeatInfo contract field with no consumer until the launched-app lifecycle work lands. It should travel with the behaviour that reads it.

Those two belong together and are their own decision, not a leftover of this one. Worth a fresh issue if they're wanted.

Thanks again to @Dani6ca-T — every one of these is ported from MultiSeat-Extended.

Closing.