A client reaches only a server it may use; an orphaned server exits (0.6.2)

[trissim]

OpenHCS surface B7. A client attached to whatever answered at an address, and nothing stopped a server whose starter was gone.

What changes

• A server holds an EndpointLaunch (code root, the process that started it, audience) and reports it in every heartbeat (PongResponse.launch).
• EndpointAudience is a registered family: OwnerOnlyAudience (a non-persistent server) and AnySessionAudience (a persistent one). The wire carries the registry name.
• ZMQClient.launch() is what a client hands the server it starts. After the start, the client connects only if the ready server reports exactly that launch. On a mismatch it stops its own child and leaves the other server's socket files alone.
• On attach (connect at an occupied address, connect_existing), a local server must report a launch, its code root must equal the client's, and its audience must admit the client process. Otherwise the client raises EndpointLaunchMismatchError, which names the address and the reason. A remote host is not compared: its paths and process ids mean nothing on this machine.
• ZMQServer.process_messages checks its owner once a second. When the owner is gone, an owner-only server cancels its work and stops; an any-session server stops once it has no running or queued execution.
• ZMQConfig.socket_root() owns where socket and lock files live (~/.<app_name> by default; both transports read it). An application overrides it to keep installations apart.
• TransportDeclaration.private_endpoint(config) gives a caller an address of its own: a new socket directory for IPC, the first unbound pair for TCP.
• code_root() on clients and servers defaults to the directory the class's top-level package is imported from. An application with a declared import root overrides it on both.

Callers must change

• A _spawn_server_process implementation must pass self.launch() to the server it starts (EndpointLaunch.to_argument / from_argument for a command line), or the client refuses the server.
• A third-party TransportDeclaration must implement private_endpoint.

Nothing public is removed, so this is 0.6.2. Not tagged or released here.

Not changed: connect still kills the listener of an unresponsive TCP address before starting its own server (_kill_processes_on_port). That process may belong to someone else.

Tests

tests/test_endpoint_launch.py (10 tests, real server processes): two servers from two code roots and a client refused at the other's address; an owner-only server refuses another process and a persistent one admits it; a server that reports no launch is refused; a server exits after its owner is killed (both audiences); a persistent orphan finishes its work first.

Local run: 383 passed, 2 skipped, 2 failed. The 2 failures are test_ack_return_route IPC cases whose socket path under my long --basetemp exceeds sun_path; both pass with a short one.

🤖 Generated with Claude Code

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.