refactor(managed-server): move the managed server's lifecycle into src/main/managed-server/lifecycle/ (#30343)

orcad-managed-*, orcad-runtime-*, orcad-stdio-bridge-*, orcad-decommission-* and orcad-rollback-*
leave src/main/ssh. git mv plus import and path-literal rewrites; two e2e route regexes learn the
new folder. orcad-runtime-maintenance stays for now because open #29834 edits it.

config/legacy-relay-compat-tags-baseline.txt

@@ -17,7 +17,7 @@ src/main/ssh/orcad-migration-repository-link.test.ts
 src/main/ssh/orcad-migration-terminal-gate-host-wide.test.ts
 src/main/ssh/orcad-migration-terminal-gate.test.ts
 src/main/ssh/orcad-migration-terminal-gate.ts
-src/main/ssh/orcad-runtime-conversion.test.ts
+src/main/managed-server/lifecycle/orcad-runtime-conversion.test.ts
 src/main/ssh/ssh-host-server-on-connect.test.ts
 src/main/ssh/ssh-host-server-on-connect.ts
 src/main/ssh/ssh-target-orcad-preflight.ts

config/legacy-relay-importers-baseline.txt

@@ -10,6 +10,6 @@ src/main/ipc/ssh-host-server-on-connect-wiring.ts
 src/main/ipc/ssh-session-teardown.ts
 src/main/ipc/ssh.ts
 src/main/ssh/orcad-migration-terminal-gate-host-wide.test.ts
-src/main/ssh/orcad-runtime-conversion-wiring.ts
+src/main/managed-server/lifecycle/orcad-runtime-conversion-wiring.ts
 tests/e2e/cross-version-wire/legacy-relay-bridge.unit.test.ts
 tests/e2e/helpers/legacy-relay-docker-host.ts

config/scripts/ci-shard-timings.json

@@ -5593,27 +5593,27 @@
       "src/main/ssh/orcad-activation-outcome-log.test.ts": 40,
       "src/main/managed-server/activation/orcad-activation-record.test.ts": 245,
       "src/main/managed-server/activation/orcad-activation-transaction.test.ts": 451,
-      "src/main/ssh/orcad-decommission-released-peer-recovery.test.ts": 266,
-      "src/main/ssh/orcad-decommission-transaction.test.ts": 309,
+      "src/main/managed-server/lifecycle/orcad-decommission-released-peer-recovery.test.ts": 266,
+      "src/main/managed-server/lifecycle/orcad-decommission-transaction.test.ts": 309,
       "src/main/ssh/orcad-deployment-target.test.ts": 263,
       "src/main/ssh/orcad-exited-own-fence-mutation-race.test.ts": 822,
       "src/main/ssh/orcad-exited-own-fence.test.ts": 5949,
       "src/main/ssh/orcad-exited-own-install-lock.test.ts": 4491,
       "src/main/ssh/orcad-exited-own-lock-windows.test.ts": 422,
       "src/main/ssh/orcad-fence-lost-classification.test.ts": 374,
-      "src/main/ssh/orcad-managed-auto-update.test.ts": 438,
-      "src/main/ssh/orcad-managed-bound-port.test.ts": 442,
-      "src/main/ssh/orcad-managed-serving.test.ts": 489,
-      "src/main/ssh/orcad-managed-tunnel-bridge-port.test.ts": 414,
-      "src/main/ssh/orcad-managed-tunnel-identity-restart.test.ts": 5282,
-      "src/main/ssh/orcad-managed-tunnel-identity.test.ts": 447,
-      "src/main/ssh/orcad-managed-tunnel-target.test.ts": 558,
-      "src/main/ssh/orcad-managed-tunnel-transport.test.ts": 437,
-      "src/main/ssh/orcad-managed-tunnel.test.ts": 914,
-      "src/main/ssh/orcad-managed-update-deferrals.test.ts": 30,
-      "src/main/ssh/orcad-managed-update-on-restore.test.ts": 422,
-      "src/main/ssh/orcad-managed-version-gc.test.ts": 380,
-      "src/main/ssh/orcad-managed-wake.test.ts": 567,
+      "src/main/managed-server/lifecycle/orcad-managed-auto-update.test.ts": 438,
+      "src/main/managed-server/lifecycle/orcad-managed-bound-port.test.ts": 442,
+      "src/main/managed-server/lifecycle/orcad-managed-serving.test.ts": 489,
+      "src/main/managed-server/lifecycle/orcad-managed-tunnel-bridge-port.test.ts": 414,
+      "src/main/managed-server/lifecycle/orcad-managed-tunnel-identity-restart.test.ts": 5282,
+      "src/main/managed-server/lifecycle/orcad-managed-tunnel-identity.test.ts": 447,
+      "src/main/managed-server/lifecycle/orcad-managed-tunnel-target.test.ts": 558,
+      "src/main/managed-server/lifecycle/orcad-managed-tunnel-transport.test.ts": 437,
+      "src/main/managed-server/lifecycle/orcad-managed-tunnel.test.ts": 914,
+      "src/main/managed-server/lifecycle/orcad-managed-update-deferrals.test.ts": 30,
+      "src/main/managed-server/lifecycle/orcad-managed-update-on-restore.test.ts": 422,
+      "src/main/managed-server/lifecycle/orcad-managed-version-gc.test.ts": 380,
+      "src/main/managed-server/lifecycle/orcad-managed-wake.test.ts": 567,
       "src/main/ssh/orcad-migration-catalog-client-extra-agent-args.test.ts": 351,
       "src/main/ssh/orcad-migration-catalog-client-source-kind.test.ts": 378,
       "src/main/ssh/orcad-migration-catalog-client.test.ts": 373,
@@ -5660,19 +5660,19 @@
       "src/main/ssh/orcad-retained-fence-takeover.test.ts": 200,
       "src/main/ssh/orcad-retained-source-lists.test.ts": 504,
       "src/main/ssh/orcad-running-version-adoption.test.ts": 383,
-      "src/main/ssh/orcad-runtime-conversion.test.ts": 2187,
-      "src/main/ssh/orcad-runtime-decommission.test.ts": 877,
-      "src/main/ssh/orcad-runtime-deployment.test.ts": 873,
-      "src/main/ssh/orcad-runtime-forget.test.ts": 814,
+      "src/main/managed-server/lifecycle/orcad-runtime-conversion.test.ts": 2187,
+      "src/main/managed-server/lifecycle/orcad-runtime-decommission.test.ts": 877,
+      "src/main/managed-server/lifecycle/orcad-runtime-deployment.test.ts": 873,
+      "src/main/managed-server/lifecycle/orcad-runtime-forget.test.ts": 814,
       "src/main/ssh/orcad-runtime-maintenance.test.ts": 894,
-      "src/main/ssh/orcad-runtime-target.test.ts": 217,
+      "src/main/managed-server/lifecycle/orcad-runtime-target.test.ts": 217,
       "src/main/ssh/orcad-ssh-provisioning.test.ts": 271,
       "src/main/ssh/orcad-state-mutation-exec.test.ts": 360,
       "src/main/ssh/orcad-state-mutation-fence-heartbeat.test.ts": 4403,
       "src/main/ssh/orcad-state-mutation-timeout.test.ts": 434,
       "src/main/ssh/orcad-state-snapshot-shell.test.ts": 832,
       "src/main/ssh/orcad-state-snapshot.test.ts": 334,
-      "src/main/ssh/orcad-stdio-bridge-provider.test.ts": 705,
+      "src/main/managed-server/lifecycle/orcad-stdio-bridge-provider.test.ts": 705,
       "src/main/ssh/orcad-stdio-bridge.test.ts": 597,
       "src/main/ssh/orcad-terminal-census-client.test.ts": 302,
       "src/main/ssh/orcad-tunneled-pairing.test.ts": 257,

config/scripts/pr-e2e-route-contracts.test.mjs

@@ -354,7 +354,7 @@ describe('orcad-e2e-routing', () => {
   it('routes the auto-convert spec from its conversion sources and harness', () => {
     expectRouted(
       [
-        'src/main/ssh/orcad-runtime-conversion.ts',
+        'src/main/managed-server/lifecycle/orcad-runtime-conversion.ts',
         'tests/e2e/helpers/orcad-convert-flow.ts',
         'tests/e2e/helpers/orcad-convert-host.ts',
         'tests/e2e/helpers/orcad-template-variant.ts',
@@ -362,9 +362,9 @@ describe('orcad-e2e-routing', () => {
       ],
       ORCAD_AUTO_CONVERT_E2E_SPEC
     )
-    expect(selectPrE2eSpecs(['src/main/ssh/orcad-runtime-conversion.test.ts'])).not.toContain(
-      ORCAD_AUTO_CONVERT_E2E_SPEC
-    )
+    expect(
+      selectPrE2eSpecs(['src/main/managed-server/lifecycle/orcad-runtime-conversion.test.ts'])
+    ).not.toContain(ORCAD_AUTO_CONVERT_E2E_SPEC)
   })
 
   it('routes the idle-exit spec from its idle sources and the shared convert harness', () => {
@@ -372,7 +372,7 @@ describe('orcad-e2e-routing', () => {
       [
         'src/shared/orcad-idle-exit.ts',
         'src/main/managed-server/install/orcad-remote-runtime-control.ts',
-        'src/main/ssh/orcad-managed-serving.ts',
+        'src/main/managed-server/lifecycle/orcad-managed-serving.ts',
         'tests/e2e/helpers/orcad-convert-flow.ts',
         'tests/e2e/helpers/orcad-convert-host.ts'
       ],

config/scripts/pr-e2e-source-routing.mjs

@@ -128,7 +128,7 @@ export const PR_E2E_SOURCE_ROUTES = [
     matches: (file) =>
       MANAGED_SSH_HARNESS.test(file) ||
       (isProductSource(file) &&
-        /^src\/main\/(?:ipc\/ssh-host-server-|ssh\/(?:ssh-host-server-|orcad-runtime-conversion|orcad-migration-|orcad-retained-source|orcad-runtime-deployment))/.test(
+        /^src\/main\/(?:ipc\/ssh-host-server-|(?:ssh|managed-server\/[a-z-]+)\/(?:ssh-host-server-|orcad-runtime-conversion|orcad-migration-|orcad-retained-source|orcad-runtime-deployment))/.test(
           file
         ))
   },
@@ -248,7 +248,7 @@ export const PR_E2E_SOURCE_ROUTES = [
         file
       ) ||
       (isProductSource(file) &&
-        /^src\/(?:main\/ssh\/orcad-managed-|main\/ipc\/ssh-port-forward|main\/(?:ipc\/(?:ssh-(?:connect-flow|connection-handlers|host-user-disconnect|session-teardown)|runtime-environment-(?:connectivity-handlers|manual-disconnect))|ssh\/ssh-(?:connection-manager|user-disconnect))\.ts$|renderer\/src\/startup\/(?:ssh-startup-reconnect|startup-ssh-connection-restore)\.ts$|renderer\/src\/runtime\/(?:web-runtime-session|web-session-close-|runtime-terminal-artifact-read\.ts$)|renderer\/src\/components\/terminal-pane\/(?:remote-runtime-|terminal-host-(?:workspace-file|file-link-existence)\.ts$))/.test(
+        /^src\/(?:main\/(?:ssh|managed-server\/[a-z-]+)\/orcad-managed-|main\/ipc\/ssh-port-forward|main\/(?:ipc\/(?:ssh-(?:connect-flow|connection-handlers|host-user-disconnect|session-teardown)|runtime-environment-(?:connectivity-handlers|manual-disconnect))|ssh\/ssh-(?:connection-manager|user-disconnect))\.ts$|renderer\/src\/startup\/(?:ssh-startup-reconnect|startup-ssh-connection-restore)\.ts$|renderer\/src\/runtime\/(?:web-runtime-session|web-session-close-|runtime-terminal-artifact-read\.ts$)|renderer\/src\/components\/terminal-pane\/(?:remote-runtime-|terminal-host-(?:workspace-file|file-link-existence)\.ts$))/.test(
           file
         ))
   },

config/scripts/vitest-sqlite-runtime-files.mjs

@@ -296,7 +296,7 @@ export const SQLITE_RUNTIME_INCLUDE = [
   'src/main/ssh/orcad-migration-source-fence.test.ts',
   'src/main/ssh/orcad-migration-ssh-relay-source.test.ts',
   'src/main/ssh/orcad-migration-stuck-host-profiles.test.ts',
-  'src/main/ssh/orcad-runtime-conversion.test.ts',
+  'src/main/managed-server/lifecycle/orcad-runtime-conversion.test.ts',
   'src/main/ssh/orcad-unreachable-setup-release.test.ts',
   'src/main/ssh/ssh-target-orcad-preflight.test.ts',
   'src/main/worktree-identity-persistence.test.ts',

src/main/ephemeral-vm-runtime-environment-release.test.ts

@@ -14,7 +14,9 @@ vi.mock('../shared/runtime-environment-store', () => ({
 vi.mock('../shared/runtime-environment-managed-orcad-store', () => ({
   removeManagedOrcadEnvironment: mocks.removeManaged
 }))
-vi.mock('./ssh/orcad-managed-tunnel', () => ({ closeOrcadManagedTunnel: mocks.closeTunnel }))
+vi.mock('./managed-server/lifecycle/orcad-managed-tunnel', () => ({
+  closeOrcadManagedTunnel: mocks.closeTunnel
+}))
 
 import { releaseEphemeralVmRuntimeEnvironments } from './ephemeral-vm-runtime-environment-release'
 

src/main/ephemeral-vm-runtime-environment-release.ts

@@ -20,7 +20,8 @@ export async function releaseEphemeralVmRuntimeEnvironments(
       removeEnvironment(userDataPath, environment.id)
       continue
     }
-    const { closeOrcadManagedTunnel } = await import('./ssh/orcad-managed-tunnel')
+    const { closeOrcadManagedTunnel } =
+      await import('./managed-server/lifecycle/orcad-managed-tunnel')
     await closeOrcadManagedTunnel(environment.id).catch(() => undefined)
     removeManagedOrcadEnvironment(userDataPath, environment.id)
   }

src/main/ipc/desktop-browser-bridge-wiring.test.ts

@@ -10,7 +10,9 @@ vi.mock('electron', () => ({ webContents: { fromId: () => null } }))
 vi.mock('../browser/browser-manager', () => ({ browserManager: {} }))
 vi.mock('../runtime/rpc/methods', () => ({ ALL_RPC_METHODS: [] }))
 vi.mock('./ssh-ipc-context', () => ({ persistedStore: null }))
-vi.mock('../ssh/orcad-managed-tunnel', () => ({ ensureOrcadManagedTunnel: vi.fn() }))
+vi.mock('../managed-server/lifecycle/orcad-managed-tunnel', () => ({
+  ensureOrcadManagedTunnel: vi.fn()
+}))
 vi.mock('../ssh/ssh-target-registry', async (importOriginal) => ({
   ...(await importOriginal<Record<string, unknown>>()),
   getSshTargetRegistryStore: () => ({ listTargets: () => targets })

src/main/ipc/desktop-browser-bridge-wiring.ts

@@ -30,7 +30,7 @@ import { rendererResolveRemoteCliWorkspace } from '../browser/desktop-browser-br
 import type { OrcaRuntimeService } from '../runtime/orca-runtime'
 import { RpcDispatcher } from '../runtime/rpc/dispatcher'
 import { ALL_RPC_METHODS } from '../runtime/rpc/methods'
-import { ensureOrcadManagedTunnel } from '../ssh/orcad-managed-tunnel'
+import { ensureOrcadManagedTunnel } from '../managed-server/lifecycle/orcad-managed-tunnel'
 import { getSshTargetRegistryStore } from '../ssh/ssh-target-registry'
 import type { SshConnectionManager } from '../ssh/ssh-connection-manager'
 import { getRuntimeEnvironmentStatus } from './runtime-environment-status-probe'

src/main/ipc/managed-orcad-actions.ts

@@ -3,8 +3,8 @@ import {
   cancelManagedOrcadStop,
   forgetManagedOrcadEnvironment,
   stopManagedOrcadEnvironment
-} from '../ssh/orcad-runtime-decommission'
-import { getManagedOrcadRuntimeStatus } from '../ssh/orcad-runtime-status'
+} from '../managed-server/lifecycle/orcad-runtime-decommission'
+import { getManagedOrcadRuntimeStatus } from '../managed-server/lifecycle/orcad-runtime-status'
 import {
   recoverManagedOrcadEnvironment,
   rollbackManagedOrcadEnvironment,
@@ -13,7 +13,7 @@ import {
 import { getOrcadSshDeployment } from '../../shared/runtime-environments'
 import { resolveEnvironment } from '../../shared/runtime-environment-store'
 import type { OrcadManagedRestartResult } from '../../shared/orcad-managed-runtime'
-import { restartManagedOrcadEnvironment } from '../ssh/orcad-managed-launch-session'
+import { restartManagedOrcadEnvironment } from '../managed-server/lifecycle/orcad-managed-launch-session'
 import { clearLaunchSessionNote } from './runtime-environment-managed-tunnel'
 import { forgetLaunchSessionVerdict } from './ssh-host-launch-session-note'
 import type { ManagedServerActions } from '../runtime/managed-server-actions-registry'

src/main/ipc/orcad-delta-move-handlers.test.ts

@@ -19,7 +19,7 @@ vi.mock('electron', () => ({ ipcMain: { handle: mocks.handle } }))
 vi.mock('../../shared/runtime-environment-store', () => ({
   listEnvironments: () => [{ id: 'env-1' }]
 }))
-vi.mock('../ssh/orcad-managed-runtime-context', () => ({
+vi.mock('../managed-server/lifecycle/orcad-managed-runtime-context', () => ({
   requireManagedOrcadInfrastructure: () => ({
     claims: {},
     targetStore: { getOrcadMigrationSource: () => ({ getSshTarget: () => mocks.target }) }
@@ -29,10 +29,10 @@ vi.mock('../ssh/orcad-migration-delta-move', () => ({
   runOrcadDeltaMove: mocks.move,
   keepOrcadServerVersion: mocks.keep
 }))
-vi.mock('../ssh/orcad-runtime-conversion-wiring', () => ({
+vi.mock('../managed-server/lifecycle/orcad-runtime-conversion-wiring', () => ({
   orcadMigrationDestinationFor: () => ({})
 }))
-vi.mock('../ssh/orcad-managed-tunnel', () => ({
+vi.mock('../managed-server/lifecycle/orcad-managed-tunnel', () => ({
   ensureOrcadManagedTunnel: vi.fn()
 }))
 vi.mock('./ssh-session-teardown', () => ({

src/main/ipc/orcad-delta-move-handlers.ts

@@ -5,12 +5,12 @@ import type {
   OrcadDeltaMoveResult
 } from '../../shared/orcad-managed-runtime'
 import { listEnvironments } from '../../shared/runtime-environment-store'
-import { requireManagedOrcadInfrastructure } from '../ssh/orcad-managed-runtime-context'
-import { ensureOrcadManagedTunnel } from '../ssh/orcad-managed-tunnel'
+import { requireManagedOrcadInfrastructure } from '../managed-server/lifecycle/orcad-managed-runtime-context'
+import { ensureOrcadManagedTunnel } from '../managed-server/lifecycle/orcad-managed-tunnel'
 import { keepOrcadServerVersion, runOrcadDeltaMove } from '../ssh/orcad-migration-delta-move'
 import { planOrcadDeltaMove } from '../ssh/orcad-migration-delta-plan'
 import { censusHostRelayTerminalsFor } from '../ssh/legacy-relay/ssh-host-relay-census-for-target'
-import { orcadMigrationDestinationFor } from '../ssh/orcad-runtime-conversion-wiring'
+import { orcadMigrationDestinationFor } from '../managed-server/lifecycle/orcad-runtime-conversion-wiring'
 import { requiredString } from './orcad-runtime-lifecycle-handlers'
 import { publishResolvedChangedHostStatus } from './runtime-environment-managed-tunnel'
 import { runTargetLifecycle } from './ssh-target-lifecycle-queue'

src/main/ipc/orcad-runtime-conversion-handlers.test.ts

@@ -7,13 +7,13 @@ const mocks = vi.hoisted(() => ({
 }))
 
 vi.mock('electron', () => ({ ipcMain: { handle: mocks.handle } }))
-vi.mock('../ssh/orcad-runtime-conversion', () => ({
+vi.mock('../managed-server/lifecycle/orcad-runtime-conversion', () => ({
   convertSshTargetToManagedOrcad: mocks.convert
 }))
-vi.mock('../ssh/orcad-managed-migration-status', () => ({
+vi.mock('../managed-server/lifecycle/orcad-managed-migration-status', () => ({
   listPendingManagedOrcadMigrations: mocks.pending
 }))
-vi.mock('../ssh/orcad-runtime-conversion-wiring', () => ({
+vi.mock('../managed-server/lifecycle/orcad-runtime-conversion-wiring', () => ({
   conversionCollaborators: () => ({ marker: 'live-collaborators' })
 }))
 

src/main/ipc/orcad-runtime-conversion-handlers.ts

@@ -3,9 +3,9 @@ import type {
   OrcadManagedConversionResult,
   OrcadManagedPendingMigrationRow
 } from '../../shared/orcad-managed-runtime'
-import { listPendingManagedOrcadMigrations } from '../ssh/orcad-managed-migration-status'
-import { convertSshTargetToManagedOrcad } from '../ssh/orcad-runtime-conversion'
-import { conversionCollaborators } from '../ssh/orcad-runtime-conversion-wiring'
+import { listPendingManagedOrcadMigrations } from '../managed-server/lifecycle/orcad-managed-migration-status'
+import { convertSshTargetToManagedOrcad } from '../managed-server/lifecycle/orcad-runtime-conversion'
+import { conversionCollaborators } from '../managed-server/lifecycle/orcad-runtime-conversion-wiring'
 import { requiredString } from './orcad-runtime-lifecycle-handlers'
 
 export function registerOrcadRuntimeConversionHandlers(getUserDataPath: () => string): void {

src/main/ipc/orcad-runtime-lifecycle-handlers.test.ts

@@ -8,10 +8,10 @@ const mocks = vi.hoisted(() => ({
 }))
 
 vi.mock('electron', () => ({ ipcMain: { handle: mocks.handle } }))
-vi.mock('../ssh/orcad-runtime-deployment', () => ({
+vi.mock('../managed-server/lifecycle/orcad-runtime-deployment', () => ({
   createManagedOrcadEnvironment: mocks.deploy
 }))
-vi.mock('../ssh/orcad-runtime-status', () => ({
+vi.mock('../managed-server/lifecycle/orcad-runtime-status', () => ({
   getManagedOrcadRuntimeStatus: mocks.status
 }))
 vi.mock('./orcad-ssh-provisioning-handlers', () => ({

src/main/ipc/orcad-runtime-lifecycle-handlers.ts

@@ -1,7 +1,7 @@
 import { ipcMain } from 'electron'
 import type { OrcadManagedRuntimeStatus } from '../../shared/orcad-managed-runtime'
-import { createManagedOrcadEnvironment } from '../ssh/orcad-runtime-deployment'
-import { getManagedOrcadRuntimeStatus } from '../ssh/orcad-runtime-status'
+import { createManagedOrcadEnvironment } from '../managed-server/lifecycle/orcad-runtime-deployment'
+import { getManagedOrcadRuntimeStatus } from '../managed-server/lifecycle/orcad-runtime-status'
 import { registerOrcadSshProvisioningHandlers } from './orcad-ssh-provisioning-handlers'
 
 export function registerOrcadRuntimeLifecycleHandlers(options: {

src/main/ipc/orcad-runtime-maintenance-handlers.test.ts

@@ -16,7 +16,7 @@ vi.mock('../ssh/orcad-runtime-maintenance', () => ({
   rollbackManagedOrcadEnvironment: mocks.rollback,
   recoverManagedOrcadEnvironment: mocks.recover
 }))
-vi.mock('../ssh/orcad-runtime-decommission', () => ({
+vi.mock('../managed-server/lifecycle/orcad-runtime-decommission', () => ({
   stopManagedOrcadEnvironment: mocks.stop,
   cancelManagedOrcadStop: mocks.cancel
 }))

src/main/ipc/runtime-environment-managed-tunnel.test.ts

@@ -1,6 +1,6 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-import type * as ServingModule from '../ssh/orcad-managed-serving'
-import type { ManagedOrcadStartListener } from '../ssh/orcad-managed-serving'
+import type * as ServingModule from '../managed-server/lifecycle/orcad-managed-serving'
+import type { ManagedOrcadStartListener } from '../managed-server/lifecycle/orcad-managed-serving'
 import type { SshTarget } from '../../shared/ssh-types'
 
 const mocks = vi.hoisted(() => {
@@ -38,14 +38,14 @@ vi.mock('../wsl/wsl-host-service-instance', () => ({
     mocks.hasWslService ? { ensureForRuntimeCall: mocks.ensureForRuntimeCall } : null
 }))
 vi.mock('../ssh/managed-server-update-deps', () => ({ managedServerUpdateDeps: () => ({}) }))
-vi.mock('../ssh/orcad-managed-tunnel', () => ({
+vi.mock('../managed-server/lifecycle/orcad-managed-tunnel', () => ({
   ensureOrcadManagedTunnel: mocks.ensureTunnel,
   rebuildOrcadManagedTunnel: mocks.rebuildTunnel
 }))
-vi.mock('../ssh/orcad-managed-serving-verify', () => ({
+vi.mock('../managed-server/lifecycle/orcad-managed-serving-verify', () => ({
   verifyOrcadManagedServing: mocks.verify
 }))
-vi.mock('../ssh/orcad-managed-update-on-restore', () => ({
+vi.mock('../managed-server/lifecycle/orcad-managed-update-on-restore', () => ({
   updateManagedOrcadOnRestore: mocks.restoreUpdate,
   redeployStoppedManagedOrcad: mocks.redeploy
 }))
@@ -56,14 +56,14 @@ vi.mock('./ssh-renderer-broadcast', () => ({ broadcastSshState: vi.fn() }))
 vi.mock('./ssh-host-launch-session-note', () => ({
   forgetLaunchSessionVerdict: mocks.forgetVerdict
 }))
-vi.mock('../ssh/orcad-managed-serving', async (importOriginal) => ({
+vi.mock('../managed-server/lifecycle/orcad-managed-serving', async (importOriginal) => ({
   ...(await importOriginal<typeof ServingModule>()),
   setManagedOrcadStartListener: (listener: ManagedOrcadStartListener | null) => {
     mocks.startListener.current = listener
   }
 }))
 
-import { MANAGED_ORCAD_NOT_ACTIVATED_DETAIL } from '../ssh/orcad-managed-serving'
+import { MANAGED_ORCAD_NOT_ACTIVATED_DETAIL } from '../managed-server/lifecycle/orcad-managed-serving'
 import {
   installManagedOrcadStartStatus,
   resolveManagedRuntimeEnvironment

src/main/ipc/runtime-environment-managed-tunnel.ts

@@ -10,17 +10,20 @@ import type {
   SshTarget
 } from '../../shared/ssh-types'
 import { managedServerUpdateDeps } from '../ssh/managed-server-update-deps'
-import { ensureOrcadManagedTunnel, rebuildOrcadManagedTunnel } from '../ssh/orcad-managed-tunnel'
-import { verifyOrcadManagedServing } from '../ssh/orcad-managed-serving-verify'
+import {
+  ensureOrcadManagedTunnel,
+  rebuildOrcadManagedTunnel
+} from '../managed-server/lifecycle/orcad-managed-tunnel'
+import { verifyOrcadManagedServing } from '../managed-server/lifecycle/orcad-managed-serving-verify'
 import {
   MANAGED_ORCAD_NOT_ACTIVATED_DETAIL,
   setManagedOrcadStartListener,
   type OrcadManagedServing
-} from '../ssh/orcad-managed-serving'
+} from '../managed-server/lifecycle/orcad-managed-serving'
 import {
   redeployStoppedManagedOrcad,
   updateManagedOrcadOnRestore
-} from '../ssh/orcad-managed-update-on-restore'
+} from '../managed-server/lifecycle/orcad-managed-update-on-restore'
 import { getSshHostServerStatus, setSshHostServerStatus } from '../ssh/ssh-host-server-status'
 import { getSshTargetRegistryStore } from '../ssh/ssh-target-registry'
 import { connectionManager, getCurrentMainWindow } from './ssh-ipc-context'

src/main/ipc/ssh-app-shutdown.test.ts

@@ -14,7 +14,7 @@ vi.mock('../ssh/ssh-channel-multiplexer', () => mocks.sshChannelMultiplexer)
 vi.mock('../ssh/port-forwarding/ssh-port-forward', () => mocks.sshPortForward)
 vi.mock('../ssh/ssh-port-scanner', () => mocks.sshPortScanner)
 const { shutdownTunnelsMock } = vi.hoisted(() => ({ shutdownTunnelsMock: vi.fn() }))
-vi.mock('../ssh/orcad-managed-tunnel', async (importOriginal) => ({
+vi.mock('../managed-server/lifecycle/orcad-managed-tunnel', async (importOriginal) => ({
   ...(await importOriginal<Record<string, unknown>>()),
   shutdownOrcadManagedTunnels: shutdownTunnelsMock
 }))

src/main/ipc/ssh-host-launch-session-note.test.ts

@@ -17,7 +17,7 @@ vi.mock('../../shared/app-environment', () => ({
 vi.mock('../../shared/runtime-environment-store', () => ({
   listEnvironments: () => mocks.environments.current.map((id) => ({ id }))
 }))
-vi.mock('../ssh/orcad-managed-launch-session', () => ({
+vi.mock('../managed-server/lifecycle/orcad-managed-launch-session', () => ({
   readManagedOrcadLaunchSshSession: mocks.read
 }))
 vi.mock('../ssh/ssh-host-platform-memo', () => ({

src/main/ipc/ssh-host-launch-session-note.ts

@@ -1,7 +1,7 @@
 /** After a managed connect or restore: flags a macOS host whose server outlived its launching SSH session. */
 import { getAppEnvironment } from '../../shared/app-environment'
 import { listEnvironments } from '../../shared/runtime-environment-store'
-import { readManagedOrcadLaunchSshSession } from '../ssh/orcad-managed-launch-session'
+import { readManagedOrcadLaunchSshSession } from '../managed-server/lifecycle/orcad-managed-launch-session'
 import { knownSshHostPlatform } from '../ssh/ssh-host-platform-memo'
 import { getSshHostServerStatus } from '../ssh/ssh-host-server-status'
 import { connectionManager } from './ssh-ipc-context'

src/main/ipc/ssh-host-server-on-connect-wiring.test.ts

@@ -25,11 +25,15 @@ vi.mock('../../shared/app-environment', () => ({
 vi.mock('../ssh/ssh-target-registry', () => ({
   getSshTargetRegistryStore: () => mocks.registry.current
 }))
-vi.mock('../ssh/orcad-runtime-deployment', () => ({ createManagedOrcadEnvironment: mocks.deploy }))
-vi.mock('../ssh/orcad-runtime-conversion', () => ({
+vi.mock('../managed-server/lifecycle/orcad-runtime-deployment', () => ({
+  createManagedOrcadEnvironment: mocks.deploy
+}))
+vi.mock('../managed-server/lifecycle/orcad-runtime-conversion', () => ({
   convertSshTargetToManagedOrcad: mocks.convert
 }))
-vi.mock('../ssh/orcad-managed-tunnel', () => ({ ensureOrcadManagedTunnel: mocks.tunnel }))
+vi.mock('../managed-server/lifecycle/orcad-managed-tunnel', () => ({
+  ensureOrcadManagedTunnel: mocks.tunnel
+}))
 vi.mock('../orcad/orcad-artifact-materializer', () => ({ hasOrcadTemplate: () => true }))
 vi.mock('./ssh-renderer-broadcast', () => ({ broadcastSshState: mocks.broadcast }))
 vi.mock('./ssh-ipc-context', () => ({ getCurrentMainWindow: () => null }))

src/main/ipc/ssh-host-server-on-connect-wiring.ts

@@ -10,21 +10,21 @@ import { abandonOrcadConversion } from '../ssh/orcad-conversion-abandon'
 import { retainOrcadMigrationSource } from '../ssh/orcad-migration-source-retention'
 import { hasOrcadTemplate } from '../orcad/orcad-artifact-materializer'
 import { managedServerUpdateDeps } from '../ssh/managed-server-update-deps'
-import { ensureOrcadManagedTunnel } from '../ssh/orcad-managed-tunnel'
-import { verifyOrcadManagedServing } from '../ssh/orcad-managed-serving-verify'
-import { convertSshTargetToManagedOrcad } from '../ssh/orcad-runtime-conversion'
+import { ensureOrcadManagedTunnel } from '../managed-server/lifecycle/orcad-managed-tunnel'
+import { verifyOrcadManagedServing } from '../managed-server/lifecycle/orcad-managed-serving-verify'
+import { convertSshTargetToManagedOrcad } from '../managed-server/lifecycle/orcad-runtime-conversion'
 import {
   orcadMigrationDestinationFor,
   orcadServerFolderCatalogFor,
   orcadServerRepositoriesFor
-} from '../ssh/orcad-runtime-conversion-wiring'
-import { createManagedOrcadEnvironment } from '../ssh/orcad-runtime-deployment'
+} from '../managed-server/lifecycle/orcad-runtime-conversion-wiring'
+import { createManagedOrcadEnvironment } from '../managed-server/lifecycle/orcad-runtime-deployment'
 import type { HostServerOnConnectDeps } from '../ssh/ssh-host-server-on-connect'
 import {
   censusSshHostRelaysBeforeSession,
   relayTerminalsOnConnect
 } from '../ssh/legacy-relay/ssh-host-relay-terminals-on-connect'
-import { requireManagedOrcadInfrastructure } from '../ssh/orcad-managed-runtime-context'
+import { requireManagedOrcadInfrastructure } from '../managed-server/lifecycle/orcad-managed-runtime-context'
 import { censusHostRelayTerminalsFor } from '../ssh/legacy-relay/ssh-host-relay-census-for-target'
 import { setSshHostServerStatus } from '../ssh/ssh-host-server-status'
 import { trackSshHostServerEvent } from '../ssh/ssh-host-server-telemetry'

src/main/ipc/ssh-host-sleep-reconnect.test.ts

@@ -7,7 +7,7 @@ vi.mock('electron', async () => {
   const { EventEmitter } = await import('node:events')
   return { powerMonitor: new EventEmitter() }
 })
-vi.mock('../ssh/orcad-managed-tunnel', () => ({
+vi.mock('../managed-server/lifecycle/orcad-managed-tunnel', () => ({
   recoverOrcadManagedTunnelsAfterHostResume: recoverManagedTunnels
 }))
 vi.mock('../ssh/ssh-target-registry', () => ({

src/main/ipc/ssh-host-sleep-reconnect.ts

@@ -1,5 +1,5 @@
 import { powerMonitor } from 'electron'
-import { recoverOrcadManagedTunnelsAfterHostResume } from '../ssh/orcad-managed-tunnel'
+import { recoverOrcadManagedTunnelsAfterHostResume } from '../managed-server/lifecycle/orcad-managed-tunnel'
 import { getSshConnectionManager } from '../ssh/ssh-target-registry'
 import { errorMessage } from '../../shared/error-message'
 

src/main/ipc/ssh-shutdown-drain.ts

@@ -4,7 +4,7 @@ import {
   testConnectionProbes
 } from './ssh-connect-attempt-registry'
 import { connectionManager, portForwardManager } from './ssh-ipc-context'
-import { shutdownOrcadManagedTunnels } from '../ssh/orcad-managed-tunnel'
+import { shutdownOrcadManagedTunnels } from '../managed-server/lifecycle/orcad-managed-tunnel'
 
 // Why one budget for the whole sequence rather than one per phase: an invalidated connect only
 // observes its cancellation at the next checkpoint, and one blocked in the transport handshake can

src/main/ipc/ssh-target-crud-handlers-ownership.test.ts

@@ -26,7 +26,9 @@ vi.mock('../ssh/ssh-target-registry', () => ({
   setSshTargetMutations: mocks.setMutations
 }))
 vi.mock('./ssh-session-teardown', () => ({ removeRegisteredSshTarget: mocks.remove }))
-vi.mock('../ssh/orcad-managed-tunnel', () => ({ closeOrcadManagedTunnel: mocks.closeTunnel }))
+vi.mock('../managed-server/lifecycle/orcad-managed-tunnel', () => ({
+  closeOrcadManagedTunnel: mocks.closeTunnel
+}))
 vi.mock('./ssh-ipc-context', () => ({
   getCurrentMainWindow: () => null,
   connectionManager: { disconnect: mocks.disconnect }

src/main/ipc/ssh-target-crud-handlers.ts

@@ -12,7 +12,7 @@ import {
   resolveUserSshConfigHost
 } from '../ssh/ssh-config-host-picker'
 import { getManagedOrcadFenceEnvironmentId } from '../../shared/managed-orcad-ssh-owner'
-import { closeOrcadManagedTunnel } from '../ssh/orcad-managed-tunnel'
+import { closeOrcadManagedTunnel } from '../managed-server/lifecycle/orcad-managed-tunnel'
 import { rotateSshProviderAuthority } from '../ssh/ssh-provider-authority'
 import { getSshTargetRegistryStore, setSshTargetMutations } from '../ssh/ssh-target-registry'
 import {

src/main/ipc/ssh.ts

@@ -52,7 +52,7 @@ import { broadcastPortForwards } from './ssh-renderer-broadcast'
 import { resetSshShutdownDrain } from './ssh-shutdown-drain'
 import { registerSshTargetCrudHandlers } from './ssh-target-crud-handlers'
 import { targetLifecycleInFlight } from './ssh-target-lifecycle-queue'
-import { disposeOrcadManagedTunnels } from '../ssh/orcad-managed-tunnel'
+import { disposeOrcadManagedTunnels } from '../managed-server/lifecycle/orcad-managed-tunnel'
 import { reconcileManagedOrcadSshTargets } from '../ssh/orcad-retained-source'
 import { installOrcadMigrationScrollbackRetention } from '../ssh/orcad-migration-scrollback-retention-wiring'
 import { getAppEnvironment } from '../../shared/app-environment'

src/main/managed-server/activation/orcad-activation-crash-recovery.test.ts

@@ -44,8 +44,8 @@ import { writeAtomicOrcadRemoteRecord } from '../install/orcad-remote-record-fil
 import { deployOrcad } from '../../ssh/orcad-remote-deploy'
 import { rollbackOrcad } from '../install/orcad-remote-rollback'
 import { recoverInterruptedOrcadActivation } from './orcad-activation-recovery'
-import { wakeStoppedManagedOrcad } from '../../ssh/orcad-managed-wake'
-import { planManagedOrcadAutoUpdate } from '../../ssh/orcad-managed-auto-update'
+import { wakeStoppedManagedOrcad } from '../lifecycle/orcad-managed-wake'
+import { planManagedOrcadAutoUpdate } from '../lifecycle/orcad-managed-auto-update'
 import { parseOrcadActivationRecord } from './orcad-activation-record'
 import { getRemoteHostPlatform } from '../../ssh/ssh-remote-platform'
 import type { OrcadHostTransport } from '../../ssh/orcad-host-transport'

src/main/managed-server/activation/orcad-activation-recovery.ts

@@ -19,7 +19,7 @@ import {
 } from './orcad-activation-lock'
 import { RemoteInstallLockBusyError } from '../install/remote-install-lock'
 import { ensureOrcadSlotServing, resolveOrcadSlotIdentity } from '../../ssh/orcad-recovery-slot'
-import { reconcileOrcadDecommission } from '../../ssh/orcad-decommission-recovery'
+import { reconcileOrcadDecommission } from '../lifecycle/orcad-decommission-recovery'
 import {
   recoverOrcadIncumbent,
   type OrcadIncumbentRecoveryOptions

src/main/managed-server/activation/orcad-activation-transaction.ts

@@ -22,7 +22,7 @@ import {
   planOrcadDecommissionRecovery,
   type OrcadDecommissionRecoveryPlan,
   type OrcadDecommissionTransaction
-} from '../../ssh/orcad-decommission-transaction'
+} from '../lifecycle/orcad-decommission-transaction'
 import { errorMessage } from '../../../shared/error-message'
 import { RELAY_INSTALL_LOCK_NAME } from '../../../shared/relay-install-lock-name'
 import { RELAY_REMOTE_DIR } from '../../ssh/remote-frame-protocol'

src/main/managed-server/install/orcad-remote-context.ts

@@ -3,7 +3,7 @@ import type { NodeRuntimeTarget } from '../../../shared/node-runtime-pin'
 import type { SshTarget } from '../../../shared/ssh-types'
 import type { OrcadActivationRecord } from '../activation/orcad-activation-record'
 import { readOrcadActivationRecord } from '../activation/orcad-activation-record-store'
-import { resolveOrcadRuntimeTarget } from '../../ssh/orcad-runtime-target'
+import { resolveOrcadRuntimeTarget } from '../lifecycle/orcad-runtime-target'
 import { prepareWindowsOrcadHost } from '../../ssh/orcad-windows-host-preparation'
 import {
   isWslOrcadHostTarget,

src/main/managed-server/install/orcad-remote-decommission.ts

@@ -22,9 +22,9 @@ import {
   createOrcadDecommissionTransaction,
   withOrcadDecommissionProcessExited,
   withOrcadDecommissionStopDispatched
-} from '../../ssh/orcad-decommission-transaction'
-import { readRemoteOrcadManagedStopTarget } from '../../ssh/orcad-managed-remote-stop'
-import { settleOrcadDecommissionStop } from '../../ssh/orcad-decommission-stop'
+} from '../lifecycle/orcad-decommission-transaction'
+import { readRemoteOrcadManagedStopTarget } from '../lifecycle/orcad-managed-remote-stop'
+import { settleOrcadDecommissionStop } from '../lifecycle/orcad-decommission-stop'
 import type { OrcadSlotOptions } from '../../ssh/orcad-recovery-slot'
 import type { OrcadDecommissionResult } from '../../../shared/orcad-decommission'
 import type { OrcadTerminalCensus } from '../../../shared/orcad-terminal-census'

src/main/managed-server/install/orcad-remote-lifecycle-windows.test.ts

@@ -1,5 +1,5 @@
 import type * as ExecCommandModule from '../../ssh/remote-exec-command'
-import type * as TerminalBarrier from '../../ssh/orcad-rollback-terminal-barrier'
+import type * as TerminalBarrier from '../lifecycle/orcad-rollback-terminal-barrier'
 /**
  * The deploy and rollback drivers end to end against a Windows host whose every host op is answered by a
  * fake: no POSIX command, no `-EncodedCommand` and no PowerShell hop on the orcad path.
@@ -24,7 +24,7 @@ vi.mock('./orcad-remote-record-file', async (importOriginal) => ({
   writeAtomicOrcadRemoteRecord: vi.fn().mockResolvedValue(undefined)
 }))
 // The managed stop's Windows commands are covered by orcad-remote-windows-decommission.test.ts.
-vi.mock('../../ssh/orcad-rollback-terminal-barrier', async (importOriginal) => ({
+vi.mock('../lifecycle/orcad-rollback-terminal-barrier', async (importOriginal) => ({
   ...(await importOriginal<typeof TerminalBarrier>()),
   readOrcadRollbackBarrierTarget: async (_options: unknown, version: string) => ({
     state: 'ready',

src/main/managed-server/install/orcad-remote-rollback.test.ts

@@ -2,7 +2,7 @@ import type * as ExecCommandModule from '../../ssh/remote-exec-command'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import type * as RecordFile from './orcad-remote-record-file'
 import type * as InstallLock from './remote-install-lock'
-import type * as TerminalBarrier from '../../ssh/orcad-rollback-terminal-barrier'
+import type * as TerminalBarrier from '../lifecycle/orcad-rollback-terminal-barrier'
 
 vi.mock('../../ssh/remote-exec-command', async (importOriginal) => ({
   ...(await importOriginal<typeof ExecCommandModule>()),
@@ -30,7 +30,7 @@ const barrier = vi.hoisted(() => {
   return state
 })
 // The managed stop and its terminal barrier are proven in orcad-activation-crash-recovery.test.ts.
-vi.mock('../../ssh/orcad-rollback-terminal-barrier', async (importOriginal) => ({
+vi.mock('../lifecycle/orcad-rollback-terminal-barrier', async (importOriginal) => ({
   ...(await importOriginal<typeof TerminalBarrier>()),
   readOrcadRollbackBarrierTarget: async (_options: unknown, version: string) => ({
     state: 'ready',

src/main/managed-server/install/orcad-remote-rollback.ts

@@ -28,7 +28,7 @@ import {
 } from '../activation/orcad-activation-lock'
 import { orcadActivationFenceRefusal } from '../activation/orcad-activation-fence-hold'
 import { ORCAD_STARTUP_READINESS_TIMEOUT_MS } from '../../../shared/orcad-profile-preflight'
-import { rollbackOrcadLocked } from '../../ssh/orcad-rollback-transition'
+import { rollbackOrcadLocked } from '../lifecycle/orcad-rollback-transition'
 
 export type OrcadRollbackOptions = {
   conn: OrcadHostTransport

src/main/managed-server/install/orcad-remote-windows-commands.test.ts

@@ -26,7 +26,7 @@ import {
 } from './orcad-remote-record-file'
 import { launchOrcadAndAwaitReadiness } from './orcad-remote-runtime-control'
 import { probeActiveOrcadReadiness } from '../../ssh/orcad-active-readiness'
-import { completeRemoteOrcadManagedStop } from '../../ssh/orcad-managed-remote-stop'
+import { completeRemoteOrcadManagedStop } from '../lifecycle/orcad-managed-remote-stop'
 import {
   installOrcadWindowsHostScript,
   orcadWindowsNodeCommandLine,

src/main/managed-server/lifecycle/orcad-decommission-recovery.ts

@@ -1,20 +1,20 @@
 /** Recovering an interrupted decommission from its journal entry; see orcad-decommission-transaction. */
-import { writeOrcadActivationRecord } from '../managed-server/activation/orcad-activation-record-store'
-import type { OrcadActivationRecoveryResult } from '../managed-server/activation/orcad-activation-recovery'
+import { writeOrcadActivationRecord } from '../activation/orcad-activation-record-store'
+import type { OrcadActivationRecoveryResult } from '../activation/orcad-activation-recovery'
 import type { OrcadDecommissionRecoveryPlan } from './orcad-decommission-transaction'
 import { settleOrcadDecommissionStop } from './orcad-decommission-stop'
 import {
   orcadLivenessProbeCommand,
   orcadLivenessProvenExited,
   parseOrcadLiveness
-} from '../managed-server/install/orcad-remote-launch'
-import { execOrcadRemote } from '../managed-server/install/orcad-remote-runtime-control'
+} from '../install/orcad-remote-launch'
+import { execOrcadRemote } from '../install/orcad-remote-runtime-control'
 import {
   ensureOrcadSlotServing,
   orcadSlotDir,
   resolveOrcadSlotIdentity,
   type OrcadSlotOptions
-} from './orcad-recovery-slot'
+} from '../../ssh/orcad-recovery-slot'
 
 /** Finishes an interrupted decommission; the record is only cleared on proven exit. */
 export async function reconcileOrcadDecommission(

src/main/managed-server/lifecycle/orcad-decommission-released-peer-recovery.test.ts

@@ -8,24 +8,20 @@ import {
   coreOrcadActivationRecord,
   serializeOrcadActivationRecord,
   type OrcadActivationRecord
-} from '../managed-server/activation/orcad-activation-record'
+} from '../activation/orcad-activation-record'
 import {
   parseOrcadActivationTransaction,
   serializeOrcadActivationTransaction
-} from '../managed-server/activation/orcad-activation-transaction'
+} from '../activation/orcad-activation-transaction'
 import {
   createOrcadDecommissionTransaction,
   withOrcadDecommissionProcessExited,
   withOrcadDecommissionStopDispatched,
   type OrcadDecommissionTransaction
 } from './orcad-decommission-transaction'
-import {
-  FakeOrcadHost,
-  NEW,
-  OLD
-} from '../managed-server/activation/orcad-activation-host-test-harness'
-import { compareAppVersions } from '../../shared/app-version'
-import type { OrcadManagedStopRequest } from '../../shared/orcad-stop-request'
+import { FakeOrcadHost, NEW, OLD } from '../activation/orcad-activation-host-test-harness'
+import { compareAppVersions } from '../../../shared/app-version'
+import type { OrcadManagedStopRequest } from '../../../shared/orcad-stop-request'
 
 const T = new Date('2026-02-02T00:00:00.000Z')
 const ID = '7f1c2a7e-6c1b-4a8e-9f0e-0a1b2c3d4e5f'

src/main/managed-server/lifecycle/orcad-decommission-stop.ts

@@ -5,17 +5,17 @@
  * lost answer is `unverifiable`, never exit; cancelling is how a stop that did not finish is
  * withdrawn, and only an orcad-confirmed cancellation lets the fence go.
  */
-import { isUnconfirmedSshCommandTermination } from './remote-exec-command'
+import { isUnconfirmedSshCommandTermination } from '../../ssh/remote-exec-command'
 import {
   cancelRemoteOrcadManagedStop,
   completeRemoteOrcadManagedStop
 } from './orcad-managed-remote-stop'
-import type { OrcadSlotOptions } from './orcad-recovery-slot'
+import type { OrcadSlotOptions } from '../../ssh/orcad-recovery-slot'
 import type {
   OrcadDaemonRetirementVerdict,
   OrcadManagedStopRequest
-} from '../../shared/orcad-stop-request'
-import { errorMessage } from '../../shared/error-message'
+} from '../../../shared/orcad-stop-request'
+import { errorMessage } from '../../../shared/error-message'
 
 export type OrcadDecommissionStopSettlement =
   | { state: 'exited'; retirement: OrcadDaemonRetirementVerdict }

src/main/managed-server/lifecycle/orcad-decommission-transaction.test.ts

@@ -3,15 +3,15 @@ import {
   parseOrcadActivationTransaction,
   planOrcadTransactionRecovery,
   serializeOrcadActivationTransaction
-} from '../managed-server/activation/orcad-activation-transaction'
+} from '../activation/orcad-activation-transaction'
 import {
   committedOrcadDecommissionRecord,
   createOrcadDecommissionTransaction,
   withOrcadDecommissionProcessExited,
   withOrcadDecommissionStopDispatched
 } from './orcad-decommission-transaction'
-import { FakeOrcadHost, NEW } from '../managed-server/activation/orcad-activation-host-test-harness'
-import type { OrcadManagedStopRequest } from '../../shared/orcad-stop-request'
+import { FakeOrcadHost, NEW } from '../activation/orcad-activation-host-test-harness'
+import type { OrcadManagedStopRequest } from '../../../shared/orcad-stop-request'
 
 const T = new Date('2026-02-02T00:00:00.000Z')
 const ID = '7f1c2a7e-6c1b-4a8e-9f0e-0a1b2c3d4e5f'

src/main/managed-server/lifecycle/orcad-decommission-transaction.ts

@@ -11,9 +11,9 @@ import {
   withDeactivatedVersion,
   withDeactivatedVersionCommitted,
   type OrcadActivationRecord
-} from '../managed-server/activation/orcad-activation-record'
-import { ORCAD_ACTIVATION_TRANSACTION_SCHEMA_VERSION } from '../managed-server/activation/orcad-activation-transaction-schema'
-import type { OrcadManagedStopRequest } from '../../shared/orcad-stop-request'
+} from '../activation/orcad-activation-record'
+import { ORCAD_ACTIVATION_TRANSACTION_SCHEMA_VERSION } from '../activation/orcad-activation-transaction-schema'
+import type { OrcadManagedStopRequest } from '../../../shared/orcad-stop-request'
 
 export type OrcadDecommissionTransaction = {
   schemaVersion: typeof ORCAD_ACTIVATION_TRANSACTION_SCHEMA_VERSION

src/main/managed-server/lifecycle/orcad-managed-auto-update.test.ts

@@ -2,8 +2,8 @@ import { beforeEach, describe, expect, it, vi } from 'vitest'
 import {
   emptyOrcadActivationRecord,
   type OrcadActivationRecord
-} from '../managed-server/activation/orcad-activation-record'
-import { OrcadHostUnsupportedError } from '../orcad/orcad-host-unavailable'
+} from '../activation/orcad-activation-record'
+import { OrcadHostUnsupportedError } from '../../orcad/orcad-host-unavailable'
 
 const mocks = vi.hoisted(() => {
   const state: { record: OrcadActivationRecord | null } = { record: null }
@@ -15,7 +15,7 @@ const mocks = vi.hoisted(() => {
   }
 })
 
-vi.mock('./orcad-runtime-maintenance', () => ({
+vi.mock('../../ssh/orcad-runtime-maintenance', () => ({
   withManagedOrcadLifecycle: (
     _userData: string,
     _selector: string,
@@ -32,10 +32,10 @@ vi.mock('./orcad-managed-runtime-context', () => ({
 vi.mock('./orcad-managed-migration-status', () => ({
   findIncompleteManagedOrcadMigration: mocks.migrating
 }))
-vi.mock('../orcad/orcad-artifact-materializer', () => ({
+vi.mock('../../orcad/orcad-artifact-materializer', () => ({
   materializeOrcadArtifact: mocks.materialize
 }))
-vi.mock('../managed-server/install/remote-versioned-install', () => ({
+vi.mock('../install/remote-versioned-install', () => ({
   readLocalFullVersion: () => '0.1.0+new'
 }))
 

src/main/managed-server/lifecycle/orcad-managed-auto-update.ts

@@ -5,22 +5,25 @@
  * terminals, and a rejected candidate is restored through the activation journal, so the old
  * version keeps serving. A host a newer Orca activated is never downgraded.
  */
-import type { OrcadActivationRecord } from '../managed-server/activation/orcad-activation-record'
+import type { OrcadActivationRecord } from '../activation/orcad-activation-record'
 import {
   refuseOrcadHostDowngrade,
   type OrcadHostVersionRefusal
-} from './orcad-host-version-admission'
-import { materializeOrcadArtifact } from '../orcad/orcad-artifact-materializer'
+} from '../../ssh/orcad-host-version-admission'
+import { materializeOrcadArtifact } from '../../orcad/orcad-artifact-materializer'
 import {
   OrcadArtifactsUnavailableError,
   OrcadHostUnsupportedError
-} from '../orcad/orcad-host-unavailable'
+} from '../../orcad/orcad-host-unavailable'
 import { findIncompleteManagedOrcadMigration } from './orcad-managed-migration-status'
-import { ORCAD_ACTIVATION_FENCE_BUSY_CODE } from '../managed-server/activation/orcad-activation-fence-hold'
+import { ORCAD_ACTIVATION_FENCE_BUSY_CODE } from '../activation/orcad-activation-fence-hold'
 import { resolveLinkedOrcadContext } from './orcad-managed-runtime-context'
-import { runManagedOrcadUpdate, withManagedOrcadLifecycle } from './orcad-runtime-maintenance'
-import type { OrcadUpdateDeferCode } from './orcad-update-plan'
-import { readLocalFullVersion } from '../managed-server/install/remote-versioned-install'
+import {
+  runManagedOrcadUpdate,
+  withManagedOrcadLifecycle
+} from '../../ssh/orcad-runtime-maintenance'
+import type { OrcadUpdateDeferCode } from '../../ssh/orcad-update-plan'
+import { readLocalFullVersion } from '../install/remote-versioned-install'
 
 export type ManagedOrcadAutoUpdateSkip =
   | 'current'

src/main/managed-server/lifecycle/orcad-managed-bound-port.test.ts

@@ -1,19 +1,19 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest'
-import type { OrcadHostTransport } from './orcad-host-transport'
-import { getRemoteHostPlatform } from './ssh-remote-platform'
+import type { OrcadHostTransport } from '../../ssh/orcad-host-transport'
+import { getRemoteHostPlatform } from '../../ssh/ssh-remote-platform'
 
 const execOrcadRemote = vi.hoisted(() => vi.fn())
-vi.mock('../managed-server/install/orcad-remote-runtime-control', () => ({ execOrcadRemote }))
+vi.mock('../install/orcad-remote-runtime-control', () => ({ execOrcadRemote }))
 const resolveOrcadRemoteContext = vi.hoisted(() => vi.fn())
-vi.mock('../managed-server/install/orcad-remote-context', () => ({ resolveOrcadRemoteContext }))
+vi.mock('../install/orcad-remote-context', () => ({ resolveOrcadRemoteContext }))
 
 import {
   orcadBoundPort,
   readManagedOrcadBoundPort,
   resolveManagedOrcadTunnelPort
 } from './orcad-managed-bound-port'
-import type { KnownRuntimeEnvironment } from '../../shared/runtime-environments'
-import type { SshTarget } from '../../shared/ssh-types'
+import type { KnownRuntimeEnvironment } from '../../../shared/runtime-environments'
+import type { SshTarget } from '../../../shared/ssh-types'
 
 function readinessLine(boundEndpoint: string | null): string {
   return `${JSON.stringify({ type: 'orca_server_ready', runtimeId: 'runtime-1', boundEndpoint })}\n`

src/main/managed-server/lifecycle/orcad-managed-bound-port.ts

@@ -6,20 +6,20 @@
 import {
   getRuntimeSshAccess,
   type KnownRuntimeEnvironment
-} from '../../shared/runtime-environments'
-import type { SshTarget } from '../../shared/ssh-types'
-import type { ServeReadiness } from '../server/serve-readiness'
+} from '../../../shared/runtime-environments'
+import type { SshTarget } from '../../../shared/ssh-types'
+import type { ServeReadiness } from '../../server/serve-readiness'
 import { managedOrcadInstallDir } from './orcad-managed-runtime-context'
-import { resolveOrcadRemoteContext } from '../managed-server/install/orcad-remote-context'
+import { resolveOrcadRemoteContext } from '../install/orcad-remote-context'
 import {
   parseOrcadReadinessWaitOutput,
   readOrcadReadinessNowCommand
-} from '../managed-server/install/orcad-remote-readiness-wait'
+} from '../install/orcad-remote-readiness-wait'
 import {
   execOrcadRemote,
   type OrcadRemoteExecTarget
-} from '../managed-server/install/orcad-remote-runtime-control'
-import type { OrcadHostTransport } from './orcad-host-transport'
+} from '../install/orcad-remote-runtime-control'
+import type { OrcadHostTransport } from '../../ssh/orcad-host-transport'
 
 export type OrcadTunnelPortInput = {
   environment: KnownRuntimeEnvironment

src/main/managed-server/lifecycle/orcad-managed-launch-session.test.ts

@@ -1,5 +1,5 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest'
-import { getRemoteHostPlatform, type RemoteHostPlatform } from './ssh-remote-platform'
+import { getRemoteHostPlatform, type RemoteHostPlatform } from '../../ssh/ssh-remote-platform'
 
 const mocks = vi.hoisted(() => {
   const host: { current: RemoteHostPlatform | null } = { current: null }
@@ -16,7 +16,7 @@ const mocks = vi.hoisted(() => {
   }
 })
 
-vi.mock('./orcad-runtime-maintenance', () => ({
+vi.mock('../../ssh/orcad-runtime-maintenance', () => ({
   withManagedOrcadLifecycle: (
     _path: string,
     _selector: string,
@@ -48,7 +48,7 @@ vi.mock('./orcad-managed-runtime-context', () => ({
   }),
   managedOrcadInstallDir: () => '/Users/dev/.orca-remote/orcad-1.0.0'
 }))
-vi.mock('../managed-server/install/orcad-remote-context', () => ({
+vi.mock('../install/orcad-remote-context', () => ({
   resolveOrcadRemoteContext: async () => ({
     host: mocks.host.current,
     connection: {},
@@ -57,12 +57,12 @@ vi.mock('../managed-server/install/orcad-remote-context', () => ({
     activationRecord: { active: mocks.active.current }
   })
 }))
-vi.mock('./orcad-ssh-host-transport', () => ({ sshOrcadHostTransport: (c: unknown) => c }))
-vi.mock('../managed-server/activation/orcad-activation-lock', () => ({
+vi.mock('../../ssh/orcad-ssh-host-transport', () => ({ sshOrcadHostTransport: (c: unknown) => c }))
+vi.mock('../activation/orcad-activation-lock', () => ({
   withOrcadActivationLock: (_slot: unknown, run: (lock: unknown) => Promise<unknown>) =>
     run({ retain: mocks.retain })
 }))
-vi.mock('../managed-server/activation/orcad-activation-record-store', () => ({
+vi.mock('../activation/orcad-activation-record-store', () => ({
   readOrcadActivationRecord: async () => ({ active: mocks.active.current })
 }))
 vi.mock('./orcad-managed-remote-stop', () => ({
@@ -73,8 +73,10 @@ vi.mock('./orcad-rollback-terminal-barrier', () => ({
 }))
 vi.mock('./orcad-managed-wake', () => ({ wakeStoppedManagedOrcad: mocks.wake }))
 vi.mock('./orcad-managed-tunnel', () => ({ rebuildOrcadManagedTunnel: mocks.rebuild }))
-vi.mock('./orcad-terminal-census-client', () => ({ collectManagedTerminalCensus: mocks.census }))
-vi.mock('../managed-server/install/orcad-remote-runtime-control', () => ({
+vi.mock('../../ssh/orcad-terminal-census-client', () => ({
+  collectManagedTerminalCensus: mocks.census
+}))
+vi.mock('../install/orcad-remote-runtime-control', () => ({
   execOrcadRemote: mocks.exec
 }))
 

src/main/managed-server/lifecycle/orcad-managed-launch-session.ts

@@ -3,19 +3,19 @@
  * the restart that re-attributes it to the current session. See orcad-launch-ssh-session.ts.
  */
 import { randomUUID } from 'node:crypto'
-import type { OrcadManagedRestartResult } from '../../shared/orcad-managed-runtime'
+import type { OrcadManagedRestartResult } from '../../../shared/orcad-managed-runtime'
 import {
   withOrcadActivationLock,
   type OrcadActivationLockControl
-} from '../managed-server/activation/orcad-activation-lock'
-import { readOrcadActivationRecord } from '../managed-server/activation/orcad-activation-record-store'
+} from '../activation/orcad-activation-lock'
+import { readOrcadActivationRecord } from '../activation/orcad-activation-record-store'
 import {
   orcadLaunchSshSessionProbeCommand,
   parseOrcadLaunchSshSession,
   recordsOrcadLaunchSshSession,
   type OrcadLaunchSshSession
-} from './orcad-launch-ssh-session'
-import { withManagedOrcadLifecycle } from './orcad-runtime-maintenance'
+} from '../../ssh/orcad-launch-ssh-session'
+import { withManagedOrcadLifecycle } from '../../ssh/orcad-runtime-maintenance'
 import {
   managedOrcadInstallDir,
   managedOrcadSlot,
@@ -23,15 +23,15 @@ import {
   requireManagedOrcadInfrastructure,
   resolveLinkedOrcadContext
 } from './orcad-managed-runtime-context'
-import { resolveOrcadRemoteContext } from '../managed-server/install/orcad-remote-context'
-import { sshOrcadHostTransport } from './orcad-ssh-host-transport'
+import { resolveOrcadRemoteContext } from '../install/orcad-remote-context'
+import { sshOrcadHostTransport } from '../../ssh/orcad-ssh-host-transport'
 import { rebuildOrcadManagedTunnel } from './orcad-managed-tunnel'
 import { wakeStoppedManagedOrcad } from './orcad-managed-wake'
 import { readRemoteOrcadManagedStopTarget } from './orcad-managed-remote-stop'
-import { orcadSlotDir, type OrcadSlotOptions } from './orcad-recovery-slot'
+import { orcadSlotDir, type OrcadSlotOptions } from '../../ssh/orcad-recovery-slot'
 import { stopIncumbentBehindTerminalBarrier } from './orcad-rollback-terminal-barrier'
-import { execOrcadRemote } from '../managed-server/install/orcad-remote-runtime-control'
-import { collectManagedTerminalCensus } from './orcad-terminal-census-client'
+import { execOrcadRemote } from '../install/orcad-remote-runtime-control'
+import { collectManagedTerminalCensus } from '../../ssh/orcad-terminal-census-client'
 
 export async function readManagedOrcadLaunchSshSession(
   userDataPath: string,

src/main/managed-server/lifecycle/orcad-managed-lifecycle-test-fixture.ts

@@ -1,13 +1,13 @@
 import { mkdtempSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
-import { encodePairingOffer, PAIRING_OFFER_VERSION } from '../../shared/pairing'
-import { addManagedOrcadEnvironment } from '../../shared/runtime-environment-managed-orcad-store'
-import type { SshTarget } from '../../shared/ssh-types'
-import type { ServeReadiness } from '../server/serve-readiness'
-import { getRemoteHostPlatform } from './ssh-remote-platform'
-import { SshTargetOrcadClaims } from './ssh-target-orcad-claims'
-import { emptyDependentStateStore } from './ssh-target-orcad-dependents-fixture'
+import { encodePairingOffer, PAIRING_OFFER_VERSION } from '../../../shared/pairing'
+import { addManagedOrcadEnvironment } from '../../../shared/runtime-environment-managed-orcad-store'
+import type { SshTarget } from '../../../shared/ssh-types'
+import type { ServeReadiness } from '../../server/serve-readiness'
+import { getRemoteHostPlatform } from '../../ssh/ssh-remote-platform'
+import { SshTargetOrcadClaims } from '../../ssh/ssh-target-orcad-claims'
+import { emptyDependentStateStore } from '../../ssh/ssh-target-orcad-dependents-fixture'
 
 export const MANAGED_VERSION = '0.2.0+abc'
 export const MANAGED_PREVIOUS_VERSION = '0.1.0+def'

src/main/managed-server/lifecycle/orcad-managed-migration-status.ts

@@ -2,12 +2,12 @@
 import {
   isRetainedOrcadMigrationSourceCutover,
   type OrcadMigrationSourceCutover
-} from '../../shared/orcad-migration-source-cutover'
+} from '../../../shared/orcad-migration-source-cutover'
 import {
   getOrcadSshDeployment,
   type KnownRuntimeEnvironment
-} from '../../shared/runtime-environments'
-import { listOrcadMigrationSourceCutovers } from './orcad-migration-cutover-journal'
+} from '../../../shared/runtime-environments'
+import { listOrcadMigrationSourceCutovers } from '../../ssh/orcad-migration-cutover-journal'
 
 export type OrcadManagedPendingMigration = {
   migrationId: string

src/main/managed-server/lifecycle/orcad-managed-remote-stop.ts

@@ -6,24 +6,24 @@
  * nonce). The slot's own `orcad.js` then writes the request and proves exit on the host.
  */
 import { randomUUID } from 'node:crypto'
-import { shellEscape } from './ssh-connection-utils'
-import { selectOrcadSlotRuntimeCommand } from '../managed-server/install/orcad-remote-runtime'
+import { shellEscape } from '../../ssh/ssh-connection-utils'
+import { selectOrcadSlotRuntimeCommand } from '../install/orcad-remote-runtime'
 import {
   parseOrcadReadinessWaitOutput,
   readOrcadReadinessNowCommand
-} from '../managed-server/install/orcad-remote-readiness-wait'
-import { execOrcadRemote } from '../managed-server/install/orcad-remote-runtime-control'
-import { readBoundedOrcadRemoteRecord } from '../managed-server/install/orcad-remote-record-file'
-import { orcadSlotDir, type OrcadSlotOptions } from './orcad-recovery-slot'
-import { isWindowsRemoteHost, joinRemotePath } from './ssh-remote-platform'
-import { isUnconfirmedSshCommandTermination } from './remote-exec-command'
+} from '../install/orcad-remote-readiness-wait'
+import { execOrcadRemote } from '../install/orcad-remote-runtime-control'
+import { readBoundedOrcadRemoteRecord } from '../install/orcad-remote-record-file'
+import { orcadSlotDir, type OrcadSlotOptions } from '../../ssh/orcad-recovery-slot'
+import { isWindowsRemoteHost, joinRemotePath } from '../../ssh/ssh-remote-platform'
+import { isUnconfirmedSshCommandTermination } from '../../ssh/remote-exec-command'
 import {
   orcadWindowsNodeCommandLine,
   orcadWindowsSlotOpCommand,
   readOrcadWindowsEncodedAnswer
-} from '../managed-server/install/orcad-remote-windows-node'
-import { ORCAD_WINDOWS_RUNTIME_MARKER } from './orcad-windows-host-script'
-import { ORCAD_LOCK_FILE_NAME, parseOrcadInstanceLockRecord } from '../orcad/orcad-instance-lock'
+} from '../install/orcad-remote-windows-node'
+import { ORCAD_WINDOWS_RUNTIME_MARKER } from '../../ssh/orcad-windows-host-script'
+import { ORCAD_LOCK_FILE_NAME, parseOrcadInstanceLockRecord } from '../../orcad/orcad-instance-lock'
 import {
   ORCAD_CANCEL_MANAGED_STOP_FLAG,
   ORCAD_COMPLETE_MANAGED_STOP_FLAG,
@@ -35,7 +35,7 @@ import {
   type OrcadManagedStopCompletion,
   type OrcadManagedStopContext,
   type OrcadManagedStopRequest
-} from '../../shared/orcad-stop-request'
+} from '../../../shared/orcad-stop-request'
 
 const LOCK_RECORD_MAX_BYTES = 64 * 1024
 

src/main/managed-server/lifecycle/orcad-managed-runtime-context.ts

@@ -1,25 +1,22 @@
-import { resolveEnvironment } from '../../shared/runtime-environment-store'
+import { resolveEnvironment } from '../../../shared/runtime-environment-store'
 import {
   getOrcadSshDeployment,
   type KnownRuntimeEnvironment,
   type OrcadSshDeploymentLink
-} from '../../shared/runtime-environments'
-import { getManagedOrcadFenceEnvironmentId } from '../../shared/managed-orcad-ssh-owner'
-import type { ServeReadiness } from '../server/serve-readiness'
-import { computeLocalOrcadBuildHash } from './orcad-local-build-hash'
-import { sshOrcadHostTransport } from './orcad-ssh-host-transport'
-import type { OrcadHostTarget } from './orcad-host-transport'
-import type { OrcadActivationRecord } from '../managed-server/activation/orcad-activation-record'
-import { refuseOrcadHostDowngrade } from './orcad-host-version-admission'
-import type { OrcadTerminalCensus } from '../../shared/orcad-terminal-census'
-import { probeActiveOrcadReadiness } from './orcad-active-readiness'
-import {
-  resolveOrcadRemoteContext,
-  type OrcadRemoteContext
-} from '../managed-server/install/orcad-remote-context'
-import { ORCAD_INSTALL_MODEL } from '../managed-server/install/remote-install-model'
-import { computeRemoteInstallDir } from '../managed-server/install/remote-versioned-install'
-import { getSshConnectionManager, getSshTargetRegistryStore } from './ssh-target-registry'
+} from '../../../shared/runtime-environments'
+import { getManagedOrcadFenceEnvironmentId } from '../../../shared/managed-orcad-ssh-owner'
+import type { ServeReadiness } from '../../server/serve-readiness'
+import { computeLocalOrcadBuildHash } from '../../ssh/orcad-local-build-hash'
+import { sshOrcadHostTransport } from '../../ssh/orcad-ssh-host-transport'
+import type { OrcadHostTarget } from '../../ssh/orcad-host-transport'
+import type { OrcadActivationRecord } from '../activation/orcad-activation-record'
+import { refuseOrcadHostDowngrade } from '../../ssh/orcad-host-version-admission'
+import type { OrcadTerminalCensus } from '../../../shared/orcad-terminal-census'
+import { probeActiveOrcadReadiness } from '../../ssh/orcad-active-readiness'
+import { resolveOrcadRemoteContext, type OrcadRemoteContext } from '../install/orcad-remote-context'
+import { ORCAD_INSTALL_MODEL } from '../install/remote-install-model'
+import { computeRemoteInstallDir } from '../install/remote-versioned-install'
+import { getSshConnectionManager, getSshTargetRegistryStore } from '../../ssh/ssh-target-registry'
 
 export const ORCAD_BIND_HOST = '127.0.0.1'
 

src/main/managed-server/lifecycle/orcad-managed-serving-verify.ts

@@ -1,4 +1,4 @@
-import { resolveEnvironment } from '../../shared/runtime-environment-store'
+import { resolveEnvironment } from '../../../shared/runtime-environment-store'
 import type { OrcadManagedServing } from './orcad-managed-serving'
 import { verifyManagedTunnelServing } from './orcad-managed-tunnel'
 

src/main/managed-server/lifecycle/orcad-managed-serving.test.ts

@@ -1,6 +1,6 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
-vi.mock('../managed-server/install/orcad-remote-context', () => ({
+vi.mock('../install/orcad-remote-context', () => ({
   resolveOrcadRemoteContext: vi.fn(async () => ({
     connection: {},
     host: {},

src/main/managed-server/lifecycle/orcad-managed-serving.ts

@@ -7,13 +7,13 @@
  * Never throws. A server that cannot be started stays `unverifiable` with the reason, and is
  * never read as evidence that its terminals exited.
  */
-import type { KnownRuntimeEnvironment } from '../../shared/runtime-environments'
-import type { SshTarget } from '../../shared/ssh-types'
+import type { KnownRuntimeEnvironment } from '../../../shared/runtime-environments'
+import type { SshTarget } from '../../../shared/ssh-types'
 import { orcadBoundPort } from './orcad-managed-bound-port'
 import { managedOrcadSlot } from './orcad-managed-runtime-context'
 import { wakeStoppedManagedOrcad } from './orcad-managed-wake'
-import { resolveOrcadRemoteContext } from '../managed-server/install/orcad-remote-context'
-import type { OrcadHostTransport } from './orcad-host-transport'
+import { resolveOrcadRemoteContext } from '../install/orcad-remote-context'
+import type { OrcadHostTransport } from '../../ssh/orcad-host-transport'
 
 export type OrcadManagedServing =
   | { state: 'serving' }

src/main/managed-server/lifecycle/orcad-managed-tunnel-active.ts

@@ -1,14 +1,17 @@
 /** The managed tunnels a client holds, and the one rule for whether one still belongs to its server. */
-import { getManagedOrcadFenceEnvironmentId } from '../../shared/managed-orcad-ssh-owner'
+import { getManagedOrcadFenceEnvironmentId } from '../../../shared/managed-orcad-ssh-owner'
 import {
   getRuntimeSshAccess,
   type KnownRuntimeEnvironment,
   type RuntimeSshTunnelLink
-} from '../../shared/runtime-environments'
-import type { SshTarget } from '../../shared/ssh-types'
-import type { SshConnection } from './ssh-connection'
-import { adoptSshConnection } from './ssh-connection-attribution'
-import type { PortForwardEntry, SshPortForwardManager } from './port-forwarding/ssh-port-forward'
+} from '../../../shared/runtime-environments'
+import type { SshTarget } from '../../../shared/ssh-types'
+import type { SshConnection } from '../../ssh/ssh-connection'
+import { adoptSshConnection } from '../../ssh/ssh-connection-attribution'
+import type {
+  PortForwardEntry,
+  SshPortForwardManager
+} from '../../ssh/port-forwarding/ssh-port-forward'
 
 export type ActiveOrcadTunnel = {
   connection: SshConnection

src/main/managed-server/lifecycle/orcad-managed-tunnel-bridge-port.test.ts

@@ -1,12 +1,12 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest'
-import type { SshConnection } from './ssh-connection'
-import type { PortForwardStartOptions } from './port-forwarding/ssh-port-forward-provider'
-import type * as ForwardProcess from './system-ssh-forward-process'
+import type { SshConnection } from '../../ssh/ssh-connection'
+import type { PortForwardStartOptions } from '../../ssh/port-forwarding/ssh-port-forward-provider'
+import type * as ForwardProcess from '../../ssh/system-ssh-forward-process'
 
 const { reserveLocalForwardPort } = vi.hoisted(() => ({
   reserveLocalForwardPort: vi.fn(async (port: number, _orphanArgs?: readonly string[]) => port)
 }))
-vi.mock('./system-ssh-forward-process', async (importOriginal) => ({
+vi.mock('../../ssh/system-ssh-forward-process', async (importOriginal) => ({
   ...(await importOriginal<typeof ForwardProcess>()),
   reserveLocalForwardPort
 }))

src/main/managed-server/lifecycle/orcad-managed-tunnel-identity-restart.test.ts

@@ -1,21 +1,21 @@
-import { pairedRuntimeConnectionFromOffer } from '../../shared/paired-runtime-connection'
+import { pairedRuntimeConnectionFromOffer } from '../../../shared/paired-runtime-connection'
 import { mkdtempSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { afterEach, describe, expect, it, vi } from 'vitest'
-import { encodePairingOffer, parsePairingCode, type PairingOffer } from '../../shared/pairing'
+import { encodePairingOffer, parsePairingCode, type PairingOffer } from '../../../shared/pairing'
 import {
   addEnvironmentFromPairingCode,
   listEnvironments,
   markEnvironmentUsed
-} from '../../shared/runtime-environment-store'
-import type { KnownRuntimeEnvironment } from '../../shared/runtime-environments'
-import { OrcaRuntimeService } from '../runtime/orca-runtime'
-import { OrcaRuntimeRpcServer } from '../runtime/runtime-rpc'
-import { verifyRuntimePairingIdentity } from '../runtime/runtime-environment-identity-verification'
+} from '../../../shared/runtime-environment-store'
+import type { KnownRuntimeEnvironment } from '../../../shared/runtime-environments'
+import { OrcaRuntimeService } from '../../runtime/orca-runtime'
+import { OrcaRuntimeRpcServer } from '../../runtime/runtime-rpc'
+import { verifyRuntimePairingIdentity } from '../../runtime/runtime-environment-identity-verification'
 import { verifyManagedOrcadTunnelIdentity } from './orcad-managed-tunnel-identity'
 
-vi.mock('../git/worktree', () => ({
+vi.mock('../../git/worktree', () => ({
   listWorktrees: vi.fn().mockResolvedValue([]),
   listWorktreesStrict: vi.fn().mockResolvedValue([])
 }))

src/main/managed-server/lifecycle/orcad-managed-tunnel-identity.test.ts

@@ -1,13 +1,13 @@
-import type { PairedRuntimeConnection } from '../../shared/paired-runtime-connection'
+import type { PairedRuntimeConnection } from '../../../shared/paired-runtime-connection'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
-import { encodePairingOffer, PAIRING_OFFER_VERSION } from '../../shared/pairing'
-import { RemoteRuntimeClientError } from '../../shared/remote-runtime-client-error'
-import type { ServeReadiness } from '../server/serve-readiness'
+import { encodePairingOffer, PAIRING_OFFER_VERSION } from '../../../shared/pairing'
+import { RemoteRuntimeClientError } from '../../../shared/remote-runtime-client-error'
+import type { ServeReadiness } from '../../server/serve-readiness'
 
 const verifyRuntimePairingIdentity = vi.hoisted(() =>
   vi.fn<(pairing: PairedRuntimeConnection, expected: unknown) => Promise<unknown>>()
 )
-vi.mock('../runtime/runtime-environment-identity-verification', () => ({
+vi.mock('../../runtime/runtime-environment-identity-verification', () => ({
   verifyRuntimePairingIdentity
 }))
 

src/main/managed-server/lifecycle/orcad-managed-tunnel-identity.ts

@@ -3,25 +3,25 @@
  * runtime still accepts the connection, so a forward that opened proves nothing; only a status
  * call that completes the pairing handshake and reports the paired runtime id does.
  */
-import { parsePairingCode } from '../../shared/pairing'
+import { parsePairingCode } from '../../../shared/pairing'
 import {
   pairedRuntimeConnectionFromOffer,
   type PairedRuntimeConnection
-} from '../../shared/paired-runtime-connection'
-import { ORCAD_MANAGED_REMOTE_PORT } from '../../shared/orcad-managed-runtime'
+} from '../../../shared/paired-runtime-connection'
+import { ORCAD_MANAGED_REMOTE_PORT } from '../../../shared/orcad-managed-runtime'
 import {
   isRecoverableRemoteRuntimeConnectionError,
   toRemoteRuntimeClientErrorLike
-} from '../../shared/remote-runtime-client-error-classification'
-import { RemoteRuntimeClientError } from '../../shared/remote-runtime-client-error'
+} from '../../../shared/remote-runtime-client-error-classification'
+import { RemoteRuntimeClientError } from '../../../shared/remote-runtime-client-error'
 import {
   getPreferredPairedRuntimeConnection,
   type KnownRuntimeEnvironment
-} from '../../shared/runtime-environments'
-import { verifyRuntimePairingIdentity } from '../runtime/runtime-environment-identity-verification'
-import type { ServeReadiness } from '../server/serve-readiness'
+} from '../../../shared/runtime-environments'
+import { verifyRuntimePairingIdentity } from '../../runtime/runtime-environment-identity-verification'
+import type { ServeReadiness } from '../../server/serve-readiness'
 import { orcadBoundPort } from './orcad-managed-bound-port'
-import { tunneledOrcadPairingCode } from './orcad-tunneled-pairing'
+import { tunneledOrcadPairingCode } from '../../ssh/orcad-tunneled-pairing'
 
 /** `unreachable` means nothing answered; it is never evidence about which server holds the port. */
 export type OrcadTunnelIdentity =

src/main/managed-server/lifecycle/orcad-managed-tunnel-manager.ts

@@ -5,13 +5,13 @@
 import {
   getRuntimeSshAccess,
   type KnownRuntimeEnvironment
-} from '../../shared/runtime-environments'
-import type { SshTarget } from '../../shared/ssh-types'
-import { getManagedOrcadFenceEnvironmentId } from '../../shared/managed-orcad-ssh-owner'
-import type { SshConnection } from './ssh-connection'
-import { isAuthError } from './ssh-connection-utils'
-import type { SshConnectionManager } from './ssh-connection-manager'
-import { SshPortForwardManager } from './port-forwarding/ssh-port-forward'
+} from '../../../shared/runtime-environments'
+import type { SshTarget } from '../../../shared/ssh-types'
+import { getManagedOrcadFenceEnvironmentId } from '../../../shared/managed-orcad-ssh-owner'
+import type { SshConnection } from '../../ssh/ssh-connection'
+import { isAuthError } from '../../ssh/ssh-connection-utils'
+import type { SshConnectionManager } from '../../ssh/ssh-connection-manager'
+import { SshPortForwardManager } from '../../ssh/port-forwarding/ssh-port-forward'
 import { OrcadManagedTunnelTransportProvider } from './orcad-managed-tunnel-transport'
 import {
   OrcadManagedTunnelResumeRecovery,
@@ -28,7 +28,7 @@ import {
   type ActiveOrcadTunnel
 } from './orcad-managed-tunnel-active'
 import { checkManagedTunnelServing, type OrcadTunnelServing } from './orcad-managed-tunnel-serving'
-import type { getSshTargetRegistryStore } from './ssh-target-registry'
+import type { getSshTargetRegistryStore } from '../../ssh/ssh-target-registry'
 import {
   environmentForwardChecks,
   forwardToVerifiedOrcad,

src/main/managed-server/lifecycle/orcad-managed-tunnel-resume.ts

@@ -1,15 +1,15 @@
-import { sendRemoteRuntimeRequest } from '../../shared/remote-runtime-client'
+import { sendRemoteRuntimeRequest } from '../../../shared/remote-runtime-client'
 import {
   getPreferredPairedRuntimeConnection,
   type KnownRuntimeEnvironment,
   type RuntimeSshTunnelLink
-} from '../../shared/runtime-environments'
-import type { SshConnection } from './ssh-connection'
-import type { SshTarget } from '../../shared/ssh-types'
+} from '../../../shared/runtime-environments'
+import type { SshConnection } from '../../ssh/ssh-connection'
+import type { SshTarget } from '../../../shared/ssh-types'
 import type { OrcadManagedServing } from './orcad-managed-serving'
-import type { SshConnectionManager } from './ssh-connection-manager'
-import type { SshPortForwardManager } from './port-forwarding/ssh-port-forward'
-import type { getSshTargetRegistryStore } from './ssh-target-registry'
+import type { SshConnectionManager } from '../../ssh/ssh-connection-manager'
+import type { SshPortForwardManager } from '../../ssh/port-forwarding/ssh-port-forward'
+import type { getSshTargetRegistryStore } from '../../ssh/ssh-target-registry'
 import {
   dropActiveOrcadTunnel,
   managedTunnelAccess,

src/main/managed-server/lifecycle/orcad-managed-tunnel-serving.ts

@@ -3,12 +3,12 @@
  * other than the one the tunnel forwards to; the forward is then dropped, and the next build
  * forwards to the port the new server actually bound.
  */
-import type { KnownRuntimeEnvironment } from '../../shared/runtime-environments'
+import type { KnownRuntimeEnvironment } from '../../../shared/runtime-environments'
 import type { OrcadManagedServing } from './orcad-managed-serving'
 import type { OrcadManagedServingCheck } from './orcad-managed-tunnel-resume'
 import type { ActiveOrcadTunnel } from './orcad-managed-tunnel-active'
-import type { SshPortForwardManager } from './port-forwarding/ssh-port-forward'
-import type { SshTarget } from '../../shared/ssh-types'
+import type { SshPortForwardManager } from '../../ssh/port-forwarding/ssh-port-forward'
+import type { SshTarget } from '../../../shared/ssh-types'
 
 export type OrcadTunnelServing = OrcadManagedServing & { rebind?: true }
 

src/main/managed-server/lifecycle/orcad-managed-tunnel-target.test.ts

@@ -1,9 +1,9 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest'
-import type { SshTarget } from '../../shared/ssh-types'
-import type { KnownRuntimeEnvironment } from '../../shared/runtime-environments'
-import type { OrcadHostTransport } from './orcad-host-transport'
-import type { SshConnection } from './ssh-connection'
-import type { SshPortForwardManager } from './port-forwarding/ssh-port-forward'
+import type { SshTarget } from '../../../shared/ssh-types'
+import type { KnownRuntimeEnvironment } from '../../../shared/runtime-environments'
+import type { OrcadHostTransport } from '../../ssh/orcad-host-transport'
+import type { SshConnection } from '../../ssh/ssh-connection'
+import type { SshPortForwardManager } from '../../ssh/port-forwarding/ssh-port-forward'
 import {
   OrcadManagedIdentityError,
   type OrcadTunnelIdentity
@@ -16,7 +16,7 @@ import {
 
 const mocks = vi.hoisted(() => ({ wake: vi.fn(), resolveContext: vi.fn() }))
 vi.mock('./orcad-managed-wake', () => ({ wakeStoppedManagedOrcad: mocks.wake }))
-vi.mock('../managed-server/install/orcad-remote-context', () => ({
+vi.mock('../install/orcad-remote-context', () => ({
   resolveOrcadRemoteContext: mocks.resolveContext
 }))
 

src/main/managed-server/lifecycle/orcad-managed-tunnel-target.ts

@@ -2,7 +2,7 @@
 import {
   getRuntimeSshAccess,
   type KnownRuntimeEnvironment
-} from '../../shared/runtime-environments'
+} from '../../../shared/runtime-environments'
 import {
   resolveManagedOrcadTunnelPort,
   type OrcadTunnelPortInput
@@ -14,9 +14,12 @@ import {
 } from './orcad-managed-tunnel-identity'
 import { managedOrcadSlot } from './orcad-managed-runtime-context'
 import { wakeStoppedManagedOrcad } from './orcad-managed-wake'
-import { resolveOrcadRemoteContext } from '../managed-server/install/orcad-remote-context'
-import type { SshConnection } from './ssh-connection'
-import type { PortForwardEntry, SshPortForwardManager } from './port-forwarding/ssh-port-forward'
+import { resolveOrcadRemoteContext } from '../install/orcad-remote-context'
+import type { SshConnection } from '../../ssh/ssh-connection'
+import type {
+  PortForwardEntry,
+  SshPortForwardManager
+} from '../../ssh/port-forwarding/ssh-port-forward'
 
 export type OrcadManagedTunnelTargeting = {
   resolveRemotePort: (input: OrcadTunnelPortInput) => Promise<number>

src/main/managed-server/lifecycle/orcad-managed-tunnel-transport.test.ts

@@ -1,13 +1,13 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import { OrcadManagedTunnelTransportProvider } from './orcad-managed-tunnel-transport'
-import { knownOrcadTunnelTransport } from './orcad-tunnel-transport-memo'
-import type { SshConnection } from './ssh-connection'
+import { knownOrcadTunnelTransport } from '../../ssh/orcad-tunnel-transport-memo'
+import type { SshConnection } from '../../ssh/ssh-connection'
 import type {
   PortForwardStartOptions,
   SshPortForwardProvider,
   StartedPortForward
-} from './port-forwarding/ssh-port-forward-provider'
-import type { TcpForwardingVerdict } from './ssh-tcp-forwarding-probe'
+} from '../../ssh/port-forwarding/ssh-port-forward-provider'
+import type { TcpForwardingVerdict } from '../../ssh/ssh-tcp-forwarding-probe'
 
 let generation = 1
 // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: the selector reads only the transport generation.

src/main/managed-server/lifecycle/orcad-managed-tunnel-transport.ts

@@ -3,27 +3,27 @@
  * wherever the host allows it, and the stdio bridge where its sshd refuses forwarding.
  */
 import { OrcadStdioBridgePortForwardProvider } from './orcad-stdio-bridge-provider'
-import { rememberOrcadTunnelTransport } from './orcad-tunnel-transport-memo'
-import type { SshConnection } from './ssh-connection'
+import { rememberOrcadTunnelTransport } from '../../ssh/orcad-tunnel-transport-memo'
+import type { SshConnection } from '../../ssh/ssh-connection'
 import type {
   PortForwardStartOptions,
   SshPortForwardProvider,
   StartedPortForward
-} from './port-forwarding/ssh-port-forward-provider'
+} from '../../ssh/port-forwarding/ssh-port-forward-provider'
 import {
   checkForwardChannel,
   probeTcpForwarding,
   type TcpForwardingVerdict
-} from './ssh-tcp-forwarding-probe'
-import { Ssh2PortForwardProvider } from './port-forwarding/ssh2-port-forward-provider'
+} from '../../ssh/ssh-tcp-forwarding-probe'
+import { Ssh2PortForwardProvider } from '../../ssh/port-forwarding/ssh2-port-forward-provider'
 import {
   SystemSshPortForwardProvider,
   systemSshForwardBuildArgsOptions
-} from './port-forwarding/system-ssh-port-forward-provider'
+} from '../../ssh/port-forwarding/system-ssh-port-forward-provider'
 import {
   buildSystemSshPortForwardArgs,
   reserveLocalForwardPort
-} from './system-ssh-forward-process'
+} from '../../ssh/system-ssh-forward-process'
 
 type OrcadManagedTunnelTransportDependencies = {
   forwards: SshPortForwardProvider[]

src/main/managed-server/lifecycle/orcad-managed-tunnel.test.ts

@@ -2,16 +2,16 @@ import { describe, expect, it, vi } from 'vitest'
 import {
   createEnvironmentFromPairingOffer,
   type KnownRuntimeEnvironment
-} from '../../shared/runtime-environments'
-import { PAIRING_OFFER_VERSION } from '../../shared/pairing'
-import type { SshTarget } from '../../shared/ssh-types'
-import type { SshConnection } from './ssh-connection'
-import type { SshConnectionManager } from './ssh-connection-manager'
-import type { SshConnectionStore } from './ssh-connection-store'
-import type { SshPortForwardManager } from './port-forwarding/ssh-port-forward'
+} from '../../../shared/runtime-environments'
+import { PAIRING_OFFER_VERSION } from '../../../shared/pairing'
+import type { SshTarget } from '../../../shared/ssh-types'
+import type { SshConnection } from '../../ssh/ssh-connection'
+import type { SshConnectionManager } from '../../ssh/ssh-connection-manager'
+import type { SshConnectionStore } from '../../ssh/ssh-connection-store'
+import type { SshPortForwardManager } from '../../ssh/port-forwarding/ssh-port-forward'
 import { OrcadManagedTunnelManager } from './orcad-managed-tunnel-manager'
 import type { OrcadManagedTunnelTargeting } from './orcad-managed-tunnel-target'
-import { createCancelledConnectAttemptError } from './ssh-connect-attempt-cancellation'
+import { createCancelledConnectAttemptError } from '../../ssh/ssh-connect-attempt-cancellation'
 
 function createEnvironment(linkKind: 'orcadDeployment' | 'sshAccess'): KnownRuntimeEnvironment {
   const paired = createEnvironmentFromPairingOffer({

src/main/managed-server/lifecycle/orcad-managed-tunnel.ts

@@ -1,12 +1,12 @@
-import type { KnownRuntimeEnvironment } from '../../shared/runtime-environments'
-import { resolveEnvironment } from '../../shared/runtime-environment-store'
-import type { SshTarget } from '../../shared/ssh-types'
-import type { SshConnection } from './ssh-connection'
+import type { KnownRuntimeEnvironment } from '../../../shared/runtime-environments'
+import { resolveEnvironment } from '../../../shared/runtime-environment-store'
+import type { SshTarget } from '../../../shared/ssh-types'
+import type { SshConnection } from '../../ssh/ssh-connection'
 import { probeManagedOrcadTunnel } from './orcad-managed-tunnel-resume'
 import { ensureManagedOrcadServing } from './orcad-managed-serving'
 import { OrcadManagedTunnelManager } from './orcad-managed-tunnel-manager'
-import { getRemoteRuntimeSharedControlAnsweredAt } from '../ipc/runtime-environment-shared-control-answers'
-import { getSshConnectionManager, getSshTargetRegistryStore } from './ssh-target-registry'
+import { getRemoteRuntimeSharedControlAnsweredAt } from '../../ipc/runtime-environment-shared-control-answers'
+import { getSshConnectionManager, getSshTargetRegistryStore } from '../../ssh/ssh-target-registry'
 import {
   MANAGED_ORCAD_TUNNEL_TARGETING,
   type OrcadTunnelStartChecks

src/main/managed-server/lifecycle/orcad-managed-update-deferrals.ts

@@ -1,6 +1,6 @@
 /** The last update each managed server deferred in this session, so status can report it. */
-import type { OrcadManagedDeferral } from '../../shared/orcad-managed-runtime'
-import { compareAppVersions } from '../../shared/app-version'
+import type { OrcadManagedDeferral } from '../../../shared/orcad-managed-runtime'
+import { compareAppVersions } from '../../../shared/app-version'
 
 type RecordedDeferral = OrcadManagedDeferral & { deferredAt: string }
 

src/main/managed-server/lifecycle/orcad-managed-update-on-restore.test.ts

@@ -1,6 +1,6 @@
-import type { ManagedServerUpdateDeps } from './managed-server-update-check'
+import type { ManagedServerUpdateDeps } from '../../ssh/managed-server-update-check'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
-import type { SshTarget } from '../../shared/ssh-types'
+import type { SshTarget } from '../../../shared/ssh-types'
 import type { ManagedOrcadAutoUpdateOutcome } from './orcad-managed-auto-update'
 import {
   redeployStoppedManagedOrcad,

src/main/managed-server/lifecycle/orcad-managed-update-on-restore.ts

@@ -2,11 +2,11 @@
  * The launch-time tunnel restore reaches a managed server without an SSH connect, so it runs the
  * same update check a connect would, once per server per session and off the caller's path.
  */
-import type { SshManagedServerUpdateNote, SshTarget } from '../../shared/ssh-types'
+import type { SshManagedServerUpdateNote, SshTarget } from '../../../shared/ssh-types'
 import {
   checkManagedServerUpdate,
   type ManagedServerUpdateDeps
-} from './managed-server-update-check'
+} from '../../ssh/managed-server-update-check'
 
 export type ManagedOrcadRestoreUpdateDeps = ManagedServerUpdateDeps & {
   /** The SSH target that serves this managed server, or null when it is gone or unlinked. */

src/main/managed-server/lifecycle/orcad-managed-version-gc.test.ts

@@ -1,14 +1,14 @@
 import { afterEach, describe, expect, it, vi } from 'vitest'
-import type { ServeReadiness } from '../server/serve-readiness'
-import { NODE_RUNTIME_ASSETS, NODE_RUNTIME_COMPAT_ASSETS } from '../../shared/node-runtime-pin'
+import type { ServeReadiness } from '../../server/serve-readiness'
+import { NODE_RUNTIME_ASSETS, NODE_RUNTIME_COMPAT_ASSETS } from '../../../shared/node-runtime-pin'
 
 const { gcMock, readRecordMock } = vi.hoisted(() => ({
   gcMock: vi.fn(),
   readRecordMock: vi.fn()
 }))
 
-vi.mock('../managed-server/install/orcad-remote-gc', () => ({ gcOldOrcadVersions: gcMock }))
-vi.mock('../managed-server/activation/orcad-activation-record-store', () => ({
+vi.mock('../install/orcad-remote-gc', () => ({ gcOldOrcadVersions: gcMock }))
+vi.mock('../activation/orcad-activation-record-store', () => ({
   readOrcadActivationRecord: readRecordMock
 }))
 

src/main/managed-server/lifecycle/orcad-managed-version-gc.ts

@@ -4,12 +4,12 @@
  * rollback target, journaled versions, and the version the live terminal daemon was forked
  * from. Anything the host cannot answer about is kept.
  */
-import type { NodeRuntimeTarget } from '../../shared/node-runtime-pin'
-import type { ServeReadiness } from '../server/serve-readiness'
-import { readOrcadActivationRecord } from '../managed-server/activation/orcad-activation-record-store'
-import { orcadSlotDir, type OrcadSlotOptions } from './orcad-recovery-slot'
-import { gcOldOrcadVersions } from '../managed-server/install/orcad-remote-gc'
-import { nodeRuntimeStorePins } from './pinned-runtime-host-target'
+import type { NodeRuntimeTarget } from '../../../shared/node-runtime-pin'
+import type { ServeReadiness } from '../../server/serve-readiness'
+import { readOrcadActivationRecord } from '../activation/orcad-activation-record-store'
+import { orcadSlotDir, type OrcadSlotOptions } from '../../ssh/orcad-recovery-slot'
+import { gcOldOrcadVersions } from '../install/orcad-remote-gc'
+import { nodeRuntimeStorePins } from '../../ssh/pinned-runtime-host-target'
 
 /** The daemon's build when the readiness proves it; undefined when it cannot say. */
 export function provenLiveDaemonVersion(readiness: ServeReadiness): string | null | undefined {

src/main/managed-server/lifecycle/orcad-managed-wake.test.ts

@@ -1,30 +1,27 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-import type * as ExecCommandModule from './remote-exec-command'
-import type * as InstallLock from '../managed-server/install/remote-install-lock'
+import type * as ExecCommandModule from '../../ssh/remote-exec-command'
+import type * as InstallLock from '../install/remote-install-lock'
 
-vi.mock('./remote-exec-command', async (importOriginal) => ({
+vi.mock('../../ssh/remote-exec-command', async (importOriginal) => ({
   ...(await importOriginal<typeof ExecCommandModule>()),
   execCommand: vi.fn()
 }))
-vi.mock('./ssh-connection-utils', () => ({ shellEscape: (s: string) => `'${s}'` }))
-vi.mock('../managed-server/install/remote-install-lock', async (importOriginal) => ({
+vi.mock('../../ssh/ssh-connection-utils', () => ({ shellEscape: (s: string) => `'${s}'` }))
+vi.mock('../install/remote-install-lock', async (importOriginal) => ({
   ...(await importOriginal<typeof InstallLock>()),
   acquireInstallLock: vi.fn()
 }))
 
-import { execCommand } from './remote-exec-command'
-import {
-  acquireInstallLock,
-  RemoteInstallLockBusyError
-} from '../managed-server/install/remote-install-lock'
+import { execCommand } from '../../ssh/remote-exec-command'
+import { acquireInstallLock, RemoteInstallLockBusyError } from '../install/remote-install-lock'
 import { wakeStoppedManagedOrcad } from './orcad-managed-wake'
-import { getRemoteHostPlatform } from './ssh-remote-platform'
-import type { OrcadHostTransport } from './orcad-host-transport'
-import { FakeOrcadHost, OLD } from '../managed-server/activation/orcad-activation-host-test-harness'
+import { getRemoteHostPlatform } from '../../ssh/ssh-remote-platform'
+import type { OrcadHostTransport } from '../../ssh/orcad-host-transport'
+import { FakeOrcadHost, OLD } from '../activation/orcad-activation-host-test-harness'
 import {
   ORCAD_E2E_IDLE_TIMEOUT_ENV,
   ORCAD_MANAGED_ACTIVATION_ROOT_ENV
-} from '../../shared/orcad-idle-exit'
+} from '../../../shared/orcad-idle-exit'
 
 let host = new FakeOrcadHost()
 

src/main/managed-server/lifecycle/orcad-managed-wake.ts

@@ -3,32 +3,32 @@
  * that stopped itself after idling. A stopped server is just "not running": it is neither a
  * failure nor evidence about terminals, which the daemon owns and which outlive orcad.
  */
-import { ORCAD_FENCE_OWNER_FILENAME } from '../managed-server/activation/orcad-activation-fence-scope'
-import type { ServeReadiness } from '../server/serve-readiness'
-import { readOrcadActivationRecord } from '../managed-server/activation/orcad-activation-record-store'
+import { ORCAD_FENCE_OWNER_FILENAME } from '../activation/orcad-activation-fence-scope'
+import type { ServeReadiness } from '../../server/serve-readiness'
+import { readOrcadActivationRecord } from '../activation/orcad-activation-record-store'
 import { randomUUID } from 'node:crypto'
 import {
   orcadActivationFenceExists,
   releaseOrcadActivationFence,
   withOrcadActivationLock
-} from '../managed-server/activation/orcad-activation-lock'
-import { orcadLivenessProvenExited } from '../managed-server/install/orcad-remote-launch'
-import { readBoundedOrcadRemoteRecord } from '../managed-server/install/orcad-remote-record-file'
-import { orcadActivationFenceLockDir } from '../managed-server/activation/orcad-activation-transaction'
-import { joinRemotePath } from './ssh-remote-platform'
+} from '../activation/orcad-activation-lock'
+import { orcadLivenessProvenExited } from '../install/orcad-remote-launch'
+import { readBoundedOrcadRemoteRecord } from '../install/orcad-remote-record-file'
+import { orcadActivationFenceLockDir } from '../activation/orcad-activation-transaction'
+import { joinRemotePath } from '../../ssh/ssh-remote-platform'
 
-import { readOrcadActivationTransaction } from '../managed-server/activation/orcad-activation-transaction-store'
+import { readOrcadActivationTransaction } from '../activation/orcad-activation-transaction-store'
 import {
   ORCAD_RECOVERY_UNVERIFIABLE_CODE,
   recoverInterruptedOrcadActivation
-} from '../managed-server/activation/orcad-activation-recovery'
+} from '../activation/orcad-activation-recovery'
 import {
   ensureOrcadSlotServing,
   orcadSlotDir,
   resolveOrcadSlotIdentity,
   slotLiveness,
   type OrcadSlotOptions
-} from './orcad-recovery-slot'
+} from '../../ssh/orcad-recovery-slot'
 
 export type OrcadManagedWake =
   | { outcome: 'serving' | 'not-activated' | 'unverifiable' }

src/main/managed-server/lifecycle/orcad-rollback-terminal-barrier.ts

@@ -11,8 +11,8 @@ import {
   type OrcadManagedStopTarget
 } from './orcad-managed-remote-stop'
 import { settleOrcadDecommissionStop } from './orcad-decommission-stop'
-import type { OrcadSlotOptions } from './orcad-recovery-slot'
-import type { OrcadManagedStopContext } from '../../shared/orcad-stop-request'
+import type { OrcadSlotOptions } from '../../ssh/orcad-recovery-slot'
+import type { OrcadManagedStopContext } from '../../../shared/orcad-stop-request'
 
 export type OrcadRollbackBarrier =
   | { state: 'retired' }

src/main/managed-server/lifecycle/orcad-rollback-transition.ts

@@ -1,16 +1,13 @@
 /** The locked, journaled half of `rollbackOrcad`. */
-import { orcadRemoteBaseDir } from '../managed-server/install/orcad-remote-windows-node'
+import { orcadRemoteBaseDir } from '../install/orcad-remote-windows-node'
 import { randomUUID } from 'node:crypto'
-import type {
-  OrcadRollbackOptions,
-  OrcadRollbackResult
-} from '../managed-server/install/orcad-remote-rollback'
-import { isUnconfirmedSshCommandTermination } from './remote-exec-command'
-import { withRolledBackVersion } from '../managed-server/activation/orcad-activation-record'
-import { writeOrcadActivationRecord } from '../managed-server/activation/orcad-activation-record-store'
-import { launchAndJudgeOrcadSlot } from './orcad-candidate-launch-verdict'
-import { assessOrcadRollback } from './orcad-update-plan'
-import { ORCAD_LOG_FILENAME } from '../managed-server/install/orcad-remote-host-support'
+import type { OrcadRollbackOptions, OrcadRollbackResult } from '../install/orcad-remote-rollback'
+import { isUnconfirmedSshCommandTermination } from '../../ssh/remote-exec-command'
+import { withRolledBackVersion } from '../activation/orcad-activation-record'
+import { writeOrcadActivationRecord } from '../activation/orcad-activation-record-store'
+import { launchAndJudgeOrcadSlot } from '../../ssh/orcad-candidate-launch-verdict'
+import { assessOrcadRollback } from '../../ssh/orcad-update-plan'
+import { ORCAD_LOG_FILENAME } from '../install/orcad-remote-host-support'
 import {
   captureOrcadStateSnapshotCommand,
   newestStateMtimeCommand,
@@ -21,41 +18,38 @@ import {
   parseOrcadSnapshotRestore,
   probeOrcadStateSnapshotCommand,
   restoreOrcadStateSnapshotCommand
-} from './orcad-state-snapshot'
-import { joinRemotePath } from './ssh-remote-platform'
-import type { OrcadActivationLockControl } from '../managed-server/activation/orcad-activation-lock'
+} from '../../ssh/orcad-state-snapshot'
+import { joinRemotePath } from '../../ssh/ssh-remote-platform'
+import type { OrcadActivationLockControl } from '../activation/orcad-activation-lock'
 import {
   rollbackStartingState,
   type OrcadRollbackTransaction
-} from '../managed-server/activation/orcad-activation-transaction'
+} from '../activation/orcad-activation-transaction'
 import {
   createOrcadRollbackTransaction,
   withOrcadRollbackPhase,
   withOrcadRollbackRescue
-} from '../managed-server/activation/orcad-activation-transaction-transitions'
-import { writeOrcadActivationTransaction } from '../managed-server/activation/orcad-activation-transaction-store'
-import {
-  execOrcadRemoteOr,
-  withoutAbortSignal
-} from '../managed-server/install/orcad-remote-runtime-control'
-import { execOrcadStateMutationOr } from './orcad-state-mutation-exec'
+} from '../activation/orcad-activation-transaction-transitions'
+import { writeOrcadActivationTransaction } from '../activation/orcad-activation-transaction-store'
+import { execOrcadRemoteOr, withoutAbortSignal } from '../install/orcad-remote-runtime-control'
+import { execOrcadStateMutationOr } from '../../ssh/orcad-state-mutation-exec'
 import {
   orcadSlotDir,
   resolveOrcadSlotIdentity,
   type OrcadSlotIdentity
-} from './orcad-recovery-slot'
-import { orcadSnapshotPath } from './orcad-incumbent-recovery'
+} from '../../ssh/orcad-recovery-slot'
+import { orcadSnapshotPath } from '../../ssh/orcad-incumbent-recovery'
 import {
   putTransactionIncumbentBack,
   restoreAfterRejectedCandidate
-} from './orcad-transaction-incumbent'
+} from '../../ssh/orcad-transaction-incumbent'
 import {
   readOrcadRollbackBarrierTarget,
   rollbackBarrierRefusal,
   stopIncumbentBehindTerminalBarrier
 } from './orcad-rollback-terminal-barrier'
-import { withOrcadLogTail } from '../managed-server/install/orcad-remote-log-tail'
-import { errorMessage } from '../../shared/error-message'
+import { withOrcadLogTail } from '../install/orcad-remote-log-tail'
+import { errorMessage } from '../../../shared/error-message'
 
 async function stateWritesSinceActivation(options: OrcadRollbackOptions): Promise<boolean | null> {
   const activatedAtSeconds = Math.floor(Date.parse(options.record.activatedAt ?? '') / 1000)

src/main/managed-server/lifecycle/orcad-runtime-conversion-wiring.ts

@@ -1,11 +1,11 @@
 /** The live collaborators a host conversion needs: the census, the direct session and the server. */
-import { encodePairingOffer } from '../../shared/pairing'
+import { encodePairingOffer } from '../../../shared/pairing'
 import {
   getPreferredPairingOffer,
   type KnownRuntimeEnvironment
-} from '../../shared/runtime-environments'
-import { disconnectRegisteredSshTarget } from '../ipc/ssh-session-teardown'
-import type { OrcadMigrationDestinationCatalog } from './orcad-migration-cutover-coordinator'
+} from '../../../shared/runtime-environments'
+import { disconnectRegisteredSshTarget } from '../../ipc/ssh-session-teardown'
+import type { OrcadMigrationDestinationCatalog } from '../../ssh/orcad-migration-cutover-coordinator'
 import {
   abortRemoteOrcadMigrationCatalog,
   commitRemoteOrcadMigrationCatalog,
@@ -13,14 +13,14 @@ import {
   readRemoteOrcadMigrationCatalogState,
   stageRemoteOrcadMigrationCatalog,
   stageRemoteOrcadMigrationSnapshotChunk
-} from './orcad-migration-catalog-client'
-import { censusHostRelayTerminalsFor } from './legacy-relay/ssh-host-relay-census-for-target'
+} from '../../ssh/orcad-migration-catalog-client'
+import { censusHostRelayTerminalsFor } from '../../ssh/legacy-relay/ssh-host-relay-census-for-target'
 import type { OrcadManagedConversionArgs } from './orcad-runtime-conversion'
-import type { OrcadServerRepository } from './orcad-migration-repository-link'
+import type { OrcadServerRepository } from '../../ssh/orcad-migration-repository-link'
 import {
   listRemoteOrcadFolderCatalog,
   type OrcadServerFolderCatalog
-} from './orcad-server-folder-workspaces'
+} from '../../ssh/orcad-server-folder-workspaces'
 
 /** The T6-9 client against this server, pinned to the runtime it paired with. */
 export function orcadMigrationDestinationFor(

src/main/managed-server/lifecycle/orcad-runtime-conversion.test.ts

@@ -2,27 +2,27 @@ import { mkdtempSync, rmSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-import { getManagedOrcadFenceEnvironmentId } from '../../shared/managed-orcad-ssh-owner'
-import { encodePairingOffer, PAIRING_OFFER_VERSION } from '../../shared/pairing'
+import { getManagedOrcadFenceEnvironmentId } from '../../../shared/managed-orcad-ssh-owner'
+import { encodePairingOffer, PAIRING_OFFER_VERSION } from '../../../shared/pairing'
 import {
   addManagedOrcadEnvironment,
   removeManagedOrcadEnvironment
-} from '../../shared/runtime-environment-managed-orcad-store'
-import { listEnvironments } from '../../shared/runtime-environment-store'
-import type { SshTarget } from '../../shared/ssh-types'
-import { closeTestStores, createSqliteTestStore } from '../persistence-test-harness'
-import { Store } from '../persistence/loading-store/store'
-import { listOrcadMigrationSourceCutovers } from './orcad-migration-cutover-journal'
+} from '../../../shared/runtime-environment-managed-orcad-store'
+import { listEnvironments } from '../../../shared/runtime-environment-store'
+import type { SshTarget } from '../../../shared/ssh-types'
+import { closeTestStores, createSqliteTestStore } from '../../persistence-test-harness'
+import { Store } from '../../persistence/loading-store/store'
+import { listOrcadMigrationSourceCutovers } from '../../ssh/orcad-migration-cutover-journal'
 import type { OrcadManagedConversionArgs } from './orcad-runtime-conversion'
-import { fakeOrcadMigrationDestination } from './orcad-migration-destination-fake'
-import { reconcileManagedOrcadSshTargets, visibleRepos } from './orcad-retained-source'
-import { SshConnectionStore } from './ssh-connection-store'
+import { fakeOrcadMigrationDestination } from '../../ssh/orcad-migration-destination-fake'
+import { reconcileManagedOrcadSshTargets, visibleRepos } from '../../ssh/orcad-retained-source'
+import { SshConnectionStore } from '../../ssh/ssh-connection-store'
 
 const mocks = vi.hoisted(() => {
   const state: { targetStore: unknown } = { targetStore: null }
   return { state, deploy: vi.fn(), ensureTunnel: vi.fn() }
 })
-vi.mock('./ssh-target-registry', () => ({
+vi.mock('../../ssh/ssh-target-registry', () => ({
   getSshConnectionManager: () => ({}),
   getSshTargetRegistryStore: () => mocks.state.targetStore
 }))
@@ -33,7 +33,7 @@ vi.mock('./orcad-managed-tunnel', () => ({
 }))
 
 const { convertSshTargetToManagedOrcad } = await import('./orcad-runtime-conversion')
-const { abandonOrcadConversion } = await import('./orcad-conversion-abandon')
+const { abandonOrcadConversion } = await import('../../ssh/orcad-conversion-abandon')
 
 const TARGET: SshTarget = {
   id: 'ssh-prod',

src/main/managed-server/lifecycle/orcad-runtime-conversion.ts

@@ -8,44 +8,44 @@
  * destination proves its commit, and is never deleted afterwards.
  */
 import { randomUUID } from 'node:crypto'
-import type { OrcadManagedConversionResult } from '../../shared/orcad-managed-runtime'
-import type { OrcadMigrationSourceCutover } from '../../shared/orcad-migration-source-cutover'
-import { recordManagedOrcadMigration } from '../../shared/runtime-environment-managed-orcad-store'
-import { listEnvironments } from '../../shared/runtime-environment-store'
+import type { OrcadManagedConversionResult } from '../../../shared/orcad-managed-runtime'
+import type { OrcadMigrationSourceCutover } from '../../../shared/orcad-migration-source-cutover'
+import { recordManagedOrcadMigration } from '../../../shared/runtime-environment-managed-orcad-store'
+import { listEnvironments } from '../../../shared/runtime-environment-store'
 import {
   getOrcadSshDeployment,
   redactRuntimeEnvironment,
   type KnownRuntimeEnvironment
-} from '../../shared/runtime-environments'
-import { runTargetLifecycle } from '../ipc/ssh-target-lifecycle-queue'
+} from '../../../shared/runtime-environments'
+import { runTargetLifecycle } from '../../ipc/ssh-target-lifecycle-queue'
 import { environmentMatchesManagedOrcadCutover } from './orcad-managed-migration-status'
 import { requireManagedOrcadInfrastructure } from './orcad-managed-runtime-context'
 import { ensureOrcadManagedTunnel } from './orcad-managed-tunnel'
 import {
   commitOrcadMigrationDestination,
   type OrcadMigrationDestinationCatalog
-} from './orcad-migration-cutover-coordinator'
+} from '../../ssh/orcad-migration-cutover-coordinator'
 import {
   findOrcadMigrationSourceCutoverForTarget,
   removeOrcadMigrationJournalsForDestination
-} from './orcad-migration-cutover-journal'
-import type { SshTarget } from '../../shared/ssh-types'
-import type { CensusHostRelayTerminals } from './orcad-migration-terminal-gate'
+} from '../../ssh/orcad-migration-cutover-journal'
+import type { SshTarget } from '../../../shared/ssh-types'
+import type { CensusHostRelayTerminals } from '../../ssh/orcad-migration-terminal-gate'
 import { createManagedOrcadEnvironment } from './orcad-runtime-deployment'
-import { createSshRelayMigrationSource } from './orcad-migration-ssh-relay-source'
+import { createSshRelayMigrationSource } from '../../ssh/orcad-migration-ssh-relay-source'
 import {
   leaveBehindClearsOrcadMigrationBlockers,
   onlyLeavableOrcadMigrationBlockers
-} from './ssh-target-orcad-preflight'
-import { ORCAD_MIGRATION_LEAVE_BEHIND_TERMINALS_REASON } from './orcad-migration-source-fence'
-import { retainOrcadMigrationSource } from './orcad-migration-source-retention'
+} from '../../ssh/ssh-target-orcad-preflight'
+import { ORCAD_MIGRATION_LEAVE_BEHIND_TERMINALS_REASON } from '../../ssh/orcad-migration-source-fence'
+import { retainOrcadMigrationSource } from '../../ssh/orcad-migration-source-retention'
 import {
   linkedOrcadMigrationCutoverPort,
   linkedOrcadMigrationProjects,
   linkServerHeldRepositories,
   type OrcadServerRepository
-} from './orcad-migration-repository-link'
-import type { OrcadServerFolderCatalog } from './orcad-server-folder-workspaces'
+} from '../../ssh/orcad-migration-repository-link'
+import type { OrcadServerFolderCatalog } from '../../ssh/orcad-server-folder-workspaces'
 
 export type OrcadManagedConversionArgs = {
   sshTargetId: string

src/main/managed-server/lifecycle/orcad-runtime-decommission.test.ts

@@ -1,13 +1,13 @@
 import { existsSync, readFileSync, rmSync } from 'node:fs'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-import { getManagedOrcadFenceEnvironmentId } from '../../shared/managed-orcad-ssh-owner'
-import { getRuntimeEnvironmentSidecarPath } from '../../shared/runtime-environment-sidecar'
-import { listEnvironments } from '../../shared/runtime-environment-store'
+import { getManagedOrcadFenceEnvironmentId } from '../../../shared/managed-orcad-ssh-owner'
+import { getRuntimeEnvironmentSidecarPath } from '../../../shared/runtime-environment-sidecar'
+import { listEnvironments } from '../../../shared/runtime-environment-store'
 import {
   listOrcadMigrationSourceCutovers,
   writeOrcadMigrationSourceCutover
-} from './orcad-migration-cutover-journal'
-import { orcadMigrationCutoverFixture } from './orcad-migration-cutover-fixture'
+} from '../../ssh/orcad-migration-cutover-journal'
+import { orcadMigrationCutoverFixture } from '../../ssh/orcad-migration-cutover-fixture'
 import {
   createManagedLifecycleHarness,
   MANAGED_VERSION
@@ -29,24 +29,26 @@ const mocks = vi.hoisted(() => {
   }
 })
 
-vi.mock('./ssh-target-registry', () => ({
+vi.mock('../../ssh/ssh-target-registry', () => ({
   getSshConnectionManager: () => ({ connect: async () => ({}) }),
   getSshTargetRegistryStore: () => mocks.state.store
 }))
-vi.mock('../managed-server/install/orcad-remote-context', () => ({
+vi.mock('../install/orcad-remote-context', () => ({
   resolveOrcadRemoteContext: mocks.resolveContext
 }))
-vi.mock('./orcad-terminal-census-client', () => ({ collectManagedTerminalCensus: mocks.census }))
-vi.mock('../managed-server/install/orcad-remote-decommission', () => ({
+vi.mock('../../ssh/orcad-terminal-census-client', () => ({
+  collectManagedTerminalCensus: mocks.census
+}))
+vi.mock('../install/orcad-remote-decommission', () => ({
   decommissionRemoteOrcad: mocks.decommission
 }))
-vi.mock('../managed-server/activation/orcad-activation-recovery', () => ({
+vi.mock('../activation/orcad-activation-recovery', () => ({
   recoverInterruptedOrcadActivation: mocks.recover
 }))
-vi.mock('../managed-server/activation/orcad-activation-transaction-store', () => ({
+vi.mock('../activation/orcad-activation-transaction-store', () => ({
   readOrcadActivationTransaction: async () => mocks.state.transaction
 }))
-vi.mock('../managed-server/activation/orcad-activation-lock', () => ({
+vi.mock('../activation/orcad-activation-lock', () => ({
   withStaleOrcadActivationRecoveryLock: async (
     _options: unknown,
     run: (lock: { retain: () => void }) => Promise<unknown>

src/main/managed-server/lifecycle/orcad-runtime-decommission.ts

@@ -6,16 +6,16 @@ import type {
   OrcadManagedCancelStopResult,
   OrcadManagedForgetResult,
   OrcadManagedStopResult
-} from '../../shared/orcad-managed-runtime'
-import type { OrcadDaemonRetirementVerdict } from '../../shared/orcad-stop-request'
-import { removeManagedOrcadEnvironment } from '../../shared/runtime-environment-managed-orcad-store'
+} from '../../../shared/orcad-managed-runtime'
+import type { OrcadDaemonRetirementVerdict } from '../../../shared/orcad-stop-request'
+import { removeManagedOrcadEnvironment } from '../../../shared/runtime-environment-managed-orcad-store'
 import type {
   KnownRuntimeEnvironment,
   OrcadSshDeploymentLink
-} from '../../shared/runtime-environments'
-import { recoverInterruptedOrcadActivation } from '../managed-server/activation/orcad-activation-recovery'
-import { withStaleOrcadActivationRecoveryLock } from '../managed-server/activation/orcad-activation-lock'
-import { readOrcadActivationTransaction } from '../managed-server/activation/orcad-activation-transaction-store'
+} from '../../../shared/runtime-environments'
+import { recoverInterruptedOrcadActivation } from '../activation/orcad-activation-recovery'
+import { withStaleOrcadActivationRecoveryLock } from '../activation/orcad-activation-lock'
+import { readOrcadActivationTransaction } from '../activation/orcad-activation-transaction-store'
 import { reconcileOrcadDecommission } from './orcad-decommission-recovery'
 import { cancelRemoteOrcadManagedStop } from './orcad-managed-remote-stop'
 import {
@@ -25,11 +25,11 @@ import {
 } from './orcad-managed-runtime-context'
 import { closeOrcadManagedTunnel, ensureOrcadManagedTunnel } from './orcad-managed-tunnel'
 import { clearManagedOrcadUpdateDeferral } from './orcad-managed-update-deferrals'
-import { removeOrcadMigrationJournalsForDestination } from './orcad-migration-cutover-journal'
-import { decommissionRemoteOrcad } from '../managed-server/install/orcad-remote-decommission'
-import { withManagedOrcadLifecycle } from './orcad-runtime-maintenance'
-import { collectManagedTerminalCensus } from './orcad-terminal-census-client'
-import { RemoteInstallLockBusyError } from '../managed-server/install/remote-install-lock'
+import { removeOrcadMigrationJournalsForDestination } from '../../ssh/orcad-migration-cutover-journal'
+import { decommissionRemoteOrcad } from '../install/orcad-remote-decommission'
+import { withManagedOrcadLifecycle } from '../../ssh/orcad-runtime-maintenance'
+import { collectManagedTerminalCensus } from '../../ssh/orcad-terminal-census-client'
+import { RemoteInstallLockBusyError } from '../install/remote-install-lock'
 
 export type ManagedOrcadStopPolicy = {
   isActiveEnvironment: (environmentId: string) => boolean

src/main/managed-server/lifecycle/orcad-runtime-deployment.test.ts

@@ -2,23 +2,23 @@ import { mkdtempSync, rmSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-import { getAppEnvironment } from '../../shared/app-environment'
-import { encodePairingOffer, PAIRING_OFFER_VERSION } from '../../shared/pairing'
-import { getManagedOrcadFenceEnvironmentId } from '../../shared/managed-orcad-ssh-owner'
-import { writeOrcadMigrationSourceCutover } from './orcad-migration-cutover-journal'
-import { orcadMigrationCutoverFixture } from './orcad-migration-cutover-fixture'
-import { listEnvironments } from '../../shared/runtime-environment-store'
-import type { SshTarget } from '../../shared/ssh-types'
-import { getRemoteHostPlatform } from './ssh-remote-platform'
-import { SshTargetOrcadClaims } from './ssh-target-orcad-claims'
-import { emptyDependentStateStore } from './ssh-target-orcad-dependents-fixture'
+import { getAppEnvironment } from '../../../shared/app-environment'
+import { encodePairingOffer, PAIRING_OFFER_VERSION } from '../../../shared/pairing'
+import { getManagedOrcadFenceEnvironmentId } from '../../../shared/managed-orcad-ssh-owner'
+import { writeOrcadMigrationSourceCutover } from '../../ssh/orcad-migration-cutover-journal'
+import { orcadMigrationCutoverFixture } from '../../ssh/orcad-migration-cutover-fixture'
+import { listEnvironments } from '../../../shared/runtime-environment-store'
+import type { SshTarget } from '../../../shared/ssh-types'
+import { getRemoteHostPlatform } from '../../ssh/ssh-remote-platform'
+import { SshTargetOrcadClaims } from '../../ssh/ssh-target-orcad-claims'
+import { emptyDependentStateStore } from '../../ssh/ssh-target-orcad-dependents-fixture'
 import {
   withDeactivatedVersion,
   withDeactivatedVersionCommitted,
   type OrcadActivationRecord
-} from '../managed-server/activation/orcad-activation-record'
-import { ORCAD_ACTIVATION_POLICY_REFUSED_CODE } from './orcad-installed-activation'
-import type { OrcadDeployOptions } from './orcad-remote-deploy'
+} from '../activation/orcad-activation-record'
+import { ORCAD_ACTIVATION_POLICY_REFUSED_CODE } from '../../ssh/orcad-installed-activation'
+import type { OrcadDeployOptions } from '../../ssh/orcad-remote-deploy'
 
 const mocks = vi.hoisted(() => {
   const state: { store: unknown } = { store: null }
@@ -41,43 +41,45 @@ const mocks = vi.hoisted(() => {
   }
 })
 
-vi.mock('./ssh-target-registry', () => ({
+vi.mock('../../ssh/ssh-target-registry', () => ({
   getSshConnectionManager: () => ({ connect: mocks.connect }),
   getSshTargetRegistryStore: () => mocks.state.store
 }))
-vi.mock('../managed-server/install/orcad-remote-context', () => ({
+vi.mock('../install/orcad-remote-context', () => ({
   resolveOrcadRemoteContext: mocks.resolveContext
 }))
-vi.mock('../managed-server/activation/orcad-activation-recovery', () => ({
+vi.mock('../activation/orcad-activation-recovery', () => ({
   recoverInterruptedOrcadActivation: mocks.recover
 }))
-vi.mock('../managed-server/activation/orcad-activation-record-store', () => ({
+vi.mock('../activation/orcad-activation-record-store', () => ({
   readOrcadActivationRecord: mocks.readRecord
 }))
-vi.mock('../managed-server/activation/orcad-activation-transaction-store', () => ({
+vi.mock('../activation/orcad-activation-transaction-store', () => ({
   readOrcadActivationTransaction: mocks.readTransaction
 }))
-vi.mock('./orcad-remote-deploy', () => ({ deployOrcad: mocks.deploy }))
-vi.mock('../orcad/orcad-artifact-materializer', () => ({
+vi.mock('../../ssh/orcad-remote-deploy', () => ({ deployOrcad: mocks.deploy }))
+vi.mock('../../orcad/orcad-artifact-materializer', () => ({
   materializeOrcadArtifact: async () => '/local/orcad'
 }))
 vi.mock('./orcad-managed-wake', () => ({ wakeStoppedManagedOrcad: mocks.wake }))
-vi.mock('../managed-server/activation/orcad-activation-fence-hold', () => ({
+vi.mock('../activation/orcad-activation-fence-hold', () => ({
   orcadActivationFenceRefusal: mocks.fenceRefusal
 }))
-vi.mock('../managed-server/install/orcad-remote-build-hash', () => ({
+vi.mock('../install/orcad-remote-build-hash', () => ({
   readRemoteOrcadBuildHash: async () => 'running-hash'
 }))
-vi.mock('../managed-server/install/remote-versioned-install', async (importOriginal) => ({
+vi.mock('../install/remote-versioned-install', async (importOriginal) => ({
   ...(await importOriginal<Record<string, unknown>>()),
   readLocalFullVersion: mocks.localVersion
 }))
-vi.mock('./orcad-local-build-hash', () => ({ computeLocalOrcadBuildHash: () => 'build-hash' }))
-vi.mock('./orcad-active-readiness', async (importOriginal) => ({
+vi.mock('../../ssh/orcad-local-build-hash', () => ({
+  computeLocalOrcadBuildHash: () => 'build-hash'
+}))
+vi.mock('../../ssh/orcad-active-readiness', async (importOriginal) => ({
   ...(await importOriginal<Record<string, unknown>>()),
   probeActiveOrcadReadiness: mocks.probe
 }))
-vi.mock('./orcad-terminal-census-client', () => ({
+vi.mock('../../ssh/orcad-terminal-census-client', () => ({
   collectManagedTerminalCensus: async () => ({
     liveSessions: 0,
     startedSinceActivation: 0,

src/main/managed-server/lifecycle/orcad-runtime-deployment.ts

@@ -3,44 +3,44 @@
  * The target claim is the resume point: an interrupted deploy leaves the target owned by the
  * environment id it was creating, and the next deploy of that target finishes the same one.
  */
-import { getAppEnvironment } from '../../shared/app-environment'
+import { getAppEnvironment } from '../../../shared/app-environment'
 import { randomUUID } from 'node:crypto'
-import { assertRuntimeEnvironmentNotReconciling } from '../../shared/runtime-environment-reconciliation-record'
-import { listEnvironments } from '../../shared/runtime-environment-store'
-import { addManagedOrcadEnvironment } from '../../shared/runtime-environment-managed-orcad-store'
-import { getOrcadSshDeployment, redactRuntimeEnvironment } from '../../shared/runtime-environments'
+import { assertRuntimeEnvironmentNotReconciling } from '../../../shared/runtime-environment-reconciliation-record'
+import { listEnvironments } from '../../../shared/runtime-environment-store'
+import { addManagedOrcadEnvironment } from '../../../shared/runtime-environment-managed-orcad-store'
+import {
+  getOrcadSshDeployment,
+  redactRuntimeEnvironment
+} from '../../../shared/runtime-environments'
 import {
   ORCAD_MANAGED_REMOTE_PORT,
   type OrcadManagedDeferral,
   type OrcadManagedDeployResult
-} from '../../shared/orcad-managed-runtime'
-import { getManagedOrcadFenceEnvironmentId } from '../../shared/managed-orcad-ssh-owner'
-import { runTargetLifecycle } from '../ipc/ssh-target-lifecycle-queue'
-import { materializeOrcadArtifact } from '../orcad/orcad-artifact-materializer'
+} from '../../../shared/orcad-managed-runtime'
+import { getManagedOrcadFenceEnvironmentId } from '../../../shared/managed-orcad-ssh-owner'
+import { runTargetLifecycle } from '../../ipc/ssh-target-lifecycle-queue'
+import { materializeOrcadArtifact } from '../../orcad/orcad-artifact-materializer'
 import {
   closeOrcadManagedTunnel,
   ensureOrcadManagedTunnel,
   startOrcadManagedTunnel
 } from './orcad-managed-tunnel'
-import { recoverInterruptedOrcadActivation } from '../managed-server/activation/orcad-activation-recovery'
-import { wakeAlreadyActiveOrcad } from './orcad-already-active-wake'
-import { readOrcadActivationRecord } from '../managed-server/activation/orcad-activation-record-store'
-import {
-  resolveOrcadRemoteContext,
-  type OrcadRemoteContext
-} from '../managed-server/install/orcad-remote-context'
-import { deployOrcad } from './orcad-remote-deploy'
+import { recoverInterruptedOrcadActivation } from '../activation/orcad-activation-recovery'
+import { wakeAlreadyActiveOrcad } from '../../ssh/orcad-already-active-wake'
+import { readOrcadActivationRecord } from '../activation/orcad-activation-record-store'
+import { resolveOrcadRemoteContext, type OrcadRemoteContext } from '../install/orcad-remote-context'
+import { deployOrcad } from '../../ssh/orcad-remote-deploy'
 import {
   adoptRunningOrcadVersion,
   type OrcadRunningAdoption
-} from './orcad-running-version-adoption'
-import { readLocalFullVersion } from '../managed-server/install/remote-versioned-install'
-import { sshOrcadHostTransport } from './orcad-ssh-host-transport'
-import { ORCAD_ACTIVATION_POLICY_REFUSED_CODE } from './orcad-installed-activation'
+} from '../../ssh/orcad-running-version-adoption'
+import { readLocalFullVersion } from '../install/remote-versioned-install'
+import { sshOrcadHostTransport } from '../../ssh/orcad-ssh-host-transport'
+import { ORCAD_ACTIVATION_POLICY_REFUSED_CODE } from '../../ssh/orcad-installed-activation'
 import { pruneManagedOrcadVersions } from './orcad-managed-version-gc'
-import { tunneledOrcadPairingCode } from './orcad-tunneled-pairing'
-import { resolveOrcadMigrationFence } from './orcad-migration-source-fence'
-import type { SshTarget } from '../../shared/ssh-types'
+import { tunneledOrcadPairingCode } from '../../ssh/orcad-tunneled-pairing'
+import { resolveOrcadMigrationFence } from '../../ssh/orcad-migration-source-fence'
+import type { SshTarget } from '../../../shared/ssh-types'
 import { deployedOrcadTunnelChecks } from './orcad-managed-tunnel-identity'
 import {
   isForceableOrcadDeferral,

src/main/managed-server/lifecycle/orcad-runtime-forget.test.ts

@@ -1,14 +1,14 @@
 import { rmSync } from 'node:fs'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-import { getManagedOrcadFenceEnvironmentId } from '../../shared/managed-orcad-ssh-owner'
-import { listEnvironments } from '../../shared/runtime-environment-store'
+import { getManagedOrcadFenceEnvironmentId } from '../../../shared/managed-orcad-ssh-owner'
+import { listEnvironments } from '../../../shared/runtime-environment-store'
 import {
   listOrcadMigrationSourceCutovers,
   writeOrcadMigrationSourceCutover
-} from './orcad-migration-cutover-journal'
-import { orcadMigrationCutoverFixture } from './orcad-migration-cutover-fixture'
+} from '../../ssh/orcad-migration-cutover-journal'
+import { orcadMigrationCutoverFixture } from '../../ssh/orcad-migration-cutover-fixture'
 import { createManagedLifecycleHarness } from './orcad-managed-lifecycle-test-fixture'
-import { isManagedOrcadSshTarget } from './ssh-connection-store'
+import { isManagedOrcadSshTarget } from '../../ssh/ssh-connection-store'
 
 const mocks = vi.hoisted(() => {
   const state: { store: unknown } = { store: null }
@@ -21,11 +21,11 @@ const mocks = vi.hoisted(() => {
   }
 })
 
-vi.mock('./ssh-target-registry', () => ({
+vi.mock('../../ssh/ssh-target-registry', () => ({
   getSshConnectionManager: () => ({ connect: mocks.connect }),
   getSshTargetRegistryStore: () => mocks.state.store
 }))
-vi.mock('../managed-server/install/orcad-remote-context', () => ({
+vi.mock('../install/orcad-remote-context', () => ({
   resolveOrcadRemoteContext: mocks.resolveContext
 }))
 vi.mock('./orcad-managed-tunnel', () => ({

src/main/managed-server/lifecycle/orcad-runtime-status.ts

@@ -1,14 +1,14 @@
-import type { OrcadManagedRuntimeStatus } from '../../shared/orcad-managed-runtime'
-import { runTargetLifecycle } from '../ipc/ssh-target-lifecycle-queue'
-import type { OrcadActivationTransaction } from '../managed-server/activation/orcad-activation-transaction'
-import { readOrcadActivationTransaction } from '../managed-server/activation/orcad-activation-transaction-store'
+import type { OrcadManagedRuntimeStatus } from '../../../shared/orcad-managed-runtime'
+import { runTargetLifecycle } from '../../ipc/ssh-target-lifecycle-queue'
+import type { OrcadActivationTransaction } from '../activation/orcad-activation-transaction'
+import { readOrcadActivationTransaction } from '../activation/orcad-activation-transaction-store'
 import {
   requireManagedOrcadEnvironment,
   resolveLinkedOrcadContext
 } from './orcad-managed-runtime-context'
 import { currentManagedOrcadUpdateDeferral } from './orcad-managed-update-deferrals'
 import { findIncompleteManagedOrcadMigration } from './orcad-managed-migration-status'
-import { collectManagedTerminalCensus } from './orcad-terminal-census-client'
+import { collectManagedTerminalCensus } from '../../ssh/orcad-terminal-census-client'
 
 /** Read-only: what the host's activation record and journal say, without repairing either. */
 export async function getManagedOrcadRuntimeStatus(

src/main/managed-server/lifecycle/orcad-runtime-target.test.ts

@@ -1,12 +1,12 @@
-import type * as ExecCommandModule from './remote-exec-command'
+import type * as ExecCommandModule from '../../ssh/remote-exec-command'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import { resolveOrcadRuntimeTarget } from './orcad-runtime-target'
-import { SshConnection } from './ssh-connection'
-import { createCallbacks, createTarget } from './ssh-connection-test-fixtures'
-import { execCommand } from './remote-exec-command'
-import { getRemoteHostPlatform } from './ssh-remote-platform'
+import { SshConnection } from '../../ssh/ssh-connection'
+import { createCallbacks, createTarget } from '../../ssh/ssh-connection-test-fixtures'
+import { execCommand } from '../../ssh/remote-exec-command'
+import { getRemoteHostPlatform } from '../../ssh/ssh-remote-platform'
 
-vi.mock('./remote-exec-command', async (importOriginal) => ({
+vi.mock('../../ssh/remote-exec-command', async (importOriginal) => ({
   ...(await importOriginal<typeof ExecCommandModule>()),
   execCommand: vi.fn()
 }))

src/main/managed-server/lifecycle/orcad-runtime-target.ts

@@ -1,9 +1,9 @@
-import type { NodeRuntimeTarget } from '../../shared/node-runtime-pin'
-import { resolveOrcadDeploymentTargetFacts } from './orcad-deployment-target'
-import { OrcadHostUnsupportedError } from '../orcad/orcad-host-unavailable'
-import type { OrcadHostTransport } from './orcad-host-transport'
-import { pinnedRuntimeTargetForHost } from './pinned-runtime-host-target'
-import type { RemoteHostPlatform } from './ssh-remote-platform'
+import type { NodeRuntimeTarget } from '../../../shared/node-runtime-pin'
+import { resolveOrcadDeploymentTargetFacts } from '../../ssh/orcad-deployment-target'
+import { OrcadHostUnsupportedError } from '../../orcad/orcad-host-unavailable'
+import type { OrcadHostTransport } from '../../ssh/orcad-host-transport'
+import { pinnedRuntimeTargetForHost } from '../../ssh/pinned-runtime-host-target'
+import type { RemoteHostPlatform } from '../../ssh/ssh-remote-platform'
 
 /**
  * The runtime target managed orcad deploys on a host, picked by glibc: the host's own target, or

src/main/managed-server/lifecycle/orcad-stdio-bridge-listener.ts

@@ -10,12 +10,12 @@ import {
   OrcadStdioBridgeDecoder,
   type OrcadStdioBridgeSignal
 } from './orcad-stdio-bridge-stream'
-import type { RemoteCommandChannel } from '../managed-server/install/remote-install-transport'
+import type { RemoteCommandChannel } from '../install/remote-install-transport'
 import type {
   PortForwardStartOptions,
   StartedPortForward
-} from './port-forwarding/ssh-port-forward-provider'
-import { listenForPortForward } from './port-forwarding/ssh2-port-forward-provider'
+} from '../../ssh/port-forwarding/ssh-port-forward-provider'
+import { listenForPortForward } from '../../ssh/port-forwarding/ssh2-port-forward-provider'
 
 /**
  * Each bridge is one sshd session, and OpenSSH's MaxSessions defaults to 10 per connection. The

src/main/managed-server/lifecycle/orcad-stdio-bridge-provider.test.ts

@@ -4,15 +4,15 @@ import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { PassThrough } from 'node:stream'
 import { afterAll, afterEach, beforeAll, describe, expect, it, vi } from 'vitest'
-import { OrcadStdioBridgeUnavailableError } from '../orcad/orcad-host-unavailable'
-import type { OrcadStdioBridge } from './orcad-stdio-bridge'
+import { OrcadStdioBridgeUnavailableError } from '../../orcad/orcad-host-unavailable'
+import type { OrcadStdioBridge } from '../../ssh/orcad-stdio-bridge'
 import { ORCAD_STDIO_BRIDGE_MAX_CHANNELS } from './orcad-stdio-bridge-listener'
 import { OrcadStdioBridgePortForwardProvider } from './orcad-stdio-bridge-provider'
 import { spawnLocalBridgeChannel, startEchoServer } from './orcad-stdio-bridge-test-channel'
-import { ORCAD_WINDOWS_HOST_SCRIPT } from './orcad-windows-host-script'
-import type { SshConnection } from './ssh-connection'
-import type { StartedPortForward } from './port-forwarding/ssh-port-forward-provider'
-import type { RemoteCommandChannel } from '../managed-server/install/remote-install-transport'
+import { ORCAD_WINDOWS_HOST_SCRIPT } from '../../ssh/orcad-windows-host-script'
+import type { SshConnection } from '../../ssh/ssh-connection'
+import type { StartedPortForward } from '../../ssh/port-forwarding/ssh-port-forward-provider'
+import type { RemoteCommandChannel } from '../install/remote-install-transport'
 
 let echo: { server: Server; port: number }
 let script: string

src/main/managed-server/lifecycle/orcad-stdio-bridge-provider.ts

@@ -6,23 +6,23 @@
  * Disconnects match the forward: a lost channel drops its socket and the listener stays, so the
  * tunnel's own reconnect logic decides, and a lost transport never reads as a dead server.
  */
-import { OrcadStdioBridgeUnavailableError } from '../orcad/orcad-host-unavailable'
-import type { OrcadHostTransport } from './orcad-host-transport'
+import { OrcadStdioBridgeUnavailableError } from '../../orcad/orcad-host-unavailable'
+import type { OrcadHostTransport } from '../../ssh/orcad-host-transport'
 import {
   checkOrcadStdioBridge,
   openOrcadStdioBridgeChannel,
   resolveOrcadStdioBridge,
   type OrcadStdioBridge
-} from './orcad-stdio-bridge'
+} from '../../ssh/orcad-stdio-bridge'
 import { listenOrcadStdioBridge } from './orcad-stdio-bridge-listener'
-import { sshOrcadHostTransport } from './orcad-ssh-host-transport'
-import type { RemoteCommandChannel } from '../managed-server/install/remote-install-transport'
-import type { SshConnection } from './ssh-connection'
+import { sshOrcadHostTransport } from '../../ssh/orcad-ssh-host-transport'
+import type { RemoteCommandChannel } from '../install/remote-install-transport'
+import type { SshConnection } from '../../ssh/ssh-connection'
 import type {
   PortForwardStartOptions,
   SshPortForwardProvider,
   StartedPortForward
-} from './port-forwarding/ssh-port-forward-provider'
+} from '../../ssh/port-forwarding/ssh-port-forward-provider'
 
 export type OrcadStdioBridgeDependencies = {
   resolveBridge: (conn: OrcadHostTransport, port: number) => Promise<OrcadStdioBridge>

src/main/managed-server/lifecycle/orcad-stdio-bridge-script.ts

@@ -12,10 +12,10 @@ import {
   ORCAD_NODE_RUNTIME_DIR_PREFIX,
   ORCAD_NODE_RUNTIME_POSIX_EXECUTABLE,
   ORCAD_RUNTIMES_DIRNAME
-} from '../../shared/orcad-artifacts'
-import { shellEscape } from './ssh-connection-utils'
-import { RELAY_REMOTE_DIR } from './remote-frame-protocol'
-import { ORCAD_MACHINE_HOMES_DIRNAME } from './orcad-machine-home'
+} from '../../../shared/orcad-artifacts'
+import { shellEscape } from '../../ssh/ssh-connection-utils'
+import { RELAY_REMOTE_DIR } from '../../ssh/remote-frame-protocol'
+import { ORCAD_MACHINE_HOMES_DIRNAME } from '../../ssh/orcad-machine-home'
 
 export type OrcadStdioBridgeMode = 'raw' | 'base64'
 

src/main/managed-server/lifecycle/orcad-stdio-bridge-test-channel.ts

@@ -2,7 +2,7 @@
 import { createServer, type Server } from 'node:net'
 import { Duplex } from 'node:stream'
 import { spawnProcess } from '@orca/process-host'
-import type { RemoteCommandChannel } from '../managed-server/install/remote-install-transport'
+import type { RemoteCommandChannel } from '../install/remote-install-transport'
 
 export function spawnLocalBridgeChannel(
   program: string,

src/main/ssh/hostile-host-test-support/ssh-hostile-host-managed-orcad.ts

@@ -11,7 +11,7 @@ import { ORCAD_RUNTIMES_DIRNAME } from '../../../shared/orcad-artifacts'
 import type { SshTarget } from '../../../shared/ssh-types'
 import { readOrcadActivationRecord } from '../../managed-server/activation/orcad-activation-record-store'
 import { classifyOrcadHostUnavailable } from '../../orcad/orcad-host-unavailable'
-import { managedOrcadSlot } from '../orcad-managed-runtime-context'
+import { managedOrcadSlot } from '../../managed-server/lifecycle/orcad-managed-runtime-context'
 import { orcadSlotDir, type OrcadSlotOptions } from '../orcad-recovery-slot'
 import { resolveOrcadRemoteContext } from '../../managed-server/install/orcad-remote-context'
 import { deployOrcad } from '../orcad-remote-deploy'