[TheGreatAxios]

A hub restart no longer stops the local sidecar. When the hub gets SIGTERM, hits a fatal error, fails to start or crashes, the sidecar keeps running. The next hub adopts it, and it reconnects through Interchange's stock path (hello, route restore, welcome, queued mail), so a turn in flight carries on. Interchange itself is unchanged.

The hub now starts the sidecar under a small watchdog (apps/hub/src/sidecar/watchdog.ts). Both processes carry the hub's data dir on their command line, and the watchdog also carries a fingerprint of everything the sidecar was spawned from: hub URL, identity, token, data dir, credential key, deployment limit, child environment, adapter manifest and the vendored Interchange revision. At boot, the hub lists processes. It adopts the one sidecar on its data dir whose fingerprint matches and stops every other process on that data dir, so two sidecars never share one. A sidecar left by a hub from before this change, which only recorded a pid, is stopped as before. Before signalling an adopted process, the hub checks that the pid still runs the same command.

A sidecar is now stopped in these cases:

• the hub gets SIGINT, as when the dev script exits;
• the hub sets SIDECAR_LOCAL_OUTLIVES_HUB=false, or is process 1 and leaves it unset, which keeps the graceful SIGTERM-then-SIGKILL stop for containers (the Dockerfile sets it to false);
• at boot, its fingerprint no longer matches, its identity is gone, it was minted with an older adapter manifest, or it has no work left;
• it is adopted but does not reconnect for any allocation within a minute, and is then replaced;
• its watchdog has had no answer from the hub's address for ten minutes.

The hub's SIGTERM shutdown releases the sidecar's process handle, so the hub exits rather than waiting on its child.

The e2e harness can now run the hub as its own server.ts process and restart it with SIGTERM. The recorded model server can also hold a reply. The new hub-restart e2e test holds a writer's model reply, sends the hub process SIGTERM, starts a new one, then releases the reply. It checks that the writer files its document, no run is listed as failed, and the coordinator gets no extra exchange. With SIDECAR_LOCAL_OUTLIVES_HUB=false, the same test fails because the coordinator receives "The writer stopped before finishing." The test delays the coordinator's first approval request by a second, because the hub compares a Postgres timestamp with its own clock; a separate fix removes that.

I ran lint, format:check, typecheck, bun run test, pins:verify, vendor:verify and the full e2e suite against a throwaway Postgres, and all passed. I also checked by hand that the watchdog stops a sidecar when no hub answers. With the reconnect check shortened to three seconds, the e2e test still passed, so an adopted sidecar that reconnects is not replaced.

Refs CL-12139

[linear-code]

CL-12139

[TheGreatAxios]

Closing: the approach adds custom sidecar lifecycle code in Builder that belongs in a provisioner plugin and Interchange. The scope of CL-12139 will be re-defined before any new PR.