fix: harden Pi lifecycle recovery

backend/src/runtime/maintenance-gate.ts

@@ -1,9 +1,25 @@
-/** An in-process admission barrier. A lease spans the complete create/resume decision. */
+import {
+  closeSync,
+  existsSync,
+  fsyncSync,
+  mkdirSync,
+  openSync,
+  renameSync,
+  unlinkSync,
+  writeFileSync,
+} from "node:fs";
+import { dirname } from "node:path";
+
+/** A durable admission barrier. A lease spans the complete create/resume decision. */
 export class MaintenanceBarrier {
-  private active = false;
+  private active: boolean;
   private admissions = 0;
   private waiters: (() => void)[] = [];
 
+  constructor(private readonly markerFile?: string) {
+    this.active = markerFile === undefined ? false : existsSync(markerFile);
+  }
+
   acquire(): (() => void) | undefined {
     if (this.active) return undefined;
     this.admissions += 1;
@@ -17,11 +33,48 @@ export class MaintenanceBarrier {
   }
 
   async activate(): Promise<void> {
+    this.persistMarker();
     this.active = true;
     if (this.admissions === 0) return;
     await new Promise<void>((resolve) => this.waiters.push(resolve));
   }
 
-  deactivate(): void { this.active = false; }
+  deactivate(): void {
+    this.removeMarker();
+    this.active = false;
+  }
   status(): { active: boolean; admissions: number } { return { active: this.active, admissions: this.admissions }; }
+
+  private persistMarker(): void {
+    if (!this.markerFile) return;
+    const directory = dirname(this.markerFile);
+    mkdirSync(directory, { recursive: true });
+    const temporary = `${this.markerFile}.tmp-${process.pid}-${Date.now()}`;
+    const fd = openSync(temporary, "wx", 0o600);
+    try {
+      writeFileSync(fd, '{"version":1,"active":true}\n', "utf8");
+      fsyncSync(fd);
+    } finally {
+      closeSync(fd);
+    }
+    try {
+      renameSync(temporary, this.markerFile);
+      syncDirectory(directory);
+    } catch (error) {
+      try { unlinkSync(temporary); } catch { /* already renamed or best-effort cleanup */ }
+      throw error;
+    }
+  }
+
+  private removeMarker(): void {
+    if (!this.markerFile || !existsSync(this.markerFile)) return;
+    unlinkSync(this.markerFile);
+    syncDirectory(dirname(this.markerFile));
+  }
+}
+
+function syncDirectory(directory: string): void {
+  if (process.platform === "win32") return;
+  const fd = openSync(directory, "r");
+  try { fsyncSync(fd); } finally { closeSync(fd); }
 }