[LIghtJUNction]

The daemon currently defaults to one host installation and a separate top-level msgd-root directory. Add stable named installations: msgd --instance main selects /etc/msgd/main, /var/lib/msgd/main and OS-root-only /var/lib/private/msgd/main/root, independently of DNS. Named initialization requires an explicit origin and PostgreSQL DSN. Separate web/worker templates use separate msgd-<instance> accounts; the preparation script rejects legacy/named mixtures and symlinks.

Legacy installations and existing explicit custom Root locations remain readable; duplicate Root material fails closed. Packages create shared containers without resetting existing ownership/modes. No directory, identity, key or ledger migration runs during upgrade. Signed service bindings remain unchanged; DNS aliases currently need to redirect to the canonical origin.

Rebuilt on current main c57511c using only the two instance commits, preserving the current client domain namespace, origin validation, release version and money-fixture fix. Keeps main's required --service-url; no project-hostname fallback is reintroduced. The previous shard 3 failure was the old base's funded-account archive fixture; current main already drains that fixture.

Validation: 54 targeted tests passed, covering server instances, client paths, configuration safety, Root storage and the public-money tests including the formerly failing archive case. Ruff check/format, shell syntax and diff checks passed. Full CI on the new head runs separately. No deployment, production path migration, Root/PIN or money action was performed.

[chatgpt-codex-connector]

You have reached your Codex usage limits for security reviews. Please try again later.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[LIghtJUNction]

更新（合并 head 7a4c2e9 / main ce52136）：此项已修复。已核对最终 stopping() 检查，并重跑原始函数的隔离 SIGTERM 用例，结果 execute=false、saved_after_stop=0。下面保留旧 head 9ad30a0 的复现记录；它不再是当前合并版本的阻塞项。此验证不代表整套 CI 已通过。

在当前 head 9ad30a0 核对到一个继承的关闭流程回归：此分支包含 #209 的 graceful shutdown 主体，但没有 e8a4986 在 EffectWorker._claim 中、pending → running 之前增加的最后一次 stopping() 检查。

我用当前分支的原始 _claim / tool_concurrency 函数做了隔离复现：在等待工具内容读取时发送真实 SIGTERM，等 stop 标志置位后恢复读取，结果仍是 stop_seen=true、claimed_state=running、execute=true、saved_after_stop=1。入口处的检查不能覆盖中途 await 的窗口，因此关停后仍会领取并开始新任务。

请把 #209 的最后一次停止检查及对应回归覆盖带入此分支，再验证 SIGTERM 后 execute=false 且没有新的 running 写入。已有修复验证记录：#209 (comment) 。这里只运行了隔离函数复现，没有触碰部署或真实任务。

[LIghtJUNction]

补充两个在 head 9ad30a0 核对到的部署兼容性问题：

1. deploy/prepare-instance.sh 最后把配置目录中的所有普通文件改为 0640，包括两个新模板通过 PGPASSFILE 指定的 /etc/msgd/INSTANCE/pgpass。libpq 会忽略有 group/world 权限的密码文件；我用临时文件、合成值和本地关闭端口做了隔离验证，确实收到「password file ... has group or world access; permissions should be u=rw (0600) or less」警告。因此依赖该文件进行密码认证的实例在准备权限后无法连接数据库。请为 pgpass 单独设置服务账号可读取的 owner 和 0600 模式，不要让通用 0640 规则覆盖它，并补充该文件的权限回归测试。

2. packaging/build-native.py 已把 msgd@.service、msgd-worker@.service 放进安装 payload，但生成的 RPM %files 仍只列出 msgd.service 和 msgd-worker.service。对源码构造出的安装清单与 RPM manifest 做比较，确认两个新模板都未被收录。请把这两项加入 %files，并在 RPM 构建/安装清单测试中覆盖；本次只验证了清单不一致，环境没有 rpmbuild，未执行完整 RPM 构建。

以上检查未修改真实实例的配置、权限或数据。

[LIghtJUNction]

更新：合并 head 7a4c2e9 / main ce52136 的源码已包含测试 fixture 余额归零步骤及成功断言。此前 9ad30a0 上的归档测试依赖缺口已在源码中补齐；合并提交的完整 CI 仍待单独确认。生产账户归档的零余额约束保持不变。