fix(runtime): manage daemon lifecycle during launch/reap

pack/native/CMakeLists.txt

@@ -18,6 +18,10 @@ set(XZ_MICROLZMA_ENCODER OFF CACHE BOOL "" FORCE)
 set(XZ_MICROLZMA_DECODER OFF CACHE BOOL "" FORCE)
 set(XZ_LZIP_DECODER OFF CACHE BOOL "" FORCE)
 set(XZ_THREADS no CACHE STRING "" FORCE)
+set(XZ_MATCH_FINDERS "" CACHE STRING "" FORCE)
+
+# Section-per-function so the loader link can drop xz encoders and unused checks.
+add_compile_options(-ffunction-sections -fdata-sections)
 
 FetchContent_Declare(
     xz
@@ -26,9 +30,33 @@ FetchContent_Declare(
 )
 FetchContent_MakeAvailable(xz)
 
+if(TARGET liblzma)
+    # -O2 keeps the decompress loop fast. Sections, hidden visibility and no unwind
+    # tables let --gc-sections and --icf drop the unused xz encoder without slowing it.
+    target_compile_options(liblzma PRIVATE
+        -O2
+        -ffunction-sections
+        -fdata-sections
+        -fvisibility=hidden
+        -fno-unwind-tables
+        -fno-asynchronous-unwind-tables)
+endif()
+
 add_library(loader SHARED loader.c)
 target_compile_features(loader PRIVATE c_std_17)
-target_compile_options(loader PRIVATE -O3 -fvisibility=hidden -Wall -Wextra -Werror)
+target_compile_options(loader PRIVATE
+    -Os
+    -fvisibility=hidden
+    -fno-unwind-tables
+    -fno-asynchronous-unwind-tables
+    -Wall
+    -Wextra
+    -Werror)
 target_include_directories(loader PRIVATE "${xz_SOURCE_DIR}/src/liblzma/api")
-target_link_options(loader PRIVATE -Wl,--gc-sections -Wl,--exclude-libs,ALL -Wl,-soname,libloader.so)
+target_link_options(loader PRIVATE
+    -Wl,--gc-sections
+    -Wl,--icf=safe
+    -Wl,--exclude-libs,ALL
+    -Wl,-s
+    -Wl,-soname,libloader.so)
 target_link_libraries(loader PRIVATE liblzma)

pack/native/loader.c

@@ -221,6 +221,7 @@ static NativeArchive *open_native_archive(
         free(archive);
         return NULL;
     }
+    (void)posix_fadvise(archive->fd, 0, 0, POSIX_FADV_SEQUENTIAL);
     struct stat status;
     if (fstat(archive->fd, &status) != 0 || status.st_size < 22) {
         set_error(error, error_capacity, "invalid APK: %s", strerror(errno));
@@ -393,7 +394,8 @@ static bool extract_payload(
         set_error(error, error_capacity, "allocate decompression buffers");
         goto cleanup;
     }
-    lzma_ret result = lzma_stream_decoder(&stream, UINT64_MAX, 0);
+    // The uncompressed bytes are hashed below, so the xz container check is redundant work.
+    lzma_ret result = lzma_stream_decoder(&stream, UINT64_MAX, LZMA_IGNORE_CHECK);
     if (result != LZMA_OK) {
         set_error(error, error_capacity, "initialize liblzma decoder: %d", result);
         goto cleanup;
@@ -449,7 +451,7 @@ static bool extract_payload(
                 (unsigned long long)output_size, (unsigned long long)expected_size);
         goto cleanup;
     }
-    if (fsync(output) != 0) {
+    if (fdatasync(output) != 0) {
         set_error(error, error_capacity, "sync payload: %s", strerror(errno));
         goto cleanup;
     }

runtime/client/src/runtime/client/session/RuntimeOwnership.kt

@@ -139,6 +139,24 @@ internal class RuntimeOwnership(
                 },
         )
 
+    /** The root daemon is still the runtime. Used when a replacement start fails before the swap. */
+    fun liveRootSnapshot(profile: Profile, generation: Long, lastError: String?): RuntimeSnapshot? {
+        if (!isRootDaemonActive()) return null
+        val mode = localModeForOwner(RuntimeOwner.RootDaemon) ?: return null
+        return activeSnapshot(
+            owner = RuntimeOwner.RootDaemon,
+            runMode = mode,
+            localPhase = localRuntimePhaseForOwner(RuntimeOwner.RootDaemon),
+            localStartedAt = localRuntimeStartedAtForOwner(RuntimeOwner.RootDaemon),
+        ).copy(
+            profileReady = true,
+            profileUuid = profile.uuid.toString(),
+            profileName = profile.name,
+            generation = generation,
+            lastError = lastError,
+        )
+    }
+
     fun startedSnapshot(
         current: RuntimeSnapshot,
         owner: RuntimeOwner,

runtime/client/src/runtime/client/session/RuntimeSession.kt

@@ -353,7 +353,12 @@ internal class RuntimeSession(private val deps: RuntimeSessionDeps) {
             val currentOwner =
                 ownership.detectActiveOwner().takeIf { it != RuntimeOwner.None }
                     ?: _runtimeSnapshot.value.owner
-            if (currentOwner != RuntimeOwner.None) {
+            // Root reload keeps the live daemon through config compile. The launcher swaps it
+            // under the core lifecycle lock. VPN and cross-mode starts still stop first: the
+            // service owns the tun and will not apply a second start while it is running.
+            val replacingSameRoot =
+                currentOwner == RuntimeOwner.RootDaemon && targetOwner == RuntimeOwner.RootDaemon
+            if (currentOwner != RuntimeOwner.None && !replacingSameRoot) {
                 stopInternal(
                     RuntimeStopRequest(
                         owner = currentOwner,
@@ -377,16 +382,26 @@ internal class RuntimeSession(private val deps: RuntimeSessionDeps) {
 
             runCatching { launcher.start(targetOwner, mode) }
                 .onFailure { error ->
-                    clearRuntimePayload(resetGroups = false)
-                    publishSnapshot(
-                        RuntimeStateMapper.idleSnapshot(
-                            configuredMode = mode,
-                            generation = generation,
-                            lastError = error.message,
+                    val liveRoot =
+                        if (replacingSameRoot) {
+                            ownership.liveRootSnapshot(activeProfile, generation, error.message)
+                        } else {
+                            null
+                        }
+                    if (liveRoot != null) {
+                        publishSnapshot(liveRoot)
+                    } else {
+                        clearRuntimePayload(resetGroups = false)
+                        publishSnapshot(
+                            RuntimeStateMapper.idleSnapshot(
+                                configuredMode = mode,
+                                generation = generation,
+                                lastError = error.message,
+                            )
                         )
-                    )
-                    stopTrafficPolling()
-                    scope.launch { onAfterIdle() }
+                        stopTrafficPolling()
+                        scope.launch { onAfterIdle() }
+                    }
                     throw error
                 }
         }

runtime/service/src/runtime/service/core/AndroidProcessController.kt

@@ -41,7 +41,7 @@ class AndroidProcessController(context: Context) : ProcessController {
     }
 
     override fun stopRoot() {
-        CoreProcess.stopRoot(appContext)
+        CoreProcess.stopRoot()
     }
 
     override fun isRootDaemonAlive(): Boolean = CoreProcess.isRootDaemonAlive()