fix(remote): preserve a live serve when its token is unavailable

internal/platform/remote/bootstrap/bootstrap.go

@@ -382,7 +382,7 @@ func tryReuse(ctx context.Context, conn Conn, target remoteOS, fs *sftpfs.FS, pa
 	// authority, so a tampered record cannot make us read an arbitrary file.
 	tok, err := readToken(ctx, fs, paths.TokenFile)
 	if err != nil {
-		return ServeState{}, "", false, nil
+		return ServeState{}, "", false, fmt.Errorf("%w: pid %d has no readable token file", ErrServeNotAttachable, st.PID)
 	}
 	if follows {
 		// Written on every reuse, not only when the address moved: a broker
@@ -436,11 +436,8 @@ func rebind(ctx context.Context, fs *sftpfs.FS, paths StatePaths, st ServeState,
 	return st, true
 }
 
-// retireReplaced stops the kernel named by the record this launch is about to
-// overwrite. Reuse was already refused — too old, bound to a retired broker,
-// its token gone — and which of those it was does not change that the record
-// naming the pid is the only note this side keeps. Best effort: a machine that
-// will not answer is not a reason to refuse the pane the caller asked for.
+// retireReplaced stops the recorded serve only after reuse permits replacement.
+// An attachment refusal must return before this path can signal a live serve.
 func retireReplaced(ctx context.Context, conn Conn, target remoteOS, fs *sftpfs.FS, paths StatePaths) {
 	st, err := readState(ctx, fs, paths.StateJSON)
 	if err != nil || st.PID <= 0 {

internal/platform/remote/bootstrap/reuse_credentials_test.go

@@ -0,0 +1,89 @@
+package bootstrap
+
+import (
+	"context"
+	"errors"
+	"os"
+	"strings"
+	"testing"
+
+	"reasonix/internal/platform/remote"
+)
+
+func TestEnsureServeKeepsAnAdoptedServeWhenItsTokenIsUnavailable(t *testing.T) {
+	skipOnWindows(t)
+	for _, token := range []string{"missing", "empty"} {
+		t.Run(token, func(t *testing.T) {
+			pub := publishExternalServe(t, "4242", "127.0.0.1:47001", true)
+			alive := aliveServe(t, "4242", "reasonix v2.31.0\n")
+			conn := newFakeConn(t, pub.root, func(cmd string) (remote.ExecResult, error) {
+				if strings.Contains(cmd, "command -v reasonix") {
+					return ok("bin /usr/bin/reasonix\nver reasonix v2.31.0\n" + allFlagsYes())
+				}
+				return alive(cmd)
+			})
+			opts := Options{Workspace: "~", MinVersion: MinPaneVersion}
+			first, err := EnsureServe(context.Background(), conn, opts)
+			if err != nil || !first.Reused {
+				t.Fatalf("initial adoption: reused=%v err=%v", first.Reused, err)
+			}
+			before, err := os.ReadFile(pub.paths.StateJSON)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if token == "missing" {
+				err = os.Remove(pub.paths.TokenFile)
+			} else {
+				err = os.WriteFile(pub.paths.TokenFile, []byte(" \n"), 0o600)
+			}
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			_, err = EnsureServe(context.Background(), conn, opts)
+			if !errors.Is(err, ErrServeNotAttachable) {
+				t.Fatalf("reconnect error = %v, want ErrServeNotAttachable", err)
+			}
+			stopped := conn.ranContaining("kill -TERM")
+			launched := conn.ranContaining("nohup")
+			located := conn.ranContaining("command -v reasonix")
+			if stopped || launched || located {
+				t.Fatalf("an unavailable token entered the replacement path: stop=%v launch=%v locate=%v", stopped, launched, located)
+			}
+			pub.intact(t)
+			after, err := os.ReadFile(pub.paths.StateJSON)
+			if err != nil || string(after) != string(before) {
+				t.Fatalf("the live serve's record changed: err=%v", err)
+			}
+			if err := os.WriteFile(pub.paths.TokenFile, []byte("restored-token\n"), 0o600); err != nil {
+				t.Fatal(err)
+			}
+			res, err := EnsureServe(context.Background(), conn, opts)
+			if err != nil || !res.Reused || res.State.PID != first.State.PID || res.Token != "restored-token" {
+				t.Fatalf("reconnect after restoring token: res=%+v err=%v", res, err)
+			}
+		})
+	}
+}
+
+func TestEnsureServeReusesARecordedServeWithoutPublishedEndpointFiles(t *testing.T) {
+	skipOnWindows(t)
+	pub := publishExternalServe(t, "4242", "127.0.0.1:47001", true)
+	conn := newFakeConn(t, pub.root, aliveServe(t, "4242", "reasonix v2.31.0\n"))
+	opts := Options{Workspace: "~", MinVersion: MinPaneVersion}
+	if _, err := EnsureServe(context.Background(), conn, opts); err != nil {
+		t.Fatal(err)
+	}
+	for _, path := range []string{pub.paths.PortFile, pub.paths.PidFile} {
+		if err := os.Remove(path); err != nil {
+			t.Fatal(err)
+		}
+	}
+	res, err := EnsureServe(context.Background(), conn, opts)
+	if err != nil || !res.Reused || res.State.PID != 4242 || res.State.Addr != "127.0.0.1:47001" {
+		t.Fatalf("recorded endpoint not reused: res=%+v err=%v", res, err)
+	}
+	if conn.ranContaining("kill -TERM") || conn.ranContaining("nohup") || conn.ranContaining("command -v reasonix") {
+		t.Fatal("missing publication files caused a replacement of the live serve")
+	}
+}