Owner console interaction contract¶

Owner: vacancyd. Consumers: the installed Windows console and its notification-area menu. Separate sidebar views, manual lending switches, durable settings and a tray extend the initial read-only console.

The renderer invokes set_lending with { request: { enabled: boolean, resource: string | null } }. A null resource selects the global switch; a nonempty resource ID selects that resource. IDs are bounded and never a host, path or operation. The Rust host sends the change over the service's admin pipe as the signed-in Windows account, after checking that the pipe belongs to the running service, and bounds time and response bytes. The service decides from that account (local administration on Windows): anyone signed in may pause; the account that paused may resume; resuming another account's pause and switching a resource need an administrator. When the service answers that an administrator is required, the host raises the Windows approval prompt and runs vacancyd.exe admin-request elevated with the same change. Declining it is reported as "Administrator approval was declined. Nothing was changed." No credential/config access is added.

Response is { state: "applied", enabled: boolean } only after a matching acknowledgement (or the approved helper's success status), or { state: "failed", reason: string }. Busy, denied, declined approval, missing resource, network/timeout and invalid acknowledgement are failures. Timeout can mean the request applied: refresh observed status, never replay automatically. Only one mutation can run at once across tray and window. Polls display observed daemon state, not optimistic state. Unknown/incompatible status disables controls.

Pause refuses new admissions; it does not promise cancellation or measured GPU reclamation. Resume permits consideration under all existing owner/resource protections. Resource changes have the same limited effect. Switches are runtime-only and return to configured defaults on service restart, which also forgets who paused. Confirmation states these consequences before each mutation, and says when a change needs administrator approval. Work-hold release, credential edits, force lending and process termination are excluded.

Overview, Hardware, Workloads, Installation and Settings are separate views selected by sidebar navigation with current-page semantics and visible keyboard focus. Overview fits a normal desktop window. Settings presents common policy first and uses a native disclosure for advanced policy. The selected content area may scroll when small windows, text scaling or extensive resources, work or expanded settings require it. The document body and navigation remain fixed. Hidden views are neither visible nor keyboard reachable. Status polling preserves navigation, dialog and control focus.

The Troubleshooting panel on Installation invokes set_debug_logging with { request: { enabled: boolean } } and export_diagnostics with no arguments, each under its own diagnostics capability. set_debug_logging sends start_debug with a fixed 30 minutes, or end_debug, over the admin pipe on the same single-mutation, acknowledgement and approval-prompt path as the resource switches, and answers like set_lending; the renderer cannot choose the length. The panel shows logging from the latest status poll and re-reads status after a change. export_diagnostics reads GET /admin/diagnostics from the fixed loopback endpoint, bounded to 64 MiB and 30 seconds, then opens the native Save As dialog and writes the bytes only to the file the owner picks. It answers { state: "saved", path }, { state: "cancelled" } or { state: "failed", reason }. See logging and diagnostics.

Durable settings use the separate owner console settings contract. The renderer receives a whitelisted typed snapshot and submits a complete typed update with an exact source revision. The service preserves unexposed configuration and validates the complete staged result. After durable replacement, model and default capacity budgets apply to new admissions; existing active and held work retains its lease. Owner policy, resource defaults, pressure calibration, operational limits and advanced topology changes require a service restart. Credentials and installation paths remain outside generic Save. Runtime switches and configured defaults remain visibly distinct. Discard changes and reload performs a fresh read and replaces unsaved form values; it is the explicit recovery path after a stale-revision refusal. It asks for confirmation first when the form holds edits, since it discards them. A failed read leaves the form hidden and shows a separate Retry outside it, since the form's own Reload is unreachable while hidden. /status additionally carries config_revision, the revision loaded at service startup. Settings combines that revision with the saved snapshot's application.restart_required to show a pending-restart notice for unapplied policy. A capacity-only save does not show that notice. Live capacity publication never labels the whole saved configuration active.

The Windows console owns its tray separately from the reporter. Close hides the console, tray Open restores it, and Quit exits only the console. MSI installs a separate console startup entry with --tray; opening a second instance signals a session-local auto-reset event. The existing process restores its own window through the same path as the tray, including an activation received during startup. A --tray launch does not request activation. Existing session reporter ownership/lifecycle remains unchanged. Native tray actions share the same pipe path, approval prompt and single-mutation rule, and require confirmation. Service unavailability is shown rather than a success claim.

Verification: browser navigation/overflow/keyboard, common/advanced disclosure, settings validation/save/stale-revision failure, declined approval, confirmation/cancel/pending/failure/refresh, text injection; the platform-neutral local-admin policy and pipe request handling on Linux; Windows compilation and installed standard-user pause/resume, second-account resume, approval-prompt save and decline, settings, ACL, tray/open/close/single-instance/startup/upgrade acceptance. Browser fixtures cannot qualify native behavior.