Separate lease-loss release and finalize session terminals

docs/schema.md

@@ -1,6 +1,7 @@
 # Lazaret schemas
 
-This document is the normative design schema for Lazaret records. The
+This document is the normative design schema for Lazaret records and protocol
+data shapes. The
 [specification](specification.md) defines their physical use, while the TLA+
 models define lifecycle and ordering above the implementation abstraction. The
 diagrams define logical fields, variants, and relationships; they do not select a
@@ -69,6 +70,21 @@ classDiagram
         session_phase
     }
 
+    class SessionTerminal {
+        generation_id
+        session_id
+        state
+        container_id
+    }
+
+    class SessionTerminalState {
+        <<enumeration>>
+        Intent
+        Running
+        ReleaseIntent
+        Clean
+    }
+
     class Mailbox {
         generation_id
         identity_path
@@ -84,6 +100,8 @@ classDiagram
     Participant --> ParticipantState
     Participant --> ParticipantOwnership
     Generation "1" --> "0..*" Session
+    Session "1" --> "0..1" SessionTerminal
+    SessionTerminal --> SessionTerminalState
     Generation "1" --> "0..1" Mailbox
     Mailbox --> ParticipantState
 ```
@@ -92,6 +110,122 @@ classDiagram
 protocol model. This schema records them without redefining either state machine.
 Each store carries its own schema identity and version.
 
+### Session terminal ownership
+
+```mermaid
+classDiagram
+    class SessionTerminal {
+        generation_id
+        session_id
+        state
+        container_id
+    }
+
+    class PtyIdentity {
+        master_fd
+        device
+        inode
+    }
+
+    class ProcessIdentity {
+        pid
+        start_time
+    }
+
+    class GuestProcessIdentity {
+        leader_pid
+        leader_start_time
+        process_group_id
+    }
+
+    SessionTerminal --> ProcessIdentity : host_coordinator
+    SessionTerminal --> PtyIdentity : pty_master
+    SessionTerminal --> ProcessIdentity : exec_client
+    SessionTerminal --> GuestProcessIdentity : guest_process
+```
+
+Host process identities use host pid and start time. Guest process identity uses
+the leader PID and start time observed inside the exact generation-bound runsc
+container; its process-group ID is relative to that container's root PID
+namespace.
+The PTY identity is exact only in combination with its Host Coordinator process
+identity. `SessionTerminalState` is a physical recovery state below the
+application protocol model; it does not redefine `session_phase`.
+
+## Session terminal protocol
+
+```mermaid
+classDiagram
+    class SessionTerminalEvent {
+        <<union>>
+    }
+
+    class TerminalInput {
+        session_id
+        bytes
+    }
+
+    class TerminalResize {
+        session_id
+        rows
+        columns
+        pixel_width
+        pixel_height
+    }
+
+    class TerminalSignal {
+        session_id
+        signal
+    }
+
+    class TerminalSignalKind {
+        <<enumeration>>
+        Interrupt
+        Quit
+        Suspend
+    }
+
+    class SessionClose {
+        session_id
+    }
+
+    class SessionTerminalMessage {
+        <<union>>
+    }
+
+    class TerminalOutput {
+        session_id
+        bytes
+    }
+
+    class SessionExit {
+        session_id
+        outcome
+        exit_code
+    }
+
+    class SessionExitOutcome {
+        <<enumeration>>
+        Exited
+        Terminated
+        RuntimeLost
+    }
+
+    SessionTerminalEvent --> TerminalInput
+    SessionTerminalEvent --> TerminalResize
+    SessionTerminalEvent --> TerminalSignal
+    SessionTerminalEvent --> SessionClose
+    TerminalSignal --> TerminalSignalKind
+    SessionTerminalMessage --> TerminalOutput
+    SessionTerminalMessage --> SessionExit
+    SessionExit --> SessionExitOutcome
+```
+
+`exit_code` is present only for `Exited` and is the status collected from the
+non-detached runsc exec client. Interactive PTY output is one merged byte stream;
+it does not preserve stdout and stderr as separate channels. Protocol
+cryptographic envelopes and wire encoding are outside this schema.
+
 ### Participant ownership
 
 ```mermaid
@@ -251,7 +385,9 @@ do not form one transactional database.
 `ReleaseIntent` is a physical recovery state. It does not redefine the modeled
 lease lifecycle: the specification defines how Domain Store release intent,
 physical unmount, and Storage Catalog lease removal refine model unmount and
-release actions.
+release actions. After Host Coordinator loss, the exact Runtime Supervisor may
+unmount under the retained Prepared ownership record, but the Artifact Lease
+remains until bootstrap Host Coordinator recovery records release intent.
 
 ## Derived network policy