hst/instance: define instance state

This is now part of the hst API. This change also improves identifier generation and serialisation.

Signed-off-by: Ophestra <cat@gensokyo.uk>

19 files changed, 261 insertions, 227 deletions

diff --git a/cmd/hakurei/parse.go b/cmd/hakurei/parse.go
index 4a24c90a..42eaf737 100644
--- a/cmd/hakurei/parse.go
+++ b/cmd/hakurei/parse.go
@@ -61,7 +61,7 @@ func tryFd(msg message.Msg, name string) io.ReadCloser {
 	}
 }
 
-func tryShort(msg message.Msg, name string) (config *hst.Config, entry *state.State) {
+func tryShort(msg message.Msg, name string) (config *hst.Config, entry *hst.State) {
 	likePrefix := false
 	if len(name) <= 32 {
 		likePrefix = true
diff --git a/cmd/hakurei/print.go b/cmd/hakurei/print.go
index 8f6e7139..c28146ad 100644
--- a/cmd/hakurei/print.go
+++ b/cmd/hakurei/print.go
@@ -41,7 +41,7 @@ func printShowSystem(output io.Writer, short, flagJSON bool) {
 // printShowInstance writes a representation of [state.State] or [hst.Config] to output.
 func printShowInstance(
 	output io.Writer, now time.Time,
-	instance *state.State, config *hst.Config,
+	instance *hst.State, config *hst.Config,
 	short, flagJSON bool) (valid bool) {
 	valid = true
 
@@ -168,7 +168,7 @@ func printShowInstance(
 
 // printPs writes a representation of active instances to output.
 func printPs(output io.Writer, now time.Time, s state.Store, short, flagJSON bool) {
-	var entries state.Entries
+	var entries map[hst.ID]*hst.State
 	if e, err := state.Join(s); err != nil {
 		log.Fatalf("cannot join store: %v", err)
 	} else {
@@ -179,7 +179,7 @@ func printPs(output io.Writer, now time.Time, s state.Store, short, flagJSON boo
 	}
 
 	if !short && flagJSON {
-		es := make(map[string]*state.State, len(entries))
+		es := make(map[string]*hst.State, len(entries))
 		for id, instance := range entries {
 			es[id.String()] = instance
 		}
@@ -249,7 +249,7 @@ func printPs(output io.Writer, now time.Time, s state.Store, short, flagJSON boo
 // expandedStateEntry stores [state.State] alongside a string representation of its [state.ID].
 type expandedStateEntry struct {
 	s string
-	*state.State
+	*hst.State
 }
 
 // newPrinter returns a configured, wrapped [tabwriter.Writer].
diff --git a/cmd/hakurei/print_test.go b/cmd/hakurei/print_test.go
index bc65bac3..da5c815a 100644
--- a/cmd/hakurei/print_test.go
+++ b/cmd/hakurei/print_test.go
@@ -10,13 +10,13 @@ import (
 )
 
 var (
-	testID = state.ID{
+	testID = hst.ID{
 		0x8e, 0x2c, 0x76, 0xb0,
 		0x66, 0xda, 0xbe, 0x57,
 		0x4c, 0xf0, 0x73, 0xbd,
 		0xb4, 0x6e, 0xb5, 0xc1,
 	}
-	testState = &state.State{
+	testState = &hst.State{
 		ID:     testID,
 		PID:    0xDEADBEEF,
 		Config: hst.Template(),
@@ -31,7 +31,7 @@ func TestPrintShowInstance(t *testing.T) {
 
 	testCases := []struct {
 		name        string
-		instance    *state.State
+		instance    *hst.State
 		config      *hst.Config
 		short, json bool
 		want        string
@@ -185,24 +185,7 @@ App
 		{"json nil", nil, nil, false, true, `null
 `, true},
 		{"json instance", testState, nil, false, true, `{
-  "instance": [
-    142,
-    44,
-    118,
-    176,
-    102,
-    218,
-    190,
-    87,
-    76,
-    240,
-    115,
-    189,
-    180,
-    110,
-    181,
-    193
-  ],
+  "instance": "8e2c76b066dabe574cf073bdb46eb5c1",
   "pid": 3735928559,
   "config": {
     "id": "org.chromium.Chromium",
@@ -530,43 +513,26 @@ func TestPrintPs(t *testing.T) {
 
 	testCases := []struct {
 		name        string
-		entries     state.Entries
+		entries     map[hst.ID]*hst.State
 		short, json bool
 		want        string
 	}{
-		{"no entries", make(state.Entries), false, false, "    Instance    PID    Application    Uptime\n"},
-		{"no entries short", make(state.Entries), true, false, ""},
-		{"nil instance", state.Entries{testID: nil}, false, false, "    Instance    PID    Application    Uptime\n"},
-		{"state corruption", state.Entries{state.ID{}: testState}, false, false, "    Instance    PID    Application    Uptime\n"},
+		{"no entries", make(map[hst.ID]*hst.State), false, false, "    Instance    PID    Application    Uptime\n"},
+		{"no entries short", make(map[hst.ID]*hst.State), true, false, ""},
+		{"nil instance", map[hst.ID]*hst.State{testID: nil}, false, false, "    Instance    PID    Application    Uptime\n"},
+		{"state corruption", map[hst.ID]*hst.State{hst.ID{}: testState}, false, false, "    Instance    PID    Application    Uptime\n"},
 
-		{"valid pd", state.Entries{testID: &state.State{ID: testID, PID: 1 << 8, Config: new(hst.Config), Time: testAppTime}}, false, false, `    Instance    PID    Application                 Uptime
+		{"valid pd", map[hst.ID]*hst.State{testID: {ID: testID, PID: 1 << 8, Config: new(hst.Config), Time: testAppTime}}, false, false, `    Instance    PID    Application                 Uptime
     8e2c76b0    256    0 (app.hakurei.8e2c76b0)    1h2m32s
 `},
 
-		{"valid", state.Entries{testID: testState}, false, false, `    Instance    PID           Application                  Uptime
+		{"valid", map[hst.ID]*hst.State{testID: testState}, false, false, `    Instance    PID           Application                  Uptime
     8e2c76b0    3735928559    9 (org.chromium.Chromium)    1h2m32s
 `},
-		{"valid short", state.Entries{testID: testState}, true, false, "8e2c76b0\n"},
-		{"valid json", state.Entries{testID: testState}, false, true, `{
+		{"valid short", map[hst.ID]*hst.State{testID: testState}, true, false, "8e2c76b0\n"},
+		{"valid json", map[hst.ID]*hst.State{testID: testState}, false, true, `{
   "8e2c76b066dabe574cf073bdb46eb5c1": {
-    "instance": [
-      142,
-      44,
-      118,
-      176,
-      102,
-      218,
-      190,
-      87,
-      76,
-      240,
-      115,
-      189,
-      180,
-      110,
-      181,
-      193
-    ],
+    "instance": "8e2c76b066dabe574cf073bdb46eb5c1",
     "pid": 3735928559,
     "config": {
       "id": "org.chromium.Chromium",
@@ -721,7 +687,7 @@ func TestPrintPs(t *testing.T) {
   }
 }
 `},
-		{"valid short json", state.Entries{testID: testState}, true, true, `["8e2c76b066dabe574cf073bdb46eb5c1"]
+		{"valid short json", map[hst.ID]*hst.State{testID: testState}, true, true, `["8e2c76b066dabe574cf073bdb46eb5c1"]
 `},
 	}
 
@@ -741,9 +707,9 @@ func TestPrintPs(t *testing.T) {
 }
 
 // stubStore implements [state.Store] and returns test samples via [state.Joiner].
-type stubStore state.Entries
+type stubStore map[hst.ID]*hst.State
 
-func (s stubStore) Join() (state.Entries, error)               { return state.Entries(s), nil }
+func (s stubStore) Join() (map[hst.ID]*hst.State, error)       { return s, nil }
 func (s stubStore) Do(int, func(c state.Cursor)) (bool, error) { panic("unreachable") }
 func (s stubStore) List() ([]int, error)                       { panic("unreachable") }
 func (s stubStore) Close() error                               { return nil }
diff --git a/hst/hst.go b/hst/hst.go
index 7fd7619c..bdff19f8 100644
--- a/hst/hst.go
+++ b/hst/hst.go
@@ -16,7 +16,7 @@ type AppError struct {
 	// A user-facing description of where the error occurred.
 	Step string `json:"step"`
 	// The underlying error value.
-	Err error
+	Err error `json:"err"`
 	// An arbitrary error message, overriding the return value of Message if not empty.
 	Msg string `json:"message,omitempty"`
 }
diff --git a/hst/instance.go b/hst/instance.go
new file mode 100644
index 00000000..5d15df6b
--- /dev/null
+++ b/hst/instance.go
@@ -0,0 +1,84 @@
+package hst
+
+import (
+	"crypto/rand"
+	"encoding/binary"
+	"encoding/hex"
+	"errors"
+	"fmt"
+	"time"
+)
+
+// An ID is a unique identifier held by a running hakurei container.
+type ID [16]byte
+
+// ErrIdentifierLength is returned when encountering a [hex] representation of [ID] with unexpected length.
+var ErrIdentifierLength = errors.New("identifier string has unexpected length")
+
+// IdentifierDecodeError is returned by [ID.UnmarshalText] to provide relevant error descriptions.
+type IdentifierDecodeError struct{ Err error }
+
+func (e IdentifierDecodeError) Unwrap() error { return e.Err }
+func (e IdentifierDecodeError) Error() string {
+	var invalidByteError hex.InvalidByteError
+	switch {
+	case errors.As(e.Err, &invalidByteError):
+		return fmt.Sprintf("got invalid byte %#U in identifier", rune(invalidByteError))
+	case errors.Is(e.Err, hex.ErrLength):
+		return "odd length identifier hex string"
+
+	default:
+		return e.Err.Error()
+	}
+}
+
+// String returns the [hex] string representation of [ID].
+func (a *ID) String() string { return hex.EncodeToString(a[:]) }
+
+// CreationTime returns the point in time [ID] was created.
+func (a *ID) CreationTime() time.Time {
+	return time.Unix(0, int64(binary.BigEndian.Uint64(a[:8]))).UTC()
+}
+
+// NewInstanceID creates a new unique [ID].
+func NewInstanceID(id *ID) error { return newInstanceID(id, uint64(time.Now().UnixNano())) }
+
+// newInstanceID creates a new unique [ID] with the specified timestamp.
+func newInstanceID(id *ID, p uint64) error {
+	binary.BigEndian.PutUint64(id[:8], p)
+	_, err := rand.Read(id[8:])
+	return err
+}
+
+// MarshalText encodes the [hex] representation of [ID].
+func (a *ID) MarshalText() (text []byte, err error) {
+	text = make([]byte, hex.EncodedLen(len(a)))
+	hex.Encode(text, a[:])
+	return
+}
+
+// UnmarshalText decodes a [hex] representation of [ID].
+func (a *ID) UnmarshalText(text []byte) error {
+	dl := hex.DecodedLen(len(text))
+	if dl != len(a) {
+		return IdentifierDecodeError{ErrIdentifierLength}
+	}
+	_, err := hex.Decode(a[:], text)
+	if err == nil {
+		return nil
+	}
+	return IdentifierDecodeError{err}
+}
+
+// A State describes a running hakurei container.
+type State struct {
+	// Unique instance id, created by [NewInstanceID].
+	ID ID `json:"instance"`
+	// Shim process pid. Runs as the target user.
+	PID int `json:"pid"`
+	// Configuration used to start the container.
+	Config *Config `json:"config"`
+
+	// Point in time the shim process was created.
+	Time time.Time `json:"time"`
+}
diff --git a/hst/instance_test.go b/hst/instance_test.go
new file mode 100644
index 00000000..5be9fc8b
--- /dev/null
+++ b/hst/instance_test.go
@@ -0,0 +1,113 @@
+package hst_test
+
+import (
+	"encoding/hex"
+	"errors"
+	"reflect"
+	"testing"
+	"time"
+	_ "unsafe"
+
+	"hakurei.app/hst"
+)
+
+//go:linkname newInstanceID hakurei.app/hst.newInstanceID
+func newInstanceID(id *hst.ID, p uint64) error
+
+func TestIdentifierDecodeError(t *testing.T) {
+	t.Parallel()
+
+	testCases := []struct {
+		name string
+		err  error
+		want string
+	}{
+		{"invalid byte", hst.IdentifierDecodeError{Err: hex.InvalidByteError(0)},
+			"got invalid byte U+0000 in identifier"},
+		{"odd length", hst.IdentifierDecodeError{Err: hex.ErrLength},
+			"odd length identifier hex string"},
+		{"passthrough", hst.IdentifierDecodeError{Err: hst.ErrIdentifierLength},
+			hst.ErrIdentifierLength.Error()},
+	}
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			if got := tc.err.Error(); got != tc.want {
+				t.Errorf("Error: %q, want %q", got, tc.want)
+			}
+		})
+	}
+
+	t.Run("unwrap", func(t *testing.T) {
+		t.Parallel()
+
+		err := hst.IdentifierDecodeError{Err: hst.ErrIdentifierLength}
+		if !errors.Is(err, hst.ErrIdentifierLength) {
+			t.Errorf("Is unexpected false")
+		}
+	})
+}
+
+func TestID(t *testing.T) {
+	t.Parallel()
+
+	var randomID hst.ID
+	if err := hst.NewInstanceID(&randomID); err != nil {
+		t.Fatalf("NewInstanceID: error = %v", err)
+	}
+
+	testCases := []struct {
+		name string
+		data string
+		want hst.ID
+		err  error
+	}{
+		{"bad length", "meow", hst.ID{},
+			hst.IdentifierDecodeError{Err: hst.ErrIdentifierLength}},
+		{"invalid byte", "02bc7f8936b2af6\x00\x00e2535cd71ef0bb7", hst.ID{},
+			hst.IdentifierDecodeError{Err: hex.InvalidByteError(0)}},
+
+		{"zero", "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", hst.ID{}, nil},
+		{"random", randomID.String(), randomID, nil},
+		{"sample", "ba21c9bd33d9d37917288281a2a0d239", hst.ID{
+			0xba, 0x21, 0xc9, 0xbd,
+			0x33, 0xd9, 0xd3, 0x79,
+			0x17, 0x28, 0x82, 0x81,
+			0xa2, 0xa0, 0xd2, 0x39}, nil},
+	}
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			var got hst.ID
+			if err := got.UnmarshalText([]byte(tc.data)); !reflect.DeepEqual(err, tc.err) {
+				t.Errorf("UnmarshalText: error = %#v, want %#v", err, tc.err)
+			}
+
+			if tc.err == nil {
+				if gotString := got.String(); gotString != tc.data {
+					t.Errorf("String: %q, want %q", gotString, tc.data)
+				}
+				if gotData, _ := got.MarshalText(); string(gotData) != tc.data {
+					t.Errorf("MarshalText: %q, want %q", string(gotData), tc.data)
+				}
+			}
+		})
+	}
+
+	t.Run("time", func(t *testing.T) {
+		t.Parallel()
+		var id hst.ID
+
+		now := time.Now()
+		if err := newInstanceID(&id, uint64(now.UnixNano())); err != nil {
+			t.Fatalf("newInstanceID: error = %v", err)
+		}
+
+		got := id.CreationTime()
+		if !got.Equal(now) {
+			t.Fatalf("CreationTime(%q): %s, want %s", id.String(), got, now)
+		}
+	})
+}
diff --git a/internal/app/app.go b/internal/app/app.go
index 4d9d2efe..03608517 100644
--- a/internal/app/app.go
+++ b/internal/app/app.go
@@ -7,15 +7,14 @@ import (
 	"os"
 
 	"hakurei.app/hst"
-	"hakurei.app/internal/app/state"
 	"hakurei.app/message"
 )
 
 // Main runs an app according to [hst.Config] and terminates. Main does not return.
 func Main(ctx context.Context, msg message.Msg, config *hst.Config) {
-	var id state.ID
-	if err := state.NewAppID(&id); err != nil {
-		log.Fatal(err)
+	var id hst.ID
+	if err := hst.NewInstanceID(&id); err != nil {
+		log.Fatal(err.Error())
 	}
 
 	seal := outcome{syscallDispatcher: direct{msg}}
diff --git a/internal/app/app_test.go b/internal/app/app_test.go
index b562f8ee..96113eb8 100644
--- a/internal/app/app_test.go
+++ b/internal/app/app_test.go
@@ -22,7 +22,6 @@ import (
 	"hakurei.app/container/fhs"
 	"hakurei.app/container/seccomp"
 	"hakurei.app/hst"
-	"hakurei.app/internal/app/state"
 	"hakurei.app/message"
 	"hakurei.app/system"
 	"hakurei.app/system/acl"
@@ -38,7 +37,7 @@ func TestApp(t *testing.T) {
 		name       string
 		k          syscallDispatcher
 		config     *hst.Config
-		id         state.ID
+		id         hst.ID
 		wantSys    *system.I
 		wantParams *container.Params
 	}{
@@ -212,7 +211,7 @@ func TestApp(t *testing.T) {
 			Args: []string{"/run/current-system/sw/bin/zsh"},
 
 			Flags: hst.FUserns | hst.FHostNet | hst.FHostAbstract | hst.FTty | hst.FShareRuntime | hst.FShareTmpdir,
-		}}, state.ID{
+		}}, hst.ID{
 			0x4a, 0x45, 0x0b, 0x65,
 			0x96, 0xd7, 0xbc, 0x15,
 			0xbd, 0x01, 0x78, 0x0e,
@@ -336,7 +335,7 @@ func TestApp(t *testing.T) {
 
 				Flags: hst.FUserns | hst.FHostNet | hst.FHostAbstract | hst.FTty | hst.FShareRuntime | hst.FShareTmpdir,
 			},
-		}, state.ID{
+		}, hst.ID{
 			0xeb, 0xf0, 0x83, 0xd1,
 			0xb1, 0x75, 0x91, 0x17,
 			0x82, 0xd4, 0x13, 0x36,
@@ -490,7 +489,7 @@ func TestApp(t *testing.T) {
 			DirectWayland: true,
 
 			Identity: 1, Groups: []string{},
-		}, state.ID{
+		}, hst.ID{
 			0x8e, 0x2c, 0x76, 0xb0,
 			0x66, 0xda, 0xbe, 0x57,
 			0x4c, 0xf0, 0x73, 0xbd,
diff --git a/internal/app/dispatcher_test.go b/internal/app/dispatcher_test.go
index a994d0b0..74f72b4b 100644
--- a/internal/app/dispatcher_test.go
+++ b/internal/app/dispatcher_test.go
@@ -21,7 +21,6 @@ import (
 	"hakurei.app/container/seccomp"
 	"hakurei.app/container/stub"
 	"hakurei.app/hst"
-	"hakurei.app/internal/app/state"
 	"hakurei.app/message"
 	"hakurei.app/system"
 )
@@ -49,7 +48,7 @@ const (
 )
 
 // checkExpectInstanceId is the [state.ID] value used by checkOpBehaviour to initialise outcomeState.
-var checkExpectInstanceId = *(*state.ID)(bytes.Repeat([]byte{0xaa}, len(state.ID{})))
+var checkExpectInstanceId = *(*hst.ID)(bytes.Repeat([]byte{0xaa}, len(hst.ID{})))
 
 type (
 	// pStateSysFunc is called before each test case is run to prepare outcomeStateSys.
diff --git a/internal/app/finalise.go b/internal/app/finalise.go
index 52a38faa..6cb4f586 100644
--- a/internal/app/finalise.go
+++ b/internal/app/finalise.go
@@ -9,7 +9,6 @@ import (
 	"sync/atomic"
 
 	"hakurei.app/hst"
-	"hakurei.app/internal/app/state"
 	"hakurei.app/message"
 	"hakurei.app/system"
 )
@@ -37,7 +36,7 @@ type outcome struct {
 	syscallDispatcher
 }
 
-func (k *outcome) finalise(ctx context.Context, msg message.Msg, id *state.ID, config *hst.Config) error {
+func (k *outcome) finalise(ctx context.Context, msg message.Msg, id *hst.ID, config *hst.Config) error {
 	if ctx == nil || id == nil {
 		// unreachable
 		panic("invalid call to finalise")
diff --git a/internal/app/outcome.go b/internal/app/outcome.go
index 30fd38ff..f462dfd5 100644
--- a/internal/app/outcome.go
+++ b/internal/app/outcome.go
@@ -8,7 +8,6 @@ import (
 	"hakurei.app/container"
 	"hakurei.app/container/check"
 	"hakurei.app/hst"
-	"hakurei.app/internal/app/state"
 	"hakurei.app/message"
 	"hakurei.app/system"
 	"hakurei.app/system/acl"
@@ -36,9 +35,9 @@ type outcomeState struct {
 	Shim *shimParams
 
 	// Generated and accounted for by the caller.
-	ID *state.ID
+	ID *hst.ID
 	// Copied from ID.
-	id *stringPair[state.ID]
+	id *stringPair[hst.ID]
 
 	// Copied from the [hst.Config] field of the same name.
 	Identity int
@@ -77,7 +76,7 @@ func (s *outcomeState) valid() bool {
 }
 
 // newOutcomeState returns the address of a new outcomeState with its exported fields populated via syscallDispatcher.
-func newOutcomeState(k syscallDispatcher, msg message.Msg, id *state.ID, config *hst.Config, hsu *Hsu) *outcomeState {
+func newOutcomeState(k syscallDispatcher, msg message.Msg, id *hst.ID, config *hst.Config, hsu *Hsu) *outcomeState {
 	s := outcomeState{
 		Shim:      &shimParams{PrivPID: k.getpid(), Verbose: msg.IsVerbose()},
 		ID:        id,
@@ -120,7 +119,7 @@ func (s *outcomeState) populateLocal(k syscallDispatcher, msg message.Msg) error
 	s.k = k
 	s.msg = msg
 
-	s.id = &stringPair[state.ID]{*s.ID, s.ID.String()}
+	s.id = &stringPair[hst.ID]{*s.ID, s.ID.String()}
 
 	s.Copy(&s.sc, s.UserID)
 	msg.Verbosef("process share directory at %q, runtime directory at %q", s.sc.SharePath, s.sc.RunDirPath)
diff --git a/internal/app/outcome_test.go b/internal/app/outcome_test.go
index 53c8958d..740e7db5 100644
--- a/internal/app/outcome_test.go
+++ b/internal/app/outcome_test.go
@@ -4,7 +4,6 @@ import (
 	"testing"
 
 	"hakurei.app/hst"
-	"hakurei.app/internal/app/state"
 )
 
 func TestOutcomeStateValid(t *testing.T) {
@@ -19,9 +18,9 @@ func TestOutcomeStateValid(t *testing.T) {
 		{"zero", new(outcomeState), false},
 		{"shim", &outcomeState{Shim: &shimParams{PrivPID: -1, Ops: []outcomeOp{}}, Container: new(hst.ContainerConfig), EnvPaths: new(EnvPaths)}, false},
 		{"id", &outcomeState{Shim: &shimParams{PrivPID: 1, Ops: []outcomeOp{}}, Container: new(hst.ContainerConfig), EnvPaths: new(EnvPaths)}, false},
-		{"container", &outcomeState{Shim: &shimParams{PrivPID: 1, Ops: []outcomeOp{}}, ID: new(state.ID), EnvPaths: new(EnvPaths)}, false},
-		{"envpaths", &outcomeState{Shim: &shimParams{PrivPID: 1, Ops: []outcomeOp{}}, ID: new(state.ID), Container: new(hst.ContainerConfig)}, false},
-		{"valid", &outcomeState{Shim: &shimParams{PrivPID: 1, Ops: []outcomeOp{}}, ID: new(state.ID), Container: new(hst.ContainerConfig), EnvPaths: new(EnvPaths)}, true},
+		{"container", &outcomeState{Shim: &shimParams{PrivPID: 1, Ops: []outcomeOp{}}, ID: new(hst.ID), EnvPaths: new(EnvPaths)}, false},
+		{"envpaths", &outcomeState{Shim: &shimParams{PrivPID: 1, Ops: []outcomeOp{}}, ID: new(hst.ID), Container: new(hst.ContainerConfig)}, false},
+		{"valid", &outcomeState{Shim: &shimParams{PrivPID: 1, Ops: []outcomeOp{}}, ID: new(hst.ID), Container: new(hst.ContainerConfig), EnvPaths: new(EnvPaths)}, true},
 	}
 	for _, tc := range testCases {
 		t.Run(tc.name, func(t *testing.T) {
diff --git a/internal/app/process.go b/internal/app/process.go
index 0962e212..f71479bc 100644
--- a/internal/app/process.go
+++ b/internal/app/process.go
@@ -289,7 +289,7 @@ func (k *outcome) main(msg message.Msg) {
 
 	// shim accepted setup payload, create process state
 	if ok, err := ms.store.Do(k.state.identity.unwrap(), func(c state.Cursor) {
-		if err := c.Save(&state.State{
+		if err := c.Save(&hst.State{
 			ID:     k.state.id.unwrap(),
 			PID:    ms.cmd.Process.Pid,
 			Config: k.config,
diff --git a/internal/app/state/id.go b/internal/app/state/id.go
deleted file mode 100644
index 11bbc3fe..00000000
--- a/internal/app/state/id.go
+++ /dev/null
@@ -1,48 +0,0 @@
-package state
-
-import (
-	"crypto/rand"
-	"encoding/hex"
-	"errors"
-	"fmt"
-)
-
-type ID [16]byte
-
-var (
-	ErrInvalidLength = errors.New("string representation must have a length of 32")
-)
-
-func (a *ID) String() string {
-	return hex.EncodeToString(a[:])
-}
-
-func NewAppID(id *ID) error {
-	_, err := rand.Read(id[:])
-	return err
-}
-
-func ParseAppID(id *ID, s string) error {
-	if len(s) != 32 {
-		return ErrInvalidLength
-	}
-
-	for i, b := range s {
-		if b < '0' || b > 'f' {
-			return fmt.Errorf("invalid char %q at byte %d", b, i)
-		}
-
-		v := uint8(b)
-		if v > '9' {
-			v = 10 + v - 'a'
-		} else {
-			v -= '0'
-		}
-		if i%2 == 0 {
-			v <<= 4
-		}
-		id[i/2] += v
-	}
-
-	return nil
-}
diff --git a/internal/app/state/id_test.go b/internal/app/state/id_test.go
deleted file mode 100644
index abf2c190..00000000
--- a/internal/app/state/id_test.go
+++ /dev/null
@@ -1,63 +0,0 @@
-package state_test
-
-import (
-	"errors"
-	"testing"
-
-	"hakurei.app/internal/app/state"
-)
-
-func TestParseAppID(t *testing.T) {
-	t.Run("bad length", func(t *testing.T) {
-		if err := state.ParseAppID(new(state.ID), "meow"); !errors.Is(err, state.ErrInvalidLength) {
-			t.Errorf("ParseAppID: error = %v, wantErr =  %v", err, state.ErrInvalidLength)
-		}
-	})
-
-	t.Run("bad byte", func(t *testing.T) {
-		wantErr := "invalid char '\\n' at byte 15"
-		if err := state.ParseAppID(new(state.ID), "02bc7f8936b2af6\n\ne2535cd71ef0bb7"); err == nil || err.Error() != wantErr {
-			t.Errorf("ParseAppID: error = %v, wantErr =  %v", err, wantErr)
-		}
-	})
-
-	t.Run("fuzz 16 iterations", func(t *testing.T) {
-		for i := 0; i < 16; i++ {
-			testParseAppIDWithRandom(t)
-		}
-	})
-}
-
-func FuzzParseAppID(f *testing.F) {
-	for i := 0; i < 16; i++ {
-		id := new(state.ID)
-		if err := state.NewAppID(id); err != nil {
-			panic(err.Error())
-		}
-		f.Add(id[0], id[1], id[2], id[3], id[4], id[5], id[6], id[7], id[8], id[9], id[10], id[11], id[12], id[13], id[14], id[15])
-	}
-
-	f.Fuzz(func(t *testing.T, b0, b1, b2, b3, b4, b5, b6, b7, b8, b9, b10, b11, b12, b13, b14, b15 byte) {
-		testParseAppID(t, &state.ID{b0, b1, b2, b3, b4, b5, b6, b7, b8, b9, b10, b11, b12, b13, b14, b15})
-	})
-}
-
-func testParseAppIDWithRandom(t *testing.T) {
-	id := new(state.ID)
-	if err := state.NewAppID(id); err != nil {
-		t.Fatalf("cannot generate app ID: %v", err)
-	}
-	testParseAppID(t, id)
-}
-
-func testParseAppID(t *testing.T, id *state.ID) {
-	s := id.String()
-	got := new(state.ID)
-	if err := state.ParseAppID(got, s); err != nil {
-		t.Fatalf("cannot parse app ID: %v", err)
-	}
-
-	if *got != *id {
-		t.Fatalf("ParseAppID(%#v) = \n%#v, want \n%#v", s, got, id)
-	}
-}
diff --git a/internal/app/state/join.go b/internal/app/state/join.go
index 2b4011fe..43a19b1d 100644
--- a/internal/app/state/join.go
+++ b/internal/app/state/join.go
@@ -3,6 +3,8 @@ package state
 import (
 	"errors"
 	"maps"
+
+	"hakurei.app/hst"
 )
 
 var (
@@ -14,20 +16,22 @@ Joiner is the interface that wraps the Join method.
 
 The Join function uses Joiner if available.
 */
-type Joiner interface{ Join() (Entries, error) }
+type Joiner interface {
+	Join() (map[hst.ID]*hst.State, error)
+}
 
-// Join returns joined state entries of all active aids.
-func Join(s Store) (Entries, error) {
+// Join returns joined state entries of all active identities.
+func Join(s Store) (map[hst.ID]*hst.State, error) {
 	if j, ok := s.(Joiner); ok {
 		return j.Join()
 	}
 
 	var (
 		aids    []int
-		entries = make(Entries)
+		entries = make(map[hst.ID]*hst.State)
 
 		el      int
-		res     Entries
+		res     map[hst.ID]*hst.State
 		loadErr error
 	)
 
diff --git a/internal/app/state/multi.go b/internal/app/state/multi.go
index ca608f58..c15b8534 100644
--- a/internal/app/state/multi.go
+++ b/internal/app/state/multi.go
@@ -131,7 +131,7 @@ type multiBackend struct {
 	mu sync.RWMutex
 }
 
-func (b *multiBackend) filename(id *ID) string { return path.Join(b.path, id.String()) }
+func (b *multiBackend) filename(id *hst.ID) string { return path.Join(b.path, id.String()) }
 
 func (b *multiBackend) lockFileAct(lt int) (err error) {
 	op := "LockAct"
@@ -163,7 +163,7 @@ func (b *multiBackend) unlockFile() error { return b.lockFileAct(syscall.LOCK_UN
 
 // reads all launchers in simpleBackend
 // file contents are ignored if decode is false
-func (b *multiBackend) load(decode bool) (Entries, error) {
+func (b *multiBackend) load(decode bool) (map[hst.ID]*hst.State, error) {
 	b.mu.RLock()
 	defer b.mu.RUnlock()
 
@@ -177,15 +177,15 @@ func (b *multiBackend) load(decode bool) (Entries, error) {
 
 	// allocate as if every entry is valid
 	// since that should be the case assuming no external interference happens
-	r := make(Entries, len(entries))
+	r := make(map[hst.ID]*hst.State, len(entries))
 
 	for _, e := range entries {
 		if e.IsDir() {
 			return nil, fmt.Errorf("unexpected directory %q in store", e.Name())
 		}
 
-		var id ID
-		if err := ParseAppID(&id, e.Name()); err != nil {
+		var id hst.ID
+		if err := id.UnmarshalText([]byte(e.Name())); err != nil {
 			return nil, &hst.AppError{Step: "parse state key", Err: err}
 		}
 
@@ -195,7 +195,7 @@ func (b *multiBackend) load(decode bool) (Entries, error) {
 			if f, err := os.Open(path.Join(b.path, e.Name())); err != nil {
 				return &hst.AppError{Step: "open state file", Err: err}
 			} else {
-				var s State
+				var s hst.State
 				r[id] = &s
 
 				// append regardless, but only parse if required, implements Len
@@ -226,7 +226,7 @@ func (b *multiBackend) load(decode bool) (Entries, error) {
 }
 
 // Save writes process state to filesystem
-func (b *multiBackend) Save(state *State) error {
+func (b *multiBackend) Save(state *hst.State) error {
 	b.mu.Lock()
 	defer b.mu.Unlock()
 
@@ -247,7 +247,7 @@ func (b *multiBackend) Save(state *State) error {
 	return nil
 }
 
-func (b *multiBackend) Destroy(id ID) error {
+func (b *multiBackend) Destroy(id hst.ID) error {
 	b.mu.Lock()
 	defer b.mu.Unlock()
 
@@ -257,7 +257,7 @@ func (b *multiBackend) Destroy(id ID) error {
 	return nil
 }
 
-func (b *multiBackend) Load() (Entries, error) { return b.load(true) }
+func (b *multiBackend) Load() (map[hst.ID]*hst.State, error) { return b.load(true) }
 
 func (b *multiBackend) Len() (int, error) {
 	// rn consists of only nil entries but has the correct length
diff --git a/internal/app/state/state.go b/internal/app/state/state.go
index b8d8d255..ef783bfb 100644
--- a/internal/app/state/state.go
+++ b/internal/app/state/state.go
@@ -3,7 +3,6 @@ package state
 
 import (
 	"errors"
-	"time"
 
 	"hakurei.app/hst"
 )
@@ -11,8 +10,6 @@ import (
 // ErrNoConfig is returned by [Cursor] when used with a nil [hst.Config].
 var ErrNoConfig = errors.New("state does not contain config")
 
-type Entries map[ID]*State
-
 type Store interface {
 	// Do calls f exactly once and ensures store exclusivity until f returns.
 	// Returns whether f is called and any errors during the locking process.
@@ -29,21 +26,8 @@ type Store interface {
 
 // Cursor provides access to the store of an identity.
 type Cursor interface {
-	Save(state *State) error
-	Destroy(id ID) error
-	Load() (Entries, error)
+	Save(state *hst.State) error
+	Destroy(id hst.ID) error
+	Load() (map[hst.ID]*hst.State, error)
 	Len() (int, error)
 }
-
-// State is the on-disk state of a container instance.
-type State struct {
-	// Unique instance id, generated by internal/app.
-	ID ID `json:"instance"`
-	// Shim process pid. This runs as the target user.
-	PID int `json:"pid"`
-	// Configuration value used to start the container.
-	Config *hst.Config `json:"config"`
-
-	// Exact point in time that the shim process was created.
-	Time time.Time `json:"time"`
-}
diff --git a/internal/app/state/state_test.go b/internal/app/state/state_test.go
index baada60d..2e191f31 100644
--- a/internal/app/state/state_test.go
+++ b/internal/app/state/state_test.go
@@ -28,7 +28,7 @@ func testStore(t *testing.T, s state.Store) {
 		tl
 	)
 
-	var tc [tl]state.State
+	var tc [tl]hst.State
 	for i := 0; i < tl; i++ {
 		makeState(t, &tc[i])
 	}
@@ -122,8 +122,8 @@ func testStore(t *testing.T, s state.Store) {
 	})
 }
 
-func makeState(t *testing.T, s *state.State) {
-	if err := state.NewAppID(&s.ID); err != nil {
+func makeState(t *testing.T, s *hst.State) {
+	if err := hst.NewInstanceID(&s.ID); err != nil {
 		t.Fatalf("cannot create dummy state: %v", err)
 	}
 	s.PID = rand.Int()