${esc(x)}
`).join("") + `${esc(SIG)}
`; +const TASKS = [ + { title: "Launcher recover() releases a role before its killed session is gone (row 91 finding)", + description: p("Darkwing found this building row 91 (Gitea #1585, build.md, Found, not fixed). recover() in packages/cli/src/launcher.mjs ends a leftover run and releases its role 5 s after SIGKILL even when the process has not exited. Row 91 relies on registry.running for decision 126's rule that no host git runs while a session holds the workspace, so a relaunch of that instance could reach ensureCheckouts while the old process still writes the clone.", + "Fix: release only after the process (and any sandbox descendants) is confirmed gone, or keep the role held and refuse the relaunch with a named reason. Test it with a stand-in process that ignores the first signal window.", + "Decision 128: not a blocker for row 91, because the window needs a bus start with a leftover session whose SIGKILL has not taken effect in 5 s. Needs a queue row and brief; it should land before row 91's clone is used by sessions in daily work. Touches packages/cli, so decision 109's notice to Mos applies.") }, +]; +const key = readFileSync(KEY, "utf8").trim(), sync = readFileSync(SYNC, "utf8").trim(); +async function api(method, path, body, auth) { + const r = await fetch(ORIGIN + path, { method, headers: { Authorization: `Bearer ${auth}`, "Content-Type": "application/json" }, body: body === undefined ? undefined : JSON.stringify(body), redirect: "error" }); + const t = await r.text(); let json = null; try { json = JSON.parse(t); } catch {} + return { status: r.status, json }; +} +const list = (j) => j?.items ?? (Array.isArray(j) ? j : []); +async function existing() { + const out = []; + for (let page = 1; page < 20; page++) { + const r = await api("GET", `/api/v2/projects/${PROJECT}/tasks?per_page=50&page=${page}`, undefined, sync); + if (r.status !== 200) throw new Error(`list tasks: ${r.status}`); + out.push(...list(r.json)); + if (list(r.json).length < 50) return out; + } + throw new Error("more than 19 pages"); +} +const rec = { at: new Date().toISOString(), project: PROJECT, created: [], problems: [] }; +const save = () => { + const out = JSON.stringify(rec, null, 1) + "\n"; + if (out.includes(key) || out.includes(sync)) throw new Error("secret in the record; not written"); + writeFileSync(OUT, out); +}; +const before = await existing(); +const clash = before.filter((t) => TASKS.some((x) => x.title === t.title)); +if (clash.length) throw new Error(`exists: ${clash.map((t) => `#${t.id} ${t.title}`).join("; ")}; refusing`); +writeFileSync(OUT, "", { flag: "wx" }); + +for (const t of TASKS) { + rec.created.push({ title: t.title }); + save(); + const body = { title: t.title, description: t.description, ...(t.due ? { due_date: t.due } : {}) }; + const r = await api("PUT", `/api/v1/projects/${PROJECT}/tasks`, body, key); + if (r.status >= 300 || !Number.isSafeInteger(r.json?.id)) { + rec.problems.push(`create ${t.title}: ${r.status} ${r.json?.code ?? ""} ${r.json?.message ?? ""}`); + break; + } + Object.assign(rec.created.at(-1), { id: r.json.id, index: r.json.index, inverse: `mark done: POST /api/v1/tasks/${r.json.id} done true (pm); delete is Jason's or ops-01's` }); + const back = await api("GET", `/api/v2/tasks/${r.json.id}`, undefined, sync); + Object.assign(rec.created.at(-1), { readBack: back.status, project_back: back.json?.project_id, due_back: back.json?.due_date, done: back.json?.done }); + if (back.status !== 200 || back.json?.title !== t.title || back.json?.project_id !== PROJECT || back.json?.done) rec.problems.push(`${t.title} read-back differs`); +} +save(); +process.stdout.write(JSON.stringify(rec, null, 1) + "\n"); +if (rec.problems.length) process.exit(2); diff --git a/docs/plans/2026-09-26_lead-decisions.md b/docs/plans/2026-09-26_lead-decisions.md index 2a32cf771..71c91dc86 100644 --- a/docs/plans/2026-09-26_lead-decisions.md +++ b/docs/plans/2026-09-26_lead-decisions.md @@ -2857,3 +2857,25 @@ which stay with him. Each item names who decided it and what happened. between changed what a file's imports are allowed to load. - Harness runs on the 21-path candidate in Filbert's review and in Sage's landing gate, not in a separate Dewey slot. + +128. **The launcher's recover() gap is a follow-up, not a row 91 blocker + (2026-10-12).** Darkwing found it building row 91 (build.md, "Found, + not fixed"). `recover()` in `packages/cli/src/launcher.mjs` sends + SIGKILL to a leftover bwrap session, waits up to 5 s, then binds and + ends the run whether or not the process is gone. Ending the run + releases the role, so `registry.running` no longer refuses + `instance-running`, and a launch of that instance could reach + `ensureCheckouts` while the old process still writes the clone. + That is the check-then-use gap decision 126 closed for live sessions. + - Not a blocker for row 91: it needs a bus start that finds a leftover + session whose SIGKILL hasn't taken effect within 5 s (a process + stuck in uninterruptible sleep, for one). Row 91 doesn't widen it. + - Filed as Vikunja #244 (P19). The fix releases the role only once the + process is confirmed gone, or keeps it held and refuses the relaunch + with a named reason, tested with a stand-in that outlives the window. + It gets a queue row and brief before sessions use row 91's clone in + daily work. It touches `packages/cli`, so decision 109's notice to + Mos applies. + - Filbert's row 91 review says whether the session-live guard depends + on anything else that assumes the role release means the process is + gone.