Rename design r2, "Selector scopes and parser matrix". case2-persona-import.mjs takes --org
through selectorScope and case2-precheck.sh through scripts/selector.sh, one scope each. Both
keep their exit codes and their old business-id wording; a repeated or conflicting selector
says why. persona-import now checks the id while parsing, so stage refuses an invalid
selector before it reads anything.
The case2-install fake stack copy carries packages/business/src/selector.mjs, which the real
copy already does (COPY_PATHS takes packages/business/src).
cli.mjs serve and webui-service.sh each take --org as --business in their own
scope through the shared selector rules; the service unit still carries the
canonical --business. A flag-shaped or invalid value keeps each script's old
wording and exit code; a repeated or conflicting selector is a usage error.
Rename design r2, "Selector scopes and parser matrix". packages/business/src/selector.mjs
and scripts/selector.sh carry one rule set: in a parser's scope each spelling appears once,
and a second spelling must carry exactly the same value; a repeated spelling, a missing or
flag-shaped value, an invalid id and unequal values refuse. The file family
(--business-file/--org-file) compares paths as given.
Every CLI parser that took --business now takes --org through orgSelector, and the old
global --org rewrite in main() is gone, so a value another option consumes is never read as
a selector. The id is checked while parsing (OrgError org-invalid, exit 3), so grants admin
set no longer reads the token and proxy init no longer prompts for the key before an
invalid id refuses. access gains the same local id check.
F1: the org list shows a broken org as invalid only when the failure
came after the owner check passed (ownerVerified). A broken root or
marker on someone else's org stays hidden.
F2: /api/orgs answers a registry read failure with a fixed message.
The parser text could quote private registry bytes.
F3: selected-org pages keep the list error, paint one replaceable
header banner, and Retry always re-reads the list. The Board shows the
registry message once.
New tests org-list-privacy and org-list-refresh-browser fail on
0e9b2c505 for F1, F2 and F3 and pass here. Serial batch over all 134
webui files plus business org-* and cli org: only failures were the
known pinned-copy EISDIR (8) and an org-switch assertion on the old
pass-through text, updated here.
#867: organization reads no longer take the registry writer lock; they
retry while the lock exists or the registry changed during the read.
#868: a broken organization is listed as invalid with a path-masked
reason instead of disappearing; the Board, header and picker show it,
and /api/orgs 503 carries the reason. Orgs the principal may not see and
archived orgs still give an empty list.
#869: a Console with no board says "No board", not "Board: null".
#866 (save-path validation at bus admission) is left out: it refused
documents the bus accepted before and needs a migration story first.
Every bus, business, cli and webui file run serially; failures are only
the known EISDIR node_modules-link files.
serve.mjs keeps the bound address as well as the port, so the settings,
queue and business routes answer a request that arrives after close().
browser.mjs keeps an exited leader's group tracked until it is killed at
exit, and close() signals the group only while the leader is alive. The
late-request test is event-based with one owned timeout. New test: the
chromium group dies when the main process dies and close() never runs.
Webui browser and server files (92, pinned-copy excluded): 741 pass, 0 fail.
- serve.mjs read server.address().port in the Host checks. Once close() starts that is
null, so a request on a kept-alive connection threw and was never answered, and the test
file waited forever. The bound port is now stored on 'listening'.
- Killing only chromium's main process left its renderer and GPU children writing into the
profile, so the profile rm failed with ENOTEMPTY. Chromium now runs in its own process
group; close() and the exit hook kill the group, and the rm retries.
- teardown.test.mjs: a request sent after close() starts gets a 200.
- A Console is stale only when its pid is gone or its start time differs. A live Console
started from another entry path is never quarantined; stop refuses to signal it and
names the path it was started from.
- The lock-clear fence records the clearer's pid and start time. A fence left by a dead
clearer is moved aside and recovery continues; a live or unreadable fence refuses.
lock show reports a fence.
- Console state is moved aside with one atomic rename after an inode re-check.
Combined node --test runs hung in the org browser files. Two causes:
- org-quick: a page's GET /api/config reached the server on a
kept-alive connection after close(server) had stopped the listener.
The handler threw on server.address().port, the request was never
answered, and server.close() waited for it forever. close() in
fixture.mjs now cuts every connection and fails the hook after 5 s
with a message.
- org-delete: t.after hooks run in registration order, so the data
directory was removed while the server still wrote there. The rm
failed with ENOTEMPTY, node:test skipped the later hooks, and the
open server and chromium kept the file running. The three org files
and project-archive-style now register the removal last.
browser.mjs: close() kills a browser that does not answer
Browser.close within 5 s, a call to an exited browser fails at once,
and an unclosed chromium no longer holds the event loop and is killed
when the test process exits.
teardown.test.mjs reproduces each case: 0/4 pass on the old helpers,
4/4 on the new ones.
console start and stop move a console.json whose recorded process is gone
aside instead of refusing (P19 #857). mosaic org lock show|clear reports a
lifecycle lock holder and clears it only when the holder is dead.
mosaic bus recover marks a bus host stopped when its process is gone and its
socket does not answer, and writes a recovery receipt (P19 #862).
mosaic org delete ID --confirm ID --if-revision N, and POST /api/orgs/:id/delete,
mark the organization as deleting, stop its bus, move its files into
<dataRoot>/deleted/<ID>-<stamp>/ with a receipt, then drop it from the registry
and append deleted.log. A failure stops at its step and a rerun resumes. Bus
start refuses an organization that is being deleted. The settings page asks
twice: a panel that lists the effects, then typing the ID before Delete
permanently is enabled. Purge and remote revocation are follow-ups.
Quick Setup made organization code import the plug-in loader, which loads
packages/plugins/<kind>/<name>/index.mjs by a computed path. The scanner now
allows exactly that form in the loader file and still refuses it anywhere else.
A 200 or 201 with a body that does not name the expected step as done now
stops at that step as an unknown outcome, with no further writes. Starting a
new draft re-enables the preset, thinking and run controls and clears the
risk checkbox. Browser regression covers both (Sol review P1, P2).
The dev fixture guard was instance-wide: once a fixture record existed,
every organization's bus start refused when a provider credential was in
the environment. One instance could not hold a fixture organization and a
real-model organization side by side.
Bus start now reads the organization file. An organization that does not
route a launch to the fixture launches as configured. A fixture
organization's launch environment drops provider credentials before the
guard runs.
Settings marked every page except appearance and business read only when
send was off. Organization mode always turns send off, so the read-only
style hid New organization and Save organization. Organizations now stays
writable when the server allows org setup. The browser test asserts both
buttons are visible, not only clickable.
jason.woltje