Sidebar offers ended sessions as detached #168
Closed
opened 2026-10-11 15:45:04 +00:00 by kayg
·
93 comments
No Branch/Tag specified
main
j470b-server-mesh-rejoin
mesh-compat-382
j444b-d381-key-wins-flood
j461b-macos-utun-reader-thread
j475b-remove-host-motion
fix-reconnect-new-link
j481-d380
dev
j479-mesh-soak
fix/j476-host-facts
j475-motion-pill-split
j470-mac-node-join
root-upgrade-d376
j474-review-merge
latency-targets-120hz
nightly-suite-shards
gotatun-pin-j469
macos-utun-reader-thread
fix-flood-echo-stall
wip/j416
motion-fast-ease-out
mesh-addhost-j259
takeover-close-terminals-d368
kbd-instant-followups
fix-trust-key-double-click
nightly-suite-partial-report
appwin-icons-j207
rusqlite-slice1
swipe-content-first-d374
mesh-mtu-381
addhost-instant-open
glass-contrast-d365-mock
glass-contrast-d365
signout-followups-442
fix-startup-toast-red
research-gotatun-matrix-j317
themes-sync-j304
fix-load-flakes
fix-nix-zig-patch
fix-compute01-browser-baseline
ratchet-size-baseline-419
predict-auto-d130
revoke-coverage-d367
nightly-suite-queue-timeout
nightly-browser-suite
fix-rustsec-2026-0459
fonts-ioskeley-obel
log-retention-d375
fix-kbd-no-anim-427
fix-dev-red-specs-2
takeover-proof-305-j205
wip/j410-server-pump
ui-consistency-d372
fix-osc52-clipboard
libghostty-vt-1.0
forget-retired-host-d369
j404-merge-426
fix-setup-lock-race
fix-touch-select-426
revoke-access-report-ui
fix-predictive-echo-specs
fix-selinux-agent-exec
wip/j395-checkpoint2
wip/j395
j391-review-scratch
ui-consistency-j195-deferred-rebased
fix-rustc-paths-421
decisions-wording-341
fix-install-suite-red
fix-dev-rtt-specs
fix-pending-removal-align
fix-privileged-skip
fix-install-suite-404
review-j368
mesh-dns-j254
revoke-access-report-d356b
revoke-privilege-round5
fix-removal-confirm
review-j360
gotatun-rotation-367
deps-refresh-340
review-j354
review-J351
review-j350
addhost-takeover-d359
revoke-report-items-347
revoke-end-sessions-d362
review-j348
size-mesh-ssh-346
size-trim-337
revoke-access-diff-d356
j259-pre-rebase-b06c5a6
j305-ended-at-start-spec
addhost-sudo-consent
fix-layout-real-specs-411
fix-shell-open-411
fix-console-hosts-373
fix-shell-exit
fuzz-host-name-353
fix-host-details-410
macos-filter-j197
research-gotatun-tricks
revoke-p3-j216l
stale-state-pill
revoke-followups-j216k
revoke-progress-j216e
backup/macos01-20261106/lume/j197
backup/macos01-20261106/lume/appwin-icons-j207-stash0
backup/macos01-20261106/claude/stash-0
backup/macos01-20261106/claude/stash-1
backup/macos01-20261106/claude/J80-macos-s1
backup/macos01-20261106/claude/J80
backup/macos01-20261106/claude/J80-slice1-20261102
backup/macos01-20261106/claude/J16b-appwin-on-dev
backup/macos01-20261106/claude/appwin-launch-idle-146
backup/macos01-20261106/claude/J80-s1-run
wip/j259
trust-285-p3c
runtime-lock-j216f
mesh-ssh-p3-j175
tun-proof-p3b
trust-285-p3
terminal-polish-j271
tun-proof-p3
ssh-install-flakes-j216i
fuzz-fixes-j264
trust-285-a
trust-285-b
restart-oversized-fixture-j198
backup/macos01-20261106/lume/appwin-icons-j207
restart-bound-j216h
up-preflight-p3-j198
backup/macos01-20261106/lume/j251
up-preflight-j198
wip/up-preflight-j198-j245-p2
wip/up-preflight-j198-j245-p1
agent-fsync-offloop-j196
wip/up-preflight-j198-j245
settings-offscreen-j231
wip/up-preflight-j198-j226-inspection
wip/j103f
themes-j206
wip/up-preflight-j198-j226
flakes-j216c
backup/macos01-20261106/claude/j197
flakes-j216b
backup/macos01-20261106/claude/j197-red
wip/up-preflight-j198-review
flakes-j216
backup/macos01-20261106/claude/appwin-icons-j207
engineering-j208b
appwin-mock-j209
toast-stack-j165
engineering-j208
decisions-d351
decisions-d350
decisions-d349
appearance-presets-mock-j129
decisions-d348
docs-audit-spec
doc-coverage-baseline-raise
decisions-d347
decisions-d346b
decisions-d346
j88h-profile
ui-consistency-j195-deferred
ui-consistency-j195
engineering-practices-j194
preferred-login-ui-j166
signin-pools-263-j174
macos-node-265-s1
decisions-d345
decisions-d344
proxy-cgroup-j164
verify-quick-fuzz-329
proxy-start-io-j168
timing-flakes-j163
up-263-s1
mcp-events-j147
verify-quick-fuzz-j158
proxy-p3-j159
agent-resource-j157-detect
wip/j103d-final
remote-cancel-hang-j155
proxy-traefik-281-j62d
j149-verify-quick
proxy-traefik-281-j62b
j150-drop-unnamed
wip/j79d-red-r4
wip/j103d-d332
rootless-toast-j142
wip/j103d-head
wip/j103d
j125c-mcp
macos-build-j136
backup/macos01-20261106/claude/j136
wip/j79d-red-cli
wip/j79d-red-server
j121-link-liveness
j118c-tracer-failures
wip/j79c-head
release-desktop-j131
j124c-signed-macos
wip/j79c-red-p3
wip/j79c-red-p23
wip/j79c-red-p22
merge-j128-check
perf-deferred-j128
sidebar-toggle-260
j127-shortcut-changed-dot
j125-mcp
j118-tracer-failures
j126-account-summary
settings-sections-mock-j92
j120-pinch-lock
sidebar-292
backup/macos01-20261106/claude/j120
taste-2026-11-03
row-actions-242-215
backup/macos01-20261106/claude/stash-0-untracked
backup/macos01-20261106/claude/J80-265-s1-run
backup/macos01-20261106/claude/J80-macos-s1-20261102
j112-canvas-commands
ui-no-overshoot-scroll
fix-recovery-restart
backup/macos01-20261106/claude/stash-1-untracked
taste-2026-11-02
size-baseline-ratchet
machine-cards-structure-j108
j109-boot-copy-mockups
fix-dev-red
wip/up-263-s1
j95b-settings-rows
proxy-traefik-281
j95-option-rows
docs-human-j91
docs-keys-palette
fix-flood-1013-270-j38d
mesh-ssh-s1
mesh-ssh-s0
addhost-d291-tunnel
test-stability-load
mesh-relay-220
repro-296
shim-thp-off-24
mesh-pins-258-v2
mesh-dns
signin-d311-merged
docs-pages
ui-size-283
fix-ui-batch-specs
wip/j12b-edge-update
gate-on-arm
fix-rename-sync-293
trust-285-j60b
fix-focus-ring-clip
integ-ui-1101
edge-update-v2
signin-d311
taste-2026-11-01
layout-per-tab-250
ui-approved-splitopt-224
ui-approved-splitopt-224-on-dev
icon-text-centre-282
ui-approved-189-212-216
research-reverse-proxy
transfer-budget-320
review-mesh-pins-258-r2
sidebar-pill-259
review-mesh-relay-220
wip/j12-edge-update-v2
nix-package
status-crash-loop-237
fix-dev-test-failures
fix-fixture-socket-path
wip/mesh-relay-220-pre-dev-advance-rebase
fix-canvas-side-clip
research-head-to-head
frosted-real-256
review-mesh-pins-258
wip/mesh-relay-220-pre-final-rebase
review-layout-per-tab-250-r2
broad-suite-triage
nix-devshell
review-status-crash-loop-237-r3
wip/nix-devshell-pre-p3
taste-frosted-real
wip/code-serve-demo-2026-10-30
wip/code-serve-glass-2026-10-30
wip/code-serve-clusters-2026-10-30
wip/code-merge-release94-dev-2026-10-30
wip/rproxy-delta-scratch-2026-10-30
wip/stale-note-257-staged-2026-10-30
wip/d241-size-staged-2026-10-30
review-broad-suite-207
wip/mesh-pins-258-pre-split
wip/mesh-relay-220-pre-rebase
mesh-measure-220
plan-211-update
review-edge-autoupdate-r3
perf24-reconnect
review-stale-note-r2
release-prod-live
d241-shell-marker
review-mesh-pins-server-258
review-revocation-r3
review-setup-token-r2
review-sync-journal-r3
wip/review-mesh-pins-258-prune-review-1995fee46
frosted-scroll-256
sync-journal-r3
revocation-per-account-wip
review-tokio-asyncfd-0386
review-sync-p3s
wip/stash-8by64-stash0-2026-10-30
mesh-drag-r2
setup-token-data-wip
release-9-4
auth-busy-1013
mesh-view-overlap
sync-p3s
review-auth-busy-wake
review-readd-r8-wip
mesh-drag-bounds
audit-auth-93
app-windows-stream-start
review-authority-cap-r3
app-windows-r7-measure
readd-minimal-r6
readd-minimal-r5
app-windows-r7-soak
readd-minimal-r4
app-windows-r7
app-windows-r6
readd-minimal-r3
readd-minimal-r2
readd-minimal
merge-release8-dev
review-busy-page-liveness-r2
review-busy-page-liveness
mesh-view-trim
review-authority-read-retry-r2
review-remove-uninstall-r2
release-retry-reattach
release-retry
review-remove-uninstall
review-authority-read-retry
app-windows-ship
mesh-autoswitch-p2
mesh-ssh
mesh-relay
mesh-macos-node
screen-and-control
session-labels
review-real-logins-r5
review-real-logins-r4
review-real-logins-r3
shim-memory-r2
review-real-logins-r2
shim-memory
shadow-addhost-instant
shadow-real-logins
shadow-same-session-flood
shadow-prod-perf-fix
hosts-from-server
app-windows-real
app-windows-transport
release-prod-6w
mesh-policy-verify
quiet-close-toast
dev-merge-r4
review-mesh-agent-transport
review-app-windows-transport
settings-roundtrip
review-release-pipeline-r4
mesh-agent-transport
ended-strip-fix
review-audit-ca-update-d244
settings-rows
phone-width
signout-clear
fix-restart-tests
dev-merge-rp
signer-hardening
review-audit-ca-update
terminal-fidelity
review-audit-ca-update-wip
mesh-integrate
review-mesh-agent-transport-515d3712
review-mesh-dataplane-feec1988
mesh-dataplane
signout
research-canvas-node
wip/review-renderer-cost
wip/review-terminal-fidelity
padlock-glyph
review-release-pipeline-2e95b689
phone-polish
sidebar-polish
inbox-generic
review-mesh-dataplane-378d4055
prod-batch
ui-inbox
ui-ca-unlock
ui-machine-sections
review-mesh-dataplane-a5f744fb
tls-session-prod
session-bounds-prod
fix-dead-session
session-bounds
tls-session
palette-polish
shortcuts-d222
research-appmeta
phone-gutter
ui-centre-button
wip/ui-centre-button
wip/tls-session
review-addhost-breakit
ui-platform
renderer-cost
remote-agents
mesh-api
ssh-bootstrap
prod-hotfix2
prod-fixes
review-remote-agents
review-mesh-dataplane
session-life
research-browser
review-mesh-api
research-capture
review-mesh-api-round3
review-mesh-api-round1
gate-stability
review-gate-stability
review-relay-direct
review-mesh-api-findings
proto-sessions
font-picker
proto-addhost
proto-windows
mesh-core
latency-gate
research-bsd
research-discovery
keytray-mods
mock-core
ui-tweaks
fix-motion-sel
fix-motion
integrate2
fix-robust
t-web
t-server
vt-ghostty
fix-snap-echo
t-web-auth
review-vt2
t-agent
lane-protocol
lane-shim
lane-auth
s1-base
s1-contracts
s1-workspace
No results found.
No labels
launch-qa
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".
No due date set.
Dependencies
No dependencies set
Reference
kayg/infraternal#168
Loading…
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Owner, production screenshot 2026-10-11 (web, desktop): the sidebar lists ~40 "shell · detached" rows under monitor01 while the top pill says "Console · 1 session". Picking one opens a window that shows "Session ended · New shell". Production facts: 16 shim processes alive on monitor01 (15 from 06:58 UTC, 1 from 11:00 UTC); the server restarted at 10:54, 12:07 and 12:26 UTC. TASTE row: "Lists only offer what can be opened" (dev
76872157). Branchended-sessionsfrom release-prod-2.Started on branch
ended-sessions, baseorigin/release-prod-2at93b00f5ab965949b1a76a808e5734f98fed82fd4. Read #168 (no prior comments) and related #158 history (no parent issue linked). Reproducing the stale sidebar inventory before tracing server, agent and tracer ownership.Finding (source trace):
apps/tracer/src/canvas/sessions/live-inventory.tspersists rows in per-account localStorage andlist()returns remembered rows without host validation.crates/infraternal-agent/src/daemon.rs:339-342already discovers surviving shims at startup and:368refreshes the live registry on retirement, buthost.facts.readexposes only counts; there is no session-ID inventory or push to the tracer. #158's final gone answer is attach-triggered, so clients that never attach stale rows cannot learn they ended. I’m reproducing the client listing failure before implementation.Reproduction:
bun test src/canvas/sessions/live-inventory.test.tsfails the new testa session the host reports ended is removed from every inventory list: expected[], received['ended-session']aftergone(). This confirms #158 records the ended state butlist()still offers that row. Bun 1.4.2; existing cross-host retention test passes.Proposed additive #168 contract for
contracts/wire.md§3/§4/§5 (no frame IDs or codec change): the infraternal agent sends a fullterminal.sessions.snapshotcontrol Event after startup/reconnect and whenever its live-shim set changes; itssession_idsare exactly shims that authenticated during discovery and remain alive. The server reconciles open embeddedterminal_sessionsrows against that set (marking missing rows closed so #158 attach refusal remains final), then serves an authenticated per-userSubscribe {topic:"terminal.sessions"}snapshot and pushes a replacement snapshot after inventory/exit changes. The tracer keeps labels for IDs in the snapshot, hides unverified cached rows until the first snapshot, and removes absent IDs from its sidebar and persisted active inventory while retaining an ended state only for an already-open window. The server never terminates shims. This reuses existing Event frames and D13/D50/D178/#158; no library/engine selection or frozen shim change.Resuming on
ended-sessionsat WIP checkpointa272c01104d54881ab7fdec1347af88ee8885125, based onorigin/release-prod-293b00f5ab965949b1a76a808e5734f98fed82fd4. Read all #168 comments; no parent issue is linked. I’m restoring the checkpoint with the requested soft reset and splitting it into passing atomic commits.Finding:
crates/infraternal-server/src/embedded.rskeeps the lastSome(session_ids)when its infraternal agent connection is lost; no watch update reaches the WebSocket subscribers until a replacement snapshot arrives. A stalled restart can therefore leave unverifiable rows listed. I’m extending the existingterminal.sessionstopic additively with an unavailable event: clients hide cached rows during the gap without treating them as ended, then reconcile against the next full snapshot. This adds no frame IDs, codec or shim change.Reproduction (RED):
cargo test -p infraternal-server --lib agent_link_loss_invalidates_the_last_live_session_snapshot -- --nocapturecompiled and failed 0 passed / 1 failed. After a real Unix-socket greeting and full live snapshot, closing the agent peer produced no inventory watch update within 100 ms (crates/infraternal-server/src/embedded_regressions.rs:408).run_actorretained the priorSome(ids)onIncoming::Disconnected, confirming the restart-gap finding.Real-engine restart step passes at head
93b00f5ab9(local changes not committed yet):cargo test -p infraternal --test agent_sessions restart_discovery_keeps_a_live_shim_and_drops_clean_exit_and_sigkill -- --nocapture=> 1 passed. Discovery retained 16/16 live shims in 4 ms; every survivor reattached and echoed a marker, while one clean exit and one SIGKILL fixture were absent. Run undersystemd-run --user --scope -p CPUWeight=10000; 12 vCPUs, load average 38.87 / 35.85 / 32.56.Server path passes at head
93b00f5ab9(local changes not committed yet): link-loss regression 1/1, pending-inventory subscription test 1/1, restart SQLite reconciliation test 1/1. Link loss invalidates the prior snapshot; Pending sendsterminal.sessions.unavailable; reconciliation keeps the live row, closes the absent row, and preserves prior closure state.Baseline reproduction on release-prod-2 (production build + mock):
TRACER_TEST_PORT=4871 bun x playwright test test/dead-session.spec.ts --grep "the sidebar waits"failed as expected, Expected 1 row / Received 41 (40 seeded ended rows plus the live session) while the top pill stayed at 1. The rendered 1440×900 baseline capture isapps/tracer/captures/ended-sessions/sidebar-before-1440x900.png. Baselinebun run build && bun run transfer-budget.tsexited 0; critical JS gzip 291,683/307,200 bytes, deferred 49,651/51,200 bytes, largest on-demand chunk gzip 15,014/20,480 bytes.Finding: the pushed snapshot removed the sidebar row but left an already-open TerminalClient retryable. In the Playwright mock, attach_count rose 2→3 after
/__mock/drop-sockets. Routed newly retired IDs into the existing terminal final-state handler; the focused scenario now passes and attach_count stays fixed through the later socket drop.Finding: inventory-driven window finalization raced the saved terminal.exited reply; browser specs then showed
Session endedinstead of exits 7/0. Kept pushed inventory authoritative for sidebar/pill retirement while preserving the existing final Attach/Close path for open windows, so it can deliver stored exit status and #158 still stops subsequent retries.Contract proposal for #168: extend
terminal.sessions.snapshotwith an optional, account-filteredended_sessionslist of{session_id,status}for up to 128 most recently closed local rows. This lets the client end an already-open window and stop stale retries at the live snapshot while preserving a saved exit code; rows remain only insession_idswhen their shim is live. The sidecar is capped at 128 entries (under 7 KiB) and remains within the 32 KiB control JSON bound. Agent-linkunavailablestill hides cached rows and leaves the existing final-answer/reconnect path intact.Step: added bounded
ended_sessionsstatus data (128 newest local exits, account-filtered, indexed) to full snapshots. Server tests: 3/3 pass, including stale/live reconciliation, unavailable-before-census, and the index-backed 128-status snapshot. Browser suite: 7/7 pass on production build withTRACER_TEST_PORT=4871; 40 stale cached IDs reduce to one live row, pushed retirement removes row and pill within 1 s, and agent unavailability hides/restores the live row. Captures:apps/tracer/captures/ended-sessions/sidebar-before-1440x900.png(Console 41 / pill 1) andsidebar-after-1440x900.png(Console 1 / pill 1).Correction to the status-sidecar estimate: 128 worst-case UUID/status entries serialize to 9,601 bytes (9.4 KiB), not under 7 KiB. The cap remains 128; it bounds this portion of the snapshot below 10 KiB. The 32 KiB control JSON bound applies to control replies, not this Event payload.
Protocol review found that the leg-B inventory decoder also consumed unrelated control-stream Events. Added a regression that sends
future.control.noticefollowed by a valid live-session snapshot; it failed before the fix because the agent link was retired (agent_link_loss_invalidates_the_last_live_session_snapshot, assertion atcrates/infraternal-server/src/embedded_regressions.rs:444). I am narrowing inventory decoding to its declared event type while preserving unrelated bounded Events.The control-Event regression now passes after routing only
terminal.sessions.snapshotto inventory decoding and allowing unrelated bounded control Events through the actor (cargo test -p infraternal-server --lib embedded::regressions::agent_link_loss_invalidates_the_last_live_session_snapshot -- --nocapture: 1 passed). The first RED run showed the prior control-event path retired the link before it could apply the next snapshot.Committed and pushed the server exit-status lookup index as
3875e12f. The bounded query returns at most 128 recent local exits; its SQLite EXPLAIN plan usesterminal_sessions_closed_exit_userwith no temporary sort. The commit leaves persisted terminal history intact.Committed and pushed wire-contract documentation as
d11439c0. It specifies a complete leg-B census, account-scoped leg-A snapshots, unavailable handling, 400 ms shim census, and up to 128 saved exit statuses. The additive contract was posted on this issue before implementation.Committed and pushed agent census publication as
867a8943. The real-shim restart test now finds and reattaches 16 live shims in 2 ms while excluding a clean exit and SIGKILL;cargo test -p infraternal-agent --libpassed 31, ignored 6. The agent emits a sorted full snapshot after startup and on its single 400 ms host census.Committed and pushed the real-shim restart test as
19dbcde8. It covers 16 surviving shims plus one clean exit and one SIGKILL; all 16 survivors reattached and produced distinct markers, withrestart_inventory_discovery: live_shims=16 elapsed_ms=2.Committed and pushed server reconciliation as
3e2d2145. Targeted checks passed: 3 inventory tests (restart reconciliation, pending inventory, bounded status snapshot) and 1 embedded link-loss/control-Event regression. Reconciliation closes missing local rows, leaves live and remote rows alone, and pushes current account-filtered snapshots.Committed and pushed server regressions as
37b0d538. The three reconciliation and snapshot tests plus the real Unix-socket actor link-loss/control-Event test pass; server clippy passes with all targets and features.Committed and pushed the tracer inventory model as
a5622dcd.bun run checkpassed, and its focused unit suite passed 3/3 tests with 25 assertions: cached rows are replaced by verified inventory, unavailable state hides and restores rows, and cross-host attach remains isolated.Committed and pushed tracer inventory wiring as
d0f89590.bun run checkandbun test srcpassed: 152 tests, 10,942 assertions. The Console count and sidebar both derive from verified live inventory; stale rows cannot open, and removed IDs stop retries in existing windows.Committed and pushed focused inventory tests as
13112a81. The 3 model tests pass with 25 assertions, covering replacement of 40 stale cache rows, unavailable and restored census states, and remote-host isolation.Committed and pushed production-build browser coverage as
a23432f2. The suite passed 7/7 in 2.0 minutes withTRACER_TEST_PORT=4871; captures atapps/tracer/captures/ended-sessions/show the 1440x900 sidebar changing from 40 detached stale rows (Console 41, pill 1) to the one verified session (Console 1, pill 1). The production transfer budget passed before this Playwright run.The branch-head
scripts/verify fastrun reached the workspace test row and reported five failures in existingcrates/infraternal/src/restart_tests.rscases (rootless_even_marked_replacement_is_cold_and_open_fd_pins_the_inode,real_fd_exec_pins_replacement_and_cold_rollback_uses_null_stdin,cold_exec_with_closed_stdin_keeps_the_image_pinned_and_maps_null,early_hangup_is_queued_until_control_installs_its_handler, andrestart_requests_use_the_servers_binary_and_reject_untrusted_paths). Two other restart tests were still running past 60 seconds. I am waiting for the complete output and checking whether the test setup or host conditions explain this; the gate is not complete yet.The workspace test runner remains hung in
closed_reply_and_missing_reload_target_do_not_end_restart_controlanddefault_restart_opens_the_receiver_target_exactly_oncefor more than eight minutes, although the former has a 200 ms bound and both should complete after local socket requests. The test process has no child processes. I am stopping only this stuck test runner (not any shim), then will rerun the focused restart tests serially to distinguish a test-scheduling issue from a code failure before completing the remaining fast gates.Final-gate finding: the workspace test phase reported five existing
crates/infraternal/src/restart_tests.rsfailures and two >60s stalls; its runner had to be stopped after >8 minutes. A focused serial rerun also stalls inclosed_reply_and_missing_reload_target_do_not_end_restart_controlafter 3m11s (test thread in futex wait, Tokio thread in epoll wait; load 20.68/23.62/31.22). The Rust static-build row reports x86_64 binary 20,138,640 bytes against 16,404,816 maximum. I’m comparing unchanged restart tests and binary size againstrelease-prod-2; no sessions or shims were signaled.The first stalled restart test also stalls unchanged at the exact fork-point checkout
93b00f5a(ui-baseline):closed_reply_and_missing_reload_target_do_not_end_restart_controlremained in the test runner for 1m35s, with the test thread asleep in futex wait and its Tokio thread in epoll wait (load 10.45/17.25/24.11). The test file is unchanged between93b00f5aand this branch. This confirms the test stall predates #168; I’m still checking the binary size against the same baseline.Static-size comparison:
evidence/prod-batch/binary-final.txtrecords a 20,064,944-byte static production binary at code head431ec8a7, an ancestor of fork point93b00f5a. Between those commits,Cargo.lock, toolchain/build configuration, and the agent/server/CLI Rust trees are unchanged. The #168 branch binary is 20,138,640 bytes, a +73,696-byte delta (within the configured +262,144 allowance).scripts/verify.d/rust.shstill compares against the older 16,142,672-byte baseline, so its 16,404,816-byte maximum was already exceeded by 3,660,128 bytes at the recorded production build. I’m preserving that owner budget and recording the baseline mismatch; #168 did not account for the overage.#168 implementation is complete and pushed on
ended-sessions; heada23432f2matchesorigin/ended-sessions. No deployment was made.Root cause was confirmed: after restart, the agent did not publish its live shim set, while the tracer treated localStorage rows as session truth. The server now reconciles persisted local rows against the agent census and pushes snapshots; the client renders only server-confirmed inventory. The same verified list drives the sidebar and Console count. Agent loss hides rows without marking them ended; a complete snapshot retires missing IDs, while surviving IDs stay reattachable. Remote rows are excluded from local reconciliation and account queries. No shim is signaled or killed.
Self-review: snapshot decode rejects malformed/duplicate IDs; reconciliation is account-scoped and local-host-only; bounded channel pressure retries the census; client observers are disposed; ended windows stop reconnecting and retain saved exit state; existing shared sidebar/pill UI is reused. Production captures are at
apps/tracer/captures/ended-sessions/sidebar-before-1440x900.pngandapps/tracer/captures/ended-sessions/sidebar-after-1440x900.png(before: 40 stale rows / pill 1; after: one row / pill 1).Evidence: real agent restart found and reattached all 16 surviving PTYs in 2 ms (12-vCPU infraternal-dev, scoped run); tracer check and
bun test srcpassed (152 tests, 10,942 assertions); production build and transfer budget passed; browser specs passed 7/7 onTRACER_TEST_PORT=4871. Critical JS budget: 291,808/307,200 gzip and 242,556/256,000 brotli. No dependency or wire-contract breaking change.The branch-head
scripts/verify fastis not green because two pre-existing repository gates fail. The restart testclosed_reply_and_missing_reload_target_do_not_end_restart_controlalso stalled unchanged at fork point93b00f5a; see earlier issue evidence. The static binary is 20,138,640 bytes. Committed production evidenceevidence/prod-batch/binary-final.txtrecords 20,064,944 bytes at ancestor431ec8a7, so #168 adds 73,696 bytes, within the +262,144 allowance; the script's older 16,404,816-byte ceiling was already exceeded by 3,660,128 bytes at that recorded production build. I did not change the owner-set budget.Final
scripts/verify fastRust summary (verbatim):The workspace test runner had five restart-test failures and two stalls; I stopped the stalled Rust test process after more than eight minutes. The same named stall reproduces at the fork point. #168 remains open.
Scale measurement detail for the 16-shim restart census: infraternal-dev, 12 vCPUs, run under
systemd-run --user --scope -p CPUWeight=10000; recorded host load average 38.87/35.85/32.56. Discovery plus reattach completed in 2 ms.Independent review started on local review-ended-sessions at
a23432f238; merge base with dev93b00f5ab9. Read all 34 comments on #168, related #158 history (no parent linked), contracts and author result. Verifying census ordering, restart reconciliation, account isolation, stream completion and scale. Evidence commits local; no push/deploy per reviewer brief.ES-01 P1: an earlier census can permanently retire a newly opened live session. daemon.rs:140 prioritizes the Result control queue over census Events; the client lacks a generation fence and treats census absence as final. Normal model test (
1bababc8) learns the open ID, consumes the pre-open empty census, then the current live census: gone remains true (3 pass/1 fail, 32.92 ms). Production browser test (38fc6898, port4893) expected Console 1 after the current census, received 0. Evidence: ordering-unit.log / ordering-browser.log under ~/.cache/codex-scratch/ended-sessions-review. Server SQL ordering reproduction is compiling. Implementation unchanged; HOLD pending fixes.ES-01 P1 server proof committed7b0df5fb: a captured empty census waits for SQLite, a new live session row is inserted, then the older census permanently closes it. The next census includes the shim but the row stays closed/unattachable. Deterministic normal Rust test census_waiting_for_database_does_not_close_a_newly_created_live_session FAIL.
ES-02 P2 committed445f4bfb: census closure sets closed_at with exit_status NULL; a later authoritative saved exit7 is refused by terminal_exit.rs:43. reconciliation_before_saved_exit_keeps_the_authoritative_exit_status FAIL, expected Some(7), actual None, record Err(()).
Targeted suite3PASS/2FAIL/1ignored in0.20s; source build8m03s. Evidence server-review.log under ~/.cache/codex-scratch/ended-sessions-review. Original browser suite7/7PASS in1.7m. HOLD: P0=0/P1=1/P2=1/P3=0. No implementation repair/push/deploy.
Browser evidence correction: TypeScript caught a Uint8Array passed to Playwright WebSocketRoute.send (requires Buffer). The original browser packet-injection output and screenshot are superseded; the corrected binary-frame rerun is in progress. ES-01 remains independently confirmed by the deterministic SQLite test7b0df5fb and inventory model1bababc8. No production implementation changed.
ES-01 corrected production browser proof committed9d1b3113: valid codec frames passed as Buffer. Open Result -> older empty census -> current live census leaves the new shell ended: expected0 ended strips, received1. Strict tracer TypeScript check PASS. Screenshot and corrected failure retained at evidence/ended-sessions-review/{census-ordering.png,browser-ordering.md}. Earlier invalid browser injection evidence superseded. Independent SQL/model failures unchanged.
Exact-head fast gate: RTT/fmt/VTfmt/clippy PASS. CLI unit runner reported the same five restart failures and two >60s stalls as the author. Stopped only that runner after >2m (no shim signaled); cargo test remains a failed row and later gates continue. restart_tests.rs is byte-identical between
a23432f2and detached dev8e7467c0. Dev baseline serial restart comparison queued in the same load window; no test failure waived. Confirmed diff findings remain ES-01 P1 and ES-02 P2.ES-03 P2: new startup census breaks the existing native verification fixture. Normal Rust integration regression latency_fixture_accepts_the_unsolicited_startup_inventory (
0f81da16+ cleanup correction) fails0PASS/1FAIL in0.44s: agent_fixture.py:197 expects Pong next but receives the census Event. The latency script fails before measuring; no typing regression number claimed. Fixture daemon/state cleaned.Verification limitation: original16-shim restart test, with review-owned scratch, twice fails discover() with ConnectionReset (0.81s/1.06s); the discovery helper is unchanged, so no additional diff finding assigned. Author2ms claim not independently reproduced. Database200-session/50-account diagnostic PASS: debug p50=2126us,p99=13963us,close200=17184us; CPUWeight10000,12CPUs,load46.65/34.97/30.89. Counts now P0=0/P1=1/P2=2/P3=0; HOLD.
Dev baseline8e7467c0 reproduces the exact-head restart stall: same byte-identical restart_tests.rs, serial closed_reply_and_missing_reload_target_do_not_end_restart_control remained running >2m. Stopped only that owned baseline CLI unit runner; no shim signaled. Baseline log baseline-restart-final.log; exact-head log fast-exact-head.log. No failed test waived. First baseline attempt expired during compilation (300s), warm rerun reached the test after19.72s. Head fast gate remains in static release compilation; review-test clippy corrected a test-only map_unwrap_or lint and is rerunning.
Durable evidence step4910ed0a: docs/reviews/ended-sessions-168.md plus corrected production screenshot and normal-test proof excerpts. Findings ES-01 P1 (SQL7b0df5fb/model1bababc8/browser9d1b3113), ES-02 P2 (
445f4bfb), ES-03 P2 (0f81da16/549b86de). HOLD/merge after fixes; P0=0/P1=1/P2=2/P3=0.Passing independent steps: decoder corpus b2aebebe,10000 mutations+shape/truncation cases,0.11s; 200-session/50-account diagnostic81c50443, p50=2126us/p99=13963us,close200=17184us (debug SQLite, load46.65/34.97/30.89); strict clippy3335ef27 PASS,0.92s. Original tracer152PASS/10942 assertions; original browser7PASS/1.7m. Default production transfer critical291799gzip/242614brotli,deferred50370/44414 bytes, all within budgets. No implementation repair, push or deployment. Exact-head static release still compiling; final gate and independent fork-point size comparison pending.
ES-04 P2 committed9e3232f3: client imports every ended_sessions ID, including sessions never opened on this device, and never releases superseded rows. Two disjoint128-status replacement snapshots retain256 inaccessible records (live-inventory.ts:119-130); every later reconcile/save scans that accumulated history. Focused normal Bun test superseded status snapshots release records for sessions this device never opened:0PASS/1FAIL,171.94ms, expected<=128/current sidecar, actual256. No existing window needs those prior rows. This confirms unbounded hidden retention despite the128-row wire cap. CountsP0=0/P1=1/P2=3/P3=0; HOLD remains. Implementation unchanged.
Independent review finished: merge after fixes — HOLD (P0/P1 present).
Counts:P0=0/P1=1/P2=3/P3=0. Target:a23432f2387dcbff5f19429966feb65c8d9abb35; review head:87e53fc530827b2209d0327912f9f94a76688535, local review-ended-sessions. No implementation fixes, push, deployment or issue closure.
ES-01 P1: old census processed after open permanently retires a live session. SQL test7b0df5fb, model1bababc8, corrected production browser9d1b3113 (valid Buffer frames; expected0 ended strips, actual1). Earlier invalid browser injection evidence is superseded.
ES-02 P2: reconciliation closure refuses later authenticated saved exit7 (
445f4bfb).ES-03 P2: new startup census stops shared native latency/snapshot fixture at agent_fixture.py:197 (
0f81da16, cleanup549b86de).ES-04 P2: two disjoint128-status replacement sidecars retain256 unviewed records (
9e3232f3).Report:docs/reviews/ended-sessions-168.md; failing tests and durable evidence committed. Final tracer:152PASS/2expectedFAIL,10944 assertions,1.471s. Original production browser:7/7PASS,1.7min; strict TS/clippy PASS. Server excluding two known probes:189PASS/0FAIL/14ignored. Decoder10000 mutations PASS. D170 database-only200sessions/50accounts:100samples p50=2126us,p99=13963us;200closures17184us, load46.65/34.97/30.89, CPUWeight10000. Does not establish real200PTY typing/RSS budgets.
Static head20138640B vs independently built merge-base20064976B: +73664B(0.367%). Both stripped/static PIE,no interpreter; locked default recipe under CPUWeight10000. Head matches author; baseline32B larger. No budget/dependency/profile adjustment. Gate size failure retained per D205.
Native release latency gate stops at ES-03 before measurement. Two real16-shim restart attempts fail discover() ConnectionReset; author's2ms/16-survivor result not independently reproduced (discovery helper unchanged, no new finding assigned). Exact-head fast test row has existing restart failures/stalls; byte-identical restart test also stalls on dev8e7467c0 in same load window. Only owned stalled runners stopped after>2m; no failed row waived.
scripts/verify fast on unmodified target head, verbatim final output:
Orchestrator: independent review (branch review-ended-sessions @
87e53fc5) returned HOLD, P1=1 (ES-01 stale census retires a new live session), P2=3. Round 2 fix job launched on ended-sessions @a23432f2(Sol medium, CPUWeight 100). ended-sessions is held out of the production batch until round 2 passes a delta review.Round 2 started on ended-sessions, base
a23432f238. Read all #168 comments, related #158 (no parent linked), repository contracts and review report at origin/review-ended-sessions87e53fc5. Reproducing acceptance tests before fixes; separate logical commits, targeted gates, push each; final full fast gate and 200-session/static-size comparison. No deployment.ES-04 fixed and pushed
bc656a96. Imported the independent superseded-status test unchanged: RED retained 256 from two 128-entry sidecars; GREEN releases prior unviewed records, retains current 128 and status for opened windows. Tracer check PASS; inventory suite 5 PASS / 0 FAIL, 29 assertions; fmt PASS. Evidence: evidence/ended-sessions-round2/es04-{red,green}.log.ES-01 ordering proposal (D13/D50/D178, wire framing unchanged): publish census Events on the same FIFO control lane as open Results, so the new-ID census precedes its successful Result. Acquire the database writer before copying the latest inventory for reconciliation; acquire a connection before copying inventory for browser snapshots. New local client records ignore absence until their first positive census; explicit saved exits and final Close remain authoritative and irreversible. Rejected schema/epoch metadata because ordered existing queues and a current watch read avoid persisted metadata and binary growth. Acceptance assertions remain intact; the SQLite race test will supply the live watch source used by production rather than an immutable copied array.
ES-01 client step pushed
a6c60d8a; contract ordering clarification pushed8230b4e3. Independent model acceptance unchanged passes; final Close before first positive census stays ended, later absence after confirmation retires the ID. Strict tracer check PASS; 157 unit tests / 10954 assertions PASS. Independent production browser acceptance unchanged PASS 1/1 in 24.2s at port 4988, default 300ms RTT, CPUWeight10000 (es01-browser-focused.log). Initial unweighted broad browser run had startup timeouts and a wrong count; baselinea23432f2under the matching weighted scope passes 7/7 in 1.8min (port4978); weighted head rerun ongoing. Rust cold native builds still running; server and fixture fixes await targeted checks before commit. No gate failure waived.Production browser acceptance and screenshot committed/pushed
281160bf(source and assertions from corrected review probe unchanged). Weighted head: original suite 7/7 PASS, 1.7min, default 300ms RTT, port4988; ordering acceptance 1/1 PASS again, 20.7s; strict tracer check PASS. Default production transfer: critical gzip291799/307200, brotli242516/256000; deferred gzip50455/51200, brotli44446/45056; largest on-demand gzip15011/20480, brotli13336/18432. Preview-build transfer failure was a different build profile, not used for D188; budgets unchanged. Evidence screenshot: evidence/ended-sessions-round2/es01-browser-green.png. Baseline statica23432f2independently rebuilt: 20138640B, stripped static PIE, matching the review. Rust startup fixture baseline still fails at agent_fixture.py:197; fixed-fixture native test and strict clippy pending.ES-01 daemon ordering committed/pushed
92b9f49b. All-target/all-feature strict clippy PASS (42.47s after forced head rebuild), fmt PASS, infraternal-agent lib 33 PASS / 0 FAIL / 6 ignored in0.24s. FIFO and saturation regressions pass; a full census queue cannot publish a successful open Result without its fence.Verification correction: shared Cargo target outputs were overwritten by the baseline checkout, so the first later head inventory checks and scale-head result actually ran the baseline executable; invalidated and retained as *shared-target-invalid.log. Saved baseline executables separately, stopped using that checkout with the head target, and cleaned only the touched packages to force head compilation. Baseline SQL acceptance still reproduces both ES-01 and ES-02 failures (es01-baseline-red.log/es02-baseline-red.log). Older unit fixtures also require worktree target/: created a link to this job scratch fixtures; all8 missing-directory failures then pass (agent-final.log). No acceptance assertion or gate weakened. Head server checks and valid head scale measurement pending.
ES-01 fixed/pushed: daemon92b9f49b orders census before Result; serverb5beff06 reads the latest watch only after BEGIN IMMEDIATE; clienta6c60d8a fences new records until their first positive census. Final Close remains irreversible. Valid forced-head inventory suite5PASS/0FAIL; queue/saturation tests included in33PASS daemon suite; unchanged production browser acceptance1PASS plus original7PASS. SQLite acceptance now uses the production watch and ordered publication, with retirement assertions intact. No generation fields, schema or dependency additions.
ES-02 fixed/pushed
c251f3fd. A census-closed row with NULL exit_status can accept its first authenticated saved status; conflicting status, ownership/token/cursor checks and first closed_at remain unchanged. Independent acceptance unchanged PASS after forced head rebuild; authenticated terminal_exit suite2PASS/0FAIL. Baseline red proof returns Err(())/None instead of Some(7), retained in es02-baseline-red.log.ES-03 fixed/pushed
b7ee41f9. Shared fixture startup uses the bounded correlated ping loop; control Events are consumed during open and terminal progress, and only the latest inventory is kept separately from terminal events. Real fixture regression1PASS/0FAIL in1.32s: startup, census-before-Result for an actual open, real PTY marker and Pong. Baseline still fails agent_fixture.py:197 before measurement. No cursor/credit validation weakened; strict all-target/all-feature clippy and fmt PASS.ES-01 host-isolation follow-up:
9c88d6a0pushed. Self-review found foreign-host live/Close events cleared the pending first-census fence before ownership validation. Both new regression tests failed before the fix; ownership now precedes fence removal. Strict tracer check, 159 unit tests, production build and unchanged D188 transfer budgets pass (client-final.log).Scale step
b4e70c8cpushed: three alternating baseline a23432f2/head debug SQLite runs, 200 sessions/50 accounts, 100 samples each, infraternal-dev x86_64, 12 CPUs, CPUWeight=10000, load 32.60/37.36/37.91. Median run p50 1848 -> 1845 us; median close-all 21228 -> 20036 us. No measured regression; DB-only, not a whole-server throughput claim. scale-final.log preserves all samples. Earlier shared-target measurements were discarded; saved separate baseline/head executables were used for these runs.Static locked default x86_64 musl:
a23432f220138640 B -> head 20142672 B, +4032 B (+0.020%). Static PIE, no interpreter. Historical max 16404816 B remains unchanged and already fails ona23432f2; no waiver or budget change.Real-engine agent_sessions 3/3 pass (0.76s); all 16 surviving shims discovered in 5 ms and replay/clean-exit/SIGKILL assertions pass at load 41.01/34.51/34.66 under CPUWeight=10000. The brief's pre-existing 16-shim stall did not reproduce in this valid run. Both formerly stalled restart-control tests pass separately. Final full gate follows the evidence commit.
Evidence step 160629b85 (full SHA follows in final comment) pushed: docs/verification/ended-sessions-round2.md and failing-before-fix/native/browser/scale/size logs and production screenshots are committed. Latest unchanged production ordering acceptance passes 1/1 in 20.6 s at 300 ms RTT on port 4988. Default production D188 transfer rerun passes: critical gzip 291797/307200 B, Brotli 242566/256000 B; deferred gzip 50453/51200 B, Brotli 44496/45056 B; largest on-demand chunk gzip 15010/20480 B, Brotli 13330/18432 B. Final scripts/verify fast is running on this head, under CPUWeight=10000 with short private fixture state roots and umask 022. No gate waived or changed.
Final gate on
160629b8beis NOT green: fmt, VT fmt, workspace clippy and cargo-deny pass; workspace test fails in real_binary_preserves_input_and_output_across_24_abrupt_stops before its functional checks because the idle canary observes 11 scheduler entries / 2.201 s. Static size is 20142672 B > unchanged max 16404816 B. No waiver.Investigation: daemon.rs:34,381,412 has an unconditional 400 ms live census timer, already present in
a23432f2. The repaired ES-03 fixture now gets past the startup census and exposes it. Weighted sequential comparison with the same census-tolerant fixture: exacta23432f2static binary 12 entries / 2.200 s; head debug binary 10 entries / 2.201 s. This is not a host-load timeout and no test/threshold was changed. Evidence: fast-final.log, idle-baseline.log, idle-head-repeat.log.Blocked for a fully green gate: the recorded 400 ms complete-census contract conflicts with D81's zero-idle default. An owner decision is needed to reconcile that contract with idle behavior; a job cannot choose a new foundational process-death mechanism or change an owner decision. I retain the existing contract and report the failure, rather than disabling discovery or weakening the canary. All four ES findings pass targeted acceptance; remaining workspace tests are being checked separately because cargo stops at this failing integration binary. No issue closed, no deployment.
ES-03 follow-ups found while checking beyond the full gate's idle failure, committed and pushed atomically:
1e3e5862: authenticated UID-refusal fixture validates the exact empty startup census before its unchanged refusal/nonce/no-session assertions. It failed before the change; remote daemon tests 5/5 pass, strict agent all-target/all-feature clippy passes.2ad79ae0: saturation oracle reuses the bounded correlated Pong helper after census/retirement events. Prior oracle failed at the next-frame assumption after its payload assertions. Green oracle: 12 streams, 65 Input frames each, 2640000 payload bytes exactly once, dead-shim isolation and daemon Ping pass.6d34eacd: shared read_without_inventory validates censuses within one original socket budget and returns all other replies unchanged.63392d9c: retention oracle uses that helper and correlated ping. Prior failure was stream-zero census before terminal exit; all original identity/status 7/final cursor/Close 4404/saved replay/unknown-session/retirement-race checks now pass. Python syntax passes on all three touched fixtures.Separate TypeScript fast checks pass (166 tracer/shared tests, 36 protocol tests, default build and unchanged D188 budgets). All other CLI integration suites in cli-remaining.log passed; the two census-assumption failures have the green reruns above. Remaining workspace checks are finishing. The deterministic 400 ms timer idle failure is retained, not waived.
Round-two result: HOLD for a fully green gate. Head
dd867a5815, branch ended-sessions, all commits pushed; no deployment or issue closure.ES-01 through ES-04 pass their targeted acceptance, including the unchanged production ordering test. Additional census-aware fixture corrections preserve the UID/refusal, queue bytes, saved exit and Close assertions. Evidence and screenshots: docs/verification/ended-sessions-round2.md and evidence/ended-sessions-round2/ at this head.
200-session/50-account alternating debug DB comparison: median p50 1848 -> 1845 us; median close-all 21228 -> 20036 us. No measured regression. Static x86 musl vs exact
a23432f2: 20138640 -> 20142672 B, +4032 B (+0.020%), no interpreter. D188 budgets unchanged and pass.Broader checks: server 297 pass/33 ignored, shim 65 pass/13 ignored, all other CLI integration suites pass with the corrected fixture reruns, native mouse probe passes with the pinned Zig PATH, workspace doc tests pass, separate TS fast checks pass (166 tracer/shared tests, 36 protocol tests). Real restart integration 3/3 passed; 16 shims discovered in 5 ms. The brief's pre-existing 16-shim stall did not reproduce in that valid run. No other test failure is waived.
Final scripts/verify fast on this exact head returns 1. Test row fails in the unchanged idle canary: 12 scheduler entries / 2.201 s. The existing unconditional 400 ms census timer also fails on
a23432f2using the repaired fixture (12 / 2.200 s), so this is deterministic idle work, not a timeout waived under host load. Owner resolution is needed for the recorded 400 ms census contract versus D81's zero-idle default; no foundational process-death mechanism or owner decision was changed. Static row fails its unchanged historical ceiling, which already fails ona23432f2. Both failures remain unwaived.Final gate output, verbatim:
Orchestrator decision (reversible, within D81): the 400 ms LIVE_SESSION_SCAN timer added by this branch (
867a8943) is a D81 regression, not an owner question — production has no such timer. Round 3 replaces it with event-driven discovery: pidfd per shim on Linux in the existing poll set, kqueue NOTE_EXIT on macOS, census only on change; no periodic fallback. ended-sessions is out of tonight's production batch.Round 3 started on ended-sessions at
dd867a5815. Read all #168 comments, related #158 (no parent linked), CLAUDE.md, DECISIONS.md, architecture/process and round-2 evidence. Following the orchestrator's D81 decision: replace the 400 ms census with shared kernel exit readiness, preserve ES-01 ordering and all round-2 acceptance, no periodic fallback or new dependency. Contract clarification will describe connect/reconnect and open/close/exit-driven census. Atomic commits, targeted gates, push each; final fast gate and idle/exit-latency/200-session/static-size evidence.Contract clarification before implementation (D81; approved event-driven choice above): initial census after connect/reconnect adoption; thereafter only when authenticated live set changes. Linux pidfds share one kernel readiness queue, macOS NOTE_EXIT follows the same model. Registration is at create/adopt and identity is rechecked across registration to reject PID reuse. Unsupported pidfd_open uses only connect/reconnect and open/close/exit-event checks. Directory removal remains event driven. Census queue pressure retries on writable capacity, preserving the ES-01 FIFO fence, without a timer. Existing nix 0.30 lacks a pidfd_open wrapper; the small syscall wrapper will stay in the existing audited shim PTY/process boundary (D40), using nix::libc and OwnedFd, with no dependency addition.
Contract step
ec6d6809pushed: contracts/wire.md now specifies event-driven connect/reconnect and lifecycle census, shared kernel readiness, queue-capacity retry and no periodic fallback (D81). cargo fmt --all --check and git diff --check pass. No frame/schema change. Baselinedd867a58native and static builds are underway in owned scratch for matched idle/size evidence.Round-2 production browser acceptance unchanged: 8/8 PASS in 2.0 min, CPUWeight=10000, TRACER_TEST_PORT=5188/upstream5189, default 300 ms RTT. Includes original seven dead-session cases plus ES-01 ordering regression. Browser plugin unavailable; existing Playwright harness used. Screenshot evidence: evidence/ended-sessions-round3/captures/{ended-1440x900-ink,retired-exit-0-1440x900-ink,retired-exit-7-1440x900-ink}.png; no author visual-quality verdict. Native baseline builds continue through cold locked C dependencies. macOS watcher compile succeeded with existing nix/Tokio versions; strict cross-target lint check follows (runtime not tested on this Linux host).
macOS backend
b193195bpushed: one CLOEXEC kqueue, EVFILT_PROC/NOTE_EXIT one-shot registration, explicit retirement cleanup, no per-shim task or periodic timer. Independent aarch64-apple-darwin compile and strict pedantic clippy PASS with nix 0.30.1/Tokio 1.53.2; repository fmt PASS. Runtime macOS is untested on this Linux host, and the surrounding existing daemon launch code remains Linux-specific. Native C dependencies completed; fresh native checks will include the nix event feature (the initial cold Cargo invocation had read the old manifest before that feature was enabled and its partial build is not acceptance evidence).Linux process boundary
8258de83and real-kernel tests (next SHA recorded below) pushed. Audited pty.rs uses nix::libc::syscall(pidfd_open) with zero flags and OwnedFd ownership; PID bounds/CLOEXEC and the registration identity invariant are documented (D13/D40/D81). No new crate. Native infraternal-shim all-target strict clippy PASS and descriptor tests 2/2 PASS (0.01s, helper-crate-gates-final.log). Separate source-import harness also passes 6 tests, including SIGKILL queue isolation, cleanup, ENOSYS fallback and EMFILE refusal; strict pedantic lint PASS. The exactdd867a58server test executable is saved independently after its successful build; the duplicate queued baseline build was cancelled so head validation cannot overwrite baseline evidence.c1398f818dNative fixture findings: agent_sessions.rs:187 initially failed NotFound because its fixed ended-sessions scratch parent was absent; created that parent without assertion changes. Serial retry reached :293 and reproduced the previously reported ConnectionReset race: it starts discover() immediately after SIGKILL, before the shim's listener has completed teardown. Proposal: await the fixture-owned pidfd death readiness before restart discovery, preserving all 16-survivor/replay/clean-exit/SIGKILL exclusion assertions. This does not change production discovery or the SIGKILL-to-census latency measurement.
New adopted-idle probe once observed 1 schedule-in/2.201s directly after startup; separate unchanged five-second observations returned 0 and 0 (adoption-wake-diagnostic.log). Add a 100ms probe-only settle period for finite startup/exit cleanup before the existing unchanged 2.2s zero-activation canary; no periodic daemon work or threshold change. Baseline
dd867a58still has 10 schedule-ins/2.200s (idle-baseline-red.log), matching the original 400ms regression. Current touched-crate clippy PASS and infraternal-agent all-feature tests 63 PASS/12 ignored (native-gates.log). No failure waived.D81 production wiring
dc79d117pushed, following nix featurebaa74448and shared Linux backend00d671df. Registry authenticates lifetime across registration, tracks create/adopt, drops retired watches; dispatcher removes LIVE_SESSION_SCAN and retries census only on queue capacity. ES-01 FIFO open fence remains. Native clippy for all touched crates/all targets/features PASS; library 63 PASS/12 ignored, including saturation/census retry. The unchanged restart acceptance assertions now pass after fixture-owned process-death synchronization: 16/16 survivors discovered in 11ms and replayed, clean exit and SIGKILL absent (real-daemon-green.log).Exact
dd867a58static baseline: 20142672B and 10 schedule-ins/2.200s. Head release: 20153072B, +10400B (+0.052%), stripped static PIE. Existing 2.2s idle canary: 0 empty, 0 adopted-unattached, 0 after all exits; RSS 4916/5236/5388KiB. 100 actual SIGKILL -> leg-B server-peer census samples p50=1005us, p99=2891us, max=3464us < 400000us (static-idle-exit-latency.log); infraternal-dev/x86_64/12 CPUs/CPUWeight10000, load7.91/20.98/32.81. Actual server-actor/200-live-shim scale probe and DB comparison follow; full fast gate pending. No deployment or gate waiver.Completed/pushed steps:
e2eff64dmacOS registration-token fencing (cross-target all-target strict clippy including test compilation; no macOS runtime claim);84013752shared kernel lifetime/200-descriptor tests;2c54a6besaturated control-lane census retry;784c8584real daemon idle/exit oracle;e43a0135fixture-owned SIGKILL death barrier preserving all round-2 restart assertions;6257a59breal server-actor/200-shim scale probe. Native touched-crate all-target/all-feature clippy PASS; restart/fixture 3/3 PASS plus idle/exit oracle 1/1 PASS. Protected daemon FD access remained denied: descriptor accounting uses only the fixture's own process, never relaxed D217.Scale: actual server inventory actor, 200 real unattached shims, 200 SIGKILL samples, p50=9691us/p99=23022us/max=27701us <400000us; zero scheduler activations at 200 live and after all exits, RSS5672/5444KiB, one daemon thread. CPUWeight10000 including fixture scopes, x86_64/12 CPUs, load28.80/20.38/27.88 (server-scale-200.log). Watcher-owned FD measurement at200: before7/active208/retired8 => exactly201 added and1 retained; no per-shim watcher task (watcher-scale-200-final.log).
DB-only reconciliation production/test source unchanged vs
dd867a58. Initial 3+5 alternating debug runs were noisy; retained, not discarded. Controlled 10-per-version A-B-B-A rounds (100 samples/run,200 sessions/50 accounts, all200 closures verified): median run p50 baseline1660.5/head1640.5us; p99 2482.5/2545us; close200 17864.5/17725.5us. No material measured regression or significance claim; reconciliation-200-abba.log records each run/load. Full fast milestone is running at6257a59b; final head replay follows evidence documentation. No deployment or waiver.Evidence step
14d01febpushed: docs/verification/ended-sessions-round3.md plus raw failing/corrected/native/browser/scale/size logs and production screenshots. Full scripts/verify fast milestone at6257a59b: fmt/VT fmt/clippy/test/cargo-deny PASS; static builds FAIL(1) only, 20153072B > unchanged16404816B ceiling. All workspace tests, existing zero-idle canaries and previously stalled restart tests pass; no timeout failure waived. Separate TS fast PASS:166 tracer/shared tests and36 protocol tests/34462 assertions, unchanged D188 budgets. Initial protocol run waited on the concurrent Cargo lock; isolated owned protocol target passes the unchanged30s test. Final full replay is running at evidence head14d01feb; finish comment will include full SHA and verbatim output. No deployment.Final replay at14d01feb hit the previously reported closed_reply_and_missing_reload_target_do_not_end_restart_control EPIPE assertion (restart_tests.rs:216); this unchanged restart test passed in the complete6257a59b milestone. Source area is unchanged by round3. Failed output retained as fast-head-restart-failure.log; serial focused test and full same-head replay are running. No assertion/budget change or waiver. Finish comment will quote the actual final result.
Same-head full replay now passes all36 CLI unit tests (including closed_reply_and_missing_reload_target_do_not_end_restart_control),24 restart oracle,queue tests,VT credit/reconnect,and is progressing through server tests. Two serial diagnostics of the known restart test stalled; the second used the gate's umask022 and was stopped after >2min by stopping only its owned scope. This reproduces the previously documented serial stall; restart source is unchanged. Logs restart-head-focused.log and restart-head-focused-private.log retain it. No full-gate row is waived; final replay result pending.
Round 3 finished on ended-sessions, HEAD
14d01feb71; all atomic commits pushed, no deployment or issue closure.D81 restored: shared pidfd/kqueue exit readiness replaces LIVE_SESSION_SCAN, no periodic fallback, census only on change/connect and capacity-driven retry; ES-01 fencing preserved. No new crate. Contract updated.
Release idle: zero scheduler activations empty/adopted/after exits and at200 live shims; at200 RSS5672KiB. Actual server watch SIGKILL latency n200 p50=9691us/p99=23022us/max=27701us (<400000us). Single-live release peer n100 p50=1005us/p99=2891us. Watcher descriptors at200 exactly201, then1 after retirement. DB200/50 accounts controlled A-B-B-A median p50 1660.5->1640.5us, close200 17864.5->17725.5us; production reconciliation unchanged. Static x86 20142672->20153072B (+10400B,+0.052%). Evidence and screenshots: docs/verification/ended-sessions-round3.md and evidence/ended-sessions-round3/.
Acceptance: all final Rust workspace tests PASS, original zero-idle canaries PASS, round-2 acceptance preserved, browser8/8 PASS; separate TS fast166+36 PASS/34462 protocol assertions. macOS backend cross-compilation/lint/test compilation passes; runtime untested on Linux. Author checklist completed.
Final scripts/verify fast at this exact head, with RUST_TEST_THREADS=1, CPUWeight10000 and umask022: only the historical static ceiling fails. No failed test waived. Earlier same-head parallel attempts hit the documented restart EPIPE case and an unchanged mesh pagination fixture; isolated mesh passed, final complete serial replay passes both. Known serial diagnostic stall: closed_reply_and_missing_reload_target_do_not_end_restart_control; its two owned diagnostic scopes were stopped after >2min. This test passes in both full milestone and final gates; no restart stall remains in the final gate.
Final output, verbatim:
Complete raw final output: evidence/ended-sessions-round3/fast-final.log. Owned targets and baseline/harness checkouts are being removed; committed evidence retained.
Cleanup complete at14d01feb712186bcacbfe444948a3baf0d107947: owned round3 build targets, baseline/harness checkouts, saved executables and fixture state removed. Worktree clean; origin/ended-sessions matches HEAD. Committed evidence and final raw gate logs retained under evidence/ended-sessions-round3/. Final gate has no failed test waiver; only historical static ceiling remains. No deployment or issue closure.
Delta verification started on local review-ended-sessions at
14d01feb71; target merge base with dev93b00f5ab9. Prior review87e53fc5preserved as review-ended-sessions-prior. Scope a23432f2..14d01feb only, ES-01..04 acceptance plus event-driven exit readiness. Read #168 and related #158 history (no parent linked), required repository docs and author report. No implementation changes, push, deployment or remote benchmarks.Delta client acceptance complete at unchanged target
14d01feb: live inventory 10 PASS/0 FAIL,41 assertions,75ms; original ES-01 model and ES-04 sidecar tests are already imported with original assertions. Production browser ES-01 ordering1/1 PASS,21.5s; original dead-session suite7/7 PASS,1.8min,default300ms RTT,TRACER_TEST_PORT5298,CPUWeight10000. Screenshot output retained for review; no UI or implementation changes. The ES-01 SQLite oracle is adapted to the production watch API; pending native build. ES-02/03 tests already imported. No duplicate cherry-pick needed. Logs under ~/.cache/codex-scratch/ended-sessions-review/.Evidence commits560178c1(client acceptance) and94175ae5(kernel scale), local only. Exact production Linux watcher imported into an isolated harness:6PASS/0FAIL/2ignored; separate200-lifetime testPASS. FDs10->211->11(exactly200pidfds+onequeue,all200released). Registration112931us,stop/drain187509us; infraternal-dev,x86_64,12CPUs,CPUWeight10000,load66.65/44.56/39.26. This is kernel resource evidence,not200PTYRSS. Initial scratch harness missing prepare_spawn wrapper corrected using existing source; implementation untouched. Full exact-code fast gate is still in cold workspace compilation.
Delta verification at local94175ae5: no new confirmed finding. Client133PASS/0FAIL,10882assertions; default critical gzip291798/Brotli242547B,deferred gzip50459/Brotli44508B,largest on-demand gzip15012/Brotli13327B,all unchanged budgets pass. Production ordering recheck1/1PASS at port5318,21.4s; fresh census-ordering.png retained. Full fast cold VT/OpenSSL dependencies finished after ~25min; native Rust compilation continues under shared load(~50/49/47). ES-01SQL/ES-02/ES-03 still pending independent runtime; final verdict awaits actual gate. Source and implementation unchanged,no push/deploy.
Native agent suite now independently63PASS/0FAIL/12ignored,11.29s,CPUWeight10000,serial. First run62PASS/1setup-timeout at daemon_census_retry_tests.rs:121(before rendezvous retirement),16.84s; unchanged isolated repeat1PASS/50ms and full unchanged serial repeat63PASS. Both failures and passing outputs retained,no production retry failure inferred or timeout waived. Exact-code fast test compilation continues; server/CLI acceptance not yet executable.
Step20f204b5(local): ES-01..04 all independentlyPASS. Server inventory5PASS/0FAIL/1ignored,agent63PASS/0FAIL/12ignored,real-session3/3PASS(16 survivors discovered3ms and replayed),real idle/exit1PASS(0/0/0 activations in2.2s windows;debug daemon8exits max13871us). SQLite200sessions/50accounts,n100,p502267us,p998779us,close20020000us;CPUWeight10000,12CPUs,load40.00/37.36/42.28. Debug RSS14-15MiB is not a release budget claim. Exact-code full fast reproduces prior five unchanged CLI restart failures/two stalls; stopped only owned stalled CLIunit after>2m,test row remainsFAIL,no waiver. Historical detached-dev stall proof is already on#168; no new same-window baseline claimed. Release/static gate still building; final verdict/output pending.
Independent delta review finished: merge — MERGE (no P0/P1).
Active confirmed delta findings: P0=0/P1=0/P2=0/P3=0. ES-01..04 all PASS; original finding assertions already imported by target, so no duplicate cherry-pick or new failing test was needed.
Target14d01feb712186bcacbfe444948a3baf0d107947; scope a23432f2..14d01feb only. Local review-ended-sessions HEAD
e705ee67df. Evidence commits560178c1/94175ae5/20f204b5/e705ee67; report docs/reviews/ended-sessions-168-delta.md. Implementation diff0 bytes, worktree clean; no push/deploy/issue closure.Independent acceptance: inventory10PASS,canvas133PASS; production browser8/8PASS; native agent63PASS,server inventory5PASS,saved-exit authority2PASS,real-session3PASS(16survivors discovered3ms/replayed),queue/retention1PASS each. Initial census-retry setup timeout before retirement and unchanged passing isolated/full repeats retained; no waiver.
Release200real shims: zero activations/2.201s,one daemon thread,RSS5660KiB=5.53MiB(28.30KiB/session x200,daemon only); after exits zero/2.202s,RSS5444KiB.200pushed retirements,no refresh/attach,p507871us,p9946110us,max130421us<400000us; CPUWeight10000,x86_64,12CPUs,load50.79/35.93/34.83. Separate100-lifetime release oracle0/0/0 activations,p9912674us,max17453us. SQLite200sessions/50accounts,n100,p502267us,p998779us,close20020000us.
Fast is NOT green: prior five unchanged CLI restart failures/two stalls repeated; only owned stalled rootunit stopped after>2min,test row remainsFAIL. Restart implementation/tests unchanged in delta; historical detached-dev proof is already on#168,not a new baseline/waiver. Static20153072B,no PT_INTERP;+14432B vs prior independently verified
a23432f220138640B. Historical16404816B ceiling unchanged(D205);aarch64/TS skipped by dispatcher after failures. Independent tracer check/build/transfer budgets PASS.Native typing gate FAIL:100samples/condition,300msRTT;PTYecho baselinep99371.80ms,otherflood351.25ms,sameflood492.35ms vs334ms;same-floodgrowth120.54ms vs16.67ms,endload67.90/48.78/39.99. No fresh same-window old typing artifact was built,no causal delta regression established,no green latency or failure waiver claimed. Raw failure retained. Full auth/browser latency profile not rerun.
Owned build targets/fixture roots removed; logs/release artifact retained at ~/.cache/codex-scratch/ended-sessions-review/. Completed scripts/verify fast on target code, verbatim:
Production batch 4 started on release-prod-4, base
1f77a449ed(live release-prod-3). Read issue/review histories and repository contracts. Merge terminal-fidelity27db08cfthen ended-sessions14d01feb; preserve replay fencing, production lifetime authentication and event-driven census. Exclude audit-ca-update/release-prod-3b and64d4e213. Required native/browser/static gates and three interleaved base/head perf-VM keystroke runs; push only release-prod-4, no deployment.Fresh live-base control at
1f77a449: default stripped static x86 image20093776B, no PT_INTERP, SHA256 f5fcda1a36f2270e458a1598a35d444f542a826b6d49fc88f0f876497b25fed1. Production-build browser gate (port5264, CPUWeight10000, default300ms RTT)50PASS/5FAIL in14.2min. Failures: retired exit7 attach count, sessions-canvas30s watchdog, theme long-task assertion, first-run5s connection poll, access-screen120s watchdog (setup render p992651.40ms vs1000ms). Raw evidence/prod4/browser-base-1.log. First merge fmt/all-feature touched-crate clippy PASS; agent34PASS+2transport, server186PASS/13ignored, raw queue1PASS/review8PASS, VT credit1PASS, session discovery1PASS and all three session-script runs PASS; shim suite finishing. No waiver or budget change; head A/B follows second merge.Completed first merge:69babc9237457a8dd30a20ba596c730b44414e79, terminal-fidelity27db08cf onto live1f77a449. fmt and touched-crate all-target/all-feature clippy PASS (20m02s cold); default agent34+2transport PASS, server186PASS/13ignored plus integration/doc targets, shim73PASS/13ignored plus detach2/mouse1 PASS. CLI discovery/VT credit1 each PASS; queue1PASS(36.68s)/review8PASS(23.36s); three session-script modes PASS; tracer150PASS/check/build/transfer PASS; replay browser2/2PASS after retained initial fixture-attach race. Second merge14d01feb now staged: resolve mock cursor+inventory, combine census/replay-aware readers and retention, retain production process identity and zero-timer event backend. Incoming raw evidence has whitespace; source-only diff check passes, raw logs preserved verbatim. Separate browser fixture adaptations follow, no deployment.
Production-batch restart fallback started on release-prod-4 at69babc9237457a8dd30a20ba596c730b44414e79, with ended-sessions14d01feb staged. Read all #174 comments; no parent linked. Unmodified restart::tests probe reproduces cold_exec_with_closed_stdin_keeps_the_image_pinned_and_maps_null FAILED and two>60s stalls (closed_reply/default_restart); owned120s guard returns124. Harness mode0775 under inherited umask0002, matching #174's strict validator fixture defect. evidence/prod4/restart-before.log preserves output. After the second merge, port only4fcba8a6 and
e1749321as separate logical test commits; existing #174 attach-credit/discovery state fixes are already present through terminal-fidelity. No unrelated dev history or production restart change.Second-merge checks:fmt/all-target/all-feature touched-crate clippy PASS; tracer159PASS/0FAIL,check/build/transfer PASS(critical gzip293781/Brotli244262B,deferred49714/43933B). Default agent42+2transport PASS; shim73+detach2/mouse1/pidfd2 PASS; queue1/review8 PASS. Two broad server runs each191PASS/1auth-socket-close FAIL; fresh_delete passes unchanged isolated1.44s and server_setup_echo passes unchanged isolated1.73s. Full unchanged server replay underway; failures retained, no waiver.
Imported restart-discovery fixture fails at agent_sessions.rs:197 with ENOENT because its hard-coded ended-sessions scratch parent is absent (same prerequisite recorded by author). With prerequisite present, agent_sessions3/3 and zero-idle/unsolicited-exit1/1 PASS(9.00s). Separate fixture adaptation will create the parent and honor the existing state root; no production change.
Fresh staged-head stripped x86 image20205936B (+112160B vs independently built live20093776B), no interpreter; ARM building. Full head browser55PASS/6FAIL: all7 ended-session cases, census-ordering and both query replay cases PASS. Four timing failures reproduce on live; addhost watchdog and manager extra-JS first-run failures are under interleaved controls. Invalid duplicate-port baseline attempt retained as browser-base-2-invalid.log; valid fresh-port baseline2 has2PASS/4knownFAIL. Query fixture setup barrier and in-worktree evidence path pass2/2(45.5s), queued as separate test commit. No deployment.
Completed second merge494388821526f8be674eb24a43dab5f955cf28f9. Full default server replay192PASS/0FAIL/15ignored(490.99s), including both previously intermittent auth cases; raw failures retained, no waiver. Agent42+transport2, shim73+detach2/mouse1/pidfd2, queue1/review8, real-session3 and idle-exit1 pass.
Separate follow-ups:4a4ead30 ports reviewed private restart fixtures;
e0fb30a9ports bounded9s exec deadline; each fmt/CLI all-target/all-feature clippy PASS and16/16 restart tests PASS(7.36s/7.34s).c5dc93b0reuses parent-creating state root: red ENOENT preserved, green3/3/16survivors discovered6ms.Additional #160 queued-live-query finding repaired in8ab20914, regression/setup coverage38a09ea8. Before: full live suffix received/painted,0 reply bytes for15s. After: all3 production-renderer regressions PASS(56.8s), including exact fence; tracer159PASS/0FAIL/10958 assertions/check/build/transfer PASS. Critical gzip293817/Brotli244107B; deferred49717/43905B. No engine/wire/timer change. First attempted green run hit another job's backend port5355; fresh16404/16405 run is valid.
Code head38a09ea879d64145e8f4ed69213b0c6af7013df0. Rebuilding final x86/ARM images, remote-feature tests and full final browser replay underway; native interleaved perf-VM comparison and final fast gate remain. No deployment.
Native data-path comparison on infraternal-perf-test, Debian6.12.69, x86_64,4CPUs, CPUWeight10000, shared flock, identical real-PTY fixture, RTT0,1000samples/condition. Interleaved B1/H1/B2/H2/B3/H3. Base1f77a449 imageSHA256 f5fcda1a36f2270e458a1598a35d444f542a826b6d49fc88f0f876497b25fed1; code-head38a09ea8 image b8450a258fa701a2149a73747c8f0de4db787cf047611387fcc4fae23e3b02df.
PTY-echo p50/p99ms: B1 .31/.62, H1 .80/2.70; B2 .77/3.31,H2 .56/3.34; B3 .57/2.25,H3 .39/1.63. Median run p50 .57->.56; median run p99 2.25->2.70, within overlapping run variation (base .62..3.31/head1.63..3.34); all typing references below D41's5ms. No reproducible head slowdown beyond observed noise; no significance claim. All head runs pass native fixture budgets. Base3 fails same-session flood growth23.12ms>16.67ms; retained, not discarded. Median same-flood echo p99 base18.31/head16.12ms. VM load rose .33/.12/.03->1.02/.35/.11 during finite fixture flood bursts; all cleaned by existing fixture. Complete evidence: evidence/prod4/perf-interleaved.log; reproducible runner perf-interleaved.sh. No VM builds/account/host-key changes.
Final documentation head8d78e598f93a5611f21ba09b60132e0ed32d0624: exact-head fast replay fmt/VTfmt/clippy/deny PASS; test FAIL in daemon_census_retry_tests.rs:121(5s setup wait, before retirement assertions),65other agent tests PASS. This matches the setup timeout already recorded by author/reviewer on#168; no waiver. Unchanged isolated test and full exact-head replay are running. Complete code milestone at160add59 previously passed every workspace test. Static cap remains unchanged/FAIL. Final output and push await the full replay.
Confirmed cause of final-head setup timeout, not a host-load waiver: diagnostic reports daemon outcome Ok(Err(WouldBlock, "control reply queue full")) before retirement. HeldCensus supplies Hello plus8Pings in one ready read, so initial census+8Pongs can fill9 replies into8 slots before writer consumes the census. The intended saturation fixture needs the initial census already held in write(). Fix only the test: split greeting delivery and wait for census write readiness before releasing queued Pings; preserve all8Pongs, capacity retry, no-inbound-traffic retirement and existing deadlines/assertions. Source diagnostic and original red outputs preserved under this job scratch; they will be committed with evidence. No production/wire/engine/budget change.
Production batch 4 finished and pushed only release-prod-4 at
74305cc690; no deployment. Ordered merge commits69babc92(27db08cf) and49438882(14d01feb); excluded CA branches and64d4e213. Follow-up commits retain production lifetime checks, repair replay/live query suppression with failing-first production-renderer coverage, port reviewed #174 restart fixture fixes, and fence census/Attach fixture setup races.Final exact-head scripts/verify fast (exit 1, only unchanged historical static cap):
Full exact-head raw output: /home/kayg/.cache/codex-scratch/prod4/fast-final-corrected-head.log. Committed complete milestone output: evidence/prod4/fast-milestone-retry.log. fmt/clippy and touched default/remote tests pass: agent 42/66, server 192/301, shim 73; 16 restart tests pass. Session scripts and zero-idle canary pass. Tracer check, 159 source tests/10958 assertions, build and transfer budget pass; separate TS fast 36 tests/34462 assertions pass. Raw gate outputs, screenshots and controls: evidence/prod4/; narrative: docs/verification/production-batch-4.md.
Browser final broad run 57/62: four persistent failures reproduce on live
1f77a449; fifth was saved-Close fixture Attach race, repaired and verified 7/7. Replay/query regression suite 3/3. No browser or product budget relaxed.Perf VM interleaved B1/H1/B2/H2/B3/H3, 1000 samples/condition, flock + CPUWeight10000: PTY p50/p99 ms base .31/.62, .77/3.31, .57/2.25; head .80/2.70, .56/3.34, .39/1.63. Median run percentiles .57/2.25 -> .56/2.70; overlapping ranges and mixed paired deltas, no reproducible slowdown beyond observed noise. All head latency budgets pass. Zero daemon activations at 200 real sessions over 2.203s; RSS5452KiB; 200 exits p50/p99 8979/31935us, max42160us at load57.08/52.71/52.83.
Stripped static x86 base20093776 -> head20205936 bytes (+112160, +.558%); arm18010544 bytes, no PT_INTERP. Historical caps16404816/13817816 already exceeded on live base (x86); not changed. Review checklist recorded in report. Temporary baseline/build targets removed after preserving images/logs. Issues left open.
Orchestrator: DEPLOYED to production at 09:13 UTC (14:43 IST): release-prod-4 @
3aec316e= live1f77a449+ terminal fidelity (#160/#161) + ended sessions (#168) + live web fixes (3w) + settings rows (text never collides). Binaries built from61bdbd9f(later merges are web-only); sha256 prefixes x86 2af382ef / arm 8fd4d67f match on host. healthz 200, public 200, 0 errors in journal, 23 shims survived the restart. Settings round-trip evidence (#161): base1f77a449accepted 190-200 stray PTY bytes after Settings return; head 0 across five cycles, background/foreground and reconnect. Restart re-locked the CA: owner unlock needed. Perf VM latency A/B (prod-batch-4 report): p50/p99 0.57/2.25 → 0.56/2.70 ms, overlapping.Closed by the orchestrator during the 2026-10-28 handover (#254), on the owner's request to close finished issues. Evidence: Ended-sessions fix deployed in release-prod-4
3aec316e(in dev and prod-live) after review rounds 2-3; last comment is the deploy record. Reopen if anything is still missing.kayg referenced this issue2026-10-28 17:53:55 +00:00