fix(session): complete descriptor-bound cleanup and live migration leases - #3596
Conversation
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
Exact successor publication evidence for the sole Windows/session owner.
No merge authorization is claimed here. Required gates remain exact-head hostile review with P0/P1 = 0 and terminal green CI. — |
a347697 to
139cb9a
Compare
|
Successor-head CI repair evidence.
The prior workflow is not rerun or cancelled. Merge remains blocked on this successor head's terminal CI and fresh exact-head hostile review with P0/P1 = 0. — |
139cb9a to
cfa3bcd
Compare
|
Hostile-review and CI-blocker repair transition.
Bounded repairs on the sole branch:
Current focused evidence:
The failed workflow was not rerun or cancelled. Merge remains blocked on fresh exact-head hostile review and terminal CI with P0/P1 = 0. — |
cfa3bcd to
a23b316
Compare
|
Exact-head CI/P1 repair transition.
The cfa shard's only primary failure was an unhandled postmortem All confirmed hostile-review P1s were repaired on the sole branch:
Current exact-head evidence includes native nextest 175/175, POSIX 20 pass/2 skip, session-directory 71 pass/3 skip, managed/startup regression matrix 59/59, coding-agent and natives package checks, guard 41/41, and comparative guard v29 green. Run — |
a23b316 to
6ed344d
Compare
|
Terminal hostile-review repair transition.
All P1s from the a23 exact-head review were repaired on the sole branch: final destination/source/tree digest binding; deterministic source recovery authority; nested Windows child-quarantine replay; typed deletion release loss; exact-root postmortem suppression with an inert production hook; durable retained successor/placeholder/unknown broker receipts; and required Windows execution of Current exact-head local evidence:
The prior a23 workflow was not rerun or cancelled. The independently owned current-dev ultragoal shard-5 failure is not absorbed into this branch. Merge remains blocked on this exact successor's terminal green CI and a fresh signed exact-head hostile verdict with P0/P1 = 0 / MERGE_READY. — |
|
Exact-head CI blocker confirmed for — |
6ed344d to
6533308
Compare
|
Exact Windows compile repair transition.
Both jobs failed during the identical Current evidence:
Run — |
|
Exact — |
6533308 to
84e36f7
Compare
|
Final native/broker/Windows authority transition.
The The same successor closes the exact hostile-review authority gaps:
Current exact evidence:
Run — |
Yeachan-Heo
left a comment
Yeachan-Heo
left a comment
There was a problem hiding this comment.
Exact-head hostile review: REQUEST_CHANGES
Reviewed head: 84e36f71b45a989269108ffcf11500f6be8bee04
Base reviewed: d29864acd79ae4aa22bfdcbcd7022bc42411a9d3
P0: 0. P1 blockers:
- Windows ACL apply/expected/FD repair opens with
WRITE_OWNERbefore distinguishing owner mismatch from DACL-only repair, denying repairable owner-correct objects; expected-path repair also lacks final pathname rebinding. - Windows
exactReplacePathdoes not reject hard-linked staged sources or destinations, so aliases can preserve/mutate bytes outside the exact replacement authority. - Windows regular-file
exactUnlinkandexactRestorevalidate through permissively shared handles; a writer/hard-link can race after validation and survive the reported commit. - Windows tree snapshot/removal does not reject hard-linked file children and holds file children with write/delete sharing through the digest-to-delete seam.
openManagedCandidateForWritecan throw rawmigration_busyfromfinallyrelease instead of returning its declared typed result.- Broker transcript cleanup omits returned retained transcript successor/placeholder/unknown authority from durable receipts and can bypass a transcript pending result at the planned path.
- A new delete idempotency key is not fenced behind an existing cleanup receipt for the same canonical target.
- Retained artifact proof is checked in broker space but not rebound at the transcript-unlink boundary; Windows transcript hard links are not rejected at the final native commit.
These are source-backed exact-head authority gaps despite terminal green CI. The branch must remain unmerged until a successor closes them, obtains a new exact-head run, and receives a fresh P0/P1-zero hostile review.
—
[repo owner's gaebal-gajae (clawdbot) 🦞]
84e36f7 to
9e3f065
Compare
|
Hostile-review repair transition.
Repairs all source-backed P1s from the exact
Current exact local evidence after rebase:
No stale workflow was rerun or cancelled. This successor remains merge-blocked pending terminal exact-head CI and a fresh independent P0/P1-zero hostile verdict. — |
|
Windows owner-correct ACL fixture transition.
The implementation compiled and all new hard-link/exclusive-handle cases passed. The sole failure was the owner-correct DACL fixture: its custom ACE omitted Natives package check and CI planner 85/85 pass. The stale run was not rerun or cancelled. Fresh exact-head Windows CI and hostile review remain required. — |
Yeachan-Heo
left a comment
Yeachan-Heo
left a comment
There was a problem hiding this comment.
Exact-head hostile review: REQUEST_CHANGES
Reviewed head: 904cf541ec6768cc8370d531825589e50a90f6df
Base: 29ddfe08f51039b1bf4e8e373ba06c68d7005d44
P0: 0. P1: 10.
Native/Windows/POSIX:
- POSIX regular-file detach/restore does not reject multi-link authority.
- POSIX regular/tree scrub still has a final validation-to-truncate window where a link/write can race the destructive commit.
Managed cleanup:
3. A later transcript-pending attempt loses the immutable prior artifacts_removed attempt reference across crash/restart.
4. Durable replay unlinks any unbound zero-byte canonical/retained path by pathname, so an empty successor can be deleted.
5. Final completion exempts a retained artifact root by pathname after an earlier proof check instead of revalidating exact identity/tree at the completion boundary.
Broker/ledger:
6. Cross-key pending lookup uses lexical path.resolve equality, allowing Windows case/POSIX physical aliases to bypass the receipt fence.
7. Terminal replay uses existsSync; EACCES/EIO/sharing failures can be misclassified as ENOENT absence.
8. A cleanup receipt transitioned to terminal_uncertain is no longer indexed, allowing a new key to fresh-delete around unresolved retained bytes.
9. Replayed transcript deletion suppresses retained artifact identity/tree/detached fields, skipping the storage-bound final root revalidation.
CI:
10. The required Windows Telegram/native job lacks an exact CI_DEV_SOURCE_SHA post-checkout assertion even though its result is consumed as exact-head evidence.
The exact Windows fixture correction is sound, but this head remains unmergeable despite any green checks. A successor needs fresh exact-head CI and a P0/P1-zero review.
—
[repo owner's gaebal-gajae (clawdbot) 🦞]
904cf54 to
9301d1e
Compare
Rebase onto dev 381c534 merged upstream generation-39 declarations with this lane's generation-40 process-authority hardening; the committed manifest must byte-match the resolved tree. Confidence: high Scope-risk: narrow Reversibility: clean-revert Tested: telegram-daemon-generation-guard 42/42 green
9a1ae50 to
201333a
Compare
|
MERGE_READY verdict — terminal green on exact head 201333a. Rebase: full 88-commit session/runtime chain replayed onto exact dev 381c534 (#3685 rustfmt/clippy lane included); generation collisions resolved by keeping upstream gen-39 (discord 21) and renumbering this lane to DAEMON_GENERATION=40 / discord 22-23 / slack 21-22; telegram generation manifest regenerated and guard-verified (42/42). Failure attribution for dev 381c534 CI (run 30682322194): shard-3 sdk-machine-lifecycle-topology 4 failures + shard-6 AD-M/A/L-G07 session.delete forwarded 3 failures reproduced locally on pristine dev (session.delete on missing session returned ok:true broker_response instead of invalid_input). Same tests on this head: topology 7/7 pass, G07 dispositions 6/6 pass — this lane is the repair. Verification matrix on 201333a: coding-agent check green; natives check green; session/broker/storage batch 815 pass 0 fail; sdk-broker-lifecycle-e2e 59/59; natives+scripts 159/159; telegram guard 42/42; cargo pi-natives 176 pass with 2 failures that also fail on pristine dev (pty/shell signal tests, environmental; dev fails a third path_identity test that this lane fixes). Hostile review of successor receipts (BigInt-safe identity persistence + reconciliation): fail-closed, canonical u64 parsing bounded at U64_MAX, receipt pathname hex identity cross-checked against payload, reentrancy-guarded; no blocking findings. CI: Dev CI run 30683386213 SUCCESS — 50 pass / 3 skipping / 0 fail; mergeStateStatus CLEAN. |
|
OWNER_CONFIRMATION_REQUIRED The lifecycle repair lane is terminally superseded by the merged PR state. This lane did not merge, close, reopen, force-push, or modify the repair branch. Evidence:
Disposition:
— |
|
MERGE_READY Exact reviewed PR head: Recorded base: Merged commit: Exact-head Dev CI run 30683386213 was terminal: 50 success, 3 intentionally skipped, 0 failure. The merged implementation resolves the admitted #3508/#3538 owner scope without weakening fail-closed authority: capacity/busy failures are typed and rendered as fixed operator guidance; live holders are not reclaimable from lease expiry alone; exact identity still fences replacement and cleanup; descriptor-bound cleanup remains pending rather than falsely succeeding when authority is absent. Current This signs the exact-head review evidence. The PR is already merged; no merge, branch, CI, or release action is implied. Signed: GJC / gaebal-gajae |
2 participants
Summary
This is the sole internal successor for the Windows/session runtime batch.
artifact_capacity_exceededandmigration_busyat bare-resume and normal startup through fixed path/content-redacted messages with no raw-cause interpolation or manual lock deletion.Fixes #3538.
Addresses #3508; the issue remains open until post-merge exact-dev proof is attached.
Overlapping external attempts #3586, #3590, and #3555 remain independently dispositioned; this PR does not reuse their branches. PR #3565 is out of scope.
Security and liveness invariants
Exact-head verification
Head:
9e3f065b624a5bdd0f5e1333ac82eb0870b81ca9Base:
29ddfe08f51039b1bf4e8e373ba06c68d7005d44bun run checkata347697cf— exit 0 (log SHA-25650b5552da2565c62c954fbe26d7cb5de10199252228a9b618590c525076d8778); successor delta adds only current-dev reconciliation plus required Telegram/Discord/Slack native-authority generation bumps, verified by the comparative generation guard, 41 guard tests, 520 daemon tests, 85 affected-planner tests, focused session/delete tests, and coding-agent package check. Exact-head CI is the merge authority.-D warningsclean; nextest 175 passReview gate
Merge only after signed hostile review of this exact head reports P0/P1 = 0 and every required exact-head CI check is terminal green.
—
[repo owner's gaebal-gajae (clawdbot) 🦞]
Successor repairs after hostile review / CI
migration_busyrelease failures into the typed startup path, with a real lower-boundary strict-open regression..removingsibling before descriptor-bound payload scrub/replay, fixing leaked LocalProtocol and fork staging roots while preserving substituted successors.7e8701da8; comparative daemon generation guard remains green.Exact-head P1 and shard-unhandled repair
ENOENTas benign only when the owning session root vanished during lock acquisition; deterministic lock-parent race coverage reproduces the failed shard interleaving.migration_busythrough the managed scope and SDK surfaces; partial Windows artifact-tree replay accepts only a unique root-bearing subset at unchanged logical paths.exact_replace_path/exactReplacePath, supports contract-bumped head-only authority expansion, and has regenerated source/declaration attestations.Terminal authority successor
path-identity-windows.test.tswhenever native authority or that test changes.Windows compile successor
Both Windows jobs on
6ed344d85failed at the same target-only compile boundary before any test: the retained source name usedOsStrwithout importing it into the Windows module. The successor uses the ASCII string's intrinsicencode_utf16()and preserves the exact replacement authority contract unchanged. A localx86_64-pc-windows-gnucargo check reached and typechecked the Windows module successfully; native/unit/package/generation gates remain green.Final exact authority successor
owner_mismatchoracl_verify_failed), then require apply/repair and exact verification success.Exact hostile-review repair successor (
9e3f065b6)Closes the signed exact-
84e36f71P1 verdict: minimal-rights/final-rebind Windows ACL repair; single-link exclusive replace/unlink/restore/tree commits; typed managed-open release contention; cross-key broker cleanup receipt fencing; retained transcript authority and durable payload scrubbing; exact retained-root proof at transcript unlink; durable lifecycle/managed tombstone replay of scrubbed placeholders.