---
name: v041-linux-respawn-blocker
description: v0.4.1 fleet roll found a Linux brain-respawn-path bug; restoration close BLOCKED pending v0.4.2 fix
metadata: 
  node_type: memory
  type: project
  originSessionId: f3f208d9-9c31-4aaa-acfc-98acbfdf2509
---

v0.4.1 (counter 8) PUBLISHED 2026-06-11 (deployah, PR #4 merged @ 038257b, tag v0.4.1). Fleet roll surfaced a **Linux seamless-update bug** → restoration close BLOCKED, v0.4.2 needed.

**hfenduleam (Windows): GREEN.** apply → brain pid 38324→6620, gen 0→1, broker pid 17232 UNCHANGED, exe_hash 81c24675(0.4.0)→728a1bfc(0.4.1 win artifact), pump STALLED 16199s→live. No-bounce PROVEN on Windows.

**kitsubito (Linux): RED.** apply recorded "applied v8" (applied-state phase:applied, no rollback), canonical `/home/reavus/.local/bin/spt` correctly swapped to 35c9544c (v0.4.1 linux artifact) — BUT respawned brain (pid 1247825, gen 1) execs `.local/bin/spt.old-8` = b4b7ea14 (v0.4.0). **Brain runs OLD bytes while recording success.**

**ROOT CAUSE (code-confirmed `brainproc.rs:815-818`):** candidate respawn `binary=None` → `std::env::current_exe()`. Linux `apply` renames running `spt`→`spt.old-N`, writes new bytes to `spt`; resident broker's `current_exe()` follows the rename to `.old-N`, so the new brain execs old bytes. Rollback path `Some(.old-N)` is fine; the NORMAL path is wrong. Windows dodges it (can't rename a running PE in place). `current_exe_hash()` (l.324) also reads current_exe → breadcrumb honestly showed old bytes; doyle's bytes-level exe_hash assert is what caught it (readiness gate passed on the old brain = false-success).

**E2E gap (`brain_survive.rs`):** models swap as a PATH-FLIP between two distinct fixtures (fixture_a→fixture_b), never an in-place rename — so `current_exe()`-follows-rename is never exercised; CI green on kitsubito while prod fails.

**STATUS 2026-06-11 (build done):** v0.4.1 PUBLIC (counter 8). hfenduleam rolled GREEN (Windows leg DONE). kitsubito left as-is (v0.4.0 brain, applied:8 uncorrected = appendix evidence). **V042-PLAN.md doyle-SIGNED.** v0.4.2 fix BUILT on branch fix/v0.4.2-brain-respawn-path, **PR #5** open, CI both runners running. Commits: T1 doc 8aa309e (mint REQ + KH 6.11 + ADR-0018 Q3 amend), T2+T3 impl+unit be626bf (Half1 canonical capture + select_brain_exe; Half2 bytes-gate + ReleaseCache::staged_artifact_hash + TrialEnv ready_exe_hash/staged_artifact_hash; PROMOTE_BYTES_UNVERIFIED loud degrade per doyle), T4 int f69e0cd (brain_respawn_rename.rs — real broker proc, in-place rename P→P.old-N, respawn must run B; fails Linux pre-fix, closes brain_survive path-flip gap), T5 release (bump 0.4.2 + changelog). Local gates all green; traceable REQ [doc,impl,unit,int] all +. Operator chose **debug-channel rollout** for final Linux observation. NEXT: CI green → ping doyle pre-merge → merge → deployah publishes **counter 9** → kitsubito+enlyzeam one bounce each (final) → debug rollout → restoration close.

**v0.4.2 plan (deployah+todlando aligned; doyle confirmed ruling):**
- R1 mint `REQ-HAZARD-BRAIN-RESPAWN-PATH`: respawn must exec applied bytes via resolved canonical install path (captured at broker boot, pre-rename), never current_exe/.old-N.
- R2 tighten readiness-success: promotion asserts respawned exe_hash == applied artifact hash (close false-success hole).
- FIX brainproc.rs candidate spawn → canonical install path.
- TEST Linux in-place-rename apply E2E asserting respawned exe_hash == artifact.
- GATES + CI both runners → deployah publishes **counter 9**.
- FLEET: resident v0.4.0 brokers can't self-fix → v0.4.2 needs a **one-time MANUAL broker bounce on Linux** = project's actual FINAL manual bounce, paired with enlyzeam catch-up. THEN restoration close.

**FLEET ROLLED + RESTORATION CLOSING (2026-06-11):** v0.4.2 PUBLIC counter 9 (deployah). All 3 nodes on v0.4.2: kitsubito(Linux) apply+final bounce → fixed broker, exe_hash 500a9e7b; enlyzeam(Win) v0.3.2→v0.4.2 + final bounce (perennial laggard caught up, two-process now, gerald re-attached) — these were the project's FINAL TWO manual bounces; hfenduleam(Win) SEAMLESS v0.4.1→v0.4.2 no-bounce (broker pid 17232 held across 0.4.0→0.4.1→0.4.2). Operator chose CLOSE ON CURRENT EVIDENCE (not debug-rollout): green-on-Linux-CI brain_respawn_rename.rs E2E + fixed-broker fleet + Windows live-seamless ×2; live Linux FIELD-seamless rides next real release (v0.4.3). RESTORATION MILESTONE CLOSED — PR #6 merged to main @ 55c4e59 (doyle-approved; ROADMAP ✅ + KH 6.7/6.8 close-outs). Merged branches tidied. NEXT track = spt-claude-code (own repo, own scoping). Don't re-plan restoration. GOTCHA learned: `spt daemon start` over an ELEVATED ssh hits the no-unelevated-identity guard → use the at-logon scheduled task (Start-ScheduledTask 'spt-core daemon') for an unelevated Win daemon start. FLAG: CONTEXT.md has an unrelated uncommitted "Gateway" endpoint concept (2026-06-11 grill, spt-lecturn/Playdate) — not mine, left untouched.

See [[v040-published-fleet-rolled]], [[pump-ipc-deadline-fix]], [[v042-published]].