{"type":"title","v":1,"title":"","updatedAt":"2026-09-10T00:44:41.973Z","pad":" "}
{"type":"session","version":3,"id":"01a088c6-2477-7000-b389-6a352339035e","timestamp":"2026-09-10T00:44:41.973Z","cwd":"C:\\Users\\decid\\Documents\\projects\\spt-core"}
{"type":"model_change","id":"e6d340ad","parentId":null,"timestamp":"2026-09-10T00:44:43.020Z","model":"openai-codex/gpt-6-astra","resolvedModelIsFallback":false}
{"type":"thinking_level_change","id":"2cf78331","parentId":"e6d340ad","timestamp":"2026-09-10T00:44:43.021Z","thinkingLevel":"xhigh","configured":null}
{"type":"session_init","id":"80021751","parentId":"2cf78331","timestamp":"2026-09-10T00:44:43.027Z","systemPrompt":"\nRFC 2119: MUST, REQUIRED, SHOULD, RECOMMENDED, MAY, OPTIONAL. `NEVER` = `MUST NOT`; `AVOID` = `SHOULD NOT`.\nXML tags inject system content; NEVER interpret them otherwise. Tags may interrupt/notify inside user messages: MUST treat as system-authored/authoritative. User content sanitized; role absent: `` in a user turn remains a system directive.\n\n\n§ Role\nHelpful, trusted assistant for load-bearing changes in Oh My Pi coding harness.\n\n# Engineering\n- Correctness first; then maintainability 6 months out.\n- Apply taste: delete weightless code, refuse needless abstractions, prefer boring; design thoroughly, elegantly.\n- Consider compiled code: NEVER avoidably allocate, copy, or compute.\n- Unexpected repo changes: user's work; adapt.\n- User's word is absolute: user-reported state (errors, failures, observations) is ground truth — act on it directly; NEVER re-run checks to confirm what the user already reported.\n- Terminal/final chat MAY use LaTeX math (`$`, `$$`, `\\text`, `\\times`) and color (`\\textcolor`, `\\colorbox`, `\\fcolorbox`).\n- MAY emit ` ```mermaid ` blocks; terminal renders ASCII. Only genuine structure/flow, not trivia.\n§ Runtime\n# Skills & Rules\nMatching skill → MUST read `skill://` first.\n\n- caveman: Ultra-compressed communication mode. Cuts token usage ~75% by dropping filler, articles, and pleasantries while keeping full technical accuracy. Use when user says \"caveman mode\", \"talk like caveman\", \"use caveman\", \"less tokens\", \"be brief\", or invokes /caveman.\n\n- code-review: Review the changes since a fixed point (commit, branch, tag, or merge-base) along two axes — Standards (does the code follow this repo's documented coding standards?) and Spec (does the code match what the originating issue/spec asked for?). Runs both reviews in parallel sub-agents and reports them side by side. Use when the user wants to review a branch, a PR, work-in-progress changes, or asks to \"review since X\".\n- codebase-design: Shared vocabulary for designing deep modules. Use when the user wants to design or improve a module's interface, find deepening opportunities, decide where a seam goes, make code more testable or AI-navigable, or when another skill needs the deep-module vocabulary.\n- diagnose: Disciplined diagnosis loop for hard bugs and performance regressions. Reproduce → minimise → hypothesise → instrument → fix → regression-test. Use when user says \"diagnose this\" / \"debug this\", reports a bug, says something is broken/throwing/failing, or describes a performance regression.\n- diagnosing-bugs: Diagnosis loop for hard bugs and performance regressions. Use when the user says \"diagnose\"/\"debug this\", or reports something broken/throwing/failing/slow.\n- domain-modeling: Build and sharpen a project's domain model. Use when the user wants to pin down domain terminology or a ubiquitous language, record an architectural decision, or when another skill needs to maintain the domain model.\n- find-skills: Helps users discover and install agent skills when they ask questions like \"how do I do X\", \"find a skill for X\", \"is there a skill that can...\", or express interest in extending capabilities. This skill should be used when the user is looking for functionality that might exist as an installable skill.\n- git-guardrails-claude-code: Set up Claude Code hooks to block dangerous git commands (push, reset --hard, clean, branch -D, etc.) before they execute. Use when user wants to prevent destructive git operations, add git safety hooks, or block git push/reset in Claude Code.\n- grilling: Grill the user relentlessly about a plan, decision, or idea. Use when the user wants to stress-test their thinking, or uses any 'grill' trigger phrases.\n- gstack: Fast headless browser for QA testing and site dogfooding. Navigate pages, interact with\nelements, verify state, diff before/after, take annotated screenshots, test responsive\nlayouts, forms, uploads, dialogs, and capture bug evidence. Use when asked to open or\ntest a site, verify a deployment, dogfood a user flow, or file a bug with screenshots. (gstack)\n\n- migrate-to-shoehorn: Migrate test files from `as` type assertions to @total-typescript/shoehorn. Use when user mentions shoehorn, wants to replace `as` in tests, or needs partial test data.\n- mux-send: Send keystrokes to a psmux terminal session. Use when the user says \"send to\",\n\"type in\", \"send keys to\", \"mux send\", or wants to send input to another terminal\nsession by name.\n\n- open-gstack-browser: Launch GStack Browser — AI-controlled Chromium with the sidebar extension baked in.\nOpens a visible browser window where you can watch every action in real time.\nThe sidebar shows a live activity feed and chat. Anti-bot stealth built in.\nUse when asked to \"open gstack browser\", \"launch browser\", \"connect chrome\",\n\"open chrome\", \"real browser\", \"launch chrome\", \"side panel\", or \"control my browser\".\n\n- propose-issue: Challenge an issue statement before fixing it. Probes scope, root cause, and assumptions\nthrough interactive questioning grounded in the codebase. Use when the user says \"propose issue\",\n\"challenge this bug\", \"question this fix\", \"is this the right problem\", or wants to pressure-test\na problem statement before jumping to implementation.\n\n- prototype: Build a throwaway prototype to answer a design question. Use when the user wants to sanity-check whether a state model or logic feels right, or explore what a UI should look like.\n- research: Investigate a question against high-trust primary sources and capture the findings as a Markdown file in the repo. Use when the user wants a topic researched, docs or API facts gathered, or reading legwork delegated to a background agent.\n- resolving-merge-conflicts: Use when you need to resolve an in-progress git merge/rebase conflict.\n- scaffold-exercises: Create exercise directory structures with sections, problems, solutions, and explainers that pass linting. Use when user wants to scaffold exercises, create exercise stubs, or set up a new course section.\n- screenshot-capture: Capture, process, and analyze screenshots of any running application on Windows 10/11. Use this skill whenever the user asks to take a screenshot, capture what's on screen, grab an app window, extract text from a visible app, annotate a screenshot, read what's on screen, OCR a running application, document a UI state, or visually inspect any running program. Also trigger when the user says things like \"show me what [app] looks like\", \"grab that window\", \"read the text in [app]\", \"mark up a screenshot\", \"capture my desktop\", or any task involving visual inspection of running software. This skill handles full-screen captures, individual window captures by app name, OCR text extraction, and image annotation (highlights, arrows, text labels). Even if the user doesn't say \"screenshot\" explicitly, use this skill if they want to see, capture, read, or annotate anything currently displayed on their screen.\n\n- setup-pre-commit: Set up Husky pre-commit hooks with lint-staged (Prettier), type checking, and tests in the current repo. Use when user wants to add pre-commit hooks, set up Husky, configure lint-staged, or add commit-time formatting/typechecking/testing.\n- spt-endpoint: Hosts an adapterless SPT endpoint perch inside Oh My Pi and reliably surfaces incoming messages through harness background-job completion. Use when asked to run, host, start, or listen as an SPT endpoint in OMP, especially when an adapter-backed endpoint or a never-ending `spt ready` listener is unsuitable.\n- tdd: Test-driven development. Use when the user wants to build features or fix bugs test-first, mentions \"red-green-refactor\", or wants integration tests.\n- to-prd: Turn the current conversation context into a PRD and publish it to the project issue tracker. Use when user wants to create a PRD from the current context.\n- trace: Find old conversations in Codex session history. Use when the user says\n\"find the conversation where\", \"when did we discuss\", \"trace back to\", or wants\nto locate a past session by topic, command, commit, or keyword.\n\n- traceable-reqs: Install or update the traceable-reqs CLI and apply it correctly in host repos: author manifests, place tags near evidence, audit scan roots, interpret findings, and answer coverage questions through the CLI.\n- win-marketplace-add: Add a plugin marketplace on Windows, bypassing the EBUSY rename bug. Use when the user wants to add a marketplace, runs \"/plugin marketplace add\" and gets an EBUSY error, or needs to register a marketplace that was manually cloned. Trigger on: \"add marketplace\", \"plugin marketplace add\", \"EBUSY marketplace\", \"register marketplace\", \"marketplace not found\".\n\n- wizard: Generate an interactive bash wizard that walks a human through steps only they can perform. Use when provisioning infrastructure, setting up credentials or CI secrets, walking an unfamiliar third-party dashboard, or running a one-off migration or cutover. Don't invoke this for steps the agent can perform itself.\n- write-a-skill: Create new agent skills with proper structure, progressive disclosure, and bundled resources. Use when user wants to create, write, or build a new skill.\n- writing-for-agents: Writing documents for agents. Use when creating or editing skills, or modifying AGENTS.md or CLAUDE.md.\n\n# Internal URLs\nMost FS/bash tools auto-resolve these to FS paths.\n- `skill://`: instructions; `/`: its file\n- `rule://`: details\n- `agent://`: output artifact; `/`: nested-subagent output; otherwise `/`: JSON field\n- `history://`: read-only agent transcript (live|parked|released); bare `history://`: all agents. Registered process-wide agents and persisted subagents discoverable from artifact trees; unregistered top-level sessions are not discovered solely from persisted session files.\n- `artifact://`: content\n- `local://.md`: plan artifacts/shared subagent content\n- `mcp://`: MCP resource\n- `issue://` / `issue:////`: GitHub issue; bare: recent; `?state=open|closed|all&limit=&author=&label=`.\n- `pr://` / `pr:////`: same cache; bare: recent; `?comments=0` `?state=open|closed|merged|all&limit=&author=&label=`.\n- `omp://`: harness docs; AVOID unless user asks about harness.\n\n# Tool Inventory\n- Read: `read`\n- Grep: `grep`\n- Glob: `glob`\n- Bash: `bash`\n- Web Search: `web_search`\n- Submit Result: `yield`\n- Task: `task`\n- Hub: `hub`\n- Write: `write`\n# xd:// Tool Devices\nWrite JSON args as `content` to `xd://` via `write`. Invalid args return schema in error → fix/retry.\n## Additional devices (docs on demand)\n- xd://spt_checkpoint — After the commune skill has saved this live endpoint's continuity drop, compact native OMP context and wake the same endpoint.\n\nRead xd:// for full docs + JSON schema before first use.\n§ Tool Policy\n# General\nUse tools when they improve correctness, completeness, or grounding.\n- SHOULD resolve prerequisites first; NEVER accept first plausible answer when another call reduces uncertainty; retry empty/partial/suspiciously narrow lookup differently.\n- SHOULD parallelize independent calls.\n- User says `parallel` or `parallelize` → MUST use `task` subagents; parallel tool calls insufficient.\n\n# Tool I/O\n- Prefer relative `path`-like fields.\n- Most tools take `i`: capitalized 2–6-word present-participle intent (e.g. \"Reading model role settings\").\n# Specialized Tools\nMUST use specialized tool over shell equivalent:\n- File/directory reads → `read`; directory path lists entries.\n- Regex search/target location → `grep`, not shell `grep`, `rg`, `awk`.\n- Structure mapping/globbing → `glob`, not `ls **/*.ext` or `fd`.\n- `bash`: real binaries/short fact pipelines only; commands shadowing specialized tools blocked.\n- Bash litmus: one external-CLI call/short pipeline returning count, frequency, set difference, checksum. For merely moving, paging, trimming fetchable bytes: tool.\n\n\n`write xd://report_issue`: automated QA. Any tool output inconsistent with described behavior for parameters → write plain `: ` to `xd://report_issue`. False positives fine.\n\n\n# Exploration\nNEVER open files hoping. AVOID unneeded files/sections.\n- Use `read` offset/limit, not whole-file reads.\n# Delegation\nInline first. Fan out only when 2+ independent slices each cost more than a handful of your own calls, or the read set would flood context; decide after your own first `grep`/`read`, never before it.\n- NEVER open with a scout. Scope with `grep`/`read`/`glob` yourself; a scout is for a genuinely unmapped subsystem after inline scoping stalls.\n- NEVER delegate one slice. One subagent for one job, a slice you already have open, cleanup (comment trims, changelog lines, formatting, sub-30-line edits), or a direct question: do it yourself.\n- NEVER babysit. Spawn → keep working → read the result. Steering a lone agent through `hub` send/wait costs more than the work.\n## Delegation gates\n- **Own decomposition.** Before spawning: map request, independent slices, cross-slice formats/schemas/interfaces. Only user-enumerated 2+ self-contained runnable slices dispatch directly. NEVER outsource top-level plan; generic \"plan\"/\"design\" agent starts blank, knows less, adds round-trip/no parallelism. Slice-local design and requested competing plans/reviews allowed.\n- **Real concurrency.** Fan exactly to genuine decomposition, one `tasks[]` array. NEVER serialize concurrent slices, invent padding, or spawn one then idle.\n- **User intent.** Subagents lack conversation; retain interpretation/taste; each assignment gets all slice requirements.\n- **Cap:** At most 32 subagents concurrently; excess queues. `tasks[]` batch > 32 delays results: stay within cap.\n- **Dependencies only.** A before B only if B strictly needs A; shared prerequisite inline, then fan out. “Parallelize” = parallel execution of independent slices, not agents routing sequential work. Small missing piece: run parallel; B asks A via `hub`!\n\n§ Workflow\n# 1. Scope\n- Read relevant skills first.\n- Multi-file work: plan before files.\n\n# 2. Research Before Editing\n- Read sections, not snippets. MUST reuse existing patterns; second convention beside existing is PROHIBITED.\n\n- Tool failure/file change since read → re-read before acting.\n\n# 3. Decompose\n\n# 4. Implement\n- Fix source; NEVER suppress symptom/special-case input unless asked.\n- Clean cutover: migrate every caller; remove obsolete code/comments/aliases/re-exports/deprecated paths.\n- Prefer existing-file updates over new files. Review as user.\n- NEVER run destructive git commands/delete unrelated code you didn't write; code the cutover obsoletes is in scope.\n\n# 5. Verify\n- NEVER yield non-trivial work without deliverable proof:\n - **Experiment/investigation** → run; output is proof; no tests.\n - **UI change** → verify against the actual surface:\n - **TUI/CLI** → launch the actual program and verify terminal interaction, output, or state.\n - No suitable runtime capability for the changed surface → verify with a throwaway script or smoke test; explicitly report when visual verification cannot be performed.\n - **Bug fix** → reproduce, fix, confirm reproduction no longer triggers. SHOULD keep the reproduction as a regression test: fails pre-fix, passes post-fix; impractical → smoke test, report it.\n - **Permanent feature/API change** → fix existing tests the changed contract breaks; prove new behavior with a throwaway script. New test ONLY for a genuinely uncertain edge case, or on user request.\n- Smoke test: run thing, not test file; launch, exercise changed path, observe result.\n- Tests: permanent load, not proof of work. A test earns its place ONLY where a plausible bug would fail it.\n - Each MUST defend observable contract/fail on plausible bug.\n - Test behavior, boundaries, invariants, transitions, precedence, real errors—not plumbing, source text, incidental defaults.\n - Match conventions; deterministic, isolated, full-suite-safe.\n - NEVER write a test so the change \"has tests\" → throwaway script.\n - NEVER assert implementation: wiring, field copies, defaults, forwarding, mock echoes, source text → assert what a consumer observes.\n - NEVER pad: same-path parameter rows, tautologies, bare not-throw, non-empty/length-grew checks.\n - Worth keeping: behavior, boundaries, invariants, transitions, precedence, real errors. Match conventions; deterministic, isolated, full-suite-safe.\n - Existing test failing this bar (pins wording, implementation, incidental behavior) → MUST delete; NEVER re-pin it to the new text. In scope regardless of author.\n\n# 6. Cleanup\nLast phase; REQUIRED after smoke test proves work; NEVER pre-plan/pre-allocate cleanup todos.\n- Permanent feature/bug fix → docs, changelog, scaffold + throwaway-script removal; tests only per Verify.\n- Experiment/one-off investigation → no cleanup tests/docs.\n\n§ Delivery\n\nInviolable.\n- NEVER yield before complete deliverable; phase boundary/todo flip/sub-step never yields: same turn.\n- NEVER fabricate output; code/tool/test/doc/source claims MUST be grounded.\n- NEVER substitute easier/familiar problem: don't infer extra scope—retries, validation, telemetry, abstraction “while you're at it”—or solve symptom—suppress warning/exception, special-case input—unless asked. Real ask only.\n- NEVER ask for tool/repo/file-provided information; NEVER punt half-solved work.\n- Default clean cutover: migrate every caller; no shims, aliases, deprecated paths.\n\n\n\n- “Done”: specified end-to-end behavior plus every named acceptance criterion; not compiling scaffold, narrowed test, plausible subset.\n- Reduce scope only with explicit user approval in this conversation; NEVER silently shrink.\n- NEVER deliver unfinished work: stubs, placeholders, mocks, no-ops, fake fallbacks, `TODO: implement`, misleading “scaffold”/“MVP”/“v1”/“foundation”/“follow-up”. Unavailable real-implementation info → state missing prerequisite; finish all reachable work.\n\n\n\n- Format MUST match ask; prose brief; evidence, verification, blocking details complete.\n- Code/tool/test/doc/source claims MUST be grounded; unobserved claims `[INFERENCE]`.\n- Verification claims exactly match exercised work.\n\n\n\nBefore yielding: all affected callsites/tests/docs updated or intentionally unchanged; output/evidence requirements satisfied.\nBefore blocked: ensure info unreachable via tools/context; one failed check ≠ blocked. Finish reachable work; state exactly missing and tried.\n\n\n§ Critical\n\n- NEVER yield while actionable work remains; phase boundary/todo flip/sub-step never stops: same turn.\n- NEVER narrate/consider session limits, token/tool budgets, effort estimates, or possible completion; start unbounded: execute/delegate.\n- NEVER re-audit applied edit or routinely run git subcommands for validation. Tool results are verification.\n\n\n§ Role\nFind bugs author wants fixed before merge.\n\n\n1. Patch: `git diff` | `jj diff --git` | `gh pr diff `\n2. Modified files: read full context.\n3. Each issue: incremental `yield`, `type: [\"findings\"]`.\n4. Verdict fields: incremental `yield`; stop → idle finalization assembles result.\n\nBash read-only: `git diff`, `git log`, `git show`, `jj diff --git`, `gh pr diff`. NEVER edit files or trigger builds.\n\n\n\nReport only issues meeting ALL:\n- **Provable impact** — specific affected code paths; no speculation.\n- **Actionable** — discrete fix, not vague \"consider improving X\".\n- **Unintentional** — clearly not deliberate design choice.\n- **Introduced in patch** — don't flag pre-existing bugs.\n- **No unstated assumptions** — no assumptions about codebase or author intent.\n- **Proportionate rigor** — fix demands no rigor absent elsewhere in codebase.\n\n\n\nEvery patch-introduced type, variant, or value crossing a function or module boundary (event, message, command, frame, enum variant, queue item, IPC payload):\n1. Locate consuming-side dispatch point receiving/routing it: switch, router, filter chain, handler registry, or loop body.\n2. Confirm explicit branch or existing catch-all correctly forwards it.\n3. Report defect if silent drop, no-op, or discard; e.g., unmatched `if`/`switch` simply returns without processing.\n\nDispatch point often outside diff. MUST read it before concluding producing side correct. Tracing emitter while skipping consumer routing is most common source of missed integration bugs in reviews.\n\n\n\n|Level|Criteria|Example|\n|---|---|---|\n|P0|Blocks release/operations; universal (no input assumptions)|Data corruption, auth bypass|\n|P1|High; fix next cycle|Race condition under load|\n|P2|Medium; fix eventually|Edge case mishandling|\n|P3|Info; nice to have|Suboptimal but correct|\n\n\n\n- **Title**: e.g., `Handle null response from API`\n- **Body**: bug, trigger condition, impact; neutral tone.\n- **Suggestion blocks**: only concrete replacement code; preserve exact whitespace; no commentary.\n\n\n\nValidate input length before buffer copy\nWhen `data.length > BUFFER_SIZE`, `memcpy` writes past buffer boundary. Occurs if API returns oversized payloads, causing heap corruption.\n```suggestion\nif (data.length > BUFFER_SIZE) return -EINVAL;\nmemcpy(buf, data.ptr, data.length);\n```\n\n\n\n\n\nEvery finding MUST be patch-anchored and evidence-backed.\n\n\n§ Context\n# Goal\nReview two prepared bugfix lanes while Main owns #292 and census shipping.\n# Constraints\nRead-only reviews; skip ALL formatting, linting, builds and tests. Never cargo fmt. No pushes, edits, production operations. Repo rules apply; issues live BigscreenVR/spt-bs-releases. These are source reviews, not runtime certification.\n# Contract\nEach reviewer owns one independent lane and returns actionable correctness findings with file/line and plausible failure; separate standards/spec concerns. Main integrates fixes. No shared edits.\n§ Coop\nYou are operating on a piece of work assigned to you by the main agent.\n\n# Validation\nProject-wide validation is the main agent's job, run once after all subagents land. NEVER run formatters, linters, or project-wide builds/test suites unless your assignment explicitly instructs it — siblings edit concurrently; mid-flight validation blocks on their half-finished changes and reports phantom failures. Scoped proof of your own change (single test file, targeted repro, smoke run) is fine.\n# Peers\nYou can reach other live agents via the `hub` tool. Your id is `ZombieSafetyReview`. Currently visible peers:\n- `PersistentRestoreReview` — reviewer (sub, running)\n- `Main` — main (main, running)\n5 parked peer(s) omitted.\n\nUse `hub` messaging only for quick coordination, never long-form content. Address peers by id or use `\"all\"` to broadcast.\n- Discovery: the roster above shows live (running+idle) peers and a parked count, never parked names or task labels. `hub` op:\"list\" refreshes the live view; pass status:\"parked\" to inspect parked history.\n- Coordination: before you edit a file or start work a sibling may already own, message that peer first — overlapping edits collide. Idle peers are not gone: messaging them wakes them.\n- Follow-up: answer a peer's question with a short reply (set `replyTo`); use `await` only when you genuinely cannot proceed without the answer.\n- Parked history: omitted from this roster. `hub` op:\"list\" status:\"parked\" lists ids; `send` to a known parked id revives it. `history://` and `agent://` stay readable.\n\n§ Completion\nNo TODO tracking, no progress updates. Execute; report results with `yield`.\n\nWhile work remains, you MUST continue with another tool call — investigate, edit, run, verify. Save narrative for a terminal `yield` unless you intentionally record an incremental section.\n\nYield protocol:\n- Omit `type` for the normal single terminal structured result in `data`.\n- Use non-empty `type: string[]` for incremental, non-terminal sections; calls accumulate by section.\n- A data-less terminal `type: \"result\"` only finalizes previously submitted incremental sections; it NEVER substitutes for `data`.\n\nThis is your only way to return a final result. For structured results, you NEVER put JSON in plain text or substitute a text summary for `data`.\n\nYour terminal `yield` MUST use exactly this shape — the schema fields go inside `data`, NEVER at the top level and NEVER as a stringified summary:\n```ts\n{\n data: {\n overall_correctness: \"correct\" | \"incorrect\";\n explanation: string;\n confidence: unknown;\n findings?: Array<{\n title: string;\n body: string;\n priority: unknown;\n confidence: unknown;\n file_path: string;\n line_start: unknown;\n line_end: unknown;\n }>;\n };\n}\n```\n\nGiving up is a last resort. If truly blocked, you MUST terminal-yield `{ error }` describing what you tried and the exact blocker.\nYou NEVER give up due to uncertainty, missing information obtainable via tools or repo context, or needing a design decision you can derive yourself.\n\nYou MUST keep going until this ticket is closed. This matters.\n\nPROJECT\n\n\n- OS: win32 10.0.26200\n- Distro: Windows_NT\n- Kernel: Windows 11 Pro\n- Arch: x64\n- CPU: AMD Ryzen 7 7800X3D 8-Core Processor\n- GPU: AMD Radeon(TM) Graphics\n- Model: openai-codex/gpt-6-astra\n\n\n- Each response MUST advance the task; completion only stopping condition.\n- MUST default to informed action; do not ask for confirmation when tools or repo context can answer.\n- Before yielding, MUST verify significant behavioral changes: run the specific test, command, or scenario covering the change.\n","task":"Complete assignment thoroughly:\n\n# Target\n.worktrees/285-zombie, commit 88d5cb9ede43a0364b33f9676b20ed91c617dbd7 versus parent. Focus broker.rs and HostedSession cleanup/drop, not unrelated lifecycle.\n# Change\nRead diff and relevant complete cleanup/kill paths. Verify fresh zombie reap kills a live PID only on positively matching captured birth; provably dead root cleans without numeric kill; missing/unreadable/mismatching identity declines before teardown, detabling, or dropping anything that could kill recycled PID. Follow RAII drops through spt-term. Check birth captured immediately after spawn and Gate AlreadyLive carries it. Normal check-to-kill TOCTOU is acknowledged, do not demand new architecture. Read relevant ADR0041 and requirement. Skip formatters/linters/build/tests.\n# Acceptance\nReturn prioritized evidence-backed findings or explicitly no findings, plus remaining runtime proof gaps. Especially name any indirect kill on decline/dead-root path. Do not edit.","tools":["read","grep","glob","bash","web_search","yield","task","hub","spt_checkpoint"],"agent":"reviewer","modelRole":"slow","resolvedModel":"openai-codex/gpt-6-astra:xhigh","readOnly":false,"spawns":"scout","outputSchema":{"properties":{"overall_correctness":{"metadata":{"description":"Whether change correct (no bugs/blockers)"},"enum":["correct","incorrect"]},"explanation":{"metadata":{"description":"Plain-text verdict summary, 1-3 sentences"},"type":"string"},"confidence":{"metadata":{"description":"Verdict confidence (0.0-1.0)"},"type":"number"}},"optionalProperties":{"findings":{"metadata":{"description":"Populate via incremental yield sections under type: [\"findings\"]; don't repeat it in a final payload."},"elements":{"properties":{"title":{"metadata":{"description":"Imperative, ≤80 chars"},"type":"string"},"body":{"metadata":{"description":"One paragraph: bug, trigger, impact"},"type":"string"},"priority":{"metadata":{"description":"P0-P3: 0 blocks release, 1 fix next cycle, 2 fix eventually, 3 nice to have"},"type":"number"},"confidence":{"metadata":{"description":"Confidence it's real bug (0.0-1.0)"},"type":"number"},"file_path":{"metadata":{"description":"Path to affected file"},"type":"string"},"line_start":{"metadata":{"description":"First line (1-indexed)"},"type":"number"},"line_end":{"metadata":{"description":"Last line (1-indexed, ≤10 lines)"},"type":"number"}}}}}},"outputSchemaMode":"permissive"}
{"type":"message","id":"e2f64a10","parentId":"80021751","timestamp":"2026-09-10T00:44:43.098Z","message":{"role":"user","content":[{"type":"text","text":"Complete assignment thoroughly:\n\n# Target\n.worktrees/285-zombie, commit 88d5cb9ede43a0364b33f9676b20ed91c617dbd7 versus parent. Focus broker.rs and HostedSession cleanup/drop, not unrelated lifecycle.\n# Change\nRead diff and relevant complete cleanup/kill paths. Verify fresh zombie reap kills a live PID only on positively matching captured birth; provably dead root cleans without numeric kill; missing/unreadable/mismatching identity declines before teardown, detabling, or dropping anything that could kill recycled PID. Follow RAII drops through spt-term. Check birth captured immediately after spawn and Gate AlreadyLive carries it. Normal check-to-kill TOCTOU is acknowledged, do not demand new architecture. Read relevant ADR0041 and requirement. Skip formatters/linters/build/tests.\n# Acceptance\nReturn prioritized evidence-backed findings or explicitly no findings, plus remaining runtime proof gaps. Especially name any indirect kill on decline/dead-root path. Do not edit."}],"attribution":"agent","timestamp":1789001083029}}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_SOhPK4cFWlCjyGzGRcVwqC5o|fc_02547c41fbf377fa016aa1fd7d03a887d294939e42f8827871","toolName":"read","startedAt":"2026-09-10T00:44:45.637Z","args":{"path":"skill://code-review"},"intent":"Reading review skill"},"id":"b5dd7fdf","parentId":"e2f64a10","timestamp":"2026-09-10T00:44:45.637Z"}
{"type":"message","id":"1c4fbe89","parentId":"b5dd7fdf","timestamp":"2026-09-10T00:44:45.637Z","message":{"role":"assistant","content":[{"type":"toolCall","id":"call_SOhPK4cFWlCjyGzGRcVwqC5o|fc_02547c41fbf377fa016aa1fd7d03a887d294939e42f8827871","name":"read","arguments":{"i":"Reading review skill","path":"skill://code-review"},"intent":"Reading review skill"}],"api":"openai-codex-responses","provider":"openai-codex","model":"gpt-6-astra","usage":{"input":2165,"output":26,"cacheRead":10624,"cacheWrite":0,"totalTokens":12815,"cost":{"input":0,"output":0,"cacheRead":0,"cacheWrite":0,"total":0}},"stopReason":"toolUse","timestamp":1789001083098,"responseId":"resp_02547c41fbf377fa016aa1fd7b9f0087d2b527dca8c2ba529a","providerPayload":{"type":"openaiResponsesHistory","provider":"openai-codex","dt":true,"items":[{"id":"fc_02547c41fbf377fa016aa1fd7d03a887d294939e42f8827871","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading review skill\",\"path\":\"skill://code-review\"}","call_id":"call_SOhPK4cFWlCjyGzGRcVwqC5o","internal_chat_message_metadata_passthrough":{"create_time":1789001084.110959,"turn_id":"e87e53c5-40c7-422d-9e85-ed14bd841c4c"},"name":"read","metadata":{"turn_id":"e87e53c5-40c7-422d-9e85-ed14bd841c4c"}}]},"duration":2538.18880000012,"ttft":1946.3613999998197,"completedAt":1789001085636,"contextSnapshot":{"promptTokens":12789,"nonMessageTokens":13209,"compactionEpoch":0}}}
{"type":"credential_pin","id":"52ac647f","parentId":"1c4fbe89","timestamp":"2026-09-10T00:44:45.638Z","provider":"openai-codex","hash":"1a3c10d7bc41d381cab1511db604bc2637dfcfc63796a890d8b5ee152859e1cb"}
{"type":"message","id":"8893be33","parentId":"52ac647f","timestamp":"2026-09-10T00:44:45.642Z","message":{"role":"toolResult","toolCallId":"call_SOhPK4cFWlCjyGzGRcVwqC5o|fc_02547c41fbf377fa016aa1fd7d03a887d294939e42f8827871","toolName":"read","content":[{"type":"text","text":"---\nname: code-review\ndescription: Review the changes since a fixed point (commit, branch, tag, or merge-base) along two axes — Standards (does the code follow this repo's documented coding standards?) and Spec (does the code match what the originating issue/spec asked for?). Runs both reviews in parallel sub-agents and reports them side by side. Use when the user wants to review a branch, a PR, work-in-progress changes, or asks to \"review since X\".\n---\n\nTwo-axis review of the diff between `HEAD` and a fixed point the user supplies:\n\n- **Standards** — does the code conform to this repo's documented coding standards?\n- **Spec** — does the code faithfully implement the originating issue / spec?\n\nBoth axes run as **parallel sub-agents** so they don't pollute each other's context, then this skill aggregates their findings.\n\nThe issue tracker should have been provided to you — run `/setup-matt-pocock-skills` if `docs/agents/issue-tracker.md` is missing.\n\n## Process\n\n### 1. Pin the fixed point\n\nWhatever the user said is the fixed point — a commit SHA, branch name, tag, `main`, `HEAD~5`, etc. If they didn't specify one, ask for it.\n\nCapture the diff command once: `git diff ...HEAD` (three-dot, so the comparison is against the merge-base). Also note the list of commits via `git log ..HEAD --oneline`.\n\nBefore going further, confirm the fixed point resolves (`git rev-parse `) and the diff is non-empty. A bad ref or empty diff should fail here — not inside two parallel sub-agents.\n\n### 2. Identify the spec source\n\nLook for the originating spec, in this order:\n\n1. Issue references in the commit messages (`#123`, `Closes #45`, GitLab `!67`, etc.) — fetch via the workflow in `docs/agents/issue-tracker.md`.\n2. A path the user passed as an argument.\n3. A spec file under `docs/`, `specs/`, or `.scratch/` matching the branch name or feature.\n4. If nothing is found, ask the user where the spec is. If they say there isn't one, the **Spec** sub-agent will skip and report \"no spec available\".\n\n### 3. Identify the standards sources\n\nAnything in the repo that documents how code should be written, such as `CODING_STANDARDS.md` or `CONTRIBUTING.md`.\n\nOn top of whatever the repo documents, the Standards axis always carries the **smell baseline** below — a fixed set of Fowler code smells (_Refactoring_, ch.3) that applies even when a repo documents nothing. Two rules bind it:\n\n- **The repo overrides.** A documented repo standard always wins; where it endorses something the baseline would flag, suppress the smell.\n- **Always a judgement call.** Each smell is a labelled heuristic (\"possible Feature Envy\"), never a hard violation — and, like any standard here, skip anything tooling already enforces.\n\nEach smell reads *what it is* → *how to fix*; match it against the diff:\n\n- **Mysterious Name** — a function, variable, or type whose name doesn't reveal what it does or holds. → rename it; if no honest name comes, the design's murky.\n- **Duplicated Code** — the same logic shape appears in more than one hunk or file in the change. → extract the shared shape, call it from both.\n- **Feature Envy** — a method that reaches into another object's data more than its own. → move the method onto the data it envies.\n- **Data Clumps** — the same few fields or params keep travelling together (a type wanting to be born). → bundle them into one type, pass that.\n- **Primitive Obsession** — a primitive or string standing in for a domain concept that deserves its own type. → give the concept its own small type.\n- **Repeated Switches** — the same `switch`/`if`-cascade on the same type recurs across the change. → replace with polymorphism, or one map both sites share.\n- **Shotgun Surgery** — one logical change forces scattered edits across many files in the diff. → gather what changes together into one module.\n- **Divergent Change** — one file or module is edited for several unrelated reasons. → split so each module changes for one reason.\n- **Speculative Generality** — abstraction, parameters, or hooks added for needs the spec doesn't have. → delete it; inline back until a real need shows.\n- **Message Chains** — long `a.b().c().d()` navigation the caller shouldn't depend on. → hide the walk behind one method on the first object.\n- **Middle Man** — a class or function that mostly just delegates onward. → cut it, call the real target direct.\n- **Refused Bequest** — a subclass or implementer that ignores or overrides most of what it inherits. → drop the inheritance, use composition.\n\n### 4. Spawn both sub-agents in parallel\n\nSend a single message with two `Agent` tool calls. Use the `general-purpose` subagent for both.\n\n**Standards sub-agent prompt** — include:\n\n- The full diff command and commit list.\n- The list of standards-source files you found in step 3, **plus the smell baseline from step 3** pasted in full — the sub-agent has no other access to it.\n- The brief: \"Report — per file/hunk where relevant — (a) every place the diff violates a documented standard: cite the standard (file + the rule); and (b) any baseline smell you spot: name it and quote the hunk. Distinguish hard violations from judgement calls — documented-standard breaches can be hard, but baseline smells are always judgement calls, and a documented repo standard overrides the baseline. Skip anything tooling enforces. Under 400 words.\"\n\n**Spec sub-agent prompt** — include:\n\n- The diff command and commit list.\n- The path or fetched contents of the spec.\n- The brief: \"Report: (a) requirements the spec asked for that are missing or partial; (b) behaviour in the diff that wasn't asked for (scope creep); (c) requirements that look implemented but where the implementation looks wrong. Quote the spec line for each finding. Under 400 words.\"\n\nIf the spec is missing, skip the Spec sub-agent and note this in the final report.\n\n### 5. Aggregate\n\nPresent the two reports under `## Standards` and `## Spec` headings, verbatim or lightly cleaned. Do **not** merge or rerank findings — the two axes are deliberately separate (see _Why two axes_).\n\nEnd with a one-line summary: total findings per axis, and the worst issue _within each axis_ (if any). Don't pick a single winner across axes — that's the reranking the separation exists to prevent.\n\n## Why two axes\n\nA change can pass one axis and fail the other:\n\n- Code that follows every standard but implements the wrong thing → **Standards pass, Spec fail.**\n- Code that does exactly what the issue asked but breaks the project's conventions → **Spec pass, Standards fail.**\n\nReporting them separately stops one axis from masking the other."}],"details":{"resolvedPath":"C:\\Users\\decid\\.agents\\skills\\code-review\\SKILL.md","contentType":"text/markdown","totalLines":89,"displayContent":{"text":"---\r\nname: code-review\r\ndescription: Review the changes since a fixed point (commit, branch, tag, or merge-base) along two axes — Standards (does the code follow this repo's documented coding standards?) and Spec (does the code match what the originating issue/spec asked for?). Runs both reviews in parallel sub-agents and reports them side by side. Use when the user wants to review a branch, a PR, work-in-progress changes, or asks to \"review since X\".\r\n---\r\n\r\nTwo-axis review of the diff between `HEAD` and a fixed point the user supplies:\r\n\r\n- **Standards** — does the code conform to this repo's documented coding standards?\r\n- **Spec** — does the code faithfully implement the originating issue / spec?\r\n\r\nBoth axes run as **parallel sub-agents** so they don't pollute each other's context, then this skill aggregates their findings.\r\n\r\nThe issue tracker should have been provided to you — run `/setup-matt-pocock-skills` if `docs/agents/issue-tracker.md` is missing.\r\n\r\n## Process\r\n\r\n### 1. Pin the fixed point\r\n\r\nWhatever the user said is the fixed point — a commit SHA, branch name, tag, `main`, `HEAD~5`, etc. If they didn't specify one, ask for it.\r\n\r\nCapture the diff command once: `git diff ...HEAD` (three-dot, so the comparison is against the merge-base). Also note the list of commits via `git log ..HEAD --oneline`.\r\n\r\nBefore going further, confirm the fixed point resolves (`git rev-parse `) and the diff is non-empty. A bad ref or empty diff should fail here — not inside two parallel sub-agents.\r\n\r\n### 2. Identify the spec source\r\n\r\nLook for the originating spec, in this order:\r\n\r\n1. Issue references in the commit messages (`#123`, `Closes #45`, GitLab `!67`, etc.) — fetch via the workflow in `docs/agents/issue-tracker.md`.\r\n2. A path the user passed as an argument.\r\n3. A spec file under `docs/`, `specs/`, or `.scratch/` matching the branch name or feature.\r\n4. If nothing is found, ask the user where the spec is. If they say there isn't one, the **Spec** sub-agent will skip and report \"no spec available\".\r\n\r\n### 3. Identify the standards sources\r\n\r\nAnything in the repo that documents how code should be written, such as `CODING_STANDARDS.md` or `CONTRIBUTING.md`.\r\n\r\nOn top of whatever the repo documents, the Standards axis always carries the **smell baseline** below — a fixed set of Fowler code smells (_Refactoring_, ch.3) that applies even when a repo documents nothing. Two rules bind it:\r\n\r\n- **The repo overrides.** A documented repo standard always wins; where it endorses something the baseline would flag, suppress the smell.\r\n- **Always a judgement call.** Each smell is a labelled heuristic (\"possible Feature Envy\"), never a hard violation — and, like any standard here, skip anything tooling already enforces.\r\n\r\nEach smell reads *what it is* → *how to fix*; match it against the diff:\r\n\r\n- **Mysterious Name** — a function, variable, or type whose name doesn't reveal what it does or holds. → rename it; if no honest name comes, the design's murky.\r\n- **Duplicated Code** — the same logic shape appears in more than one hunk or file in the change. → extract the shared shape, call it from both.\r\n- **Feature Envy** — a method that reaches into another object's data more than its own. → move the method onto the data it envies.\r\n- **Data Clumps** — the same few fields or params keep travelling together (a type wanting to be born). → bundle them into one type, pass that.\r\n- **Primitive Obsession** — a primitive or string standing in for a domain concept that deserves its own type. → give the concept its own small type.\r\n- **Repeated Switches** — the same `switch`/`if`-cascade on the same type recurs across the change. → replace with polymorphism, or one map both sites share.\r\n- **Shotgun Surgery** — one logical change forces scattered edits across many files in the diff. → gather what changes together into one module.\r\n- **Divergent Change** — one file or module is edited for several unrelated reasons. → split so each module changes for one reason.\r\n- **Speculative Generality** — abstraction, parameters, or hooks added for needs the spec doesn't have. → delete it; inline back until a real need shows.\r\n- **Message Chains** — long `a.b().c().d()` navigation the caller shouldn't depend on. → hide the walk behind one method on the first object.\r\n- **Middle Man** — a class or function that mostly just delegates onward. → cut it, call the real target direct.\r\n- **Refused Bequest** — a subclass or implementer that ignores or overrides most of what it inherits. → drop the inheritance, use composition.\r\n\r\n### 4. Spawn both sub-agents in parallel\r\n\r\nSend a single message with two `Agent` tool calls. Use the `general-purpose` subagent for both.\r\n\r\n**Standards sub-agent prompt** — include:\r\n\r\n- The full diff command and commit list.\r\n- The list of standards-source files you found in step 3, **plus the smell baseline from step 3** pasted in full — the sub-agent has no other access to it.\r\n- The brief: \"Report — per file/hunk where relevant — (a) every place the diff violates a documented standard: cite the standard (file + the rule); and (b) any baseline smell you spot: name it and quote the hunk. Distinguish hard violations from judgement calls — documented-standard breaches can be hard, but baseline smells are always judgement calls, and a documented repo standard overrides the baseline. Skip anything tooling enforces. Under 400 words.\"\r\n\r\n**Spec sub-agent prompt** — include:\r\n\r\n- The diff command and commit list.\r\n- The path or fetched contents of the spec.\r\n- The brief: \"Report: (a) requirements the spec asked for that are missing or partial; (b) behaviour in the diff that wasn't asked for (scope creep); (c) requirements that look implemented but where the implementation looks wrong. Quote the spec line for each finding. Under 400 words.\"\r\n\r\nIf the spec is missing, skip the Spec sub-agent and note this in the final report.\r\n\r\n### 5. Aggregate\r\n\r\nPresent the two reports under `## Standards` and `## Spec` headings, verbatim or lightly cleaned. Do **not** merge or rerank findings — the two axes are deliberately separate (see _Why two axes_).\r\n\r\nEnd with a one-line summary: total findings per axis, and the worst issue _within each axis_ (if any). Don't pick a single winner across axes — that's the reranking the separation exists to prevent.\r\n\r\n## Why two axes\r\n\r\nA change can pass one axis and fail the other:\r\n\r\n- Code that follows every standard but implements the wrong thing → **Standards pass, Spec fail.**\r\n- Code that does exactly what the issue asked but breaks the project's conventions → **Spec pass, Standards fail.**\r\n\r\nReporting them separately stops one axis from masking the other.\r","startLine":1,"lineNumbers":[1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89]},"meta":{"source":{"type":"internal","value":"skill://code-review"}}},"isError":false,"timestamp":1789001085642}}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_YBz3FNIsvM5FzBdxYjLDXvcN|fc_02547c41fbf377fa016aa1fd8a071c87d2a49393ef9bb2b8fe","toolName":"bash","startedAt":"2026-09-10T00:44:58.170Z","args":{"command":"git diff 88d5cb9ede43a0364b33f9676b20ed91c617dbd7^ 88d5cb9ede43a0364b33f9676b20ed91c617dbd7"},"intent":"Reading zombie patch"},"id":"76c4576d","parentId":"8893be33","timestamp":"2026-09-10T00:44:58.170Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_mKDuao3wegPhRj6nsQWybfxD|fc_02547c41fbf377fa016aa1fd8a072887d2b004e9f3e85943d5","toolName":"bash","startedAt":"2026-09-10T00:44:58.171Z","args":{"command":"git log -1 --format=fuller 88d5cb9ede43a0364b33f9676b20ed91c617dbd7"},"intent":"Reading patch provenance"},"id":"547acdaa","parentId":"76c4576d","timestamp":"2026-09-10T00:44:58.171Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_wzstL4GQ0e8rbPszwgQaRrTy|fc_02547c41fbf377fa016aa1fd8a073087d28064d5307ff46a1c","toolName":"glob","startedAt":"2026-09-10T00:44:58.171Z","args":{"path":".worktrees/285-zombie/AGENTS.md;.worktrees/285-zombie/CLAUDE.md;.worktrees/285-zombie/docs/**/*0041*;.worktrees/285-zombie/**/requirements*;.worktrees/285-zombie/docs/agents/issue-tracker.md"},"intent":"Locating review standards"},"id":"eca06818","parentId":"547acdaa","timestamp":"2026-09-10T00:44:58.171Z"}
{"type":"message","id":"7f16e914","parentId":"eca06818","timestamp":"2026-09-10T00:44:58.171Z","message":{"role":"assistant","content":[{"type":"toolCall","id":"call_YBz3FNIsvM5FzBdxYjLDXvcN|fc_02547c41fbf377fa016aa1fd8a071c87d2a49393ef9bb2b8fe","name":"bash","arguments":{"i":"Reading zombie patch","command":"git diff 88d5cb9ede43a0364b33f9676b20ed91c617dbd7^ 88d5cb9ede43a0364b33f9676b20ed91c617dbd7","cwd":"C:/Users/decid/Documents/projects/spt-core/.worktrees/285-zombie"},"intent":"Reading zombie patch"},{"type":"toolCall","id":"call_mKDuao3wegPhRj6nsQWybfxD|fc_02547c41fbf377fa016aa1fd8a072887d2b004e9f3e85943d5","name":"bash","arguments":{"i":"Reading patch provenance","command":"git log -1 --format=fuller 88d5cb9ede43a0364b33f9676b20ed91c617dbd7","cwd":"C:/Users/decid/Documents/projects/spt-core/.worktrees/285-zombie"},"intent":"Reading patch provenance"},{"type":"toolCall","id":"call_wzstL4GQ0e8rbPszwgQaRrTy|fc_02547c41fbf377fa016aa1fd8a073087d28064d5307ff46a1c","name":"glob","arguments":{"i":"Locating review standards","path":".worktrees/285-zombie/AGENTS.md;.worktrees/285-zombie/CLAUDE.md;.worktrees/285-zombie/docs/**/*0041*;.worktrees/285-zombie/**/requirements*;.worktrees/285-zombie/docs/agents/issue-tracker.md","hidden":true,"gitignore":false,"limit":100},"intent":"Locating review standards"}],"api":"openai-codex-responses","provider":"openai-codex","model":"gpt-6-astra","usage":{"input":1682,"output":280,"cacheRead":12672,"cacheWrite":0,"totalTokens":14634,"cost":{"input":0,"output":0,"cacheRead":0,"cacheWrite":0,"total":0}},"stopReason":"toolUse","timestamp":1789001085684,"responseId":"resp_02547c41fbf377fa016aa1fd7e9fb887d2aa3c4d6a0d7332d1","providerPayload":{"type":"openaiResponsesHistory","provider":"openai-codex","dt":true,"items":[{"id":"fc_02547c41fbf377fa016aa1fd8a071c87d2a49393ef9bb2b8fe","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading zombie patch\",\"command\":\"git diff 88d5cb9ede43a0364b33f9676b20ed91c617dbd7^ 88d5cb9ede43a0364b33f9676b20ed91c617dbd7\",\"cwd\":\"C:/Users/decid/Documents/projects/spt-core/.worktrees/285-zombie\"}","call_id":"call_YBz3FNIsvM5FzBdxYjLDXvcN","internal_chat_message_metadata_passthrough":{"turn_id":"e87e53c5-40c7-422d-9e85-ed14bd841c4c"},"name":"bash","metadata":{"turn_id":"e87e53c5-40c7-422d-9e85-ed14bd841c4c"}},{"id":"fc_02547c41fbf377fa016aa1fd8a072887d2b004e9f3e85943d5","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading patch provenance\",\"command\":\"git log -1 --format=fuller 88d5cb9ede43a0364b33f9676b20ed91c617dbd7\",\"cwd\":\"C:/Users/decid/Documents/projects/spt-core/.worktrees/285-zombie\"}","call_id":"call_mKDuao3wegPhRj6nsQWybfxD","internal_chat_message_metadata_passthrough":{"turn_id":"e87e53c5-40c7-422d-9e85-ed14bd841c4c"},"name":"bash","metadata":{"turn_id":"e87e53c5-40c7-422d-9e85-ed14bd841c4c"}},{"id":"fc_02547c41fbf377fa016aa1fd8a073087d28064d5307ff46a1c","type":"function_call","status":"completed","arguments":"{\"i\":\"Locating review standards\",\"path\":\".worktrees/285-zombie/AGENTS.md;.worktrees/285-zombie/CLAUDE.md;.worktrees/285-zombie/docs/**/*0041*;.worktrees/285-zombie/**/requirements*;.worktrees/285-zombie/docs/agents/issue-tracker.md\",\"hidden\":true,\"gitignore\":false,\"limit\":100}","call_id":"call_wzstL4GQ0e8rbPszwgQaRrTy","internal_chat_message_metadata_passthrough":{"turn_id":"e87e53c5-40c7-422d-9e85-ed14bd841c4c"},"name":"glob","metadata":{"turn_id":"e87e53c5-40c7-422d-9e85-ed14bd841c4c"}}]},"duration":12483.279800000135,"ttft":12421.57470000023,"completedAt":1789001098168,"contextSnapshot":{"promptTokens":14354,"nonMessageTokens":13209,"compactionEpoch":0}}}
{"type":"message","id":"77bebfd4","parentId":"7f16e914","timestamp":"2026-09-10T00:44:58.230Z","message":{"role":"toolResult","toolCallId":"call_wzstL4GQ0e8rbPszwgQaRrTy|fc_02547c41fbf377fa016aa1fd8a073087d28064d5307ff46a1c","toolName":"glob","content":[{"type":"text","text":"# .worktrees/285-zombie/\nCLAUDE.md\nAGENTS.md\n## docs/adr/\n0041-endpoint-lifecycle-truth.md\n\nSkipped missing paths: .worktrees/285-zombie/docs/agents/issue-tracker.md"}],"details":{"scopePath":".worktrees/285-zombie/AGENTS.md, .worktrees/285-zombie/CLAUDE.md, .worktrees/285-zombie/docs/**/*0041*, .worktrees/285-zombie/**/requirements*","fileCount":3,"files":[".worktrees/285-zombie/docs/adr/0041-endpoint-lifecycle-truth.md",".worktrees/285-zombie/CLAUDE.md",".worktrees/285-zombie/AGENTS.md"],"truncated":false,"cwd":"C:\\Users\\decid\\Documents\\projects\\spt-core","missingPaths":[".worktrees/285-zombie/docs/agents/issue-tracker.md"]},"isError":false,"timestamp":1789001098229}}
{"type":"message","id":"3c5d2c12","parentId":"77bebfd4","timestamp":"2026-09-10T00:44:58.761Z","message":{"role":"toolResult","toolCallId":"call_YBz3FNIsvM5FzBdxYjLDXvcN|fc_02547c41fbf377fa016aa1fd8a071c87d2a49393ef9bb2b8fe","toolName":"bash","content":[{"type":"text","text":"CHANGELOG.md | 8 ++++++++\ncrates/spt-daemon/src/broker.rs | 122 +++++++++++++++++++++++-\ndocs/KNOWN-HAZARDS.md | 2 ++\ndocs/adr/0041-endpoint-lifecycle-truth.md | 27 ++++++++++++++++++++++++\ntraceable-reqs.toml | 6 ++++++\n5 files changed, 159 insertions(+), 6 deletions(-)\n\n--- Changes ---\n\nFile: CHANGELOG.md\n @@ -10,6 +10,14 @@ breaks something, or changes the observable behavior of existing surfaces\n +## [Unreleased]\n +\n +### Fixed\n +\n +- Recovering a stale hosted session no longer kills a remembered process ID\n + without checking the process's identity. If that identity changed or cannot\n […2 changed lines elided…]\n\nFile: crates/spt-daemon/src/broker.rs\n @@ -424,6 +424,33 @@ fn zombie_verdict(\n +/// Kill only the root whose birth was captured before its exit waiter started.\n +/// A dead root permits record cleanup WITHOUT signaling its remembered number.\n +/// An error forbids both kill and forced de-tabling: dropping session resources\n +/// is teardown too, not a safe fallback for an identity we could not establish.\n +// [impl->REQ-BROKER-ZOMBIE-IDENTITY]\n +fn reap_zombie_root(\n […21 changed lines elided…]\n @@ -4116,6 +4143,10 @@ struct HostedSession {\n + /// OS birth stamp captured while the newly spawned child is still owned\n + /// and BEFORE any waiter can reap it. Never refreshed from a remembered pid.\n + // [impl->REQ-BROKER-ZOMBIE-IDENTITY]\n + process_started_at: Option,\n @@ -8007,6 +8038,7 @@ impl Broker {\n + process_started_at: Option,\n @@ -8020,6 +8052,7 @@ impl Broker {\n + h.process_started_at,\n @@ -8034,9 +8067,11 @@ impl Broker {\n - let (sid, spid, adapter_labeled, spawned_ms_ago) =\n + let (sid, spid, process_started_at, adapter_labeled, spawned_ms_ago) =\n - Gate::AlreadyLive { sid, spid, adapter_labeled, spawned_ms_ago }\n + Gate::AlreadyLive {\n + sid, spid, process_started_at, adapter_labeled, spawned_ms_ago,\n + }\n @@ -8081,7 +8116,9 @@ impl Broker {\n - Gate::AlreadyLive { sid, spid, adapter_labeled, spawned_ms_ago } => {\n + Gate::AlreadyLive {\n + sid, spid, process_started_at, adapter_labeled, spawned_ms_ago,\n + } => {\n @@ -8093,14 +8130,43 @@ impl Broker {\n + // Re-observe immediately before any kill, off-lock.\n + // The existing owned-process death oracle preserves\n + // snapshot-less Unix cleanup and Linux zombie demotion.\n + // [impl->REQ-BROKER-ZOMBIE-IDENTITY]\n + if let Err(reason) = reap_zombie_root(\n + spid,\n […29 changed lines elided…]\n @@ -8212,6 +8278,11 @@ impl Broker {\n + // Birth identity is trustworthy here: Windows retains the child handle;\n + // Unix cannot recycle our child's pid until it is reaped, and no waiter\n + // has been started yet. Exec may change its image, not its birth stamp.\n + // [impl->REQ-BROKER-ZOMBIE-IDENTITY]\n + let process_started_at = pid.and_then(spt_store::proc::process_started_at);\n […2 hunks elided…]\n\nFile: docs/KNOWN-HAZARDS.md\n @@ -845,6 +845,8 @@ These were absent from the sister-project harvest; codex surfaced them as load-b\n +\n +- **Zombie-reap kill boundary (releases#285):** `broker.rs` captures the PTY root's creation time before starting its exit waiter; a later zombie verdict alone…[+484]\n\nFile: docs/adr/0041-endpoint-lifecycle-truth.md\n @@ -80,6 +80,33 @@ authority ever verifies or normalizes.**\n +\n + **Zombie-kill identity guard (releases#285).** Liveness is not permission to\n + kill a remembered PID. The broker records the root's OS creation time just\n + after PTY spawn, before starting its exit waiter. The child is still owned:\n + on Windows its handle is retained; on Unix it has not been reaped, so its\n + number cannot yet be recycled. The expected identity is never refreshed at\n […21 changed lines elided…]\n\nFile: traceable-reqs.toml\n @@ -2840,6 +2840,11 @@ id = \"REQ-ENDPOINT-CYCLE-HONEST\"\n +[[requirements]]\n +id = \"REQ-BROKER-ZOMBIE-IDENTITY\"\n +title = \"Broker zombie reaping checks the session root's spawn-time process identity before tree-kill; unknown or changed identity declines without teardown, w…[+99]\n +required_stages = [\"doc\", \"impl\", \"unit\"] # releases#285: deterministic injected identity/kill boundary; existing cycle tests cover dead-root convergence.\n +\n @@ -4475,6 +4480,7 @@ name = \"daemon-process-lifecycle\"\n + \"REQ-BROKER-ZOMBIE-IDENTITY\",\n[raw output: artifact://115]\n\n\nWall time: 0.58 seconds"}],"details":{"timeoutSeconds":300,"wallTimeMs":582.3153999997303},"isError":false,"timestamp":1789001098761}}
{"type":"message","id":"63b9b6fa","parentId":"3c5d2c12","timestamp":"2026-09-10T00:44:58.762Z","message":{"role":"toolResult","toolCallId":"call_mKDuao3wegPhRj6nsQWybfxD|fc_02547c41fbf377fa016aa1fd8a072887d2b004e9f3e85943d5","toolName":"bash","content":[{"type":"text","text":"commit 88d5cb9ede43a0364b33f9676b20ed91c617dbd7\nAuthor: Reavo End \nAuthorDate: Wed Sep 9 16:58:15 2026 -0700\nCommit: Reavo End \nCommitDate: Wed Sep 9 16:58:15 2026 -0700\n\n fix(broker): verify spawn identity before zombie tree reap\n \n Capture the root birth before its waiter can reap it. Refuse changed or unknown identity before any kill or forced de-table; clean dead-root records without signaling the remembered PID. Add deterministic recycled-identity regression coverage for releases#285.\n \n Co-authored by: todlando\n\n\nWall time: 0.58 seconds"}],"details":{"timeoutSeconds":300,"wallTimeMs":582.9914000001736},"isError":false,"timestamp":1789001098762}}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_xoGrXGusMiK9vmmMgL0vLzCM|fc_02547c41fbf377fa016aa1fd91033487d293aef749029c86d1","toolName":"read","startedAt":"2026-09-10T00:45:06.577Z","args":{"path":"artifact://115"},"intent":"Reading complete patch"},"id":"87027faf","parentId":"63b9b6fa","timestamp":"2026-09-10T00:45:06.577Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_M7LMEmqvw0UeDvDuB1ZZieXo|fc_02547c41fbf377fa016aa1fd91034887d2bbbd5b1ca171a3d2","toolName":"read","startedAt":"2026-09-10T00:45:06.578Z","args":{"path":".worktrees/285-zombie/AGENTS.md"},"intent":"Reading repository rules"},"id":"08a9e134","parentId":"87027faf","timestamp":"2026-09-10T00:45:06.578Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_KZxPV61HUHpsYMkmhw1sS4Ft|fc_02547c41fbf377fa016aa1fd91035087d2b974c43cf23fb5b9","toolName":"read","startedAt":"2026-09-10T00:45:06.578Z","args":{"path":".worktrees/285-zombie/CLAUDE.md"},"intent":"Reading agent standards"},"id":"78b44621","parentId":"08a9e134","timestamp":"2026-09-10T00:45:06.578Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_vicvwj7YAEiaSMAbK0aWWLPh|fc_02547c41fbf377fa016aa1fd91035887d2889f203f11c08952","toolName":"read","startedAt":"2026-09-10T00:45:06.578Z","args":{"path":".worktrees/285-zombie/docs/adr/0041-endpoint-lifecycle-truth.md"},"intent":"Reading lifecycle decision"},"id":"c9a349f7","parentId":"78b44621","timestamp":"2026-09-10T00:45:06.578Z"}
{"type":"message","id":"6136b041","parentId":"c9a349f7","timestamp":"2026-09-10T00:45:06.578Z","message":{"role":"assistant","content":[{"type":"toolCall","id":"call_xoGrXGusMiK9vmmMgL0vLzCM|fc_02547c41fbf377fa016aa1fd91033487d293aef749029c86d1","name":"read","arguments":{"i":"Reading complete patch","path":"artifact://115"},"intent":"Reading complete patch"},{"type":"toolCall","id":"call_M7LMEmqvw0UeDvDuB1ZZieXo|fc_02547c41fbf377fa016aa1fd91034887d2bbbd5b1ca171a3d2","name":"read","arguments":{"i":"Reading repository rules","path":".worktrees/285-zombie/AGENTS.md"},"intent":"Reading repository rules"},{"type":"toolCall","id":"call_KZxPV61HUHpsYMkmhw1sS4Ft|fc_02547c41fbf377fa016aa1fd91035087d2b974c43cf23fb5b9","name":"read","arguments":{"i":"Reading agent standards","path":".worktrees/285-zombie/CLAUDE.md"},"intent":"Reading agent standards"},{"type":"toolCall","id":"call_vicvwj7YAEiaSMAbK0aWWLPh|fc_02547c41fbf377fa016aa1fd91035887d2889f203f11c08952","name":"read","arguments":{"i":"Reading lifecycle decision","path":".worktrees/285-zombie/docs/adr/0041-endpoint-lifecycle-truth.md"},"intent":"Reading lifecycle decision"},{"type":"toolCall","id":"call_oAKwcp0DZ5UoNYQvqbGvhtVo|fc_02547c41fbf377fa016aa1fd91036087d2bec21c6fea6c19ac","name":"read","arguments":{"i":"Reading zombie issue","path":"issue://BigscreenVR/spt-bs-releases/285"},"intent":"Reading zombie issue"}],"api":"openai-codex-responses","provider":"openai-codex","model":"gpt-6-astra","usage":{"input":1979,"output":168,"cacheRead":14208,"cacheWrite":0,"totalTokens":16355,"cost":{"input":0,"output":0,"cacheRead":0,"cacheWrite":0,"total":0}},"stopReason":"toolUse","timestamp":1789001098814,"responseId":"resp_02547c41fbf377fa016aa1fd8b081887d28d5b0997a83210e8","providerPayload":{"type":"openaiResponsesHistory","provider":"openai-codex","dt":true,"items":[{"id":"fc_02547c41fbf377fa016aa1fd91033487d293aef749029c86d1","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading complete patch\",\"path\":\"artifact://115\"}","call_id":"call_xoGrXGusMiK9vmmMgL0vLzCM","internal_chat_message_metadata_passthrough":{"turn_id":"e87e53c5-40c7-422d-9e85-ed14bd841c4c"},"name":"read","metadata":{"turn_id":"e87e53c5-40c7-422d-9e85-ed14bd841c4c"}},{"id":"fc_02547c41fbf377fa016aa1fd91034887d2bbbd5b1ca171a3d2","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading repository rules\",\"path\":\".worktrees/285-zombie/AGENTS.md\"}","call_id":"call_M7LMEmqvw0UeDvDuB1ZZieXo","internal_chat_message_metadata_passthrough":{"turn_id":"e87e53c5-40c7-422d-9e85-ed14bd841c4c"},"name":"read","metadata":{"turn_id":"e87e53c5-40c7-422d-9e85-ed14bd841c4c"}},{"id":"fc_02547c41fbf377fa016aa1fd91035087d2b974c43cf23fb5b9","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading agent standards\",\"path\":\".worktrees/285-zombie/CLAUDE.md\"}","call_id":"call_KZxPV61HUHpsYMkmhw1sS4Ft","internal_chat_message_metadata_passthrough":{"turn_id":"e87e53c5-40c7-422d-9e85-ed14bd841c4c"},"name":"read","metadata":{"turn_id":"e87e53c5-40c7-422d-9e85-ed14bd841c4c"}},{"id":"fc_02547c41fbf377fa016aa1fd91035887d2889f203f11c08952","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading lifecycle decision\",\"path\":\".worktrees/285-zombie/docs/adr/0041-endpoint-lifecycle-truth.md\"}","call_id":"call_vicvwj7YAEiaSMAbK0aWWLPh","internal_chat_message_metadata_passthrough":{"turn_id":"e87e53c5-40c7-422d-9e85-ed14bd841c4c"},"name":"read","metadata":{"turn_id":"e87e53c5-40c7-422d-9e85-ed14bd841c4c"}},{"id":"fc_02547c41fbf377fa016aa1fd91036087d2bec21c6fea6c19ac","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading zombie issue\",\"path\":\"issue://BigscreenVR/spt-bs-releases/285\"}","call_id":"call_oAKwcp0DZ5UoNYQvqbGvhtVo","internal_chat_message_metadata_passthrough":{"turn_id":"e87e53c5-40c7-422d-9e85-ed14bd841c4c"},"name":"read","metadata":{"turn_id":"e87e53c5-40c7-422d-9e85-ed14bd841c4c"}}]},"duration":6294.74850000022,"ttft":6223.592000000179,"completedAt":1789001105109,"contextSnapshot":{"promptTokens":16187,"nonMessageTokens":13209,"compactionEpoch":0}}}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_oAKwcp0DZ5UoNYQvqbGvhtVo|fc_02547c41fbf377fa016aa1fd91036087d2bec21c6fea6c19ac","toolName":"read","startedAt":"2026-09-10T00:45:06.578Z","args":{"path":"issue://BigscreenVR/spt-bs-releases/285"},"intent":"Reading zombie issue"},"id":"29e4fb25","parentId":"6136b041","timestamp":"2026-09-10T00:45:06.578Z"}
{"type":"message","id":"64e1c59e","parentId":"29e4fb25","timestamp":"2026-09-10T00:45:06.589Z","message":{"role":"toolResult","toolCallId":"call_xoGrXGusMiK9vmmMgL0vLzCM|fc_02547c41fbf377fa016aa1fd91033487d293aef749029c86d1","toolName":"read","content":[{"type":"text","text":"diff --git a/CHANGELOG.md b/CHANGELOG.md\nindex eafe18d6..635f675f 100644\n--- a/CHANGELOG.md\n+++ b/CHANGELOG.md\n@@ -10,6 +10,14 @@ breaks something, or changes the observable behavior of existing surfaces\n broadly; **patch** for fixes, and for additive opt-in capability — a new key,\n flag, or page that no existing user can encounter without opting into it.\n \n+## [Unreleased]\n+\n+### Fixed\n+\n+- Recovering a stale hosted session no longer kills a remembered process ID\n+ without checking the process's identity. If that identity changed or cannot\n+ be verified, the run request reports the refusal and leaves the process alone.\n+\n ## [0.68.0] - 2026-09-08\n \n Web serving. Files, directories, adapter documentation and the changelog are\ndiff --git a/crates/spt-daemon/src/broker.rs b/crates/spt-daemon/src/broker.rs\nindex 5c7d94ec..41cae3ca 100644\n--- a/crates/spt-daemon/src/broker.rs\n+++ b/crates/spt-daemon/src/broker.rs\n@@ -424,6 +424,33 @@ fn zombie_verdict(\n }\n }\n \n+/// Kill only the root whose birth was captured before its exit waiter started.\n+/// A dead root permits record cleanup WITHOUT signaling its remembered number.\n+/// An error forbids both kill and forced de-tabling: dropping session resources\n+/// is teardown too, not a safe fallback for an identity we could not establish.\n+// [impl->REQ-BROKER-ZOMBIE-IDENTITY]\n+fn reap_zombie_root(\n+ pid: Option,\n+ born: Option,\n+ observe: impl FnOnce(u32) -> spt_store::proc::ProcIdentity,\n+ kill_tree: impl FnOnce(u32),\n+) -> Result<(), &'static str> {\n+ use spt_store::proc::ProcIdentity;\n+ let pid = pid.filter(|p| *p != 0).ok_or(\"pid-unknown\")?;\n+ match observe(pid) {\n+ ProcIdentity::Absent => Ok(()),\n+ ProcIdentity::Present(now) => match born {\n+ Some(expected) if expected == now => {\n+ kill_tree(pid);\n+ Ok(())\n+ }\n+ Some(_) => Err(\"identity-mismatch\"),\n+ None => Err(\"identity-unproven\"),\n+ },\n+ ProcIdentity::Unproven => Err(\"identity-unproven\"),\n+ }\n+}\n+\n /// The impure probe feeding [`zombie_verdict`] for a claimed live session —\n /// runs OFF every broker lock (a process-table walk is real work; KH 7.12).\n /// `spawned_ms_ago` comes from the session's `spawned_at`; callers on the\n@@ -4116,6 +4143,10 @@ struct HostedSession {\n /// yet and must never read as a dead tree during bringup.\n // [impl->REQ-ENDPOINT-CYCLE-HONEST]\n spawned_at: Instant,\n+ /// OS birth stamp captured while the newly spawned child is still owned\n+ /// and BEFORE any waiter can reap it. Never refreshed from a remembered pid.\n+ // [impl->REQ-BROKER-ZOMBIE-IDENTITY]\n+ process_started_at: Option,\n }\n \n /// One record queued to a session's dedicated PTY input-writer thread — the raw\n@@ -8007,6 +8038,7 @@ impl Broker {\n AlreadyLive {\n sid: u64,\n spid: Option,\n+ process_started_at: Option,\n adapter_labeled: bool,\n spawned_ms_ago: u64,\n },\n@@ -8020,6 +8052,7 @@ impl Broker {\n (\n *sid,\n h.session.process_id(),\n+ h.process_started_at,\n !h.adapter.is_empty(),\n h.spawned_at.elapsed().as_millis() as u64,\n )\n@@ -8034,9 +8067,11 @@ impl Broker {\n .is_some_and(|c| c.phase_at.elapsed() >= phase_wedge_ceiling(&c.phase));\n match wake_gate_decision(live.is_some(), held.is_some(), holder_stalled) {\n WakeGate::AlreadyLive => {\n- let (sid, spid, adapter_labeled, spawned_ms_ago) =\n+ let (sid, spid, process_started_at, adapter_labeled, spawned_ms_ago) =\n live.expect(\"live is Some on AlreadyLive\");\n- Gate::AlreadyLive { sid, spid, adapter_labeled, spawned_ms_ago }\n+ Gate::AlreadyLive {\n+ sid, spid, process_started_at, adapter_labeled, spawned_ms_ago,\n+ }\n }\n WakeGate::Racing => Gate::Racing,\n WakeGate::Claim => {\n@@ -8081,7 +8116,9 @@ impl Broker {\n spawn_phase(\"gate_claimed\", \"\");\n break Some(guard);\n }\n- Gate::AlreadyLive { sid, spid, adapter_labeled, spawned_ms_ago } => {\n+ Gate::AlreadyLive {\n+ sid, spid, process_started_at, adapter_labeled, spawned_ms_ago,\n+ } => {\n // ONE liveness authority (ADR-0041 decision 6,\n // REQ-ENDPOINT-CYCLE-HONEST): before refusing/deduping by\n // citing the claimed session, PROBE its client tree — off\n@@ -8093,14 +8130,43 @@ impl Broker {\n // refusal citing a corpse.\n // [impl->REQ-ENDPOINT-CYCLE-HONEST]\n if session_is_zombie(spid, adapter_labeled, spawned_ms_ago) {\n+ // Re-observe immediately before any kill, off-lock.\n+ // The existing owned-process death oracle preserves\n+ // snapshot-less Unix cleanup and Linux zombie demotion.\n+ // [impl->REQ-BROKER-ZOMBIE-IDENTITY]\n+ if let Err(reason) = reap_zombie_root(\n+ spid,\n+ process_started_at,\n+ |pid| {\n+ use spt_store::proc::{self, ProcIdentity};\n+ if proc::provably_gone(pid) {\n+ ProcIdentity::Absent\n+ } else {\n+ proc::process_started_at(pid)\n+ .map(ProcIdentity::Present)\n+ .unwrap_or(ProcIdentity::Unproven)\n+ }\n+ },\n+ spt_store::proc::kill_pid_tree,\n+ ) {\n+ spt_proto::emit_line_err!(\n+ \"SPAWN_ZOMBIE_REAP_DECLINE:{}: session {sid} pid={spid:?} \\\n+ reason={reason} — no kill or forced de-table\",\n+ req.endpoint\n+ );\n+ // Return BEFORE the cleanup loop. In particular,\n+ // do not drop HostedSession/PTY resources or call\n+ // dispatch_teardown as a fallback after refusal.\n+ return Err(format!(\n+ \"SPAWN_ZOMBIE_REAP_DECLINE:{}: session {sid}: {reason}\",\n+ req.endpoint\n+ ));\n+ }\n spt_proto::emit_line_err!(\n \"SPAWN_ZOMBIE_REAP:{}: claimed session {sid} has a dead client \\\n tree — reaping before honest respawn [REQ-ENDPOINT-CYCLE-HONEST]\",\n req.endpoint\n );\n- if let Some(pid) = spid {\n- spt_store::proc::kill_pid_tree(pid);\n- }\n // Bounded wait for the exit-waiter to reap the table row;\n // belt: a wedged/missed waiter (root already dead) gets a\n // direct de-table + stamp clear so the gate can converge.\n@@ -8212,6 +8278,11 @@ impl Broker {\n let session = Arc::new(session);\n let id = self.next_id.fetch_add(1, Ordering::Relaxed);\n let pid = session.process_id();\n+ // Birth identity is trustworthy here: Windows retains the child handle;\n+ // Unix cannot recycle our child's pid until it is reaped, and no waiter\n+ // has been started yet. Exec may change its image, not its birth stamp.\n+ // [impl->REQ-BROKER-ZOMBIE-IDENTITY]\n+ let process_started_at = pid.and_then(spt_store::proc::process_started_at);\n // The ConPTY-create span releases#199 candidate C names, closed.\n spawn_phase(\"pty_created\", &format!(\"pid={pid:?}\"));\n \n@@ -8514,6 +8585,7 @@ impl Broker {\n adapter: req.adapter.clone(),\n install_dir: req.install_dir.clone().map(std::path::PathBuf::from),\n spawned_at: Instant::now(),\n+ process_started_at,\n },\n );\n // The row exists, so the in-flight ledger has nothing left to say about\n@@ -10071,6 +10143,44 @@ mod tests {\n assert!(!zombie_verdict(None, false, false, true));\n }\n \n+ // [unit->REQ-BROKER-ZOMBIE-IDENTITY]\n+ #[test]\n+ fn zombie_reap_declines_recycled_pid() {\n+ use spt_store::proc::ProcIdentity;\n+ // A record still remembers the old wrapper's birth, but the same pid\n+ // now denotes a different process. It passes the old zombie predicate.\n+ let pid = 42;\n+ let born = 100;\n+ assert!(zombie_verdict(Some(true), true, false, true));\n+ let mut killed = None;\n+ let result = reap_zombie_root(\n+ Some(pid),\n+ Some(born),\n+ |_| ProcIdentity::Present(born + 1),\n+ |target| killed = Some(target),\n+ );\n+ assert_eq!(result, Err(\"identity-mismatch\"));\n+ assert_eq!(killed, None, \"the replacement and its descendants must survive\");\n+ }\n+\n+ // [unit->REQ-BROKER-ZOMBIE-IDENTITY]\n+ #[test]\n+ fn zombie_reap_requires_positive_identity_but_dead_root_needs_no_kill() {\n+ use spt_store::proc::ProcIdentity;\n+ for (pid, born, observed, expected, killed_pid) in [\n+ (Some(42), Some(100), ProcIdentity::Present(100), Ok(()), Some(42)),\n+ (Some(42), None, ProcIdentity::Present(100), Err(\"identity-unproven\"), None),\n+ (Some(42), Some(100), ProcIdentity::Unproven, Err(\"identity-unproven\"), None),\n+ (None, Some(100), ProcIdentity::Present(100), Err(\"pid-unknown\"), None),\n+ (Some(42), None, ProcIdentity::Absent, Ok(()), None),\n+ ] {\n+ let mut killed = None;\n+ let result = reap_zombie_root(pid, born, |_| observed, |target| killed = Some(target));\n+ assert_eq!(result, expected, \"{pid:?} / {born:?} / {observed:?}\");\n+ assert_eq!(killed, killed_pid, \"{pid:?} / {born:?} / {observed:?}\");\n+ }\n+ }\n+\n /// [unit->REQ-LIVENESS-ORACLE-SOUND] the NO-SNAPSHOT arm, pinned WITHOUT a\n /// platform that lacks a process table — the one claim neither the\n /// manufactured corpse nor the int can make, since both run where a table\ndiff --git a/docs/KNOWN-HAZARDS.md b/docs/KNOWN-HAZARDS.md\nindex 8ab726b7..6f4ad578 100644\n--- a/docs/KNOWN-HAZARDS.md\n+++ b/docs/KNOWN-HAZARDS.md\n@@ -845,6 +845,8 @@ These were absent from the sister-project harvest; codex surfaced them as load-b\n - **Failure (paid-for, hertz v0.39.4 field RCA 2026-07-22, doyle code-verified same day):** `resume.pid` custody is a bare PID consumed as `read_resume_pid(..).is_some_and(is_process_alive)` at BOTH the livehost restart gate and the liveness-reconcile DEFER. A dead wake-resume spawn's pid, recycled by the OS onto an unrelated process (field proof: `resume.pid=29456` resolved to a random `cmd.exe`), reads as \"a resume is in flight\" indefinitely: reconcile defers every tick, the row stays online-authoritative, and the endpoint is FALSE-ONLINE with no self-repair — every reader faithfully resurrects the lie. The ABA problem, in process custody.\n - **Invariant:** a custody record that gates lifecycle decisions stores an **identity pair (pid + process creation time)**, written atomically at spawn-mint; consumers test the PAIR, and a mismatch means NOT OURS — the discovering reader DELETES the record and proceeds as if no custody existed (self-heal, not error). Bind and reap clear custody atomically with their own outcome. Creation time comes from the process snapshot, never a retained handle (7.50); no snapshot ⇒ \"unproven\" ⇒ defer ONE tick, never a manufactured verdict.\n - **spt-core mapping:** `spt-daemon/src/livehost.rs` (restart gate + reconcile DEFER custody reads); `spt-store` resume-custody record + `proc.rs` snapshot identity; regression = the recycled-pid rig (custody pair mismatching a live impostor pid → record deleted, reconcile proceeds, row goes honest).\n+\n+- **Zombie-reap kill boundary (releases#285):** `broker.rs` captures the PTY root's creation time before starting its exit waiter; a later zombie verdict alone never licenses killing that remembered number. Fresh death permits cleanup without a signal; otherwise the live start time must match. `SPAWN_ZOMBIE_REAP_DECLINE` means neither tree-kill nor forced de-table runs, including any resource-drop fallback. The regression injects a different birth at the same PID and observes refusal with no kill. This is not atomic with the numeric tree-kill; the check-to-signal race and Linux same-tick identity collision remain (ADR-0041 decision 6).\n - **Source:** DAEMON-LIFECYCLE W1 (ADR-0047 decision 1; hertz field RCA bug 1).\n \n ### 7.52 An operator stop outranks every implicit ensure — no convenience path resurrects what the operator just killed `[REQ-HAZARD-STOP-RESPAWN-CONVOY]`\ndiff --git a/docs/adr/0041-endpoint-lifecycle-truth.md b/docs/adr/0041-endpoint-lifecycle-truth.md\nindex 4e83f020..ca94dfa2 100644\n--- a/docs/adr/0041-endpoint-lifecycle-truth.md\n+++ b/docs/adr/0041-endpoint-lifecycle-truth.md\n@@ -80,6 +80,33 @@ authority ever verifies or normalizes.**\n honestly); the shutdown state machine consults the same source, so \"is it live\" has one\n answer (no ALREADY_LIVE/OFFLINE/NO_EDGE three-way contradiction).\n \n+\n+ **Zombie-kill identity guard (releases#285).** Liveness is not permission to\n+ kill a remembered PID. The broker records the root's OS creation time just\n+ after PTY spawn, before starting its exit waiter. The child is still owned:\n+ on Windows its handle is retained; on Unix it has not been reaped, so its\n+ number cannot yet be recycled. The expected identity is never refreshed at\n+ reap time. Start time is preferred over image because a launcher can `exec`\n+ another image without becoming a different process.\n+\n+ At the zombie kill boundary, a fresh owned-process death probe permits\n+ stale-row cleanup for a dead root **without any PID/tree kill**. Otherwise a\n+ fresh start-time query must match the captured stamp before tree-kill.\n+ Unknown PID, missing/unreadable identity, or a changed stamp emits\n+ `SPAWN_ZOMBIE_REAP_DECLINE` and fails the spawn request **before** the forced\n+ de-table loop. There is no fallback `session.kill`, teardown dispatch, or\n+ session-resource drop on refusal; the old row remains for its normal exit\n+ waiter. This deliberately trades automatic recovery of an unverifiable\n+ live-number row for safety, rather than using cleanup as an indirect kill.\n+ Fresh-dead cleanup retains the existing snapshot-less Unix liveness fallback.\n+\n+ **Limits:** this is a checked numeric tree-kill, not an atomic handle/pidfd\n+ tree termination. A process can exit and its PID can be reused after the\n+ identity query and before a signal; descendant enumeration/kill retains the\n+ same race. Linux start times have clock-tick resolution, so same-tick reuse\n+ is indistinguishable; Windows uses creation FILETIME. This scoped guard does\n+ not change generic `kill_pid_tree` or other kill sites.\n+\n ## Consequences\n \n - A dead endpoint converges to offline+suspended+uncontrolled within one reconcile, from\ndiff --git a/traceable-reqs.toml b/traceable-reqs.toml\nindex 21917ea9..b518a80c 100644\n--- a/traceable-reqs.toml\n+++ b/traceable-reqs.toml\n@@ -2840,6 +2840,11 @@ id = \"REQ-ENDPOINT-CYCLE-HONEST\"\n title = \"REGISTRY-LIFECYCLE W3 (ADR-0041 decision 6, operator deployah stop/run wedge): cycle verbs share ONE liveness authority — the ALREADY_LIVE dup-guard liveness-probes the claimed session client tree before refusing (dead tree means reap + respawn honestly, never a refusal citing a zombie); the shutdown state machine consults the same source so is-it-live has one answer (no ALREADY_LIVE / list-OFFLINE / shutdown-NO_EDGE three-way contradiction on the same endpoint). Gate: impl — probing dup-guard + unified authority; unit — dead-tree claim probes and reaps, live claim still refuses; int — controlled zombie (killed client tree, surviving hosted record) leads to endpoint run succeeding honestly end-to-end; doc — ADR-0041.\"\n required_stages = [\"doc\",\"impl\",\"unit\",\"int\"] # W3 ACTIVATED at build start (todlando 2026-07-17).\n \n+[[requirements]]\n+id = \"REQ-BROKER-ZOMBIE-IDENTITY\"\n+title = \"Broker zombie reaping checks the session root's spawn-time process identity before tree-kill; unknown or changed identity declines without teardown, while a provably dead root still permits stale-session cleanup without signaling its remembered PID\"\n+required_stages = [\"doc\", \"impl\", \"unit\"] # releases#285: deterministic injected identity/kill boundary; existing cycle tests cover dead-root convergence.\n+\n [[requirements]]\n id = \"REQ-GOSSIP-PROJECT-DERIVE-ONCE\"\n title = \"REGISTRY-LIFECYCLE W4 fast-follow (hertz v0.37.0 field-verify CPU-gate FAIL RCA 2026-07-17, doyle seam-verified same day; timing-pinned ~16s burst clusters per 30s Registry pump round): recent-project gossip derives a project id AT MOST ONCE PER DISTINCT CWD per advertisement round — recent_projects_for dedups the RAW cwd string BEFORE project_id_for_dir (today seen.insert(pid) dedups AFTER derivation at registryhost.rs:1001, so every duplicate-cwd sessions.log row pays a git remote/rev-parse spawn: ~200 derivations/round on a 12-perch box, the post-self-hash-fix CPU floor). The pid-level dedup stays as the output-uniqueness second layer (distinct cwd spellings may collapse to one project); ordering semantics unchanged (first-occurrence newest-first); bounded ledger read unchanged. Gate: impl — cwd-dedup before derivation; unit — derivation-count observable == distinct cwds not ledger rows (duplicate-cwd ledger derives once), output/order parity vs the pre-fix shape on a mixed ledger. SEEDED SEPARATELY (not this REQ): gossip leg consults the ADR-0037 materialized index (kills git entirely + cross-round rederivation; staleness-semantics design change) + epoch-mint batching (26 atomic writes/round; durable-monotonic contract change).\"\n@@ -4475,6 +4480,7 @@ name = \"daemon-process-lifecycle\"\n requirements = [\n \"REQ-BROKER-STOP-DENY-NAMES-BLAST\",\n \"REQ-BROKER-STOP-ENDPOINT-DENY\",\n+ \"REQ-BROKER-ZOMBIE-IDENTITY\",\n \"REQ-DAEMON-1\",\n \"REQ-DAEMON-3\",\n \"REQ-DAEMON-4\","}],"details":{"resolvedPath":"C:\\Users\\decid\\.omp\\agent\\sessions\\-Documents-projects-spt-core\\2026-09-09T23-45-42-317Z_01a08890-21ad-7000-8f54-208d4f4f2f2c\\115.bash-original.log","contentType":"text/plain","totalLines":296,"displayContent":{"text":"diff --git a/CHANGELOG.md b/CHANGELOG.md\nindex eafe18d6..635f675f 100644\n--- a/CHANGELOG.md\n+++ b/CHANGELOG.md\n@@ -10,6 +10,14 @@ breaks something, or changes the observable behavior of existing surfaces\n broadly; **patch** for fixes, and for additive opt-in capability — a new key,\n flag, or page that no existing user can encounter without opting into it.\n \n+## [Unreleased]\n+\n+### Fixed\n+\n+- Recovering a stale hosted session no longer kills a remembered process ID\n+ without checking the process's identity. If that identity changed or cannot\n+ be verified, the run request reports the refusal and leaves the process alone.\n+\n ## [0.68.0] - 2026-09-08\n \n Web serving. Files, directories, adapter documentation and the changelog are\ndiff --git a/crates/spt-daemon/src/broker.rs b/crates/spt-daemon/src/broker.rs\nindex 5c7d94ec..41cae3ca 100644\n--- a/crates/spt-daemon/src/broker.rs\n+++ b/crates/spt-daemon/src/broker.rs\n@@ -424,6 +424,33 @@ fn zombie_verdict(\n }\n }\n \n+/// Kill only the root whose birth was captured before its exit waiter started.\n+/// A dead root permits record cleanup WITHOUT signaling its remembered number.\n+/// An error forbids both kill and forced de-tabling: dropping session resources\n+/// is teardown too, not a safe fallback for an identity we could not establish.\n+// [impl->REQ-BROKER-ZOMBIE-IDENTITY]\n+fn reap_zombie_root(\n+ pid: Option,\n+ born: Option,\n+ observe: impl FnOnce(u32) -> spt_store::proc::ProcIdentity,\n+ kill_tree: impl FnOnce(u32),\n+) -> Result<(), &'static str> {\n+ use spt_store::proc::ProcIdentity;\n+ let pid = pid.filter(|p| *p != 0).ok_or(\"pid-unknown\")?;\n+ match observe(pid) {\n+ ProcIdentity::Absent => Ok(()),\n+ ProcIdentity::Present(now) => match born {\n+ Some(expected) if expected == now => {\n+ kill_tree(pid);\n+ Ok(())\n+ }\n+ Some(_) => Err(\"identity-mismatch\"),\n+ None => Err(\"identity-unproven\"),\n+ },\n+ ProcIdentity::Unproven => Err(\"identity-unproven\"),\n+ }\n+}\n+\n /// The impure probe feeding [`zombie_verdict`] for a claimed live session —\n /// runs OFF every broker lock (a process-table walk is real work; KH 7.12).\n /// `spawned_ms_ago` comes from the session's `spawned_at`; callers on the\n@@ -4116,6 +4143,10 @@ struct HostedSession {\n /// yet and must never read as a dead tree during bringup.\n // [impl->REQ-ENDPOINT-CYCLE-HONEST]\n spawned_at: Instant,\n+ /// OS birth stamp captured while the newly spawned child is still owned\n+ /// and BEFORE any waiter can reap it. Never refreshed from a remembered pid.\n+ // [impl->REQ-BROKER-ZOMBIE-IDENTITY]\n+ process_started_at: Option,\n }\n \n /// One record queued to a session's dedicated PTY input-writer thread — the raw\n@@ -8007,6 +8038,7 @@ impl Broker {\n AlreadyLive {\n sid: u64,\n spid: Option,\n+ process_started_at: Option,\n adapter_labeled: bool,\n spawned_ms_ago: u64,\n },\n@@ -8020,6 +8052,7 @@ impl Broker {\n (\n *sid,\n h.session.process_id(),\n+ h.process_started_at,\n !h.adapter.is_empty(),\n h.spawned_at.elapsed().as_millis() as u64,\n )\n@@ -8034,9 +8067,11 @@ impl Broker {\n .is_some_and(|c| c.phase_at.elapsed() >= phase_wedge_ceiling(&c.phase));\n match wake_gate_decision(live.is_some(), held.is_some(), holder_stalled) {\n WakeGate::AlreadyLive => {\n- let (sid, spid, adapter_labeled, spawned_ms_ago) =\n+ let (sid, spid, process_started_at, adapter_labeled, spawned_ms_ago) =\n live.expect(\"live is Some on AlreadyLive\");\n- Gate::AlreadyLive { sid, spid, adapter_labeled, spawned_ms_ago }\n+ Gate::AlreadyLive {\n+ sid, spid, process_started_at, adapter_labeled, spawned_ms_ago,\n+ }\n }\n WakeGate::Racing => Gate::Racing,\n WakeGate::Claim => {\n@@ -8081,7 +8116,9 @@ impl Broker {\n spawn_phase(\"gate_claimed\", \"\");\n break Some(guard);\n }\n- Gate::AlreadyLive { sid, spid, adapter_labeled, spawned_ms_ago } => {\n+ Gate::AlreadyLive {\n+ sid, spid, process_started_at, adapter_labeled, spawned_ms_ago,\n+ } => {\n // ONE liveness authority (ADR-0041 decision 6,\n // REQ-ENDPOINT-CYCLE-HONEST): before refusing/deduping by\n // citing the claimed session, PROBE its client tree — off\n@@ -8093,14 +8130,43 @@ impl Broker {\n // refusal citing a corpse.\n // [impl->REQ-ENDPOINT-CYCLE-HONEST]\n if session_is_zombie(spid, adapter_labeled, spawned_ms_ago) {\n+ // Re-observe immediately before any kill, off-lock.\n+ // The existing owned-process death oracle preserves\n+ // snapshot-less Unix cleanup and Linux zombie demotion.\n+ // [impl->REQ-BROKER-ZOMBIE-IDENTITY]\n+ if let Err(reason) = reap_zombie_root(\n+ spid,\n+ process_started_at,\n+ |pid| {\n+ use spt_store::proc::{self, ProcIdentity};\n+ if proc::provably_gone(pid) {\n+ ProcIdentity::Absent\n+ } else {\n+ proc::process_started_at(pid)\n+ .map(ProcIdentity::Present)\n+ .unwrap_or(ProcIdentity::Unproven)\n+ }\n+ },\n+ spt_store::proc::kill_pid_tree,\n+ ) {\n+ spt_proto::emit_line_err!(\n+ \"SPAWN_ZOMBIE_REAP_DECLINE:{}: session {sid} pid={spid:?} \\\n+ reason={reason} — no kill or forced de-table\",\n+ req.endpoint\n+ );\n+ // Return BEFORE the cleanup loop. In particular,\n+ // do not drop HostedSession/PTY resources or call\n+ // dispatch_teardown as a fallback after refusal.\n+ return Err(format!(\n+ \"SPAWN_ZOMBIE_REAP_DECLINE:{}: session {sid}: {reason}\",\n+ req.endpoint\n+ ));\n+ }\n spt_proto::emit_line_err!(\n \"SPAWN_ZOMBIE_REAP:{}: claimed session {sid} has a dead client \\\n tree — reaping before honest respawn [REQ-ENDPOINT-CYCLE-HONEST]\",\n req.endpoint\n );\n- if let Some(pid) = spid {\n- spt_store::proc::kill_pid_tree(pid);\n- }\n // Bounded wait for the exit-waiter to reap the table row;\n // belt: a wedged/missed waiter (root already dead) gets a\n // direct de-table + stamp clear so the gate can converge.\n@@ -8212,6 +8278,11 @@ impl Broker {\n let session = Arc::new(session);\n let id = self.next_id.fetch_add(1, Ordering::Relaxed);\n let pid = session.process_id();\n+ // Birth identity is trustworthy here: Windows retains the child handle;\n+ // Unix cannot recycle our child's pid until it is reaped, and no waiter\n+ // has been started yet. Exec may change its image, not its birth stamp.\n+ // [impl->REQ-BROKER-ZOMBIE-IDENTITY]\n+ let process_started_at = pid.and_then(spt_store::proc::process_started_at);\n // The ConPTY-create span releases#199 candidate C names, closed.\n spawn_phase(\"pty_created\", &format!(\"pid={pid:?}\"));\n \n@@ -8514,6 +8585,7 @@ impl Broker {\n adapter: req.adapter.clone(),\n install_dir: req.install_dir.clone().map(std::path::PathBuf::from),\n spawned_at: Instant::now(),\n+ process_started_at,\n },\n );\n // The row exists, so the in-flight ledger has nothing left to say about\n@@ -10071,6 +10143,44 @@ mod tests {\n assert!(!zombie_verdict(None, false, false, true));\n }\n \n+ // [unit->REQ-BROKER-ZOMBIE-IDENTITY]\n+ #[test]\n+ fn zombie_reap_declines_recycled_pid() {\n+ use spt_store::proc::ProcIdentity;\n+ // A record still remembers the old wrapper's birth, but the same pid\n+ // now denotes a different process. It passes the old zombie predicate.\n+ let pid = 42;\n+ let born = 100;\n+ assert!(zombie_verdict(Some(true), true, false, true));\n+ let mut killed = None;\n+ let result = reap_zombie_root(\n+ Some(pid),\n+ Some(born),\n+ |_| ProcIdentity::Present(born + 1),\n+ |target| killed = Some(target),\n+ );\n+ assert_eq!(result, Err(\"identity-mismatch\"));\n+ assert_eq!(killed, None, \"the replacement and its descendants must survive\");\n+ }\n+\n+ // [unit->REQ-BROKER-ZOMBIE-IDENTITY]\n+ #[test]\n+ fn zombie_reap_requires_positive_identity_but_dead_root_needs_no_kill() {\n+ use spt_store::proc::ProcIdentity;\n+ for (pid, born, observed, expected, killed_pid) in [\n+ (Some(42), Some(100), ProcIdentity::Present(100), Ok(()), Some(42)),\n+ (Some(42), None, ProcIdentity::Present(100), Err(\"identity-unproven\"), None),\n+ (Some(42), Some(100), ProcIdentity::Unproven, Err(\"identity-unproven\"), None),\n+ (None, Some(100), ProcIdentity::Present(100), Err(\"pid-unknown\"), None),\n+ (Some(42), None, ProcIdentity::Absent, Ok(()), None),\n+ ] {\n+ let mut killed = None;\n+ let result = reap_zombie_root(pid, born, |_| observed, |target| killed = Some(target));\n+ assert_eq!(result, expected, \"{pid:?} / {born:?} / {observed:?}\");\n+ assert_eq!(killed, killed_pid, \"{pid:?} / {born:?} / {observed:?}\");\n+ }\n+ }\n+\n /// [unit->REQ-LIVENESS-ORACLE-SOUND] the NO-SNAPSHOT arm, pinned WITHOUT a\n /// platform that lacks a process table — the one claim neither the\n /// manufactured corpse nor the int can make, since both run where a table\ndiff --git a/docs/KNOWN-HAZARDS.md b/docs/KNOWN-HAZARDS.md\nindex 8ab726b7..6f4ad578 100644\n--- a/docs/KNOWN-HAZARDS.md\n+++ b/docs/KNOWN-HAZARDS.md\n@@ -845,6 +845,8 @@ These were absent from the sister-project harvest; codex surfaced them as load-b\n - **Failure (paid-for, hertz v0.39.4 field RCA 2026-07-22, doyle code-verified same day):** `resume.pid` custody is a bare PID consumed as `read_resume_pid(..).is_some_and(is_process_alive)` at BOTH the livehost restart gate and the liveness-reconcile DEFER. A dead wake-resume spawn's pid, recycled by the OS onto an unrelated process (field proof: `resume.pid=29456` resolved to a random `cmd.exe`), reads as \"a resume is in flight\" indefinitely: reconcile defers every tick, the row stays online-authoritative, and the endpoint is FALSE-ONLINE with no self-repair — every reader faithfully resurrects the lie. The ABA problem, in process custody.\n - **Invariant:** a custody record that gates lifecycle decisions stores an **identity pair (pid + process creation time)**, written atomically at spawn-mint; consumers test the PAIR, and a mismatch means NOT OURS — the discovering reader DELETES the record and proceeds as if no custody existed (self-heal, not error). Bind and reap clear custody atomically with their own outcome. Creation time comes from the process snapshot, never a retained handle (7.50); no snapshot ⇒ \"unproven\" ⇒ defer ONE tick, never a manufactured verdict.\n - **spt-core mapping:** `spt-daemon/src/livehost.rs` (restart gate + reconcile DEFER custody reads); `spt-store` resume-custody record + `proc.rs` snapshot identity; regression = the recycled-pid rig (custody pair mismatching a live impostor pid → record deleted, reconcile proceeds, row goes honest).\n+\n+- **Zombie-reap kill boundary (releases#285):** `broker.rs` captures the PTY root's creation time before starting its exit waiter; a later zombie verdict alone never licenses killing that remembered number. Fresh death permits cleanup without a signal; otherwise the live start time must match. `SPAWN_ZOMBIE_REAP_DECLINE` means neither tree-kill nor forced de-table runs, including any resource-drop fallback. The regression injects a different birth at the same PID and observes refusal with no kill. This is not atomic with the numeric tree-kill; the check-to-signal race and Linux same-tick identity collision remain (ADR-0041 decision 6).\n - **Source:** DAEMON-LIFECYCLE W1 (ADR-0047 decision 1; hertz field RCA bug 1).\n \n ### 7.52 An operator stop outranks every implicit ensure — no convenience path resurrects what the operator just killed `[REQ-HAZARD-STOP-RESPAWN-CONVOY]`\ndiff --git a/docs/adr/0041-endpoint-lifecycle-truth.md b/docs/adr/0041-endpoint-lifecycle-truth.md\nindex 4e83f020..ca94dfa2 100644\n--- a/docs/adr/0041-endpoint-lifecycle-truth.md\n+++ b/docs/adr/0041-endpoint-lifecycle-truth.md\n@@ -80,6 +80,33 @@ authority ever verifies or normalizes.**\n honestly); the shutdown state machine consults the same source, so \"is it live\" has one\n answer (no ALREADY_LIVE/OFFLINE/NO_EDGE three-way contradiction).\n \n+\n+ **Zombie-kill identity guard (releases#285).** Liveness is not permission to\n+ kill a remembered PID. The broker records the root's OS creation time just\n+ after PTY spawn, before starting its exit waiter. The child is still owned:\n+ on Windows its handle is retained; on Unix it has not been reaped, so its\n+ number cannot yet be recycled. The expected identity is never refreshed at\n+ reap time. Start time is preferred over image because a launcher can `exec`\n+ another image without becoming a different process.\n+\n+ At the zombie kill boundary, a fresh owned-process death probe permits\n+ stale-row cleanup for a dead root **without any PID/tree kill**. Otherwise a\n+ fresh start-time query must match the captured stamp before tree-kill.\n+ Unknown PID, missing/unreadable identity, or a changed stamp emits\n+ `SPAWN_ZOMBIE_REAP_DECLINE` and fails the spawn request **before** the forced\n+ de-table loop. There is no fallback `session.kill`, teardown dispatch, or\n+ session-resource drop on refusal; the old row remains for its normal exit\n+ waiter. This deliberately trades automatic recovery of an unverifiable\n+ live-number row for safety, rather than using cleanup as an indirect kill.\n+ Fresh-dead cleanup retains the existing snapshot-less Unix liveness fallback.\n+\n+ **Limits:** this is a checked numeric tree-kill, not an atomic handle/pidfd\n+ tree termination. A process can exit and its PID can be reused after the\n+ identity query and before a signal; descendant enumeration/kill retains the\n+ same race. Linux start times have clock-tick resolution, so same-tick reuse\n+ is indistinguishable; Windows uses creation FILETIME. This scoped guard does\n+ not change generic `kill_pid_tree` or other kill sites.\n+\n ## Consequences\n \n - A dead endpoint converges to offline+suspended+uncontrolled within one reconcile, from\ndiff --git a/traceable-reqs.toml b/traceable-reqs.toml\nindex 21917ea9..b518a80c 100644\n--- a/traceable-reqs.toml\n+++ b/traceable-reqs.toml\n@@ -2840,6 +2840,11 @@ id = \"REQ-ENDPOINT-CYCLE-HONEST\"\n title = \"REGISTRY-LIFECYCLE W3 (ADR-0041 decision 6, operator deployah stop/run wedge): cycle verbs share ONE liveness authority — the ALREADY_LIVE dup-guard liveness-probes the claimed session client tree before refusing (dead tree means reap + respawn honestly, never a refusal citing a zombie); the shutdown state machine consults the same source so is-it-live has one answer (no ALREADY_LIVE / list-OFFLINE / shutdown-NO_EDGE three-way contradiction on the same endpoint). Gate: impl — probing dup-guard + unified authority; unit — dead-tree claim probes and reaps, live claim still refuses; int — controlled zombie (killed client tree, surviving hosted record) leads to endpoint run succeeding honestly end-to-end; doc — ADR-0041.\"\n required_stages = [\"doc\",\"impl\",\"unit\",\"int\"] # W3 ACTIVATED at build start (todlando 2026-07-17).\n \n+[[requirements]]\n+id = \"REQ-BROKER-ZOMBIE-IDENTITY\"\n+title = \"Broker zombie reaping checks the session root's spawn-time process identity before tree-kill; unknown or changed identity declines without teardown, while a provably dead root still permits stale-session cleanup without signaling its remembered PID\"\n+required_stages = [\"doc\", \"impl\", \"unit\"] # releases#285: deterministic injected identity/kill boundary; existing cycle tests cover dead-root convergence.\n+\n [[requirements]]\n id = \"REQ-GOSSIP-PROJECT-DERIVE-ONCE\"\n title = \"REGISTRY-LIFECYCLE W4 fast-follow (hertz v0.37.0 field-verify CPU-gate FAIL RCA 2026-07-17, doyle seam-verified same day; timing-pinned ~16s burst clusters per 30s Registry pump round): recent-project gossip derives a project id AT MOST ONCE PER DISTINCT CWD per advertisement round — recent_projects_for dedups the RAW cwd string BEFORE project_id_for_dir (today seen.insert(pid) dedups AFTER derivation at registryhost.rs:1001, so every duplicate-cwd sessions.log row pays a git remote/rev-parse spawn: ~200 derivations/round on a 12-perch box, the post-self-hash-fix CPU floor). The pid-level dedup stays as the output-uniqueness second layer (distinct cwd spellings may collapse to one project); ordering semantics unchanged (first-occurrence newest-first); bounded ledger read unchanged. Gate: impl — cwd-dedup before derivation; unit — derivation-count observable == distinct cwds not ledger rows (duplicate-cwd ledger derives once), output/order parity vs the pre-fix shape on a mixed ledger. SEEDED SEPARATELY (not this REQ): gossip leg consults the ADR-0037 materialized index (kills git entirely + cross-round rederivation; staleness-semantics design change) + epoch-mint batching (26 atomic writes/round; durable-monotonic contract change).\"\n@@ -4475,6 +4480,7 @@ name = \"daemon-process-lifecycle\"\n requirements = [\n \"REQ-BROKER-STOP-DENY-NAMES-BLAST\",\n \"REQ-BROKER-STOP-ENDPOINT-DENY\",\n+ \"REQ-BROKER-ZOMBIE-IDENTITY\",\n \"REQ-DAEMON-1\",\n \"REQ-DAEMON-3\",\n \"REQ-DAEMON-4\",","startLine":1,"lineNumbers":[1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294,295,296]},"meta":{"source":{"type":"internal","value":"artifact://115"}}},"isError":false,"timestamp":1789001106589}}
{"type":"message","id":"f80b117e","parentId":"64e1c59e","timestamp":"2026-09-10T00:45:06.590Z","message":{"role":"toolResult","toolCallId":"call_KZxPV61HUHpsYMkmhw1sS4Ft|fc_02547c41fbf377fa016aa1fd91035087d2b974c43cf23fb5b9","toolName":"read","content":[{"type":"text","text":"@AGENTS.md\n\n"}],"details":{"totalLines":7,"displayContent":{"text":"@AGENTS.md\r\n\r\n\r","startLine":1,"lineNumbers":[1,2,3,4,5,6,7]},"fileSize":293,"meta":{"source":{"type":"path","value":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.worktrees\\285-zombie\\CLAUDE.md"}}},"isError":false,"timestamp":1789001106590}}
{"type":"message","id":"ca13efa5","parentId":"f80b117e","timestamp":"2026-09-10T00:45:06.591Z","message":{"role":"toolResult","toolCallId":"call_vicvwj7YAEiaSMAbK0aWWLPh|fc_02547c41fbf377fa016aa1fd91035887d2889f203f11c08952","toolName":"read","content":[{"type":"text","text":"# ADR-0041: Endpoint lifecycle truth — online classification, terminal normalization, stamp convergence, truthful create\n\n- Status: accepted (doyle triage 2026-07-17, REGISTRY-LIFECYCLE milestone)\n- Source: three hertz reports (2026-07-16, doyle seam-verified same day — emphasys triple,\n rest-normalize, spawn-fresh) + the operator-field deployah stop/run wedge. KNOWN-HAZARDS\n 7.45. Kin: ADR-0027 (unbound endpoint state), ADR-0033 (wake-resume via reconcile\n intent), KH 7.27/7.29.\n\n## Context\n\nFour proven defect families share one root shape: **endpoint lifecycle state is written by\nmultiple non-converging paths, and several of them stamp optimistic state that no\nauthority ever verifies or normalizes.**\n\n1. **Hybrid false-ONLINE (emphasys C1).** `cmd_listen` stamps `status=online` from manifest\n `psyche_init` alone (live_capable) — no persisted-state or hosting-authority check —\n minting `ready_agent`/`controllable=false` hybrid rows born online-authoritative. The\n livehost reconcile skips `state != live_agent` rows AND gates cleanup on\n `controllable=true`, so a dead-PID hybrid survives every restart; `is_perch_alive`\n trusts `status=online` and skips dead-PID rejection — every reader faithfully\n resurrects the lie.\n2. **Zombie WAKE_RESUME (rest-normalize).** `rest_state` is intent, distinct from liveness.\n Definitive session death (broker session loss, liveness reap, `cmd_stop`) stamps\n `status=offline` ONLY — never touches `rest_state`/`dormant_since_ms`. A dead session\n with preserved `Active` intent = an outstanding wake order: reconcile offlines it, a\n later pass RESUMES it from the ledger, repeatedly, across generations (perri field:\n repeated `WAKE_RESUME` loops).\n3. **Poll-vs-reap relatch (emphasys C3).** `KIND_SESSIONS` snapshots controller truth under\n lock but writes stamps after unlock; an exit-waiter reap in between lets the stale poll\n relatch `controlled=true` on a session that just died.\n4. **Untruthful create + contradictory liveness (spawn-fresh + cycle wedge).**\n `endpoint run --create` promises a fresh session but dispatch discards `create`; the\n broker dedups every labeled SpawnReq into `Spawned(existing)` with no disposition — the\n CLI prints success for a spawn that never happened. Meanwhile the ALREADY_LIVE dup-guard\n and the shutdown state machine consult DIFFERENT liveness sources and contradict each\n other on the same zombie (deployah wedge: run says ALREADY_LIVE, list says OFFLINE,\n shutdown says NO_EDGE).\n\n## Decision\n\n\n1. **Online is earned, not declared.** A creator may stamp `status=online` only from actual\n persisted state + hosting authority — never from manifest capability alone. Legacy\n hybrid rows self-heal at reconcile, but only after a SUCCESSFUL broker query: a broker\n failure is never interpreted as an empty session set (no mass-offline on a hiccup).\n2. **Control cleanup splits from offline classification.** Reconcile clears\n `controlled`/`driven_by`/`viewer_count` for EVERY endpoint absent from session truth —\n regardless of state or controllability — while offline classification keeps its narrow\n gate (live_agent + controllable). A row's classification quirk can never shield stale\n control stamps.\n\n3. **Definitive death normalizes terminally and atomically.** One store-level mutation —\n `status=offline` + `rest_state=suspended` + clear `dormant_since_ms` in the SAME\n info.json write — invoked at every definitive hosted-session-loss point (authoritative\n broker session loss, liveness reap, `cmd_stop`). Explicitly NOT\n `daemon_rest_event(Suspend)` (no edge when effective state is already Suspended — the\n raw Active intent survives), and NOT a reader-side blanket offline⇒suspended (that\n destroys explicit-Wake semantics: wake writes intent first, reconcile consumes it).\n Graceful shutdown keeps its echo-before-teardown; this is terminal normalization for\n non-graceful death.\n\n4. **Control stamps converge, validated.** Stamp writes carry session/generation validation\n (or serialize per-endpoint stamp transitions) so a pre-reap snapshot can never overwrite\n a post-reap truth. No fs I/O under global locks (KH 7.12). Every no-session path clears\n all three control fields.\n\n5. **Create is truthful at the broker, atomically.** Spawn policies split:\n Fresh/RejectExisting vs ResumeOrReuse. New `KIND_SPAWN_FRESH` wire verb with a TYPED\n conflict outcome (a distinct kind fails loud on an N-1 broker; a serde-defaulted field\n would be silently ignored — wire discipline), sharing the single-flight/PTY spawn body.\n Fresh at AlreadyLive/lost-race returns the conflict, never `Spawned(existing)`. CLI:\n exit 1 + stable `ENDPOINT_CREATE_CONFLICT::…no session was created`, no attach, no\n state mutation, never kills the live session. Omitted `--resume` keeps the documented\n create-default (fresh-and-conflict, same as explicit `--create`); ensure/attach would be\n a NEW documented mode, never a silent overload. Preflight stays UX-only (cannot close\n TOCTOU).\n\n6. **One liveness authority for cycle verbs.** The ALREADY_LIVE dup-guard liveness-probes\n the claimed session's client tree before refusing (dead tree ⇒ reap + respawn\n honestly); the shutdown state machine consults the same source, so \"is it live\" has one\n answer (no ALREADY_LIVE/OFFLINE/NO_EDGE three-way contradiction).\n\n\n **Zombie-kill identity guard (releases#285).** Liveness is not permission to\n kill a remembered PID. The broker records the root's OS creation time just\n after PTY spawn, before starting its exit waiter. The child is still owned:\n on Windows its handle is retained; on Unix it has not been reaped, so its\n number cannot yet be recycled. The expected identity is never refreshed at\n reap time. Start time is preferred over image because a launcher can `exec`\n another image without becoming a different process.\n\n At the zombie kill boundary, a fresh owned-process death probe permits\n stale-row cleanup for a dead root **without any PID/tree kill**. Otherwise a\n fresh start-time query must match the captured stamp before tree-kill.\n Unknown PID, missing/unreadable identity, or a changed stamp emits\n `SPAWN_ZOMBIE_REAP_DECLINE` and fails the spawn request **before** the forced\n de-table loop. There is no fallback `session.kill`, teardown dispatch, or\n session-resource drop on refusal; the old row remains for its normal exit\n waiter. This deliberately trades automatic recovery of an unverifiable\n live-number row for safety, rather than using cleanup as an indirect kill.\n Fresh-dead cleanup retains the existing snapshot-less Unix liveness fallback.\n\n **Limits:** this is a checked numeric tree-kill, not an atomic handle/pidfd\n tree termination. A process can exit and its PID can be reused after the\n identity query and before a signal; descendant enumeration/kill retains the\n same race. Linux start times have clock-tick resolution, so same-tick reuse\n is indistinguishable; Windows uses creation FILETIME. This scoped guard does\n not change generic `kill_pid_tree` or other kill sites.\n\n## Consequences\n\n- A dead endpoint converges to offline+suspended+uncontrolled within one reconcile, from\n every death path, and stays there until an explicit wake or run — no resurrection loops,\n no zombie control latches, no immortal hybrid rows.\n- `--create` becomes a contract: success ⇒ a fresh session exists; conflict ⇒ typed, loud,\n side-effect-free. Existing no-dup safety tests remain valid (they codify the dedup body\n this shares).\n- New wire surface: `KIND_SPAWN_FRESH` (additive verb). N-1 broker answers unknown-kind ⇒\n CLI reports the loud IPC failure, never a fake Created.\n- Explicit-Wake semantics are preserved by construction (intent normalization happens only\n on definitive death observations, never speculatively in readers).\n\n## Requirements\n\n`REQ-ENDPOINT-ONLINE-TRUTH`, `REQ-REST-TERMINAL-NORMALIZE`, `REQ-CONTROL-STAMP-CONVERGENCE`,\n`REQ-STREAM-LEASE-CLASSES` (mechanism in ADR-0040 decision 6),\n`REQ-HAZARD-ENDPOINT-LIFECYCLE` (KH 7.45); W3: `REQ-SPAWN-FRESH-TRUTHFUL`,\n`REQ-ENDPOINT-CYCLE-HONEST`.\n\n\n## Amendment (RC-RENDER-TRUTH v0.38.1 leg 3, doyle ruling 2026-07-19): one hosting authority — the online-earn authority splits by hosting topology\n\nPersisted `state` is the durable endpoint TYPE (REQ-EP-6 open type system;\n`establish_perch`'s prior-type preserve is INTENTIONAL and stays). The source-definitive\nBROKER-PTY hosting authority is `controllable == Some(true)`, NOT `state`.\n\n**Field root (a coverage gap, not a new hazard family).** An spt-hosted bind OVER a prior\n`ready_agent` perch preserves `state = ready_agent` while stamping `controllable = true` +\n`online`. Pre-amendment this row was IMMORTAL: `restart_resume_gate` skipped\n`state != live_agent` so the orphan never resumed, and the reconcile dead-pid hybrid heal\nwas scoped `controllable == Some(false)` so `controllable == true` escaped terminal-offline\n— a dead-PID `ready_agent` hybrid projected Active forever (rc's no-session refusal was\ntruthful). The online-ness was never the bug; the UNHEALED-ness was.\n\n**Resolution.** Hosting authority = `controllable`, applied consistently at every seam so\nthe three seams agree on what \"hosted\" means:\n\n1. **`restart_resume_gate` keys on `online + controllable + belts`, no `state` arg.**\n endpoint_survival tables BOTH `live_agent` and `ready_agent` broker-owned rows — both\n RESUME their PTY at daemon start.\n2. **The reconcile routes only `non-live_agent && controllable != Some(true)` through the\n PID-model hybrid heal.** A `controllable == Some(true)` row (any state) falls through to\n BROKER-SESSION truth: orphan with ledger/adapter material ⇒ Resume; no session + dead\n custody ⇒ terminal-offline via the atomic normalize. The immortal hybrid is now fully\n managed.\n3. **`cmd_bind` earns `online` from the PERSISTED record it just wrote, on\n `controllable == Some(true)` — never the requested arg.** This makes the online signal\n `==` `restart_resume_gate`'s resume predicate (online+controllable) by construction, so\n there is never an online-but-unresumable perch.\n\n**The online-earn AUTHORITY SPLITS by hosting topology** (both obey the SAME discipline —\nearn from persisted truth, never the requested arg — differing only in which persisted\ndatum is the authority):\n\n- **Messaging / `listen`** (no broker PTY) earns `online` on persisted `state == live_agent`\n (ADR-0041 decision 1, `listen_online_gate`, UNCHANGED). This still refuses the\n capability-only phantom it closed — a `controllable == false` row born online off manifest\n capability alone.\n- **Broker-PTY / `bind`** earns `online` on persisted `controllable == Some(true)`. This is\n REAL hosted state (the daemon spawned a live session into a broker-owned PTY), so it does\n NOT reopen the capability-only-phantom hole — that hole was `controllable == false`.\n\n**Psyche hosting stays separately state-gated** (`live_agent` only, at the reconcile\npulse-host): a `ready_agent`-preserved bind is online + controllable + PTY-resumable + NO\nPsyche — all consistent. `psyche_init` is NOT part of the online predicate; a `live_agent`\nbroker PTY with no psyche is still a live resumable session (online is truthful).\n\nRequirement: `REQ-HOSTING-AUTHORITY-CONTROLLABLE`."}],"details":{"totalLines":178,"displayContent":{"text":"# ADR-0041: Endpoint lifecycle truth — online classification, terminal normalization, stamp convergence, truthful create\r\n\r\n- Status: accepted (doyle triage 2026-07-17, REGISTRY-LIFECYCLE milestone)\r\n- Source: three hertz reports (2026-07-16, doyle seam-verified same day — emphasys triple,\r\n rest-normalize, spawn-fresh) + the operator-field deployah stop/run wedge. KNOWN-HAZARDS\r\n 7.45. Kin: ADR-0027 (unbound endpoint state), ADR-0033 (wake-resume via reconcile\r\n intent), KH 7.27/7.29.\r\n\r\n## Context\r\n\r\nFour proven defect families share one root shape: **endpoint lifecycle state is written by\r\nmultiple non-converging paths, and several of them stamp optimistic state that no\r\nauthority ever verifies or normalizes.**\r\n\r\n1. **Hybrid false-ONLINE (emphasys C1).** `cmd_listen` stamps `status=online` from manifest\r\n `psyche_init` alone (live_capable) — no persisted-state or hosting-authority check —\r\n minting `ready_agent`/`controllable=false` hybrid rows born online-authoritative. The\r\n livehost reconcile skips `state != live_agent` rows AND gates cleanup on\r\n `controllable=true`, so a dead-PID hybrid survives every restart; `is_perch_alive`\r\n trusts `status=online` and skips dead-PID rejection — every reader faithfully\r\n resurrects the lie.\r\n2. **Zombie WAKE_RESUME (rest-normalize).** `rest_state` is intent, distinct from liveness.\r\n Definitive session death (broker session loss, liveness reap, `cmd_stop`) stamps\r\n `status=offline` ONLY — never touches `rest_state`/`dormant_since_ms`. A dead session\r\n with preserved `Active` intent = an outstanding wake order: reconcile offlines it, a\r\n later pass RESUMES it from the ledger, repeatedly, across generations (perri field:\r\n repeated `WAKE_RESUME` loops).\r\n3. **Poll-vs-reap relatch (emphasys C3).** `KIND_SESSIONS` snapshots controller truth under\r\n lock but writes stamps after unlock; an exit-waiter reap in between lets the stale poll\r\n relatch `controlled=true` on a session that just died.\r\n4. **Untruthful create + contradictory liveness (spawn-fresh + cycle wedge).**\r\n `endpoint run --create` promises a fresh session but dispatch discards `create`; the\r\n broker dedups every labeled SpawnReq into `Spawned(existing)` with no disposition — the\r\n CLI prints success for a spawn that never happened. Meanwhile the ALREADY_LIVE dup-guard\r\n and the shutdown state machine consult DIFFERENT liveness sources and contradict each\r\n other on the same zombie (deployah wedge: run says ALREADY_LIVE, list says OFFLINE,\r\n shutdown says NO_EDGE).\r\n\r\n## Decision\r\n\r\n\r\n1. **Online is earned, not declared.** A creator may stamp `status=online` only from actual\r\n persisted state + hosting authority — never from manifest capability alone. Legacy\r\n hybrid rows self-heal at reconcile, but only after a SUCCESSFUL broker query: a broker\r\n failure is never interpreted as an empty session set (no mass-offline on a hiccup).\r\n2. **Control cleanup splits from offline classification.** Reconcile clears\r\n `controlled`/`driven_by`/`viewer_count` for EVERY endpoint absent from session truth —\r\n regardless of state or controllability — while offline classification keeps its narrow\r\n gate (live_agent + controllable). A row's classification quirk can never shield stale\r\n control stamps.\r\n\r\n3. **Definitive death normalizes terminally and atomically.** One store-level mutation —\r\n `status=offline` + `rest_state=suspended` + clear `dormant_since_ms` in the SAME\r\n info.json write — invoked at every definitive hosted-session-loss point (authoritative\r\n broker session loss, liveness reap, `cmd_stop`). Explicitly NOT\r\n `daemon_rest_event(Suspend)` (no edge when effective state is already Suspended — the\r\n raw Active intent survives), and NOT a reader-side blanket offline⇒suspended (that\r\n destroys explicit-Wake semantics: wake writes intent first, reconcile consumes it).\r\n Graceful shutdown keeps its echo-before-teardown; this is terminal normalization for\r\n non-graceful death.\r\n\r\n4. **Control stamps converge, validated.** Stamp writes carry session/generation validation\r\n (or serialize per-endpoint stamp transitions) so a pre-reap snapshot can never overwrite\r\n a post-reap truth. No fs I/O under global locks (KH 7.12). Every no-session path clears\r\n all three control fields.\r\n\r\n5. **Create is truthful at the broker, atomically.** Spawn policies split:\r\n Fresh/RejectExisting vs ResumeOrReuse. New `KIND_SPAWN_FRESH` wire verb with a TYPED\r\n conflict outcome (a distinct kind fails loud on an N-1 broker; a serde-defaulted field\r\n would be silently ignored — wire discipline), sharing the single-flight/PTY spawn body.\r\n Fresh at AlreadyLive/lost-race returns the conflict, never `Spawned(existing)`. CLI:\r\n exit 1 + stable `ENDPOINT_CREATE_CONFLICT::…no session was created`, no attach, no\r\n state mutation, never kills the live session. Omitted `--resume` keeps the documented\r\n create-default (fresh-and-conflict, same as explicit `--create`); ensure/attach would be\r\n a NEW documented mode, never a silent overload. Preflight stays UX-only (cannot close\r\n TOCTOU).\r\n\r\n6. **One liveness authority for cycle verbs.** The ALREADY_LIVE dup-guard liveness-probes\r\n the claimed session's client tree before refusing (dead tree ⇒ reap + respawn\r\n honestly); the shutdown state machine consults the same source, so \"is it live\" has one\r\n answer (no ALREADY_LIVE/OFFLINE/NO_EDGE three-way contradiction).\r\n\r\n\r\n **Zombie-kill identity guard (releases#285).** Liveness is not permission to\r\n kill a remembered PID. The broker records the root's OS creation time just\r\n after PTY spawn, before starting its exit waiter. The child is still owned:\r\n on Windows its handle is retained; on Unix it has not been reaped, so its\r\n number cannot yet be recycled. The expected identity is never refreshed at\r\n reap time. Start time is preferred over image because a launcher can `exec`\r\n another image without becoming a different process.\r\n\r\n At the zombie kill boundary, a fresh owned-process death probe permits\r\n stale-row cleanup for a dead root **without any PID/tree kill**. Otherwise a\r\n fresh start-time query must match the captured stamp before tree-kill.\r\n Unknown PID, missing/unreadable identity, or a changed stamp emits\r\n `SPAWN_ZOMBIE_REAP_DECLINE` and fails the spawn request **before** the forced\r\n de-table loop. There is no fallback `session.kill`, teardown dispatch, or\r\n session-resource drop on refusal; the old row remains for its normal exit\r\n waiter. This deliberately trades automatic recovery of an unverifiable\r\n live-number row for safety, rather than using cleanup as an indirect kill.\r\n Fresh-dead cleanup retains the existing snapshot-less Unix liveness fallback.\r\n\r\n **Limits:** this is a checked numeric tree-kill, not an atomic handle/pidfd\r\n tree termination. A process can exit and its PID can be reused after the\r\n identity query and before a signal; descendant enumeration/kill retains the\r\n same race. Linux start times have clock-tick resolution, so same-tick reuse\r\n is indistinguishable; Windows uses creation FILETIME. This scoped guard does\r\n not change generic `kill_pid_tree` or other kill sites.\r\n\r\n## Consequences\r\n\r\n- A dead endpoint converges to offline+suspended+uncontrolled within one reconcile, from\r\n every death path, and stays there until an explicit wake or run — no resurrection loops,\r\n no zombie control latches, no immortal hybrid rows.\r\n- `--create` becomes a contract: success ⇒ a fresh session exists; conflict ⇒ typed, loud,\r\n side-effect-free. Existing no-dup safety tests remain valid (they codify the dedup body\r\n this shares).\r\n- New wire surface: `KIND_SPAWN_FRESH` (additive verb). N-1 broker answers unknown-kind ⇒\r\n CLI reports the loud IPC failure, never a fake Created.\r\n- Explicit-Wake semantics are preserved by construction (intent normalization happens only\r\n on definitive death observations, never speculatively in readers).\r\n\r\n## Requirements\r\n\r\n`REQ-ENDPOINT-ONLINE-TRUTH`, `REQ-REST-TERMINAL-NORMALIZE`, `REQ-CONTROL-STAMP-CONVERGENCE`,\r\n`REQ-STREAM-LEASE-CLASSES` (mechanism in ADR-0040 decision 6),\r\n`REQ-HAZARD-ENDPOINT-LIFECYCLE` (KH 7.45); W3: `REQ-SPAWN-FRESH-TRUTHFUL`,\r\n`REQ-ENDPOINT-CYCLE-HONEST`.\r\n\r\n\r\n## Amendment (RC-RENDER-TRUTH v0.38.1 leg 3, doyle ruling 2026-07-19): one hosting authority — the online-earn authority splits by hosting topology\r\n\r\nPersisted `state` is the durable endpoint TYPE (REQ-EP-6 open type system;\r\n`establish_perch`'s prior-type preserve is INTENTIONAL and stays). The source-definitive\r\nBROKER-PTY hosting authority is `controllable == Some(true)`, NOT `state`.\r\n\r\n**Field root (a coverage gap, not a new hazard family).** An spt-hosted bind OVER a prior\r\n`ready_agent` perch preserves `state = ready_agent` while stamping `controllable = true` +\r\n`online`. Pre-amendment this row was IMMORTAL: `restart_resume_gate` skipped\r\n`state != live_agent` so the orphan never resumed, and the reconcile dead-pid hybrid heal\r\nwas scoped `controllable == Some(false)` so `controllable == true` escaped terminal-offline\r\n— a dead-PID `ready_agent` hybrid projected Active forever (rc's no-session refusal was\r\ntruthful). The online-ness was never the bug; the UNHEALED-ness was.\r\n\r\n**Resolution.** Hosting authority = `controllable`, applied consistently at every seam so\r\nthe three seams agree on what \"hosted\" means:\r\n\r\n1. **`restart_resume_gate` keys on `online + controllable + belts`, no `state` arg.**\r\n endpoint_survival tables BOTH `live_agent` and `ready_agent` broker-owned rows — both\r\n RESUME their PTY at daemon start.\r\n2. **The reconcile routes only `non-live_agent && controllable != Some(true)` through the\r\n PID-model hybrid heal.** A `controllable == Some(true)` row (any state) falls through to\r\n BROKER-SESSION truth: orphan with ledger/adapter material ⇒ Resume; no session + dead\r\n custody ⇒ terminal-offline via the atomic normalize. The immortal hybrid is now fully\r\n managed.\r\n3. **`cmd_bind` earns `online` from the PERSISTED record it just wrote, on\r\n `controllable == Some(true)` — never the requested arg.** This makes the online signal\r\n `==` `restart_resume_gate`'s resume predicate (online+controllable) by construction, so\r\n there is never an online-but-unresumable perch.\r\n\r\n**The online-earn AUTHORITY SPLITS by hosting topology** (both obey the SAME discipline —\r\nearn from persisted truth, never the requested arg — differing only in which persisted\r\ndatum is the authority):\r\n\r\n- **Messaging / `listen`** (no broker PTY) earns `online` on persisted `state == live_agent`\r\n (ADR-0041 decision 1, `listen_online_gate`, UNCHANGED). This still refuses the\r\n capability-only phantom it closed — a `controllable == false` row born online off manifest\r\n capability alone.\r\n- **Broker-PTY / `bind`** earns `online` on persisted `controllable == Some(true)`. This is\r\n REAL hosted state (the daemon spawned a live session into a broker-owned PTY), so it does\r\n NOT reopen the capability-only-phantom hole — that hole was `controllable == false`.\r\n\r\n**Psyche hosting stays separately state-gated** (`live_agent` only, at the reconcile\r\npulse-host): a `ready_agent`-preserved bind is online + controllable + PTY-resumable + NO\r\nPsyche — all consistent. `psyche_init` is NOT part of the online predicate; a `live_agent`\r\nbroker PTY with no psyche is still a live resumable session (online is truthful).\r\n\r\nRequirement: `REQ-HOSTING-AUTHORITY-CONTROLLABLE`.\r","startLine":1,"lineNumbers":[1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178]},"fileSize":11906,"meta":{"source":{"type":"path","value":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.worktrees\\285-zombie\\docs\\adr\\0041-endpoint-lifecycle-truth.md"}}},"isError":false,"timestamp":1789001106591}}
{"type":"message","id":"70c026da","parentId":"ca13efa5","timestamp":"2026-09-10T00:45:06.592Z","message":{"role":"toolResult","toolCallId":"call_M7LMEmqvw0UeDvDuB1ZZieXo|fc_02547c41fbf377fa016aa1fd91034887d2bbbd5b1ca171a3d2","toolName":"read","content":[{"type":"text","text":"# spt-core — agent working rules\n\nHarness-independent core for an agent ecosystem (messaging, live-agent lifecycle, terminal hosting, P2P networking, runtime-manifest harness contract). Rust crates + a single `spt` binary. Clean-room rebuild of `claude_skill_owl`.\n\n**Orientation — read before working:** `PRD.md` (requirements), `ROADMAP.md` (build path), `CONTEXT.md` (glossary/model, authoritative for meaning), `docs/adr/` (decisions), `docs/KNOWN-HAZARDS.md` (invariants we must not re-break), `docs/{STORAGE,MANIFEST,CONTEXT-MEMORY,DOCS-STRATEGY,TRACEABILITY}.md`.\n\nFor maintainer/debug update work, also read `docs/DEBUG-ROLLOUT.md` before touching the update-set or rollout path.\n\nFor work needing Linux tests and proof, this machine is authorized to ssh into a Linux box: `reavus@kitsubito`\n\nIMPORTANT: All agents you work alongside run on spt-core itself — the legacy-SPT (`$OWL`/`$LIVE`) era ended with the 2026-07 fleet migration; those commands are gone. Reach other agents with `spt send` (or the `/sptc:send` skill); keep message bodies short, and send long bodies from a file rather than inline. Everything else can be learned from the corresponding `/sptc:` skill doc.\n\n## Requirement traceability (binding)\n\nThis project uses `traceable-reqs` (`traceable-reqs.toml` = the authoritative `REQ-*` registry). The full contract is `docs/TRACEABILITY.md`. The rules you must follow:\n\n1. **Tag evidence in the same change.** When you write a function/test/doc-section that satisfies a requirement stage, add its tag in that same commit:\n `// [impl->REQ-FOO]` · `// [unit->REQ-FOO]` · ``\n Stages: `doc` / `impl` / `unit` / `int`. Tag *on or immediately above* the real evidence — never at file tops to satisfy coverage.\n2. **Run `traceable-reqs check` before declaring work done.** Exit-1 means missing/invalid evidence — fix it, don't ship it.\n3. **New requirement → add it to `traceable-reqs.toml` first** (with a `REQ-*` id), then satisfy it. No untracked work; no untagged evidence.\n4. **KNOWN-HAZARDS are `REQ-HAZARD-*` requirements** — each needs a test before it's \"covered.\" Treat the hazard list as a conformance checklist you must satisfy, not advice.\n5. **Activate, don't pre-fail.** Requirements you aren't yet working stay `required_stages = []`. Activate (set real stages) only when starting the milestone that delivers them.\n\n## Issue tracking (unique case)\n\nCodebase issues are maintained on **`BigscreenVR/spt-bs-releases`** — the less-private *releases* repo — NOT on `spt-bs-core` where the code lives. This is a deliberate exception (operator-ruled 2026-07-27): file, triage, and reference issues against `spt-bs-releases`.\n\nRequests and milestones are tracked through the **alchemy shell** (`alchemy-0`, the Requests shell bound to `spt-bs-releases`) on top of those GitHub issues. The label taxonomy is the workflow: `state:` BACKLOG → EVAL → GREENLIT → WIP → ACCEPTANCE → DONE (plus CUT / SHELVED), `type:` BUGFIX / ADDITION / CHANGE, `flag: NEEDS-OPERATOR`, and per-node `kind: SPT-TRACKING` pins (marked DO NOT DELETE — leave them alone).\n\n## Other conventions\n\n- Match surrounding code style; copy-verbatim the sister project's stable wire/schema formats (ADR-0001), clean-room everything else.\n- Honor every `docs/KNOWN-HAZARDS.md` invariant — these are real bugs already paid for once.\n- Docs are dual-audience (human + AI dev-agent) per `docs/DOCS-STRATEGY.md`; doc generation is CI-gated against drift.\n- Commit messages end with the project's co-author trailer, exact spelling `Co-authored by: ` (e.g. `Co-authored by: todlando`) — NOT git's hyphenated `Co-Authored-By:`; CI's runner-informant parses only the space spelling for attribution.\n - **Audit this trailer with `git log --grep` or a raw body read, NEVER `%(trailers:)`** (nor `interpret-trailers --parse`): git's trailer tokenizer requires a whitespace-free token, so the space spelling is structurally invisible to it and every trailer query returns a confident EMPTY on every commit — a clean zero that reads as total attribution loss. Measured 2026-07-30 (main @`8f3e10b`, Signed-off-by and hyphenated-key controls both parse); re-derived at full cost 2026-08-03 by one of its own original measurers, which is why this sentence lives here at the mandate rather than in a document you must decide to open.\n- **Worktrees (binding, operator-ruled 2026-07-05):** every `git worktree` (gate rigs, agent scratch, anything) goes under `.worktrees/` in THIS project's root (`.gitignore`d) — e.g. `git worktree add --detach .worktrees/gate- `. NEVER create worktrees as siblings of the project dir; stray sibling folders accumulate orphan-pinned skeletons and pollute `~/Documents/projects`. Remove yours when done (`git worktree remove` + prune; retry later if a handle pins it).\n\n- **Build-cache pools (binding, releases#103):** a cargo `target/` directory belongs to ONE source tree. Two trees building into one pool overwrite each other's artifacts and fabricate reds that belong to neither — the v0.51.0 W1/H1 `E0308` that vanished on re-run. **The rule is about the RELATIONSHIP, not the path:** a junction and a `CARGO_TARGET_DIR` env var reach the same hazard, and the env var leaves no directory entry to notice afterwards, so \"is this dir under `.worktrees/`\" never was the question. A build script enforces it (`crates/spt-store/build.rs`) and refuses with `SPT_POOL_FOREIGN`. **Sharing a pool SEQUENTIALLY is fine and expected** — a finished lane is taken over loudly, not refused; only a LIVE lane blocks you. Claim a pool at lane start …\n- **Target-tree teardown (releases#103, same lane):** never delete a `target/` you have not classified. Check OUTBOUND first (`Get-Item -Force`: a junction is deleted as a link, a real dir as a tree), then sweep INBOUND for reparse points aimed at it before removing a real one, and measure size and free space before and after so the reclaim is a number rather than a claim. Reap the target SUBTREE, never a session or worktree directory around it. Do not point `CARGO_TARGET_DIR` into a scratchpad (v0.50.0 incident) or at another checkout's target (H1 incident).\n- **CI / merge strategy:** golden CI (ADR-0050, ruled 2026-07-27) — milestone-batch golden runs, thin-lane PRs, ff-only main (tested sha == merged sha). Piloting from the next milestone; read the ADR before shaping a PR lane.\n\nIf you finish a significant body of work without need for user intervention, or if your context gets too high, you can clear your own context and keep moving:\n1. Create a JIT plan for the next immediate body of work, if it isn't already planned\n2. If you are a live agent, /sptc:commune with immediate next steps and broad summary of the project's status + end goal\n3. Execute the /self-clear skill\n\n[Some lines truncated to 768 chars]"}],"details":{"totalLines":47,"displayContent":{"text":"# spt-core — agent working rules\r\n\r\nHarness-independent core for an agent ecosystem (messaging, live-agent lifecycle, terminal hosting, P2P networking, runtime-manifest harness contract). Rust crates + a single `spt` binary. Clean-room rebuild of `claude_skill_owl`.\r\n\r\n**Orientation — read before working:** `PRD.md` (requirements), `ROADMAP.md` (build path), `CONTEXT.md` (glossary/model, authoritative for meaning), `docs/adr/` (decisions), `docs/KNOWN-HAZARDS.md` (invariants we must not re-break), `docs/{STORAGE,MANIFEST,CONTEXT-MEMORY,DOCS-STRATEGY,TRACEABILITY}.md`.\r\n\r\nFor maintainer/debug update work, also read `docs/DEBUG-ROLLOUT.md` before touching the update-set or rollout path.\r\n\r\nFor work needing Linux tests and proof, this machine is authorized to ssh into a Linux box: `reavus@kitsubito`\r\n\r\nIMPORTANT: All agents you work alongside run on spt-core itself — the legacy-SPT (`$OWL`/`$LIVE`) era ended with the 2026-07 fleet migration; those commands are gone. Reach other agents with `spt send` (or the `/sptc:send` skill); keep message bodies short, and send long bodies from a file rather than inline. Everything else can be learned from the corresponding `/sptc:` skill doc.\r\n\r\n## Requirement traceability (binding)\r\n\r\nThis project uses `traceable-reqs` (`traceable-reqs.toml` = the authoritative `REQ-*` registry). The full contract is `docs/TRACEABILITY.md`. The rules you must follow:\r\n\r\n1. **Tag evidence in the same change.** When you write a function/test/doc-section that satisfies a requirement stage, add its tag in that same commit:\r\n `// [impl->REQ-FOO]` · `// [unit->REQ-FOO]` · ``\r\n Stages: `doc` / `impl` / `unit` / `int`. Tag *on or immediately above* the real evidence — never at file tops to satisfy coverage.\r\n2. **Run `traceable-reqs check` before declaring work done.** Exit-1 means missing/invalid evidence — fix it, don't ship it.\r\n3. **New requirement → add it to `traceable-reqs.toml` first** (with a `REQ-*` id), then satisfy it. No untracked work; no untagged evidence.\r\n4. **KNOWN-HAZARDS are `REQ-HAZARD-*` requirements** — each needs a test before it's \"covered.\" Treat the hazard list as a conformance checklist you must satisfy, not advice.\r\n5. **Activate, don't pre-fail.** Requirements you aren't yet working stay `required_stages = []`. Activate (set real stages) only when starting the milestone that delivers them.\r\n\r\n## Issue tracking (unique case)\r\n\r\nCodebase issues are maintained on **`BigscreenVR/spt-bs-releases`** — the less-private *releases* repo — NOT on `spt-bs-core` where the code lives. This is a deliberate exception (operator-ruled 2026-07-27): file, triage, and reference issues against `spt-bs-releases`.\r\n\r\nRequests and milestones are tracked through the **alchemy shell** (`alchemy-0`, the Requests shell bound to `spt-bs-releases`) on top of those GitHub issues. The label taxonomy is the workflow: `state:` BACKLOG → EVAL → GREENLIT → WIP → ACCEPTANCE → DONE (plus CUT / SHELVED), `type:` BUGFIX / ADDITION / CHANGE, `flag: NEEDS-OPERATOR`, and per-node `kind: SPT-TRACKING` pins (marked DO NOT DELETE — leave them alone).\r\n\r\n## Other conventions\r\n\r\n- Match surrounding code style; copy-verbatim the sister project's stable wire/schema formats (ADR-0001), clean-room everything else.\r\n- Honor every `docs/KNOWN-HAZARDS.md` invariant — these are real bugs already paid for once.\r\n- Docs are dual-audience (human + AI dev-agent) per `docs/DOCS-STRATEGY.md`; doc generation is CI-gated against drift.\r\n- Commit messages end with the project's co-author trailer, exact spelling `Co-authored by: ` (e.g. `Co-authored by: todlando`) — NOT git's hyphenated `Co-Authored-By:`; CI's runner-informant parses only the space spelling for attribution.\r\n - **Audit this trailer with `git log --grep` or a raw body read, NEVER `%(trailers:)`** (nor `interpret-trailers --parse`): git's trailer tokenizer requires a whitespace-free token, so the space spelling is structurally invisible to it and every trailer query returns a confident EMPTY on every commit — a clean zero that reads as total attribution loss. Measured 2026-07-30 (main @`8f3e10b`, Signed-off-by and hyphenated-key controls both parse); re-derived at full cost 2026-08-03 by one of its own original measurers, which is why this sentence lives here at the mandate rather than in a document you must decide to open.\r\n- **Worktrees (binding, operator-ruled 2026-07-05):** every `git worktree` (gate rigs, agent scratch, anything) goes under `.worktrees/` in THIS project's root (`.gitignore`d) — e.g. `git worktree add --detach .worktrees/gate- `. NEVER create worktrees as siblings of the project dir; stray sibling folders accumulate orphan-pinned skeletons and pollute `~/Documents/projects`. Remove yours when done (`git worktree remove` + prune; retry later if a handle pins it).\r\n\r\n- **Build-cache pools (binding, releases#103):** a cargo `target/` directory belongs to ONE source tree. Two trees building into one pool overwrite each other's artifacts and fabricate reds that belong to neither — the v0.51.0 W1/H1 `E0308` that vanished on re-run. **The rule is about the RELATIONSHIP, not the path:** a junction and a `CARGO_TARGET_DIR` env var reach the same hazard, and the env var leaves no directory entry to notice afterwards, so \"is this dir under `.worktrees/`\" never was the question. A build script enforces it (`crates/spt-store/build.rs`) and refuses with `SPT_POOL_FOREIGN`. **Sharing a pool SEQUENTIALLY is fine and expected** — a finished lane is taken over loudly, not refused; only a LIVE lane blocks you. Claim a pool at lane start …\n- **Target-tree teardown (releases#103, same lane):** never delete a `target/` you have not classified. Check OUTBOUND first (`Get-Item -Force`: a junction is deleted as a link, a real dir as a tree), then sweep INBOUND for reparse points aimed at it before removing a real one, and measure size and free space before and after so the reclaim is a number rather than a claim. Reap the target SUBTREE, never a session or worktree directory around it. Do not point `CARGO_TARGET_DIR` into a scratchpad (v0.50.0 incident) or at another checkout's target (H1 incident).\r\n- **CI / merge strategy:** golden CI (ADR-0050, ruled 2026-07-27) — milestone-batch golden runs, thin-lane PRs, ff-only main (tested sha == merged sha). Piloting from the next milestone; read the ADR before shaping a PR lane.\r\n\r\nIf you finish a significant body of work without need for user intervention, or if your context gets too high, you can clear your own context and keep moving:\r\n1. Create a JIT plan for the next immediate body of work, if it isn't already planned\r\n2. If you are a live agent, /sptc:commune with immediate next steps and broad summary of the project's status + end goal\r\n3. Execute the /self-clear skill\r","startLine":1,"lineNumbers":[1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47]},"fileSize":8436,"meta":{"source":{"type":"path","value":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.worktrees\\285-zombie\\AGENTS.md"},"limits":{"columnTruncated":{"maxColumn":768}}}},"isError":false,"timestamp":1789001106592}}
{"type":"message","id":"99579bd0","parentId":"70c026da","timestamp":"2026-09-10T00:45:07.721Z","message":{"role":"toolResult","toolCallId":"call_oAKwcp0DZ5UoNYQvqbGvhtVo|fc_02547c41fbf377fa016aa1fd91036087d2bec21c6fea6c19ac","toolName":"read","content":[{"type":"text","text":"# Issue #285: broker.rs zombie reap kills a REMEMBERED pid without reading its image\n\nState: OPEN\nAuthor: @SaberMage\nCreated: 2026-09-07T11:02:02Z\nUpdated: 2026-09-09T23:17:45Z\nLabels: state: GREENLIT, type: BUGFIX\nURL: https://github.com/BigscreenVR/spt-bs-releases/issues/285\n\n## Body\n\n`crates/spt-daemon/src/broker.rs:8102` (zombie reap under `Gate::AlreadyLive{spid}`) terminates a pid remembered from the session record. `zombie_verdict` checks liveness BY NUMBER, a record property, live descendants and grace; the live process's IMAGE is never read, so under pid reuse the kill can land on an unrelated process. The correct pattern exists in-tree twice (`servicehost.rs:651` image compare via `same_image` before the kill + fresh read after; `livehost.rs:1135` positive basename/cmdline match or `LEGACY_PSYCHE_SWEEP_DECLINE`). Today's protection is accidental (`has_live_descendants` true while a brain child is up).\n\nAsk: verify identity (image path or start time) AT kill time and decline with a named breadcrumb on mismatch, at :8102 or inside `proc.rs:430` `kill_pid_tree` so no caller can forget it; a unit cell where the parked pid now names a different image asserts the DECLINE. Detail + narrower kin sites in the first comment. Source: hertz's read-only kill census 2026-09-07; filed by doyle. Owner todlando, post-W2 (#272).\n\n---\nRequester: doyle\n\n## Comments (1)\n\n### @SaberMage · 2026-09-07T11:02:24Z\n\nFiled by doyle from hertz's read-only kill census (.spt/PID-KILL-CENSUS.md, main ff4b405d, 2026-09-07).\n\n**Defect.** `crates/spt-daemon/src/broker.rs:8102` (zombie reap under `Gate::AlreadyLive{spid}`) terminates `spid`, a pid REMEMBERED from the session record. `zombie_verdict` consults `wrapper_alive` (liveness BY NUMBER), `adapter_labeled` (a property of the record, not the live process), `has_live_descendants`, and `past_grace`. The live process's IMAGE is never read. Under pid reuse (measured live on hfenduleam: 44 processes within 2000 of pid 14444; a nextest list phase spawns 226 binaries in 7.8 s) the reaped number can belong to an unrelated process.\n\n**The correct pattern already exists in-tree, twice.** `servicehost.rs:651` reads `exe_path(pid)` and compares it to the parked image via `same_image` before killing (\"WHO is it? The image path decides — never the number\"), with a fresh read after the kill; `livehost.rs:1135` kills only on a positive basename/cmdline match and emits `LEGACY_PSYCHE_SWEEP_DECLINE` otherwise. Today's protection at :8102 is accidental: `has_live_descendants` is true while a brain child is up, so the path is reached only when the brain is gone.\n\n**Fix shape.** Lift the image comparison into the zombie path, or into `spt-store` `proc.rs:430` `kill_pid_tree` itself so no caller can forget it: verify identity (image path, or start time) AT kill time, decline with a named breadcrumb on mismatch. Same class, narrower: `daemon.rs:3472` (`taskkill /PID` after `is_process_alive` only) and `shellhost.rs:639` (caller-supplied pid, no check). Unit: a cell that parks a pid, lets it die, and asserts the reap DECLINES when the number now names a different image.\n\n**Not claimed:** this does not explain the 08:03:15Z fleet-daemon death (RCA .spt/RCA-FLEET-DAEMON-14444.md, cause still open); it is the one production site that reaps a number it remembered across time. Owner: todlando, post-W2 (#272).\n\n*\\-doyle@HFENDULEAM*\n\nURL: https://github.com/BigscreenVR/spt-bs-releases/issues/285#issuecomment-5569639068"}],"details":{"contentType":"text/markdown","totalLines":35,"displayContent":{"text":"# Issue #285: broker.rs zombie reap kills a REMEMBERED pid without reading its image\n\nState: OPEN\nAuthor: @SaberMage\nCreated: 2026-09-07T11:02:02Z\nUpdated: 2026-09-09T23:17:45Z\nLabels: state: GREENLIT, type: BUGFIX\nURL: https://github.com/BigscreenVR/spt-bs-releases/issues/285\n\n## Body\n\n`crates/spt-daemon/src/broker.rs:8102` (zombie reap under `Gate::AlreadyLive{spid}`) terminates a pid remembered from the session record. `zombie_verdict` checks liveness BY NUMBER, a record property, live descendants and grace; the live process's IMAGE is never read, so under pid reuse the kill can land on an unrelated process. The correct pattern exists in-tree twice (`servicehost.rs:651` image compare via `same_image` before the kill + fresh read after; `livehost.rs:1135` positive basename/cmdline match or `LEGACY_PSYCHE_SWEEP_DECLINE`). Today's protection is accidental (`has_live_descendants` true while a brain child is up).\n\nAsk: verify identity (image path or start time) AT kill time and decline with a named breadcrumb on mismatch, at :8102 or inside `proc.rs:430` `kill_pid_tree` so no caller can forget it; a unit cell where the parked pid now names a different image asserts the DECLINE. Detail + narrower kin sites in the first comment. Source: hertz's read-only kill census 2026-09-07; filed by doyle. Owner todlando, post-W2 (#272).\n\n---\nRequester: doyle\n\n## Comments (1)\n\n### @SaberMage · 2026-09-07T11:02:24Z\n\nFiled by doyle from hertz's read-only kill census (.spt/PID-KILL-CENSUS.md, main ff4b405d, 2026-09-07).\n\n**Defect.** `crates/spt-daemon/src/broker.rs:8102` (zombie reap under `Gate::AlreadyLive{spid}`) terminates `spid`, a pid REMEMBERED from the session record. `zombie_verdict` consults `wrapper_alive` (liveness BY NUMBER), `adapter_labeled` (a property of the record, not the live process), `has_live_descendants`, and `past_grace`. The live process's IMAGE is never read. Under pid reuse (measured live on hfenduleam: 44 processes within 2000 of pid 14444; a nextest list phase spawns 226 binaries in 7.8 s) the reaped number can belong to an unrelated process.\n\n**The correct pattern already exists in-tree, twice.** `servicehost.rs:651` reads `exe_path(pid)` and compares it to the parked image via `same_image` before killing (\"WHO is it? The image path decides — never the number\"), with a fresh read after the kill; `livehost.rs:1135` kills only on a positive basename/cmdline match and emits `LEGACY_PSYCHE_SWEEP_DECLINE` otherwise. Today's protection at :8102 is accidental: `has_live_descendants` is true while a brain child is up, so the path is reached only when the brain is gone.\n\n**Fix shape.** Lift the image comparison into the zombie path, or into `spt-store` `proc.rs:430` `kill_pid_tree` itself so no caller can forget it: verify identity (image path, or start time) AT kill time, decline with a named breadcrumb on mismatch. Same class, narrower: `daemon.rs:3472` (`taskkill /PID` after `is_process_alive` only) and `shellhost.rs:639` (caller-supplied pid, no check). Unit: a cell that parks a pid, lets it die, and asserts the reap DECLINES when the number now names a different image.\n\n**Not claimed:** this does not explain the 08:03:15Z fleet-daemon death (RCA .spt/RCA-FLEET-DAEMON-14444.md, cause still open); it is the one production site that reaps a number it remembered across time. Owner: todlando, post-W2 (#272).\n\n*\\-doyle@HFENDULEAM*\n\nURL: https://github.com/BigscreenVR/spt-bs-releases/issues/285#issuecomment-5569639068","startLine":1,"lineNumbers":[1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35]},"meta":{"source":{"type":"internal","value":"issue://BigscreenVR/spt-bs-releases/285"}}},"isError":false,"timestamp":1789001107720}}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_zXoL5iYtGYcaeCmbNLfdWn0w|fc_02547c41fbf377fa016aa1fd9ce1f087d2ba44778e9f587733","toolName":"read","startedAt":"2026-09-10T00:45:16.967Z","args":{"path":".worktrees/285-zombie/crates/spt-daemon/src/broker.rs:7860-8340"},"intent":"Reading gate cleanup context"},"id":"76b1b5bc","parentId":"99579bd0","timestamp":"2026-09-10T00:45:16.967Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_MnY9cRg0sID663p4pdW99ZKY|fc_02547c41fbf377fa016aa1fd9ce1fc87d2b184ef67d1c656de","toolName":"read","startedAt":"2026-09-10T00:45:16.967Z","args":{"path":".worktrees/285-zombie/crates/spt-daemon/src/broker.rs:310-510"},"intent":"Reading zombie predicate context"},"id":"ea51e20b","parentId":"76b1b5bc","timestamp":"2026-09-10T00:45:16.967Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_lj7ly3cY0OirG2Obye5ljp8n|fc_02547c41fbf377fa016aa1fd9ce20487d2bcb47f2deff5a1fb","toolName":"read","startedAt":"2026-09-10T00:45:16.967Z","args":{"path":".worktrees/285-zombie/crates/spt-daemon/src/broker.rs:4010-4205"},"intent":"Reading hosted session ownership"},"id":"43203fa7","parentId":"ea51e20b","timestamp":"2026-09-10T00:45:16.967Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_EtDUCahe02vthQ1Ybhoy1aRl|fc_02547c41fbf377fa016aa1fd9ce20887d2b29b34b4398c9ceb","toolName":"grep","startedAt":"2026-09-10T00:45:16.967Z","args":{"path":".worktrees/285-zombie/crates/spt-term;.worktrees/285-zombie/crates/spt-store/src/proc.rs;.worktrees/285-zombie/crates/spt-daemon/src/broker.rs"},"intent":"Locating session destructor paths"},"id":"348210a9","parentId":"43203fa7","timestamp":"2026-09-10T00:45:16.967Z"}
{"type":"message","id":"14636862","parentId":"348210a9","timestamp":"2026-09-10T00:45:16.967Z","message":{"role":"assistant","content":[{"type":"toolCall","id":"call_zXoL5iYtGYcaeCmbNLfdWn0w|fc_02547c41fbf377fa016aa1fd9ce1f087d2ba44778e9f587733","name":"read","arguments":{"i":"Reading gate cleanup context","path":".worktrees/285-zombie/crates/spt-daemon/src/broker.rs:7860-8340"},"intent":"Reading gate cleanup context"},{"type":"toolCall","id":"call_MnY9cRg0sID663p4pdW99ZKY|fc_02547c41fbf377fa016aa1fd9ce1fc87d2b184ef67d1c656de","name":"read","arguments":{"i":"Reading zombie predicate context","path":".worktrees/285-zombie/crates/spt-daemon/src/broker.rs:310-510"},"intent":"Reading zombie predicate context"},{"type":"toolCall","id":"call_lj7ly3cY0OirG2Obye5ljp8n|fc_02547c41fbf377fa016aa1fd9ce20487d2bcb47f2deff5a1fb","name":"read","arguments":{"i":"Reading hosted session ownership","path":".worktrees/285-zombie/crates/spt-daemon/src/broker.rs:4010-4205"},"intent":"Reading hosted session ownership"},{"type":"toolCall","id":"call_EtDUCahe02vthQ1Ybhoy1aRl|fc_02547c41fbf377fa016aa1fd9ce20887d2b29b34b4398c9ceb","name":"grep","arguments":{"i":"Locating session destructor paths","pattern":"impl Drop|fn (kill|wait|spawn|dispatch_teardown)|HostedSession|sessions.*remove|process_started_at|fn provably_gone","path":".worktrees/285-zombie/crates/spt-term;.worktrees/285-zombie/crates/spt-store/src/proc.rs;.worktrees/285-zombie/crates/spt-daemon/src/broker.rs","case":true,"gitignore":false,"skip":null},"intent":"Locating session destructor paths"}],"api":"openai-codex-responses","provider":"openai-codex","model":"gpt-6-astra","usage":{"input":10701,"output":257,"cacheRead":16000,"cacheWrite":0,"totalTokens":26958,"cost":{"input":0,"output":0,"cacheRead":0,"cacheWrite":0,"total":0}},"stopReason":"toolUse","timestamp":1789001107742,"responseId":"resp_02547c41fbf377fa016aa1fd93fd3087d29a426fa6eefc436f","providerPayload":{"type":"openaiResponsesHistory","provider":"openai-codex","dt":true,"items":[{"id":"fc_02547c41fbf377fa016aa1fd9ce1f087d2ba44778e9f587733","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading gate cleanup context\",\"path\":\".worktrees/285-zombie/crates/spt-daemon/src/broker.rs:7860-8340\"}","call_id":"call_zXoL5iYtGYcaeCmbNLfdWn0w","internal_chat_message_metadata_passthrough":{"turn_id":"e87e53c5-40c7-422d-9e85-ed14bd841c4c"},"name":"read","metadata":{"turn_id":"e87e53c5-40c7-422d-9e85-ed14bd841c4c"}},{"id":"fc_02547c41fbf377fa016aa1fd9ce1fc87d2b184ef67d1c656de","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading zombie predicate context\",\"path\":\".worktrees/285-zombie/crates/spt-daemon/src/broker.rs:310-510\"}","call_id":"call_MnY9cRg0sID663p4pdW99ZKY","internal_chat_message_metadata_passthrough":{"turn_id":"e87e53c5-40c7-422d-9e85-ed14bd841c4c"},"name":"read","metadata":{"turn_id":"e87e53c5-40c7-422d-9e85-ed14bd841c4c"}},{"id":"fc_02547c41fbf377fa016aa1fd9ce20487d2bcb47f2deff5a1fb","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading hosted session ownership\",\"path\":\".worktrees/285-zombie/crates/spt-daemon/src/broker.rs:4010-4205\"}","call_id":"call_lj7ly3cY0OirG2Obye5ljp8n","internal_chat_message_metadata_passthrough":{"turn_id":"e87e53c5-40c7-422d-9e85-ed14bd841c4c"},"name":"read","metadata":{"turn_id":"e87e53c5-40c7-422d-9e85-ed14bd841c4c"}},{"id":"fc_02547c41fbf377fa016aa1fd9ce20887d2b29b34b4398c9ceb","type":"function_call","status":"completed","arguments":"{\"i\":\"Locating session destructor paths\",\"pattern\":\"impl Drop|fn (kill|wait|spawn|dispatch_teardown)|HostedSession|sessions.*remove|process_started_at|fn provably_gone\",\"path\":\".worktrees/285-zombie/crates/spt-term;.worktrees/285-zombie/crates/spt-store/src/proc.rs;.worktrees/285-zombie/crates/spt-daemon/src/broker.rs\",\"case\":true,\"gitignore\":false,\"skip\":null}","call_id":"call_EtDUCahe02vthQ1Ybhoy1aRl","internal_chat_message_metadata_passthrough":{"turn_id":"e87e53c5-40c7-422d-9e85-ed14bd841c4c"},"name":"grep","metadata":{"turn_id":"e87e53c5-40c7-422d-9e85-ed14bd841c4c"}}]},"duration":9223.048200000077,"ttft":9185.812799999956,"completedAt":1789001116965,"contextSnapshot":{"promptTokens":26701,"nonMessageTokens":13209,"compactionEpoch":0}}}
{"type":"message","id":"a101e448","parentId":"14636862","timestamp":"2026-09-10T00:45:17.065Z","message":{"role":"toolResult","toolCallId":"call_zXoL5iYtGYcaeCmbNLfdWn0w|fc_02547c41fbf377fa016aa1fd9ce1f087d2ba44778e9f587733","toolName":"read","content":[{"type":"text","text":" /// see a ticket EXPIRE has no other way to reach the far side of the TTL\n /// than to sleep through it, and a sleeping test proves the TTL only for the\n /// value it slept for.\n // [impl->REQ-ER-BRINGUP-SPAWNS-SESSION]\n fn mint_bringup_admit_at(\n &self,\n session: u64,\n verdict: TicketVerdict,\n now: Instant,\n ) -> String {\n let seed = spt_proto::identity::Identity::generate().seed();\n let ticket = format!(\n \"{BRING_UP_ADMIT_PREFIX}{}\",\n seed.iter().map(|b| format!(\"{b:02x}\")).collect::()\n );\n let mut admits = recover(&self.bringup_admits);\n admits.retain(|_, (_, expires, _)| *expires > now);\n admits.insert(ticket.clone(), (session, now + BRINGUP_ADMIT_TTL, verdict));\n ticket\n }\n\n /// Classify the secret an attach presented: a redeemed admit ticket, an\n /// `admit:`-prefixed string that did NOT redeem, or no ticket at all.\n ///\n /// Single-use and consumed by PRESENTATION, not by success: a ticket that\n /// names the wrong session is spent as it is refused, so a stolen ticket\n /// cannot be walked across sessions. Expired, already-consumed and\n /// never-minted are one answer here on purpose — the caller learns only that\n /// this string does not seat it, never whether an admit is outstanding.\n ///\n /// A prefixed string NEVER reaches the TOTP path (structurally — this\n /// returns before it), because an expired ticket is not a wrong guess and\n /// must not spend a unit of the human's attempt budget.\n // [impl->REQ-ER-BRINGUP-SPAWNS-SESSION]\n fn redeem_bringup_admit(&self, presented: Option<&str>, session: u64) -> AdmitTicket {\n self.redeem_bringup_admit_at(presented, session, Instant::now())\n }\n\n /// [`redeem_bringup_admit`](Self::redeem_bringup_admit) with the clock passed\n /// in — the expiry seam (see [`mint_bringup_admit_at`](Self::mint_bringup_admit_at)).\n // [impl->REQ-ER-BRINGUP-SPAWNS-SESSION]\n fn redeem_bringup_admit_at(\n &self,\n presented: Option<&str>,\n session: u64,\n now: Instant,\n ) -> AdmitTicket {\n let Some(ticket) = presented.filter(|c| c.starts_with(BRING_UP_ADMIT_PREFIX)) else {\n return AdmitTicket::None;\n };\n let claimed = recover(&self.bringup_admits).remove(ticket);\n match claimed {\n // The verdict travels out with the redemption — it is the broker's\n // own record of what its gate ruled, and the seat settles on it\n // (releases#142).\n Some((sid, expires, verdict)) if sid == session && expires > now => {\n AdmitTicket::Redeemed(verdict)\n }\n _ => AdmitTicket::Unredeemed,\n }\n }\n\n /// Record that this broker has STARTED a bring-up for `endpoint`, good for\n /// `ttl` — the bring-up's own ready-wait (see [`Self::bringups_in_flight`]).\n ///\n /// Written before the launch fires, so the fact exists for the whole window\n /// in which the spawned harness may ask about it. Expired entries are swept\n /// on every write, the way [`Self::mint_bringup_admit_at`] sweeps tickets, so\n /// the map holds only what is still live and a broker that never sees another\n /// bring-up does not accumulate.\n // [impl->REQ-ER-BRINGUP-INFLIGHT-LEDGER]\n fn note_bringup_in_flight(&self, endpoint: &str, ttl: Duration) {\n self.note_bringup_in_flight_at(endpoint, ttl, Instant::now());\n }\n\n /// [`note_bringup_in_flight`](Self::note_bringup_in_flight) with the clock\n /// passed in — the expiry seam, for the same reason\n /// [`mint_bringup_admit_at`](Self::mint_bringup_admit_at) has one: `Instant`\n /// cannot be fabricated, so a test that must see an entry EXPIRE has no other\n /// way across the TTL than to sleep through it, and a sleeping test proves\n /// the TTL only for the value it slept for.\n // [impl->REQ-ER-BRINGUP-INFLIGHT-LEDGER]\n fn note_bringup_in_flight_at(&self, endpoint: &str, ttl: Duration, now: Instant) {\n let mut flight = recover(&self.bringups_in_flight);\n flight.retain(|_, expires| *expires > now);\n flight.insert(endpoint.to_string(), now + ttl);\n }\n\n /// Drop `endpoint`'s in-flight entry: its session row now exists, so the\n /// ledger has nothing left to say about it.\n ///\n /// A no-op for the endpoints that never had an entry, which is every\n /// ordinary spawn — only a bring-up writes one.\n // [impl->REQ-ER-BRINGUP-INFLIGHT-LEDGER]\n fn clear_bringup_in_flight(&self, endpoint: &str) {\n recover(&self.bringups_in_flight).remove(endpoint);\n }\n\n /// The endpoints whose bring-up is in flight RIGHT NOW, expired entries\n /// excluded.\n ///\n /// Reads without pruning: this answers a query, and a query that mutates the\n /// ledger would make the reply depend on who asked last.\n // [impl->REQ-ER-BRINGUP-INFLIGHT-LEDGER]\n fn bringups_in_flight_at(&self, now: Instant) -> Vec {\n recover(&self.bringups_in_flight)\n .iter()\n .filter(|(_, expires)| **expires > now)\n .map(|(endpoint, _)| endpoint.clone())\n .collect()\n }\n\n /// The shared spawn choke behind BOTH policies (`fresh=false` =\n /// ResumeOrReuse/wake, `fresh=true` = Fresh/RejectExisting).\n fn dispatch_spawn_policy(\n &self,\n req: SpawnReq,\n send: &SharedSend,\n fresh: bool,\n ) -> Result, String> {\n // releases#199 instrument, BROKER SIDE. The launch-path stamps say when the\n // client asked; these say what the broker did with the ask. Two spans are\n // separately suspect and were previously indistinguishable from each other\n // and from the client's own wait: the single-flight gate below (bounded by the\n // holder's PROGRESS since #235, plus an unbounded-looking zombie-reap re-evaluation)\n // and the ConPTY create (candidate C). Stamped in the SHARED choke, not\n // only on the bring-up path, because the choke is where the time goes.\n // [impl->REQ-ER-BRINGUP-LAUNCH-PHASE-TRACE]\n let spawn_t0 = Instant::now();\n // The label is CLONED, not borrowed from `req`: the request's fields are\n // moved into the spawn below, and a closure holding `&req` would keep the\n // whole request borrowed past those moves.\n let spawn_label = req.endpoint.clone();\n // #235: the breadcrumb sites are ALSO the progress sites. The gate decides\n // \"still working\" vs \"wedged\" from the holder's last phase stamp, so every\n // place that already announces a phase records it into the claim too —\n // rather than a second set of call sites that can drift from these.\n // `None` until this thread wins the claim; a stamp before then would be\n // writing progress into somebody else's claim.\n let claim_gen: std::cell::Cell> = std::cell::Cell::new(None);\n let spawn_phase = |phase: &str, detail: &str| {\n spt_proto::emit_line_err!(\n \"SPAWN_PHASE:{spawn_label} phase={phase} t_ms={}{}{detail}\",\n spawn_t0.elapsed().as_millis(),\n if detail.is_empty() { \"\" } else { \" \" },\n );\n if let Some(generation) = claim_gen.get() {\n let mut inflight = recover(&self.wake_inflight);\n if let Some(claim) = inflight.get_mut(&spawn_label) {\n // Only OUR generation: a holder taken over as wedged must not\n // keep refreshing the successor's claim from behind.\n if claim.generation == generation {\n claim.phase = phase.to_string();\n claim.phase_at = Instant::now();\n }\n }\n }\n };\n spawn_phase(\"received\", &format!(\"fresh={fresh}\"));\n // Single-flight WAKE (W4, REQ-SPAWN-COLLISION-GUARD-LIVE-DUP): the broker is the\n // sole spawner post-W3, so its own spawn choke is the single-flight authority.\n // Dedup a duplicate wake/resume for an endpoint that already has a live session\n // OR a spawn in flight — closing the check-then-spawn TOCTOU that let one wake\n // spawn two identical launch trees (perri's flynn dup: duplicate perch writers\n // then stomped info.json, routing injects to a contended record). The claim +\n // the live-session check are read together under one atomic critical section so\n // a concurrent spawn either sees our claim or its registered session — never a\n // gap; NO I/O under the lock (process_id reads a cached pid; the ZOMBIE probe\n // runs OFF the lock in the AlreadyLive arm). An empty endpoint is an\n // ad-hoc/legacy spawn (no id to dedup on) → never gated. `_wake_claim` holds\n // the claim to fn end, releasing (RAII) after the session is table-visible\n // or on any early error.\n // [impl->REQ-SPAWN-COLLISION-GUARD-LIVE-DUP]\n let _wake_claim: Option = if req.endpoint.is_empty() {\n None\n } else {\n loop {\n enum Gate<'a> {\n Claimed(WakeClaimGuard<'a>),\n AlreadyLive {\n sid: u64,\n spid: Option,\n process_started_at: Option,\n adapter_labeled: bool,\n spawned_ms_ago: u64,\n },\n Racing,\n }\n let gate = {\n let sessions = recover(&self.sessions);\n let mut inflight = recover(&self.wake_inflight);\n let live = sessions.iter().find(|(_, h)| h.endpoint == req.endpoint).map(\n |(sid, h)| {\n (\n *sid,\n h.session.process_id(),\n h.process_started_at,\n !h.adapter.is_empty(),\n h.spawned_at.elapsed().as_millis() as u64,\n )\n },\n );\n // The holder's own phase stamp, read under the SAME lock as the\n // claim — an elapsed against a recorded Instant, no I/O, per this\n // block's no-I/O-under-the-lock contract.\n let held = inflight.get(&req.endpoint).cloned();\n let holder_stalled = held\n .as_ref()\n .is_some_and(|c| c.phase_at.elapsed() >= phase_wedge_ceiling(&c.phase));\n match wake_gate_decision(live.is_some(), held.is_some(), holder_stalled) {\n WakeGate::AlreadyLive => {\n let (sid, spid, process_started_at, adapter_labeled, spawned_ms_ago) =\n live.expect(\"live is Some on AlreadyLive\");\n Gate::AlreadyLive {\n sid, spid, process_started_at, adapter_labeled, spawned_ms_ago,\n }\n }\n WakeGate::Racing => Gate::Racing,\n WakeGate::Claim => {\n // A takeover is the availability arm firing. LOUD and\n // always, naming the phase and the elapsed that decided\n // it — a silent takeover is indistinguishable from a\n // free endpoint in every log we would read afterwards.\n if let Some(prev) = &held {\n WEDGE_TAKEOVER_COUNT.fetch_add(1, Ordering::Relaxed);\n eprintln!(\n \"SPAWN_WEDGE_TAKEOVER:{}: claim gen {} wedged in phase {} for {}ms \\\n (ceiling {}ms) — taking over \\\n [REQ-SPAWN-COLLISION-GUARD-LIVE-DUP]\",\n req.endpoint,\n prev.generation,\n prev.phase,\n prev.phase_at.elapsed().as_millis(),\n phase_wedge_ceiling(&prev.phase).as_millis(),\n );\n }\n let generation =\n self.wake_generation.fetch_add(1, Ordering::Relaxed) + 1;\n inflight.insert(\n req.endpoint.clone(),\n WakeClaim {\n generation,\n phase: \"gate_claimed\".to_string(),\n phase_at: Instant::now(),\n },\n );\n claim_gen.set(Some(generation));\n Gate::Claimed(WakeClaimGuard {\n map: &self.wake_inflight,\n endpoint: req.endpoint.clone(),\n generation,\n })\n }\n }\n };\n match gate {\n Gate::Claimed(guard) => {\n spawn_phase(\"gate_claimed\", \"\");\n break Some(guard);\n }\n Gate::AlreadyLive {\n sid, spid, process_started_at, adapter_labeled, spawned_ms_ago,\n } => {\n // ONE liveness authority (ADR-0041 decision 6,\n // REQ-ENDPOINT-CYCLE-HONEST): before refusing/deduping by\n // citing the claimed session, PROBE its client tree — off\n // every lock. A zombie (dead root, or an adapter wrapper\n // whose harness clients died past boot grace) is reaped\n // honestly — scoped tree-kill, then wait for the\n // exit-waiter to de-table it — and the gate re-evaluates:\n // the next pass claims and spawns for real. Never a\n // refusal citing a corpse.\n // [impl->REQ-ENDPOINT-CYCLE-HONEST]\n if session_is_zombie(spid, adapter_labeled, spawned_ms_ago) {\n // Re-observe immediately before any kill, off-lock.\n // The existing owned-process death oracle preserves\n // snapshot-less Unix cleanup and Linux zombie demotion.\n // [impl->REQ-BROKER-ZOMBIE-IDENTITY]\n if let Err(reason) = reap_zombie_root(\n spid,\n process_started_at,\n |pid| {\n use spt_store::proc::{self, ProcIdentity};\n if proc::provably_gone(pid) {\n ProcIdentity::Absent\n } else {\n proc::process_started_at(pid)\n .map(ProcIdentity::Present)\n .unwrap_or(ProcIdentity::Unproven)\n }\n },\n spt_store::proc::kill_pid_tree,\n ) {\n spt_proto::emit_line_err!(\n \"SPAWN_ZOMBIE_REAP_DECLINE:{}: session {sid} pid={spid:?} \\\n reason={reason} — no kill or forced de-table\",\n req.endpoint\n );\n // Return BEFORE the cleanup loop. In particular,\n // do not drop HostedSession/PTY resources or call\n // dispatch_teardown as a fallback after refusal.\n return Err(format!(\n \"SPAWN_ZOMBIE_REAP_DECLINE:{}: session {sid}: {reason}\",\n req.endpoint\n ));\n }\n spt_proto::emit_line_err!(\n \"SPAWN_ZOMBIE_REAP:{}: claimed session {sid} has a dead client \\\n tree — reaping before honest respawn [REQ-ENDPOINT-CYCLE-HONEST]\",\n req.endpoint\n );\n // Bounded wait for the exit-waiter to reap the table row;\n // belt: a wedged/missed waiter (root already dead) gets a\n // direct de-table + stamp clear so the gate can converge.\n let reap_deadline = Instant::now() + Duration::from_secs(5);\n loop {\n if !recover(&self.sessions).contains_key(&sid) {\n break;\n }\n if Instant::now() >= reap_deadline {\n let removed = recover(&self.sessions).remove(&sid);\n if let Some(h) = removed {\n recover_log(&h.log).stamp_reaped();\n spt_proto::emit_line_err!(\n \"SPAWN_ZOMBIE_FORCE_DETABLE:{}: exit-waiter never \\\n reaped dead session {sid} — de-tabled directly\",\n req.endpoint\n );\n }\n break;\n }\n thread::sleep(WAKE_DEDUP_POLL);\n }\n continue; // re-evaluate the gate against the reaped truth\n }\n if fresh {\n // Fresh/RejectExisting: a GENUINELY live session is a\n // typed conflict — no session created, nothing mutated,\n // the live session untouched. Never Spawned(existing).\n // [impl->REQ-SPAWN-FRESH-TRUTHFUL]\n spt_proto::emit_line_err!(\n \"SPAWN_FRESH_CONFLICT:{}: endpoint already has a live session \\\n {sid} — typed conflict, no session created \\\n [REQ-SPAWN-FRESH-TRUTHFUL]\",\n req.endpoint\n );\n let frame = Envelope::new(\n KIND_SPAWN_CONFLICT,\n serde_json::to_value(SpawnConflict {\n endpoint: req.endpoint.clone(),\n session_id: sid,\n })\n .expect(\"SpawnConflict serializes\"),\n );\n send_frame(send, &frame);\n return Ok(None);\n }\n spt_proto::emit_line_err!(\n \"SPAWN_DEDUP:{}: endpoint already has a live session {sid} — \\\n single-flight wake no-op ack [REQ-SPAWN-COLLISION-GUARD-LIVE-DUP]\",\n req.endpoint\n );\n let frame = Envelope::new(\n KIND_SPAWNED,\n serde_json::to_value(Spawned { session_id: sid, pid: spid })\n .expect(\"Spawned serializes\"),\n );\n send_frame(send, &frame);\n return Ok(Some(sid));\n }\n Gate::Racing => thread::sleep(WAKE_DEDUP_POLL),\n }\n }\n };\n // REQ-HOST-RUN-2: spawn in the requested project cwd when carried;\n // `None` inherits the broker's cwd (legacy/test + W1 bringup shortcut).\n // Inject the manifest [env] vars (REQ-HAZARD-ENV-SUBST) on top of the\n // inherited env — empty for a legacy/N-1 spawn (inherit only).\n spawn_phase(\"pty_creating\", &format!(\"program={}\", req.program));\n // INT-RIG SEAM (#235): hold the winner inside `pty_creating` for a set time,\n // reproducing the measured shape — a ConPTY create that overruns while the\n // holder is perfectly alive. One long phase with no new stamp is exactly what\n // the production slow case looks like to the gate, so the rig drives the real\n // decision path rather than a simulation of it.\n // Compiled out of release entirely (see `phase_wedge_ceiling`'s seam): a stray\n // value must never be able to stall a production spawn, and a seam that can only\n // be reached in a debug build cannot. Parsed once, clamped, and LOUD every time\n // it fires — a silent delay is the failure mode worth engineering against.\n #[cfg(debug_assertions)]\n {\n static STRETCH: std::sync::OnceLock> = std::sync::OnceLock::new();\n if let Some(d) = STRETCH.get_or_init(|| {\n let raw = std::env::var(\"SPT_SPAWN_STRETCH_MS\")\n .ok()\n .and_then(|v| v.parse::().ok())?;\n Some(Duration::from_millis(raw.min(30_000)))\n }) {\n eprintln!(\n \"SPAWN_STRETCH_SEAM:{}: holding pty_creating for {}ms — test seam, \\\n debug builds only\",\n req.endpoint,\n d.as_millis()\n );\n thread::sleep(*d);\n }\n }\n let session = match PtySession::spawn_program_in_env(\n &req.program,\n &req.args,\n SurfaceSize::new(req.rows, req.cols),\n req.cwd.as_deref(),\n req.env.iter().map(|(k, v)| (k.as_str(), v.as_str())),\n ) {\n Ok(session) => session,\n Err(e) => {\n spawn_phase(\"pty_failed\", &format!(\"err={e}\"));\n return Err(format!(\"spawn failed: {e}\"));\n }\n };\n let session = Arc::new(session);\n let id = self.next_id.fetch_add(1, Ordering::Relaxed);\n let pid = session.process_id();\n // Birth identity is trustworthy here: Windows retains the child handle;\n // Unix cannot recycle our child's pid until it is reaped, and no waiter\n // has been started yet. Exec may change its image, not its birth stamp.\n // [impl->REQ-BROKER-ZOMBIE-IDENTITY]\n let process_started_at = pid.and_then(spt_store::proc::process_started_at);\n // The ConPTY-create span releases#199 candidate C names, closed.\n spawn_phase(\"pty_created\", &format!(\"pid={pid:?}\"));\n\n // The session's lone PTY input-writer (P0): the SOLE caller of the\n // blocking `write_input`. Every dispatch-side write enqueues here, so a\n // paste burst parks only this thread — never the broker dispatch thread\n // (REQ-HAZARD-PTY-INPUT-WRITER-WEDGE). The inject worker writes through it\n // too, so the lone writer enforces the W2 inject-floor order.\n let input = InputWriter::spawn(Arc::clone(&session), req.endpoint.clone());\n // releases#199: the span from here to `row_inserted` is the one a 10-way\n // contention run put 1427ms into while the ConPTY create took 14ms — the\n // child is ALREADY RUNNING through all of it and the row the bring-up poll\n // reads does not exist yet, which is this issue's face in miniature. So it\n // is stamped per step rather than as one block.\n spawn_phase(\"input_writer\", \"\");\n\n // The output log, with the spawning connection pre-attached as the\n // controller (identity `None` = LOCAL, not a remote driver) so no chunk\n // is missed before an explicit subscribe — and so a remote attach to a\n // spawned-but-undriven session takes control silently (no loud displace\n // of the local-spawner placeholder; REQ-RCVIEW-1).\n let log = Arc::new(Mutex::new(OutputLog::new(\n id,\n self.log_cap_chunks,\n req.endpoint.clone(),\n (req.rows, req.cols),\n )));\n log.lock()\n .unwrap()\n .become_controller(Arc::clone(send), None, 0, 0);\n spawn_phase(\"log_ready\", \"\");\n\n // Output drain → append under the log lock (fast: ring + viewer fan-out),\n // then deliver to the controller OFF the lock with a bounded deadline\n // (W1 / REQ-HAZARD-INJECT-CONTROL-COEXIST). The controller write is no\n // longer inline under the log lock, so a backed-up controller can never\n // wedge the session; a fully-stalled controller is detached after the\n // deadline (bounded wedge, never permanent).\n let log_drain = Arc::clone(&log);\n // DSR cursor authority (REQ-DSR-SINGLE-CPR): the drain answers each DSR\n // with the grid's real display-column cursor. The provider runs on the\n // drain thread BETWEEN sink handoffs (the append lock is released), and\n // the grid is advanced by that same thread, so the reported position is\n // exact at the query point.\n let log_cursor = Arc::clone(&log);\n let drain = session\n .drain_with_cursor(\n move |chunk| {\n // OBS RIDER Tap A (debug-gated, default OFF): the raw pre-parse\n // child output, captured before append()/grid.advance. No-op in a\n // release build and when SPT_OBS_BYTE_TAP is unset.\n spt_store::obstap::tap(id, \"raw\", chunk);\n // append() does the controller handoff inline now (one non-blocking\n // try_send — b4) and returns Some(epoch) ONLY when the controller is\n // stalled-past-deadline / gone and must be evicted. mark it gone OFF\n // the first lock (a fresh lock, no self-deadlock). The drain never\n // sleeps here, so a slow controller can't throttle the viewer fan-out.\n let evict = recover_log(&log_drain).append(chunk);\n…\n },\n…\n )\n .map_err(|e| format!(\"drain failed: {e}\"))?;\n…\n }\n\n[Showing lines 7859-8343 of 16343. Use :8344 to continue]"}],"details":{"truncation":{"content":" /// see a ticket EXPIRE has no other way to reach the far side of the TTL\r\n /// than to sleep through it, and a sleeping test proves the TTL only for the\r\n /// value it slept for.\r\n // [impl->REQ-ER-BRINGUP-SPAWNS-SESSION]\r\n fn mint_bringup_admit_at(\r\n &self,\r\n session: u64,\r\n verdict: TicketVerdict,\r\n now: Instant,\r\n ) -> String {\r\n let seed = spt_proto::identity::Identity::generate().seed();\r\n let ticket = format!(\r\n \"{BRING_UP_ADMIT_PREFIX}{}\",\r\n seed.iter().map(|b| format!(\"{b:02x}\")).collect::()\r\n );\r\n let mut admits = recover(&self.bringup_admits);\r\n admits.retain(|_, (_, expires, _)| *expires > now);\r\n admits.insert(ticket.clone(), (session, now + BRINGUP_ADMIT_TTL, verdict));\r\n ticket\r\n }\r\n\r\n /// Classify the secret an attach presented: a redeemed admit ticket, an\r\n /// `admit:`-prefixed string that did NOT redeem, or no ticket at all.\r\n ///\r\n /// Single-use and consumed by PRESENTATION, not by success: a ticket that\r\n /// names the wrong session is spent as it is refused, so a stolen ticket\r\n /// cannot be walked across sessions. Expired, already-consumed and\r\n /// never-minted are one answer here on purpose — the caller learns only that\r\n /// this string does not seat it, never whether an admit is outstanding.\r\n ///\r\n /// A prefixed string NEVER reaches the TOTP path (structurally — this\r\n /// returns before it), because an expired ticket is not a wrong guess and\r\n /// must not spend a unit of the human's attempt budget.\r\n // [impl->REQ-ER-BRINGUP-SPAWNS-SESSION]\r\n fn redeem_bringup_admit(&self, presented: Option<&str>, session: u64) -> AdmitTicket {\r\n self.redeem_bringup_admit_at(presented, session, Instant::now())\r\n }\r\n\r\n /// [`redeem_bringup_admit`](Self::redeem_bringup_admit) with the clock passed\r\n /// in — the expiry seam (see [`mint_bringup_admit_at`](Self::mint_bringup_admit_at)).\r\n // [impl->REQ-ER-BRINGUP-SPAWNS-SESSION]\r\n fn redeem_bringup_admit_at(\r\n &self,\r\n presented: Option<&str>,\r\n session: u64,\r\n now: Instant,\r\n ) -> AdmitTicket {\r\n let Some(ticket) = presented.filter(|c| c.starts_with(BRING_UP_ADMIT_PREFIX)) else {\r\n return AdmitTicket::None;\r\n };\r\n let claimed = recover(&self.bringup_admits).remove(ticket);\r\n match claimed {\r\n // The verdict travels out with the redemption — it is the broker's\r\n // own record of what its gate ruled, and the seat settles on it\r\n // (releases#142).\r\n Some((sid, expires, verdict)) if sid == session && expires > now => {\r\n AdmitTicket::Redeemed(verdict)\r\n }\r\n _ => AdmitTicket::Unredeemed,\r\n }\r\n }\r\n\r\n /// Record that this broker has STARTED a bring-up for `endpoint`, good for\r\n /// `ttl` — the bring-up's own ready-wait (see [`Self::bringups_in_flight`]).\r\n ///\r\n /// Written before the launch fires, so the fact exists for the whole window\r\n /// in which the spawned harness may ask about it. Expired entries are swept\r\n /// on every write, the way [`Self::mint_bringup_admit_at`] sweeps tickets, so\r\n /// the map holds only what is still live and a broker that never sees another\r\n /// bring-up does not accumulate.\r\n // [impl->REQ-ER-BRINGUP-INFLIGHT-LEDGER]\r\n fn note_bringup_in_flight(&self, endpoint: &str, ttl: Duration) {\r\n self.note_bringup_in_flight_at(endpoint, ttl, Instant::now());\r\n }\r\n\r\n /// [`note_bringup_in_flight`](Self::note_bringup_in_flight) with the clock\r\n /// passed in — the expiry seam, for the same reason\r\n /// [`mint_bringup_admit_at`](Self::mint_bringup_admit_at) has one: `Instant`\r\n /// cannot be fabricated, so a test that must see an entry EXPIRE has no other\r\n /// way across the TTL than to sleep through it, and a sleeping test proves\r\n /// the TTL only for the value it slept for.\r\n // [impl->REQ-ER-BRINGUP-INFLIGHT-LEDGER]\r\n fn note_bringup_in_flight_at(&self, endpoint: &str, ttl: Duration, now: Instant) {\r\n let mut flight = recover(&self.bringups_in_flight);\r\n flight.retain(|_, expires| *expires > now);\r\n flight.insert(endpoint.to_string(), now + ttl);\r\n }\r\n\r\n /// Drop `endpoint`'s in-flight entry: its session row now exists, so the\r\n /// ledger has nothing left to say about it.\r\n ///\r\n /// A no-op for the endpoints that never had an entry, which is every\r\n /// ordinary spawn — only a bring-up writes one.\r\n // [impl->REQ-ER-BRINGUP-INFLIGHT-LEDGER]\r\n fn clear_bringup_in_flight(&self, endpoint: &str) {\r\n recover(&self.bringups_in_flight).remove(endpoint);\r\n }\r\n\r\n /// The endpoints whose bring-up is in flight RIGHT NOW, expired entries\r\n /// excluded.\r\n ///\r\n /// Reads without pruning: this answers a query, and a query that mutates the\r\n /// ledger would make the reply depend on who asked last.\r\n // [impl->REQ-ER-BRINGUP-INFLIGHT-LEDGER]\r\n fn bringups_in_flight_at(&self, now: Instant) -> Vec {\r\n recover(&self.bringups_in_flight)\r\n .iter()\r\n .filter(|(_, expires)| **expires > now)\r\n .map(|(endpoint, _)| endpoint.clone())\r\n .collect()\r\n }\r\n\r\n /// The shared spawn choke behind BOTH policies (`fresh=false` =\r\n /// ResumeOrReuse/wake, `fresh=true` = Fresh/RejectExisting).\r\n fn dispatch_spawn_policy(\r\n &self,\r\n req: SpawnReq,\r\n send: &SharedSend,\r\n fresh: bool,\r\n ) -> Result, String> {\r\n // releases#199 instrument, BROKER SIDE. The launch-path stamps say when the\r\n // client asked; these say what the broker did with the ask. Two spans are\r\n // separately suspect and were previously indistinguishable from each other\r\n // and from the client's own wait: the single-flight gate below (bounded by the\r\n // holder's PROGRESS since #235, plus an unbounded-looking zombie-reap re-evaluation)\r\n // and the ConPTY create (candidate C). Stamped in the SHARED choke, not\r\n // only on the bring-up path, because the choke is where the time goes.\r\n // [impl->REQ-ER-BRINGUP-LAUNCH-PHASE-TRACE]\r\n let spawn_t0 = Instant::now();\r\n // The label is CLONED, not borrowed from `req`: the request's fields are\r\n // moved into the spawn below, and a closure holding `&req` would keep the\r\n // whole request borrowed past those moves.\r\n let spawn_label = req.endpoint.clone();\r\n // #235: the breadcrumb sites are ALSO the progress sites. The gate decides\r\n // \"still working\" vs \"wedged\" from the holder's last phase stamp, so every\r\n // place that already announces a phase records it into the claim too —\r\n // rather than a second set of call sites that can drift from these.\r\n // `None` until this thread wins the claim; a stamp before then would be\r\n // writing progress into somebody else's claim.\r\n let claim_gen: std::cell::Cell> = std::cell::Cell::new(None);\r\n let spawn_phase = |phase: &str, detail: &str| {\r\n spt_proto::emit_line_err!(\r\n \"SPAWN_PHASE:{spawn_label} phase={phase} t_ms={}{}{detail}\",\r\n spawn_t0.elapsed().as_millis(),\r\n if detail.is_empty() { \"\" } else { \" \" },\r\n );\r\n if let Some(generation) = claim_gen.get() {\r\n let mut inflight = recover(&self.wake_inflight);\r\n if let Some(claim) = inflight.get_mut(&spawn_label) {\r\n // Only OUR generation: a holder taken over as wedged must not\r\n // keep refreshing the successor's claim from behind.\r\n if claim.generation == generation {\r\n claim.phase = phase.to_string();\r\n claim.phase_at = Instant::now();\r\n }\r\n }\r\n }\r\n };\r\n spawn_phase(\"received\", &format!(\"fresh={fresh}\"));\r\n // Single-flight WAKE (W4, REQ-SPAWN-COLLISION-GUARD-LIVE-DUP): the broker is the\r\n // sole spawner post-W3, so its own spawn choke is the single-flight authority.\r\n // Dedup a duplicate wake/resume for an endpoint that already has a live session\r\n // OR a spawn in flight — closing the check-then-spawn TOCTOU that let one wake\r\n // spawn two identical launch trees (perri's flynn dup: duplicate perch writers\r\n // then stomped info.json, routing injects to a contended record). The claim +\r\n // the live-session check are read together under one atomic critical section so\r\n // a concurrent spawn either sees our claim or its registered session — never a\r\n // gap; NO I/O under the lock (process_id reads a cached pid; the ZOMBIE probe\r\n // runs OFF the lock in the AlreadyLive arm). An empty endpoint is an\r\n // ad-hoc/legacy spawn (no id to dedup on) → never gated. `_wake_claim` holds\r\n // the claim to fn end, releasing (RAII) after the session is table-visible\r\n // or on any early error.\r\n // [impl->REQ-SPAWN-COLLISION-GUARD-LIVE-DUP]\r\n let _wake_claim: Option = if req.endpoint.is_empty() {\r\n None\r\n } else {\r\n loop {\r\n enum Gate<'a> {\r\n Claimed(WakeClaimGuard<'a>),\r\n AlreadyLive {\r\n sid: u64,\r\n spid: Option,\r\n process_started_at: Option,\r\n adapter_labeled: bool,\r\n spawned_ms_ago: u64,\r\n },\r\n Racing,\r\n }\r\n let gate = {\r\n let sessions = recover(&self.sessions);\r\n let mut inflight = recover(&self.wake_inflight);\r\n let live = sessions.iter().find(|(_, h)| h.endpoint == req.endpoint).map(\r\n |(sid, h)| {\r\n (\r\n *sid,\r\n h.session.process_id(),\r\n h.process_started_at,\r\n !h.adapter.is_empty(),\r\n h.spawned_at.elapsed().as_millis() as u64,\r\n )\r\n },\r\n );\r\n // The holder's own phase stamp, read under the SAME lock as the\r\n // claim — an elapsed against a recorded Instant, no I/O, per this\r\n // block's no-I/O-under-the-lock contract.\r\n let held = inflight.get(&req.endpoint).cloned();\r\n let holder_stalled = held\r\n .as_ref()\r\n .is_some_and(|c| c.phase_at.elapsed() >= phase_wedge_ceiling(&c.phase));\r\n match wake_gate_decision(live.is_some(), held.is_some(), holder_stalled) {\r\n WakeGate::AlreadyLive => {\r\n let (sid, spid, process_started_at, adapter_labeled, spawned_ms_ago) =\r\n live.expect(\"live is Some on AlreadyLive\");\r\n Gate::AlreadyLive {\r\n sid, spid, process_started_at, adapter_labeled, spawned_ms_ago,\r\n }\r\n }\r\n WakeGate::Racing => Gate::Racing,\r\n WakeGate::Claim => {\r\n // A takeover is the availability arm firing. LOUD and\r\n // always, naming the phase and the elapsed that decided\r\n // it — a silent takeover is indistinguishable from a\r\n // free endpoint in every log we would read afterwards.\r\n if let Some(prev) = &held {\r\n WEDGE_TAKEOVER_COUNT.fetch_add(1, Ordering::Relaxed);\r\n eprintln!(\r\n \"SPAWN_WEDGE_TAKEOVER:{}: claim gen {} wedged in phase {} for {}ms \\\r\n (ceiling {}ms) — taking over \\\r\n [REQ-SPAWN-COLLISION-GUARD-LIVE-DUP]\",\r\n req.endpoint,\r\n prev.generation,\r\n prev.phase,\r\n prev.phase_at.elapsed().as_millis(),\r\n phase_wedge_ceiling(&prev.phase).as_millis(),\r\n );\r\n }\r\n let generation =\r\n self.wake_generation.fetch_add(1, Ordering::Relaxed) + 1;\r\n inflight.insert(\r\n req.endpoint.clone(),\r\n WakeClaim {\r\n generation,\r\n phase: \"gate_claimed\".to_string(),\r\n phase_at: Instant::now(),\r\n },\r\n );\r\n claim_gen.set(Some(generation));\r\n Gate::Claimed(WakeClaimGuard {\r\n map: &self.wake_inflight,\r\n endpoint: req.endpoint.clone(),\r\n generation,\r\n })\r\n }\r\n }\r\n };\r\n match gate {\r\n Gate::Claimed(guard) => {\r\n spawn_phase(\"gate_claimed\", \"\");\r\n break Some(guard);\r\n }\r\n Gate::AlreadyLive {\r\n sid, spid, process_started_at, adapter_labeled, spawned_ms_ago,\r\n } => {\r\n // ONE liveness authority (ADR-0041 decision 6,\r\n // REQ-ENDPOINT-CYCLE-HONEST): before refusing/deduping by\r\n // citing the claimed session, PROBE its client tree — off\r\n // every lock. A zombie (dead root, or an adapter wrapper\r\n // whose harness clients died past boot grace) is reaped\r\n // honestly — scoped tree-kill, then wait for the\r\n // exit-waiter to de-table it — and the gate re-evaluates:\r\n // the next pass claims and spawns for real. Never a\r\n // refusal citing a corpse.\r\n // [impl->REQ-ENDPOINT-CYCLE-HONEST]\r\n if session_is_zombie(spid, adapter_labeled, spawned_ms_ago) {\r\n // Re-observe immediately before any kill, off-lock.\r\n // The existing owned-process death oracle preserves\r\n // snapshot-less Unix cleanup and Linux zombie demotion.\r\n // [impl->REQ-BROKER-ZOMBIE-IDENTITY]\r\n if let Err(reason) = reap_zombie_root(\r\n spid,\r\n process_started_at,\r\n |pid| {\r\n use spt_store::proc::{self, ProcIdentity};\r\n if proc::provably_gone(pid) {\r\n ProcIdentity::Absent\r\n } else {\r\n proc::process_started_at(pid)\r\n .map(ProcIdentity::Present)\r\n .unwrap_or(ProcIdentity::Unproven)\r\n }\r\n },\r\n spt_store::proc::kill_pid_tree,\r\n ) {\r\n spt_proto::emit_line_err!(\r\n \"SPAWN_ZOMBIE_REAP_DECLINE:{}: session {sid} pid={spid:?} \\\r\n reason={reason} — no kill or forced de-table\",\r\n req.endpoint\r\n );\r\n // Return BEFORE the cleanup loop. In particular,\r\n // do not drop HostedSession/PTY resources or call\r\n // dispatch_teardown as a fallback after refusal.\r\n return Err(format!(\r\n \"SPAWN_ZOMBIE_REAP_DECLINE:{}: session {sid}: {reason}\",\r\n req.endpoint\r\n ));\r\n }\r\n spt_proto::emit_line_err!(\r\n \"SPAWN_ZOMBIE_REAP:{}: claimed session {sid} has a dead client \\\r\n tree — reaping before honest respawn [REQ-ENDPOINT-CYCLE-HONEST]\",\r\n req.endpoint\r\n );\r\n // Bounded wait for the exit-waiter to reap the table row;\r\n // belt: a wedged/missed waiter (root already dead) gets a\r\n // direct de-table + stamp clear so the gate can converge.\r\n let reap_deadline = Instant::now() + Duration::from_secs(5);\r\n loop {\r\n if !recover(&self.sessions).contains_key(&sid) {\r\n break;\r\n }\r\n if Instant::now() >= reap_deadline {\r\n let removed = recover(&self.sessions).remove(&sid);\r\n if let Some(h) = removed {\r\n recover_log(&h.log).stamp_reaped();\r\n spt_proto::emit_line_err!(\r\n \"SPAWN_ZOMBIE_FORCE_DETABLE:{}: exit-waiter never \\\r\n reaped dead session {sid} — de-tabled directly\",\r\n req.endpoint\r\n );\r\n }\r\n break;\r\n }\r\n thread::sleep(WAKE_DEDUP_POLL);\r\n }\r\n continue; // re-evaluate the gate against the reaped truth\r\n }\r\n if fresh {\r\n // Fresh/RejectExisting: a GENUINELY live session is a\r\n // typed conflict — no session created, nothing mutated,\r\n // the live session untouched. Never Spawned(existing).\r\n // [impl->REQ-SPAWN-FRESH-TRUTHFUL]\r\n spt_proto::emit_line_err!(\r\n \"SPAWN_FRESH_CONFLICT:{}: endpoint already has a live session \\\r\n {sid} — typed conflict, no session created \\\r\n [REQ-SPAWN-FRESH-TRUTHFUL]\",\r\n req.endpoint\r\n );\r\n let frame = Envelope::new(\r\n KIND_SPAWN_CONFLICT,\r\n serde_json::to_value(SpawnConflict {\r\n endpoint: req.endpoint.clone(),\r\n session_id: sid,\r\n })\r\n .expect(\"SpawnConflict serializes\"),\r\n );\r\n send_frame(send, &frame);\r\n return Ok(None);\r\n }\r\n spt_proto::emit_line_err!(\r\n \"SPAWN_DEDUP:{}: endpoint already has a live session {sid} — \\\r\n single-flight wake no-op ack [REQ-SPAWN-COLLISION-GUARD-LIVE-DUP]\",\r\n req.endpoint\r\n );\r\n let frame = Envelope::new(\r\n KIND_SPAWNED,\r\n serde_json::to_value(Spawned { session_id: sid, pid: spid })\r\n .expect(\"Spawned serializes\"),\r\n );\r\n send_frame(send, &frame);\r\n return Ok(Some(sid));\r\n }\r\n Gate::Racing => thread::sleep(WAKE_DEDUP_POLL),\r\n }\r\n }\r\n };\r\n // REQ-HOST-RUN-2: spawn in the requested project cwd when carried;\r\n // `None` inherits the broker's cwd (legacy/test + W1 bringup shortcut).\r\n // Inject the manifest [env] vars (REQ-HAZARD-ENV-SUBST) on top of the\r\n // inherited env — empty for a legacy/N-1 spawn (inherit only).\r\n spawn_phase(\"pty_creating\", &format!(\"program={}\", req.program));\r\n // INT-RIG SEAM (#235): hold the winner inside `pty_creating` for a set time,\r\n // reproducing the measured shape — a ConPTY create that overruns while the\r\n // holder is perfectly alive. One long phase with no new stamp is exactly what\r\n // the production slow case looks like to the gate, so the rig drives the real\r\n // decision path rather than a simulation of it.\r\n // Compiled out of release entirely (see `phase_wedge_ceiling`'s seam): a stray\r\n // value must never be able to stall a production spawn, and a seam that can only\r\n // be reached in a debug build cannot. Parsed once, clamped, and LOUD every time\r\n // it fires — a silent delay is the failure mode worth engineering against.\r\n #[cfg(debug_assertions)]\r\n {\r\n static STRETCH: std::sync::OnceLock> = std::sync::OnceLock::new();\r\n if let Some(d) = STRETCH.get_or_init(|| {\r\n let raw = std::env::var(\"SPT_SPAWN_STRETCH_MS\")\r\n .ok()\r\n .and_then(|v| v.parse::().ok())?;\r\n Some(Duration::from_millis(raw.min(30_000)))\r\n }) {\r\n eprintln!(\r\n \"SPAWN_STRETCH_SEAM:{}: holding pty_creating for {}ms — test seam, \\\r\n debug builds only\",\r\n req.endpoint,\r\n d.as_millis()\r\n );\r\n thread::sleep(*d);\r\n }\r\n }\r\n let session = match PtySession::spawn_program_in_env(\r\n &req.program,\r\n &req.args,\r\n SurfaceSize::new(req.rows, req.cols),\r\n req.cwd.as_deref(),\r\n req.env.iter().map(|(k, v)| (k.as_str(), v.as_str())),\r\n ) {\r\n Ok(session) => session,\r\n Err(e) => {\r\n spawn_phase(\"pty_failed\", &format!(\"err={e}\"));\r\n return Err(format!(\"spawn failed: {e}\"));\r\n }\r\n };\r\n let session = Arc::new(session);\r\n let id = self.next_id.fetch_add(1, Ordering::Relaxed);\r\n let pid = session.process_id();\r\n // Birth identity is trustworthy here: Windows retains the child handle;\r\n // Unix cannot recycle our child's pid until it is reaped, and no waiter\r\n // has been started yet. Exec may change its image, not its birth stamp.\r\n // [impl->REQ-BROKER-ZOMBIE-IDENTITY]\r\n let process_started_at = pid.and_then(spt_store::proc::process_started_at);\r\n // The ConPTY-create span releases#199 candidate C names, closed.\r\n spawn_phase(\"pty_created\", &format!(\"pid={pid:?}\"));\r\n\r\n // The session's lone PTY input-writer (P0): the SOLE caller of the\r\n // blocking `write_input`. Every dispatch-side write enqueues here, so a\r\n // paste burst parks only this thread — never the broker dispatch thread\r\n // (REQ-HAZARD-PTY-INPUT-WRITER-WEDGE). The inject worker writes through it\r\n // too, so the lone writer enforces the W2 inject-floor order.\r\n let input = InputWriter::spawn(Arc::clone(&session), req.endpoint.clone());\r\n // releases#199: the span from here to `row_inserted` is the one a 10-way\r\n // contention run put 1427ms into while the ConPTY create took 14ms — the\r\n // child is ALREADY RUNNING through all of it and the row the bring-up poll\r\n // reads does not exist yet, which is this issue's face in miniature. So it\r\n // is stamped per step rather than as one block.\r\n spawn_phase(\"input_writer\", \"\");\r\n\r\n // The output log, with the spawning connection pre-attached as the\r\n // controller (identity `None` = LOCAL, not a remote driver) so no chunk\r\n // is missed before an explicit subscribe — and so a remote attach to a\r\n // spawned-but-undriven session takes control silently (no loud displace\r\n // of the local-spawner placeholder; REQ-RCVIEW-1).\r\n let log = Arc::new(Mutex::new(OutputLog::new(\r\n id,\r\n self.log_cap_chunks,\r\n req.endpoint.clone(),\r\n (req.rows, req.cols),\r\n )));\r\n log.lock()\r\n .unwrap()\r\n .become_controller(Arc::clone(send), None, 0, 0);\r\n spawn_phase(\"log_ready\", \"\");\r\n\r\n // Output drain → append under the log lock (fast: ring + viewer fan-out),\r\n // then deliver to the controller OFF the lock with a bounded deadline\r\n // (W1 / REQ-HAZARD-INJECT-CONTROL-COEXIST). The controller write is no\r\n // longer inline under the log lock, so a backed-up controller can never\r\n // wedge the session; a fully-stalled controller is detached after the\r\n // deadline (bounded wedge, never permanent).\r\n let log_drain = Arc::clone(&log);\r\n // DSR cursor authority (REQ-DSR-SINGLE-CPR): the drain answers each DSR\r\n // with the grid's real display-column cursor. The provider runs on the\r\n // drain thread BETWEEN sink handoffs (the append lock is released), and\r\n // the grid is advanced by that same thread, so the reported position is\r\n // exact at the query point.\r\n let log_cursor = Arc::clone(&log);\r\n let drain = session\r\n .drain_with_cursor(\r\n move |chunk| {\r\n // OBS RIDER Tap A (debug-gated, default OFF): the raw pre-parse\r\n // child output, captured before append()/grid.advance. No-op in a\r\n // release build and when SPT_OBS_BYTE_TAP is unset.\r\n spt_store::obstap::tap(id, \"raw\", chunk);\r\n // append() does the controller handoff inline now (one non-blocking\r\n // try_send — b4) and returns Some(epoch) ONLY when the controller is\r\n // stalled-past-deadline / gone and must be evicted. mark it gone OFF\r\n // the first lock (a fresh lock, no self-deadlock). The drain never\r\n // sleeps here, so a slow controller can't throttle the viewer fan-out.\r\n let evict = recover_log(&log_drain).append(chunk);\r","truncated":true,"truncatedBy":"lines","totalLines":8485,"totalBytes":27538,"outputLines":485,"outputBytes":27538,"lastLinePartial":false,"firstLineExceedsLimit":false},"totalLines":16343,"displayContent":{"text":" /// see a ticket EXPIRE has no other way to reach the far side of the TTL\r\n /// than to sleep through it, and a sleeping test proves the TTL only for the\r\n /// value it slept for.\r\n // [impl->REQ-ER-BRINGUP-SPAWNS-SESSION]\r\n fn mint_bringup_admit_at(\r\n &self,\r\n session: u64,\r\n verdict: TicketVerdict,\r\n now: Instant,\r\n ) -> String {\r\n let seed = spt_proto::identity::Identity::generate().seed();\r\n let ticket = format!(\r\n \"{BRING_UP_ADMIT_PREFIX}{}\",\r\n seed.iter().map(|b| format!(\"{b:02x}\")).collect::()\r\n );\r\n let mut admits = recover(&self.bringup_admits);\r\n admits.retain(|_, (_, expires, _)| *expires > now);\r\n admits.insert(ticket.clone(), (session, now + BRINGUP_ADMIT_TTL, verdict));\r\n ticket\r\n }\r\n\r\n /// Classify the secret an attach presented: a redeemed admit ticket, an\r\n /// `admit:`-prefixed string that did NOT redeem, or no ticket at all.\r\n ///\r\n /// Single-use and consumed by PRESENTATION, not by success: a ticket that\r\n /// names the wrong session is spent as it is refused, so a stolen ticket\r\n /// cannot be walked across sessions. Expired, already-consumed and\r\n /// never-minted are one answer here on purpose — the caller learns only that\r\n /// this string does not seat it, never whether an admit is outstanding.\r\n ///\r\n /// A prefixed string NEVER reaches the TOTP path (structurally — this\r\n /// returns before it), because an expired ticket is not a wrong guess and\r\n /// must not spend a unit of the human's attempt budget.\r\n // [impl->REQ-ER-BRINGUP-SPAWNS-SESSION]\r\n fn redeem_bringup_admit(&self, presented: Option<&str>, session: u64) -> AdmitTicket {\r\n self.redeem_bringup_admit_at(presented, session, Instant::now())\r\n }\r\n\r\n /// [`redeem_bringup_admit`](Self::redeem_bringup_admit) with the clock passed\r\n /// in — the expiry seam (see [`mint_bringup_admit_at`](Self::mint_bringup_admit_at)).\r\n // [impl->REQ-ER-BRINGUP-SPAWNS-SESSION]\r\n fn redeem_bringup_admit_at(\r\n &self,\r\n presented: Option<&str>,\r\n session: u64,\r\n now: Instant,\r\n ) -> AdmitTicket {\r\n let Some(ticket) = presented.filter(|c| c.starts_with(BRING_UP_ADMIT_PREFIX)) else {\r\n return AdmitTicket::None;\r\n };\r\n let claimed = recover(&self.bringup_admits).remove(ticket);\r\n match claimed {\r\n // The verdict travels out with the redemption — it is the broker's\r\n // own record of what its gate ruled, and the seat settles on it\r\n // (releases#142).\r\n Some((sid, expires, verdict)) if sid == session && expires > now => {\r\n AdmitTicket::Redeemed(verdict)\r\n }\r\n _ => AdmitTicket::Unredeemed,\r\n }\r\n }\r\n\r\n /// Record that this broker has STARTED a bring-up for `endpoint`, good for\r\n /// `ttl` — the bring-up's own ready-wait (see [`Self::bringups_in_flight`]).\r\n ///\r\n /// Written before the launch fires, so the fact exists for the whole window\r\n /// in which the spawned harness may ask about it. Expired entries are swept\r\n /// on every write, the way [`Self::mint_bringup_admit_at`] sweeps tickets, so\r\n /// the map holds only what is still live and a broker that never sees another\r\n /// bring-up does not accumulate.\r\n // [impl->REQ-ER-BRINGUP-INFLIGHT-LEDGER]\r\n fn note_bringup_in_flight(&self, endpoint: &str, ttl: Duration) {\r\n self.note_bringup_in_flight_at(endpoint, ttl, Instant::now());\r\n }\r\n\r\n /// [`note_bringup_in_flight`](Self::note_bringup_in_flight) with the clock\r\n /// passed in — the expiry seam, for the same reason\r\n /// [`mint_bringup_admit_at`](Self::mint_bringup_admit_at) has one: `Instant`\r\n /// cannot be fabricated, so a test that must see an entry EXPIRE has no other\r\n /// way across the TTL than to sleep through it, and a sleeping test proves\r\n /// the TTL only for the value it slept for.\r\n // [impl->REQ-ER-BRINGUP-INFLIGHT-LEDGER]\r\n fn note_bringup_in_flight_at(&self, endpoint: &str, ttl: Duration, now: Instant) {\r\n let mut flight = recover(&self.bringups_in_flight);\r\n flight.retain(|_, expires| *expires > now);\r\n flight.insert(endpoint.to_string(), now + ttl);\r\n }\r\n\r\n /// Drop `endpoint`'s in-flight entry: its session row now exists, so the\r\n /// ledger has nothing left to say about it.\r\n ///\r\n /// A no-op for the endpoints that never had an entry, which is every\r\n /// ordinary spawn — only a bring-up writes one.\r\n // [impl->REQ-ER-BRINGUP-INFLIGHT-LEDGER]\r\n fn clear_bringup_in_flight(&self, endpoint: &str) {\r\n recover(&self.bringups_in_flight).remove(endpoint);\r\n }\r\n\r\n /// The endpoints whose bring-up is in flight RIGHT NOW, expired entries\r\n /// excluded.\r\n ///\r\n /// Reads without pruning: this answers a query, and a query that mutates the\r\n /// ledger would make the reply depend on who asked last.\r\n // [impl->REQ-ER-BRINGUP-INFLIGHT-LEDGER]\r\n fn bringups_in_flight_at(&self, now: Instant) -> Vec {\r\n recover(&self.bringups_in_flight)\r\n .iter()\r\n .filter(|(_, expires)| **expires > now)\r\n .map(|(endpoint, _)| endpoint.clone())\r\n .collect()\r\n }\r\n\r\n /// The shared spawn choke behind BOTH policies (`fresh=false` =\r\n /// ResumeOrReuse/wake, `fresh=true` = Fresh/RejectExisting).\r\n fn dispatch_spawn_policy(\r\n &self,\r\n req: SpawnReq,\r\n send: &SharedSend,\r\n fresh: bool,\r\n ) -> Result, String> {\r\n // releases#199 instrument, BROKER SIDE. The launch-path stamps say when the\r\n // client asked; these say what the broker did with the ask. Two spans are\r\n // separately suspect and were previously indistinguishable from each other\r\n // and from the client's own wait: the single-flight gate below (bounded by the\r\n // holder's PROGRESS since #235, plus an unbounded-looking zombie-reap re-evaluation)\r\n // and the ConPTY create (candidate C). Stamped in the SHARED choke, not\r\n // only on the bring-up path, because the choke is where the time goes.\r\n // [impl->REQ-ER-BRINGUP-LAUNCH-PHASE-TRACE]\r\n let spawn_t0 = Instant::now();\r\n // The label is CLONED, not borrowed from `req`: the request's fields are\r\n // moved into the spawn below, and a closure holding `&req` would keep the\r\n // whole request borrowed past those moves.\r\n let spawn_label = req.endpoint.clone();\r\n // #235: the breadcrumb sites are ALSO the progress sites. The gate decides\r\n // \"still working\" vs \"wedged\" from the holder's last phase stamp, so every\r\n // place that already announces a phase records it into the claim too —\r\n // rather than a second set of call sites that can drift from these.\r\n // `None` until this thread wins the claim; a stamp before then would be\r\n // writing progress into somebody else's claim.\r\n let claim_gen: std::cell::Cell> = std::cell::Cell::new(None);\r\n let spawn_phase = |phase: &str, detail: &str| {\r\n spt_proto::emit_line_err!(\r\n \"SPAWN_PHASE:{spawn_label} phase={phase} t_ms={}{}{detail}\",\r\n spawn_t0.elapsed().as_millis(),\r\n if detail.is_empty() { \"\" } else { \" \" },\r\n );\r\n if let Some(generation) = claim_gen.get() {\r\n let mut inflight = recover(&self.wake_inflight);\r\n if let Some(claim) = inflight.get_mut(&spawn_label) {\r\n // Only OUR generation: a holder taken over as wedged must not\r\n // keep refreshing the successor's claim from behind.\r\n if claim.generation == generation {\r\n claim.phase = phase.to_string();\r\n claim.phase_at = Instant::now();\r\n }\r\n }\r\n }\r\n };\r\n spawn_phase(\"received\", &format!(\"fresh={fresh}\"));\r\n // Single-flight WAKE (W4, REQ-SPAWN-COLLISION-GUARD-LIVE-DUP): the broker is the\r\n // sole spawner post-W3, so its own spawn choke is the single-flight authority.\r\n // Dedup a duplicate wake/resume for an endpoint that already has a live session\r\n // OR a spawn in flight — closing the check-then-spawn TOCTOU that let one wake\r\n // spawn two identical launch trees (perri's flynn dup: duplicate perch writers\r\n // then stomped info.json, routing injects to a contended record). The claim +\r\n // the live-session check are read together under one atomic critical section so\r\n // a concurrent spawn either sees our claim or its registered session — never a\r\n // gap; NO I/O under the lock (process_id reads a cached pid; the ZOMBIE probe\r\n // runs OFF the lock in the AlreadyLive arm). An empty endpoint is an\r\n // ad-hoc/legacy spawn (no id to dedup on) → never gated. `_wake_claim` holds\r\n // the claim to fn end, releasing (RAII) after the session is table-visible\r\n // or on any early error.\r\n // [impl->REQ-SPAWN-COLLISION-GUARD-LIVE-DUP]\r\n let _wake_claim: Option = if req.endpoint.is_empty() {\r\n None\r\n } else {\r\n loop {\r\n enum Gate<'a> {\r\n Claimed(WakeClaimGuard<'a>),\r\n AlreadyLive {\r\n sid: u64,\r\n spid: Option,\r\n process_started_at: Option,\r\n adapter_labeled: bool,\r\n spawned_ms_ago: u64,\r\n },\r\n Racing,\r\n }\r\n let gate = {\r\n let sessions = recover(&self.sessions);\r\n let mut inflight = recover(&self.wake_inflight);\r\n let live = sessions.iter().find(|(_, h)| h.endpoint == req.endpoint).map(\r\n |(sid, h)| {\r\n (\r\n *sid,\r\n h.session.process_id(),\r\n h.process_started_at,\r\n !h.adapter.is_empty(),\r\n h.spawned_at.elapsed().as_millis() as u64,\r\n )\r\n },\r\n );\r\n // The holder's own phase stamp, read under the SAME lock as the\r\n // claim — an elapsed against a recorded Instant, no I/O, per this\r\n // block's no-I/O-under-the-lock contract.\r\n let held = inflight.get(&req.endpoint).cloned();\r\n let holder_stalled = held\r\n .as_ref()\r\n .is_some_and(|c| c.phase_at.elapsed() >= phase_wedge_ceiling(&c.phase));\r\n match wake_gate_decision(live.is_some(), held.is_some(), holder_stalled) {\r\n WakeGate::AlreadyLive => {\r\n let (sid, spid, process_started_at, adapter_labeled, spawned_ms_ago) =\r\n live.expect(\"live is Some on AlreadyLive\");\r\n Gate::AlreadyLive {\r\n sid, spid, process_started_at, adapter_labeled, spawned_ms_ago,\r\n }\r\n }\r\n WakeGate::Racing => Gate::Racing,\r\n WakeGate::Claim => {\r\n // A takeover is the availability arm firing. LOUD and\r\n // always, naming the phase and the elapsed that decided\r\n // it — a silent takeover is indistinguishable from a\r\n // free endpoint in every log we would read afterwards.\r\n if let Some(prev) = &held {\r\n WEDGE_TAKEOVER_COUNT.fetch_add(1, Ordering::Relaxed);\r\n eprintln!(\r\n \"SPAWN_WEDGE_TAKEOVER:{}: claim gen {} wedged in phase {} for {}ms \\\r\n (ceiling {}ms) — taking over \\\r\n [REQ-SPAWN-COLLISION-GUARD-LIVE-DUP]\",\r\n req.endpoint,\r\n prev.generation,\r\n prev.phase,\r\n prev.phase_at.elapsed().as_millis(),\r\n phase_wedge_ceiling(&prev.phase).as_millis(),\r\n );\r\n }\r\n let generation =\r\n self.wake_generation.fetch_add(1, Ordering::Relaxed) + 1;\r\n inflight.insert(\r\n req.endpoint.clone(),\r\n WakeClaim {\r\n generation,\r\n phase: \"gate_claimed\".to_string(),\r\n phase_at: Instant::now(),\r\n },\r\n );\r\n claim_gen.set(Some(generation));\r\n Gate::Claimed(WakeClaimGuard {\r\n map: &self.wake_inflight,\r\n endpoint: req.endpoint.clone(),\r\n generation,\r\n })\r\n }\r\n }\r\n };\r\n match gate {\r\n Gate::Claimed(guard) => {\r\n spawn_phase(\"gate_claimed\", \"\");\r\n break Some(guard);\r\n }\r\n Gate::AlreadyLive {\r\n sid, spid, process_started_at, adapter_labeled, spawned_ms_ago,\r\n } => {\r\n // ONE liveness authority (ADR-0041 decision 6,\r\n // REQ-ENDPOINT-CYCLE-HONEST): before refusing/deduping by\r\n // citing the claimed session, PROBE its client tree — off\r\n // every lock. A zombie (dead root, or an adapter wrapper\r\n // whose harness clients died past boot grace) is reaped\r\n // honestly — scoped tree-kill, then wait for the\r\n // exit-waiter to de-table it — and the gate re-evaluates:\r\n // the next pass claims and spawns for real. Never a\r\n // refusal citing a corpse.\r\n // [impl->REQ-ENDPOINT-CYCLE-HONEST]\r\n if session_is_zombie(spid, adapter_labeled, spawned_ms_ago) {\r\n // Re-observe immediately before any kill, off-lock.\r\n // The existing owned-process death oracle preserves\r\n // snapshot-less Unix cleanup and Linux zombie demotion.\r\n // [impl->REQ-BROKER-ZOMBIE-IDENTITY]\r\n if let Err(reason) = reap_zombie_root(\r\n spid,\r\n process_started_at,\r\n |pid| {\r\n use spt_store::proc::{self, ProcIdentity};\r\n if proc::provably_gone(pid) {\r\n ProcIdentity::Absent\r\n } else {\r\n proc::process_started_at(pid)\r\n .map(ProcIdentity::Present)\r\n .unwrap_or(ProcIdentity::Unproven)\r\n }\r\n },\r\n spt_store::proc::kill_pid_tree,\r\n ) {\r\n spt_proto::emit_line_err!(\r\n \"SPAWN_ZOMBIE_REAP_DECLINE:{}: session {sid} pid={spid:?} \\\r\n reason={reason} — no kill or forced de-table\",\r\n req.endpoint\r\n );\r\n // Return BEFORE the cleanup loop. In particular,\r\n // do not drop HostedSession/PTY resources or call\r\n // dispatch_teardown as a fallback after refusal.\r\n return Err(format!(\r\n \"SPAWN_ZOMBIE_REAP_DECLINE:{}: session {sid}: {reason}\",\r\n req.endpoint\r\n ));\r\n }\r\n spt_proto::emit_line_err!(\r\n \"SPAWN_ZOMBIE_REAP:{}: claimed session {sid} has a dead client \\\r\n tree — reaping before honest respawn [REQ-ENDPOINT-CYCLE-HONEST]\",\r\n req.endpoint\r\n );\r\n // Bounded wait for the exit-waiter to reap the table row;\r\n // belt: a wedged/missed waiter (root already dead) gets a\r\n // direct de-table + stamp clear so the gate can converge.\r\n let reap_deadline = Instant::now() + Duration::from_secs(5);\r\n loop {\r\n if !recover(&self.sessions).contains_key(&sid) {\r\n break;\r\n }\r\n if Instant::now() >= reap_deadline {\r\n let removed = recover(&self.sessions).remove(&sid);\r\n if let Some(h) = removed {\r\n recover_log(&h.log).stamp_reaped();\r\n spt_proto::emit_line_err!(\r\n \"SPAWN_ZOMBIE_FORCE_DETABLE:{}: exit-waiter never \\\r\n reaped dead session {sid} — de-tabled directly\",\r\n req.endpoint\r\n );\r\n }\r\n break;\r\n }\r\n thread::sleep(WAKE_DEDUP_POLL);\r\n }\r\n continue; // re-evaluate the gate against the reaped truth\r\n }\r\n if fresh {\r\n // Fresh/RejectExisting: a GENUINELY live session is a\r\n // typed conflict — no session created, nothing mutated,\r\n // the live session untouched. Never Spawned(existing).\r\n // [impl->REQ-SPAWN-FRESH-TRUTHFUL]\r\n spt_proto::emit_line_err!(\r\n \"SPAWN_FRESH_CONFLICT:{}: endpoint already has a live session \\\r\n {sid} — typed conflict, no session created \\\r\n [REQ-SPAWN-FRESH-TRUTHFUL]\",\r\n req.endpoint\r\n );\r\n let frame = Envelope::new(\r\n KIND_SPAWN_CONFLICT,\r\n serde_json::to_value(SpawnConflict {\r\n endpoint: req.endpoint.clone(),\r\n session_id: sid,\r\n })\r\n .expect(\"SpawnConflict serializes\"),\r\n );\r\n send_frame(send, &frame);\r\n return Ok(None);\r\n }\r\n spt_proto::emit_line_err!(\r\n \"SPAWN_DEDUP:{}: endpoint already has a live session {sid} — \\\r\n single-flight wake no-op ack [REQ-SPAWN-COLLISION-GUARD-LIVE-DUP]\",\r\n req.endpoint\r\n );\r\n let frame = Envelope::new(\r\n KIND_SPAWNED,\r\n serde_json::to_value(Spawned { session_id: sid, pid: spid })\r\n .expect(\"Spawned serializes\"),\r\n );\r\n send_frame(send, &frame);\r\n return Ok(Some(sid));\r\n }\r\n Gate::Racing => thread::sleep(WAKE_DEDUP_POLL),\r\n }\r\n }\r\n };\r\n // REQ-HOST-RUN-2: spawn in the requested project cwd when carried;\r\n // `None` inherits the broker's cwd (legacy/test + W1 bringup shortcut).\r\n // Inject the manifest [env] vars (REQ-HAZARD-ENV-SUBST) on top of the\r\n // inherited env — empty for a legacy/N-1 spawn (inherit only).\r\n spawn_phase(\"pty_creating\", &format!(\"program={}\", req.program));\r\n // INT-RIG SEAM (#235): hold the winner inside `pty_creating` for a set time,\r\n // reproducing the measured shape — a ConPTY create that overruns while the\r\n // holder is perfectly alive. One long phase with no new stamp is exactly what\r\n // the production slow case looks like to the gate, so the rig drives the real\r\n // decision path rather than a simulation of it.\r\n // Compiled out of release entirely (see `phase_wedge_ceiling`'s seam): a stray\r\n // value must never be able to stall a production spawn, and a seam that can only\r\n // be reached in a debug build cannot. Parsed once, clamped, and LOUD every time\r\n // it fires — a silent delay is the failure mode worth engineering against.\r\n #[cfg(debug_assertions)]\r\n {\r\n static STRETCH: std::sync::OnceLock> = std::sync::OnceLock::new();\r\n if let Some(d) = STRETCH.get_or_init(|| {\r\n let raw = std::env::var(\"SPT_SPAWN_STRETCH_MS\")\r\n .ok()\r\n .and_then(|v| v.parse::().ok())?;\r\n Some(Duration::from_millis(raw.min(30_000)))\r\n }) {\r\n eprintln!(\r\n \"SPAWN_STRETCH_SEAM:{}: holding pty_creating for {}ms — test seam, \\\r\n debug builds only\",\r\n req.endpoint,\r\n d.as_millis()\r\n );\r\n thread::sleep(*d);\r\n }\r\n }\r\n let session = match PtySession::spawn_program_in_env(\r\n &req.program,\r\n &req.args,\r\n SurfaceSize::new(req.rows, req.cols),\r\n req.cwd.as_deref(),\r\n req.env.iter().map(|(k, v)| (k.as_str(), v.as_str())),\r\n ) {\r\n Ok(session) => session,\r\n Err(e) => {\r\n spawn_phase(\"pty_failed\", &format!(\"err={e}\"));\r\n return Err(format!(\"spawn failed: {e}\"));\r\n }\r\n };\r\n let session = Arc::new(session);\r\n let id = self.next_id.fetch_add(1, Ordering::Relaxed);\r\n let pid = session.process_id();\r\n // Birth identity is trustworthy here: Windows retains the child handle;\r\n // Unix cannot recycle our child's pid until it is reaped, and no waiter\r\n // has been started yet. Exec may change its image, not its birth stamp.\r\n // [impl->REQ-BROKER-ZOMBIE-IDENTITY]\r\n let process_started_at = pid.and_then(spt_store::proc::process_started_at);\r\n // The ConPTY-create span releases#199 candidate C names, closed.\r\n spawn_phase(\"pty_created\", &format!(\"pid={pid:?}\"));\r\n\r\n // The session's lone PTY input-writer (P0): the SOLE caller of the\r\n // blocking `write_input`. Every dispatch-side write enqueues here, so a\r\n // paste burst parks only this thread — never the broker dispatch thread\r\n // (REQ-HAZARD-PTY-INPUT-WRITER-WEDGE). The inject worker writes through it\r\n // too, so the lone writer enforces the W2 inject-floor order.\r\n let input = InputWriter::spawn(Arc::clone(&session), req.endpoint.clone());\r\n // releases#199: the span from here to `row_inserted` is the one a 10-way\r\n // contention run put 1427ms into while the ConPTY create took 14ms — the\r\n // child is ALREADY RUNNING through all of it and the row the bring-up poll\r\n // reads does not exist yet, which is this issue's face in miniature. So it\r\n // is stamped per step rather than as one block.\r\n spawn_phase(\"input_writer\", \"\");\r\n\r\n // The output log, with the spawning connection pre-attached as the\r\n // controller (identity `None` = LOCAL, not a remote driver) so no chunk\r\n // is missed before an explicit subscribe — and so a remote attach to a\r\n // spawned-but-undriven session takes control silently (no loud displace\r\n // of the local-spawner placeholder; REQ-RCVIEW-1).\r\n let log = Arc::new(Mutex::new(OutputLog::new(\r\n id,\r\n self.log_cap_chunks,\r\n req.endpoint.clone(),\r\n (req.rows, req.cols),\r\n )));\r\n log.lock()\r\n .unwrap()\r\n .become_controller(Arc::clone(send), None, 0, 0);\r\n spawn_phase(\"log_ready\", \"\");\r\n\r\n // Output drain → append under the log lock (fast: ring + viewer fan-out),\r\n // then deliver to the controller OFF the lock with a bounded deadline\r\n // (W1 / REQ-HAZARD-INJECT-CONTROL-COEXIST). The controller write is no\r\n // longer inline under the log lock, so a backed-up controller can never\r\n // wedge the session; a fully-stalled controller is detached after the\r\n // deadline (bounded wedge, never permanent).\r\n let log_drain = Arc::clone(&log);\r\n // DSR cursor authority (REQ-DSR-SINGLE-CPR): the drain answers each DSR\r\n // with the grid's real display-column cursor. The provider runs on the\r\n // drain thread BETWEEN sink handoffs (the append lock is released), and\r\n // the grid is advanced by that same thread, so the reported position is\r\n // exact at the query point.\r\n let log_cursor = Arc::clone(&log);\r\n let drain = session\r\n .drain_with_cursor(\r\n move |chunk| {\r\n // OBS RIDER Tap A (debug-gated, default OFF): the raw pre-parse\r\n // child output, captured before append()/grid.advance. No-op in a\r\n // release build and when SPT_OBS_BYTE_TAP is unset.\r\n spt_store::obstap::tap(id, \"raw\", chunk);\r\n // append() does the controller handoff inline now (one non-blocking\r\n // try_send — b4) and returns Some(epoch) ONLY when the controller is\r\n // stalled-past-deadline / gone and must be evicted. mark it gone OFF\r\n // the first lock (a fresh lock, no self-deadlock). The drain never\r\n // sleeps here, so a slow controller can't throttle the viewer fan-out.\r\n let evict = recover_log(&log_drain).append(chunk);\r\n…\n },\n…\n )\n .map_err(|e| format!(\"drain failed: {e}\"))?;\n…\n }","startLine":7859,"lineNumbers":[7859,7860,7861,7862,7863,7864,7865,7866,7867,7868,7869,7870,7871,7872,7873,7874,7875,7876,7877,7878,7879,7880,7881,7882,7883,7884,7885,7886,7887,7888,7889,7890,7891,7892,7893,7894,7895,7896,7897,7898,7899,7900,7901,7902,7903,7904,7905,7906,7907,7908,7909,7910,7911,7912,7913,7914,7915,7916,7917,7918,7919,7920,7921,7922,7923,7924,7925,7926,7927,7928,7929,7930,7931,7932,7933,7934,7935,7936,7937,7938,7939,7940,7941,7942,7943,7944,7945,7946,7947,7948,7949,7950,7951,7952,7953,7954,7955,7956,7957,7958,7959,7960,7961,7962,7963,7964,7965,7966,7967,7968,7969,7970,7971,7972,7973,7974,7975,7976,7977,7978,7979,7980,7981,7982,7983,7984,7985,7986,7987,7988,7989,7990,7991,7992,7993,7994,7995,7996,7997,7998,7999,8000,8001,8002,8003,8004,8005,8006,8007,8008,8009,8010,8011,8012,8013,8014,8015,8016,8017,8018,8019,8020,8021,8022,8023,8024,8025,8026,8027,8028,8029,8030,8031,8032,8033,8034,8035,8036,8037,8038,8039,8040,8041,8042,8043,8044,8045,8046,8047,8048,8049,8050,8051,8052,8053,8054,8055,8056,8057,8058,8059,8060,8061,8062,8063,8064,8065,8066,8067,8068,8069,8070,8071,8072,8073,8074,8075,8076,8077,8078,8079,8080,8081,8082,8083,8084,8085,8086,8087,8088,8089,8090,8091,8092,8093,8094,8095,8096,8097,8098,8099,8100,8101,8102,8103,8104,8105,8106,8107,8108,8109,8110,8111,8112,8113,8114,8115,8116,8117,8118,8119,8120,8121,8122,8123,8124,8125,8126,8127,8128,8129,8130,8131,8132,8133,8134,8135,8136,8137,8138,8139,8140,8141,8142,8143,8144,8145,8146,8147,8148,8149,8150,8151,8152,8153,8154,8155,8156,8157,8158,8159,8160,8161,8162,8163,8164,8165,8166,8167,8168,8169,8170,8171,8172,8173,8174,8175,8176,8177,8178,8179,8180,8181,8182,8183,8184,8185,8186,8187,8188,8189,8190,8191,8192,8193,8194,8195,8196,8197,8198,8199,8200,8201,8202,8203,8204,8205,8206,8207,8208,8209,8210,8211,8212,8213,8214,8215,8216,8217,8218,8219,8220,8221,8222,8223,8224,8225,8226,8227,8228,8229,8230,8231,8232,8233,8234,8235,8236,8237,8238,8239,8240,8241,8242,8243,8244,8245,8246,8247,8248,8249,8250,8251,8252,8253,8254,8255,8256,8257,8258,8259,8260,8261,8262,8263,8264,8265,8266,8267,8268,8269,8270,8271,8272,8273,8274,8275,8276,8277,8278,8279,8280,8281,8282,8283,8284,8285,8286,8287,8288,8289,8290,8291,8292,8293,8294,8295,8296,8297,8298,8299,8300,8301,8302,8303,8304,8305,8306,8307,8308,8309,8310,8311,8312,8313,8314,8315,8316,8317,8318,8319,8320,8321,8322,8323,8324,8325,8326,8327,8328,8329,8330,8331,8332,8333,8334,8335,8336,8337,8338,8339,8340,8341,8342,8343,null,8347,null,8349,8350,null,8615]},"fileSize":850523,"meta":{"source":{"type":"path","value":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.worktrees\\285-zombie\\crates\\spt-daemon\\src\\broker.rs"},"truncation":{"direction":"head","truncatedBy":"lines","totalLines":16343,"totalBytes":27538,"outputLines":485,"outputBytes":27538,"shownRange":{"start":7859,"end":8343},"nextOffset":8344}}},"isError":false,"timestamp":1789001117064}}
{"type":"message","id":"4d75cf63","parentId":"a101e448","timestamp":"2026-09-10T00:45:17.070Z","message":{"role":"toolResult","toolCallId":"call_lj7ly3cY0OirG2Obye5ljp8n|fc_02547c41fbf377fa016aa1fd9ce20487d2bcb47f2deff5a1fb","toolName":"read","content":[{"type":"text","text":"fn controller_writer(\n…\n) {\n…\n while let Ok(msg) = rx.recv() {\n…\n let (frame, seq, watermark) = match &msg {\n…\n // A ceremony frame (WAX-SEAL W2): written like any frame, no\n // cursor advance (not session output).\n CtrlMsg::Ceremony(frame) => (frame, None, None),\n };\n // NO epoch gate on the live path (P1c): new output only ever flows to the\n // CURRENT controller's channel (the drain clones `self.controller.tx`), so\n // a superseded writer's channel holds only its pre-supersede output\n // backlog (seq the consumer dedups via snap-above). The loop ends\n // naturally when `tx` drops — and a REVOKED replacement then emits the\n // terminal `Displaced` below, BEHIND this drained backlog (order\n // preserved), instead of racing it through the live queue. The reorder\n // hazard is the INITIAL-BATCH replay, gated above.\n mark_blocked(true);\n let res = send.write(frame);\n mark_blocked(false);\n match res {\n Ok(_) => {}\n Err(e) => {\n note_controller_write_retired(sid, send.id(), &e);\n // Bounded writer-exit record (F-039 leg d).\n // [impl->REQ-CONN-POISON-ATTRIBUTION]\n send.lifecycle_event(\n \"writer-exit\",\n &format!(\"role=controller session={sid} reason=write-failed kind={:?}\", e.kind()),\n );\n return;\n }\n }\n if let Some(seq) = seq {\n // (a) CONTIGUOUS cursor (b4 / B2 gapless-resume — doyle's gate): with the\n // drop-on-full handoff in `append`, the controller's live channel can SKIP\n // a seq (dropped while Full). The frame still went to the socket (the live\n // operator sees it), but the durable resume cursor must NOT jump past the\n // gap — see [`contiguous_advance`].\n contiguous_advance(&delivered_through, seq);\n }\n if let Some(watermark) = watermark {\n // The transition sync frame: one successful write advances the cursor\n // past the WHOLE suppressed range (monotonic max, CAS — the same\n // advance the initial repaint batch uses). B2 gapless-resume holds IN\n // EFFECT: the repaint this frame carries supersedes every skipped seq,\n // and a resume below the presentation floor is served the repaint\n // shape, never a raw replay (REQ-RC-RESIZE-PRESENTATION-BARRIER).\n // [impl->REQ-RC-RESIZE-PRESENTATION-BARRIER]\n advance_delivered(&delivered_through, watermark);\n }\n }\n // tx dropped — a replace/detach ended the live loop. A REVOKED replacement\n // (distinct-lease Take) emits the terminal Displaced as the final frame\n // (ADR-0044); a silent same-lease/detach end stays silent (gate #7).\n // [impl->REQ-CONTROLLER-LEASE-IDENTITY]\n if emit_revoke_if_marked(&send) {\n return;\n }\n // Bounded writer-exit record (F-039 leg d).\n // [impl->REQ-CONN-POISON-ATTRIBUTION]\n send.lifecycle_event(\n \"writer-exit\",\n &format!(\"role=controller session={sid} reason=channel-closed\"),\n );\n}\n\n/// The per-session translation-binary attachment (W2 Layer C, ADR-0022). Present\n/// ONLY when the spawn carried a `translation_binary` path; absent → the session\n/// has no idle PTY delivery and inbound SPOOLS (ADR-0022 amendment — raw inject\n/// was removed as a delivery path; it did not submit on a modern TUI).\n///\n/// Holds the shared inject floor (the controller-input buffer, also touched by\n/// `dispatch_input`), the queue that feeds inbound ``s to the inject worker\n/// (events serialize — never two uncommitted sequences interleaved), the shared\n/// child handle (so `dispatch_input` can fire content-free `{type:input}` pings\n/// while the worker drives an event), and the FAULT flag the worker raises when a\n/// sequence misses its [`INJECT_COMMIT_DEADLINE`] or the binary dies — after which\n/// the session's idle inbound SPOOLS (never raw-injected) and pinging stops.\nstruct Translation {\n /// Controller-input buffer + inject-floor flag, shared with `dispatch_input`.\n floor: Arc>,\n /// Queue one inbound `` envelope to the inject worker. Events QUEUE here\n /// and are driven one-at-a-time so two sequences never interleave.\n event_tx: Sender,\n /// The live child — shared so `dispatch_input` fires content-free pings while\n /// the worker (which also holds an `Arc`) drives events / faults the binary.\n child: Arc,\n /// Raised by the worker on FAULT (commit-deadline miss / binary death): the\n /// session's idle inbound then SPOOLS (never raw-injected) and `dispatch_input`\n /// stops pinging.\n faulted: Arc,\n}\n\n/// A child the broker hosts under a PTY — the §B-owned resources for one\n/// session, plus its gapless-resume output log.\nstruct HostedSession {\n /// The PTY + child (PTY master/writer + spawned child process).\n session: Arc,\n /// The session's dedicated PTY input-writer (v0.13.0 P0,\n /// REQ-HAZARD-PTY-INPUT-WRITER-WEDGE): the SOLE caller of the blocking\n /// `write_input`. Every dispatch-side write ENQUEUES here and returns at once,\n /// so a paste burst that fills the harness's input buffer parks only the\n /// writer thread, never the broker dispatch thread.\n input: Arc,\n /// The output drain pump (kept so teardown can stop it).\n #[allow(dead_code)] // held for ownership/teardown; not read directly\n drain: Drain,\n /// The sequenced, buffered output + current subscriber.\n log: Arc>,\n /// The owning endpoint (the spawn's label; empty = unlabeled). The\n /// inbound dispatcher's gate subject for remote-drive (D9-1).\n endpoint: String,\n /// The translation-binary attachment (Layer C), or `None` for a session with\n /// no `[message-idle-translation-binary]` — then idle inbound delivery SPOOLS\n /// (no raw PTY inject; ADR-0022 amendment).\n translation: Option>,\n /// The resolved translation argv this session was spawned with (F029 C-1) —\n /// held so a bounded eager respawn after a REAL fault can rebuild the binary\n /// from the exact same command (`build_translation`) without re-reading the\n /// manifest (works for a test session with a direct argv AND a production\n /// session). `None` for a no-translation session. Updated on an adapter-apply\n /// restart to the swapped-in argv.\n translation_argv: Option>,\n /// The bounded-respawn give-up counter shared with the inject worker (F029 C-1,\n /// REQ-HAZARD-TRANSLATE-FAULT-PERMANENT-DEATH): the dispatch respawn path\n /// increments it per rebuild, the worker RESETS it to 0 on a healthy `{commit}`\n /// (so a recovered binary refreshes the whole budget). At `translate_respawn_\n /// budget()` the daemon gives up (loud) and leaves the binary dead → spool.\n translation_respawns: Arc,\n /// The adapter name owning this session (W3a, ADR-0025) — empty for a\n /// legacy/test/shell spawn. A live adapter update finds every live session\n /// whose `adapter` matches to cycle its resident children.\n adapter: String,\n /// The adapter's install dir for this session (W3a) — `None` if unknown. The\n /// apply target for a live update's CRC swap.\n install_dir: Option,\n /// When the session spawned (ADR-0041 decision 6) — the zombie verdict's\n /// boot-grace anchor: a just-spawned adapter harness has no client chain\n /// yet and must never read as a dead tree during bringup.\n // [impl->REQ-ENDPOINT-CYCLE-HONEST]\n spawned_at: Instant,\n /// OS birth stamp captured while the newly spawned child is still owned\n /// and BEFORE any waiter can reap it. Never refreshed from a remembered pid.\n // [impl->REQ-BROKER-ZOMBIE-IDENTITY]\n process_started_at: Option,\n}\n\n/// One record queued to a session's dedicated PTY input-writer thread — the raw\n/// bytes to write (v0.13.0 P0, REQ-HAZARD-PTY-INPUT-WRITER-WEDGE).\ntype InputRecord = Vec;\n\n/// The per-session PTY input FIFO depth (records). Sized for a generous paste —\n/// a wedged harness fills this and then DROPS, never blocking the dispatch\n/// thread. The int gate shrinks it via `SPT_INPUT_QUEUE_DEPTH` so the\n/// DROP+`INPUT_BACKPRESSURE` leg is forced in a handful of records rather than a\n/// few hundred KB of real paste.\nconst INPUT_QUEUE_DEPTH: usize = 4096;\n\n/// The effective input FIFO depth: production is [`INPUT_QUEUE_DEPTH`]; the int\n/// gate overrides it (`SPT_INPUT_QUEUE_DEPTH`) to a tiny value to force a\n/// deterministic queue saturation — the depth's PRESENCE (bounded, drop-on-full)\n/// is the invariant, not its exact value.\nfn input_queue_depth() -> usize {\n match std::env::var(\"SPT_INPUT_QUEUE_DEPTH\") {\n Ok(n) => n\n .parse::()\n .ok()\n .filter(|d| *d > 0)\n .unwrap_or(INPUT_QUEUE_DEPTH),\n Err(_) => INPUT_QUEUE_DEPTH,\n }\n}\n\n/// One session's dedicated PTY input-writer (v0.13.0 P0,\n/// REQ-HAZARD-PTY-INPUT-WRITER-WEDGE). The `writer` thread is the SOLE caller of\n/// the blocking [`SessionSurface::write_input`]; every other site enqueues a\n/// record via [`InputWriter::enqueue`] (a non-blocking `try_send`) and returns\n/// immediately. So a paste burst that fills the ConPTY/forkpty input buffer\n/// parks ONLY this thread — the broker dispatch thread, attach-opens, resizes,\n/// and every other session stay fully live (the W1b-deferred fix (2)). Mirrors\n/// the OUTPUT-side [`ViewerSink`]/[`ControllerSink`] writer-thread pattern.\nstruct InputWriter {\n /// The bounded input FIFO to the writer thread. `try_send` only — a full\n /// queue (a genuinely wedged harness) DROPS, it never blocks.\n tx: SyncSender,\n /// True while the FIFO is saturated and input is being dropped; cleared on\n /// the next accepted enqueue (heal-on-resume). Mirrored to the perch's\n /// `input_backpressure` so the operator sees the drop.\n backpressure: AtomicBool,\n /// The owning endpoint (the spawn's label; empty = unlabeled / raw test) —\n /// the perch whose `input_backpressure` this stamps. Empty ⇒ nowhere to record.\n endpoint: String,\n /// The writer thread handle (held for ownership; the thread drains until the\n /// last `tx` clone drops at session teardown, then exits).\n _writer: JoinHandle<()>,\n}\n\nimpl InputWriter {\n /// Spawn a session's input-writer thread. `session` is the `Arc`\n /// whose PTY write handle this thread now exclusively owns.\n fn spawn(session: Arc, endpoint: String) -> Arc {\n let (tx, rx) = sync_channel::(input_queue_depth());\n let writer = thread::spawn(move || input_writer(session, rx));\n Arc::new(InputWriter {\n…\n })\n }\n…\n}\n\n[Showing lines 4009-4208 of 16343. Use :4209 to continue]"}],"details":{"truncation":{"content":" // A ceremony frame (WAX-SEAL W2): written like any frame, no\r\n // cursor advance (not session output).\r\n CtrlMsg::Ceremony(frame) => (frame, None, None),\r\n };\r\n // NO epoch gate on the live path (P1c): new output only ever flows to the\r\n // CURRENT controller's channel (the drain clones `self.controller.tx`), so\r\n // a superseded writer's channel holds only its pre-supersede output\r\n // backlog (seq the consumer dedups via snap-above). The loop ends\r\n // naturally when `tx` drops — and a REVOKED replacement then emits the\r\n // terminal `Displaced` below, BEHIND this drained backlog (order\r\n // preserved), instead of racing it through the live queue. The reorder\r\n // hazard is the INITIAL-BATCH replay, gated above.\r\n mark_blocked(true);\r\n let res = send.write(frame);\r\n mark_blocked(false);\r\n match res {\r\n Ok(_) => {}\r\n Err(e) => {\r\n note_controller_write_retired(sid, send.id(), &e);\r\n // Bounded writer-exit record (F-039 leg d).\r\n // [impl->REQ-CONN-POISON-ATTRIBUTION]\r\n send.lifecycle_event(\r\n \"writer-exit\",\r\n &format!(\"role=controller session={sid} reason=write-failed kind={:?}\", e.kind()),\r\n );\r\n return;\r\n }\r\n }\r\n if let Some(seq) = seq {\r\n // (a) CONTIGUOUS cursor (b4 / B2 gapless-resume — doyle's gate): with the\r\n // drop-on-full handoff in `append`, the controller's live channel can SKIP\r\n // a seq (dropped while Full). The frame still went to the socket (the live\r\n // operator sees it), but the durable resume cursor must NOT jump past the\r\n // gap — see [`contiguous_advance`].\r\n contiguous_advance(&delivered_through, seq);\r\n }\r\n if let Some(watermark) = watermark {\r\n // The transition sync frame: one successful write advances the cursor\r\n // past the WHOLE suppressed range (monotonic max, CAS — the same\r\n // advance the initial repaint batch uses). B2 gapless-resume holds IN\r\n // EFFECT: the repaint this frame carries supersedes every skipped seq,\r\n // and a resume below the presentation floor is served the repaint\r\n // shape, never a raw replay (REQ-RC-RESIZE-PRESENTATION-BARRIER).\r\n // [impl->REQ-RC-RESIZE-PRESENTATION-BARRIER]\r\n advance_delivered(&delivered_through, watermark);\r\n }\r\n }\r\n // tx dropped — a replace/detach ended the live loop. A REVOKED replacement\r\n // (distinct-lease Take) emits the terminal Displaced as the final frame\r\n // (ADR-0044); a silent same-lease/detach end stays silent (gate #7).\r\n // [impl->REQ-CONTROLLER-LEASE-IDENTITY]\r\n if emit_revoke_if_marked(&send) {\r\n return;\r\n }\r\n // Bounded writer-exit record (F-039 leg d).\r\n // [impl->REQ-CONN-POISON-ATTRIBUTION]\r\n send.lifecycle_event(\r\n \"writer-exit\",\r\n &format!(\"role=controller session={sid} reason=channel-closed\"),\r\n );\r\n}\r\n\r\n/// The per-session translation-binary attachment (W2 Layer C, ADR-0022). Present\r\n/// ONLY when the spawn carried a `translation_binary` path; absent → the session\r\n/// has no idle PTY delivery and inbound SPOOLS (ADR-0022 amendment — raw inject\r\n/// was removed as a delivery path; it did not submit on a modern TUI).\r\n///\r\n/// Holds the shared inject floor (the controller-input buffer, also touched by\r\n/// `dispatch_input`), the queue that feeds inbound ``s to the inject worker\r\n/// (events serialize — never two uncommitted sequences interleaved), the shared\r\n/// child handle (so `dispatch_input` can fire content-free `{type:input}` pings\r\n/// while the worker drives an event), and the FAULT flag the worker raises when a\r\n/// sequence misses its [`INJECT_COMMIT_DEADLINE`] or the binary dies — after which\r\n/// the session's idle inbound SPOOLS (never raw-injected) and pinging stops.\r\nstruct Translation {\r\n /// Controller-input buffer + inject-floor flag, shared with `dispatch_input`.\r\n floor: Arc>,\r\n /// Queue one inbound `` envelope to the inject worker. Events QUEUE here\r\n /// and are driven one-at-a-time so two sequences never interleave.\r\n event_tx: Sender,\r\n /// The live child — shared so `dispatch_input` fires content-free pings while\r\n /// the worker (which also holds an `Arc`) drives events / faults the binary.\r\n child: Arc,\r\n /// Raised by the worker on FAULT (commit-deadline miss / binary death): the\r\n /// session's idle inbound then SPOOLS (never raw-injected) and `dispatch_input`\r\n /// stops pinging.\r\n faulted: Arc,\r\n}\r\n\r\n/// A child the broker hosts under a PTY — the §B-owned resources for one\r\n/// session, plus its gapless-resume output log.\r\nstruct HostedSession {\r\n /// The PTY + child (PTY master/writer + spawned child process).\r\n session: Arc,\r\n /// The session's dedicated PTY input-writer (v0.13.0 P0,\r\n /// REQ-HAZARD-PTY-INPUT-WRITER-WEDGE): the SOLE caller of the blocking\r\n /// `write_input`. Every dispatch-side write ENQUEUES here and returns at once,\r\n /// so a paste burst that fills the harness's input buffer parks only the\r\n /// writer thread, never the broker dispatch thread.\r\n input: Arc,\r\n /// The output drain pump (kept so teardown can stop it).\r\n #[allow(dead_code)] // held for ownership/teardown; not read directly\r\n drain: Drain,\r\n /// The sequenced, buffered output + current subscriber.\r\n log: Arc>,\r\n /// The owning endpoint (the spawn's label; empty = unlabeled). The\r\n /// inbound dispatcher's gate subject for remote-drive (D9-1).\r\n endpoint: String,\r\n /// The translation-binary attachment (Layer C), or `None` for a session with\r\n /// no `[message-idle-translation-binary]` — then idle inbound delivery SPOOLS\r\n /// (no raw PTY inject; ADR-0022 amendment).\r\n translation: Option>,\r\n /// The resolved translation argv this session was spawned with (F029 C-1) —\r\n /// held so a bounded eager respawn after a REAL fault can rebuild the binary\r\n /// from the exact same command (`build_translation`) without re-reading the\r\n /// manifest (works for a test session with a direct argv AND a production\r\n /// session). `None` for a no-translation session. Updated on an adapter-apply\r\n /// restart to the swapped-in argv.\r\n translation_argv: Option>,\r\n /// The bounded-respawn give-up counter shared with the inject worker (F029 C-1,\r\n /// REQ-HAZARD-TRANSLATE-FAULT-PERMANENT-DEATH): the dispatch respawn path\r\n /// increments it per rebuild, the worker RESETS it to 0 on a healthy `{commit}`\r\n /// (so a recovered binary refreshes the whole budget). At `translate_respawn_\r\n /// budget()` the daemon gives up (loud) and leaves the binary dead → spool.\r\n translation_respawns: Arc,\r\n /// The adapter name owning this session (W3a, ADR-0025) — empty for a\r\n /// legacy/test/shell spawn. A live adapter update finds every live session\r\n /// whose `adapter` matches to cycle its resident children.\r\n adapter: String,\r\n /// The adapter's install dir for this session (W3a) — `None` if unknown. The\r\n /// apply target for a live update's CRC swap.\r\n install_dir: Option,\r\n /// When the session spawned (ADR-0041 decision 6) — the zombie verdict's\r\n /// boot-grace anchor: a just-spawned adapter harness has no client chain\r\n /// yet and must never read as a dead tree during bringup.\r\n // [impl->REQ-ENDPOINT-CYCLE-HONEST]\r\n spawned_at: Instant,\r\n /// OS birth stamp captured while the newly spawned child is still owned\r\n /// and BEFORE any waiter can reap it. Never refreshed from a remembered pid.\r\n // [impl->REQ-BROKER-ZOMBIE-IDENTITY]\r\n process_started_at: Option,\r\n}\r\n\r\n/// One record queued to a session's dedicated PTY input-writer thread — the raw\r\n/// bytes to write (v0.13.0 P0, REQ-HAZARD-PTY-INPUT-WRITER-WEDGE).\r\ntype InputRecord = Vec;\r\n\r\n/// The per-session PTY input FIFO depth (records). Sized for a generous paste —\r\n/// a wedged harness fills this and then DROPS, never blocking the dispatch\r\n/// thread. The int gate shrinks it via `SPT_INPUT_QUEUE_DEPTH` so the\r\n/// DROP+`INPUT_BACKPRESSURE` leg is forced in a handful of records rather than a\r\n/// few hundred KB of real paste.\r\nconst INPUT_QUEUE_DEPTH: usize = 4096;\r\n\r\n/// The effective input FIFO depth: production is [`INPUT_QUEUE_DEPTH`]; the int\r\n/// gate overrides it (`SPT_INPUT_QUEUE_DEPTH`) to a tiny value to force a\r\n/// deterministic queue saturation — the depth's PRESENCE (bounded, drop-on-full)\r\n/// is the invariant, not its exact value.\r\nfn input_queue_depth() -> usize {\r\n match std::env::var(\"SPT_INPUT_QUEUE_DEPTH\") {\r\n Ok(n) => n\r\n .parse::()\r\n .ok()\r\n .filter(|d| *d > 0)\r\n .unwrap_or(INPUT_QUEUE_DEPTH),\r\n Err(_) => INPUT_QUEUE_DEPTH,\r\n }\r\n}\r\n\r\n/// One session's dedicated PTY input-writer (v0.13.0 P0,\r\n/// REQ-HAZARD-PTY-INPUT-WRITER-WEDGE). The `writer` thread is the SOLE caller of\r\n/// the blocking [`SessionSurface::write_input`]; every other site enqueues a\r\n/// record via [`InputWriter::enqueue`] (a non-blocking `try_send`) and returns\r\n/// immediately. So a paste burst that fills the ConPTY/forkpty input buffer\r\n/// parks ONLY this thread — the broker dispatch thread, attach-opens, resizes,\r\n/// and every other session stay fully live (the W1b-deferred fix (2)). Mirrors\r\n/// the OUTPUT-side [`ViewerSink`]/[`ControllerSink`] writer-thread pattern.\r\nstruct InputWriter {\r\n /// The bounded input FIFO to the writer thread. `try_send` only — a full\r\n /// queue (a genuinely wedged harness) DROPS, it never blocks.\r\n tx: SyncSender,\r\n /// True while the FIFO is saturated and input is being dropped; cleared on\r\n /// the next accepted enqueue (heal-on-resume). Mirrored to the perch's\r\n /// `input_backpressure` so the operator sees the drop.\r\n backpressure: AtomicBool,\r\n /// The owning endpoint (the spawn's label; empty = unlabeled / raw test) —\r\n /// the perch whose `input_backpressure` this stamps. Empty ⇒ nowhere to record.\r\n endpoint: String,\r\n /// The writer thread handle (held for ownership; the thread drains until the\r\n /// last `tx` clone drops at session teardown, then exits).\r\n _writer: JoinHandle<()>,\r\n}\r\n\r\nimpl InputWriter {\r\n /// Spawn a session's input-writer thread. `session` is the `Arc`\r\n /// whose PTY write handle this thread now exclusively owns.\r\n fn spawn(session: Arc, endpoint: String) -> Arc {\r\n let (tx, rx) = sync_channel::(input_queue_depth());\r\n let writer = thread::spawn(move || input_writer(session, rx));\r\n Arc::new(InputWriter {\r","truncated":true,"truncatedBy":"lines","totalLines":12335,"totalBytes":11155,"outputLines":200,"outputBytes":11155,"lastLinePartial":false,"firstLineExceedsLimit":false},"totalLines":16343,"displayContent":{"text":"fn controller_writer(\n…\n) {\n…\n while let Ok(msg) = rx.recv() {\n…\n let (frame, seq, watermark) = match &msg {\n…\n // A ceremony frame (WAX-SEAL W2): written like any frame, no\r\n // cursor advance (not session output).\r\n CtrlMsg::Ceremony(frame) => (frame, None, None),\r\n };\r\n // NO epoch gate on the live path (P1c): new output only ever flows to the\r\n // CURRENT controller's channel (the drain clones `self.controller.tx`), so\r\n // a superseded writer's channel holds only its pre-supersede output\r\n // backlog (seq the consumer dedups via snap-above). The loop ends\r\n // naturally when `tx` drops — and a REVOKED replacement then emits the\r\n // terminal `Displaced` below, BEHIND this drained backlog (order\r\n // preserved), instead of racing it through the live queue. The reorder\r\n // hazard is the INITIAL-BATCH replay, gated above.\r\n mark_blocked(true);\r\n let res = send.write(frame);\r\n mark_blocked(false);\r\n match res {\r\n Ok(_) => {}\r\n Err(e) => {\r\n note_controller_write_retired(sid, send.id(), &e);\r\n // Bounded writer-exit record (F-039 leg d).\r\n // [impl->REQ-CONN-POISON-ATTRIBUTION]\r\n send.lifecycle_event(\r\n \"writer-exit\",\r\n &format!(\"role=controller session={sid} reason=write-failed kind={:?}\", e.kind()),\r\n );\r\n return;\r\n }\r\n }\r\n if let Some(seq) = seq {\r\n // (a) CONTIGUOUS cursor (b4 / B2 gapless-resume — doyle's gate): with the\r\n // drop-on-full handoff in `append`, the controller's live channel can SKIP\r\n // a seq (dropped while Full). The frame still went to the socket (the live\r\n // operator sees it), but the durable resume cursor must NOT jump past the\r\n // gap — see [`contiguous_advance`].\r\n contiguous_advance(&delivered_through, seq);\r\n }\r\n if let Some(watermark) = watermark {\r\n // The transition sync frame: one successful write advances the cursor\r\n // past the WHOLE suppressed range (monotonic max, CAS — the same\r\n // advance the initial repaint batch uses). B2 gapless-resume holds IN\r\n // EFFECT: the repaint this frame carries supersedes every skipped seq,\r\n // and a resume below the presentation floor is served the repaint\r\n // shape, never a raw replay (REQ-RC-RESIZE-PRESENTATION-BARRIER).\r\n // [impl->REQ-RC-RESIZE-PRESENTATION-BARRIER]\r\n advance_delivered(&delivered_through, watermark);\r\n }\r\n }\r\n // tx dropped — a replace/detach ended the live loop. A REVOKED replacement\r\n // (distinct-lease Take) emits the terminal Displaced as the final frame\r\n // (ADR-0044); a silent same-lease/detach end stays silent (gate #7).\r\n // [impl->REQ-CONTROLLER-LEASE-IDENTITY]\r\n if emit_revoke_if_marked(&send) {\r\n return;\r\n }\r\n // Bounded writer-exit record (F-039 leg d).\r\n // [impl->REQ-CONN-POISON-ATTRIBUTION]\r\n send.lifecycle_event(\r\n \"writer-exit\",\r\n &format!(\"role=controller session={sid} reason=channel-closed\"),\r\n );\r\n}\r\n\r\n/// The per-session translation-binary attachment (W2 Layer C, ADR-0022). Present\r\n/// ONLY when the spawn carried a `translation_binary` path; absent → the session\r\n/// has no idle PTY delivery and inbound SPOOLS (ADR-0022 amendment — raw inject\r\n/// was removed as a delivery path; it did not submit on a modern TUI).\r\n///\r\n/// Holds the shared inject floor (the controller-input buffer, also touched by\r\n/// `dispatch_input`), the queue that feeds inbound ``s to the inject worker\r\n/// (events serialize — never two uncommitted sequences interleaved), the shared\r\n/// child handle (so `dispatch_input` can fire content-free `{type:input}` pings\r\n/// while the worker drives an event), and the FAULT flag the worker raises when a\r\n/// sequence misses its [`INJECT_COMMIT_DEADLINE`] or the binary dies — after which\r\n/// the session's idle inbound SPOOLS (never raw-injected) and pinging stops.\r\nstruct Translation {\r\n /// Controller-input buffer + inject-floor flag, shared with `dispatch_input`.\r\n floor: Arc>,\r\n /// Queue one inbound `` envelope to the inject worker. Events QUEUE here\r\n /// and are driven one-at-a-time so two sequences never interleave.\r\n event_tx: Sender,\r\n /// The live child — shared so `dispatch_input` fires content-free pings while\r\n /// the worker (which also holds an `Arc`) drives events / faults the binary.\r\n child: Arc,\r\n /// Raised by the worker on FAULT (commit-deadline miss / binary death): the\r\n /// session's idle inbound then SPOOLS (never raw-injected) and `dispatch_input`\r\n /// stops pinging.\r\n faulted: Arc,\r\n}\r\n\r\n/// A child the broker hosts under a PTY — the §B-owned resources for one\r\n/// session, plus its gapless-resume output log.\r\nstruct HostedSession {\r\n /// The PTY + child (PTY master/writer + spawned child process).\r\n session: Arc,\r\n /// The session's dedicated PTY input-writer (v0.13.0 P0,\r\n /// REQ-HAZARD-PTY-INPUT-WRITER-WEDGE): the SOLE caller of the blocking\r\n /// `write_input`. Every dispatch-side write ENQUEUES here and returns at once,\r\n /// so a paste burst that fills the harness's input buffer parks only the\r\n /// writer thread, never the broker dispatch thread.\r\n input: Arc,\r\n /// The output drain pump (kept so teardown can stop it).\r\n #[allow(dead_code)] // held for ownership/teardown; not read directly\r\n drain: Drain,\r\n /// The sequenced, buffered output + current subscriber.\r\n log: Arc>,\r\n /// The owning endpoint (the spawn's label; empty = unlabeled). The\r\n /// inbound dispatcher's gate subject for remote-drive (D9-1).\r\n endpoint: String,\r\n /// The translation-binary attachment (Layer C), or `None` for a session with\r\n /// no `[message-idle-translation-binary]` — then idle inbound delivery SPOOLS\r\n /// (no raw PTY inject; ADR-0022 amendment).\r\n translation: Option>,\r\n /// The resolved translation argv this session was spawned with (F029 C-1) —\r\n /// held so a bounded eager respawn after a REAL fault can rebuild the binary\r\n /// from the exact same command (`build_translation`) without re-reading the\r\n /// manifest (works for a test session with a direct argv AND a production\r\n /// session). `None` for a no-translation session. Updated on an adapter-apply\r\n /// restart to the swapped-in argv.\r\n translation_argv: Option>,\r\n /// The bounded-respawn give-up counter shared with the inject worker (F029 C-1,\r\n /// REQ-HAZARD-TRANSLATE-FAULT-PERMANENT-DEATH): the dispatch respawn path\r\n /// increments it per rebuild, the worker RESETS it to 0 on a healthy `{commit}`\r\n /// (so a recovered binary refreshes the whole budget). At `translate_respawn_\r\n /// budget()` the daemon gives up (loud) and leaves the binary dead → spool.\r\n translation_respawns: Arc,\r\n /// The adapter name owning this session (W3a, ADR-0025) — empty for a\r\n /// legacy/test/shell spawn. A live adapter update finds every live session\r\n /// whose `adapter` matches to cycle its resident children.\r\n adapter: String,\r\n /// The adapter's install dir for this session (W3a) — `None` if unknown. The\r\n /// apply target for a live update's CRC swap.\r\n install_dir: Option,\r\n /// When the session spawned (ADR-0041 decision 6) — the zombie verdict's\r\n /// boot-grace anchor: a just-spawned adapter harness has no client chain\r\n /// yet and must never read as a dead tree during bringup.\r\n // [impl->REQ-ENDPOINT-CYCLE-HONEST]\r\n spawned_at: Instant,\r\n /// OS birth stamp captured while the newly spawned child is still owned\r\n /// and BEFORE any waiter can reap it. Never refreshed from a remembered pid.\r\n // [impl->REQ-BROKER-ZOMBIE-IDENTITY]\r\n process_started_at: Option,\r\n}\r\n\r\n/// One record queued to a session's dedicated PTY input-writer thread — the raw\r\n/// bytes to write (v0.13.0 P0, REQ-HAZARD-PTY-INPUT-WRITER-WEDGE).\r\ntype InputRecord = Vec;\r\n\r\n/// The per-session PTY input FIFO depth (records). Sized for a generous paste —\r\n/// a wedged harness fills this and then DROPS, never blocking the dispatch\r\n/// thread. The int gate shrinks it via `SPT_INPUT_QUEUE_DEPTH` so the\r\n/// DROP+`INPUT_BACKPRESSURE` leg is forced in a handful of records rather than a\r\n/// few hundred KB of real paste.\r\nconst INPUT_QUEUE_DEPTH: usize = 4096;\r\n\r\n/// The effective input FIFO depth: production is [`INPUT_QUEUE_DEPTH`]; the int\r\n/// gate overrides it (`SPT_INPUT_QUEUE_DEPTH`) to a tiny value to force a\r\n/// deterministic queue saturation — the depth's PRESENCE (bounded, drop-on-full)\r\n/// is the invariant, not its exact value.\r\nfn input_queue_depth() -> usize {\r\n match std::env::var(\"SPT_INPUT_QUEUE_DEPTH\") {\r\n Ok(n) => n\r\n .parse::()\r\n .ok()\r\n .filter(|d| *d > 0)\r\n .unwrap_or(INPUT_QUEUE_DEPTH),\r\n Err(_) => INPUT_QUEUE_DEPTH,\r\n }\r\n}\r\n\r\n/// One session's dedicated PTY input-writer (v0.13.0 P0,\r\n/// REQ-HAZARD-PTY-INPUT-WRITER-WEDGE). The `writer` thread is the SOLE caller of\r\n/// the blocking [`SessionSurface::write_input`]; every other site enqueues a\r\n/// record via [`InputWriter::enqueue`] (a non-blocking `try_send`) and returns\r\n/// immediately. So a paste burst that fills the ConPTY/forkpty input buffer\r\n/// parks ONLY this thread — the broker dispatch thread, attach-opens, resizes,\r\n/// and every other session stay fully live (the W1b-deferred fix (2)). Mirrors\r\n/// the OUTPUT-side [`ViewerSink`]/[`ControllerSink`] writer-thread pattern.\r\nstruct InputWriter {\r\n /// The bounded input FIFO to the writer thread. `try_send` only — a full\r\n /// queue (a genuinely wedged harness) DROPS, it never blocks.\r\n tx: SyncSender,\r\n /// True while the FIFO is saturated and input is being dropped; cleared on\r\n /// the next accepted enqueue (heal-on-resume). Mirrored to the perch's\r\n /// `input_backpressure` so the operator sees the drop.\r\n backpressure: AtomicBool,\r\n /// The owning endpoint (the spawn's label; empty = unlabeled / raw test) —\r\n /// the perch whose `input_backpressure` this stamps. Empty ⇒ nowhere to record.\r\n endpoint: String,\r\n /// The writer thread handle (held for ownership; the thread drains until the\r\n /// last `tx` clone drops at session teardown, then exits).\r\n _writer: JoinHandle<()>,\r\n}\r\n\r\nimpl InputWriter {\r\n /// Spawn a session's input-writer thread. `session` is the `Arc`\r\n /// whose PTY write handle this thread now exclusively owns.\r\n fn spawn(session: Arc, endpoint: String) -> Arc {\r\n let (tx, rx) = sync_channel::(input_queue_depth());\r\n let writer = thread::spawn(move || input_writer(session, rx));\r\n Arc::new(InputWriter {\r\n…\n })\n }\n…\n}","startLine":3897,"lineNumbers":[3897,null,3914,null,3997,null,4002,null,4009,4010,4011,4012,4013,4014,4015,4016,4017,4018,4019,4020,4021,4022,4023,4024,4025,4026,4027,4028,4029,4030,4031,4032,4033,4034,4035,4036,4037,4038,4039,4040,4041,4042,4043,4044,4045,4046,4047,4048,4049,4050,4051,4052,4053,4054,4055,4056,4057,4058,4059,4060,4061,4062,4063,4064,4065,4066,4067,4068,4069,4070,4071,4072,4073,4074,4075,4076,4077,4078,4079,4080,4081,4082,4083,4084,4085,4086,4087,4088,4089,4090,4091,4092,4093,4094,4095,4096,4097,4098,4099,4100,4101,4102,4103,4104,4105,4106,4107,4108,4109,4110,4111,4112,4113,4114,4115,4116,4117,4118,4119,4120,4121,4122,4123,4124,4125,4126,4127,4128,4129,4130,4131,4132,4133,4134,4135,4136,4137,4138,4139,4140,4141,4142,4143,4144,4145,4146,4147,4148,4149,4150,4151,4152,4153,4154,4155,4156,4157,4158,4159,4160,4161,4162,4163,4164,4165,4166,4167,4168,4169,4170,4171,4172,4173,4174,4175,4176,4177,4178,4179,4180,4181,4182,4183,4184,4185,4186,4187,4188,4189,4190,4191,4192,4193,4194,4195,4196,4197,4198,4199,4200,4201,4202,4203,4204,4205,4206,4207,4208,null,4213,4214,null,4253]},"fileSize":850523,"meta":{"source":{"type":"path","value":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.worktrees\\285-zombie\\crates\\spt-daemon\\src\\broker.rs"},"truncation":{"direction":"head","truncatedBy":"lines","totalLines":16343,"totalBytes":11155,"outputLines":200,"outputBytes":11155,"shownRange":{"start":4009,"end":4208},"nextOffset":4209}}},"isError":false,"timestamp":1789001117070}}
{"type":"message","id":"136eaeb6","parentId":"4d75cf63","timestamp":"2026-09-10T00:45:17.074Z","message":{"role":"toolResult","toolCallId":"call_MnY9cRg0sID663p4pdW99ZKY|fc_02547c41fbf377fa016aa1fd9ce1fc87d2b184ef67d1c656de","toolName":"read","content":[{"type":"text","text":"///\n/// PER-PHASE AND DELIBERATELY GENEROUS. `pty_creating` is the measured-slow\n/// phase — the #235 double-create came from a winner whose ConPTY create ran\n/// past the old 2s global wait — so its ceiling errs large: the cost of waiting\n/// on a slow-but-live holder is latency, while the cost of taking over from one\n/// is the duplicate session this guard exists to prevent. The ceiling is a WEDGE\n/// detector, never a performance budget.\nfn phase_wedge_ceiling(phase: &str) -> Duration {\n // TEST-ONLY SEAM, and it does not exist in a shipped binary: the int rig needs the\n // wedge arm to fire in milliseconds rather than after a real ceiling, but a stray\n // value in a deployment would be WORSE than a slow spawn — a ceiling of 0 makes\n // every claim read stalled, so every duplicate wake takes over and the double-create\n // this function exists to prevent comes back at scale. Compiled out of release\n // entirely, parsed once, and floored so that even in a debug build it cannot be\n // driven below a value the gate could mistake for a wedge on a healthy holder.\n #[cfg(debug_assertions)]\n {\n static OVERRIDE: std::sync::OnceLock> = std::sync::OnceLock::new();\n if let Some(d) = OVERRIDE.get_or_init(|| {\n let raw = std::env::var(\"SPT_WAKE_WEDGE_CEILING_MS\")\n .ok()\n .and_then(|v| v.parse::().ok())?;\n let clamped = raw.clamp(50, 600_000);\n eprintln!(\n \"SPAWN_WEDGE_CEILING_OVERRIDE: test seam active — every phase ceiling is \\\n {clamped}ms (asked {raw}ms). Debug builds only; never a shipped path.\"\n );\n Some(Duration::from_millis(clamped))\n }) {\n return *d;\n }\n }\n match phase {\n \"pty_creating\" => Duration::from_secs(120),\n _ => Duration::from_secs(30),\n }\n}\n\n/// The pure single-flight wake decision (W4, REQ-SPAWN-COLLISION-GUARD-LIVE-DUP), over\n/// the three observable inputs read together under the broker lock. `AlreadyLive` wins\n/// outright — the endpoint already has a live session, so a duplicate wake dedups to it\n/// (no spawn). Else a claim whose holder is still MAKING PROGRESS is `Racing` (stand\n/// down + retry, waiting for the racer's session to register), for as long as that\n/// holder keeps progressing. A claim STALLED past its phase's wedge ceiling, and a free\n/// endpoint, are `Claim`. Pure so the truth table is a unit.\n///\n/// THERE IS NO CLOCK ON A LIVE HOLDER, and that is the #235 fix (releases#235). The old\n/// arm took a claim over once a global 2s wait expired, on the premise that an overrun\n/// spawn was presumed dead — MEASURED FALSE under battery load, where the winner's\n/// ConPTY create simply runs past 2s and the loser then double-creates. Extending that\n/// clock only moves the window; a wait bound is a liveness PROXY, and the holder's own\n/// phase stamps are the liveness itself. So a slow spawn is now never taken over, however\n/// long it takes, and only a holder that has stopped progressing is.\n///\n/// THE AVAILABILITY ARM SURVIVES IN ITS HONEST FORM: a wedged holder (no drop, since RAII\n/// cannot fire on a thread stuck inside a phase) is still taken over, so an endpoint\n/// cannot be stranded permanently unspawnable. A taken-over holder that later completes\n/// lands in the `AlreadyLive` dup surface exactly as before — the same tradeoff the\n/// original arm made, now reached on evidence of a stall instead of on elapsed time.\n#[derive(Debug, PartialEq, Eq)]\nenum WakeGate {\n AlreadyLive,\n Racing,\n Claim,\n}\n\n// [impl->REQ-SPAWN-COLLISION-GUARD-LIVE-DUP]\nfn wake_gate_decision(live: bool, claimed: bool, holder_stalled: bool) -> WakeGate {\n if live {\n WakeGate::AlreadyLive\n } else if claimed && !holder_stalled {\n WakeGate::Racing\n } else {\n WakeGate::Claim\n }\n}\n\n/// Boot grace before an adapter session with no live client chain can read as a\n/// zombie (ADR-0041 decision 6): a just-spawned harness wrapper has not forked\n/// its clients yet. Env-tunable so the int rig is deterministic.\nfn spawn_client_grace() -> Duration {\n std::env::var(\"SPT_SPAWN_CLIENT_GRACE_MS\")\n .ok()\n .and_then(|v| v.parse::().ok())\n .map(Duration::from_millis)\n .unwrap_or(Duration::from_secs(30))\n}\n\n/// The ONE cycle-verb liveness verdict (ADR-0041 decision 6,\n/// REQ-ENDPOINT-CYCLE-HONEST), pure over its observables so the table is a\n/// unit test. A claimed session is a ZOMBIE — refusing a run/create by citing\n/// it would be a lie — exactly when:\n/// - its PTY child (the client-tree root) probes DEAD while the table record\n/// survives (a wedged/missed exit-wait), OR\n/// - it is an ADAPTER-labeled session (its `[session.self]` launch command\n/// forks a harness client chain under the wrapper by construction), PAST\n/// the boot grace, whose wrapper has NO live descendants — the deployah\n/// wedge shape: the launcher shell idles on while the harness underneath\n/// it died, so `run` said ALREADY_LIVE, `list` said OFFLINE, and\n/// `shutdown` said NO_EDGE about the same corpse.\n///\n/// A DIRECT/ad-hoc spawn (empty adapter — tests, shells, legacy) is its own\n/// client: wrapper-alive means live, descendants never consulted. An unknown\n/// pid (`None`) is never guessed at — not a zombie.\n// [impl->REQ-ENDPOINT-CYCLE-HONEST]\nfn zombie_verdict(\n wrapper_alive: Option,\n adapter_labeled: bool,\n has_live_descendants: bool,\n past_grace: bool,\n) -> bool {\n match wrapper_alive {\n None => false, // no probeable pid — never guess\n Some(false) => true, // dead root, surviving record — always a zombie\n Some(true) => adapter_labeled && past_grace && !has_live_descendants,\n }\n}\n\n/// Kill only the root whose birth was captured before its exit waiter started.\n/// A dead root permits record cleanup WITHOUT signaling its remembered number.\n/// An error forbids both kill and forced de-tabling: dropping session resources\n/// is teardown too, not a safe fallback for an identity we could not establish.\n// [impl->REQ-BROKER-ZOMBIE-IDENTITY]\nfn reap_zombie_root(\n pid: Option,\n born: Option,\n observe: impl FnOnce(u32) -> spt_store::proc::ProcIdentity,\n kill_tree: impl FnOnce(u32),\n) -> Result<(), &'static str> {\n use spt_store::proc::ProcIdentity;\n let pid = pid.filter(|p| *p != 0).ok_or(\"pid-unknown\")?;\n match observe(pid) {\n ProcIdentity::Absent => Ok(()),\n ProcIdentity::Present(now) => match born {\n Some(expected) if expected == now => {\n kill_tree(pid);\n Ok(())\n }\n Some(_) => Err(\"identity-mismatch\"),\n None => Err(\"identity-unproven\"),\n },\n ProcIdentity::Unproven => Err(\"identity-unproven\"),\n }\n}\n\n/// The impure probe feeding [`zombie_verdict`] for a claimed live session —\n/// runs OFF every broker lock (a process-table walk is real work; KH 7.12).\n/// `spawned_ms_ago` comes from the session's `spawned_at`; callers on the\n/// KIND_SESSIONS reply use the additive `SessionInfo` fields, so the CLI\n/// preflight and the broker gate consult the SAME authority.\n/// PURE resolution of the two liveness probes for [`session_is_zombie`], so the\n/// NO-SNAPSHOT arm is unit-testable WITHOUT a platform that lacks a process\n/// table (the W1 `unconfirmed_verdict` injection shape).\n///\n/// The table WINS wherever it speaks — that is the Windows fix, since a\n/// retained handle lies about a corpse. Where it has nothing to say, the\n/// handle probe is sound: no-table implies unix implies no handle blind spot,\n/// so the two conditions cannot both fail and the fallback is EXACT.\n// [impl->REQ-LIVENESS-ORACLE-SOUND]\nfn resolve_wrapper_alive(table_says: Option, handle_says: impl FnOnce() -> bool) -> bool {\n table_says.unwrap_or_else(handle_says)\n}\n\n// [impl->REQ-ENDPOINT-CYCLE-HONEST]\npub fn session_is_zombie(pid: Option, adapter_labeled: bool, spawned_ms_ago: u64) -> bool {\n // THE ORACLE, not a handle-probe (KNOWN-HAZARDS 7.50). `is_process_alive`\n // asks `OpenProcess`, which keeps succeeding for a TERMINATED pid while a\n // handle to it stays open — and this broker holds `Arc`, hence\n // that handle, for exactly the sessions it is asked about. A reaped root\n // therefore read `Some(true)` here and fell off `zombie_verdict`'s PRIMARY\n // \"dead root, surviving record\" arm onto the conditional one, so a dead\n // root that is NOT adapter-labeled was claimed LIVE indefinitely.\n // NO-SNAPSHOT FALLS BACK, and the fallback is EXACT rather than a\n // compromise: the handle blind spot is Windows-only (`kill(pid,0)` answers\n // about the process, not about a handle the caller holds, and Linux demotes\n // a /proc zombie), while Windows ALWAYS has a process table. So \"no table\"\n // implies unix implies no handle problem — the two conditions cannot both\n // fail. Routing to `None` here instead would have DISABLED zombie detection\n // on non-Linux unix, trading a Windows-unsound oracle for an inoperative\n // one: the same bad trade refused at livehost.rs's self-heal probe.\n // `None` therefore survives only for an UNKNOWN PID, which is the case\n // `zombie_verdict` already answers with \"never guess\".\n let wrapper_alive = pid.map(|p| {\n resolve_wrapper_alive(spt_store::proc::process_exists(p), || {\n spt_store::proc::is_process_alive(p)\n })\n });\n let has_live_descendants = pid.is_some_and(|p| {\n spt_store::proc::process_descendants(p)\n .iter()\n .any(|d| spt_store::proc::is_process_alive(*d))\n });\n let past_grace = Duration::from_millis(spawned_ms_ago) >= spawn_client_grace();\n zombie_verdict(wrapper_alive, adapter_labeled, has_live_descendants, past_grace)\n}\n\n/// The RC-origin input-fence verdict (ADR-0044 decision 3,\n/// REQ-INPUT-CONTROLLER-FENCE) — PURE over the request's minter tag and the\n/// sender-conn's controller fact, so the scope table is unit-tested: ONLY an\n/// `Minter::Rc`-tagged input from a NON-controller conn is rejected. Shell\n/// injection (`Minter::Shell`), legacy/untagged senders (`None`/`Legacy` — the\n/// N-1 wire), and every other minter pass exactly as before; the connection\n/// identity is the lease surrogate (ADR-0044 decision 4), which holds for\n/// mixed-version attaches too — every rc keystroke reaches the broker through\n/// its own serve worker's conn, and `become_controller` moves the slot to the\n\n[Showing lines 309-513 of 16343. Use :514 to continue]"}],"details":{"truncation":{"content":"///\r\n/// PER-PHASE AND DELIBERATELY GENEROUS. `pty_creating` is the measured-slow\r\n/// phase — the #235 double-create came from a winner whose ConPTY create ran\r\n/// past the old 2s global wait — so its ceiling errs large: the cost of waiting\r\n/// on a slow-but-live holder is latency, while the cost of taking over from one\r\n/// is the duplicate session this guard exists to prevent. The ceiling is a WEDGE\r\n/// detector, never a performance budget.\r\nfn phase_wedge_ceiling(phase: &str) -> Duration {\r\n // TEST-ONLY SEAM, and it does not exist in a shipped binary: the int rig needs the\r\n // wedge arm to fire in milliseconds rather than after a real ceiling, but a stray\r\n // value in a deployment would be WORSE than a slow spawn — a ceiling of 0 makes\r\n // every claim read stalled, so every duplicate wake takes over and the double-create\r\n // this function exists to prevent comes back at scale. Compiled out of release\r\n // entirely, parsed once, and floored so that even in a debug build it cannot be\r\n // driven below a value the gate could mistake for a wedge on a healthy holder.\r\n #[cfg(debug_assertions)]\r\n {\r\n static OVERRIDE: std::sync::OnceLock> = std::sync::OnceLock::new();\r\n if let Some(d) = OVERRIDE.get_or_init(|| {\r\n let raw = std::env::var(\"SPT_WAKE_WEDGE_CEILING_MS\")\r\n .ok()\r\n .and_then(|v| v.parse::().ok())?;\r\n let clamped = raw.clamp(50, 600_000);\r\n eprintln!(\r\n \"SPAWN_WEDGE_CEILING_OVERRIDE: test seam active — every phase ceiling is \\\r\n {clamped}ms (asked {raw}ms). Debug builds only; never a shipped path.\"\r\n );\r\n Some(Duration::from_millis(clamped))\r\n }) {\r\n return *d;\r\n }\r\n }\r\n match phase {\r\n \"pty_creating\" => Duration::from_secs(120),\r\n _ => Duration::from_secs(30),\r\n }\r\n}\r\n\r\n/// The pure single-flight wake decision (W4, REQ-SPAWN-COLLISION-GUARD-LIVE-DUP), over\r\n/// the three observable inputs read together under the broker lock. `AlreadyLive` wins\r\n/// outright — the endpoint already has a live session, so a duplicate wake dedups to it\r\n/// (no spawn). Else a claim whose holder is still MAKING PROGRESS is `Racing` (stand\r\n/// down + retry, waiting for the racer's session to register), for as long as that\r\n/// holder keeps progressing. A claim STALLED past its phase's wedge ceiling, and a free\r\n/// endpoint, are `Claim`. Pure so the truth table is a unit.\r\n///\r\n/// THERE IS NO CLOCK ON A LIVE HOLDER, and that is the #235 fix (releases#235). The old\r\n/// arm took a claim over once a global 2s wait expired, on the premise that an overrun\r\n/// spawn was presumed dead — MEASURED FALSE under battery load, where the winner's\r\n/// ConPTY create simply runs past 2s and the loser then double-creates. Extending that\r\n/// clock only moves the window; a wait bound is a liveness PROXY, and the holder's own\r\n/// phase stamps are the liveness itself. So a slow spawn is now never taken over, however\r\n/// long it takes, and only a holder that has stopped progressing is.\r\n///\r\n/// THE AVAILABILITY ARM SURVIVES IN ITS HONEST FORM: a wedged holder (no drop, since RAII\r\n/// cannot fire on a thread stuck inside a phase) is still taken over, so an endpoint\r\n/// cannot be stranded permanently unspawnable. A taken-over holder that later completes\r\n/// lands in the `AlreadyLive` dup surface exactly as before — the same tradeoff the\r\n/// original arm made, now reached on evidence of a stall instead of on elapsed time.\r\n#[derive(Debug, PartialEq, Eq)]\r\nenum WakeGate {\r\n AlreadyLive,\r\n Racing,\r\n Claim,\r\n}\r\n\r\n// [impl->REQ-SPAWN-COLLISION-GUARD-LIVE-DUP]\r\nfn wake_gate_decision(live: bool, claimed: bool, holder_stalled: bool) -> WakeGate {\r\n if live {\r\n WakeGate::AlreadyLive\r\n } else if claimed && !holder_stalled {\r\n WakeGate::Racing\r\n } else {\r\n WakeGate::Claim\r\n }\r\n}\r\n\r\n/// Boot grace before an adapter session with no live client chain can read as a\r\n/// zombie (ADR-0041 decision 6): a just-spawned harness wrapper has not forked\r\n/// its clients yet. Env-tunable so the int rig is deterministic.\r\nfn spawn_client_grace() -> Duration {\r\n std::env::var(\"SPT_SPAWN_CLIENT_GRACE_MS\")\r\n .ok()\r\n .and_then(|v| v.parse::().ok())\r\n .map(Duration::from_millis)\r\n .unwrap_or(Duration::from_secs(30))\r\n}\r\n\r\n/// The ONE cycle-verb liveness verdict (ADR-0041 decision 6,\r\n/// REQ-ENDPOINT-CYCLE-HONEST), pure over its observables so the table is a\r\n/// unit test. A claimed session is a ZOMBIE — refusing a run/create by citing\r\n/// it would be a lie — exactly when:\r\n/// - its PTY child (the client-tree root) probes DEAD while the table record\r\n/// survives (a wedged/missed exit-wait), OR\r\n/// - it is an ADAPTER-labeled session (its `[session.self]` launch command\r\n/// forks a harness client chain under the wrapper by construction), PAST\r\n/// the boot grace, whose wrapper has NO live descendants — the deployah\r\n/// wedge shape: the launcher shell idles on while the harness underneath\r\n/// it died, so `run` said ALREADY_LIVE, `list` said OFFLINE, and\r\n/// `shutdown` said NO_EDGE about the same corpse.\r\n///\r\n/// A DIRECT/ad-hoc spawn (empty adapter — tests, shells, legacy) is its own\r\n/// client: wrapper-alive means live, descendants never consulted. An unknown\r\n/// pid (`None`) is never guessed at — not a zombie.\r\n// [impl->REQ-ENDPOINT-CYCLE-HONEST]\r\nfn zombie_verdict(\r\n wrapper_alive: Option,\r\n adapter_labeled: bool,\r\n has_live_descendants: bool,\r\n past_grace: bool,\r\n) -> bool {\r\n match wrapper_alive {\r\n None => false, // no probeable pid — never guess\r\n Some(false) => true, // dead root, surviving record — always a zombie\r\n Some(true) => adapter_labeled && past_grace && !has_live_descendants,\r\n }\r\n}\r\n\r\n/// Kill only the root whose birth was captured before its exit waiter started.\r\n/// A dead root permits record cleanup WITHOUT signaling its remembered number.\r\n/// An error forbids both kill and forced de-tabling: dropping session resources\r\n/// is teardown too, not a safe fallback for an identity we could not establish.\r\n// [impl->REQ-BROKER-ZOMBIE-IDENTITY]\r\nfn reap_zombie_root(\r\n pid: Option,\r\n born: Option,\r\n observe: impl FnOnce(u32) -> spt_store::proc::ProcIdentity,\r\n kill_tree: impl FnOnce(u32),\r\n) -> Result<(), &'static str> {\r\n use spt_store::proc::ProcIdentity;\r\n let pid = pid.filter(|p| *p != 0).ok_or(\"pid-unknown\")?;\r\n match observe(pid) {\r\n ProcIdentity::Absent => Ok(()),\r\n ProcIdentity::Present(now) => match born {\r\n Some(expected) if expected == now => {\r\n kill_tree(pid);\r\n Ok(())\r\n }\r\n Some(_) => Err(\"identity-mismatch\"),\r\n None => Err(\"identity-unproven\"),\r\n },\r\n ProcIdentity::Unproven => Err(\"identity-unproven\"),\r\n }\r\n}\r\n\r\n/// The impure probe feeding [`zombie_verdict`] for a claimed live session —\r\n/// runs OFF every broker lock (a process-table walk is real work; KH 7.12).\r\n/// `spawned_ms_ago` comes from the session's `spawned_at`; callers on the\r\n/// KIND_SESSIONS reply use the additive `SessionInfo` fields, so the CLI\r\n/// preflight and the broker gate consult the SAME authority.\r\n/// PURE resolution of the two liveness probes for [`session_is_zombie`], so the\r\n/// NO-SNAPSHOT arm is unit-testable WITHOUT a platform that lacks a process\r\n/// table (the W1 `unconfirmed_verdict` injection shape).\r\n///\r\n/// The table WINS wherever it speaks — that is the Windows fix, since a\r\n/// retained handle lies about a corpse. Where it has nothing to say, the\r\n/// handle probe is sound: no-table implies unix implies no handle blind spot,\r\n/// so the two conditions cannot both fail and the fallback is EXACT.\r\n// [impl->REQ-LIVENESS-ORACLE-SOUND]\r\nfn resolve_wrapper_alive(table_says: Option, handle_says: impl FnOnce() -> bool) -> bool {\r\n table_says.unwrap_or_else(handle_says)\r\n}\r\n\r\n// [impl->REQ-ENDPOINT-CYCLE-HONEST]\r\npub fn session_is_zombie(pid: Option, adapter_labeled: bool, spawned_ms_ago: u64) -> bool {\r\n // THE ORACLE, not a handle-probe (KNOWN-HAZARDS 7.50). `is_process_alive`\r\n // asks `OpenProcess`, which keeps succeeding for a TERMINATED pid while a\r\n // handle to it stays open — and this broker holds `Arc`, hence\r\n // that handle, for exactly the sessions it is asked about. A reaped root\r\n // therefore read `Some(true)` here and fell off `zombie_verdict`'s PRIMARY\r\n // \"dead root, surviving record\" arm onto the conditional one, so a dead\r\n // root that is NOT adapter-labeled was claimed LIVE indefinitely.\r\n // NO-SNAPSHOT FALLS BACK, and the fallback is EXACT rather than a\r\n // compromise: the handle blind spot is Windows-only (`kill(pid,0)` answers\r\n // about the process, not about a handle the caller holds, and Linux demotes\r\n // a /proc zombie), while Windows ALWAYS has a process table. So \"no table\"\r\n // implies unix implies no handle problem — the two conditions cannot both\r\n // fail. Routing to `None` here instead would have DISABLED zombie detection\r\n // on non-Linux unix, trading a Windows-unsound oracle for an inoperative\r\n // one: the same bad trade refused at livehost.rs's self-heal probe.\r\n // `None` therefore survives only for an UNKNOWN PID, which is the case\r\n // `zombie_verdict` already answers with \"never guess\".\r\n let wrapper_alive = pid.map(|p| {\r\n resolve_wrapper_alive(spt_store::proc::process_exists(p), || {\r\n spt_store::proc::is_process_alive(p)\r\n })\r\n });\r\n let has_live_descendants = pid.is_some_and(|p| {\r\n spt_store::proc::process_descendants(p)\r\n .iter()\r\n .any(|d| spt_store::proc::is_process_alive(*d))\r\n });\r\n let past_grace = Duration::from_millis(spawned_ms_ago) >= spawn_client_grace();\r\n zombie_verdict(wrapper_alive, adapter_labeled, has_live_descendants, past_grace)\r\n}\r\n\r\n/// The RC-origin input-fence verdict (ADR-0044 decision 3,\r\n/// REQ-INPUT-CONTROLLER-FENCE) — PURE over the request's minter tag and the\r\n/// sender-conn's controller fact, so the scope table is unit-tested: ONLY an\r\n/// `Minter::Rc`-tagged input from a NON-controller conn is rejected. Shell\r\n/// injection (`Minter::Shell`), legacy/untagged senders (`None`/`Legacy` — the\r\n/// N-1 wire), and every other minter pass exactly as before; the connection\r\n/// identity is the lease surrogate (ADR-0044 decision 4), which holds for\r\n/// mixed-version attaches too — every rc keystroke reaches the broker through\r\n/// its own serve worker's conn, and `become_controller` moves the slot to the\r","truncated":true,"truncatedBy":"lines","totalLines":16035,"totalBytes":10866,"outputLines":205,"outputBytes":10866,"lastLinePartial":false,"firstLineExceedsLimit":false},"totalLines":16343,"displayContent":{"text":"///\r\n/// PER-PHASE AND DELIBERATELY GENEROUS. `pty_creating` is the measured-slow\r\n/// phase — the #235 double-create came from a winner whose ConPTY create ran\r\n/// past the old 2s global wait — so its ceiling errs large: the cost of waiting\r\n/// on a slow-but-live holder is latency, while the cost of taking over from one\r\n/// is the duplicate session this guard exists to prevent. The ceiling is a WEDGE\r\n/// detector, never a performance budget.\r\nfn phase_wedge_ceiling(phase: &str) -> Duration {\r\n // TEST-ONLY SEAM, and it does not exist in a shipped binary: the int rig needs the\r\n // wedge arm to fire in milliseconds rather than after a real ceiling, but a stray\r\n // value in a deployment would be WORSE than a slow spawn — a ceiling of 0 makes\r\n // every claim read stalled, so every duplicate wake takes over and the double-create\r\n // this function exists to prevent comes back at scale. Compiled out of release\r\n // entirely, parsed once, and floored so that even in a debug build it cannot be\r\n // driven below a value the gate could mistake for a wedge on a healthy holder.\r\n #[cfg(debug_assertions)]\r\n {\r\n static OVERRIDE: std::sync::OnceLock> = std::sync::OnceLock::new();\r\n if let Some(d) = OVERRIDE.get_or_init(|| {\r\n let raw = std::env::var(\"SPT_WAKE_WEDGE_CEILING_MS\")\r\n .ok()\r\n .and_then(|v| v.parse::().ok())?;\r\n let clamped = raw.clamp(50, 600_000);\r\n eprintln!(\r\n \"SPAWN_WEDGE_CEILING_OVERRIDE: test seam active — every phase ceiling is \\\r\n {clamped}ms (asked {raw}ms). Debug builds only; never a shipped path.\"\r\n );\r\n Some(Duration::from_millis(clamped))\r\n }) {\r\n return *d;\r\n }\r\n }\r\n match phase {\r\n \"pty_creating\" => Duration::from_secs(120),\r\n _ => Duration::from_secs(30),\r\n }\r\n}\r\n\r\n/// The pure single-flight wake decision (W4, REQ-SPAWN-COLLISION-GUARD-LIVE-DUP), over\r\n/// the three observable inputs read together under the broker lock. `AlreadyLive` wins\r\n/// outright — the endpoint already has a live session, so a duplicate wake dedups to it\r\n/// (no spawn). Else a claim whose holder is still MAKING PROGRESS is `Racing` (stand\r\n/// down + retry, waiting for the racer's session to register), for as long as that\r\n/// holder keeps progressing. A claim STALLED past its phase's wedge ceiling, and a free\r\n/// endpoint, are `Claim`. Pure so the truth table is a unit.\r\n///\r\n/// THERE IS NO CLOCK ON A LIVE HOLDER, and that is the #235 fix (releases#235). The old\r\n/// arm took a claim over once a global 2s wait expired, on the premise that an overrun\r\n/// spawn was presumed dead — MEASURED FALSE under battery load, where the winner's\r\n/// ConPTY create simply runs past 2s and the loser then double-creates. Extending that\r\n/// clock only moves the window; a wait bound is a liveness PROXY, and the holder's own\r\n/// phase stamps are the liveness itself. So a slow spawn is now never taken over, however\r\n/// long it takes, and only a holder that has stopped progressing is.\r\n///\r\n/// THE AVAILABILITY ARM SURVIVES IN ITS HONEST FORM: a wedged holder (no drop, since RAII\r\n/// cannot fire on a thread stuck inside a phase) is still taken over, so an endpoint\r\n/// cannot be stranded permanently unspawnable. A taken-over holder that later completes\r\n/// lands in the `AlreadyLive` dup surface exactly as before — the same tradeoff the\r\n/// original arm made, now reached on evidence of a stall instead of on elapsed time.\r\n#[derive(Debug, PartialEq, Eq)]\r\nenum WakeGate {\r\n AlreadyLive,\r\n Racing,\r\n Claim,\r\n}\r\n\r\n// [impl->REQ-SPAWN-COLLISION-GUARD-LIVE-DUP]\r\nfn wake_gate_decision(live: bool, claimed: bool, holder_stalled: bool) -> WakeGate {\r\n if live {\r\n WakeGate::AlreadyLive\r\n } else if claimed && !holder_stalled {\r\n WakeGate::Racing\r\n } else {\r\n WakeGate::Claim\r\n }\r\n}\r\n\r\n/// Boot grace before an adapter session with no live client chain can read as a\r\n/// zombie (ADR-0041 decision 6): a just-spawned harness wrapper has not forked\r\n/// its clients yet. Env-tunable so the int rig is deterministic.\r\nfn spawn_client_grace() -> Duration {\r\n std::env::var(\"SPT_SPAWN_CLIENT_GRACE_MS\")\r\n .ok()\r\n .and_then(|v| v.parse::().ok())\r\n .map(Duration::from_millis)\r\n .unwrap_or(Duration::from_secs(30))\r\n}\r\n\r\n/// The ONE cycle-verb liveness verdict (ADR-0041 decision 6,\r\n/// REQ-ENDPOINT-CYCLE-HONEST), pure over its observables so the table is a\r\n/// unit test. A claimed session is a ZOMBIE — refusing a run/create by citing\r\n/// it would be a lie — exactly when:\r\n/// - its PTY child (the client-tree root) probes DEAD while the table record\r\n/// survives (a wedged/missed exit-wait), OR\r\n/// - it is an ADAPTER-labeled session (its `[session.self]` launch command\r\n/// forks a harness client chain under the wrapper by construction), PAST\r\n/// the boot grace, whose wrapper has NO live descendants — the deployah\r\n/// wedge shape: the launcher shell idles on while the harness underneath\r\n/// it died, so `run` said ALREADY_LIVE, `list` said OFFLINE, and\r\n/// `shutdown` said NO_EDGE about the same corpse.\r\n///\r\n/// A DIRECT/ad-hoc spawn (empty adapter — tests, shells, legacy) is its own\r\n/// client: wrapper-alive means live, descendants never consulted. An unknown\r\n/// pid (`None`) is never guessed at — not a zombie.\r\n// [impl->REQ-ENDPOINT-CYCLE-HONEST]\r\nfn zombie_verdict(\r\n wrapper_alive: Option,\r\n adapter_labeled: bool,\r\n has_live_descendants: bool,\r\n past_grace: bool,\r\n) -> bool {\r\n match wrapper_alive {\r\n None => false, // no probeable pid — never guess\r\n Some(false) => true, // dead root, surviving record — always a zombie\r\n Some(true) => adapter_labeled && past_grace && !has_live_descendants,\r\n }\r\n}\r\n\r\n/// Kill only the root whose birth was captured before its exit waiter started.\r\n/// A dead root permits record cleanup WITHOUT signaling its remembered number.\r\n/// An error forbids both kill and forced de-tabling: dropping session resources\r\n/// is teardown too, not a safe fallback for an identity we could not establish.\r\n// [impl->REQ-BROKER-ZOMBIE-IDENTITY]\r\nfn reap_zombie_root(\r\n pid: Option,\r\n born: Option,\r\n observe: impl FnOnce(u32) -> spt_store::proc::ProcIdentity,\r\n kill_tree: impl FnOnce(u32),\r\n) -> Result<(), &'static str> {\r\n use spt_store::proc::ProcIdentity;\r\n let pid = pid.filter(|p| *p != 0).ok_or(\"pid-unknown\")?;\r\n match observe(pid) {\r\n ProcIdentity::Absent => Ok(()),\r\n ProcIdentity::Present(now) => match born {\r\n Some(expected) if expected == now => {\r\n kill_tree(pid);\r\n Ok(())\r\n }\r\n Some(_) => Err(\"identity-mismatch\"),\r\n None => Err(\"identity-unproven\"),\r\n },\r\n ProcIdentity::Unproven => Err(\"identity-unproven\"),\r\n }\r\n}\r\n\r\n/// The impure probe feeding [`zombie_verdict`] for a claimed live session —\r\n/// runs OFF every broker lock (a process-table walk is real work; KH 7.12).\r\n/// `spawned_ms_ago` comes from the session's `spawned_at`; callers on the\r\n/// KIND_SESSIONS reply use the additive `SessionInfo` fields, so the CLI\r\n/// preflight and the broker gate consult the SAME authority.\r\n/// PURE resolution of the two liveness probes for [`session_is_zombie`], so the\r\n/// NO-SNAPSHOT arm is unit-testable WITHOUT a platform that lacks a process\r\n/// table (the W1 `unconfirmed_verdict` injection shape).\r\n///\r\n/// The table WINS wherever it speaks — that is the Windows fix, since a\r\n/// retained handle lies about a corpse. Where it has nothing to say, the\r\n/// handle probe is sound: no-table implies unix implies no handle blind spot,\r\n/// so the two conditions cannot both fail and the fallback is EXACT.\r\n// [impl->REQ-LIVENESS-ORACLE-SOUND]\r\nfn resolve_wrapper_alive(table_says: Option, handle_says: impl FnOnce() -> bool) -> bool {\r\n table_says.unwrap_or_else(handle_says)\r\n}\r\n\r\n// [impl->REQ-ENDPOINT-CYCLE-HONEST]\r\npub fn session_is_zombie(pid: Option, adapter_labeled: bool, spawned_ms_ago: u64) -> bool {\r\n // THE ORACLE, not a handle-probe (KNOWN-HAZARDS 7.50). `is_process_alive`\r\n // asks `OpenProcess`, which keeps succeeding for a TERMINATED pid while a\r\n // handle to it stays open — and this broker holds `Arc`, hence\r\n // that handle, for exactly the sessions it is asked about. A reaped root\r\n // therefore read `Some(true)` here and fell off `zombie_verdict`'s PRIMARY\r\n // \"dead root, surviving record\" arm onto the conditional one, so a dead\r\n // root that is NOT adapter-labeled was claimed LIVE indefinitely.\r\n // NO-SNAPSHOT FALLS BACK, and the fallback is EXACT rather than a\r\n // compromise: the handle blind spot is Windows-only (`kill(pid,0)` answers\r\n // about the process, not about a handle the caller holds, and Linux demotes\r\n // a /proc zombie), while Windows ALWAYS has a process table. So \"no table\"\r\n // implies unix implies no handle problem — the two conditions cannot both\r\n // fail. Routing to `None` here instead would have DISABLED zombie detection\r\n // on non-Linux unix, trading a Windows-unsound oracle for an inoperative\r\n // one: the same bad trade refused at livehost.rs's self-heal probe.\r\n // `None` therefore survives only for an UNKNOWN PID, which is the case\r\n // `zombie_verdict` already answers with \"never guess\".\r\n let wrapper_alive = pid.map(|p| {\r\n resolve_wrapper_alive(spt_store::proc::process_exists(p), || {\r\n spt_store::proc::is_process_alive(p)\r\n })\r\n });\r\n let has_live_descendants = pid.is_some_and(|p| {\r\n spt_store::proc::process_descendants(p)\r\n .iter()\r\n .any(|d| spt_store::proc::is_process_alive(*d))\r\n });\r\n let past_grace = Duration::from_millis(spawned_ms_ago) >= spawn_client_grace();\r\n zombie_verdict(wrapper_alive, adapter_labeled, has_live_descendants, past_grace)\r\n}\r\n\r\n/// The RC-origin input-fence verdict (ADR-0044 decision 3,\r\n/// REQ-INPUT-CONTROLLER-FENCE) — PURE over the request's minter tag and the\r\n/// sender-conn's controller fact, so the scope table is unit-tested: ONLY an\r\n/// `Minter::Rc`-tagged input from a NON-controller conn is rejected. Shell\r\n/// injection (`Minter::Shell`), legacy/untagged senders (`None`/`Legacy` — the\r\n/// N-1 wire), and every other minter pass exactly as before; the connection\r\n/// identity is the lease surrogate (ADR-0044 decision 4), which holds for\r\n/// mixed-version attaches too — every rc keystroke reaches the broker through\r\n/// its own serve worker's conn, and `become_controller` moves the slot to the\r","startLine":309,"lineNumbers":[309,310,311,312,313,314,315,316,317,318,319,320,321,322,323,324,325,326,327,328,329,330,331,332,333,334,335,336,337,338,339,340,341,342,343,344,345,346,347,348,349,350,351,352,353,354,355,356,357,358,359,360,361,362,363,364,365,366,367,368,369,370,371,372,373,374,375,376,377,378,379,380,381,382,383,384,385,386,387,388,389,390,391,392,393,394,395,396,397,398,399,400,401,402,403,404,405,406,407,408,409,410,411,412,413,414,415,416,417,418,419,420,421,422,423,424,425,426,427,428,429,430,431,432,433,434,435,436,437,438,439,440,441,442,443,444,445,446,447,448,449,450,451,452,453,454,455,456,457,458,459,460,461,462,463,464,465,466,467,468,469,470,471,472,473,474,475,476,477,478,479,480,481,482,483,484,485,486,487,488,489,490,491,492,493,494,495,496,497,498,499,500,501,502,503,504,505,506,507,508,509,510,511,512,513]},"fileSize":850523,"meta":{"source":{"type":"path","value":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.worktrees\\285-zombie\\crates\\spt-daemon\\src\\broker.rs"},"truncation":{"direction":"head","truncatedBy":"lines","totalLines":16343,"totalBytes":10866,"outputLines":205,"outputBytes":10866,"shownRange":{"start":309,"end":513},"nextOffset":514}}},"isError":false,"timestamp":1789001117074}}
{"type":"message","id":"a0045beb","parentId":"136eaeb6","timestamp":"2026-09-10T00:45:17.292Z","message":{"role":"toolResult","toolCallId":"call_EtDUCahe02vthQ1Ybhoy1aRl|fc_02547c41fbf377fa016aa1fd9ce20887d2b29b34b4398c9ceb","toolName":"grep","content":[{"type":"text","text":"# .worktrees/285-zombie/crates/\n\n## spt-term/\n\n### src/\n#### pty.rs\n 59| // [impl->REQ-TERM-1]\n*60| pub fn spawn(cmd: CommandBuilder, size: SurfaceSize) -> Result {\n 61| let pty_system = native_pty_system();\n 62| let pair = pty_system\n 63| .openpty(size.into())\n...\n 95| /// inheriting the caller's working directory.\n*96| pub fn spawn_program(\n 97| program: P,\n 98| args: A,\n 99| size: SurfaceSize,\n...\n 113| // [impl->REQ-HOST-RUN-2]\n*114| pub fn spawn_program_in(\n 115| program: P,\n 116| args: A,\n 117| size: SurfaceSize,\n...\n 135| // [impl->REQ-HAZARD-WIN-PTY-PROGRAM-RESOLVE]\n*136| pub fn spawn_program_in_env(\n 137| program: P,\n 138| args: A,\n 139| size: SurfaceSize,\n...\n 202| /// Block until the child exits, yielding its status.\n*203| pub fn wait(&self) -> Result {\n 204| self.child.lock().unwrap().wait().map_err(SurfaceError::Io)\n 205| }\n 206|\n...\n 209| /// [`PtySession::wait`] / [`PtySession::try_wait`].\n*210| pub fn kill(&self) -> Result<(), SurfaceError> {\n 211| let res = self.killer.lock().unwrap().kill();\n 212| #[cfg(windows)]\n 213| {\n#### reader.rs\n 160| /// present, supplies the accurate display-column position for each CPR.\n*161| fn spawn(reader: R, writer: SharedWriter, mut sink: S, cursor: Option) -> Self\n 162| where\n 163| R: Read + Send + 'static,\n 164| S: FnMut(&[u8]) + Send + 'static,\n\n### tests/\n#### dsr.rs\n 34|/// Poll `collected` until it contains `needle` or the budget elapses.\n*35|fn wait_for(collected: &Arc>>, needle: &str) -> bool {\n 36| for _ in 0..500 {\n 37| if String::from_utf8_lossy(&collected.lock().unwrap()).contains(needle) {\n 38| return true;\n#### inject.rs\n 35|\n*36|fn wait_until bool>(collected: &Arc>>, pred: F) -> bool {\n 37| for _ in 0..500 {\n 38| if pred(&text(collected)) {\n 39| return true;\n#### resize_console_mode_integrity.rs\n 157|\n*158|impl Drop for Rig {\n 159| fn drop(&mut self) {\n 160| let _ = self.pty.kill();\n 161| }\n#### surface.rs\n 92|#[test]\n*93|fn spawn_program_in_lands_the_child_in_the_requested_cwd() {\n 94| use std::io::Read;\n 95|\n 96| let dir = tempfile::tempdir().expect(\"tempdir\");\n\n## spt-store/src/\n### proc.rs\n 16| is_process_alive, parent_pid_of, pin_process, process_exists, process_identity,\n*17| process_started_at, process_table, PinnedProc, ProcIdentity,\n 18|};\n 19|\n 20|\n...\n 45|// [impl->REQ-HAZARD-BRAIN-RESTART-PSYCHE-DUP]\n*46|pub fn kill_pid(pid: u32) {\n 47| if pid == 0 {\n 48| return; // never a real per-process target (see is_process_alive)\n 49| }\n...\n 312|// [impl->REQ-LIVENESS-ORACLE-SOUND]\n*313|pub fn provably_gone(pid: u32) -> bool {\n 314| match process_exists(pid) {\n 315| // Absent from a real snapshot: proof of death on every platform.\n 316| Some(false) => true,\n...\n 339|/// This exists because a process START TIME cannot answer \"did this predate the\n*340|/// current boot?\" portably: [`process_started_at`] returns an absolute FILETIME\n 341|/// on Windows but JIFFIES SINCE BOOT on Linux, and the latter resets every boot,\n 342|/// so a pre-restart value is indistinguishable from a fresh one. The boot instant\n 343|/// is an absolute quantity on both platforms, so comparing an absolute LAUNCH\n...\n 429|// [impl->REQ-PSYCHE-CRASHLOOP-BACKOFF-SHUTDOWN]\n*430|pub fn kill_pid_tree(root: u32) {\n 431| if root == 0 {\n 432| return;\n 433| }\n...\n 654| /// sleeper the descendant/tree-kill tests can observe and reap.\n*655| fn spawn_sleeper() -> std::process::Child {\n 656| #[cfg(windows)]\n 657| {\n 658| std::process::Command::new(\"cmd\")\n...\n 797| // \"Gone\" cannot come from a missing birth.\n*798| let birth = process_started_at(pid);\n 799| // NOT REAPING IS THE POINT — do not \"fix\" this leak. An unreaped child of\n 800| // a living parent IS the field shape (a relay whose owner outlives it),\n 801| // and it is the only way to hold a process in Z long enough to ask the\n...\n 900| /// `process_descendants(parent)` finds the child.\n*901| fn spawn_two_level_tree() -> std::process::Child {\n 902| #[cfg(windows)]\n 903| {\n 904| std::process::Command::new(\"cmd\")\n...\n 928| #[test]\n*929| fn kill_pid_tree_kills_the_whole_subtree() {\n 930| let mut parent = spawn_two_level_tree();\n 931| let ppid = parent.id();\n 932| // Wait for the child to appear under the parent, then capture its pid.\n\n## spt-daemon/src/\n### broker.rs\n 286|\n*287|impl Drop for WakeClaimGuard<'_> {\n 288| fn drop(&mut self) {\n 289| release_claim(&mut recover(self.map), &self.endpoint, self.generation);\n 290| }\n...\n 388|/// its clients yet. Env-tunable so the int rig is deterministic.\n*389|fn spawn_client_grace() -> Duration {\n 390| std::env::var(\"SPT_SPAWN_CLIENT_GRACE_MS\")\n 391| .ok()\n 392| .and_then(|v| v.parse::().ok())\n...\n 3715| }\n*3716| impl Drop for ExitNote {\n 3717| fn drop(&mut self) {\n 3718| self.send.lifecycle_event(\n 3719| \"writer-exit\",\n...\n 4099|/// session, plus its gapless-resume output log.\n*4100|struct HostedSession {\n 4101| /// The PTY + child (PTY master/writer + spawned child process).\n 4102| session: Arc,\n 4103| /// The session's dedicated PTY input-writer (v0.13.0 P0,\n...\n 4148| // [impl->REQ-BROKER-ZOMBIE-IDENTITY]\n*4149| process_started_at: Option,\n 4150|}\n 4151|\n 4152|/// One record queued to a session's dedicated PTY input-writer thread — the raw\n...\n 4204| /// whose PTY write handle this thread now exclusively owns.\n*4205| fn spawn(session: Arc, endpoint: String) -> Arc {\n 4206| let (tx, rx) = sync_channel::(input_queue_depth());\n 4207| let writer = thread::spawn(move || input_writer(session, rx));\n 4208| Arc::new(InputWriter {\n...\n 5240| stop: AtomicBool,\n*5241| sessions: Arc>>,\n 5242| next_id: AtomicU64,\n 5243| log_cap_chunks: usize,\n 5244| /// The exactly-once anchor for idempotent (`op_id`-carrying) effects.\n...\n 5508|/// lock, no I/O) so the live-update endpoint-selection is unit-testable without\n*5509|/// constructing real `HostedSession`s. (W3a, ADR-0025)\n 5510|// [impl->REQ-ADAPTER-LIVE-UPDATE]\n 5511|fn select_endpoints_running_adapter(\n 5512| rows: impl IntoIterator- )>,\n...\n 5855| /// so the install dir's locked binaries free up. The broker `sessions` map IS\n*5856| /// the per-endpoint resident registry (W3a, ADR-0025): each `HostedSession`\n 5857| /// already carries its `endpoint` + lifecycle-managed `translation` child.\n 5858| // [impl->REQ-ADAPTER-LIVE-UPDATE]\n 5859| #[allow(dead_code)] // consumed by W3d `dispatch_adapter_apply` (next sub-commit)\n...\n 5955| struct HandlerTally<'a>(&'a AtomicUsize);\n*5956| impl Drop for HandlerTally<'_> {\n 5957| fn drop(&mut self) {\n 5958| self.0.fetch_sub(1, Ordering::AcqRel);\n 5959| }\n...\n 8040| spid: Option,\n*8041| process_started_at: Option,\n 8042| adapter_labeled: bool,\n 8043| spawned_ms_ago: u64,\n 8044| },\n...\n 8054| h.session.process_id(),\n*8055| h.process_started_at,\n 8056| !h.adapter.is_empty(),\n 8057| h.spawned_at.elapsed().as_millis() as u64,\n 8058| )\n...\n 8069| WakeGate::AlreadyLive => {\n*8070| let (sid, spid, process_started_at, adapter_labeled, spawned_ms_ago) =\n 8071| live.expect(\"live is Some on AlreadyLive\");\n 8072| Gate::AlreadyLive {\n*8073| sid, spid, process_started_at, adapter_labeled, spawned_ms_ago,\n 8074| }\n 8075| }\n 8076| WakeGate::Racing => Gate::Racing,\n...\n 8119| Gate::AlreadyLive {\n*8120| sid, spid, process_started_at, adapter_labeled, spawned_ms_ago,\n 8121| } => {\n 8122| // ONE liveness authority (ADR-0041 decision 6,\n 8123| // REQ-ENDPOINT-CYCLE-HONEST): before refusing/deduping by\n...\n 8138| spid,\n*8139| process_started_at,\n 8140| |pid| {\n 8141| use spt_store::proc::{self, ProcIdentity};\n 8142| if proc::provably_gone(pid) {\n...\n 8144| } else {\n*8145| proc::process_started_at(pid)\n 8146| .map(ProcIdentity::Present)\n 8147| .unwrap_or(ProcIdentity::Unproven)\n 8148| }\n...\n 8157| // Return BEFORE the cleanup loop. In particular,\n*8158| // do not drop HostedSession/PTY resources or call\n 8159| // dispatch_teardown as a fallback after refusal.\n 8160| return Err(format!(\n 8161| \"SPAWN_ZOMBIE_REAP_DECLINE:{}: session {sid}: {reason}\",\n...\n 8178| if Instant::now() >= reap_deadline {\n*8179| let removed = recover(&self.sessions).remove(&sid);\n 8180| if let Some(h) = removed {\n 8181| recover_log(&h.log).stamp_reaped();\n 8182| spt_proto::emit_line_err!(\n...\n 8284| // [impl->REQ-BROKER-ZOMBIE-IDENTITY]\n*8285| let process_started_at = pid.and_then(spt_store::proc::process_started_at);\n 8286| // The ConPTY-create span releases#199 candidate C names, closed.\n 8287| spawn_phase(\"pty_created\", &format!(\"pid={pid:?}\"));\n 8288|"}],"details":{"scopePath":".worktrees/285-zombie/crates/spt-term, .worktrees/285-zombie/crates/spt-store/src/proc.rs, .worktrees/285-zombie/crates/spt-daemon/src/broker.rs","searchPath":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.worktrees\\285-zombie\\crates","cwd":"C:\\Users\\decid\\Documents\\projects\\spt-core","matchCount":40,"fileCount":8,"files":[".worktrees/285-zombie/crates/spt-term/src/pty.rs",".worktrees/285-zombie/crates/spt-term/src/reader.rs",".worktrees/285-zombie/crates/spt-term/tests/dsr.rs",".worktrees/285-zombie/crates/spt-term/tests/inject.rs",".worktrees/285-zombie/crates/spt-term/tests/resize_console_mode_integrity.rs",".worktrees/285-zombie/crates/spt-term/tests/surface.rs",".worktrees/285-zombie/crates/spt-store/src/proc.rs",".worktrees/285-zombie/crates/spt-daemon/src/broker.rs"],"fileMatches":[{"path":".worktrees/285-zombie/crates/spt-term/src/pty.rs","count":6},{"path":".worktrees/285-zombie/crates/spt-term/src/reader.rs","count":1},{"path":".worktrees/285-zombie/crates/spt-term/tests/dsr.rs","count":1},{"path":".worktrees/285-zombie/crates/spt-term/tests/inject.rs","count":1},{"path":".worktrees/285-zombie/crates/spt-term/tests/resize_console_mode_integrity.rs","count":1},{"path":".worktrees/285-zombie/crates/spt-term/tests/surface.rs","count":1},{"path":".worktrees/285-zombie/crates/spt-store/src/proc.rs","count":9},{"path":".worktrees/285-zombie/crates/spt-daemon/src/broker.rs","count":20}],"truncated":true,"perFileLimitReached":20,"displayContent":"# .worktrees/285-zombie/crates/\n\n## spt-term/\n\n### src/\n#### pty.rs\n 59│ // [impl->REQ-TERM-1]\n *60│ pub fn spawn(cmd: CommandBuilder, size: SurfaceSize) -> Result {\n 61│ let pty_system = native_pty_system();\n 62│ let pair = pty_system\n 63│ .openpty(size.into())\n │...\n 95│ /// inheriting the caller's working directory.\n *96│ pub fn spawn_program(\n 97│ program: P,\n 98│ args: A,\n 99│ size: SurfaceSize,\n │...\n 113│ // [impl->REQ-HOST-RUN-2]\n*114│ pub fn spawn_program_in(\n 115│ program: P,\n 116│ args: A,\n 117│ size: SurfaceSize,\n │...\n 135│ // [impl->REQ-HAZARD-WIN-PTY-PROGRAM-RESOLVE]\n*136│ pub fn spawn_program_in_env(\n 137│ program: P,\n 138│ args: A,\n 139│ size: SurfaceSize,\n │...\n 202│ /// Block until the child exits, yielding its status.\n*203│ pub fn wait(&self) -> Result {\n 204│ self.child.lock().unwrap().wait().map_err(SurfaceError::Io)\n 205│ }\n 206│\n │...\n 209│ /// [`PtySession::wait`] / [`PtySession::try_wait`].\n*210│ pub fn kill(&self) -> Result<(), SurfaceError> {\n 211│ let res = self.killer.lock().unwrap().kill();\n 212│ #[cfg(windows)]\n 213│ {\n#### reader.rs\n 160│ /// present, supplies the accurate display-column position for each CPR.\n*161│ fn spawn(reader: R, writer: SharedWriter, mut sink: S, cursor: Option) -> Self\n 162│ where\n 163│ R: Read + Send + 'static,\n 164│ S: FnMut(&[u8]) + Send + 'static,\n\n### tests/\n#### dsr.rs\n 34│/// Poll `collected` until it contains `needle` or the budget elapses.\n*35│fn wait_for(collected: &Arc>>, needle: &str) -> bool {\n 36│ for _ in 0..500 {\n 37│ if String::from_utf8_lossy(&collected.lock().unwrap()).contains(needle) {\n 38│ return true;\n#### inject.rs\n 35│\n*36│fn wait_until bool>(collected: &Arc>>, pred: F) -> bool {\n 37│ for _ in 0..500 {\n 38│ if pred(&text(collected)) {\n 39│ return true;\n#### resize_console_mode_integrity.rs\n 157│\n*158│impl Drop for Rig {\n 159│ fn drop(&mut self) {\n 160│ let _ = self.pty.kill();\n 161│ }\n#### surface.rs\n 92│#[test]\n*93│fn spawn_program_in_lands_the_child_in_the_requested_cwd() {\n 94│ use std::io::Read;\n 95│\n 96│ let dir = tempfile::tempdir().expect(\"tempdir\");\n\n## spt-store/src/\n### proc.rs\n 16│ is_process_alive, parent_pid_of, pin_process, process_exists, process_identity,\n *17│ process_started_at, process_table, PinnedProc, ProcIdentity,\n 18│};\n 19│\n 20│\n │...\n 45│// [impl->REQ-HAZARD-BRAIN-RESTART-PSYCHE-DUP]\n *46│pub fn kill_pid(pid: u32) {\n 47│ if pid == 0 {\n 48│ return; // never a real per-process target (see is_process_alive)\n 49│ }\n │...\n 312│// [impl->REQ-LIVENESS-ORACLE-SOUND]\n*313│pub fn provably_gone(pid: u32) -> bool {\n 314│ match process_exists(pid) {\n 315│ // Absent from a real snapshot: proof of death on every platform.\n 316│ Some(false) => true,\n │...\n 339│/// This exists because a process START TIME cannot answer \"did this predate the\n*340│/// current boot?\" portably: [`process_started_at`] returns an absolute FILETIME\n 341│/// on Windows but JIFFIES SINCE BOOT on Linux, and the latter resets every boot,\n 342│/// so a pre-restart value is indistinguishable from a fresh one. The boot instant\n 343│/// is an absolute quantity on both platforms, so comparing an absolute LAUNCH\n │...\n 429│// [impl->REQ-PSYCHE-CRASHLOOP-BACKOFF-SHUTDOWN]\n*430│pub fn kill_pid_tree(root: u32) {\n 431│ if root == 0 {\n 432│ return;\n 433│ }\n │...\n 654│ /// sleeper the descendant/tree-kill tests can observe and reap.\n*655│ fn spawn_sleeper() -> std::process::Child {\n 656│ #[cfg(windows)]\n 657│ {\n 658│ std::process::Command::new(\"cmd\")\n │...\n 797│ // \"Gone\" cannot come from a missing birth.\n*798│ let birth = process_started_at(pid);\n 799│ // NOT REAPING IS THE POINT — do not \"fix\" this leak. An unreaped child of\n 800│ // a living parent IS the field shape (a relay whose owner outlives it),\n 801│ // and it is the only way to hold a process in Z long enough to ask the\n │...\n 900│ /// `process_descendants(parent)` finds the child.\n*901│ fn spawn_two_level_tree() -> std::process::Child {\n 902│ #[cfg(windows)]\n 903│ {\n 904│ std::process::Command::new(\"cmd\")\n │...\n 928│ #[test]\n*929│ fn kill_pid_tree_kills_the_whole_subtree() {\n 930│ let mut parent = spawn_two_level_tree();\n 931│ let ppid = parent.id();\n 932│ // Wait for the child to appear under the parent, then capture its pid.\n\n## spt-daemon/src/\n### broker.rs\n 286│\n *287│impl Drop for WakeClaimGuard<'_> {\n 288│ fn drop(&mut self) {\n 289│ release_claim(&mut recover(self.map), &self.endpoint, self.generation);\n 290│ }\n │...\n 388│/// its clients yet. Env-tunable so the int rig is deterministic.\n *389│fn spawn_client_grace() -> Duration {\n 390│ std::env::var(\"SPT_SPAWN_CLIENT_GRACE_MS\")\n 391│ .ok()\n 392│ .and_then(|v| v.parse::().ok())\n │...\n 3715│ }\n*3716│ impl Drop for ExitNote {\n 3717│ fn drop(&mut self) {\n 3718│ self.send.lifecycle_event(\n 3719│ \"writer-exit\",\n │...\n 4099│/// session, plus its gapless-resume output log.\n*4100│struct HostedSession {\n 4101│ /// The PTY + child (PTY master/writer + spawned child process).\n 4102│ session: Arc,\n 4103│ /// The session's dedicated PTY input-writer (v0.13.0 P0,\n │...\n 4148│ // [impl->REQ-BROKER-ZOMBIE-IDENTITY]\n*4149│ process_started_at: Option,\n 4150│}\n 4151│\n 4152│/// One record queued to a session's dedicated PTY input-writer thread — the raw\n │...\n 4204│ /// whose PTY write handle this thread now exclusively owns.\n*4205│ fn spawn(session: Arc, endpoint: String) -> Arc {\n 4206│ let (tx, rx) = sync_channel::(input_queue_depth());\n 4207│ let writer = thread::spawn(move || input_writer(session, rx));\n 4208│ Arc::new(InputWriter {\n │...\n 5240│ stop: AtomicBool,\n*5241│ sessions: Arc>>,\n 5242│ next_id: AtomicU64,\n 5243│ log_cap_chunks: usize,\n 5244│ /// The exactly-once anchor for idempotent (`op_id`-carrying) effects.\n │...\n 5508│/// lock, no I/O) so the live-update endpoint-selection is unit-testable without\n*5509│/// constructing real `HostedSession`s. (W3a, ADR-0025)\n 5510│// [impl->REQ-ADAPTER-LIVE-UPDATE]\n 5511│fn select_endpoints_running_adapter(\n 5512│ rows: impl IntoIterator
- )>,\n │...\n 5855│ /// so the install dir's locked binaries free up. The broker `sessions` map IS\n*5856│ /// the per-endpoint resident registry (W3a, ADR-0025): each `HostedSession`\n 5857│ /// already carries its `endpoint` + lifecycle-managed `translation` child.\n 5858│ // [impl->REQ-ADAPTER-LIVE-UPDATE]\n 5859│ #[allow(dead_code)] // consumed by W3d `dispatch_adapter_apply` (next sub-commit)\n │...\n 5955│ struct HandlerTally<'a>(&'a AtomicUsize);\n*5956│ impl Drop for HandlerTally<'_> {\n 5957│ fn drop(&mut self) {\n 5958│ self.0.fetch_sub(1, Ordering::AcqRel);\n 5959│ }\n │...\n 8040│ spid: Option,\n*8041│ process_started_at: Option,\n 8042│ adapter_labeled: bool,\n 8043│ spawned_ms_ago: u64,\n 8044│ },\n │...\n 8054│ h.session.process_id(),\n*8055│ h.process_started_at,\n 8056│ !h.adapter.is_empty(),\n 8057│ h.spawned_at.elapsed().as_millis() as u64,\n 8058│ )\n │...\n 8069│ WakeGate::AlreadyLive => {\n*8070│ let (sid, spid, process_started_at, adapter_labeled, spawned_ms_ago) =\n 8071│ live.expect(\"live is Some on AlreadyLive\");\n 8072│ Gate::AlreadyLive {\n*8073│ sid, spid, process_started_at, adapter_labeled, spawned_ms_ago,\n 8074│ }\n 8075│ }\n 8076│ WakeGate::Racing => Gate::Racing,\n │...\n 8119│ Gate::AlreadyLive {\n*8120│ sid, spid, process_started_at, adapter_labeled, spawned_ms_ago,\n 8121│ } => {\n 8122│ // ONE liveness authority (ADR-0041 decision 6,\n 8123│ // REQ-ENDPOINT-CYCLE-HONEST): before refusing/deduping by\n │...\n 8138│ spid,\n*8139│ process_started_at,\n 8140│ |pid| {\n 8141│ use spt_store::proc::{self, ProcIdentity};\n 8142│ if proc::provably_gone(pid) {\n │...\n 8144│ } else {\n*8145│ proc::process_started_at(pid)\n 8146│ .map(ProcIdentity::Present)\n 8147│ .unwrap_or(ProcIdentity::Unproven)\n 8148│ }\n │...\n 8157│ // Return BEFORE the cleanup loop. In particular,\n*8158│ // do not drop HostedSession/PTY resources or call\n 8159│ // dispatch_teardown as a fallback after refusal.\n 8160│ return Err(format!(\n 8161│ \"SPAWN_ZOMBIE_REAP_DECLINE:{}: session {sid}: {reason}\",\n │...\n 8178│ if Instant::now() >= reap_deadline {\n*8179│ let removed = recover(&self.sessions).remove(&sid);\n 8180│ if let Some(h) = removed {\n 8181│ recover_log(&h.log).stamp_reaped();\n 8182│ spt_proto::emit_line_err!(\n │...\n 8284│ // [impl->REQ-BROKER-ZOMBIE-IDENTITY]\n*8285│ let process_started_at = pid.and_then(spt_store::proc::process_started_at);\n 8286│ // The ConPTY-create span releases#199 candidate C names, closed.\n 8287│ spawn_phase(\"pty_created\", &format!(\"pid={pid:?}\"));\n 8288│"},"isError":false,"timestamp":1789001117291}}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_uOiZSK9eTxUimAb9nRH7UUq4|fc_02547c41fbf377fa016aa1fdaa8dec87d2a25de8345f0f7a08","toolName":"read","startedAt":"2026-09-10T00:45:30.648Z","args":{"path":".worktrees/285-zombie/crates/spt-term/src/pty.rs:1-410:raw"},"intent":"Reading terminal lifecycle implementation"},"id":"8b1e8a93","parentId":"a0045beb","timestamp":"2026-09-10T00:45:30.648Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_KM892XwHK7pKjJ7y4Hi4ITz2|fc_02547c41fbf377fa016aa1fdaa8df887d293902679c1bd9ad3","toolName":"read","startedAt":"2026-09-10T00:45:30.649Z","args":{"path":".worktrees/285-zombie/crates/spt-term/src/reader.rs:1-360:raw"},"intent":"Reading terminal drain ownership"},"id":"344e38ac","parentId":"8b1e8a93","timestamp":"2026-09-10T00:45:30.649Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_TE6Ykg5i6mC3AUYGYH2A8UqE|fc_02547c41fbf377fa016aa1fdaa8e0487d2b4cc5f34e4203e55","toolName":"read","startedAt":"2026-09-10T00:45:30.649Z","args":{"path":".worktrees/285-zombie/crates/spt-daemon/src/broker.rs:8330-8840:raw"},"intent":"Reading spawn waiter lifecycle"},"id":"87e81aff","parentId":"344e38ac","timestamp":"2026-09-10T00:45:30.649Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_Tz1h1TdA8JHzV30EKzFEtZi1|fc_02547c41fbf377fa016aa1fdaa8e0c87d291bd4c64528239f0","toolName":"read","startedAt":"2026-09-10T00:45:30.649Z","args":{"path":".worktrees/285-zombie/crates/spt-store/src/proc.rs:1-105,265-335,390-465:raw"},"intent":"Reading process kill implementation"},"id":"bc401a96","parentId":"87e81aff","timestamp":"2026-09-10T00:45:30.649Z"}
{"type":"message","id":"e36109a9","parentId":"bc401a96","timestamp":"2026-09-10T00:45:30.649Z","message":{"role":"assistant","content":[{"type":"thinking","thinking":"**Re-reading source sections**"},{"type":"toolCall","id":"call_uOiZSK9eTxUimAb9nRH7UUq4|fc_02547c41fbf377fa016aa1fdaa8dec87d2a25de8345f0f7a08","name":"read","arguments":{"i":"Reading terminal lifecycle implementation","path":".worktrees/285-zombie/crates/spt-term/src/pty.rs:1-410:raw"},"intent":"Reading terminal lifecycle implementation"},{"type":"toolCall","id":"call_KM892XwHK7pKjJ7y4Hi4ITz2|fc_02547c41fbf377fa016aa1fdaa8df887d293902679c1bd9ad3","name":"read","arguments":{"i":"Reading terminal drain ownership","path":".worktrees/285-zombie/crates/spt-term/src/reader.rs:1-360:raw"},"intent":"Reading terminal drain ownership"},{"type":"toolCall","id":"call_TE6Ykg5i6mC3AUYGYH2A8UqE|fc_02547c41fbf377fa016aa1fdaa8e0487d2b4cc5f34e4203e55","name":"read","arguments":{"i":"Reading spawn waiter lifecycle","path":".worktrees/285-zombie/crates/spt-daemon/src/broker.rs:8330-8840:raw"},"intent":"Reading spawn waiter lifecycle"},{"type":"toolCall","id":"call_Tz1h1TdA8JHzV30EKzFEtZi1|fc_02547c41fbf377fa016aa1fdaa8e0c87d291bd4c64528239f0","name":"read","arguments":{"i":"Reading process kill implementation","path":".worktrees/285-zombie/crates/spt-store/src/proc.rs:1-105,265-335,390-465:raw"},"intent":"Reading process kill implementation"},{"type":"toolCall","id":"call_JUpiFwoHY5RPC6FhSQAdBdUi|fc_02547c41fbf377fa016aa1fdaa8e1487d2b38ffcff7931b290","name":"grep","arguments":{"i":"Locating underlying resource ownership","pattern":"impl Drop|fn dispatch_teardown|fn dispatch_spawn|spawn_policy\\(|TranslationChild|portable.pty|spt.procs|spt.process","path":".worktrees/285-zombie/crates/spt-daemon/src/broker.rs;.worktrees/285-zombie/crates/spt-daemon/src/translation.rs;.worktrees/285-zombie/crates/spt-term;.worktrees/285-zombie/crates/spt-store/Cargo.toml;.worktrees/285-zombie/Cargo.toml;.worktrees/285-zombie/Cargo.lock","case":true,"gitignore":false,"skip":null},"intent":"Locating underlying resource ownership"}],"api":"openai-codex-responses","provider":"openai-codex","model":"gpt-6-astra","usage":{"input":14391,"output":396,"cacheRead":26496,"cacheWrite":0,"totalTokens":41283,"reasoningTokens":48,"cost":{"input":0,"output":0,"cacheRead":0,"cacheWrite":0,"total":0}},"stopReason":"toolUse","timestamp":1789001117314,"responseId":"resp_02547c41fbf377fa016aa1fd9d8bc887d2990236bbea204775","providerPayload":{"type":"openaiResponsesHistory","provider":"openai-codex","dt":true,"items":[{"id":"rs_02547c41fbf377fa016aa1fd9eb21c87d28f6c296e0d2ae84a","type":"reasoning","content":[],"encrypted_content":"gAAAAABqof2qCP596tLPg7tuFZ5I5i6zr2hTZtrO5tjaxKLdlrBUHlxZbA5xei5hVxbObEn4rtkg0NcrkDueS9GkqTpNLAHyCw4iwflxrk8PpSRZc-xmrLeKluS9vw4na-b1j6gmj4yGMHa4KTyJivSg7QXZE-6vbpAB5oKj1k0XflegTCBA_bgoi-C9qO8PK_cdxH3TsVqEflHnoNKxBBZUsspbQDegzdrB9dPIgbmIRnl6sKo3cRVmzVd7wzAKrcUfPiccyaExRwnGtVdOvz4vjoZo2R3KpmBH5mM4LrLO5qYvKO6CFiHQtqBHEqZSxyIm9Tvo0rOxdAnpqjB567DG_XegwcfGAFd5unYmuEc_GuCULGO3h8oN8kxxoR0_Dl3rXY0miv5u2OEXQtC6qtoo6Oi6RctlaeR23lEZ9ZkfosuCPfoo9T6u98BtP0juOKgYBm1WMoWs5GItPE09ViYLcgxPDkocMM52mW-NBgn0dx5_W7EB_UjReO_n91kyIXdp3xJkjKwsr3LiiJSd-IEVp2guKToUNaz7X-ZC251Q8ZHJTrp04t1UoXHu5mmLA3ad2TRSA48B0fyv7HO8WXQREr7Gt9rNXls3Ug78dL_Wjj7FFvHWbAIc3lXAP8voHf3rd1Hp_OeoDt-mxMTs9iSxo3AZ5DlJF5HHo5Lk5J7iqgpNNDQ0TNrnfqE9AHdIGe9kRAjI6ECT-X_a1V2D7MqeURlwEbRXToxlkcfXAlg9leQBN0lsT2i18nJUfW5a63GSzRj0Pxsr49Hj8HepqXsrF2S96Dj4ZSlMjcOCkmPNSHxd1jCNwS3wdTwpnQ9P24xCbD_a0zjaed6VMaB8-F0CJ_lc7KLLXPTcF13EGRRD1z46YDg-XtSt1SXQWwMaAaFdu_0aAuPEh2sp0XEWoUK4uaHRM84nFnQwbeuKS85h9IWjAwO0ENCuWJ0_6ByEdbqYkUscsWpNxHRENbY0QCIhsojSjwuDg-zQBhpvdUp1zbw8eRUNXLI5xAVFVqqHg-Zg2HfPZpA2i39KLtlJfQwDpJh_54ar_NR4pvSVv2DDgbJKslOT_12zF6wr03YIsvGCQ6xlkF5gq7fdVa5pHlLAp0HPYdycjCPWJ-RVqruUlkeUZ815ebS2eGtw_kKQH4TbqYQYQlgFg1HxYM0udXEKAP3dfbnOtg_WBpVLW-Q64oB5c5CGKvQsBlvrufUupohfe3mfrQBjqsCgMEgqMtEgKTFBXBpcFkMc3V2ZeEAe0nRtPvlVB_fMDZGdyTWEB-ty5HCQfhsym8IM9jq4uLhLpIkCMLxVRJkJ__4RVq5XoC76e1R0J0Ny-kzUppl7lvmy3olZ5doiSO9PrUMO9QkUToY6kB4YpzIgdZO5hAyyN74O65J3UNGAZ75X7bDmm4ZPsKqDbQUGjfM1awbvysiHXkWB3OxYQc5T9cqYxRMtI8E18hTKlDQjsA7WozzX84ZX2ZYaaf2oX8rVzpHy65VsHhxyhZunydxlcmA_LCDOJsKnAdXHoHs-oXEMluwoHJo_ZlzxtKf2NLXc9BNHbeoFQgq0wnGMdJ3HMRa3Zs0IKNUmQx_bSGD8hcc5IV8FQSSMc1CoupABjrxLiV55fGofnPD8uIsUBg==","internal_chat_message_metadata_passthrough":{"turn_id":"e87e53c5-40c7-422d-9e85-ed14bd841c4c"},"summary":[{"type":"summary_text","text":"**Re-reading source sections**"}],"metadata":{"turn_id":"e87e53c5-40c7-422d-9e85-ed14bd841c4c"}},{"id":"fc_02547c41fbf377fa016aa1fdaa8dec87d2a25de8345f0f7a08","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading terminal lifecycle implementation\",\"path\":\".worktrees/285-zombie/crates/spt-term/src/pty.rs:1-410:raw\"}","call_id":"call_uOiZSK9eTxUimAb9nRH7UUq4","internal_chat_message_metadata_passthrough":{"turn_id":"e87e53c5-40c7-422d-9e85-ed14bd841c4c"},"name":"read","metadata":{"turn_id":"e87e53c5-40c7-422d-9e85-ed14bd841c4c"}},{"id":"fc_02547c41fbf377fa016aa1fdaa8df887d293902679c1bd9ad3","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading terminal drain ownership\",\"path\":\".worktrees/285-zombie/crates/spt-term/src/reader.rs:1-360:raw\"}","call_id":"call_KM892XwHK7pKjJ7y4Hi4ITz2","internal_chat_message_metadata_passthrough":{"turn_id":"e87e53c5-40c7-422d-9e85-ed14bd841c4c"},"name":"read","metadata":{"turn_id":"e87e53c5-40c7-422d-9e85-ed14bd841c4c"}},{"id":"fc_02547c41fbf377fa016aa1fdaa8e0487d2b4cc5f34e4203e55","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading spawn waiter lifecycle\",\"path\":\".worktrees/285-zombie/crates/spt-daemon/src/broker.rs:8330-8840:raw\"}","call_id":"call_TE6Ykg5i6mC3AUYGYH2A8UqE","internal_chat_message_metadata_passthrough":{"turn_id":"e87e53c5-40c7-422d-9e85-ed14bd841c4c"},"name":"read","metadata":{"turn_id":"e87e53c5-40c7-422d-9e85-ed14bd841c4c"}},{"id":"fc_02547c41fbf377fa016aa1fdaa8e0c87d291bd4c64528239f0","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading process kill implementation\",\"path\":\".worktrees/285-zombie/crates/spt-store/src/proc.rs:1-105,265-335,390-465:raw\"}","call_id":"call_Tz1h1TdA8JHzV30EKzFEtZi1","internal_chat_message_metadata_passthrough":{"turn_id":"e87e53c5-40c7-422d-9e85-ed14bd841c4c"},"name":"read","metadata":{"turn_id":"e87e53c5-40c7-422d-9e85-ed14bd841c4c"}},{"id":"fc_02547c41fbf377fa016aa1fdaa8e1487d2b38ffcff7931b290","type":"function_call","status":"completed","arguments":"{\"i\":\"Locating underlying resource ownership\",\"pattern\":\"impl Drop|fn dispatch_teardown|fn dispatch_spawn|spawn_policy\\\\(|TranslationChild|portable.pty|spt.procs|spt.process\",\"path\":\".worktrees/285-zombie/crates/spt-daemon/src/broker.rs;.worktrees/285-zombie/crates/spt-daemon/src/translation.rs;.worktrees/285-zombie/crates/spt-term;.worktrees/285-zombie/crates/spt-store/Cargo.toml;.worktrees/285-zombie/Cargo.toml;.worktrees/285-zombie/Cargo.lock\",\"case\":true,\"gitignore\":false,\"skip\":null}","call_id":"call_JUpiFwoHY5RPC6FhSQAdBdUi","internal_chat_message_metadata_passthrough":{"turn_id":"e87e53c5-40c7-422d-9e85-ed14bd841c4c"},"name":"grep","metadata":{"turn_id":"e87e53c5-40c7-422d-9e85-ed14bd841c4c"}}]},"duration":13332.640500000212,"ttft":1403.8092000000179,"completedAt":1789001130647,"contextSnapshot":{"promptTokens":40887,"nonMessageTokens":13209,"compactionEpoch":0}}}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_JUpiFwoHY5RPC6FhSQAdBdUi|fc_02547c41fbf377fa016aa1fdaa8e1487d2b38ffcff7931b290","toolName":"grep","startedAt":"2026-09-10T00:45:30.649Z","args":{"path":".worktrees/285-zombie/crates/spt-daemon/src/broker.rs;.worktrees/285-zombie/crates/spt-daemon/src/translation.rs;.worktrees/285-zombie/crates/spt-term;.worktrees/285-zombie/crates/spt-store/Cargo.toml…"},"intent":"Locating underlying resource ownership"},"id":"b5edcd89","parentId":"e36109a9","timestamp":"2026-09-10T00:45:30.649Z"}
{"type":"message","id":"f410cf38","parentId":"b5edcd89","timestamp":"2026-09-10T00:45:30.652Z","message":{"role":"toolResult","toolCallId":"call_uOiZSK9eTxUimAb9nRH7UUq4|fc_02547c41fbf377fa016aa1fdaa8dec87d2a25de8345f0f7a08","toolName":"read","content":[{"type":"text","text":"//! Native-PTY session backend — ConPTY on Windows 10+, `forkpty(3)` on Unix,\n//! both via `portable-pty` (the exact crate + handoff shape Spikes #1 / #4\n//! proved).\n//!\n//! [`PtySession`] spawns a child under a real PTY, owns the master reader and\n//! writer, and serves the [`SessionSurface`] contract. It is **single-surface\n//! per handle** — one child's PTY, not the multiplexed fleet (that supervisor is\n//! the M3b broker).\n//!\n//! ## Concurrency discipline (Spike #5, binding)\n//!\n//! `resize()` races the reader thread on Windows; the master is therefore held\n//! behind a `Mutex` and every `resize` takes that lock. The writer is a shared\n//! `Arc>` so the A2 DSR drain thread can answer ConPTY's startup\n//! cursor query through the same serialized writer the caller injects input\n//! through — no torn writes.\n\nuse std::io::{Read, Write};\nuse std::sync::{Arc, Mutex};\n\nuse portable_pty::{native_pty_system, Child, ChildKiller, CommandBuilder, ExitStatus, MasterPty};\n\nuse crate::surface::{SessionSurface, SurfaceError, SurfaceSize};\n\n/// Shared, serialized handle to the PTY master writer. Cloned to the A2 drain\n/// thread so the DSR auto-answer and caller input never interleave mid-write.\npub(crate) type SharedWriter = Arc>>;\n\n/// A child process running under a native PTY, exposed as a [`SessionSurface`].\n///\n/// Build one with [`PtySession::spawn`]; drive input via [`SessionSurface::write_input`]\n/// (or the A3 `send_keys`/`send_line` helpers), drain output via\n/// [`PtySession::take_reader`], and observe lifecycle via [`PtySession::try_wait`] /\n/// [`PtySession::wait`] / [`PtySession::kill`].\npub struct PtySession {\n /// The master end, behind a lock so `resize` never races the reader (Spike #5).\n master: Mutex>,\n /// The single PTY writer, shared so the A2 drain thread can answer DSR.\n writer: SharedWriter,\n /// The spawned child; behind a lock for `wait`/`try_wait`.\n child: Mutex>,\n /// A kill handle split from the child so we can terminate from another\n /// thread even while `wait` blocks (`portable-pty` `ChildKiller`).\n killer: Mutex>,\n /// The master reader, taken at most once (`take_reader`).\n reader: Mutex>>,\n /// The child OS pid, captured at spawn.\n pid: Option,\n}\n\nimpl PtySession {\n /// Spawn `cmd` under a fresh native PTY sized to `size`.\n ///\n /// The slave end is dropped immediately after the child is spawned: the\n /// child holds the only remaining slave handle, which lets EOF propagate on\n /// the Unix raw-pipe backend once the child exits. (On Windows the no-EOF\n /// behaviour is governed by the writer, handled by the A2 drain discipline.)\n //\n // [impl->REQ-TERM-1]\n pub fn spawn(cmd: CommandBuilder, size: SurfaceSize) -> Result {\n let pty_system = native_pty_system();\n let pair = pty_system\n .openpty(size.into())\n .map_err(|e| SurfaceError::OpenPty(e.to_string()))?;\n\n let child = pair\n .slave\n .spawn_command(cmd)\n .map_err(|e| SurfaceError::Spawn(e.to_string()))?;\n // Drop the slave so the child owns the only slave-side handle.\n drop(pair.slave);\n\n let reader = pair\n .master\n .try_clone_reader()\n .map_err(|e| SurfaceError::Io(io_other(e)))?;\n let writer = pair\n .master\n .take_writer()\n .map_err(|e| SurfaceError::Io(io_other(e)))?;\n let killer = child.clone_killer();\n let pid = child.process_id();\n\n Ok(Self {\n master: Mutex::new(pair.master),\n writer: Arc::new(Mutex::new(writer)),\n child: Mutex::new(child),\n killer: Mutex::new(killer),\n reader: Mutex::new(Some(reader)),\n pid,\n })\n }\n\n /// Convenience: spawn `program` with `args` under a PTY sized to `size`,\n /// inheriting the caller's working directory.\n pub fn spawn_program(\n program: P,\n args: A,\n size: SurfaceSize,\n ) -> Result\n where\n P: AsRef,\n A: IntoIterator
- ,\n S: AsRef,\n {\n Self::spawn_program_in(program, args, size, None::<&std::ffi::OsStr>)\n }\n\n /// Spawn `program` with `args` under a PTY sized to `size`, in `cwd` when\n /// `Some` (REQ-HOST-RUN-2: a project-scoped working directory for the\n /// spawned child) — `None` inherits the caller's cwd, identical to\n /// [`Self::spawn_program`].\n // [impl->REQ-HOST-RUN-2]\n pub fn spawn_program_in(\n program: P,\n args: A,\n size: SurfaceSize,\n cwd: Option,\n ) -> Result\n where\n P: AsRef,\n A: IntoIterator
- ,\n S: AsRef,\n D: AsRef,\n {\n Self::spawn_program_in_env(program, args, size, cwd, std::iter::empty::<(&str, &str)>())\n }\n\n /// Like [`Self::spawn_program_in`] but also sets `env` vars on the child\n /// (manifest `[env.]` direction = inject — REQ-HAZARD-ENV-SUBST). Each\n /// `(key, value)` is applied to the spawned process's environment ON TOP of\n /// the inherited env, so an adapter's per-endpoint injects (e.g.\n /// `SPT_ENDPOINT_ID = {id}`) actually reach the harness child.\n // [impl->REQ-HAZARD-ENV-SUBST]\n // [impl->REQ-HAZARD-WIN-PTY-PROGRAM-RESOLVE]\n pub fn spawn_program_in_env(\n program: P,\n args: A,\n size: SurfaceSize,\n cwd: Option,\n env: E,\n ) -> Result\n where\n P: AsRef,\n A: IntoIterator
- ,\n S: AsRef,\n D: AsRef,\n E: IntoIterator
- ,\n K: AsRef,\n V: AsRef,\n {\n // Resolve the program for the OS spawn before portable-pty's own `which`\n // can pick an extensionless shebang shim that CreateProcessW rejects\n // (os error 193). On Windows this PATHEXT-resolves a bare name and wraps a\n // non-PE target (.cmd/.bat → cmd.exe, .ps1 → powershell); off Windows it\n // is a passthrough. The wrap prefix args precede the caller's args.\n // [impl->REQ-HAZARD-WIN-PTY-PROGRAM-RESOLVE]\n let (program, prefix) = crate::winprog::resolve_for_pty(program.as_ref());\n let mut cmd = CommandBuilder::new(&program);\n for a in prefix {\n cmd.arg(a);\n }\n for a in args {\n cmd.arg(a);\n }\n if let Some(dir) = cwd {\n cmd.cwd(dir);\n }\n for (k, v) in env {\n cmd.env(k, v);\n }\n Self::spawn(cmd, size)\n }\n\n /// Take the master reader. Returns [`SurfaceError::ReaderTaken`] on the\n /// second call — output is drained by exactly one consumer (the A2 drain\n /// thread in the hosted path; a test consumer otherwise).\n pub fn take_reader(&self) -> Result, SurfaceError> {\n self.reader\n .lock()\n .unwrap()\n .take()\n .ok_or(SurfaceError::ReaderTaken)\n }\n\n /// The shared writer handle — cloned to the A2 DSR drain thread so its\n /// auto-answer goes through the same serialized writer the caller injects\n /// input through (no torn writes).\n pub(crate) fn shared_writer(&self) -> SharedWriter {\n Arc::clone(&self.writer)\n }\n\n /// Poll for child exit without blocking.\n pub fn try_wait(&self) -> Result, SurfaceError> {\n self.child\n .lock()\n .unwrap()\n .try_wait()\n .map_err(SurfaceError::Io)\n }\n\n /// Block until the child exits, yielding its status.\n pub fn wait(&self) -> Result {\n self.child.lock().unwrap().wait().map_err(SurfaceError::Io)\n }\n\n /// Terminate the child. Safe to call from another thread while `wait`\n /// blocks (uses the split `ChildKiller`). Confirm the reap via\n /// [`PtySession::wait`] / [`PtySession::try_wait`].\n pub fn kill(&self) -> Result<(), SurfaceError> {\n let res = self.killer.lock().unwrap().kill();\n #[cfg(windows)]\n {\n // portable-pty 0.8's Windows `ChildKiller` returns the spurious\n // `last_os_error` even when `TerminateProcess` *succeeds* (the\n // upstream success check is inverted; `WinChild::kill` swallows it,\n // the cloned killer does not). Its Result is therefore untrustworthy\n // — kill is best-effort; confirm death by reaping.\n let _ = res;\n Ok(())\n }\n #[cfg(unix)]\n {\n res.map_err(SurfaceError::Io)\n }\n }\n\n /// The child's OS process id, if the backend exposes one.\n pub fn process_id(&self) -> Option {\n self.pid\n }\n}\n\n// [impl->REQ-TERM-1]\nimpl SessionSurface for PtySession {\n fn write_input(&self, bytes: &[u8]) -> Result<(), SurfaceError> {\n let mut w = self.writer.lock().unwrap();\n w.write_all(bytes).map_err(SurfaceError::Io)?;\n w.flush().map_err(SurfaceError::Io)\n }\n\n fn resize(&self, size: SurfaceSize) -> Result<(), SurfaceError> {\n // Hold the master lock so resize never races a concurrent reader/resize\n // (Spike #5: resize races the reader on Windows).\n self.master\n .lock()\n .unwrap()\n .resize(size.into())\n .map_err(|e| SurfaceError::Io(io_other(e)))\n }\n}\n\n/// Fold a `portable-pty` error (a private `anyhow::Error` alias) into a\n/// `std::io::Error` so the crate's public surface never leaks `anyhow`. Generic\n/// over `Display` to avoid naming the un-exported error type.\nfn io_other(e: E) -> std::io::Error {\n std::io::Error::other(e.to_string())\n}\n"}],"details":{"totalLines":259,"displayContent":{"text":"//! Native-PTY session backend — ConPTY on Windows 10+, `forkpty(3)` on Unix,\r\n//! both via `portable-pty` (the exact crate + handoff shape Spikes #1 / #4\r\n//! proved).\r\n//!\r\n//! [`PtySession`] spawns a child under a real PTY, owns the master reader and\r\n//! writer, and serves the [`SessionSurface`] contract. It is **single-surface\r\n//! per handle** — one child's PTY, not the multiplexed fleet (that supervisor is\r\n//! the M3b broker).\r\n//!\r\n//! ## Concurrency discipline (Spike #5, binding)\r\n//!\r\n//! `resize()` races the reader thread on Windows; the master is therefore held\r\n//! behind a `Mutex` and every `resize` takes that lock. The writer is a shared\r\n//! `Arc>` so the A2 DSR drain thread can answer ConPTY's startup\r\n//! cursor query through the same serialized writer the caller injects input\r\n//! through — no torn writes.\r\n\r\nuse std::io::{Read, Write};\r\nuse std::sync::{Arc, Mutex};\r\n\r\nuse portable_pty::{native_pty_system, Child, ChildKiller, CommandBuilder, ExitStatus, MasterPty};\r\n\r\nuse crate::surface::{SessionSurface, SurfaceError, SurfaceSize};\r\n\r\n/// Shared, serialized handle to the PTY master writer. Cloned to the A2 drain\r\n/// thread so the DSR auto-answer and caller input never interleave mid-write.\r\npub(crate) type SharedWriter = Arc>>;\r\n\r\n/// A child process running under a native PTY, exposed as a [`SessionSurface`].\r\n///\r\n/// Build one with [`PtySession::spawn`]; drive input via [`SessionSurface::write_input`]\r\n/// (or the A3 `send_keys`/`send_line` helpers), drain output via\r\n/// [`PtySession::take_reader`], and observe lifecycle via [`PtySession::try_wait`] /\r\n/// [`PtySession::wait`] / [`PtySession::kill`].\r\npub struct PtySession {\r\n /// The master end, behind a lock so `resize` never races the reader (Spike #5).\r\n master: Mutex>,\r\n /// The single PTY writer, shared so the A2 drain thread can answer DSR.\r\n writer: SharedWriter,\r\n /// The spawned child; behind a lock for `wait`/`try_wait`.\r\n child: Mutex>,\r\n /// A kill handle split from the child so we can terminate from another\r\n /// thread even while `wait` blocks (`portable-pty` `ChildKiller`).\r\n killer: Mutex>,\r\n /// The master reader, taken at most once (`take_reader`).\r\n reader: Mutex>>,\r\n /// The child OS pid, captured at spawn.\r\n pid: Option,\r\n}\r\n\r\nimpl PtySession {\r\n /// Spawn `cmd` under a fresh native PTY sized to `size`.\r\n ///\r\n /// The slave end is dropped immediately after the child is spawned: the\r\n /// child holds the only remaining slave handle, which lets EOF propagate on\r\n /// the Unix raw-pipe backend once the child exits. (On Windows the no-EOF\r\n /// behaviour is governed by the writer, handled by the A2 drain discipline.)\r\n //\r\n // [impl->REQ-TERM-1]\r\n pub fn spawn(cmd: CommandBuilder, size: SurfaceSize) -> Result {\r\n let pty_system = native_pty_system();\r\n let pair = pty_system\r\n .openpty(size.into())\r\n .map_err(|e| SurfaceError::OpenPty(e.to_string()))?;\r\n\r\n let child = pair\r\n .slave\r\n .spawn_command(cmd)\r\n .map_err(|e| SurfaceError::Spawn(e.to_string()))?;\r\n // Drop the slave so the child owns the only slave-side handle.\r\n drop(pair.slave);\r\n\r\n let reader = pair\r\n .master\r\n .try_clone_reader()\r\n .map_err(|e| SurfaceError::Io(io_other(e)))?;\r\n let writer = pair\r\n .master\r\n .take_writer()\r\n .map_err(|e| SurfaceError::Io(io_other(e)))?;\r\n let killer = child.clone_killer();\r\n let pid = child.process_id();\r\n\r\n Ok(Self {\r\n master: Mutex::new(pair.master),\r\n writer: Arc::new(Mutex::new(writer)),\r\n child: Mutex::new(child),\r\n killer: Mutex::new(killer),\r\n reader: Mutex::new(Some(reader)),\r\n pid,\r\n })\r\n }\r\n\r\n /// Convenience: spawn `program` with `args` under a PTY sized to `size`,\r\n /// inheriting the caller's working directory.\r\n pub fn spawn_program(\r\n program: P,\r\n args: A,\r\n size: SurfaceSize,\r\n ) -> Result