Remote-MCP 08: Move session, lock, and lease state to a store safe for concurrent remote sessions #937

New Issue

2026-07-26T00:33:14-05:00

jcwalker3 commented

2026-07-26 00:33:14 -05:00

Parent epic: #929.
Depends on: #932, #936.

Problem

Coordination state is local and PID-shaped. Issue locks, workflow leases, reviewer leases, review decision locks, and session state live in local files and a local database, and liveness is judged by whether an operating-system process is still alive on this machine. Known failure modes already follow from that: two lease stores can disagree, a lease reporting active proves nothing without confirming the owning process is alive, and a dead process identifier can leave a lock that blocks everyone.

Once sessions arrive from several callers against one endpoint, a local PID means nothing, owner_pid_alive becomes unanswerable, and two concurrent callers can hold what each believes is an exclusive lease. Mutual exclusion is the property the whole workflow depends on, so it must survive the move intact.

Scope

Give coordination state one authority that works for concurrent remote sessions.

Identify every durable coordination store in use, including any temporary-directory pointer files, and record which are authoritative.
Replace process-identifier liveness with a session-identity and expiry model tied to the server-issued session from child 5.
Consolidate stores that can currently disagree, or define one as authoritative and make the other derive from it. Two independent stores answering the same ownership question is the defect.
Make acquire, renew, release, and expire atomic under concurrency, so two simultaneous acquisitions cannot both succeed.
Preserve the existing recovery paths, including adoption and expiry reclamation, expressed in terms of session identity rather than process identifiers.
Keep test isolation absolute: running the suite must not read or write live coordination state.

Acceptance criteria

A documented list names every coordination store and marks exactly one authority per ownership question.
Two concurrent acquisitions of the same lock or lease result in exactly one winner, proven by a concurrency test.
Liveness and expiry are computed from session identity and time, with no dependency on a local process identifier.
Adoption, release, and expiry reclamation work across separate server sessions.
An abandoned session's lease becomes reclaimable within its stated expiry, with no operator file editing.
The suite provably cannot mutate live coordination state.

Verification

Tests cover: concurrent acquire, renew, release, expiry reclamation, adoption across sessions, and the crash-then-reclaim path.
A test asserts the suite writes no live coordination state.
A test asserts no ownership decision consults a local process identifier.
Full suite compared against the recorded baseline, run from a branches/ worktree.

Non-goals

Redesigning the reviewer or merger state machines.
Changing lease durations or workflow policy.
The transactional author work tracked by issue #887. This child changes where state lives and how ownership is decided, not the author transaction boundary.

Parent epic: #929. Depends on: #932, #936. ## Problem Coordination state is local and PID-shaped. Issue locks, workflow leases, reviewer leases, review decision locks, and session state live in local files and a local database, and liveness is judged by whether an operating-system process is still alive on this machine. Known failure modes already follow from that: two lease stores can disagree, a lease reporting active proves nothing without confirming the owning process is alive, and a dead process identifier can leave a lock that blocks everyone. Once sessions arrive from several callers against one endpoint, a local PID means nothing, `owner_pid_alive` becomes unanswerable, and two concurrent callers can hold what each believes is an exclusive lease. Mutual exclusion is the property the whole workflow depends on, so it must survive the move intact. ## Scope Give coordination state one authority that works for concurrent remote sessions. - Identify every durable coordination store in use, including any temporary-directory pointer files, and record which are authoritative. - Replace process-identifier liveness with a session-identity and expiry model tied to the server-issued session from child 5. - Consolidate stores that can currently disagree, or define one as authoritative and make the other derive from it. Two independent stores answering the same ownership question is the defect. - Make acquire, renew, release, and expire atomic under concurrency, so two simultaneous acquisitions cannot both succeed. - Preserve the existing recovery paths, including adoption and expiry reclamation, expressed in terms of session identity rather than process identifiers. - Keep test isolation absolute: running the suite must not read or write live coordination state. ## Acceptance criteria - A documented list names every coordination store and marks exactly one authority per ownership question. - Two concurrent acquisitions of the same lock or lease result in exactly one winner, proven by a concurrency test. - Liveness and expiry are computed from session identity and time, with no dependency on a local process identifier. - Adoption, release, and expiry reclamation work across separate server sessions. - An abandoned session's lease becomes reclaimable within its stated expiry, with no operator file editing. - The suite provably cannot mutate live coordination state. ## Verification - Tests cover: concurrent acquire, renew, release, expiry reclamation, adoption across sessions, and the crash-then-reclaim path. - A test asserts the suite writes no live coordination state. - A test asserts no ownership decision consults a local process identifier. - Full suite compared against the recorded baseline, run from a `branches/` worktree. ## Non-goals - Redesigning the reviewer or merger state machines. - Changing lease durations or workflow policy. - The transactional author work tracked by issue #887. This child changes where state lives and how ownership is decided, not the author transaction boundary.