feat(recovery): stale worktree binding demotion and crash-orphan lease recovery (Closes #702)

Conversation 29 Commits 2 Files Changed 8

+2053 -27

2 Commits

Author SHA1 Message Date

Author	SHA1	Message	Date
sysadminandClaude Fable 5	c2fc2683b9	fix(recovery): address PR #703 review findings F1-F6 (#702 ) Fixes the six defects from the formal REQUEST_CHANGES review at `889931d553`: - F1: run sanctioned stale-binding recovery in gitea_resolve_task_capability BEFORE the terminal launcher probe, so a worktree removed mid-session can no longer wedge mutation resolution on 'missing cwd' before recovery runs. The fail-closed probe block now also carries the binding classification evidence. - F2: _resolve_preflight_workspace_path resolves with the same verify_paths existence checks as the canonical mutation context, and _get_workspace_porcelain returns a synthetic tracked-dirty sentinel when the workspace is missing or git fails — an uninspectable workspace can never read as clean/empty porcelain. - F3: the orphaned_expired_superseded_head cleanup matrix now requires affirmative safe worktree evidence (worktree_clean=true or worktree_exists=false), aligned with the sibling orphaned_owner_missing gate and the diagnosis path; unknown evidence fails closed. - F4: reviewer-session-lease shadows and stale-binding audit records are recovery-critical kinds exempt from the 4h session-state TTL; they persist until a sanctioned clear terminally reconciles them. - F5: session-lease shadows are keyed by lease session id (collision-safe identity) with a list_states enumeration API; concurrent same-profile sessions can no longer overwrite or misattribute each other's crash evidence. Legacy single-slot records remain readable. - F6: the durable audit record is persisted (status=pending) BEFORE the environment binding is cleared; if audit persistence fails the clear does not happen and the failure is reported explicitly. 30 new regression tests cover deleted-worktree recovery ordering, missing/ deleted/symlinked/mid-evaluation path changes, unknown-evidence cleanup, TTL boundary (before/at/after), interleaved and reconnected concurrent sessions, and audit-write failure/retry/idempotence/ordering. Issue #704 dotenv load-path prevention is intentionally NOT included. Full suite: 2695 passed, 6 skipped, 161 subtests passed. Co-Authored-By: Claude Fable 5 <[email protected]>	2026-07-13 16:40:58 -04:00
sysadminandClaude Fable 5	889931d553	feat(recovery): stale worktree binding demotion and crash-orphan lease recovery (Closes #702 ) An unhandled daemon crash skips teardown: the durable reviewer lease comment survives, the in-memory session lease dies, and the auto-reconnected daemon inherits a stale GITEA_ACTIVE_WORKTREE from its parent environment (PR #701 / branches/review-pr-654 incident). AC2 — safe clear/re-bind of stale bindings: - new stale_binding_recovery.py: classifies the active env binding (corroborated / unverified_inherited / provably_stale_missing_path / superseded_by_session_lease) and produces a fail-closed recovery plan; only provably stale bindings are clear-eligible - gitea_resolve_task_capability and daemon boot run the sanctioned recovery (durable audit via session state); runtime context surfaces the classification read-only - namespace_workspace_binding.resolve_namespace_workspace(verify_paths=…) demotes env-bound worktrees whose path no longer exists; mutation and runtime-context resolution always verify AC3 — recoverable lease cleanup after unexpected exit: - durable session-lease shadow (KIND_REVIEWER_SESSION_LEASE) written on sanctioned record/heartbeat, removed on sanctioned clear; a crash leaves provable orphan evidence (owner pid + session id) - assess_crashed_session_lease_orphan derives tri-state owner_process_alive: only a dead recorded owner pid proves exit; PID liveness is never ownership proof - diagnose/cleanup wrappers consume the shadow instead of passing owner_process_alive=None - new classification orphaned_expired_superseded_head: an expired superseded-head lease with no terminal review stops being a permanent ambiguous/wait; post-expiry it unlocks fresh acquisition, and guarded cleanup becomes eligible only with owner-exit evidence + clean/absent worktree + controller authorization + confirmation. Pre-expiry behavior is unchanged (fail-closed wait, no steal). Validation: tests/test_issue_702_stale_binding_lease_recovery.py (29 tests covering lost in-session leases, old-head leases, runtime/worktree mismatch, managed reconnect, safe expiry); full suite 2665 passed, 6 skipped, 161 subtests. Co-Authored-By: Claude Fable 5 <[email protected]>	2026-07-13 14:35:15 -04:00

sysadminandClaude Fable 5

c2fc2683b9

fix(recovery): address PR #703 review findings F1-F6 (#702 )

Fixes the six defects from the formal REQUEST_CHANGES review at
889931d553:

- F1: run sanctioned stale-binding recovery in
  gitea_resolve_task_capability BEFORE the terminal launcher probe, so a
  worktree removed mid-session can no longer wedge mutation resolution on
  'missing cwd' before recovery runs. The fail-closed probe block now also
  carries the binding classification evidence.
- F2: _resolve_preflight_workspace_path resolves with the same
  verify_paths existence checks as the canonical mutation context, and
  _get_workspace_porcelain returns a synthetic tracked-dirty sentinel when
  the workspace is missing or git fails — an uninspectable workspace can
  never read as clean/empty porcelain.
- F3: the orphaned_expired_superseded_head cleanup matrix now requires
  affirmative safe worktree evidence (worktree_clean=true or
  worktree_exists=false), aligned with the sibling orphaned_owner_missing
  gate and the diagnosis path; unknown evidence fails closed.
- F4: reviewer-session-lease shadows and stale-binding audit records are
  recovery-critical kinds exempt from the 4h session-state TTL; they
  persist until a sanctioned clear terminally reconciles them.
- F5: session-lease shadows are keyed by lease session id (collision-safe
  identity) with a list_states enumeration API; concurrent same-profile
  sessions can no longer overwrite or misattribute each other's crash
  evidence. Legacy single-slot records remain readable.
- F6: the durable audit record is persisted (status=pending) BEFORE the
  environment binding is cleared; if audit persistence fails the clear
  does not happen and the failure is reported explicitly.

30 new regression tests cover deleted-worktree recovery ordering, missing/
deleted/symlinked/mid-evaluation path changes, unknown-evidence cleanup,
TTL boundary (before/at/after), interleaved and reconnected concurrent
sessions, and audit-write failure/retry/idempotence/ordering.

Issue #704 dotenv load-path prevention is intentionally NOT included.

Full suite: 2695 passed, 6 skipped, 161 subtests passed.

Co-Authored-By: Claude Fable 5 <[email protected]>

2026-07-13 16:40:58 -04:00

sysadminandClaude Fable 5

889931d553

feat(recovery): stale worktree binding demotion and crash-orphan lease recovery (Closes #702 )

An unhandled daemon crash skips teardown: the durable reviewer lease
comment survives, the in-memory session lease dies, and the
auto-reconnected daemon inherits a stale GITEA_ACTIVE_WORKTREE from its
parent environment (PR #701 / branches/review-pr-654 incident).

AC2 — safe clear/re-bind of stale bindings:
- new stale_binding_recovery.py: classifies the active env binding
  (corroborated / unverified_inherited / provably_stale_missing_path /
  superseded_by_session_lease) and produces a fail-closed recovery plan;
  only provably stale bindings are clear-eligible
- gitea_resolve_task_capability and daemon boot run the sanctioned
  recovery (durable audit via session state); runtime context surfaces
  the classification read-only
- namespace_workspace_binding.resolve_namespace_workspace(verify_paths=…)
  demotes env-bound worktrees whose path no longer exists; mutation and
  runtime-context resolution always verify

AC3 — recoverable lease cleanup after unexpected exit:
- durable session-lease shadow (KIND_REVIEWER_SESSION_LEASE) written on
  sanctioned record/heartbeat, removed on sanctioned clear; a crash
  leaves provable orphan evidence (owner pid + session id)
- assess_crashed_session_lease_orphan derives tri-state
  owner_process_alive: only a dead recorded owner pid proves exit; PID
  liveness is never ownership proof
- diagnose/cleanup wrappers consume the shadow instead of passing
  owner_process_alive=None
- new classification orphaned_expired_superseded_head: an expired
  superseded-head lease with no terminal review stops being a permanent
  ambiguous/wait; post-expiry it unlocks fresh acquisition, and guarded
  cleanup becomes eligible only with owner-exit evidence + clean/absent
  worktree + controller authorization + confirmation. Pre-expiry
  behavior is unchanged (fail-closed wait, no steal).

Validation: tests/test_issue_702_stale_binding_lease_recovery.py (29
tests covering lost in-session leases, old-head leases, runtime/worktree
mismatch, managed reconnect, safe expiry); full suite 2665 passed,
6 skipped, 161 subtests.

Co-Authored-By: Claude Fable 5 <[email protected]>

2026-07-13 14:35:15 -04:00

feat(recovery): stale worktree binding demotion and crash-orphan lease recovery (Closes #702) #703