morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[PR #4346] [CLOSED] fix(process): settle missing run tokens after confirmed exit #6190

New issue

Closed

opened 2026-10-31 01:12:33 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 01:12:33 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/4346
Author: @cold-atom
Created: 10/16/2026
Status: ❌ Closed

Base: main ← Head: fix/4322-linux-exit-race

📝 Commits (10+)

b159a80 fix(process): settle missing run tokens after confirmed exit
233bc47 fix(process): validate refreshed groups and missing-token sweeps
ba85f7b fix(process): reconcile fresh cleanup proofs and lifecycle checks
029bc1d chore: merge main lifecycle fixes and preserve CI phase boundaries
0e5029a fix(process): replan fresh groups without blocking verified peers
c5c8158 test(process): preserve minimal CLI capture under host uncertainty
05bf6fb fix(process): clean verified peers during uncertain group refreshes
31faeac fix(process): retain complete sweep and lineage refreshes
693791c fix(process): preserve current cleanup proofs across replanning
e01966c fix(process): validate reparented children and discovery coverage

📊 Changes

38 files changed (+3812 additions, -523 deletions)

View changed files

📝 docs/process-capture.md (+56 -0)
📝 docs/testing.md (+8 -0)
📝 src/browser/PlaywrightBrowserScenarioProvider.test.ts (+17 -8)
📝 src/process/ExecFileOutput.test.ts (+10 -0)
📝 src/process/ExecFileOutput.ts (+26 -9)
📝 src/process/ProcessOwnership.identity.test.ts (+12 -9)
📝 src/process/ProcessOwnership.observation.test.ts (+254 -5)
📝 src/process/ProcessOwnership.part3.test.ts (+79 -64)
➕ src/process/ProcessOwnership.refresh.test.ts (+1270 -0)
📝 src/process/ProcessOwnership.test.ts (+19 -5)
📝 src/process/ProcessOwnership.ts (+921 -212)
📝 src/process/ProcessOwnership.validation.test.ts (+154 -0)
📝 src/process/ProcessOwnershipObservation.ts (+200 -129)
📝 src/process/ProcessOwnershipProcessTree.ts (+32 -1)
➕ src/process/ProcessOwnershipRefresh.ts (+232 -0)
📝 src/process/ProcessRunTokenObservations.ts (+14 -0)
📝 tests/acceptance/applications/applicationWorkflowCli.test.ts (+5 -1)
📝 tests/acceptance/applications/exportedFunctionBindingsCli.test.ts (+5 -1)
📝 tests/acceptance/applications/javascriptEndpointPayload.test.ts (+2 -1)
📝 tests/acceptance/applications/javascriptEventPayload.test.ts (+2 -1)

...and 18 more files

📄 Description

Summary

Settle missing run tokens only after fresh process evidence confirms exit. Preserve refreshed membership, reparented owned children, and current ownership proofs through cleanup and lineage observation; retain incomplete cleanup for retry.

Fixes #4322. Related lifecycle audit: #4227.

Problem and expected behavior

On Linux, a child can exit between the process-table snapshot and its /proc/PID/environ read. A readable environment without the run token was classified as a foreign-token mismatch, preventing cleanup of an already-exited process. The issue's real-Node reproduction recorded six initial failures in 100 cases, with all post-exit retries completing; those counts describe that run, not a failure-probability estimate.

Fresh exit proof must settle only the exited process. Surviving and newly discovered members still require ownership validation. Missing tokens, foreign tokens, PID reuse, unavailable inspection, and exhausted discovery coverage must never authorize signaling or a successful cleanup claim.

Change and scope

Share missing-token classification and retain complete parsed process tables across cleanup, sweep settlement, and lineage observation. Bound discovery and replanning, preserve captured start identities, and reconcile earlier failures only against later checked ownership or positive exit proof. Clean independently verified peers while retaining unresolved groups and temporary roots.

The latest follow-up fixes reparented-child discovery in generic cleanup and lineage observation. A shared boundary examines newly observed rows and changed parent/group relationships, validates tokens together with native start identities, and retains positively owned children even when they no longer link to the old parent. Stable unrelated rows remain outside generic discovery. Pre-signal reconciliation keeps the earlier snapshot rather than replacing it before comparing fresh evidence.

Follow-up 6054004fb settles candidates that exit during token or identity reads, carries their complete refreshed tables into bounded discovery, and reuses the existing token retry limits with pinned start identities and a final liveness read. The comparison advances with examined snapshots while retaining owned groups. Generic discovery now shares the token sweep's existing proven-environment-withholding rule and retains those diagnostics; same-UID denial remains unresolved. Positive JavaScript stdio fixtures use the shared caller-overridable run-token labeling boundary.

Report exhausted discovery as process-discovery-incomplete, separately from native identity failure. The Darwin host-cleanup assertion accepts this narrowly defined incomplete-coverage outcome while continuing to reject actual identity and foreign-token failures. Cleanup remains unsuccessful and resources stay retained.

Contract and boundary impact

Semantic owner and earliest changed stage: shared process-ownership inspection, after token/identity reads and process-table refreshes.
CLI and MCP/tool-catalog contract: existing capture results and cleanup_incomplete errors; input schemas and advertised operations are unchanged. Cleanup diagnostics distinguish discovery coverage from identity failure and retain affected PIDs and source reasons.
Provider, bridge, target-format, or platform compatibility: existing POSIX process cleanup and lineage consumers. Native Darwin token/start-identity readers are reused; Windows P0 authority is unchanged.
Evidence, artifact, provenance, or reconstruction contract: preserve completed observations, selected inputs, cleanup diagnostics, and retained resources. Incomplete cleanup does not become successful capture Evidence.
Process execution, authorization, cleanup, or containment impact: signal only validated owned groups. Newly discovered rows are candidates, not signaling authority; foreign processes survive and unavailable proof stays unresolved.
Generated metadata, package, or installation impact: owning process/testing documentation updated; no dependency, version, installer, or authored catalog-schema changes. Generated outputs remain uncommitted.

Evidence and regression coverage

Tests added or updated: real Linux procfs exit reads; planning/pre-signal replacements; detached and reparented children; owned/foreign/missing-token controls; PID reuse and unavailable identities; bounded churn; cancellation during settlement/finalization; mixed-peer cleanup and retained-root retry.
Base reproduction or other evidence: before the latest correction, ten new controls failed: generic cleanup omitted reparented children or accepted unavailable ownership, and lineage omitted newly observed children. All ten pass after the shared discovery correction. Earlier review controls reproduced stale ownership failures and missing refreshed groups on 31faeac.
Review follow-up reproduction: eight additional controls failed on the e01966cd4 implementation when a newly observed child exited during token/identity inspection or revealed another replacement. The corrected owner settles the exit and examines replacements. Additional controls cover token recovery versus PID reuse, final-table denial after recovery, mixed discovered groups, bounded replacement, and foreign-UID versus same-UID permission denial.
User-visible CLI/MCP output: exhausted discovery now reports process ownership discovery could not complete within its retry budget; unexamined live candidates .... A completed capture retains exit code zero and exact output as partial observations, reports failed cleanup, and keeps its temporary root until the owning retry succeeds. Serialized error projection preserves those same facts.
Remaining proof gaps: local execution is Linux x64. Reparenting and discovery-exhaustion interleavings use controlled production seams; they are not native macOS reproductions. Real Hopper/Ghidra/JADX and local Windows/macOS engine acceptance were not performed. A reduced real-worker probe identified unrelated live ZapZap/QtWebEngine children with missing tokens as local host interference. Those observations remain unresolved; final boundary/package verification used an isolated process namespace. The still-live Chromium token-visibility issue #4282 remains separate.

For evidence-bearing changes:

Observed results, source-derived reasoning, and unverified claims remain distinguishable.
Caller choices, artifact identity, source provenance, and failed attempts remain preserved.
Unsupported, incomplete, unavailable, or uncertain outcomes remain visible.

Validation performed

Latest follow-up: 6054004fb; Linux x64, Node 24.18.0, npm 11.16.0.

npm run test:local -- src/process/ProcessOwnership.refresh.test.ts src/process/ProcessOwnership.identity.test.ts src/process/ProcessOwnership.validation.test.ts src/process/ProcessOwnership.test.ts src/process/ProcessOwnership.part2.test.ts src/process/ProcessOwnership.part3.test.ts src/process/ProcessOwnership.observation.test.ts src/process/ProcessOwnership.runId.test.ts src/process/capture/ProcessCaptureLifecycle.test.ts src/process/ProviderProcessOutput.test.ts — 203 passed across ten files. The 65-case refresh file was rerun successfully after extracting its shared native-identity fixture for lint.
Focused CLI/MCP, JavaScript, process, and acceptance coverage — 414 passed across 28 files; one Darwin-only case skipped. Includes every failing JavaScript family from the previous CI logs, compiled finalization/cancellation workflows, and related fixture consumers. Execution details and the native reaping correction are below.
npm run verify:package — passed in an isolated process namespace with a reaping init: archive/install/update, dedicated and routed JavaScript analysis, managed/artifact CLI, setup/uninstall, 207 MCP tools, Evidence, and verified empty verifier lineage.
npm run check — passed typecheck, lint, formatting, unused-code/metadata checks, module boundaries, and architecture guards.
npm run check:fast — passed in the pre-push hook.
npm run docs:check — passed, including five README consistency tests.
npm run verify:test-discovery — all 1,413 test files discovered exactly once.
git diff --check — passed.
Fresh current-head CI — pending. At e01966cd4, the Apple lane and Darwin/Windows package lanes passed. Linux package verification and JavaScript tests failed at shared cleanup; the cancelled shards also contained cleanup failures, and Portable tests/CI required failed as aggregate gates. That run does not establish verification of the latest follow-up.

Focused commands and execution context

The following selection ran under unshare --user --map-current-user --pid --fork --mount-proc:

npm run test:focused -- tests/boundary/mcp/javascriptLiteralBudget.test.ts tests/boundary/filesystem/javascriptHtmlResourcePaths.test.ts tests/boundary/filesystem/javascript-applications/javascriptModuleRelationships.test.ts tests/acceptance/applications/applicationWorkflowCli.test.ts tests/boundary/filesystem/javascript-applications/electronApplicationAnalysis.test.ts tests/boundary/filesystem/javascriptApplicationWorkflows.test.ts tests/boundary/filesystem/javascriptExportShapeComparison.test.ts tests/acceptance/applications/exportedFunctionBindingsCli.test.ts tests/boundary/javascript/javascriptApplicationCancellation.test.ts tests/boundary/filesystem/javascript-applications/javascriptRuntimeReconciliation.test.ts tests/boundary/process/ownedCommand.test.ts tests/acceptance/applications/javascriptEndpointPayload.test.ts tests/acceptance/applications/javascriptEventPayload.test.ts tests/acceptance/applications/javascriptFeatureTraceSeedSelectionCli.test.ts tests/boundary/mcp/javascriptNativeHandoffIdentity.test.ts tests/boundary/mcp/javascriptLiteralPayload.test.ts tests/boundary/mcp/javascriptSourceSelection.test.ts tests/boundary/mcp/javascriptAnalysisResources.test.ts tests/boundary/cli/cliCompileCache.test.ts tests/boundary/process/providerProcess.test.ts tests/boundary/process/processCaptureLifecycle.test.ts tests/boundary/process/processCaptureCancellationAdapters.test.ts tests/boundary/process/processCli.test.ts tests/boundary/mcp/processEvidenceIdentityMcp.test.ts tests/boundary/mcp/processTraceAdaptersParity.test.ts tests/boundary/mcp/sessionMcp.test.ts tests/boundary/cli/finishAnalysisCommand.test.ts tests/acceptance/process/processFinalization.test.ts

The initial namespace selection returned 411 passed, three failed, and one skipped. All JavaScript/CLI/MCP cases passed; three native PID-exit assertions encountered adopted zombies because npm was the non-reaping namespace PID 1. With a minimal reaping init, npm run test:focused -- tests/boundary/process/providerProcess.test.ts tests/boundary/process/ownedCommand.test.ts passed all 45 tests, with one Darwin-only skip. The 414-pass coverage above is the union of verified file outcomes, not a claim that the initial aggregate command exited successfully. No assertions, retry counts, timeouts, or production ownership rules were relaxed for isolation.

Controlled cleanup and lineage cost probe

Twenty completed real-Node tasks per revision in an isolated process namespace with a reaping init, each with first/repeated lineage observation, generic or swept cleanup, and a post-exit retry. The candidate scope contains two source-owned processes; Linux token/start-identity reads and signals remain real. Base 693791cdd / corrected source: 2.15 / 2.31 s elapsed, 2.48 / 2.73 s process-family CPU, and 188.3 / 220.0 MiB sampled peak family RSS. Mean first lineage observation: 7.55 / 8.61 ms; repeated observation: 7.09 / 8.08 ms.

Fresh target processes were used and Node compile caching was disabled. Source-loader and namespace/init overhead is included; OS/transpiler cache conditions were uncontrolled, so these are not isolated cold/warm workflow measurements. Nominal RSS sampling was 5 ms, with zero/one unavailable process samples; family RSS can double-count shared pages. This pair establishes completed-work cost evidence, not a speedup or memory-improvement claim. Agent tokens, full CLI/MCP traffic, provider-analysis costs, and reparenting-path performance are unmeasured.

Compatibility, safety, and release

Breaking changes or migration steps: none; missing tokens remain uncertainty, and discovery diagnostics become more specific.
Real provider or OS coverage: real Linux Node/process-boundary and compiled CLI/MCP workflows verified above. Native macOS and Windows coverage remains subject to current-head CI; no local engine-acceptance claim.
Package or release metadata impact: no dependency/version edits or committed build artifacts; owning documentation updated.
Security, privacy, process, or containment review: existing cleanup authority only. Preserve explicit caller tokens, deliberately missing-token controls, and unrelated processes. Do not infer ownership from a name, path, parent link, or recycled PID alone; retain resources while cleanup is unresolved.

Review checklist

This PR addresses a reproduced process-cleanup problem and links its issue.
The PR has one cleanup-correctness outcome and the title follows type(scope): outcome.
Regressions cover changed observable behavior and meaningful ownership, cancellation, coverage, and retry failures.
Owning documentation is updated; generated outputs are excluded.
User-visible cleanup diagnostics and verification limits are recorded above.
The final diff was checked for unrelated changes, secrets, and unsupported claims.

Author readiness

Human owner: @cold-atom

I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work.
I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps.
I declare this PR ready for initial maintainer review.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/4346 **Author:** [@cold-atom](https://github.com/cold-atom) **Created:** 10/16/2026 **Status:** ❌ Closed **Base:** `main` ← **Head:** `fix/4322-linux-exit-race` --- ### 📝 Commits (10+) - [`b159a80`](https://github.com/morluto/rea/commit/b159a80689bd6f972d0a08a8e6c842ec364f88fb) fix(process): settle missing run tokens after confirmed exit - [`233bc47`](https://github.com/morluto/rea/commit/233bc4766d75f35f1b570f07a1a16d997ef0e501) fix(process): validate refreshed groups and missing-token sweeps - [`ba85f7b`](https://github.com/morluto/rea/commit/ba85f7b7380b76a8ef25bfd55e87e88142338802) fix(process): reconcile fresh cleanup proofs and lifecycle checks - [`029bc1d`](https://github.com/morluto/rea/commit/029bc1d98f8f0ab2a21a2ffdcca143b14610549c) chore: merge main lifecycle fixes and preserve CI phase boundaries - [`0e5029a`](https://github.com/morluto/rea/commit/0e5029a280b98a2e40f1c94c65536e413ea0313a) fix(process): replan fresh groups without blocking verified peers - [`c5c8158`](https://github.com/morluto/rea/commit/c5c8158bb110550d58d0814b7ce1610ea9103145) test(process): preserve minimal CLI capture under host uncertainty - [`05bf6fb`](https://github.com/morluto/rea/commit/05bf6fb8db8529016bd7b77b890630d0f6219dc3) fix(process): clean verified peers during uncertain group refreshes - [`31faeac`](https://github.com/morluto/rea/commit/31faeac00ac1c31ed80bfd3fee2a632e75986495) fix(process): retain complete sweep and lineage refreshes - [`693791c`](https://github.com/morluto/rea/commit/693791cdd3d1c57104e584c1f797be643bd5b476) fix(process): preserve current cleanup proofs across replanning - [`e01966c`](https://github.com/morluto/rea/commit/e01966cd48d447a789a9b41f0b75ccee0415cc35) fix(process): validate reparented children and discovery coverage ### 📊 Changes **38 files changed** (+3812 additions, -523 deletions) <details> <summary>View changed files</summary> 📝 `docs/process-capture.md` (+56 -0) 📝 `docs/testing.md` (+8 -0) 📝 `src/browser/PlaywrightBrowserScenarioProvider.test.ts` (+17 -8) 📝 `src/process/ExecFileOutput.test.ts` (+10 -0) 📝 `src/process/ExecFileOutput.ts` (+26 -9) 📝 `src/process/ProcessOwnership.identity.test.ts` (+12 -9) 📝 `src/process/ProcessOwnership.observation.test.ts` (+254 -5) 📝 `src/process/ProcessOwnership.part3.test.ts` (+79 -64) ➕ `src/process/ProcessOwnership.refresh.test.ts` (+1270 -0) 📝 `src/process/ProcessOwnership.test.ts` (+19 -5) 📝 `src/process/ProcessOwnership.ts` (+921 -212) 📝 `src/process/ProcessOwnership.validation.test.ts` (+154 -0) 📝 `src/process/ProcessOwnershipObservation.ts` (+200 -129) 📝 `src/process/ProcessOwnershipProcessTree.ts` (+32 -1) ➕ `src/process/ProcessOwnershipRefresh.ts` (+232 -0) 📝 `src/process/ProcessRunTokenObservations.ts` (+14 -0) 📝 `tests/acceptance/applications/applicationWorkflowCli.test.ts` (+5 -1) 📝 `tests/acceptance/applications/exportedFunctionBindingsCli.test.ts` (+5 -1) 📝 `tests/acceptance/applications/javascriptEndpointPayload.test.ts` (+2 -1) 📝 `tests/acceptance/applications/javascriptEventPayload.test.ts` (+2 -1) _...and 18 more files_ </details> ### 📄 Description ## Summary Settle missing run tokens only after fresh process evidence confirms exit. Preserve refreshed membership, reparented owned children, and current ownership proofs through cleanup and lineage observation; retain incomplete cleanup for retry. Fixes #4322. Related lifecycle audit: #4227. ## Problem and expected behavior On Linux, a child can exit between the process-table snapshot and its `/proc/PID/environ` read. A readable environment without the run token was classified as a foreign-token mismatch, preventing cleanup of an already-exited process. The issue's real-Node reproduction recorded six initial failures in 100 cases, with all post-exit retries completing; those counts describe that run, not a failure-probability estimate. Fresh exit proof must settle only the exited process. Surviving and newly discovered members still require ownership validation. Missing tokens, foreign tokens, PID reuse, unavailable inspection, and exhausted discovery coverage must never authorize signaling or a successful cleanup claim. ## Change and scope Share missing-token classification and retain complete parsed process tables across cleanup, sweep settlement, and lineage observation. Bound discovery and replanning, preserve captured start identities, and reconcile earlier failures only against later checked ownership or positive exit proof. Clean independently verified peers while retaining unresolved groups and temporary roots. The latest follow-up fixes reparented-child discovery in generic cleanup and lineage observation. A shared boundary examines newly observed rows and changed parent/group relationships, validates tokens together with native start identities, and retains positively owned children even when they no longer link to the old parent. Stable unrelated rows remain outside generic discovery. Pre-signal reconciliation keeps the earlier snapshot rather than replacing it before comparing fresh evidence. Follow-up `6054004fb` settles candidates that exit during token or identity reads, carries their complete refreshed tables into bounded discovery, and reuses the existing token retry limits with pinned start identities and a final liveness read. The comparison advances with examined snapshots while retaining owned groups. Generic discovery now shares the token sweep's existing proven-environment-withholding rule and retains those diagnostics; same-UID denial remains unresolved. Positive JavaScript stdio fixtures use the shared caller-overridable run-token labeling boundary. Report exhausted discovery as `process-discovery-incomplete`, separately from native identity failure. The Darwin host-cleanup assertion accepts this narrowly defined incomplete-coverage outcome while continuing to reject actual identity and foreign-token failures. Cleanup remains unsuccessful and resources stay retained. ## Contract and boundary impact - **Semantic owner and earliest changed stage:** shared process-ownership inspection, after token/identity reads and process-table refreshes. - **CLI and MCP/tool-catalog contract:** existing capture results and `cleanup_incomplete` errors; input schemas and advertised operations are unchanged. Cleanup diagnostics distinguish discovery coverage from identity failure and retain affected PIDs and source reasons. - **Provider, bridge, target-format, or platform compatibility:** existing POSIX process cleanup and lineage consumers. Native Darwin token/start-identity readers are reused; Windows P0 authority is unchanged. - **Evidence, artifact, provenance, or reconstruction contract:** preserve completed observations, selected inputs, cleanup diagnostics, and retained resources. Incomplete cleanup does not become successful capture Evidence. - **Process execution, authorization, cleanup, or containment impact:** signal only validated owned groups. Newly discovered rows are candidates, not signaling authority; foreign processes survive and unavailable proof stays unresolved. - **Generated metadata, package, or installation impact:** owning process/testing documentation updated; no dependency, version, installer, or authored catalog-schema changes. Generated outputs remain uncommitted. ## Evidence and regression coverage - **Tests added or updated:** real Linux procfs exit reads; planning/pre-signal replacements; detached and reparented children; owned/foreign/missing-token controls; PID reuse and unavailable identities; bounded churn; cancellation during settlement/finalization; mixed-peer cleanup and retained-root retry. - **Base reproduction or other evidence:** before the latest correction, ten new controls failed: generic cleanup omitted reparented children or accepted unavailable ownership, and lineage omitted newly observed children. All ten pass after the shared discovery correction. Earlier review controls reproduced stale ownership failures and missing refreshed groups on `31faeac`. - **Review follow-up reproduction:** eight additional controls failed on the `e01966cd4` implementation when a newly observed child exited during token/identity inspection or revealed another replacement. The corrected owner settles the exit and examines replacements. Additional controls cover token recovery versus PID reuse, final-table denial after recovery, mixed discovered groups, bounded replacement, and foreign-UID versus same-UID permission denial. - **User-visible CLI/MCP output:** exhausted discovery now reports `process ownership discovery could not complete within its retry budget; unexamined live candidates ...`. A completed capture retains exit code zero and exact output as partial observations, reports failed cleanup, and keeps its temporary root until the owning retry succeeds. Serialized error projection preserves those same facts. - **Remaining proof gaps:** local execution is Linux x64. Reparenting and discovery-exhaustion interleavings use controlled production seams; they are not native macOS reproductions. Real Hopper/Ghidra/JADX and local Windows/macOS engine acceptance were not performed. A reduced real-worker probe identified unrelated live ZapZap/QtWebEngine children with missing tokens as local host interference. Those observations remain unresolved; final boundary/package verification used an isolated process namespace. The still-live Chromium token-visibility issue #4282 remains separate. For evidence-bearing changes: - Observed results, source-derived reasoning, and unverified claims remain distinguishable. - Caller choices, artifact identity, source provenance, and failed attempts remain preserved. - Unsupported, incomplete, unavailable, or uncertain outcomes remain visible. ## Validation performed Latest follow-up: `6054004fb`; Linux x64, Node 24.18.0, npm 11.16.0. - `npm run test:local -- src/process/ProcessOwnership.refresh.test.ts src/process/ProcessOwnership.identity.test.ts src/process/ProcessOwnership.validation.test.ts src/process/ProcessOwnership.test.ts src/process/ProcessOwnership.part2.test.ts src/process/ProcessOwnership.part3.test.ts src/process/ProcessOwnership.observation.test.ts src/process/ProcessOwnership.runId.test.ts src/process/capture/ProcessCaptureLifecycle.test.ts src/process/ProviderProcessOutput.test.ts` — 203 passed across ten files. The 65-case refresh file was rerun successfully after extracting its shared native-identity fixture for lint. - Focused CLI/MCP, JavaScript, process, and acceptance coverage — 414 passed across 28 files; one Darwin-only case skipped. Includes every failing JavaScript family from the previous CI logs, compiled finalization/cancellation workflows, and related fixture consumers. Execution details and the native reaping correction are below. - `npm run verify:package` — passed in an isolated process namespace with a reaping init: archive/install/update, dedicated and routed JavaScript analysis, managed/artifact CLI, setup/uninstall, 207 MCP tools, Evidence, and verified empty verifier lineage. - `npm run check` — passed typecheck, lint, formatting, unused-code/metadata checks, module boundaries, and architecture guards. - `npm run check:fast` — passed in the pre-push hook. - `npm run docs:check` — passed, including five README consistency tests. - `npm run verify:test-discovery` — all 1,413 test files discovered exactly once. - `git diff --check` — passed. - Fresh current-head CI — pending. At [`e01966cd4`](https://github.com/morluto/rea/actions/runs/38891463915), the Apple lane and Darwin/Windows package lanes passed. Linux package verification and JavaScript tests failed at shared cleanup; the cancelled shards also contained cleanup failures, and Portable tests/CI required failed as aggregate gates. That run does not establish verification of the latest follow-up. <details> <summary>Focused commands and execution context</summary> The following selection ran under `unshare --user --map-current-user --pid --fork --mount-proc`: ```text npm run test:focused -- tests/boundary/mcp/javascriptLiteralBudget.test.ts tests/boundary/filesystem/javascriptHtmlResourcePaths.test.ts tests/boundary/filesystem/javascript-applications/javascriptModuleRelationships.test.ts tests/acceptance/applications/applicationWorkflowCli.test.ts tests/boundary/filesystem/javascript-applications/electronApplicationAnalysis.test.ts tests/boundary/filesystem/javascriptApplicationWorkflows.test.ts tests/boundary/filesystem/javascriptExportShapeComparison.test.ts tests/acceptance/applications/exportedFunctionBindingsCli.test.ts tests/boundary/javascript/javascriptApplicationCancellation.test.ts tests/boundary/filesystem/javascript-applications/javascriptRuntimeReconciliation.test.ts tests/boundary/process/ownedCommand.test.ts tests/acceptance/applications/javascriptEndpointPayload.test.ts tests/acceptance/applications/javascriptEventPayload.test.ts tests/acceptance/applications/javascriptFeatureTraceSeedSelectionCli.test.ts tests/boundary/mcp/javascriptNativeHandoffIdentity.test.ts tests/boundary/mcp/javascriptLiteralPayload.test.ts tests/boundary/mcp/javascriptSourceSelection.test.ts tests/boundary/mcp/javascriptAnalysisResources.test.ts tests/boundary/cli/cliCompileCache.test.ts tests/boundary/process/providerProcess.test.ts tests/boundary/process/processCaptureLifecycle.test.ts tests/boundary/process/processCaptureCancellationAdapters.test.ts tests/boundary/process/processCli.test.ts tests/boundary/mcp/processEvidenceIdentityMcp.test.ts tests/boundary/mcp/processTraceAdaptersParity.test.ts tests/boundary/mcp/sessionMcp.test.ts tests/boundary/cli/finishAnalysisCommand.test.ts tests/acceptance/process/processFinalization.test.ts ``` The initial namespace selection returned 411 passed, three failed, and one skipped. All JavaScript/CLI/MCP cases passed; three native PID-exit assertions encountered adopted zombies because npm was the non-reaping namespace PID 1. With a minimal reaping init, `npm run test:focused -- tests/boundary/process/providerProcess.test.ts tests/boundary/process/ownedCommand.test.ts` passed all 45 tests, with one Darwin-only skip. The 414-pass coverage above is the union of verified file outcomes, not a claim that the initial aggregate command exited successfully. No assertions, retry counts, timeouts, or production ownership rules were relaxed for isolation. </details> <details> <summary>Controlled cleanup and lineage cost probe</summary> Twenty completed real-Node tasks per revision in an isolated process namespace with a reaping init, each with first/repeated lineage observation, generic or swept cleanup, and a post-exit retry. The candidate scope contains two source-owned processes; Linux token/start-identity reads and signals remain real. Base `693791cdd` / corrected source: 2.15 / 2.31 s elapsed, 2.48 / 2.73 s process-family CPU, and 188.3 / 220.0 MiB sampled peak family RSS. Mean first lineage observation: 7.55 / 8.61 ms; repeated observation: 7.09 / 8.08 ms. Fresh target processes were used and Node compile caching was disabled. Source-loader and namespace/init overhead is included; OS/transpiler cache conditions were uncontrolled, so these are not isolated cold/warm workflow measurements. Nominal RSS sampling was 5 ms, with zero/one unavailable process samples; family RSS can double-count shared pages. This pair establishes completed-work cost evidence, not a speedup or memory-improvement claim. Agent tokens, full CLI/MCP traffic, provider-analysis costs, and reparenting-path performance are unmeasured. </details> ## Compatibility, safety, and release - **Breaking changes or migration steps:** none; missing tokens remain uncertainty, and discovery diagnostics become more specific. - **Real provider or OS coverage:** real Linux Node/process-boundary and compiled CLI/MCP workflows verified above. Native macOS and Windows coverage remains subject to current-head CI; no local engine-acceptance claim. - **Package or release metadata impact:** no dependency/version edits or committed build artifacts; owning documentation updated. - **Security, privacy, process, or containment review:** existing cleanup authority only. Preserve explicit caller tokens, deliberately missing-token controls, and unrelated processes. Do not infer ownership from a name, path, parent link, or recycled PID alone; retain resources while cleanup is unresolved. ## Review checklist - This PR addresses a reproduced process-cleanup problem and links its issue. - The PR has one cleanup-correctness outcome and the title follows `type(scope): outcome`. - Regressions cover changed observable behavior and meaningful ownership, cancellation, coverage, and retry failures. - Owning documentation is updated; generated outputs are excluded. - User-visible cleanup diagnostics and verification limits are recorded above. - The final diff was checked for unrelated changes, secrets, and unsupported claims. <details> <summary>Author readiness</summary> ## Author readiness Human owner: @cold-atom - [x] I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work. - [x] I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps. - [x] I declare this PR ready for initial maintainer review. </details> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-31 01:12:33 +00:00