Record run 11's completion, the capture loop, and the deployed state

Ten defects now, all fixed. The tenth was a five-second retry loop against a
blocked task that ran for twenty-six minutes and pinned the single last_error
slot to a dead task, which is F18 turning a small leak into a blind spot.

Run 11 went on through review, submission and merge without intervention, so
the frozen lifecycle is re-proven above every fix in this session.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CVbaKucEYBjMqVeUgJUsc1
This commit is contained in:
2026-08-28 17:58:20 +04:00
parent 44ff35aeb3
commit 1e8d55f933
+28 -3
View File
@@ -2073,6 +2073,7 @@ rewrite.
| F52 | `fb7135e` | A plan command outside project policy sealed anyway. The only caller of `VerificationPolicy.Allows` was `PlanPhaseCommands`, which runs when the implementer asks to verify: one phase and one rotation too late. | | F52 | `fb7135e` | A plan command outside project policy sealed anyway. The only caller of `VerificationPolicy.Allows` was `PlanPhaseCommands`, which runs when the implementer asks to verify: one phase and one rotation too late. |
| F53 | `d7e75e9` | Only a verified phase consulted `Stale`. A pending manual gate rendered "automated checks passed at 94bd45c3b5d6" against a tree at `7d04aef`. | | F53 | `d7e75e9` | Only a verified phase consulted `Stale`. A pending manual gate rendered "automated checks passed at 94bd45c3b5d6" against a tree at `7d04aef`. |
| F54 | `015764e` | The handoff prompt stated the 200-character limit for `NEXT`, `WHY` and `REMAINING`. The validator applies it to `OPEN Q` and `LEARNED` too. | | F54 | `015764e` | The handoff prompt stated the 200-character limit for `NEXT`, `WHY` and `REMAINING`. The validator applies it to `OPEN Q` and `LEARNED` too. |
| F56 | `44ff35a` | `publishCaptures` iterated every session the worker held, without checking the lease. Run 10's task was blocked and unleased for twenty-six minutes while this called the coordinator every five seconds and logged "409 Conflict: lease not owned" each time. It also kept the single `last_error` slot pinned to a dead task, hiding run 11's own failures. |
| F55 | `38aa073` | **A refused handoff had no feedback loop.** `PrepareRelease` read the report, the parser refused it, the worker recorded it in health, and the next boundary read the same bytes. Run 10 spent four leases there. `answerRefusedHandoff` now says why and drops the file, gated on a typed `ErrInvalidHandoffAnswer` so transport failures keep their retry. | | F55 | `38aa073` | **A refused handoff had no feedback loop.** `PrepareRelease` read the report, the parser refused it, the worker recorded it in health, and the next boundary read the same bytes. Run 10 spent four leases there. `answerRefusedHandoff` now says why and drops the file, gated on a typed `ErrInvalidHandoffAnswer` so transport failures keep their retry. |
F50, F51 and F54 are one shape: **a constraint the code enforces and no brief F50, F51 and F54 are one shape: **a constraint the code enforces and no brief
@@ -2084,6 +2085,23 @@ pattern `CLAUDE.md` names.
`Praxis`, `Hexis`, `manga-pipeline`, `orchestra`. Their plans still seal, but `Praxis`, `Hexis`, `manga-pipeline`, `orchestra`. Their plans still seal, but
only with manual verification. A `run:` line is now refused on the planner. only with manual verification. A `run:` line is now refused on the planner.
### Run 11 completed the lifecycle on the final build
The same task that produced the mismatch went on through review, submission and
merge without intervention. PR 16, receipt binds merge `bf0f287a` to submitted
`5bcffb33`. That is the frozen lifecycle re-proven above every fix in this
session.
### Deployed state at the freeze
| Half | Revision |
|---|---|
| Coordinator, homesrv container | `44ff35a` |
| Worker, workpc systemd | `44ff35a` |
Run 11 itself ran on `38aa073`. `44ff35a` is one commit above it, unit-tested
and deployed, not exercised by a full run.
### Recorded, not fixed ### Recorded, not fixed
- **The operator lifecycle actions lose a version race.** `block`, `release` - **The operator lifecycle actions lose a version race.** `block`, `release`
@@ -2092,9 +2110,16 @@ only with manual verification. A `run:` line is now refused on the planner.
the read and the append. They succeed once the task is quiet. the read and the append. They succeed once the task is quiet.
- **`master` carries a stale `TASK.md`.** F47 makes it harmless, but every - **`master` carries a stale `TASK.md`.** F47 makes it harmless, but every
pull request now shows a cosmetic `TASK.md` diff. pull request now shows a cosmetic `TASK.md` diff.
- **F18 is still open**, and it cost real diagnosis time here. The single - **F18 is still open**, and it cost real diagnosis time twice. The single
`last_error` slot held only the most recent failure, so the three earlier `last_error` slot held only the most recent failure, so run 7's three earlier
ones in run 7 were overwritten before they could be read. failures were overwritten before they could be read. In run 11 the slot was
pinned to a *different, blocked* task for twenty-six minutes (F56), so run
11's own expiry reason was never visible at all.
- **A release transaction whose lease has expired can never commit.** Run 10
ended this way: `PrepareRelease` succeeded, `Release` returned
`409 lease not owned`, and the transaction stayed in `anchor_pushed` across
every relaunch until `retry_limit`. The agent's completed work sat
uncommitted in the worktree throughout.
### Things that will bite ### Things that will bite