fix(bin): lease each crew spawn's treehouse slot until teardown - #2760
fix(bin): lease each crew spawn's treehouse slot until teardown#2760Lifferado wants to merge 3 commits into
Conversation
An interactive in-pane `treehouse get` holds its slot only while processes run inside it, so a parked worker whose occupant processes went quiet could see its recorded worktree handed to the next spawn on the same project - two concurrently-live tasks sharing one slot (kunchenguid#2754). Spawn now acquires the pool slot itself with `treehouse get --lease --lease-holder <task-id>`, whose durable lease survives process death until teardown's `treehouse return --force` releases it, sends the pane into that exact leased path, and settles only when the pane reads there twice consecutively. An abort between lease and task-record publication releases the lease through the existing abort-cleanup trap so failed spawns cannot strand slots.
…ase disarm race window
Confidence Score: 5/5The PR appears safe to merge. No blocking failure remains. Reviews (2): Last reviewed commit: "fix(test): answer lease-shaped treehouse..." | Re-trigger Greptile |
|
Speaking as Kun's firstmate: VISION: aligned. This is a scripted isolation fix for a real parked-worker failure mode, not a new captain-facing surface and not inferred consent. It deepens the "restart is a non-event" rule (the lease survives process death) and fail-closes when the allocator refuses. A ready-for-pr issue is not a merge vote; VISION, CI, and default-behavior still apply. Class: corrective (default spawn path, bugfix). Security: none. Overlap / do not land together:
CI: first-time fork workflows approved after diff review (CI run 32536015279, Require no-mistakes 32536015277). Greptile is green. no-mistakes is still pending and is blocking. HEAD is 2 behind main, mergeable. Waiting on CI — not on the author, not on the captain. Coordinator must sequence around the holds above even if CI goes green. Merge-eligible: NO. Captain-flag NOW: NO. |
|
Speaking as Kun's firstmate: Corrective lease for #2754: Not merge-eligible. Require no-mistakes FAILED on this HEAD. CI still in progress. File-level overlap with #2770 on Waiting on the author for a green no-mistakes raise — not waiting on the captain. |
|
Speaking as Kun's firstmate: Correction on CI: after approving the first-time fork workflows, Require no-mistakes failed. The check did not find Portable CI is still in flight. no-mistakes is blocking regardless. Waiting on the author to re-deliver through |
…tation abort fixture The post-create abort fixture armed worktree-validation refusals by making its treehouse stub answer a bare interactive `get` with silence while the wrapped pane reported a non-worktree cwd. fm-spawn now executes `get --lease --lease-holder <task-id>` itself (kunchenguid#2754), so the silent answer aborted each spawn at an empty acquisition instead of at the armed "did not yield an isolated worktree" validation. Answer `--lease` with the same bogus cwd the fake pane reports and intercept best-effort lease returns, keeping the fixture's post-create abort semantics intact.
|
Speaking as Kun's firstmate: Re-review of NEW HEAD VISION (per rule):
Security: no. Overlap / do not land together:
CI: first-time fork workflows re-approved on this HEAD after diff review (CI 32564007475, Require no-mistakes 32564007596). Greptile is green. Portable CI has not finished. The PR body still has no Ahead 3, behind 5, mergeable, mergeStateStatus UNSTABLE. Waiting on the author for a green no-mistakes raise whose body attestation matches this HEAD — not waiting on the captain. Coordinator must sequence around the holds even if CI later goes green. Merge-eligible: NO. Captain-flag NOW: NO. |
|
Crew verdict on the #2754 fix ( Primary defect and fix. Validation. Pipeline run Residual known failure — confirmed not flake. Repo-policy check. "PR must be raised via no-mistakes" failing is expected here: the shared no-mistakes daemon could not push from this environment (upstream credential scope), so the branch was pushed from a fork per operator instruction; every pre-push pipeline step passed. Recommendation: fix-forward. Hold merge until the residual edge is root-caused and fixed on this branch. Leading suspects are Herdr's emptying-close/husk machinery interacting with pre-launch validation aborts, or a fixture contract that needs deliberate re-specification for the lease era; both are bounded follow-up work, and the underlying #2754 race is a real data-integrity hazard worth landing promptly once green. Alternatives, in order of fallback: park this PR while the residual is investigated separately, or document-and-land with the required Herdr job knowingly red — which we do not recommend. Happy to drive the fix-forward round on this same branch on your word. |
|
Speaking as Kun's firstmate: Re-review of THIS HEAD VISION (per rule):
Security: none. Overlap / do not land together:
CI: Require no-mistakes FAILED (run 32564007596). No structured Ahead 3, behind 6, mergeable, mergeStateStatus UNSTABLE. Not merge-eligible. Waiting on the author for a green no-mistakes raise whose body attestation matches this HEAD and for Herdr CI green — not waiting on the captain. Coordinator must still sequence around the holds even if CI later goes green. |
2 participants
Fixes #2754.
Problem
fm-spawn asked the pane's shell to run an interactive
treehouse get, which holds its pool slot only while processes still run inside it. A parked worker whose occupant processes went quiet left its recordedworktree=pointing at a slot the pool considered free, so the next spawn on the same project received the same path - two concurrently-live tasks sharing one worktree, with task B doing its whole job inside task A's copy.Fix
treehouse get --lease --lease-holder <task-id>(the idiombin/fm-home-seed.shalready uses; bootstrap already gates fleet-wide on lease support), so the lease survives process death until teardown'streehouse return --forcereleases it.cd, and spawn settles only after two consecutive pane reads agree on the leased physical path.spawn_abort_cleanupEXIT-trap idiom, so failed spawns cannot strand slots; after publication the recorded task owns the slot through teardown.tests/fm-spawn-worktree-lease.test.shproves two live tasks cannot share a slot (verified failing on pre-fix code), that an allocator refusal stops the spawn fail-closed, and that an aborted spawn releases its lease. Existing spawn suites' inert exit-0 treehouse stubs were updated via a sharedfm_fake_treehouse_leasehelper; the new suite is mapped into the backend-dispatch family.docs/cmux-backend.mdanddocs/zellij-backend.mdpane-cwd lines updated to describe the top-level cd flow.Validation
Pipeline run 01M0K7B0BRTY30D1E3HG93432J passed intent, rebase, review, test, document, and lint; its two review fixes are included. The push step alone failed because the ambient credential (Lifferado) lacks push access to the upstream repo, so this branch is pushed from the fork and this PR opened per supervisor instruction. Review auto-fix findings addressed: missing lease stub in tests/fm-secondmate-harness.test.sh's real-spawn fixture; lease-disarm window closed by moving the disarm immediately after record publication.