Runtime Host PID-known retirement can stop a successor and report the old epoch as retired #3594

Closed
#3602
Closed
Runtime Host PID-known retirement can stop a successor and report the old epoch as retired#3594
#3602
Assignees
CuSO41108
Labels
bugSomething isn't workinghelp wantedExtra attention is needed

Description

@Astro-Han
Astro-Han
opened on Aug 23, 2026

Follow-up to #3557, which is already merged (7f68af7655e5bbc74e70f531dea1acfca2e93dc9). This was recorded as a non-blocking [P3] during review and deliberately not treated as a merge hold; opening it so it does not get lost.

The gap

In the PID-known retirement path, packages/cli/src/runtime-host-service-manager.ts:380-417, the old Host is prepared and then backend.stop() is called without holding a State Root fence. Only the service.state === 'starting' branch assigns a rootFence.

If the old process exits abnormally in that window and systemd starts a successor, backend.stop() can stop the successor while the command then reports retirement using the old epoch and PID. The caller is told the host it named was retired; what actually happened is that a different, newer host was stopped.

The post-stop checks do not close this. verifyRuntimeHostRootReleased(root) and the stopped.active/state/pid inspection prove that no writer holds the root at that moment — they cannot prove an identity-continuous handoff, because the identity being asked about may already have been replaced.

Why the obvious fix is not enough

Re-reading identity after stop is too late: by then the successor has already been stopped and any writes it made in the window are unrecoverable. The correct shape is to hold the fence across the stop, or to model retirement as an explicit transition that fails when the observed identity is not the one that was prepared.

Acceptance criteria

  • A crash → restart interleaving test: prepare against a known PID, kill that process abnormally inside the window, let a successor come up, and assert the command does not stop the successor and does not report retirement of the old epoch/PID as success.
  • The State Root fence is held across backend.stop() on the PID-known path, not only on the starting path — or retirement is expressed as an explicit transition that rejects an identity mismatch.
  • The post-stop root-vacancy check is documented for what it actually proves (no current writer) rather than as evidence of a continuous handoff.

Severity

P3 as rated: the window is narrow, there is no concurrent writer, and no direct data corruption was demonstrated. It is a correctness gap in what the command claims happened, which is why it is worth fixing rather than shipping as understood behaviour.

Provenance

Found during #3557 review, with the fix direction corrected in a review addendum (5002040661) after the first proposed fix — a post-stop identity re-read — was shown to be too late. A second reviewer independently reproduced the same window afterwards and labelled it corroboration rather than an independent finding.

Metadata

Metadata

Assignees

Labels

bugSomething isn't workinghelp wantedExtra attention is needed

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions

    , 'i'); if (__m === '*' || __re.test(location.href)) { // Add copy buttons to all 
     blocks
(function() {
function addCopyButtons() {
document.querySelectorAll('pre code').forEach(function(codeBlock) {
if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;
codeBlock.parentElement.setAttribute('data-copy-added', 'true');
var btn = document.createElement('button');
btn.textContent = 'Copy';
btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';
btn.onmouseover = function() { this.style.opacity = '1'; };
btn.onmouseout = function() { this.style.opacity = '0.7'; };
btn.onclick = function() {
navigator.clipboard.writeText(codeBlock.textContent).then(function() {
btn.textContent = 'Copied!';
setTimeout(function() { btn.textContent = 'Copy'; }, 1500);
});
};
codeBlock.parentElement.style.position = 'relative';
codeBlock.parentElement.appendChild(btn);
});
}
addCopyButtons();
// Re-run on dynamic content
var observer = new MutationObserver(addCopyButtons);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

    Skip to content
    Runtime Host PID-known retirement can stop a successor and report the old epoch as retired #3594
    Closed
    #3602
    Closed
    Runtime Host PID-known retirement can stop a successor and report the old epoch as retired#3594
    #3602
    Assignees
    CuSO41108
    Labels
    bugSomething isn't workinghelp wantedExtra attention is needed
    Description
    @Astro-Han
    Astro-Han
    opened on Aug 23, 2026
    Follow-up to #3557, which is already merged (7f68af7655e5bbc74e70f531dea1acfca2e93dc9). This was recorded as a non-blocking [P3] during review and deliberately not treated as a merge hold; opening it so it does not get lost.
    The gap
    In the PID-known retirement path, packages/cli/src/runtime-host-service-manager.ts:380-417, the old Host is prepared and then backend.stop() is called without holding a State Root fence. Only the service.state === 'starting' branch assigns a rootFence.
    If the old process exits abnormally in that window and systemd starts a successor, backend.stop() can stop the successor while the command then reports retirement using the old epoch and PID. The caller is told the host it named was retired; what actually happened is that a different, newer host was stopped.
    The post-stop checks do not close this. verifyRuntimeHostRootReleased(root) and the stopped.active/state/pid inspection prove that no writer holds the root at that moment — they cannot prove an identity-continuous handoff, because the identity being asked about may already have been replaced.
    Why the obvious fix is not enough
    Re-reading identity after stop is too late: by then the successor has already been stopped and any writes it made in the window are unrecoverable. The correct shape is to hold the fence across the stop, or to model retirement as an explicit transition that fails when the observed identity is not the one that was prepared.
    Acceptance criteria
    • A crash → restart interleaving test: prepare against a known PID, kill that process abnormally inside the window, let a successor come up, and assert the command does not stop the successor and does not report retirement of the old epoch/PID as success.
    • The State Root fence is held across backend.stop() on the PID-known path, not only on the starting path — or retirement is expressed as an explicit transition that rejects an identity mismatch.
    • The post-stop root-vacancy check is documented for what it actually proves (no current writer) rather than as evidence of a continuous handoff.
    Severity
    P3 as rated: the window is narrow, there is no concurrent writer, and no direct data corruption was demonstrated. It is a correctness gap in what the command claims happened, which is why it is worth fixing rather than shipping as understood behaviour.
    Provenance
    Found during #3557 review, with the fix direction corrected in a review addendum (5002040661) after the first proposed fix — a post-stop identity re-read — was shown to be too late. A second reviewer independently reproduced the same window afterwards and labelled it corroboration rather than an independent finding.
    Metadata
    Metadata
    Assignees
    Labels
    bugSomething isn't workinghelp wantedExtra attention is needed
    Type
    No type
    Projects
    No projects
      Milestone
      No milestone
      Relationships
      None yet
      Development
      No branches or pull requests
      Issue actions
      
, 'i');
if (__m === '*' || __re.test(location.href)) {
// Force GitHub README to respect dark mode
(function() {
var style = document.createElement('style');
style.textContent = '
.markdown-body {
color-scheme: dark light;
}
.markdown-body pre { background: #161b22 !important; }
.markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }
.markdown-body table th, .markdown-body table td { border-color: #30363d !important; }
.markdown-body img { background: #0d1117; }
.markdown-body blockquote { border-left-color: #8b949e; }
.markdown-body hr { border-color: #30363d; }
';
document.head.appendChild(style);
})();
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

      Skip to content
      Runtime Host PID-known retirement can stop a successor and report the old epoch as retired #3594
      Closed
      #3602
      Closed
      Runtime Host PID-known retirement can stop a successor and report the old epoch as retired#3594
      #3602
      Assignees
      CuSO41108
      Labels
      bugSomething isn't workinghelp wantedExtra attention is needed
      Description
      @Astro-Han
      Astro-Han
      opened on Aug 23, 2026
      Follow-up to #3557, which is already merged (7f68af7655e5bbc74e70f531dea1acfca2e93dc9). This was recorded as a non-blocking [P3] during review and deliberately not treated as a merge hold; opening it so it does not get lost.
      The gap
      In the PID-known retirement path, packages/cli/src/runtime-host-service-manager.ts:380-417, the old Host is prepared and then backend.stop() is called without holding a State Root fence. Only the service.state === 'starting' branch assigns a rootFence.
      If the old process exits abnormally in that window and systemd starts a successor, backend.stop() can stop the successor while the command then reports retirement using the old epoch and PID. The caller is told the host it named was retired; what actually happened is that a different, newer host was stopped.
      The post-stop checks do not close this. verifyRuntimeHostRootReleased(root) and the stopped.active/state/pid inspection prove that no writer holds the root at that moment — they cannot prove an identity-continuous handoff, because the identity being asked about may already have been replaced.
      Why the obvious fix is not enough
      Re-reading identity after stop is too late: by then the successor has already been stopped and any writes it made in the window are unrecoverable. The correct shape is to hold the fence across the stop, or to model retirement as an explicit transition that fails when the observed identity is not the one that was prepared.
      Acceptance criteria
      • A crash → restart interleaving test: prepare against a known PID, kill that process abnormally inside the window, let a successor come up, and assert the command does not stop the successor and does not report retirement of the old epoch/PID as success.
      • The State Root fence is held across backend.stop() on the PID-known path, not only on the starting path — or retirement is expressed as an explicit transition that rejects an identity mismatch.
      • The post-stop root-vacancy check is documented for what it actually proves (no current writer) rather than as evidence of a continuous handoff.
      Severity
      P3 as rated: the window is narrow, there is no concurrent writer, and no direct data corruption was demonstrated. It is a correctness gap in what the command claims happened, which is why it is worth fixing rather than shipping as understood behaviour.
      Provenance
      Found during #3557 review, with the fix direction corrected in a review addendum (5002040661) after the first proposed fix — a post-stop identity re-read — was shown to be too late. A second reviewer independently reproduced the same window afterwards and labelled it corroboration rather than an independent finding.
      Metadata
      Metadata
      Assignees
      Labels
      bugSomething isn't workinghelp wantedExtra attention is needed
      Type
      No type
      Projects
      No projects
        Milestone
        No milestone
        Relationships
        None yet
        Development
        No branches or pull requests
        Issue actions
        
, 'i');
if (__m === '*' || __re.test(location.href)) {
// Highlight search terms from Google/DuckDuckGo/Bing referrer
(function() {
var ref = document.referrer;
var terms = [];
if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {
var url = new URL(ref);
var q = url.searchParams.get('q') || url.searchParams.get('p');
if (q) {
terms = q.split(/\s+/).filter(function(t) { return t.length > 2; });
}
}
if (terms.length === 0) return;
var style = document.createElement('style');
style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';
document.head.appendChild(style);
function highlight(node) {
if (node.nodeType === 3) { // text node
var text = node.textContent;
var found = false;
terms.forEach(function(term) {
var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\]\\]/g, '\\') + ')', 'gi');
if (regex.test(text)) {
found = true;
var frag = document.createDocumentFragment();
var parts = text.split(regex);
parts.forEach(function(part, i) {
if (i % 2 === 0) {
frag.appendChild(document.createTextNode(part));
} else {
var span = document.createElement('span');
span.className = 'userscript-highlight';
span.textContent = part;
frag.appendChild(span);
}
});
node.parentNode.replaceChild(frag, node);
}
});
} else if (node.nodeType === 1 && node.childNodes) { // element
var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];
if (!skipTags.includes(node.tagName)) {
Array.from(node.childNodes).forEach(highlight);
}
}
}
highlight(document.body);
// Re-highlight on dynamic content
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1 || node.nodeType === 3) highlight(node);
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

        Skip to content
        Runtime Host PID-known retirement can stop a successor and report the old epoch as retired #3594
        Closed
        #3602
        Closed
        Runtime Host PID-known retirement can stop a successor and report the old epoch as retired#3594
        #3602
        Assignees
        CuSO41108
        Labels
        bugSomething isn't workinghelp wantedExtra attention is needed
        Description
        @Astro-Han
        Astro-Han
        opened on Aug 23, 2026
        Follow-up to #3557, which is already merged (7f68af7655e5bbc74e70f531dea1acfca2e93dc9). This was recorded as a non-blocking [P3] during review and deliberately not treated as a merge hold; opening it so it does not get lost.
        The gap
        In the PID-known retirement path, packages/cli/src/runtime-host-service-manager.ts:380-417, the old Host is prepared and then backend.stop() is called without holding a State Root fence. Only the service.state === 'starting' branch assigns a rootFence.
        If the old process exits abnormally in that window and systemd starts a successor, backend.stop() can stop the successor while the command then reports retirement using the old epoch and PID. The caller is told the host it named was retired; what actually happened is that a different, newer host was stopped.
        The post-stop checks do not close this. verifyRuntimeHostRootReleased(root) and the stopped.active/state/pid inspection prove that no writer holds the root at that moment — they cannot prove an identity-continuous handoff, because the identity being asked about may already have been replaced.
        Why the obvious fix is not enough
        Re-reading identity after stop is too late: by then the successor has already been stopped and any writes it made in the window are unrecoverable. The correct shape is to hold the fence across the stop, or to model retirement as an explicit transition that fails when the observed identity is not the one that was prepared.
        Acceptance criteria
        • A crash → restart interleaving test: prepare against a known PID, kill that process abnormally inside the window, let a successor come up, and assert the command does not stop the successor and does not report retirement of the old epoch/PID as success.
        • The State Root fence is held across backend.stop() on the PID-known path, not only on the starting path — or retirement is expressed as an explicit transition that rejects an identity mismatch.
        • The post-stop root-vacancy check is documented for what it actually proves (no current writer) rather than as evidence of a continuous handoff.
        Severity
        P3 as rated: the window is narrow, there is no concurrent writer, and no direct data corruption was demonstrated. It is a correctness gap in what the command claims happened, which is why it is worth fixing rather than shipping as understood behaviour.
        Provenance
        Found during #3557 review, with the fix direction corrected in a review addendum (5002040661) after the first proposed fix — a post-stop identity re-read — was shown to be too late. A second reviewer independently reproduced the same window afterwards and labelled it corroboration rather than an independent finding.
        Metadata
        Metadata
        Assignees
        Labels
        bugSomething isn't workinghelp wantedExtra attention is needed
        Type
        No type
        Projects
        No projects
          Milestone
          No milestone
          Relationships
          None yet
          Development
          No branches or pull requests
          Issue actions
          
, 'i');
if (__m === '*' || __re.test(location.href)) {
// Strip utm_, fbclid, gclid, etc. from all links on page
(function() {
var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',
'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',
'ref', 'ref_src', 'source', 'medium', 'campaign'];
function cleanUrl(url) {
try {
var u = new URL(url, window.location.origin);
var changed = false;
trackingParams.forEach(function(p) {
if (u.searchParams.has(p)) {
u.searchParams.delete(p);
changed = true;
}
});
return changed ? u.toString() : url;
} catch (e) {
return url;
}
}
function cleanLinks() {
document.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
cleanLinks();
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1) {
if (node.tagName === 'A') cleanLinks();
node.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

          Skip to content
          Runtime Host PID-known retirement can stop a successor and report the old epoch as retired #3594
          Closed
          #3602
          Closed
          Runtime Host PID-known retirement can stop a successor and report the old epoch as retired#3594
          #3602
          Assignees
          CuSO41108
          Labels
          bugSomething isn't workinghelp wantedExtra attention is needed
          Description
          @Astro-Han
          Astro-Han
          opened on Aug 23, 2026
          Follow-up to #3557, which is already merged (7f68af7655e5bbc74e70f531dea1acfca2e93dc9). This was recorded as a non-blocking [P3] during review and deliberately not treated as a merge hold; opening it so it does not get lost.
          The gap
          In the PID-known retirement path, packages/cli/src/runtime-host-service-manager.ts:380-417, the old Host is prepared and then backend.stop() is called without holding a State Root fence. Only the service.state === 'starting' branch assigns a rootFence.
          If the old process exits abnormally in that window and systemd starts a successor, backend.stop() can stop the successor while the command then reports retirement using the old epoch and PID. The caller is told the host it named was retired; what actually happened is that a different, newer host was stopped.
          The post-stop checks do not close this. verifyRuntimeHostRootReleased(root) and the stopped.active/state/pid inspection prove that no writer holds the root at that moment — they cannot prove an identity-continuous handoff, because the identity being asked about may already have been replaced.
          Why the obvious fix is not enough
          Re-reading identity after stop is too late: by then the successor has already been stopped and any writes it made in the window are unrecoverable. The correct shape is to hold the fence across the stop, or to model retirement as an explicit transition that fails when the observed identity is not the one that was prepared.
          Acceptance criteria
          • A crash → restart interleaving test: prepare against a known PID, kill that process abnormally inside the window, let a successor come up, and assert the command does not stop the successor and does not report retirement of the old epoch/PID as success.
          • The State Root fence is held across backend.stop() on the PID-known path, not only on the starting path — or retirement is expressed as an explicit transition that rejects an identity mismatch.
          • The post-stop root-vacancy check is documented for what it actually proves (no current writer) rather than as evidence of a continuous handoff.
          Severity
          P3 as rated: the window is narrow, there is no concurrent writer, and no direct data corruption was demonstrated. It is a correctness gap in what the command claims happened, which is why it is worth fixing rather than shipping as understood behaviour.
          Provenance
          Found during #3557 review, with the fix direction corrected in a review addendum (5002040661) after the first proposed fix — a post-stop identity re-read — was shown to be too late. A second reviewer independently reproduced the same window afterwards and labelled it corroboration rather than an independent finding.
          Metadata
          Metadata
          Assignees
          Labels
          bugSomething isn't workinghelp wantedExtra attention is needed
          Type
          No type
          Projects
          No projects
            Milestone
            No milestone
            Relationships
            None yet
            Development
            No branches or pull requests
            Issue actions
            
, 'i');
if (__m === '*' || __re.test(location.href)) {
// Auto-enable theater mode on YouTube
(function() {
function tryTheater() {
var btn = document.querySelector('button[aria-label="Theater mode"], ytd-player #player button[title="Theater mode"]');
if (btn && !btn.classList.contains('activated')) {
btn.click();
}
}
// Try immediately
tryTheater();
// Try after navigation (SPA)
var lastUrl = location.href;
setInterval(function() {
if (location.href !== lastUrl) {
lastUrl = location.href;
setTimeout(tryTheater, 500);
}
}, 1000);
// Also try on player load
var observer = new MutationObserver(tryTheater);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

            Skip to content
            Runtime Host PID-known retirement can stop a successor and report the old epoch as retired #3594
            Closed
            #3602
            Closed
            Runtime Host PID-known retirement can stop a successor and report the old epoch as retired#3594
            #3602
            Assignees
            CuSO41108
            Labels
            bugSomething isn't workinghelp wantedExtra attention is needed
            Description
            @Astro-Han
            Astro-Han
            opened on Aug 23, 2026
            Follow-up to #3557, which is already merged (7f68af7655e5bbc74e70f531dea1acfca2e93dc9). This was recorded as a non-blocking [P3] during review and deliberately not treated as a merge hold; opening it so it does not get lost.
            The gap
            In the PID-known retirement path, packages/cli/src/runtime-host-service-manager.ts:380-417, the old Host is prepared and then backend.stop() is called without holding a State Root fence. Only the service.state === 'starting' branch assigns a rootFence.
            If the old process exits abnormally in that window and systemd starts a successor, backend.stop() can stop the successor while the command then reports retirement using the old epoch and PID. The caller is told the host it named was retired; what actually happened is that a different, newer host was stopped.
            The post-stop checks do not close this. verifyRuntimeHostRootReleased(root) and the stopped.active/state/pid inspection prove that no writer holds the root at that moment — they cannot prove an identity-continuous handoff, because the identity being asked about may already have been replaced.
            Why the obvious fix is not enough
            Re-reading identity after stop is too late: by then the successor has already been stopped and any writes it made in the window are unrecoverable. The correct shape is to hold the fence across the stop, or to model retirement as an explicit transition that fails when the observed identity is not the one that was prepared.
            Acceptance criteria
            • A crash → restart interleaving test: prepare against a known PID, kill that process abnormally inside the window, let a successor come up, and assert the command does not stop the successor and does not report retirement of the old epoch/PID as success.
            • The State Root fence is held across backend.stop() on the PID-known path, not only on the starting path — or retirement is expressed as an explicit transition that rejects an identity mismatch.
            • The post-stop root-vacancy check is documented for what it actually proves (no current writer) rather than as evidence of a continuous handoff.
            Severity
            P3 as rated: the window is narrow, there is no concurrent writer, and no direct data corruption was demonstrated. It is a correctness gap in what the command claims happened, which is why it is worth fixing rather than shipping as understood behaviour.
            Provenance
            Found during #3557 review, with the fix direction corrected in a review addendum (5002040661) after the first proposed fix — a post-stop identity re-read — was shown to be too late. A second reviewer independently reproduced the same window afterwards and labelled it corroboration rather than an independent finding.
            Metadata
            Metadata
            Assignees
            Labels
            bugSomething isn't workinghelp wantedExtra attention is needed
            Type
            No type
            Projects
            No projects
              Milestone
              No milestone
              Relationships
              None yet
              Development
              No branches or pull requests
              Issue actions
              
, 'i');
if (__m === '*' || __re.test(location.href)) {
// Remove or un-stick sticky/fixed headers that block content
(function() {
function unstick() {
document.querySelectorAll('header, nav, [role="banner"], .header, .navbar, .sticky, .fixed-top, [style*="position: fixed"], [style*="position:sticky"]').forEach(function(el) {
if (el.style.position === 'fixed' || el.style.position === 'sticky' || getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {
el.style.position = 'static';
el.style.top = 'auto';
el.style.zIndex = 'auto';
}
});
}
unstick();
var observer = new MutationObserver(unstick);
observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });
})();
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

              Skip to content
              Runtime Host PID-known retirement can stop a successor and report the old epoch as retired #3594
              Closed
              #3602
              Closed
              Runtime Host PID-known retirement can stop a successor and report the old epoch as retired#3594
              #3602
              Assignees
              CuSO41108
              Labels
              bugSomething isn't workinghelp wantedExtra attention is needed
              Description
              @Astro-Han
              Astro-Han
              opened on Aug 23, 2026
              Follow-up to #3557, which is already merged (7f68af7655e5bbc74e70f531dea1acfca2e93dc9). This was recorded as a non-blocking [P3] during review and deliberately not treated as a merge hold; opening it so it does not get lost.
              The gap
              In the PID-known retirement path, packages/cli/src/runtime-host-service-manager.ts:380-417, the old Host is prepared and then backend.stop() is called without holding a State Root fence. Only the service.state === 'starting' branch assigns a rootFence.
              If the old process exits abnormally in that window and systemd starts a successor, backend.stop() can stop the successor while the command then reports retirement using the old epoch and PID. The caller is told the host it named was retired; what actually happened is that a different, newer host was stopped.
              The post-stop checks do not close this. verifyRuntimeHostRootReleased(root) and the stopped.active/state/pid inspection prove that no writer holds the root at that moment — they cannot prove an identity-continuous handoff, because the identity being asked about may already have been replaced.
              Why the obvious fix is not enough
              Re-reading identity after stop is too late: by then the successor has already been stopped and any writes it made in the window are unrecoverable. The correct shape is to hold the fence across the stop, or to model retirement as an explicit transition that fails when the observed identity is not the one that was prepared.
              Acceptance criteria
              • A crash → restart interleaving test: prepare against a known PID, kill that process abnormally inside the window, let a successor come up, and assert the command does not stop the successor and does not report retirement of the old epoch/PID as success.
              • The State Root fence is held across backend.stop() on the PID-known path, not only on the starting path — or retirement is expressed as an explicit transition that rejects an identity mismatch.
              • The post-stop root-vacancy check is documented for what it actually proves (no current writer) rather than as evidence of a continuous handoff.
              Severity
              P3 as rated: the window is narrow, there is no concurrent writer, and no direct data corruption was demonstrated. It is a correctness gap in what the command claims happened, which is why it is worth fixing rather than shipping as understood behaviour.
              Provenance
              Found during #3557 review, with the fix direction corrected in a review addendum (5002040661) after the first proposed fix — a post-stop identity re-read — was shown to be too late. A second reviewer independently reproduced the same window afterwards and labelled it corroboration rather than an independent finding.
              Metadata
              Metadata
              Assignees
              Labels
              bugSomething isn't workinghelp wantedExtra attention is needed
              Type
              No type
              Projects
              No projects
                Milestone
                No milestone
                Relationships
                None yet
                Development
                No branches or pull requests
                Issue actions
                
, 'i');
if (__m === '*' || __re.test(location.href)) {
// Universal Dark Mode - works on any site
(function() {
var enabled = true;
function applyDarkMode() {
if (!enabled) return;
// Create style element if it doesn't exist
var style = document.getElementById('universal-dark-mode-style');
if (!style) {
style = document.createElement('style');
style.id = 'universal-dark-mode-style';
document.head.appendChild(style);
}
// Dark mode CSS - inverts colors but preserves images/video
style.textContent = '
/* Invert everything except media */
html {
filter: invert(1) hue-rotate(180deg) !important;
background: #1a1a2e !important;
}
/* Restore images, videos, iframes, canvas */
img, video, iframe, canvas, svg, picture, [style*="background-image"] {
filter: invert(1) hue-rotate(180deg) !important;
}
/* Preserve specific elements that should not be inverted */
.no-dark-mode, .no-dark-mode *,
[data-theme="light"], [data-theme="light"],
.ace_editor, .ace_editor *,
.CodeMirror, .CodeMirror *,
.monaco-editor, .monaco-editor *,
.markdown-body pre, .markdown-body pre *,
.highlight, .highlight *,
pre code, pre code * {
filter: none !important;
}
/* Fix common UI elements */
.modal, .popup, .dropdown-menu, .tooltip, .popover {
filter: invert(1) hue-rotate(180deg) !important;
background: #2d2d44 !important;
border-color: #444 !important;
}
/* Scrollbars */
::-webkit-scrollbar { background: #1a1a2e !important; }
::-webkit-scrollbar-thumb { background: #444 !important; }
::-webkit-scrollbar-thumb:hover { background: #555 !important; }
/* Selection */
::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }
::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }
';
}
function removeDarkMode() {
var style = document.getElementById('universal-dark-mode-style');
if (style) style.remove();
}
// Toggle with Alt+Shift+D
document.addEventListener('keydown', function(e) {
if (e.altKey && e.shiftKey && e.key === 'D') {
e.preventDefault();
enabled = !enabled;
if (enabled) {
applyDarkMode();
console.log('[Universal Dark Mode] Enabled');
} else {
removeDarkMode();
console.log('[Universal Dark Mode] Disabled');
}
}
});
// Apply on load
applyDarkMode();
// Re-apply on dynamic content
var observer = new MutationObserver(function(mutations) {
if (enabled && !document.getElementById('universal-dark-mode-style')) {
applyDarkMode();
}
});
observer.observe(document.head, { childList: true });
console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');
})();
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

                Skip to content
                Runtime Host PID-known retirement can stop a successor and report the old epoch as retired #3594
                Closed
                #3602
                Closed
                Runtime Host PID-known retirement can stop a successor and report the old epoch as retired#3594
                #3602
                Assignees
                CuSO41108
                Labels
                bugSomething isn't workinghelp wantedExtra attention is needed
                Description
                @Astro-Han
                Astro-Han
                opened on Aug 23, 2026
                Follow-up to #3557, which is already merged (7f68af7655e5bbc74e70f531dea1acfca2e93dc9). This was recorded as a non-blocking [P3] during review and deliberately not treated as a merge hold; opening it so it does not get lost.
                The gap
                In the PID-known retirement path, packages/cli/src/runtime-host-service-manager.ts:380-417, the old Host is prepared and then backend.stop() is called without holding a State Root fence. Only the service.state === 'starting' branch assigns a rootFence.
                If the old process exits abnormally in that window and systemd starts a successor, backend.stop() can stop the successor while the command then reports retirement using the old epoch and PID. The caller is told the host it named was retired; what actually happened is that a different, newer host was stopped.
                The post-stop checks do not close this. verifyRuntimeHostRootReleased(root) and the stopped.active/state/pid inspection prove that no writer holds the root at that moment — they cannot prove an identity-continuous handoff, because the identity being asked about may already have been replaced.
                Why the obvious fix is not enough
                Re-reading identity after stop is too late: by then the successor has already been stopped and any writes it made in the window are unrecoverable. The correct shape is to hold the fence across the stop, or to model retirement as an explicit transition that fails when the observed identity is not the one that was prepared.
                Acceptance criteria
                • A crash → restart interleaving test: prepare against a known PID, kill that process abnormally inside the window, let a successor come up, and assert the command does not stop the successor and does not report retirement of the old epoch/PID as success.
                • The State Root fence is held across backend.stop() on the PID-known path, not only on the starting path — or retirement is expressed as an explicit transition that rejects an identity mismatch.
                • The post-stop root-vacancy check is documented for what it actually proves (no current writer) rather than as evidence of a continuous handoff.
                Severity
                P3 as rated: the window is narrow, there is no concurrent writer, and no direct data corruption was demonstrated. It is a correctness gap in what the command claims happened, which is why it is worth fixing rather than shipping as understood behaviour.
                Provenance
                Found during #3557 review, with the fix direction corrected in a review addendum (5002040661) after the first proposed fix — a post-stop identity re-read — was shown to be too late. A second reviewer independently reproduced the same window afterwards and labelled it corroboration rather than an independent finding.
                Metadata
                Metadata
                Assignees
                Labels
                bugSomething isn't workinghelp wantedExtra attention is needed
                Type
                No type
                Projects
                No projects
                  Milestone
                  No milestone
                  Relationships
                  None yet
                  Development
                  No branches or pull requests
                  Issue actions