Cycle 0058: a stopped or retried server run does only what it reports, and what the chat reads about it is true #143

Outcome

Every defect Cycle 0057 carried is closed: a stopped or retried node-server run signals and records exactly what it did and never touches a process it cannot identify; what the chat and the learner read about a server run (tool text, help, the shown body, the packaged README) is true; the bundled skill makes the chat name a database outage it can see; the Wiki-view test N57 found flaky passes reliably.

This is a bug-fix cycle (AGENTS.md Cycle rule). Cycle 0057 (#139) closed with its outcome demonstrated and 13 defects carried (its closing comment, items 1–13). This cycle fixes those 13 and nothing else: no increment, nothing selected, dropped, ranked or reduced. Defects found during this cycle are fixed in it; only a still-open Major finding of the /ship rounds may be recorded under the ship review limit, and a Critical finding never merges open.

• Learner. Stopping a server run, also a retried stop, ends what it started and says so truthfully; the chat names a database outage instead of a vague failure; the dialog, help and README describe the run as it behaves.
• Agent. codebook_action's description stops promising that a GET changes nothing; the help states one request time limit that can actually fire; skill 1.0.52 tells the chat to read the run's output and failure cause before attributing a failure.
• Engineering. One identity rule for retried stops and the orphan sweep (a matching start time decides; a folder alone never authorizes a signal); the response path settles on every failure; the flaky Wiki-view test gets its root cause fixed.

Current state (verified on main 333c7813, v0.2.52.0, 2026-10-28)

Tasks

Each task closes with its fix and a test that fails without it (red first: copy aside + git checkout HEAD -- <file>, never git stash), or with recorded evidence that it is no defect. Non-behavioral parts (task 11's @example lines and its removed SIGTERM upper bound) close with the diff and a passing run instead of a red test. Source: Cycle 0057 (#139) closing comment item N. Test paths are under extension/src/tests/. Every time bound below counts from the stop's admission (sinceAdmissionMs; NODE_SERVER_KILL_BY_MS = 5,000 ms, NODE_SERVER_STOP_DEADLINE_MS = 10,000 ms).

1. killed says what was sent (item 1; pt3 /ship pass 1, CodeRabbit CLI). endGroupBySignals returns true only when SIGKILL was sent. Tests (launcher, fixture server): a group that ends after SIGTERM records killed: false; a group that ignores SIGTERM records killed: true; a retried close whose identity check answers replaced sends nothing and records killed: false.
2. The remainder count uses one text (item 2). … n more bytes counts the remaining bytes of the redacted, sanitized text (redacted.length - cut); the doc says so; the straddling and redaction tests hard-code the corrected numbers; a lengthening sanitizer never yields a negative count. Test: '/a'.repeat(4000) hidden as <workspace> shows a non-negative count equal to the shown text's remainder.
3. A folder alone never authorizes a signal (item 3). Without a start time compared with the launch's, confirmLaunchedGroup answers unverifiable (or gone / replaced per the existing rules); the run reads the leader's start time again before the attach when the first read failed, so the folder-only path is rarer. Tests: no launch start + same folder → unverifiable; a start read that failed at spawn and succeeds before attach is recorded.
4. A pause during the detach is ended, not resumed for long (item 4). The VS Code debugger reports a stop that arrives after its release began for the bound session (releaseBegun no longer drops it). The run, on a pause reported while a release without kill-first is under way, sends SIGKILL to the group at once: on a first release unconditionally, on a retry only after maySignal answers true (unverifiable sends nothing; the release's own failure path then applies). It journals node-server.late-pause-killed with the pid. The close's killed (task 1) counts only the close's own SIGKILL, so this close records killed: false; the run's journal holds both events. When a retry's identity check is still running as the detach completes, the SIGKILL is sent as soon as the check answers launched (the close's own SIGTERM sequence goes on meanwhile). Tests: debugger (a stop after release began is reported for the bound session, not for another session); run (a pause reported during the detach → SIGKILL before the detach settles; on a retry with an unverifiable group → no signal).
5. SIGKILL by the kill bound on a retried close (item 5). A retried close checks the group's identity once, before SIGTERM. At the kill bound, when the group probe (isProcessGroupGone) answers that members remain, SIGKILL follows without a second identity check: the group has existed since the checked SIGTERM, and a group id is not given out while a member holds it. When the probe throws (it cannot tell), the close sends no SIGKILL and fails, so the stop fails retryably and names the pid; the 5 s bound is never stretched by a second check. Test (launcher, fixture server ignoring SIGTERM, times measured from the admission clock passed as sinceAdmissionMs): a retried close with killByMs: 1_200 whose confirmGroup resolves after 200 ms calls it once and sends SIGKILL before 1,600 ms; a probe that throws at the kill bound sends no SIGKILL and the close rejects.
6. The sweep follows the run's identity rule and shows what it keeps (item 6). A matching start time is the launched leader whatever its folder (closed, as the run's retried stop does); a record kept because it cannot be verified is reported in Output › Codebook at each sweep with its pid and port. Tests: start matches + folder changed → closed; unverifiable + members → kept and reported.
7. codebook_action makes no GET promise (item 7). The description says a GET is sent without the dialog and that the server's handler decides whether it changes data; the protocol test pins the new sentence and that "a GET changes nothing" is gone.
8. The response settles on every failure (item 8). sendDeclaredRequest marks settled only after the response is shaped; a throwing shaper or sanitizer rejects response with REQUEST_FAILED and the fixed message "Codebook could not prepare the response body for display." (the thrown error is never quoted). Test: a throwing sanitizer → response rejects with that code and message within 1 s.
9. A continue while stopping is a historical pause (item 9). continue refuses with STALE_PAUSE when the run is not live, before the held-pause check. Test: learner pause held, stop admitted (close held), continue → STALE_PAUSE; the state × call table gains this cell.
10. One request time limit, stated truthfully (item 10). The help, the packaged README and a 0.2.53.0 CHANGELOG correction say: REQUEST_TIMEOUT after 30 s of running time (paused time excluded); a run whose request still waits at the run's 10-minute deadline ends with RUNTIME_FAILED. The 15-minute timer stays as an internal backstop and is not named. Tests: help text; README sentence (package test or doc test as present).
11. Test hygiene (item 11). The launcher test asserts SIGTERM's order and leaves the time bound to the SIGKILL assertion; launchFixture registers the server group's cleanup at launch; nodeServerJournalBounds.test.ts hard-codes its expected bytes; createClock and readServerRuns get an @example. Evidence: each test passes and fails as described (the cleanup by a forced failure).
12. The chat names a failure it can see (item 12; N57 O-1). Skill 1.0.52: when a run fails or answers 5xx, read the run's output tail and failure cause before attributing it, and name a cause the output shows (for example a refused database connection), labeled as observed output. Tests: skill text; native check N58 (below).
13. The flaky Wiki-view test (item 13; N57 O-4). Find the root cause of the extra empty change: before the stop. If the view shows an empty message between states, fix the view so it never does (a learner-visible flicker); otherwise fix the test's synchronization (await the observable state, AGENTS.md Order and isolation). Tests: a deterministic reproduction (an injected delay or ordering in the test) fails before the fix and passes after; and the file passes 20 times in a row under load: in a separate worktree of the same commit (its own node_modules and dist, built first), node --test extension/dist/tests/llmWikiView.test.js runs 20 times while one pnpm --dir extension test runs in the main checkout, recorded with counts (a separate checkout keeps the two builds apart, AGENTS.md Order and isolation).
14. N58 native check (closes the native part of task 12). Space local:codebook-qa, VS Code 1.142.0, QA profile "Codebook QA 0049", the PR's final candidate VSIX installed normally (hash recorded); Copilot Chat Agent with GPT-6.1 Luna if the picker lists it after searching 6.1 and luna, else GPT-6.1 Terra. Target: the pinned P08 clone /Users/lume/qa/c57/switch-time at 4f68953, clean; Postgres stopped with pg_ctl -D ~/qa/c57/pg18data stop and restarted after with LC_ALL=en_US.UTF-8 pg_ctl -D ~/qa/c57/pg18data -l ~/qa/c57/pg18-server.log start. One natural question, new wording, about how sign-in finds a user (POST /api/auth/sign-in/email reaches the user lookup at apps/api/src/db/client.ts:254, Part A of Cycle 0057: a Node HTTP server of a real repository is explained live (node-server profile) #139). A run that never reaches the database counts as a failed attempt; one further attempt with a new question is allowed, then the check is FAIL. A missing model follows AGENTS.md Development target (NOT RUN with the picker list; the Codex extension after observed credit exhaustion). Pass: the chat names the database outage and cites the run's output for it, gives no source-only answer as if observed, and lsof -nP -iTCP:4100 -sTCP:LISTEN, polled every second from the moment codebook_stop answers, shows no listener within 10 s. Evidence: stills of the answer and the status, SHA-256 here, files private.

Acceptance criteria

1. Tasks 1–13 each close with their fix and a red-first test, or with recorded evidence; task 11's @example lines and removed SIGTERM upper bound close with the diff and a passing run, and its fixture cleanup with a forced failure. Every test states protects=…; fails_when=…; no_claim=….
2. N58 (task 14) passes in VS Code on the cycle's final candidate, with its identities and evidence hashes recorded here; otherwise task 12 stays open.
3. The 15-check exact-HEAD gate passes on the PR's final tree, in this order: from extension/: pnpm format:check, typecheck, lint, health:static, dupes, dead-code, test; the five Reader DOM checks (node extension/scripts/<check>-qa.mjs verify <new folder> for study-bootstrap, wiki-reader-dom, study-reading-pose, understanding-focus, repository-return); from extension/: pnpm test:package, then pnpm health; from the root: node --test .codex/restore-product-context.test.mjs. It with required CI and the local CodeRabbit CLI on its final range. Every finding of those is fixed before merge; only a still-open Major finding of the /ship rounds may be recorded under the ship review limit, and a Critical finding never merges open.
4. pnpm --dir extension health:static and pnpm --dir extension health pass against their committed baselines (extension/fallow-health-baseline.json, extension/fallow-health-measured-baseline.json).
5. Every user-visible change has a CHANGELOG 0.2.53.0 line and a packaged README sentence; skill 1.0.52.
6. Real-process tests (fixture, CI) pass on the final head, and the pinned-clone tests pass locally on it with both databases up: CODEBOOK_NODE_SERVER_CLONES='{"switch-time":"<clone>","nsx":"<clone>"}' node --test extension/dist/tests/ownedNodeServerRun.pinnedClones.test.js (4 tests; clones of laststance/switch-time 4f68953 and laststance/nsx 502545c7 with their documented local stacks), since the run and launcher change.
7. The closing comment states that nothing is carried, or names what the ship review limit recorded.

Testing plan

Counts are estimates; the tasks above name the required cases.

Rules for the implementing agent

1. Acceptance criteria are the protects / fails_when / no_claim profile of each test. Never "make the tests pass".
2. Real code and real tests land in the same change; a placeholder, a stub assertion or a deferred test is not done.
3. Any change to a test, validator, CI step, timeout, tolerance, threshold, snapshot or suppression pragma is reported on its own line with its justification, before any other result.
4. A reported command names the command and its observed result; a command not run is not reported; stderr is never silenced in a cited command.
5. A report is a claim until the parent re-executes it: say what was verified, reused and not checked.
6. Red first for every behaviour change (copy aside + git checkout HEAD -- <file>; never git stash).

Rollback

Revert the PR. No stored data, MCP shape or saved study changes; the orphan record format stays; the skill moves one version (1.0.51 → 1.0.52).

Effort

Files

Out of scope

• Saving and replaying a server run (O2, the next feature cycle).
• The Express (P07) native trial and every other gap row of Cycle 0057: a Node HTTP server of a real repository is explained live (node-server profile) #139's audit.
• Any new profile, MCP tool or setting.

Owner decisions

• Standing: the owner's goal (every resource to the product; never spend money or break the law). The owner cannot answer: 「返事ができないので、選択肢はReccomendをpickしてください🙇」, so each decision takes the recommended option, named here.
• D1 (recommended): one pull request codex/cycle-0058 (13 small fixes in the run, its text and one test file; one gate and one review loop).
• D2 (recommended): a folder alone never authorizes a signal (task 3): safety over a retry that succeeds on a weaker identity; the second start read makes the folder-only case rare.
• D3 (recommended): the sweep reports kept records instead of aging them out (task 6): a record is the only trace of a server that may still run.
• D4 (recommended): keep the 15-minute timer as an unnamed backstop (task 10); the docs name the limits that can fire.
• D5 (recommended): N58 in VS Code only (task 14), where O-1 was observed; Cursor shares the skill body.
• D6 (owner, 2026-10-28): pause after this cycle's merge. 「このサイクルのPRがマージされたら、一旦作業を中断してください」: finish this cycle through its merge and the closing comment, then stop; no next /spec or cycle until the owner's explicit message.
• D7 (owner, 2026-10-28, answered A): the Node 26.12.1 bump goes to its own pull request. The owner's commit 12672469 (Node 26.12.1 in .node-version and package.yml) landed on this cycle's branch; on it CI's health check refused (reference pinned to 24.21.0) and four tests failed on Node 26. It is kept unchanged on codex/node-26 (draft chore(ci): bump Node.js to 26.12.1 (needs the Node 26 migration before merge) #145, where the Node 26 migration happens) and reverted here (ad13920c), so this cycle merges on the verified Node 24.21.0.

Next action

• Status: closed (outcome demonstrated). Merged in PR v0.2.53.0 fix: a stopped or retried server run does only what it reports, and what the chat reads about it is true #144 (squash a2b0d4ac, v0.2.53.0); the closing comment below lists the checks and the closure of every task.
• Next: paused by the owner (D6) until the owner's explicit message. Then a feature cycle (/spec from PRODUCT_GOAL.md and the gap audit), candidate O2 (saving a server run as a learning replay); the owner closed the Node 26 pin PR chore(ci): bump Node.js to 26.12.1 (needs the Node 26 migration before merge) #145 (2026-10-28), so the project stays on Node 24 like the editors' own Node (VS Code 24.21.0, Cursor 24.19.0).