@agfpd/iapeer 0.2.50 → 0.2.51

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agfpd/iapeer",
-  "version": "0.2.50",
+  "version": "0.2.51",
   "description": "Foundation core for the iapeer multi-agent ecosystem: identity, registry, storage, codec.",
   "type": "module",
   "bin": {

package/src/launch/canary.test.ts

@@ -69,7 +69,8 @@ describe('canary script (pure)', () => {
     // proven live); the SERVER's liveness decides, after a dismissal grace sleep.
     expect(s).not.toContain(`[ "$rc" -eq 0 ] || [ "$rc" -ge 128 ]; then exit 0`) // the v1 hole
     expect(s).toContain('sleep 2') // dismissal grace window
-    expect(s).toContain(`has-session 2>/dev/null; then exit 0`) // server alive → nothing to record
+    expect(s).toContain(`kill -0 "$SPID" 2>/dev/null; then exit 0`) // original server alive → nothing to record
+    expect(s).toContain(`[ -z "$SPID" ]`) // fallback only when the original pid was unavailable
     expect(s).toContain('cause=server-vanished') // connection drop (SIGKILL/OOM class)
     expect(s).toContain('cause=signaled-server-gone') // rc=0: channel/client-TERM, server died
     expect(s).toContain('cause=client-killed-server-gone') // rc≥128: client took a hard kill
@@ -119,6 +120,7 @@ describe.if(tmuxAvailable)('canary live (sandbox tmux servers)', () => {
     'notifier-canatear',
     'claude-canasweep',
     'claude-canaclient',
+    'claude-canareplaced',
   ]
 
   afterAll(() => {
@@ -285,4 +287,44 @@ describe.if(tmuxAvailable)('canary live (sandbox tmux servers)', () => {
     },
     20000,
   )
+
+  test(
+    'dirty server death followed by immediate replacement on the same socket still records the ORIGINAL death',
+    async () => {
+      const identity = 'claude-canareplaced'
+      const { sock, logDir } = bringUp(identity)
+      const pid = serverPid(sock)
+      expect(pid).toBeGreaterThan(0)
+      expect(ensureServerCanary({ identity, sock, exitLogDir: logDir })).toBe('spawned')
+      expect(await waitFor(() => canaryRunning(identity), 3000)).toBe(true)
+      await sleep(500)
+
+      process.kill(pid, 'SIGKILL')
+      // Reuse the same socket before the canary's 2s dismissal-grace window
+      // expires. The old socket-level probe treated this successor as "server
+      // alive" and lost the predecessor's death; the canary must key on SPID.
+      let started = false
+      for (let i = 0; i < 20; i++) {
+        const r = spawnSync('tmux', ['-S', sock, 'new-session', '-d', '-s', identity, 'sleep', '120'], {
+          stdio: 'ignore',
+        })
+        if (r.status === 0) {
+          started = true
+          break
+        }
+        await sleep(50)
+      }
+      expect(started).toBe(true)
+
+      const log = exitLogPath(logDir)
+      expect(await waitFor(() => existsSync(log) && readFileSync(log, 'utf8').includes('ev=server-exit'), 8000)).toBe(
+        true,
+      )
+      const line = readFileSync(log, 'utf8')
+      expect(line).toContain(`ev=server-exit identity=${identity}`)
+      expect(line).toContain(`server_pid=${pid}`)
+      expect(readdirSync(serverDeathsDir(logDir)).length).toBe(1)
+    },
+    20000,
+  )
 })

package/src/launch/canary.ts

@@ -19,14 +19,18 @@
 //     sh recorder (`dismissCanary` → TERM → trap → silent exit). POSIX trap
 //     semantics make this race-free: the trap runs before any recording.
 //   • When wait-for returns — ANY code — the script sleeps 2 s (a concurrent
-//     dismissal TERM wins here), then probes SERVER LIVENESS: alive → exit
-//     silently (a lost canary is re-armed and logged by the supervise retrofit
-//     within a tick); dead with nobody having dismissed us → the death is real
-//     and unclaimed → ONE logfmt line `ev=server-exit` into exits.log (the
-//     per-peer death-cause home, next to pane-died's `ev=session-exit`) + a
-//     forensics snapshot (vm_stat / swap / top-RSS ps / fresh DiagnosticReports)
-//     captured within seconds — the evidence the 60 s supervise tick can never
-//     recover ("системных следов ноль" was the recurring investigation outcome).
+//     dismissal TERM wins here), then probes the ORIGINAL SERVER PID captured at
+//     arm time: still alive → exit silently (a lost canary is re-armed and logged
+//     by the supervise retrofit within a tick); gone with nobody having dismissed
+//     us → the death is real and unclaimed → ONE logfmt line `ev=server-exit`
+//     into exits.log (the per-peer death-cause home, next to pane-died's
+//     `ev=session-exit`) + a forensics snapshot (vm_stat / swap / top-RSS ps /
+//     fresh DiagnosticReports) captured within seconds — the evidence the 60 s
+//     supervise tick can never recover ("системных следов ноль" was the recurring
+//     investigation outcome). PID identity matters: a wake/attach can replace the
+//     tmux server on the same socket before the 2 s grace elapses; probing only
+//     the socket would mistake the successor for the dead original and lose the
+//     canary record (live canary-gap 11.06).
 //     The raw wait_rc still ATTRIBUTES the death (cause=server-vanished /
 //     signaled-server-gone / client-killed-server-gone).
 // Residual blind spot (structural): a killer that SIGKILLs the sh recorder
@@ -98,12 +102,16 @@ export function canaryScript(o: CanaryScriptOptions): string {
     // `rc=0 || rc>=128 → silent` was exactly that hole). v2 contract instead:
     //   • deliberate teardowns DISMISS this sh (TERM → trap above) — the sleep
     //     below gives a concurrently-delivered dismissal time to win;
-    //   • then the SERVER's liveness, not the exit code, decides: alive →
+    //   • then the ORIGINAL SERVER PID's liveness, not the exit code, decides: alive →
     //     nothing to record (a lost canary is re-armed and logged by the
-    //     supervise retrofit within a tick); dead and nobody dismissed us →
-    //     the death is real and unclaimed → record it.
+    //     supervise retrofit within a tick); original server dead and nobody
+    //     dismissed us → the death is real and unclaimed → record it. IMPORTANT:
+    //     check the ORIGINAL SPID, not merely "some server answers on the same
+    //     socket". A wake/attach can replace the server inside this 2 s window;
+    //     socket-liveness would then silently swallow the predecessor's death.
     `sleep 2`,
-    `if '${o.tmuxBin}' -S '${o.sock}' has-session 2>/dev/null; then exit 0; fi`,
+    `if [ -n "$SPID" ] && kill -0 "$SPID" 2>/dev/null; then exit 0; fi`,
+    `if [ -z "$SPID" ] && '${o.tmuxBin}' -S '${o.sock}' has-session 2>/dev/null; then exit 0; fi`,
     // The exit code still ATTRIBUTES the recorded death (raw wait_rc is kept):
     //   rc=0   → signaled-server-gone   (channel signal or client-TERM, server died)
     //   rc≥128 → client-killed-server-gone (client took a non-TERM kill)