@appchy/jarvis 0.1.121 → 0.1.122

package/harness/harness/gate.py

@@ -68,31 +68,15 @@ def _run_file(root) -> Path:
 
 
 def _alive(pid) -> bool:
-    """Whether the process that started a run is still there.
+    """Whether the process that started a run is still there — `peers.alive`, so the
+    lock and the peer scan cannot answer one question two ways.
 
     Liveness is the PID and never a clock. A lease would have to guess how long a
     verify takes, and this repo's own set spans 174 seconds warm and far more cold —
     a guess short enough to be useful would strand a real run, and one long enough to
     be safe would not guard anything.
-
-    A pid somebody else owns answers `PermissionError`, and that is ALIVE — the kernel
-    refused to signal a process it confirmed exists. Reading it as dead let a second
-    run start over a live one, and it was also a second answer to the one question
-    `peers._live()` already answers this way: two readings of one pid is exactly the
-    kind of disagreement this file exists to remove.
     """
-    try:
-        # Strictly positive: signal 0 to pid 0 asks about the whole process group and
-        # to a negative pid about another one, so either would answer "alive" about
-        # something that is not this run at all.
-        if int(pid) <= 0:
-            return False
-        os.kill(int(pid), 0)
-    except PermissionError:
-        return True
-    except (OSError, TypeError, ValueError):
-        return False
-    return True
+    return peers.alive(pid)
 
 
 def read_run(root):
@@ -133,12 +117,19 @@ def _write_run(root, data) -> None:
     p = _run_file(root)
     tmp = p.with_suffix(".tmp")
     try:
-        tmp.write_text(json.dumps(data, indent=2) + "\n")
+        tmp.write_text(_encode(data))
         os.replace(tmp, p)
     except OSError:
         pass
 
 
+def _encode(data) -> str:
+    """The run file's bytes. One definition, because the claim writes it straight into
+    an exclusively-created descriptor while every later update goes through the
+    rename above — two writers of one format is one of them drifting later."""
+    return json.dumps(data, indent=2) + "\n"
+
+
 def _begin(root, name, pid) -> dict:
     """The record a run declares itself with, written before the first gate.
 
@@ -192,7 +183,7 @@ def _lost(prior):
             ("task", "session", "machine", "started", "current", "done", "gates")}
 
 
-def _claim(root, name, pid) -> bool:
+def _claim(root, name, pid) -> tuple:
     """Take the checkout's one verify slot, or report that somebody holds it.
 
     **Created exclusively, so two starts in the same instant cannot both win.** The
@@ -206,21 +197,33 @@ def _claim(root, name, pid) -> bool:
     strand every future verify in the checkout. Two callers racing to take over one
     DEAD slot can still both proceed, because breaking a stale lock needs an
     authority a file cannot be; that residue is stated rather than pretended away.
+
+    **Only "the file is already there" means somebody holds it.** Any other failure
+    to write is the harness's own problem — a directory that is not writable, a full
+    disk — and it is raised rather than folded into a refusal, because a caller told
+    *a verify is already running here (pid None)* would go looking for a session that
+    does not exist. A door that cannot tell its own failure from the caller's
+    situation must say which.
+
+    Returns `(claimed, holder)`. The holder comes back with the refusal because this
+    already read it to decide: making the caller read the file a third time to say
+    whose run it is was work done twice for one answer that cannot have changed.
     """
     p = _run_file(root)
-    data = _begin(root, name, pid)
     try:
         fd = os.open(p, os.O_CREAT | os.O_EXCL | os.O_WRONLY, 0o644)
     except FileExistsError:
-        if live_run(root):
-            return False
-        _write_run(root, data)
-        return True
-    except OSError:
-        return False
+        # Built only once the slot is known to be takeable. `_begin` shells out for
+        # HEAD and reads the run file, and on a contended claim all of it was thrown
+        # away — wasted on exactly the path that happens when two sessions are busy.
+        held = live_run(root)
+        if held:
+            return False, held
+        _write_run(root, _begin(root, name, pid))
+        return True, None
     with os.fdopen(fd, "w") as f:
-        f.write(json.dumps(data, indent=2) + "\n")
-    return True
+        f.write(_encode(_begin(root, name, pid)))
+    return True, None
 
 
 def _elapsed(data) -> int:
@@ -366,6 +369,12 @@ def _execute(root, name, adopt: bool = False) -> tuple:
                 finished=_now().isoformat(), passed=ok, sha=sha,
                 results=[{"name": n, "status": s, "said": d, "log": g}
                          for n, s, d, g in results])
+    # A note about a vanished run for the item THIS run just recorded is spent: the
+    # item has a result now, and a record that says both is self-contradictory at
+    # rest. Cleared where it stops being true rather than stepped around by whoever
+    # reads it next, which is the only place that cannot be forgotten.
+    if (data.get("lost") or {}).get("task") == data.get("task"):
+        data["lost"] = None
     _write_run(root, data)
 
     if name and not _record(root, name, results, ok, sha):
@@ -389,17 +398,23 @@ def _print_report(results, sha) -> None:
                 print(f"  {line}")
 
 
-def _progress(running) -> str:
-    """How far through a run is, as a fraction a reader can act on.
+def _where(run) -> str:
+    """Which gate a run had reached, as a fraction. Empty when its gate list is
+    unknown, which is the one case there is no fraction to state.
 
-    A refusal saying only how long ago something started cannot answer the one
-    question the refused caller has — is this nearly over, or did it just begin — and
-    the only strategy left without it is to ask again on a timer.
+    Shared by a live run and a dead one because it is one idea: a reader told only how
+    long ago something started cannot answer whether it is nearly over or has just
+    begun, and without that the only strategy left is to ask again on a timer.
     """
-    done, gates = running.get("done") or [], running.get("gates") or []
+    done, gates = run.get("done") or [], run.get("gates") or []
+    return f"gate {len(done) + 1} of {len(gates)}" if gates else ""
+
+
+def _progress(running) -> str:
+    """How far through a live run is, with what it is doing and for how long."""
     gate = running.get("current") or ""
-    where = f"gate {len(done) + 1} of {len(gates)}" if gates else "starting"
-    return f"{where}{f' ({gate})' if gate else ''}, {_elapsed(running)}s in"
+    return (f"{_where(running) or 'starting'}{f' ({gate})' if gate else ''}, "
+            f"{_elapsed(running)}s in")
 
 
 def _whose(running) -> str:
@@ -416,8 +431,14 @@ def _whose(running) -> str:
     return peers.describe(who, str(running.get("machine") or ""))
 
 
-def _busy(running) -> str:
-    """Why a caller cannot start a verify, in the words the refused caller needs.
+def _busy(running, asked: str = "", started: bool = True) -> str:
+    """The run holding this checkout, in the words the caller needs.
+
+    **One sentence for both doors**, because they state one policy and were drifting
+    apart the moment there were two of them: a caller that tried to START says "this
+    one did not start", and a caller that only ASKED says its own item has nothing —
+    and everything else, whose run it is, how far through, who to reach and the fact
+    that no place is being held, is the same either way.
 
     Never phrased as a failure. Two runs in one checkout corrupt each other's
     result — one gate's build cleans the directory another's log check is about to
@@ -430,12 +451,15 @@ def _busy(running) -> str:
     scheduler; saying honestly that there is none is a sentence (founder, 2026-09-12).
     """
     who = _whose(running)
-    return (f"a verify is already running here — '{running.get('task') or 'no task'}', "
-            f"{_progress(running)} (pid {running.get('pid')}) "
-            f"on {running.get('machine') or 'this machine'}"
+    mine = (running.get("task") or "") == asked
+    head = ("a verify is already running here" if started or mine
+            else "a verify is running in this checkout and it is not yours")
+    outcome = ("Two at once corrupt each other's result, so this one did not start."
+               if started else f"Nothing has run for '{asked or 'no task'}'.")
+    return (f"{head} — '{running.get('task') or 'no task'}', {_progress(running)} "
+            f"(pid {running.get('pid')}) on {running.get('machine') or 'this machine'}"
             + (f", started by {who}" if who else "")
-            + f". Two at once corrupt each other's result, so this one did not start. "
-              f"Nothing is holding your place — ask again, and start it then.")
+            + f". {outcome} Nothing is holding your place — ask again, and start it then.")
 
 
 def _describe(data) -> str:
@@ -520,6 +544,23 @@ def _answer(state, message, data=None) -> int:
     return 0
 
 
+def _idle(message, reason) -> int:
+    """Nothing usable has run for the caller's item, and why. One helper because every
+    such answer carries the same two fields and there are five reasons to give it."""
+    return _answer("idle", message, {"gates": sorted(VERIFY), "reason": reason})
+
+
+def _cannot_claim(error, outcome: str) -> str:
+    """The harness could not write the slot — said once, for both doors.
+
+    It exists to stop a caller reading the harness's own failure as another session's
+    lock, so it is the one message here that must not differ between the door that
+    blocks and the door that does not.
+    """
+    return (f"the verify slot could not be written, so nothing {outcome}: {error}. "
+            f"Nothing is holding it — this is the checkout, not another session.")
+
+
 def _run_out(running) -> dict:
     return {"task": running.get("task") or "", "gate": running.get("current") or "",
             "done": running.get("done") or [], "gates": running.get("gates") or [],
@@ -553,14 +594,15 @@ def _verify_report(root, name) -> int:
         # is a different situation from watching its own gates go — and reporting
         # both as `running` is how a session read a held checkout as its own progress.
         if (running.get("task") or "") == name:
-            gate = running.get("current") or "starting"
-            done, gates = running.get("done") or [], running.get("gates") or []
+            out = _run_out(running)
+            done, gates = out["done"], out["gates"]
             return _answer(
                 "running",
-                f"running {_elapsed(running)}s: {gate}. {len(done)} of {len(gates)} done.",
-                {"gate": gate, "elapsedSeconds": _elapsed(running), "gates": gates,
-                 "done": done, "results": _results_out(running),
-                 "run": _run_out(running)})
+                f"running {out['elapsedSeconds']}s: {out['gate'] or 'starting'}. "
+                f"{len(done)} of {len(gates)} done.",
+                {"gate": out["gate"], "elapsedSeconds": out["elapsedSeconds"],
+                 "gates": gates, "done": done, "results": _results_out(running),
+                 "run": out})
         # Every gate-shaped field stays EMPTY. The caller has no run, and filling
         # them with another item's progress is the misreading this state exists to
         # make impossible.
@@ -570,16 +612,10 @@ def _verify_report(root, name) -> int:
         # asks, finds the slot naming somebody else's item, and that is the whole of
         # what it had to go on. Being behind a stranger's run and having lost your own
         # are two facts, and it needs both.
-        lost = _abandoned(running, name)
-        return _answer(
-            "busy",
-            f"A verify is running in this checkout and it is not yours — "
-            f"'{running.get('task') or 'no task'}', {_progress(running)}"
-            + (f", started by {_whose(running)}" if _whose(running) else "")
-            + f". Nothing has run for '{name or 'no task'}', and nothing is holding "
-              f"your place — ask again once the slot is free."
-            + (f" {_gone(name, lost)}" if lost else ""),
-            {"run": _run_out(running), "reason": "lost" if lost else ""})
+        lost = _abandoned(running, None, name)
+        said = _busy(running, asked=name, started=False)
+        return _answer("busy", said + (f" {_gone(name, lost)}" if lost else ""),
+                       {"run": _run_out(running), "reason": "lost" if lost else ""})
 
     return _verify_verdict(root, name, read_run(root))
 
@@ -606,7 +642,7 @@ def _verify_verdict(root, name, done) -> int:
     nine-gate runs a day into something nothing caught.
     """
     mine = done if done and (done.get("task") or "") == name else None
-    lost = _abandoned(done, name)
+    lost = _abandoned(done, mine, name)
 
     if mine and mine.get("finished") and not mine.get("read"):
         sha = mine.get("sha") or ""
@@ -618,35 +654,28 @@ def _verify_verdict(root, name, done) -> int:
                 {"elapsedSeconds": _elapsed(mine), "gates": mine.get("gates") or [],
                  "done": mine.get("done") or [], "passed": bool(mine.get("passed")),
                  "commit": sha, "results": _results_out(mine)})
-        return _answer("idle", _stale(root.parent, mine),
-                       {"commit": sha, "gates": sorted(VERIFY),
-                        "reason": "gone" if _vanished(root.parent, sha) else "moved"})
+        said, why = _stale(root.parent, mine)
+        return _answer("idle", said,
+                       {"commit": sha, "gates": sorted(VERIFY), "reason": why})
 
     if lost:
-        return _answer("idle", _gone(name, lost),
-                       {"gates": sorted(VERIFY), "reason": "lost"})
+        return _idle(_gone(name, lost), "lost")
 
     if mine and mine.get("read"):
-        return _answer(
-            "idle",
+        return _idle(
             f"The gates for '{name}' finished and that result has already been "
             f"reported once — asking again does not re-run them. Start them again to "
-            f"prove the code as it stands now.",
-            {"gates": sorted(VERIFY), "reason": "read"})
+            f"prove the code as it stands now.", "read")
 
     if done and done.get("finished"):
-        return _answer(
-            "idle",
+        return _idle(
             f"No gates have run for '{name or 'no task'}'. The last run in this "
             f"checkout proved '{done.get('task') or 'no task'}', which says nothing "
-            f"about yours. Start them explicitly — asking never starts a run.",
-            {"gates": sorted(VERIFY), "reason": "other"})
+            f"about yours. Start them explicitly — asking never starts a run.", "other")
 
-    return _answer(
-        "idle",
+    return _idle(
         f"No gates have run for '{name or 'no task'}' at this commit. Start them "
-        f"explicitly — asking never starts a run.",
-        {"gates": sorted(VERIFY), "reason": "none"})
+        f"explicitly — asking never starts a run.", "none")
 
 
 def _gone(name, lost) -> str:
@@ -656,19 +685,24 @@ def _gone(name, lost) -> str:
     slot — because the session it is addressed to reaches it either way and the fact
     does not change with the company it keeps.
     """
-    gates, at = lost.get("gates") or [], len(lost.get("done") or []) + 1
+    where = _where(lost)
     return (f"A verify for '{name or 'no task'}' started and stopped without "
             f"recording anything"
-            + (f" — it was at gate {at} of {len(gates)}" if gates else "")
+            + (f" — it was at {where}" if where else "")
             + ". Nothing was written, so there is no result to read: start them again.")
 
 
-def _abandoned(done, name):
+def _abandoned(done, mine, name):
     """A run for `name` that stopped without recording — whether it is still the run
-    on disk, or was carried onto the one that replaced it."""
-    if done and (done.get("task") or "") == name and not done.get("finished") \
-            and not _alive(done.get("pid")):
-        return done
+    on disk, or was carried onto the one that replaced it.
+
+    Two facts, not three. `mine` arrives already worked out, because "is this record
+    the caller's" is one question and deriving it again here made it three copies of
+    one comparison with nothing linking them. The note itself is retired by the run
+    that records a result, in `_execute` — so nothing has to be stepped around here.
+    """
+    if mine and not mine.get("finished") and not _alive(mine.get("pid")):
+        return mine
     lost = (done or {}).get("lost")
     return lost if isinstance(lost, dict) and (lost.get("task") or "") == name else None
 
@@ -678,13 +712,19 @@ def _vanished(repo, sha: str) -> bool:
     return bool(sha) and sha != "no-git" and not git.has_commit(repo, sha)
 
 
-def _stale(repo, done) -> str:
-    """Why a finished result cannot be used, naming both commits.
+def _stale(repo, done) -> tuple:
+    """Why a finished result cannot be used, as `(sentence, reason)`.
+
+    **Both come out of one predicate**, because the sentence a person reads and the
+    word a program branches on must describe the same thing. Asking `_vanished` twice —
+    once here to pick the wording and once in the caller to pick the reason — cost two
+    git subprocesses and left nothing holding the two answers together if either call
+    ever drifted.
 
     A hash the reader cannot open is worse than no hash, so a commit that a push
     rebased out of the history is said to be GONE rather than reported as the code
-    having moved: the code may well be identical, and the two call for different
-    next steps.
+    having moved: the code may well be identical, and the two call for different next
+    steps.
     """
     sha, head = (done.get("sha") or "")[:12], _head(repo)[:12]
     ran = done.get("head") or ""
@@ -693,13 +733,13 @@ def _stale(repo, done) -> str:
         return (f"The gates for '{task}' passed at {sha}, and that commit is no "
                 f"longer in this branch's history — a push rebased it away. The code "
                 f"it measured may be untouched, but nothing can be proven against a "
-                f"commit that is gone: start them again.")
+                f"commit that is gone: start them again."), "gone"
     drifted = (f" Those gates began at {ran[:12]} and ended at {sha}, so something "
                f"was committed while they were running." if ran and not sha.startswith(ran[:12])
                else "")
     return (f"The gates for '{task}' ran at {sha} and the code has moved since — "
             f"HEAD is {head}. That result does not describe what is in the tree now, "
-            f"so it cannot be used: start them again.{drifted}")
+            f"so it cannot be used: start them again.{drifted}"), "moved"
 
 
 def _verify_start(root, name) -> int:
@@ -715,11 +755,14 @@ def _verify_start(root, name) -> int:
     # child cannot claim anything until a Python interpreter has finished starting —
     # and a slot left open for those few hundred milliseconds is a slot two polling
     # sessions will both walk through. The child adopts it and stamps its own pid.
-    if not _claim(root, name, os.getpid()):
-        running = live_run(root) or {}
+    try:
+        claimed, held = _claim(root, name, os.getpid())
+    except OSError as e:
+        return _idle(_cannot_claim(e, "started"), "none")
+    if not claimed:
         # `busy` and never `running`: this caller has no run, and the fields that
         # would describe one stay empty so the slot's state cannot be read as its own.
-        return _answer("busy", _busy(running), {"run": _run_out(running)})
+        return _answer("busy", _busy(held, asked=name), {"run": _run_out(held)})
 
     try:
         subprocess.Popen(
@@ -732,8 +775,7 @@ def _verify_start(root, name) -> int:
         # expire with this process — a checkout that reads as busy for no reason is
         # the failure this whole item is about.
         _run_file(root).unlink(missing_ok=True)
-        return _answer("idle", f"The gates could not be started: {e}",
-                       {"gates": sorted(VERIFY), "reason": "none"})
+        return _idle(f"The gates could not be started: {e}", "none")
     return _answer(
         "started",
         f"Gates started ({len(VERIFY)}): {', '.join(sorted(VERIFY))}. They take "
@@ -795,8 +837,13 @@ def cmd_verify(args) -> int:
 
     # The person's door claims the slot the same way the background one does, so
     # neither can be the hole in a guard the other honours.
-    if not _claim(root, name, os.getpid()):
-        print(f"error: {_busy(live_run(root) or {})}", file=sys.stderr)
+    try:
+        claimed, held = _claim(root, name, os.getpid())
+    except OSError as e:
+        print(f"error: {_cannot_claim(e, 'ran')}", file=sys.stderr)
+        return 1
+    if not claimed:
+        print(f"error: {_busy(held, asked=name)}", file=sys.stderr)
         return 1
 
     results, ok, sha = _execute(root, name, adopt=True)

package/harness/harness/peers.py

@@ -46,6 +46,37 @@ def here() -> str:
     return git.machine()
 
 
+def alive(pid) -> bool:
+    """Whether a process is still there. **One answer to this, for every caller.**
+
+    Signal 0 asks the kernel without touching the process. Strictly positive, because
+    signal 0 to pid 0 asks about the whole process group and to a negative pid about
+    another one — either would answer "alive" about something that is not the process
+    in question at all.
+
+    **A pid somebody else owns answers `PermissionError`, and that is ALIVE**: the
+    kernel refused to signal a process it just confirmed exists. The verify lock read
+    the same refusal as *dead* while this read it as alive, so a second run could
+    start over a live one — two readings of one pid, which is the disagreement every
+    shared answer in this module exists to prevent. It lives here rather than beside
+    either caller because a pid is a machine fact and this file is where those are.
+
+    **Known limit: a recycled pid reads as alive.** A process killed hard leaves its
+    artifacts behind, so nothing on the machine can corroborate the number, and
+    reading a start time needs a child process this module is deliberately not
+    allowed to spawn. What bounds it is where the answer is used.
+    """
+    try:
+        if int(pid) <= 0:
+            return False
+        os.kill(int(pid), 0)
+    except PermissionError:
+        return True
+    except (OSError, TypeError, ValueError):
+        return False
+    return True
+
+
 #: Where an agent client publishes the sessions it currently has running. Claude
 #: Code is the only one that publishes anything today; the shape is one JSON file
 #: per process carrying its own session id, its addressable name and its pid.
@@ -76,20 +107,15 @@ def _live():
     different and much stronger claim: something published a list and this session
     was not on it.
 
-    A pid is checked rather than trusted. The directory is cleaned up on exit, so in
-    practice it holds only live runs, but a process killed hard leaves its file
-    behind — and a stale entry here would resurrect exactly the ghost this exists to
-    catch. Signal 0 asks the kernel whether the pid is there without touching it.
-
-    **Known limit: a recycled pid reads as alive.** If a session is killed hard AND
-    the operating system later hands its number to some unrelated program, this says
-    running about a session that is gone. It is not closed here, and the alternatives
-    were worse: every artifact that could corroborate the pid — the messaging socket
-    included — is left behind by the same hard kill, so pairing two stale files
-    proves nothing, and reading a process's start time needs a child process this
-    module is deliberately not allowed to spawn. What bounds it instead is where the answer is used: one
-    row on a status screen reading "running" instead of "ended", never a board write,
-    which is the constraint the rule about a client's facts already sets.
+    A pid is checked rather than trusted, through `alive()` — the one answer this
+    module gives to that question, shared with the verify lock. The directory is
+    cleaned up on exit, so in practice it holds only live runs, but a process killed
+    hard leaves its file behind, and a stale entry here would resurrect exactly the
+    ghost this exists to catch.
+
+    `alive()` carries the recycled-pid limit. What bounds it is where the answer is
+    used: one row on a status screen reading "running" instead of "ended", never a
+    board write, which is the constraint the rule about a client's facts already sets.
 
     The result is cached per directory for the life of the process. The harness is a
     short-lived command, so re-globbing and re-signalling once per printed row is
@@ -110,20 +136,9 @@ def _live():
             continue  # a half-written file is not a dead session
         if not isinstance(entry, dict):
             continue
-        run, pid = str(entry.get("sessionId", "")), entry.get("pid")
-        if not run:
-            continue
-        try:
-            # Strictly positive: signal 0 to pid 0 asks about the whole process
-            # group and to a negative pid about another one, so either would answer
-            # "alive" about something that is not this session at all.
-            if int(pid) <= 0:
-                continue
-            os.kill(int(pid), 0)
-        except (TypeError, ValueError, ProcessLookupError):
+        run = str(entry.get("sessionId", ""))
+        if not run or not alive(entry.get("pid")):
             continue
-        except PermissionError:
-            pass  # alive and owned by somebody else, which is still alive
         out[run] = entry
     _RUNNING[key] = out
     return out

package/harness/test_work.py

@@ -3504,6 +3504,68 @@ def test_the_slot_is_held_from_before_the_child_starts():
                 gate.VERIFY = old
 
 
+def test_a_lost_run_is_retired_by_the_run_that_records_one():
+    # The carried note outlived what it was about: a run for this item died, the next
+    # run for the same item passed and was reported, and every ask after the first
+    # went back to saying nothing had been written — about gates that had just gone
+    # green. A note that survives its own subject is the failure class this whole
+    # item exists to remove, so it must not be reintroduced by the fix.
+    with tempfile.TemporaryDirectory() as tmp:
+        v = _tree(tmp)
+        e = _epic(v, "an-epic")
+        _task(e / "in-progress", "alpha", body="# T\n")
+        with _work_dir(tmp) as root:
+            old, gate.VERIFY = gate.VERIFY, {"tests": "true"}
+            try:
+                gate._write_run(root, {"task": "alpha", "pid": 2 ** 31 - 1,
+                                       "started": gate._now().isoformat(),
+                                       "gates": ["tests"], "done": [],
+                                       "finished": None, "read": False})
+                # A real run for the same item, which picks the note up and then
+                # RECORDS — so the note is spent, and the record must not be left
+                # saying both "passed for alpha" and "alpha's run wrote nothing".
+                # Cleared where it stops being true rather than stepped around by
+                # whoever reads it next.
+                gate.cmd_verify({"task": "alpha"})
+                assert gate.read_run(root)["passed"] is True
+                assert gate.read_run(root)["lost"] is None, gate.read_run(root)
+
+                first = _said(lambda: gate.cmd_verify({"task": "alpha", "status": True}))
+                assert first["state"] == "finished" and first["passed"] is True, first
+                again = _said(lambda: gate.cmd_verify({"task": "alpha", "status": True}))
+                assert again["reason"] == "read", again
+                assert "without recording" not in again["message"], again["message"]
+            finally:
+                gate.VERIFY = old
+
+
+def test_a_slot_the_harness_cannot_write_is_not_reported_as_somebody_elses_run():
+    # Only "the file is already there" means somebody holds it. Any other failure to
+    # write is the harness's own, and a caller told `a verify is already running here
+    # (pid None)` goes looking for a session that does not exist — a door reporting
+    # its own failure as the caller's situation.
+    with tempfile.TemporaryDirectory() as tmp:
+        v = _tree(tmp)
+        _epic(v, "an-epic")
+        with _work_dir(tmp) as root:
+            old, gate.VERIFY = gate.VERIFY, {"tests": "true"}
+            real = gate.os.open
+            try:
+                def refuse(path, flags, *rest):
+                    if str(path).endswith(gate.RUN):
+                        raise PermissionError(13, "Permission denied")
+                    return real(path, flags, *rest)
+                gate.os.open = refuse
+                out = _said(lambda: gate.cmd_verify({"task": "alpha", "start": True}))
+                assert out["state"] != "busy", out
+                assert out["run"] is None, out
+                assert "Permission denied" in out["message"], out["message"]
+                assert "not another session" in out["message"], out["message"]
+            finally:
+                gate.os.open = real
+                gate.VERIFY = old
+
+
 def test_a_pid_somebody_else_owns_is_alive_not_dead():
     # Two readings of one pid: `peers._live` treats a kernel refusal as alive and
     # this treated it as dead, so a run owned by another user read as over and a

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@appchy/jarvis",
-  "version": "0.1.121",
+  "version": "0.1.122",
   "description": "Jarvis — local AI coding assistant CLI",
   "private": false,
   "type": "module",
@@ -63,10 +63,10 @@
     "@jarvis/errors": "1.0.0",
     "@jarvis/logger": "1.0.0",
     "@jarvis/rpc": "1.0.0",
+    "@jarvis/types": "1.0.0",
     "@jarvis/typescript-config": "1.0.0",
     "@jarvis/ui": "0.1.0",
-    "@jarvis/vitest-config": "1.0.0",
-    "@jarvis/types": "1.0.0"
+    "@jarvis/vitest-config": "1.0.0"
   },
   "scripts": {
     "dev": "tsx watch src/bin.ts start --foreground",