@rubytech/create-maxy-code 0.1.459 → 0.1.461

package/payload/platform/scripts/__tests__/logs-rotate.test.sh

@@ -0,0 +1,256 @@
+#!/usr/bin/env bash
+# Tests for logs-rotate.sh (Task 1706). Fixture-driven: builds a throwaway logs
+# dir per case, runs the real script against it, asserts on the resulting files.
+# No stubs — gzip/find/wc/date are the real binaries, because the portability of
+# exactly those calls across Linux and darwin is part of what this asserts.
+set -uo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+ROTATE="$SCRIPT_DIR/../logs-rotate.sh"
+
+PASS=0
+FAIL=0
+
+run_case() {
+  local name="$1"; shift
+  echo ""
+  echo "=== CASE: $name ==="
+  if "$@"; then
+    PASS=$((PASS + 1))
+    echo "PASS: $name"
+  else
+    FAIL=$((FAIL + 1))
+    echo "FAIL: $name"
+  fi
+}
+
+# Build a throwaway logs dir. Echoes its path.
+mk_logs_dir() {
+  local d
+  d="$(mktemp -d "${TMPDIR:-/tmp}/logs-rotate-test.XXXXXX")"
+  echo "$d"
+}
+
+# Write a file of exactly $2 bytes at $1. $2 must be a whole number of MiB.
+# bs=1048576 rather than bs=1m/1M: the suffix spellings differ between BSD and
+# GNU dd, and this suite runs on both.
+mk_file_of_size() {
+  local path="$1" bytes="$2" mib
+  mib=$(( bytes / 1048576 ))
+  dd if=/dev/zero bs=1048576 count="$mib" 2>/dev/null | tr '\0' 'x' > "$path"
+}
+
+size_of() { wc -c < "$1" 2>/dev/null | awk '{print $1+0}'; }
+
+# Backdate a path by $2 days. `date -r` is BSD, `date -d @` is GNU.
+backdate() {
+  local path="$1" days="$2" secs
+  secs=$(( $(date +%s) - days * 86400 ))
+  touch -t "$(date -u -r "$secs" +%Y%m%d%H%M 2>/dev/null || date -u -d "@$secs" +%Y%m%d%H%M)" "$path"
+}
+
+case_under_threshold_is_noop() {
+  local d; d="$(mk_logs_dir)"
+  # 63 MiB — just under the 64 MiB threshold, so this also pins the boundary.
+  mk_file_of_size "$d/server.log" $((63 * 1024 * 1024))
+  "$ROTATE" "$d" >/dev/null 2>&1
+  local rc=$?
+  [ "$rc" -eq 0 ] || { echo "  expected exit 0, got $rc"; rm -rf "$d"; return 1; }
+  [ ! -e "$d/server.log.1.gz" ] || { echo "  rotated a 63 MiB file"; rm -rf "$d"; return 1; }
+  [ "$(size_of "$d/server.log")" -eq $((63 * 1024 * 1024)) ] \
+    || { echo "  file was modified"; rm -rf "$d"; return 1; }
+  rm -rf "$d"; return 0
+}
+
+case_over_threshold_rotates_and_truncates() {
+  local d; d="$(mk_logs_dir)"
+  mk_file_of_size "$d/server.log" $((65 * 1024 * 1024))
+  "$ROTATE" "$d" >/dev/null 2>&1
+  [ -f "$d/server.log.1.gz" ] || { echo "  no .1.gz produced"; rm -rf "$d"; return 1; }
+  # The live file must still exist (readers hardcode the path) and be small:
+  # it holds only the marker line.
+  [ -f "$d/server.log" ] || { echo "  live path missing after rotate"; rm -rf "$d"; return 1; }
+  local live; live="$(size_of "$d/server.log")"
+  [ "$live" -lt 4096 ] || { echo "  live file not truncated: $live bytes"; rm -rf "$d"; return 1; }
+  rm -rf "$d"; return 0
+}
+
+case_marker_line_present() {
+  local d; d="$(mk_logs_dir)"
+  mk_file_of_size "$d/server.log" $((65 * 1024 * 1024))
+  "$ROTATE" "$d" >/dev/null 2>&1
+  grep -q '\[logs-rotate\] rotated file=server.log prev-bytes=68157440 prev-file=server.log.1.gz keep=5' "$d/server.log" \
+    || { echo "  marker line absent or malformed:"; cat "$d/server.log"; rm -rf "$d"; return 1; }
+  # The marker must be datable from itself.
+  grep -qE '^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z \[logs-rotate\]' "$d/server.log" \
+    || { echo "  marker line not timestamped"; rm -rf "$d"; return 1; }
+  rm -rf "$d"; return 0
+}
+
+case_generation_shift_drops_the_sixth() {
+  local d; d="$(mk_logs_dir)"
+  # Seed 5 existing generations, each identifiable by content.
+  local i
+  for i in 1 2 3 4 5; do echo "gen$i" | gzip -c > "$d/server.log.$i.gz"; done
+  mk_file_of_size "$d/server.log" $((65 * 1024 * 1024))
+  "$ROTATE" "$d" >/dev/null 2>&1
+  # .5.gz must now hold what .4.gz held; the old .5.gz is gone.
+  [ "$(gzip -cd "$d/server.log.5.gz")" = "gen4" ] || { echo "  .5.gz is not the old .4.gz"; rm -rf "$d"; return 1; }
+  [ "$(gzip -cd "$d/server.log.2.gz")" = "gen1" ] || { echo "  .2.gz is not the old .1.gz"; rm -rf "$d"; return 1; }
+  [ ! -e "$d/server.log.6.gz" ] || { echo "  a 6th generation was created"; rm -rf "$d"; return 1; }
+  rm -rf "$d"; return 0
+}
+
+case_lock_held_is_noop_exit_zero() {
+  local d; d="$(mk_logs_dir)"
+  mk_file_of_size "$d/server.log" $((65 * 1024 * 1024))
+  mkdir "$d/.rotate.lock"          # fresh lock, not stale
+  "$ROTATE" "$d" >/dev/null 2>&1
+  local rc=$?
+  [ "$rc" -eq 0 ] || { echo "  expected exit 0 when lock held, got $rc"; rm -rf "$d"; return 1; }
+  [ ! -e "$d/server.log.1.gz" ] || { echo "  rotated despite held lock"; rm -rf "$d"; return 1; }
+  # A held lock must survive the tick that could not take it.
+  [ -d "$d/.rotate.lock" ] || { echo "  another holder's lock was removed"; rm -rf "$d"; return 1; }
+  rm -rf "$d"; return 0
+}
+
+case_stale_lock_is_reclaimed() {
+  local d; d="$(mk_logs_dir)"
+  mk_file_of_size "$d/server.log" $((65 * 1024 * 1024))
+  mkdir "$d/.rotate.lock"
+  backdate "$d/.rotate.lock" 1     # 1 day > STALE_LOCK_MINUTES=30
+  "$ROTATE" "$d" >/dev/null 2>&1
+  [ -f "$d/server.log.1.gz" ] || { echo "  stale lock was not reclaimed"; rm -rf "$d"; return 1; }
+  rm -rf "$d"; return 0
+}
+
+case_missing_logs_dir_is_noop_exit_zero() {
+  "$ROTATE" "/nonexistent/logs/dir/for/test" >/dev/null 2>&1
+  local rc=$?
+  [ "$rc" -eq 0 ] || { echo "  expected exit 0 on missing dir, got $rc"; return 1; }
+  return 0
+}
+
+case_lock_released_on_exit() {
+  local d; d="$(mk_logs_dir)"
+  mk_file_of_size "$d/server.log" $((1 * 1024 * 1024))
+  "$ROTATE" "$d" >/dev/null 2>&1
+  [ ! -e "$d/.rotate.lock" ] || { echo "  lock not released"; rm -rf "$d"; return 1; }
+  rm -rf "$d"; return 0
+}
+
+case_purges_rc_child_older_than_seven_days() {
+  local d; d="$(mk_logs_dir)"
+  echo old > "$d/rc-child-aaaa.log"; backdate "$d/rc-child-aaaa.log" 9
+  echo new > "$d/rc-child-bbbb.log"   # today
+  "$ROTATE" "$d" >/dev/null 2>&1
+  [ ! -e "$d/rc-child-aaaa.log" ] || { echo "  9-day-old rc-child survived"; rm -rf "$d"; return 1; }
+  [ -f "$d/rc-child-bbbb.log" ] || { echo "  today's rc-child was purged"; rm -rf "$d"; return 1; }
+  rm -rf "$d"; return 0
+}
+
+case_purge_does_not_touch_server_log() {
+  local d; d="$(mk_logs_dir)"
+  echo old > "$d/server.log"; backdate "$d/server.log" 90
+  echo x | gzip -c > "$d/server.log.1.gz"; backdate "$d/server.log.1.gz" 90
+  "$ROTATE" "$d" >/dev/null 2>&1
+  [ -f "$d/server.log" ] || { echo "  server.log was purged by age"; rm -rf "$d"; return 1; }
+  [ -f "$d/server.log.1.gz" ] || { echo "  a kept generation was purged by age"; rm -rf "$d"; return 1; }
+  rm -rf "$d"; return 0
+}
+
+case_mcp_stderr_live_file_size_rotates() {
+  local d; d="$(mk_logs_dir)"
+  mk_file_of_size "$d/mcp-memory-stderr-2026-07-17.log" $((65 * 1024 * 1024))
+  "$ROTATE" "$d" >/dev/null 2>&1
+  [ -f "$d/mcp-memory-stderr-2026-07-17.log.1.gz" ] \
+    || { echo "  live mcp stderr log was not size-rotated"; rm -rf "$d"; return 1; }
+  rm -rf "$d"; return 0
+}
+
+# --- Code-review regressions (2026-07-17) -----------------------------------
+
+# A failing gzip must not cost a generation. The shift used to run BEFORE the
+# gzip, so every failure moved .4->.5 ... .1->.2 and wrote nothing to .1 —
+# leaving a hole and dropping the oldest. The trigger is ENOSPC, i.e. exactly
+# the condition rotation exists to prevent: 5 failing ticks destroyed 4 of the
+# 5 retained generations while never truncating the live file.
+case_gzip_failure_preserves_generations() {
+  local d; d="$(mk_logs_dir)"
+  local bin="$d/../bin-$$"; mkdir -p "$bin"
+  printf '#!/bin/sh\nexit 1\n' > "$bin/gzip"; chmod +x "$bin/gzip"
+  local i
+  for i in 1 2 3 4 5; do echo "gen$i" | gzip -c > "$d/server.log.$i.gz"; done
+  mk_file_of_size "$d/server.log" $((65 * 1024 * 1024))
+
+  PATH="$bin:$PATH" "$ROTATE" "$d" >/dev/null 2>&1
+  local rc=$?
+
+  local fail=0
+  for i in 1 2 3 4 5; do
+    if [ "$(gzip -cd "$d/server.log.$i.gz" 2>/dev/null)" != "gen$i" ]; then
+      echo "  .$i.gz should still be gen$i, got: $(gzip -cd "$d/server.log.$i.gz" 2>/dev/null)"; fail=1
+    fi
+  done
+  # The live file must be untouched — a failed rotate never truncates.
+  [ "$(size_of "$d/server.log")" -eq $((65 * 1024 * 1024)) ] \
+    || { echo "  live file was truncated despite gzip failure"; fail=1; }
+  [ "$rc" -eq 0 ] || { echo "  expected exit 0, got $rc"; fail=1; }
+  [ ! -e "$d/server.log.1.gz.tmp" ] || { echo "  temp file left behind"; fail=1; }
+  rm -rf "$d" "$bin"; return $fail
+}
+
+# The mcp stderr tee opens its file at process start and holds the stream for the
+# process's whole life, writing ONLY when the server emits stderr — which a
+# healthy server does not do for days. So a live file's mtime DOES go stale, and
+# deleting it sends every later stderr write to an unlinked inode: invisible
+# exactly when the fault you are chasing finally appears. Never purge these.
+case_never_purges_mcp_stderr_by_age() {
+  local d; d="$(mk_logs_dir)"
+  echo quiet > "$d/mcp-memory-stderr-2026-01-01.log"
+  backdate "$d/mcp-memory-stderr-2026-01-01.log" 90
+  echo x | gzip -c > "$d/mcp-memory-stderr-2026-01-01.log.1.gz"
+  backdate "$d/mcp-memory-stderr-2026-01-01.log.1.gz" 90
+  "$ROTATE" "$d" >/dev/null 2>&1
+  [ -f "$d/mcp-memory-stderr-2026-01-01.log" ] \
+    || { echo "  a 90-day-stale mcp stderr log was purged — it may still be held open"; rm -rf "$d"; return 1; }
+  [ -f "$d/mcp-memory-stderr-2026-01-01.log.1.gz" ] \
+    || { echo "  an mcp generation was purged by age"; rm -rf "$d"; return 1; }
+  rm -rf "$d"; return 0
+}
+
+# rc-child's 16 MiB cap does NOT hold: `written` is in-memory per manager
+# process, so a manager restart resumes appending to the same path. Observed at
+# 54 MB on sitedesk-code (3.25x the cap). A live long-lived session's file has a
+# fresh mtime forever, so age-purge never reaches it — it needs size rotation.
+case_rc_child_size_rotates() {
+  local d; d="$(mk_logs_dir)"
+  mk_file_of_size "$d/rc-child-live-session.log" $((65 * 1024 * 1024))
+  "$ROTATE" "$d" >/dev/null 2>&1
+  [ -f "$d/rc-child-live-session.log.1.gz" ] \
+    || { echo "  an oversized rc-child log was not size-rotated"; rm -rf "$d"; return 1; }
+  local live; live="$(size_of "$d/rc-child-live-session.log")"
+  [ "$live" -lt 4096 ] || { echo "  rc-child live file not truncated: $live"; rm -rf "$d"; return 1; }
+  rm -rf "$d"; return 0
+}
+
+run_case "gzip failure preserves generations"    case_gzip_failure_preserves_generations
+run_case "never purges mcp stderr by age"        case_never_purges_mcp_stderr_by_age
+run_case "rc-child size-rotates"                 case_rc_child_size_rotates
+
+run_case "under threshold is a no-op"            case_under_threshold_is_noop
+run_case "over threshold rotates and truncates"  case_over_threshold_rotates_and_truncates
+run_case "marker line present and timestamped"   case_marker_line_present
+run_case "generation shift drops the sixth"      case_generation_shift_drops_the_sixth
+run_case "lock held is a no-op, exit 0"          case_lock_held_is_noop_exit_zero
+run_case "stale lock is reclaimed"               case_stale_lock_is_reclaimed
+run_case "missing logs dir is a no-op, exit 0"   case_missing_logs_dir_is_noop_exit_zero
+run_case "lock released on exit"                 case_lock_released_on_exit
+run_case "purges rc-child older than 7 days"     case_purges_rc_child_older_than_seven_days
+run_case "purge does not touch server.log"       case_purge_does_not_touch_server_log
+run_case "mcp stderr live file size-rotates"     case_mcp_stderr_live_file_size_rotates
+
+echo ""
+echo "===================="
+echo "PASS: $PASS  FAIL: $FAIL"
+[ "$FAIL" -eq 0 ]

package/payload/platform/scripts/__tests__/resume-tunnel.test.sh

@@ -619,6 +619,83 @@ case_refuse_on_invalid_state_json() {
   return 0
 }
 
+# Task 1706 — the rotator's lock must be held across the offset-capture →
+# verification-poll window. logs-rotate.sh truncates cloudflared.log in place
+# when it exceeds 64 MiB; a rotation landing inside this window makes
+# `tail -c "+$LOG_OFFSET"` read past EOF and report a tunnel failure that did
+# not happen.
+case_holds_rotate_lock_during_verify() {
+  local root
+  root=$(mktemp -d /tmp/resume-tunnel-test-XXXXXX)
+  setup "$root" ".maxy-code" "inactive" "yes"
+
+  local log_dir="$root/home/.maxy-code/logs"
+  local marker="$root/lock-was-held"
+
+  # Poll for the lock's existence while the script runs. The verify gate is the
+  # window under test, so a single observation of the lock proves it was held
+  # across it.
+  ( for _ in $(seq 1 60); do
+      [[ -d "$log_dir/.rotate.lock" ]] && { touch "$marker"; break; }
+      sleep 0.05
+    done ) &
+  local watcher=$!
+
+  HOME="$root/home" \
+  PATH="$root/bin:$PATH" \
+  MAXY_PLATFORM_ROOT="$root/platform_root" \
+    bash "$RESUME" >/dev/null 2>&1
+  local rc=$?
+  wait "$watcher" 2>/dev/null
+
+  local held=0 leaked=0
+  [[ -e "$marker" ]] && held=1
+  [[ -d "$log_dir/.rotate.lock" ]] && leaked=1
+  cleanup "$root"
+
+  if [[ $rc -ne 0 ]]; then
+    echo "  expected exit 0, got $rc"; return 1
+  fi
+  if [[ $held -ne 1 ]]; then
+    echo "  rotate lock was never held during the verify window"; return 1
+  fi
+  if [[ $leaked -ne 0 ]]; then
+    echo "  rotate lock not released after the verify window"; return 1
+  fi
+  return 0
+}
+
+# A lock already held (by a live rotator tick) must not stop the tunnel coming
+# up. A false-alarm verify line is a far smaller failure than no tunnel.
+case_busy_rotate_lock_does_not_block_spawn() {
+  local root
+  root=$(mktemp -d /tmp/resume-tunnel-test-XXXXXX)
+  setup "$root" ".maxy-code" "inactive" "yes"
+
+  mkdir -p "$root/home/.maxy-code/logs/.rotate.lock"
+
+  HOME="$root/home" \
+  PATH="$root/bin:$PATH" \
+  MAXY_PLATFORM_ROOT="$root/platform_root" \
+    bash "$RESUME" >/dev/null 2>&1
+  local rc=$?
+
+  local log_content
+  log_content=$(cat "$root/home/.maxy-code/logs/cloudflared.log" 2>/dev/null || echo "")
+  cleanup "$root"
+
+  if [[ $rc -ne 0 ]]; then
+    echo "  expected exit 0, got $rc"; return 1
+  fi
+  if ! echo "$log_content" | grep -q "spawned service=cloudflared-maxy-code.service"; then
+    echo "  a busy rotate lock blocked the tunnel spawn"; echo "$log_content"; return 1
+  fi
+  if ! echo "$log_content" | grep -q "rotate-lock busy"; then
+    echo "  proceeding without the lock was not logged"; echo "$log_content"; return 1
+  fi
+  return 0
+}
+
 run_case "skip when service active" case_skip_when_scope_active
 run_case "spawn succeeds and logs verified" case_spawn_succeeds
 run_case "spawn with no connection logs ERROR exits 0" case_spawn_no_connection
@@ -635,6 +712,8 @@ run_case "reap: skip when active unit's MainPID is unresolved" case_reap_skip_wh
 run_case "token tunnel spawns without --origincert" case_token_tunnel_spawns_without_origincert
 run_case "configured tunnel with no run credential refuses loudly" case_refuse_when_no_run_credential
 run_case "corrupt tunnel.state refuses loudly and exits 0" case_refuse_on_invalid_state_json
+run_case "holds the rotate lock during verify" case_holds_rotate_lock_during_verify
+run_case "busy rotate lock does not block spawn" case_busy_rotate_lock_does_not_block_spawn
 
 echo ""
 echo "Results: $PASS passed, $FAIL failed"

package/payload/platform/scripts/logs-rotate.sh

@@ -0,0 +1,204 @@
+#!/usr/bin/env bash
+# Brand log rotation — Task 1706.
+#
+# WHY THIS EXISTS AND NOT logrotate: server.log, edge.log and cloudflared.log
+# are systemd stdout sinks (`StandardOutput=append:`, see
+# packages/create-maxy-code/src/port-resolution.ts:233 and
+# platform/scripts/resume-tunnel.sh:230). systemd opens the file O_APPEND ONCE
+# at unit start and the process holds that fd for its whole life. logrotate's
+# default rename-then-create would leave every service writing into the rotated
+# inode forever — rotation would look like it worked while the live file stayed
+# empty. So we gzip a COPY and truncate IN PLACE: because the fd is O_APPEND,
+# each write seeks to end-of-file first, so writes resume at offset 0 with no
+# service restart and no sparse hole. Verified against a real systemd unit on
+# 2026-07-17 (laptop 192.168.88.10): NRestarts=0, file 71 -> 0 -> 80 bytes for
+# 10 fresh lines. Never replace `: > "$F"` with a mv.
+#
+# Portability: this runs on Linux (cron) and darwin (launchd StartInterval), so
+# no flock(1) (absent on darwin) and no `date +%N` (GNU-only). The lock is a
+# mkdir, which is atomic on both. find's -mmin/-mtime/-delete and the timestamp
+# format were confirmed identical on both platforms.
+#
+# Usage: logs-rotate.sh [LOGS_DIR]
+set -uo pipefail
+
+ROTATE_SIZE_BYTES=$((64 * 1024 * 1024))
+KEEP=5
+STALE_LOCK_MINUTES=30
+
+# Resolve the logs dir the same way logs-read.sh:52-58 does: convention is
+# configDir = ".${installDir}".
+if [ "$#" -ge 1 ] && [ -n "${1:-}" ]; then
+  LOGS_DIR="$1"
+else
+  SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+  PLATFORM_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+  INSTALL_DIR="$(dirname "$PLATFORM_ROOT")"
+  LOGS_DIR="$HOME/.$(basename "$INSTALL_DIR")/logs"
+fi
+
+# Absent logs dir is not an error: the installer creates it, and a rotator tick
+# that lands before the first install completes has nothing to do.
+[ -d "$LOGS_DIR" ] || exit 0
+
+LOCK="$LOGS_DIR/.rotate.lock"
+
+stamp() { date -u +%Y-%m-%dT%H:%M:%SZ; }
+
+# A mkdir lock is NOT released by the kernel when its holder dies, so a crashed
+# rotator would wedge rotation permanently and silently — worse than the race
+# the lock prevents. Reclaim on age: 30 min is two rotator ticks and 90x
+# resume-tunnel.sh's 20s window, so no live holder is mistaken for a dead one.
+#
+# The reclaim moves the stale lock aside with `mv` before recreating it, rather
+# than `rm -rf`-then-mkdir. `mv` is the atomic gate: if two ticks both see the
+# same stale lock, only one can move that inode — the loser's `mv` fails because
+# the source is already gone, and it backs off. rm-then-mkdir had no such gate:
+# the loser would delete the winner's brand-new lock and both would rotate,
+# shifting generations twice for one new .1.gz.
+acquire_lock() {
+  if mkdir "$LOCK" 2>/dev/null; then return 0; fi
+  if [ -d "$LOCK" ] && [ -z "$(find "$LOCK" -maxdepth 0 -mmin -"$STALE_LOCK_MINUTES" 2>/dev/null)" ]; then
+    local stale="$LOCK.stale.$$"
+    mv "$LOCK" "$stale" 2>/dev/null || return 1   # lost the reclaim race
+    rm -rf "$stale" 2>/dev/null
+    echo "$(stamp) [logs-rotate] stale-lock-reclaimed lock=$LOCK age-min=>$STALE_LOCK_MINUTES"
+    mkdir "$LOCK" 2>/dev/null && return 0          # a third tick may have won; then back off
+  fi
+  return 1
+}
+
+if ! acquire_lock; then
+  # Another rotator tick, or a resume-tunnel.sh verification window, is live.
+  # Exit 0: the next tick is 15 min away and the bound is not tight enough for
+  # a skipped tick to matter.
+  echo "$(stamp) [logs-rotate] skipped reason=lock-held lock=$LOCK"
+  exit 0
+fi
+trap 'rmdir "$LOCK" 2>/dev/null || true' EXIT
+
+size_of() { wc -c < "$1" 2>/dev/null | awk '{print $1+0}'; }
+
+# Size-rotate one file: gzip a copy to a temp, shift older generations, move the
+# temp into .1.gz, truncate in place, then mark the truncation so the file is
+# never mistaken for one that simply starts there.
+#
+# ORDER IS LOAD-BEARING: gzip FIRST, shift only once it succeeded. The shift used
+# to run first, so a gzip failure moved .4->.5 ... .1->.2 and wrote nothing to
+# .1 — dropping the oldest generation and leaving a hole, on every tick. The
+# trigger is ENOSPC, i.e. precisely the condition rotation exists to prevent: 75
+# minutes of a full disk destroyed 4 of the 5 retained generations while
+# correctly refusing to truncate. Never hoist the shift above the gzip.
+rotate_file() {
+  local f="$1" base size i prev
+  [ -f "$f" ] || return 0
+  size="$(size_of "$f")"
+  [ "$size" -gt "$ROTATE_SIZE_BYTES" ] || return 0
+  base="$(basename "$f")"
+
+  # gzip to a temp first, so a failure (or a tick killed mid-compress) costs
+  # nothing: no generation has moved and the live file is untouched.
+  #
+  # gzip's stderr is CAPTURED, not discarded, and relayed verbatim on failure —
+  # it is the only thing that distinguishes ENOSPC from EACCES from a missing
+  # binary. `2>&1 >file` sends stderr to the command substitution and stdout to
+  # the temp; the order matters.
+  #
+  # A live log grows while gzip reads it, so gzip emits "file size changed while
+  # zipping" on nearly every real rotation. That is a WARNING and gzip still
+  # exits 0 (verified on the laptop against a file being appended to during the
+  # read), so it takes the success path and the noise is never logged. Only a
+  # genuine non-zero exit reaches the branch below.
+  local gzerr
+  gzerr="$(gzip -c "$f" 2>&1 >"$f.1.gz.tmp")"
+  if [ $? -ne 0 ]; then
+    rm -f "$f.1.gz.tmp"
+    echo "$(stamp) [logs-rotate] ERROR file=$base reason=gzip-failed bytes=$size err=$(printf '%s' "$gzerr" | tr '\n' ' ') — not truncated, generations intact"
+    return 1
+  fi
+
+  # Shift down from the oldest so nothing is overwritten before it moves. The
+  # KEEP-th generation is overwritten by the (KEEP-1)-th, which is how the
+  # oldest falls off.
+  i="$KEEP"
+  while [ "$i" -gt 1 ]; do
+    prev=$((i - 1))
+    [ -f "$f.$prev.gz" ] && mv -f "$f.$prev.gz" "$f.$i.gz"
+    i="$prev"
+  done
+  mv -f "$f.1.gz.tmp" "$f.1.gz"
+
+  # THE load-bearing line. Truncate in place; do not mv. See the header.
+  #
+  # Lines written between gzip reaching EOF and this truncate are LOST. gzip
+  # reads to the CURRENT end of file, so the window is the shift plus two mvs —
+  # milliseconds, not the seconds the gzip itself takes. Inherent to
+  # copy-truncate, which the O_APPEND fd leaves no way around.
+  #
+  # `size` was sampled BEFORE gzip ran, so on a live log the archive legitimately
+  # holds slightly MORE than prev-bytes reports. prev-bytes locates the seam
+  # approximately, not exactly. See .docs/brand-log-retention.md.
+  : > "$f"
+  echo "$(stamp) [logs-rotate] rotated file=$base prev-bytes=$size prev-file=$base.1.gz keep=$KEEP" >> "$f"
+}
+
+PURGE_DAYS=7
+
+for f in server.log edge.log cloudflared.log check-due-events.log; do
+  rotate_file "$LOGS_DIR/$f"
+done
+
+# Globbed size targets. nullglob so a brand with none of these yet does not try
+# to rotate a literal '*' path.
+#
+# mcp-*-stderr-*.log: the tee holds a live write stream, so this is the ONLY
+# bound it gets here — see the purge note below for why it is never age-purged.
+#
+# rc-child-*.log: its 16 MiB writer cap does NOT hold. `written`
+# (rc-child-log.ts:33) is in-memory per manager process, so a manager restart
+# resumes appending to the same path with a fresh counter. Observed at 54 MB on
+# sitedesk-code, 3.25x the cap. A long-lived session's file also has a fresh
+# mtime forever, so the age purge below never reaches it — without size rotation
+# it is genuinely unbounded.
+shopt -s nullglob
+for f in "$LOGS_DIR"/mcp-*-stderr-*.log "$LOGS_DIR"/rc-child-*.log; do
+  rotate_file "$f"
+done
+shopt -u nullglob
+
+# Age purge — rc-child only.
+#
+# rc-child-*.log is one file per session and the set grows without bound (100 on
+# sitedesk-code). Purging it is SAFE because rc-child-log.ts:51 writes with
+# appendFileSync: no fd is held, so a purged file is simply recreated on the
+# next write.
+#
+# mcp-*-stderr-*.log is deliberately NOT purged, though an earlier draft did.
+# The tee (mcp-stderr-tee/src/index.ts:88) opens a createWriteStream at process
+# start and holds it for the process's whole life, writing only when the server
+# emits stderr — which a healthy server does not do for days. So a LIVE file's
+# mtime DOES go stale, and deleting it would send every later stderr write to an
+# unlinked inode: invisible exactly when the fault you are chasing finally
+# appears, and its disk unreclaimed until the process exits. Bounding these by
+# age needs live-vs-dead discrimination, which needs the writer to stop pinning
+# its date at boot — that is Task 1721. Size rotation above is safe regardless,
+# because truncate-in-place is precisely what a held fd tolerates.
+#
+# The pattern is `.log*` so a purged session's rotated .gz generations go too.
+# `find` matches each path by its own mtime — there is no sibling relationship —
+# so a LIVE rc-child's generations also age out at 7 days. That is intended:
+# retention for rc-child is min(KEEP, 7 days), and 7 days of a session's spawn
+# output is the stated bound.
+# One traversal, and the count is what was actually deleted rather than what a
+# separate counting pass saw a moment earlier. `-print` before `-delete` prints
+# each path as it goes.
+purge_old() {
+  local pattern="$1" n
+  n="$(find "$LOGS_DIR" -maxdepth 1 -name "$pattern" -type f -mtime +"$PURGE_DAYS" -print -delete 2>/dev/null | wc -l | awk '{print $1+0}')"
+  [ "$n" -gt 0 ] || return 0
+  echo "$(stamp) [logs-rotate] purged pattern=$pattern files=$n older-than-days=$PURGE_DAYS"
+}
+
+purge_old 'rc-child-*.log*'
+
+exit 0

package/payload/platform/scripts/resume-tunnel.sh

@@ -194,6 +194,24 @@ log "Resuming tunnel $TUNNEL_ID for $DOMAIN..."
 # Capture log byte offset before spawning so the verification poll only
 # matches lines written by THIS invocation, not lines from a prior run.
 mkdir -p "$LOG_DIR"
+
+# Task 1706 — hold the log rotator's lock across offset-capture → verify-poll.
+# logs-rotate.sh truncates cloudflared.log in place when it exceeds 64 MiB; a
+# rotation landing inside this window makes `tail -c "+$LOG_OFFSET"` read past
+# EOF and report a tunnel failure that did not happen. Same mkdir primitive as
+# the rotator (no flock(1) on darwin, and a lock is only a lock if both ends
+# agree). Best-effort: if the lock cannot be taken we proceed anyway rather than
+# refuse to bring the tunnel up — a false-alarm log line is a far smaller
+# failure than a tunnel that never starts.
+ROTATE_LOCK="$LOG_DIR/.rotate.lock"
+ROTATE_LOCK_HELD=0
+if mkdir "$ROTATE_LOCK" 2>/dev/null; then
+  ROTATE_LOCK_HELD=1
+  trap 'rmdir "$ROTATE_LOCK" 2>/dev/null || true' EXIT
+else
+  log "rotate-lock busy — proceeding without it; a concurrent rotation may skew the verify gate"
+fi
+
 LOG_OFFSET=$(wc -c < "$LOG_FILE" 2>/dev/null | awk '{print $1+0}' || echo 0)
 
 # Spawn into a SUPERVISED transient service under cloudflared.slice (Task 757).
@@ -264,6 +282,15 @@ else
   log "ERROR: tunnel service started but no edge connection within ${VERIFY_DEADLINE}s — service=$SERVICE_UNIT"
 fi
 
+# Task 1706 — release the rotator's lock. The verify gate above is the only
+# offset-sensitive window, so holding it past here would make a rotator tick
+# skip for no reason.
+if [ "$ROTATE_LOCK_HELD" -eq 1 ]; then
+  rmdir "$ROTATE_LOCK" 2>/dev/null || true
+  ROTATE_LOCK_HELD=0
+  trap - EXIT
+fi
+
 # Update state file: keep pid/startedAt for observability, add serviceUnit as control signal.
 NEW_STATE=$(echo "$STATE" | jq \
   --arg unit "$SERVICE_UNIT" \