Skip to content

fix(coordinator): tolerate unsupported Windows directory sync - #4459

Open
Yeachan-Heo wants to merge 37 commits into
devfrom
fix/issue-4457-windows-dir-fsync
Open

fix(coordinator): tolerate unsupported Windows directory sync#4459
Yeachan-Heo wants to merge 37 commits into
devfrom
fix/issue-4457-windows-dir-fsync

Conversation

@Yeachan-Heo

@Yeachan-Heo Yeachan-Heo commented Aug 13, 2026

Copy link
Copy Markdown
Owner

Closes #4457
Closes #4593

Coordinator MCP durable writes preserve file fsync, atomic publication, directory ancestry, canonical projection integrity, journal integrity, and strict error propagation. Windows tolerates only unsupported directory-handle EPERM/EACCES/ENOTSUP/EOPNOTSUPP/EINVAL, matching the established broker directory-barrier pattern (sdk/broker/session-index.ts, sdk/broker/discovery.ts — both accept EPERM+EACCES on win32 at open and sync stages); file fsync, rename, and all non-Windows failures remain fail-closed.

Fix-forward included (dev-red unblock, #4593): dev #4573 wired session-manager to import the edit renderer for bounded edit-snapshot receipts, pulling rendererstreaminghashline (and its hashlineedit barrel cycle) into session-manager's module-init order. Result: repo-wide TDZ failures (ReferenceError: Cannot access 'END_PATCH_MARKER' before initialization, analogous handleYouTube/handleDockerHub) failing dev shards 1-4/7-8 at cd51365c and this PR's shard-1 at 96e64f718. Verified inherited, not branch-induced: pristine base 804314081 passes the identical invocations; pristine dev 87b540d2 (the #4573 merge) fails them; bisect pins 9a97601e/1e3e781b green → 87b540d2 red. Fix: the three pure receipt helpers move to node-builtin-only leaf edit/snapshot-receipt.ts; renderer re-exports unchanged; session-manager imports the leaf. Discriminating regression test edit-snapshot-receipt-leaf-init.test.ts pins barrel-first init.

Rebased onto current dev d332b7890 (dev advance since 804314081f: #4584, #4587, #4573, #4557, #4583 — none touch coordinator-mcp; sole overlap is CHANGELOG entry position; canonical digest unchanged because #4583 delta is disjoint): the same 35 coordinator commits plus the 1 fix-forward commit replay with zero conflicts; all 11 coordinator source/test files byte-identical to the reviewed tree ce73f2747f. Prior heads: 96e64f7181 (shard-1 failed on the inherited TDZ), ce73f2747f, 458a13c854, 0aef0fb7a7, 791df2861e.

Review lineage: probepark APPROVED at ce73f2747f (review 4943913192, fresh-worktree 270-test verification) — stale; fresh exact-head review required at this head.

Local verification at exact head 042e8ba9f (base 274766ad6, 37 commits):

  • 18 coordinator suites: 366 pass 0 fail (270 five-suite + 96 across coordinator-mcp/ dir, masking pair, policy/codec/preset/redteam/wake-publisher/runtime-readiness)
  • TDZ regression set: apply-patch-adverserial, safe-summary, package-managers-2, youtube, edit-result-persistence-bounding, edit-snapshot-receipt-leaf-init — all 0 fail (were the failing files)
  • session-manager suites + scripts/ci-dev-affected.test.ts (90 tests): 0 fail
  • bun --cwd=packages/coding-agent run check (biome + tsc): exit 0 (11 warnings pre-exist in fix(session): bound apply_patch transcript metadata #4573's test file)
  • Tree clean; no generated pollution

gajae.pr-review-verdict.v1 needs-human sha256:628835594eca108e598f6268e81002c889be1e6aaf04c117d3a841582fe69b2b reviewer:human reviewer-id:pending evidence:exact-head-042e8ba9f-current-dev-274766ad6-37commits-coordinator-byte-identical-tdz-plus-flake-fixes-verified-fresh-non-author-review-pending


[repo owner's gaebal-gajae (clawdbot) 🦞]

@Yeachan-Heo

Copy link
Copy Markdown
Owner Author

Signed evidence (GJC): #4457 is fixed by commit a50538f. Coordinator durable state now uses one atomic file-sync → rename → directory-barrier contract; Windows suppresses only directory-handle EPERM, EACCES, ENOTSUP, EOPNOTSUPP, and EINVAL, while file fsync and all non-Windows/unexpected directory failures remain fail-closed.

Verification: 133 focused coordinator tests passed; package TypeScript check passed; package check passed with existing warnings. Fresh independent architecture review: CLEAR. Root bun run check:ts remains blocked by unrelated pre-existing telegram SDK manifest digest drift.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a50538f99e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

}

/** Atomically publish a synced coordinator state file, then barrier its parent. */
export async function writeCoordinatorAtomic(

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Document the Windows durability fix in the changelog

This changes the shipped coding-agent coordinator persistence behavior, but the commit leaves packages/coding-agent/CHANGELOG.md unchanged and has no Unreleased entry for #4457. Add a concise entry under ## [Unreleased] describing the Windows directory-sync compatibility fix.

AGENTS.md reference: AGENTS.md:L188-L188

Useful? React with 👍 / 👎.

@Yeachan-Heo
Yeachan-Heo force-pushed the fix/issue-4457-windows-dir-fsync branch from 8515a3c to 7c8e177 Compare August 13, 2026 11:15
@Yeachan-Heo

Copy link
Copy Markdown
Owner Author

Signed replacement-head evidence (GJC)

Head fd07dc44885b73d93c7c71e12c7ef27b5cf00cd1; base 6080b98310038b963479fdc8a499dc326c81fe86. The replacement repairs the Windows directory-handle-open barrier, retains EACCES as fail-closed, and routes durable coordinator journal/diagnostic appends through the same barrier. Local exact-head verification: bun test packages/coding-agent/test/coordinator-durability.test.ts packages/coding-agent/test/coordinator-codex-handoff.test.ts packages/coding-agent/test/coordinator-mcp.test.ts packages/coding-agent/test/coordinator-mcp-server.test.ts = 136 pass; bun --cwd=packages/coding-agent run check:types passed.

Footer: GJC #4457 | head fd07dc4 | base 6080b98

@Yeachan-Heo

Copy link
Copy Markdown
Owner Author

@codex review

Please review only replacement head fd07dc44885b73d93c7c71e12c7ef27b5cf00cd1 against base 6080b98310038b963479fdc8a499dc326c81fe86; prior a50538f evidence is stale. Focus on Windows directory-open/fsync error classification, durable append ordering, and fail-closed file/POSIX behavior.

Footer: GJC #4457 | exact head fd07dc4 | original PR base 6080b98

@Yeachan-Heo

Copy link
Copy Markdown
Owner Author

Signed latest-head evidence (GJC)

Latest PR head 7c8e177f54ddb7c8473a5da0d1c28e0b3009bfaf; original PR base 6080b98310038b963479fdc8a499dc326c81fe86. The new follow-up centralizes question-state journal writes under the coordinator durable append contract with deterministic ordering/failure/cleanup seams. All older evidence is superseded. Latest exact-head local verification is running with the complete focused coordinator suite and package checks; exact-head Dev CI run 31694707091 is in progress.

Footer: GJC #4457 | head 7c8e177 | base 6080b98

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7c8e177f54

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

if (platform !== "win32") return false;
const code = (error as NodeJS.ErrnoException | undefined)?.code;
// Bun reports EPERM when fsync is applied to a Windows directory handle.
return code === "EPERM" || code === "ENOTSUP" || code === "EOPNOTSUPP" || code === "EINVAL";

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Tolerate Windows EACCES for directory barriers

When Windows reports EACCES while opening or syncing the parent directory, this classifier rethrows after the coordinator file has already been fsynced and appended or renamed, so mutations return an error despite having changed durable state and retries can observe an uncertain result. The repository's established Windows directory-barrier implementations explicitly accept EACCES at both stages (packages/coding-agent/src/sdk/broker/session-index.ts:626-641 and packages/coding-agent/src/sdk/broker/discovery.ts:144-159); include it here while retaining strict handling for file fsync failures and all POSIX errors.

Useful? React with 👍 / 👎.

@Yeachan-Heo

Copy link
Copy Markdown
Owner Author

REQUEST_CHANGES — independent latest-head rereview

Reviewed exact head 7c8e177f54ddb7c8473a5da0d1c28e0b3009bfaf against original base 6080b98310038b963479fdc8a499dc326c81fe86 and current dev 0cecbaf819727d2c519ccf33974768058548ab61.

Durability review is clean: the shared helper suppresses only Windows directory open/sync EPERM, ENOTSUP, EOPNOTSUPP, and EINVAL; EACCES, unexpected codes, file fsync/close errors, and all non-Windows directory failures propagate. Atomic writes preserve write → file fsync → close → rename → directory barrier ordering and temporary cleanup. Journal, coordinator state/idempotency, question-state transaction/registry/outbox, Codex handoff/event collision paths, and Codex diagnostics use the centralized primitives without duplicate barriers. A clean merge simulation onto current dev completed without conflicts; the three PR commits apply unchanged after #4372, so a rebase is not technically required.

Blocker: exact-head CI run 31694707091 is terminal failure (Affected path validation / test:@gajae-code/coding-agent:shard-1-of-8, job 94431789886). The failing file is packages/coding-agent/test/discovery/pi-config-dir.test.ts, which expected PI_CONFIG_DIR=.config/gjc but received .gjc. This failure is outside the PR diff, but terminal merge requires green exact-head CI. Route remediation/rerun to the issue mutation owner; this review lane made no source changes.

Local exact-head evidence: bun test ./packages/coding-agent/test/coordinator-durability.test.ts — 12 pass / 0 fail; bunx tsc -p packages/coding-agent/tsconfig.json --noEmit — pass. The broader local coordinator suite could not be used as a signal because this environment lacks the required matching pi_natives addon; package check also reports pre-existing repository-wide Biome diagnostics outside this PR.

Footer: GJC independent rereview | PR #4459 | exact head 7c8e177 | base 6080b98 | current dev 0cecbaf | REQUEST_CHANGES

@Yeachan-Heo

Copy link
Copy Markdown
Owner Author

Signed CI evidence (GJC)

Exact-head Dev CI 31694707091 (head 7c8e177f54ddb7c8473a5da0d1c28e0b3009bfaf, base 6080b98310038b963479fdc8a499dc326c81fe86) was rerun and remains red solely because the broad test:@gajae-code/coding-agent:shard-1-of-8 fails without a surfaced failed-test record. The targeted durability test, type build, package check, CLI smoke, isolated SDK host test, native build, and all state gates pass. This is not merge-ready; the fresh review also identified the coordinator-owned runtime-sidecar atomicity gap.

Footer: GJC #4457 | head 7c8e177 | base 6080b98 | CI 31694707091

@Yeachan-Heo

Copy link
Copy Markdown
Owner Author

Signed dependency evidence (GJC)

Exact run 31694707091, head 7c8e177f54ddb7c8473a5da0d1c28e0b3009bfaf, has only primary failure job 94435666667 (rerun reproduced the same two discovery/pi-config-dir.test.ts PI_CONFIG_DIR expectation failures); evidence producer 94438803670 and aggregate 94438845341 are derivative. Durability-targeted CI is green and exact-head independent review is structurally CLEAR, but this PR remains REQUEST_CHANGES because required CI is red. Repair ownership is accepted by #4436 handoff 8f0cd140-f759-4923-8af0-718bd193fc0f; this lane will rebase the three reviewed durability commits onto its merged dev repair, then run fresh exact-head CI and rereview.

Footer: GJC #4457 | PR #4459 | head 7c8e177 | base 6080b98 | CI 31694707091 | shard 94435666667

@Yeachan-Heo
Yeachan-Heo force-pushed the fix/issue-4457-windows-dir-fsync branch from 7c8e177 to f7fc033 Compare August 13, 2026 12:22
@Yeachan-Heo

Copy link
Copy Markdown
Owner Author

Signed rebased-head evidence (GJC)

#4436 repair merged as dev 3d836d1686980afc2db40088a17321b96840abbe. The three reviewed durability commits were rebased without modification: new exact head f7fc0331e1 over that dev base. Fresh local verification on the rebased head is running: focused coordinator/durability suite, package types, package check, then fresh exact CI and independent rereview.

Footer: GJC #4457 | PR #4459 | head f7fc033 | base 3d836d1

@Yeachan-Heo

Copy link
Copy Markdown
Owner Author

Signed final review-blocker repair (GJC)

Exact replacement head a1b86139952754cfe41de4e7b268ac4329fc98d3 over dev 3d836d1686980afc2db40088a17321b96840abbe fixes all three fresh-review findings: launch failure projection is atomic/durable; readiness marker payload is file-synced with directory barrier; Codex exclusive-path cleanup is fail-closed. Local targeted verification: 259 tests across launch/sidecar/handoff/durability/coordinator suites passed; package types passed. Prior evidence is superseded; fresh CI and independent review are required.

Footer: GJC #4457 | PR #4459 | head a1b8613 | base 3d836d1

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a1b8613995

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

await fs.link(temp, file);
} catch (error) {
await fs.unlink(temp).catch(() => {});
await fs.unlink(temp);

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Keep failed temporary cleanup from masking the link result

When fs.link() reports EEXIST because another process won the bind, a transient failure removing this process's temporary file (for example, a Windows sharing violation) now escapes before the EEXIST branch can load the valid concurrent handoff. The previous best-effort cleanup preserved the link error; keep cleanup best-effort here so an unlink failure does not turn a successful concurrent registration into a request failure.

Useful? React with 👍 / 👎.

@Yeachan-Heo
Yeachan-Heo force-pushed the fix/issue-4457-windows-dir-fsync branch from a1b8613 to 9815acb Compare August 13, 2026 13:13
@Yeachan-Heo

Copy link
Copy Markdown
Owner Author

Signed current-dev rejoin (GJC)

Stale CI/review was stopped after dev advanced through #4467. PR-owned commits were rebased without unrelated edits onto exact dev 4a038bc0774a73ea5e83c686cd701d775feafe73; new exact head 9815acb88d. The dev delta is the Telegram closure-manifest regeneration. Fresh focused/package/generated validation and a new independent review are now required; this comment carries no merge approval.

Footer: GJC #4457 | PR #4459 | head 9815acb | base 4a038bc

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9815acb88d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment on lines +75 to +76
} finally {
await handle.close();

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Ignore EBADF after a successful durable append

When Bun's concurrent child-pipe teardown has already closed a fully written and fsynced append descriptor, handle.close() rejects with EBADF here and turns successful journal publication into a reported failure. Coordinator callers such as appendCoordinatorEvent may then retry despite the record already being durable, creating an uncertain or duplicate event outcome; preserve write/sync failures, but tolerate EBADF from close only after those stages succeeded, as the established handling in packages/coding-agent/src/sdk/broker/session-index.ts:618-621 does.

Useful? React with 👍 / 👎.

@Yeachan-Heo
Yeachan-Heo force-pushed the fix/issue-4457-windows-dir-fsync branch from 9815acb to 1859d7f Compare August 13, 2026 13:45
@Yeachan-Heo

Copy link
Copy Markdown
Owner Author

Signed reviewer-blocker repair (GJC)

Exact replacement head 1859d7ff9ecdf626d0c00512c13b653c2caa5e7f over current dev e3fb0332054fffa4b20d0ded2590fdae01a5c6f2 addresses both current-dev review findings: wake-record durability failures now propagate after diagnostic recording, and readiness directory-barrier errors no longer remap as EEXIST races. Fresh focused coordinator/sidecar verification: 258 pass; package type check passed. Earlier CI/review is stale; final exact-head CI and rereview are required.

Footer: GJC #4457 | PR #4459 | head 1859d7f | base e3fb033

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1859d7ff9e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

};
await ensureDir(eventsDir(namespaceDir));
await fs.appendFile(eventJournalFile(namespaceDir), `${JSON.stringify(event)}\n`);
await appendCoordinatorFile(eventJournalFile(namespaceDir), `${JSON.stringify(event)}\n`);

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Reconcile the sequence after an append barrier failure

When the journal write and file fsync succeed but the newly added close or parent-directory barrier rejects, this call returns before latest-seq.json is advanced even though the event is already present. The next append trusts the still-valid stale sequence file in readLatestEventSeq() instead of inspecting the journal, so it reuses the same sequence number and event ID, leaving duplicate IDs in the journal. Preserve failure propagation, but make subsequent sequence allocation reconcile the cached sequence with the journal after this uncertain append outcome.

Useful? React with 👍 / 👎.

@Yeachan-Heo
Yeachan-Heo force-pushed the fix/issue-4457-windows-dir-fsync branch from 1859d7f to ba4f40d Compare August 13, 2026 14:05
@Yeachan-Heo

Copy link
Copy Markdown
Owner Author

Signed current-dev rejoin (GJC)

All prior evidence is stale after #4468. The six PR-owned coordinator durability commits were replayed without unrelated edits onto exact dev d2f6e8a4091a219f00d3ab304cc1b124e43cc0d3; replacement head ba4f40db9d. Remote head equality and dev ancestry are verified. Fresh focused/package/generated validation is in progress; separate clean-worktree review and exact-head CI remain required.

Footer: GJC #4457 | PR #4459 | head ba4f40d | base d2f6e8a

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ba4f40db9d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

await appendCodexWakeDiagnostic(namespaceDir, event, error);
return null;
});
throw error;

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Keep wake-record failures nonterminal after publication

When a session has a Codex handoff and a wake-eligible event is emitted, any recordCodexWakeEvent() failure now escapes here after the caller's state mutation, event-journal append, and sequence update have already succeeded. For tool mutations, withToolIdempotency() converts that exception into an error response and seals it as completed, so every same-key retry permanently replays a failure even though the requested mutation occurred. Preserve the previous isolation of wake recording, or represent this post-publication failure as a nonterminal/uncertain outcome that can be reconciled rather than sealing it.

Useful? React with 👍 / 👎.

@Yeachan-Heo
Yeachan-Heo force-pushed the fix/issue-4457-windows-dir-fsync branch from ba4f40d to 26ae017 Compare August 13, 2026 14:27
@Yeachan-Heo

Copy link
Copy Markdown
Owner Author

Signed exact-head evidence (GJC)

Exact replacement head 26ae01730f638ea7d4c834d856043aada7825031 over current dev d659a0abfa76d1c4e938265ebf9c63e2a2618973 applies only review-required coordinator durability propagation. Focused coordinator/session-sidecar suite: 258 passed; package type check passed; package check and diff guard are running. Prior review/CI is superseded. Old head ba4f40db shard1 failure is classified external #4474: only packages/coding-agent/test/discovery/pi-config-dir.test.ts PI_CONFIG_DIR baseline expectations failed; evidence producer/aggregate failures were derivative. No discovery/settings/PI_CONFIG_DIR code was changed here.

Footer: GJC #4457 | PR #4459 | head 26ae017 | base d659a0a | external #4474

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 26ae01730f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

} catch (error) {
await appendCodexWakeDiagnostic(namespaceDir, diagnosticEvent, error);
return { auto_bound: false };
throw error;

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Keep explicit auto-bind failures nonterminal

When an explicit Codex handoff exists but bindDelegateCodexHandoff() fails—for example because its durable file write fails—this rethrow occurs after controlSession() accepted the prompt and recordAcceptedPrompt() recorded the running turn. withToolIdempotency() then seals the resulting unavailable response as completed, so same-key retries permanently report failure even though the delegation is already running; preserve the previous { auto_bound: false } isolation or represent this post-delivery outcome as nonterminal.

Useful? React with 👍 / 👎.

process.stderr.write("codex-wake-diagnostic-unwritable\n");
} catch {}
}
await appendCoordinatorFile(

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Keep diagnostic writes best-effort

When the diagnostic log cannot be appended or synced, this helper now rejects instead of swallowing the secondary failure. Background error handlers such as the wake queue catch at line 1560 and detached startup drain at line 2361 await this helper without another guard, so the very error path intended to isolate a wake failure can produce an unhandled rejection and potentially terminate the coordinator; retain durable writes where possible, but make diagnostic persistence best-effort as before.

Useful? React with 👍 / 👎.

@Yeachan-Heo
Yeachan-Heo force-pushed the fix/issue-4457-windows-dir-fsync branch from 26ae017 to daf61d9 Compare August 13, 2026 14:49
@Yeachan-Heo

Copy link
Copy Markdown
Owner Author

Signed current-dev rejoin (GJC)

Dev advanced through #4470 while prior 26ae01730f CI/review was stale. PR-owned durability commits were replayed without unrelated edits onto exact dev 0a736b17ece3c277a586fb53cf9161f371f693dc; replacement head daf61d989be7ff9a0ba665152eec942671566dff. Remote equality and dev ancestry are verified. The old shard1 failure is external #4474 PI_CONFIG_DIR baseline; fresh CI and independent review are required for this head.

Footer: GJC #4457 | PR #4459 | head daf61d9 | base 0a736b1 | external #4474

Yeachan Heo added 27 commits August 15, 2026 23:35
Coordinator wake persistence must not downgrade state or cleanup failures into ordinary transport outcomes.

Fence no-replace publication before cleanup and preserve atomic cleanup, binding, update, and diagnostic failures.

Lore-id: issue-4457-wake-state
Constraint: durability failures remain observable
Confidence: high
Scope-risk: narrow
Reversibility: straightforward
Tested: coordinator MCP, handoff, sidecar, and durability suites
A file sync failure must prevent directory durability work.

Assert the file and directory failure paths independently.

Lore-id: issue-4457-file-sync-order
Confidence: high
Scope-risk: narrow
Tested: coordinator durability, handoff, and MCP server suites
First durable coordinator writes must preserve their newly-created directory entries.

Barrier each created parent, durable removals, and no-replace handoff publication while tolerating only Windows directory support limits.

Lore-id: issue-4457-directory-ancestry
Constraint: directory and cleanup errors remain fail-closed
Confidence: high
Scope-risk: narrow
Reversibility: straightforward
Tested: coordinator durability, handoff, MCP server, and sidecar suites
Canonical state directories and projection cleanup are part of the coordinator durability boundary.

Barrier newly-created state ancestry, durable WAL/projection removals, and fail closed on unreadable projections while skipping recognized lock quarantine artifacts.

Lore-id: issue-4457-canonical-state
Constraint: only proven absence may read as empty
Confidence: high
Scope-risk: narrow
Reversibility: straightforward
Tested: coordinator MCP server, durability, and sidecar suites
Coordinator journals are durable authority and cannot silently skip malformed records.

Reject malformed outbox and event entries before emitting or exposing partial state.

Lore-id: issue-4457-journal-corruption
Constraint: malformed durable state fails closed
Confidence: high
Scope-risk: narrow
Reversibility: straightforward
Tested: coordinator MCP server, durability, and sidecar suites
Parseable but forged journal entries can suppress canonical events or reuse event sequence numbers.

Validate outbox and event schemas before treating durable journal records as authoritative.

Lore-id: issue-4457-journal-schema
Constraint: parseable corruption fails closed
Confidence: high
Scope-risk: narrow
Reversibility: straightforward
Tested: coordinator MCP server, durability, and sidecar suites
Terminal runtime state access errors must not be mislabeled as invalid JSON.

Keep only absence and syntax parsing distinct; propagate other durable storage failures.

Lore-id: issue-4457-terminal-marker-read
Constraint: durable read failures remain fail-closed
Confidence: high
Scope-risk: narrow
Reversibility: straightforward
Tested: session-state-sidecar suite
A durable wake failure and forged outbox collision cannot be silently retried or treated as emitted.

Retain rejected wake tails and require exact persisted outbox records before suppressing canonical events.

Lore-id: issue-4457-wake-outbox-integrity
Constraint: durable wake and outbox failures remain fail-closed
Confidence: high
Scope-risk: narrow
Reversibility: straightforward
Tested: coordinator MCP server, durability, and sidecar suites
Retained rejected wake tails must not create an unhandled rejection.

Observe rejection for cleanup while retaining it for subsequent fail-closed publishers.

Lore-id: issue-4457-wake-tail-observation
Confidence: high
Scope-risk: narrow
Tested: coordinator MCP server and durability suites
Startup wake replay remains observable by readiness callers while avoiding an unhandled rejection before the first coordinator operation.

Lore-id: issue-4457-startup-wake-observer
Constraint: startup durability failures remain fail-closed
Confidence: high
Scope-risk: narrow
Tested: coordinator MCP server and durability suites
Corrupt optional Codex handoffs must be diagnosed without losing terminal coordinator events.

Restore bounded diagnostic-and-continue behavior after durable event publication.

Lore-id: issue-4457-optional-wake-recovery
Constraint: optional handoff corruption cannot erase coordinator events
Confidence: high
Scope-risk: narrow
Reversibility: straightforward
Tested: coordinator Codex bridge, durability, MCP server, and sidecar suites
Corrupt optional handoffs should not discard terminal coordinator events, while wake-record durability failures remain fail-closed.

Classify only corrupt handoff reads as recoverable and keep startup handoff corruption from blocking coordinator readiness.

Lore-id: issue-4457-optional-handoff-boundary
Constraint: wake persistence failures propagate
Confidence: high
Scope-risk: narrow
Reversibility: straightforward
Tested: coordinator Codex bridge, durability, MCP server, and sidecar suites
Optional corrupt handoffs are recoverable coordinator context; their filesystem read failures are not.

Expose typed parse/schema corruption while propagating non-ENOENT storage errors and scope startup recovery to that type.

Lore-id: issue-4457-handoff-io-boundary
Constraint: wake persistence I/O remains fail-closed
Confidence: high
Scope-risk: narrow
Reversibility: straightforward
Tested: coordinator bridge, handoff, durability, MCP server, and sidecar suites
Malformed optional handoff names are corruption of optional context, not a coordinator readiness failure.

Classify them as typed handoff corruption and prove terminal event preservation.

Lore-id: issue-4457-handoff-filename-recovery
Constraint: optional handoff corruption cannot block events
Confidence: high
Scope-risk: narrow
Tested: coordinator bridge, handoff, durability, MCP server, and sidecar suites
Wake persistence failures must fail the initiating coordinator operation without serializing independent Codex threads.

Await queued durability work after releasing the event append queue, and skip/log typed corrupt optional handoff entries.

Lore-id: issue-4457-wake-publication-order
Constraint: wake persistence failures remain observable
Confidence: high
Scope-risk: narrow
Reversibility: straightforward
Tested: coordinator bridge, handoff, durability, MCP server, and sidecar suites
Wake durability diagnostics and cleanup must not hide primary publication, write, or sync failures.

Aggregate concurrent cleanup/close/diagnostic failures and retain non-ENOENT handoff directory errors.

Lore-id: issue-4457-compounded-durability
Constraint: primary filesystem failure remains observable
Confidence: high
Scope-risk: narrow
Reversibility: straightforward
Tested: coordinator bridge, handoff, durability, MCP server, and sidecar suites
Wake recovery and directory barrier failures must retain their primary causes.

Aggregate recovery failures, clear rejected tails after callers observe them, and skip typed optional handoff corruption in auto-binding.

Lore-id: issue-4457-wake-failure-causes
Constraint: coordinator I/O causes remain observable
Confidence: high
Scope-risk: narrow
Tested: coordinator bridge, durability, and MCP server suites
Readiness cleanup and same-thread wake recovery must not hide durability failures or block later work.

Aggregate readiness cleanup failures and continue new wake tails after callers observe a prior rejection.

Lore-id: issue-4457-readiness-wake-recovery
Constraint: primary durability failures remain observable
Confidence: high
Scope-risk: narrow
Reversibility: straightforward
Tested: coordinator bridge, durability, sidecar, and MCP server suites
Readiness retries must reestablish parent durability, and diagnostic writes must not hide coordinator handoff failures.

Barrier matching readiness markers and aggregate primary/diagnostic failures.

Lore-id: issue-4457-readiness-diagnostic-causes
Constraint: primary durability failures remain observable
Confidence: high
Scope-risk: narrow
Reversibility: straightforward
Tested: coordinator bridge, MCP server, durability, and sidecar suites
Typed optional handoff corruption and its diagnostic failure must remain observable together.

Aggregate callback diagnostics and prove raced readiness markers re-barrier their parent.

Lore-id: issue-4457-optional-handoff-diagnostics
Constraint: durability causes remain observable
Confidence: high
Scope-risk: narrow
Reversibility: straightforward
Tested: coordinator bridge, handoff, durability, MCP server, and sidecar suites
Wake-event corruption is durable coordinator state, not optional handoff context.

Classify malformed wake records separately so startup replay propagates their corruption.

Lore-id: issue-4457-wake-record-corruption
Constraint: corrupt wake records fail closed
Confidence: high
Scope-risk: narrow
Reversibility: straightforward
Tested: coordinator bridge, handoff, durability, MCP server, and sidecar suites
Startup readiness must validate every durable wake record, even when optional handoffs are corrupt or absent.

Require canonical wake filenames and record identities before replay.

Lore-id: issue-4457-orphan-wake-validation
Constraint: wake record corruption fails closed
Confidence: high
Scope-risk: narrow
Reversibility: straightforward
Tested: coordinator bridge, handoff, durability, MCP server, and sidecar suites
Durable wake records must have the exact filename update and acknowledgement reconstruct.

Reject numeric aliases and filename-record identity drift before startup replay.

Lore-id: issue-4457-canonical-wake-filenames
Constraint: wake record paths are canonical durable identity
Confidence: high
Scope-risk: narrow
Reversibility: straightforward
Tested: coordinator bridge, handoff, durability, MCP server, and sidecar suites
Wake update keys must match their canonical durable filename identity.

Cover leading-zero aliases so acknowledgements cannot normalize a noncanonical key.

Lore-id: issue-4457-wake-key-alias
Confidence: high
Scope-risk: narrow
Tested: coordinator bridge, handoff, durability, MCP server, and sidecar suites
Windows surfaces the unsupported directory-handle fsync as either EPERM or
EACCES depending on the runtime (#4457's own reproduction shows errno 13
EACCES), and the established broker directory-barrier implementations
(sdk/broker/session-index.ts, sdk/broker/discovery.ts) already accept both
at open and sync stages. The new coordinator classifier tolerated only
EPERM, so a Windows runtime reporting EACCES still failed every mutating
coordinator tool after the file was already durably written.

Lore-id: 9f9582db7746
Constraint: only Windows directory-handle barriers may relax; file fsync and all non-Windows errors stay fail-closed
Tested: bun test coordinator-durability + coordinator-mcp-server + session-state-sidecar + codex-bridge/handoff (270 pass)
Tested: bun --cwd=packages/coding-agent run check (biome + tsc clean)
Supersedes: 6b905d9
Confidence: high
Scope-risk: narrow
Reversibility: trivial
Dev #4573 wired session-manager to the edit renderer for bounded
edit-snapshot receipts, which pulled renderer/streaming (and the
hashline barrel cycle) into session-manager's module-init order.
Any test importing the edit barrel or web-scrapers first then hit
'ReferenceError: Cannot access END_PATCH_MARKER before
initialization' (analogous handleYouTube/handleDockerHub TDZ),
failing dev shards 1-4/7-8 repo-wide.

Move the three pure receipt helpers into node-builtin-only leaf
edit/snapshot-receipt.ts; renderer re-exports unchanged;
session-manager imports the leaf. Discriminating regression test
pins barrel-first initialization.

Lore-id: issue-4593-edit-tdz
Constraint: no behavior change - renderer re-export is the same public surface
Tested: apply-patch-adverserial, safe-summary, package-managers-2, youtube, edit-result-persistence-bounding, session-manager suites, ci-dev-affected selftests, coordinator 18-suite set
Confidence: high
Scope-risk: narrow
Reversibility: clean-revert
Three races in chat-daemon-session-reconnect failed loaded CI shards
(and ~1-in-6 local runs): the ambiguous-acknowledgement test asserted
exactly two provider attempts after a fixed 50ms sleep while the retry
rides wall-clock-scheduled lease recovery; the retry-budget and
rolled-generation tests asserted exact replay-request arrays whose
retry-tail entries race the cursor acknowledgement of the first
publication (sinceSeq 0 vs 1).

Settles now poll the observable (attempt ledger, sixth replay request,
post count) to the wide bound the test timeout already allows, and the
racy array assertions assert the race-free invariants instead: count,
generations, initial cursor from zero, rebuilt attachment resuming from
the acknowledged cursor. No-double-publication semantics unchanged.

Lore-id: issue-4596-chat-daemon-flake
Constraint: test-only change; production semantics untouched
Tested: 45 consecutive green file-level runs (was ~1-in-6 failing); targeted ambiguous-ack test 6/6
Confidence: high
Scope-risk: narrow
Reversibility: clean-revert
@Yeachan-Heo
Yeachan-Heo force-pushed the fix/issue-4457-windows-dir-fsync branch from 081239e to 042e8ba Compare August 15, 2026 23:37
@Yeachan-Heo

Copy link
Copy Markdown
Owner Author

Freshness reconstruction onto dev 274766ad6 (0.13.3 merge-back) — exact head 042e8ba9f; replacement CI running

Dev absorbed the v0.13.3 release merge-back + oMLX provider (#4598) + accumulated fixes. None touch coordinator-mcp source; sole overlap is CHANGELOG entry position. Same 37 commits replayed with zero conflicts; coordinator files remain byte-identical to the approved lineage; the TDZ repair and chat-daemon settle fix are carried intact.

Local at 042e8ba9f: coordinator 270/270, TDZ set + chat-daemon 0 fail (natives addon rebuilt in-worktree; one generated-binding formatting drift reverted to the committed artifact — no generated pollution), check exit 0, tree clean. New canonical digest sha256:628835594eca108e598f6268e81002c889be1e6aaf04c117d3a841582fe69b2b.

@probepark @HaD0Yun @IYENTeam — the product-green terminal at the prior head (run 31913083396, 27 success / sole intentional needs-human) covers this identical content; the replacement run on this head is the merge-authoritative check. APPROVED review at 042e8ba9f12ec3549aeff2d310903c44bc128add once green is the final gate.


[repo owner'"'"'s gaebal-gajae (clawdbot) 🦞]

@chatgpt-codex-connector

Copy link
Copy Markdown

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants