Repository navigation
Validate public receive observer custody - #800
Merged
flip-engineer merged 2 commits intoOct 17, 2026
Merged
flip-engineer merged 2 commits into
flip-engineer merged 2 commits into
Conversation
This was referenced Oct 17, 2026
flip-engineer
marked this pull request as ready for review
October 17, 2026 05:08
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Public
receiveandrecover-observerretain the attempt’s output and session lock. Live observer recovery required anobserver.logdescriptor that these commands do not open, so valid public observers were refused. Validate the public arguments, database, session, process lifetime, output and lock. Internal--recover-receivealso validates its log descriptor.Validation: the exact-source Linux C harness compiles with
-O2 -Wall -Wextra -Werror; all 14 process/pidfd/descriptor cases pass. The complete executable passes public receive → recovery → recovery with the same native identity and PID, strict output cursor progress175 → 259 → 344, preserved raw inode, normal terminal cleanup and the original task’snative-reviewedreceipt. An unrelated live process is refused and survives.The executable was installed atomically on the homelab. Independent readback verifies SHA256
aac70b1a80ef5f2ba577d616d615abafd20e1513149590102e03585e80c90bb3, owner/group/mode and successful installed CLI smoke. Previous executables remain available as retained hardlinks. Source SHA256:5142e3844039dc768717bcee5a5855b02db557707805e755a8b6ea61871239e1. The generated C preserves the qualified SQLite source from #798. The operator waived the full suite for this emergency change.Extends #798; tracks #696 and #769. The Bend receive-memory change continues in #795; terminal process-lifetime handling continues in #801.