1 Commits

Author	SHA1	Message	Date
xarmian	110045578c	fix(build): make install proves what it installed and what it restarted (BUG-2897, TASK-2787) (#1272) ... `make install` made three claims it did not check. 1. It brought the server back BY SIDE EFFECT -- `pad auth whoami` triggers an auto-start, which does not know the killed process's argv. A server running `--host 0.0.0.0` came back bound to the default host alone: curl 127.0.0.1:7777 -> 000 while the LAN address -> 200, with the process count and the version both reading correct (BUG-2897). 2. `cp` copied whatever was at the repo path, not what the invocation built. Two sessions sharing the checkout interleave and the loser's build is installed by the winner, every exit code green (TASK-2787). 3. "Server restarted." was printed after a command ending in `|| true`, with no probe of any kind. Not "the wrong address went unverified" -- nothing was verified. Found reading the recipe; neither filing names it, and it is what made the other two invisible. The logic moves to scripts/install-refresh.sh for one reason above readability: a script can be TESTED. internal/buildtools drives it against a compiled stub `pad`, including the branches where a check must FAIL. Recipe-inline logic is only exercisable by running `make install`, which stops the developer's server -- a test nobody runs twice, which is how this target accumulated three unverified claims. The script checks OUTCOMES rather than steps: what got installed, and what is answering afterwards. Two commit checks, deliberately, answering different questions -- the ARTIFACT before the kill, so a wrong build costs an error instead of an outage, and the DESTINATION after the copy, which is the shared-path race TASK-2787 names. The restart uses the argv read from /proc before the kill, and nothing is printed about a restart until the server answers on BOTH 127.0.0.1 and the configured host (`--host 0.0.0.0` resolving to loopback plus the primary LAN address, since 0.0.0.0 is a bind spec, not something to curl). Three defects were found in the fix itself, by its own tests and by the first real run: - The restart redirected to $HOME/.pad/server.log with nothing creating that directory. On a fresh HOME the redirect fails, the server never starts, and the probe reports "did not answer" -- true, and three steps downstream. Invisible to every hand-run this script could have had, because a developer's box has ~/.pad by luck of history. - The post-copy check SURVIVED its mutant: both fixtures reported the same version from source and destination, so the guard and its absence were indistinguishable. Fixed by making the stub's version depend on its path. - Comparing commits by equality rejected a healthy build. `git rev-parse --short` returns the shortest UNAMBIGUOUS prefix, so its width grows with the object database: the binary embedded `a3a1d58` and the Makefile produced `a3a1d586` minutes later. Now a prefix comparison in either direction, with a negative leg pinning that a genuinely different commit of the same width is still refused. Five mutants, each verified to compile, each detected by its own leg. Verified end to end on the real box: captured `--host 0.0.0.0`, installed a3a1d586, restarted with that argv, both addresses answering, /proc/exe matching the installed binary. CONVE-2687's manual sibling-safe recipe is unchanged and remains the path to use when another session's worktree is live; this makes the plain target honest, it does not replace the convention. NINE adversarial rounds ran before one returned nothing new. They found twelve more defects, each verified in the code before being accepted: - The probe used a fixed port while the restart preserved `--port N`. - Only `--flag value` was parsed; Cobra accepts `--flag=value` too. - The artifact check and the copy were separated by a window another session could write into, so a swap was caught only AFTER the kill. The copy is now STAGED beside the destination, verified there, and moved into place with a rename. - `setsid` is Linux-only and would have failed on macOS after the stop. - A host or port configured only in ~/.pad/config.toml was ignored, so such a user would have seen every install fail. - A TOML inline comment (`port = 8080 # dev`) was swallowed into the value. - $INSTALLED could be replaced between the outcome check and the exec. - Comparing abbreviations by PREFIX accepts two different commits sharing seven characters -- the same mechanism that makes abbreviations grow. Ids are now resolved with `git rev-parse` and compared in full; an id that cannot be resolved is REFUSED rather than prefix-matched. - The argv capture read /proc only, so on macOS it captured nothing and the restart fell back to defaults -- the fix silently absent on the platform the setsid fallback had just been added for. - A wildcard bind whose LAN address could not be determined was reported as a success having verified only loopback. It now FAILS CLOSED. - `localhost` was mapped to 127.0.0.1 unconditionally, failing a healthy IPv6 bind. - `local` was used at top level, so bash printed an error to stderr on every normal refresh while the script kept working. - More than one running server is now REFUSED rather than guessed: the stop is a system-wide pkill and the restart can only restore one argv. Twenty mutants, each verified to compile, each detected by its own leg. SEVEN survived first -- the destination check, the `--flag=value` parse, the setsid guard, the /proc fallback, the wildcard loopback probe, the prefix-collision refusal, and the multi-server refusal. Every one survived for the same reason: the fixtures were drawn from my own model of the input (equal-width commits, one flag spelling, one bind shape, a machine with /proc), so they tested the model rather than the input. Two of them are unreachable on this platform by construction and are reached through documented PAD_NO_SETSID / PAD_NO_PROC knobs, because an untestable branch is how the macOS half would have shipped broken twice. One residual is named rather than closed: a concurrent `make install` can still swap the binary between the final verification and the exec. The complete answer is an exclusive lock across the whole sequence; flock is Linux-only and a lock that silently does nothing on macOS is worse than a named gap. Filed as IDEA-2925. Claude-Session: https://claude.ai/code/session_01HeChkgZVYb3NTgTcckF5KR	2026-09-07 11:48:58 -04:00