Pinky XX: authoritative dismissal — no zombies across both queues (v1.51.0) #79

Merged

ClaudiuSchuster merged 1 commit from oss-oo/pinky-xx-dismiss into main

2026-10-08 16:49:43 +00:00

ClaudiuSchuster commented

2026-10-08 16:48:58 +00:00

Owner

This round makes dismissal authoritative across every representation:

Fingerprint sweep — POST /api/steer/dismiss (body id + optional text/parent/keep) removes the exact child AND every queued observatory steer of the same parent whose prompt carries the same content fingerprint (whitespace-normalized sha256) — retry copies die with the original; the keep arm spares a retry's fresh child (retry re-queues exactly ONE fresh representation; the UI fires the old-attempt sweep after its 202).
Locked rewrite — the sweep mutates stream-pending.json under the dispatcher's own ledger discipline (flock on the .lock sidecar + salvage read + unique-tmp + fsync + atomic replace); a concurrent dispatcher write during the sweep loses nothing.
Dead letters stay truthful — every removed copy is recorded (dropped+dismissed), never a delivered one.
Dismissal guard — a child-keyed TTL window (ZDO_DISMISS_GUARD_TTL_MS, 15 min default) re-sweeps the queue each watcher pass: the mid-delivery exit-3 self-queue and a racing sweeper's resurrected entry die BEFORE any lane can deliver them.
Honest mid-delivery boundary — a live dispatcher means inFlight: nothing killed mid-flight, the UI keeps the chip as a 🚚 delivering chip with the ✎ still armed (settles to not-delivered once the guard kills the re-queue).
UI gap closed — the ✎ dismiss/edit now calls the server for error-state chips too (the pre-XX gap that let a failed steer's queued copy deliver after dismissal).
QQ-F1 follow-up — the expanded-header gate/mute buttons carry the 24 px click-target floor.

Evidence (all green): 584-test offline suite (11 new round-XX tests: sweep, keep arm, edit path, in-flight boundary, guard, racing writer, torn-tail salvage, truthful history); an end-to-end rig driving a REAL observatory process through the exact UI API path (the owner's zombie scenario with a delivery-hot turn boundary → ZERO delivery ever + both dismissals dead-lettered; the control leg proves a queued steer still delivers; failed-without-retry stays dead; edit path old-never-new-once; in-flight boundary with guard kill; live racing writer loses nothing); a trusted-input CDP smoke over the real dashboard (composer, pending chip, not-delivered chip with Retry, dismiss/edit recall, delivering chip, measured ≥24 px boxes). Super-Linter green on the pinned lane set.

Steer #47 (owner live evidence 2026-10-08): a dismissed-and-retried steer DELIVERED anyway. The round-V dismissal removed only the exact synthetic child from the sweeper queue; the failed original's still-queued copy, retry-created copies (same words, fresh child id) and late resurrected copies survived — the zombie. **This round makes dismissal authoritative across every representation:** - **Fingerprint sweep** — `POST /api/steer/dismiss` (body `id` + optional `text`/`parent`/`keep`) removes the exact child AND every queued observatory steer of the same parent whose prompt carries the same content fingerprint (whitespace-normalized sha256) — retry copies die with the original; the `keep` arm spares a retry's fresh child (retry re-queues exactly ONE fresh representation; the UI fires the old-attempt sweep after its 202). - **Locked rewrite** — the sweep mutates `stream-pending.json` under the dispatcher's own ledger discipline (flock on the `.lock` sidecar + salvage read + unique-tmp + fsync + atomic replace); a concurrent dispatcher write during the sweep loses nothing. - **Dead letters stay truthful** — every removed copy is recorded (`dropped`+`dismissed`), never a delivered one. - **Dismissal guard** — a child-keyed TTL window (`ZDO_DISMISS_GUARD_TTL_MS`, 15 min default) re-sweeps the queue each watcher pass: the mid-delivery exit-3 self-queue and a racing sweeper's resurrected entry die BEFORE any lane can deliver them. - **Honest mid-delivery boundary** — a live dispatcher means `inFlight`: nothing killed mid-flight, the UI keeps the chip as a 🚚 delivering chip with the ✎ still armed (settles to not-delivered once the guard kills the re-queue). - **UI gap closed** — the ✎ dismiss/edit now calls the server for error-state chips too (the pre-XX gap that let a failed steer's queued copy deliver after dismissal). - **QQ-F1 follow-up** — the expanded-header gate/mute buttons carry the 24 px click-target floor. **Evidence (all green):** 584-test offline suite (11 new round-XX tests: sweep, keep arm, edit path, in-flight boundary, guard, racing writer, torn-tail salvage, truthful history); an end-to-end rig driving a REAL observatory process through the exact UI API path (the owner's zombie scenario with a delivery-hot turn boundary → ZERO delivery ever + both dismissals dead-lettered; the control leg proves a queued steer still delivers; failed-without-retry stays dead; edit path old-never-new-once; in-flight boundary with guard kill; live racing writer loses nothing); a trusted-input CDP smoke over the real dashboard (composer, pending chip, not-delivered chip with Retry, dismiss/edit recall, delivering chip, measured ≥24 px boxes). Super-Linter green on the pinned lane set.

ClaudiuSchuster added 1 commit

2026-10-08 16:48:58 +00:00

Pinky XX: authoritative dismissal — no zombies across both queues (v1.51.0)

Checks / Functional checks (pull_request) Successful in 26s

Details Explain this check

d0a1600a11

Steer #47 (owner live evidence): a dismissed-and-retried steer
delivered anyway. The round-V dismissal removed only the exact
synthetic child; the failed original's queued copy, retry-created
copies (same words, fresh child id) and late resurrected copies
survived. Now dismissal is authoritative across every representation:

- POST /api/steer/dismiss sweeps stream-pending.json by parent +
  content fingerprint (whitespace-normalized sha256 of the prompt;
  text from the body or the steer's prompt file), so retry copies
  die with the original; a 'keep' arm spares a retry's fresh child
  (retry re-queues exactly ONE fresh representation — the UI fires
  the sweep for the old attempt after its 202).
- The sweep rides the dispatcher ledger_io discipline: flock on the
  .lock sidecar, salvage read (torn-tail raw_decode prefix, non-dict
  entries drop, heals on write), unique-tmp + fsync + os.replace —
  a concurrent dispatcher write loses nothing (race-tested live).
- Every removed copy is dead-lettered (dropped+dismissed), never a
  delivered one; both dismissals of the dismiss-retry-dismiss flow
  land as their own records.
- A child-keyed dismissal guard (15 min TTL, env
  ZDO_DISMISS_GUARD_TTL_MS) re-sweeps the queue each watcher pass:
  the mid-delivery exit-3 self-queue and a racing sweeper's
  resurrected entry die before any lane can deliver them.
- The mid-delivery boundary is honest: a live dispatcher reading
  means inFlight — nothing killed mid-flight, the UI keeps the chip
  as a delivering chip with the dismissal still armed.
- The UI calls the server for error-state chips too (the pre-XX gap
  that let a failed steer's queued copy deliver after dismissal).
- QQ-F1 follow-up: the expanded-header gate selector and master-mute
  toggle now carry the 24 px click-target floor.

Evidence: 584-test offline suite (11 new round-XX tests), an
end-to-end rig driving a real observatory process through the exact
UI API path (owner zombie scenario → zero delivery, happy paths,
edit path, in-flight boundary with guard kill, live racing writer),
and a trusted-input CDP smoke (composer, chips, retry, dismiss/edit
recall, delivering chip, measured 24 px boxes). Super-Linter green
on the pinned lane set.

ClaudiuSchuster merged commit e4297e2e57 into main

2026-10-08 16:49:43 +00:00

ClaudiuSchuster deleted branch oss-oo/pinky-xx-dismiss

2026-10-08 16:49:43 +00:00

ClaudiuSchuster referenced this pull request from a commit

2026-10-08 16:49:43 +00:00

Pinky XX: authoritative dismissal — no zombies across both queues (v1.51.0) (#79)