fix(api): flush the summary-access coalescer at lifespan shutdown (BACKLOG #1640) - #1241
wshallwshall wants to merge 3 commits into
Conversation
…decision The UserPromptSubmit hook reported how full the session's context window was and warned the seat "before it runs out of room", claiming a compaction "drops the seat, the goal and the brief, and nothing re-declares them for you". OWNER DECISION 2026-09-16: it must emit nothing, ever. The desktop app compacts automatically when the context overflows, so the warning advertises a failure mode that does not occur, and its central claim about losing the seat and the brief is false. It cost real attention as well as being wrong. A session receiving it on every prompt starts narrating its own context percentage back to the owner, curtails work it should have finished, and treats a normal condition as an emergency. That is why it is disabled rather than reworded. The script is left in place as a no-op carrying the reason, so a reader who finds the wiring does not conclude the file was lost and restore it. The wiring in .claude/settings.json is untouched here on purpose: a missing script would make the hook fail rather than stay quiet. All 65 worktree copies were neutered at the same time, so no live session sees it.
…CKLOG #1640) The M-5 control writes one `summary_access` audit row per (actor, scope, hour) window, so routine console polling does not produce a row per request while a bulk harvest shows a large count. A window is emitted when a LATER access rolls it into a new hour -- so the window open at shutdown was emitted by nothing. `_SummaryAuditCoalescer.flush` existed and documented itself as the engine-shutdown path. NOTHING CALLED IT. Every clean restart therefore dropped the open hour's PHI-summary access audit, and the case where that matters most is the one the control exists for: an operator restarting shortly after a bulk census fetch. Not deployed (section 0), so this is written in the conditional: a first deployment restarted within the hour of a bulk fetch WOULD hold no row for it. WHERE, AND WHY THE ORDER IS LOAD-BEARING The flush runs in the lifespan `finally`, BEFORE `engine.stop()`, because that ends in `store.close()` and the emit needs the store. It is wrapped, on the reaper's precedent: a store error during teardown must not skip `engine.stop()`. aiosqlite's connection worker is non-daemon, so skipping it leaves the process unable to exit -- a lost audit row would become a hung service. CHECKS ruff check pass ruff format --check pass mypy (strict) pass, on the module and the new test new tests 3 passed existing regression 13 passed (test_api.py -k "summary or audit or lifespan") THE CONTROL, run rather than asserted. With the fix stashed out, the new test fails with "the open window was dropped at shutdown: []". With it restored, 3 pass. The suite also carries that control as a test of its own: `test_the_assertion_can_fail` neutralises the flush and requires the row to disappear, so the main assertion cannot pass for some unrelated reason. `test_a_flush_failure_does_not_abort_the_teardown` pins the wrapper: its assertion is narrowly that the lifespan context EXITS when the flush raises. NOT RUN: the full suite, and every leg needing an extra this interpreter lacks (`vault`). The venv used is the primary checkout's; `messagefoundry.__file__` was confirmed to resolve to THIS worktree and to contain the change before any result was trusted. LEDGER: #1640 is not edited here. Banner text for the Lander -- SHIPPED: the coalescer is flushed in the lifespan `finally` before `engine.stop()`, guarded so a flush failure cannot abort the teardown. Both limbs of "what closing looks like" are covered: the flush, and a lifespan-to-shutdown test asserting the row lands.
|
Note for review: this same commit also currently sits on Whichever merges first makes the other's copy redundant; there is no conflict. |
github-actions
Bot
added
the
ci-red
|
THE RED HERE IS REAL, NOT STALE, AND IT IS ONE MISSING FILE. Diagnosed by the Lander at 2026-09-19 17:40Z from run 35177878171 on this head. WHAT FAILS. WHY. Commit 331a77b on this branch gutted SO THE FIX IS IN THIS PULL REQUEST, not on main. Main is green on THE OTHER HALF OF THE CHANGE IS FINE. The #1640 summary-coalescer flush in #1226 CARRIED THE IDENTICAL HEAD and has been closed as a duplicate, with the reason on that PR. NOT DISPATCHING A FIX YET, and saying so rather than leaving it silent. GitHub Actions on this Separately: #1183 unregisters the same hook in |
…ed body Commit 331a77b on this branch disabled scripts/hooks/context-budget.ps1 by owner decision, so it is now a bare `exit 0`. The test file still demanded the old output (a percentage, CEILING WRONG, NO WINDOW RESOLVED) and failed the required repo harness tests leg on PR 1241. The tests now feed the hook every input the old tests used, through both the env knobs and a transcript, and require exit 0 with empty stdout and stderr. A source check pins the body to `exit 0` alone, since behavioural cases can only see the inputs they try. Negative control: injecting one Write-Output into the hook turned 6 of 13 cases red; the hook was restored before commit. BACKLOG #1640 (the PR this rides on).
|
Builder fix for the red Shape A: the tests now assert that the hook is silent. I did not delete the file. Commit 331a77b made What the file checks now:
Other references: Checks I ran (on Windows, in this worktree):
Skipped: the full suite, because it starves under fleet contention. Please read the No ledger edit. Proposed banner text, if the Lander wants one: nothing new is needed. This commit only realigns tests that the #1640 PR's own hook change broke. |
1 participant
The M-5 control writes one
summary_accessaudit row per(actor, scope, hour)window, so routine console polling does not produce a row per request while a bulk harvest shows a large count. A window is emitted when a later access rolls it into a new hour -- so the window open at shutdown was emitted by nothing._SummaryAuditCoalescer.flushexisted and documented itself as the engine-shutdown path. Nothing called it. Every clean restart dropped the open hour's PHI-summary access audit, and the case where that matters most is the one the control exists for: an operator restarting shortly after a bulk census fetch.Not deployed (section 0), so this is in the conditional: a first deployment restarted within the hour of a bulk fetch would hold no row for it.
Where, and why the order is load-bearing
The flush runs in the lifespan
finally, beforeengine.stop(), because that ends instore.close()and the emit needs the store.It is wrapped, on the reaper's precedent: a store error during teardown must not skip
engine.stop(). aiosqlite's connection worker is non-daemon, so skipping it leaves the process unable to exit -- a lost audit row would become a hung service.The control, run rather than asserted
With the fix stashed out, the new test fails with
the open window was dropped at shutdown: []. With it restored, 3 pass.The suite carries that control as a test of its own:
test_the_assertion_can_failneutralises the flush and requires the row to disappear, so the main assertion cannot pass for some unrelated reason.test_a_flush_failure_does_not_abort_the_teardownpins the wrapper, and its assertion is narrowly that the lifespan context exits when the flush raises.The durability assertion reads the audit through a second store opened on the same file after shutdown -- reading through the app's own store would prove nothing, since surviving
store.close()is the property under test.Checks
ruff checkruff format --checkmypy(strict)test_api.py -k "summary or audit or lifespan")Not run: the full suite, and every leg needing an extra this interpreter lacks (
vault). Those must be read on the runner.The venv used is the primary checkout's.
messagefoundry.__file__was confirmed to resolve to this worktree and to contain the change before any result was trusted -- an editable install can be a copy, and green over the wrong tree means nothing.Ledger
#1640 is not edited here. Banner text for the Lander: