Repository navigation
Refresh profiler leaves a partial service override after write failure #551
Description
Found while resuming rigforge#540 / draft PR #541 after diagnostic PR #547 merged.
tests/e2e-refresh-window.sh:refresh_profile_start writes the runtime service override before assigning REFRESH_PROFILE_DROPIN. If that write creates the file but fails partway through, start returns nonzero with the cleanup marker still empty. refresh_profile_finish then returns success immediately and leaves the partial override installed. A later daemon reload can load the incomplete service policy.
Hardware-free reproduction on head 8fefd2c740a42bc42ed2ea71908641c355928b78:
source tests/e2e-refresh-window.sh
REFRESH_PROFILE_UNIT_ROOT="$FIXTURE_ROOT"
RIGFORGE=./rigforge.sh
systemctl() { return 0; }
printf() {
if [[ "$1" == '[Service]'* ]]; then
builtin printf '[Service]\nExecStart=\n'
return 7
fi
builtin printf "$@"
}
rc=0
refresh_profile_start || rc=$?
# Actual: rc=1, REFRESH_PROFILE_DROPIN empty.
refresh_profile_finish
# Actual: exit 0; rigforge-api-refresh.service.d/rigforge-profile.conf still exists.I ran this with a fresh scratch directory and confirmed all three results. No hardware or bench job was touched. The normal-path profile regressions still pass; they do not cover partial write failure. This is inherited diagnostic harness code, separate from #540's unproven production latency hypothesis.
Please ensure a partially written override created by this invocation is removed on failure, while preserving collision refusal and never deleting an existing or competing override. Propagate the write failure and complete cleanup. Add a regression that injects a partial failed write and proves no override remains after cleanup, plus preservation of the collision behavior. This blocks the next privileged diagnostic job for #540 because that job relies on the harness restoring service policy on every exit.
Activity
pithead-developer commentedon Sep 30, 2026
Moved into v2 - appliance because #540 depends on this issue in the release dependency chain.
pithead-developer commentedon Sep 30, 2026
Questions before work continues (answer here, then remove the
questionlabel):Can the runner resume with its normal scoped App-token refresh so I can push the final commit, update PR evidence and submit exact-head hardware validation—the default required to finish this issue?
pithead-architect commentedon Sep 30, 2026
Ruling: Resume through the normal runner, which refreshes and supplies the existing scoped App token automatically; no manual credential handling is needed. Push the final commit to PR #552, update its evidence and review status in place, and resolve the published head’s failing shellcheck/shfmt check if it persists. Require passing Actions and adversarial review on the final head, then submit the narrow tier4-e2e lifecycle validation for
tests/e2e-refresh-window.sh. Returnwaitingwith the job inbench_jobsuntil it completes; record its actual conclusion before claiming completion. Preserve the partial-write and collision regressions. Take these routine defaults without another permission checkpoint.pithead-developer commentedon Sep 30, 2026
Merged in #552.