vh
c488eadc31
The in-flight section was a day stale: it still described run 3c as the live subject on a box where nothing had moved. Rewritten around what is actually true now -- v3 deployed fleet-wide, the post office relocated to nh3-docker, sec serving on GPU0, run 3c still held on power. Six new decision entries, three of which carry findings that outlive their incident: the inbound half of the handle-resolution bug (a stale ALTHING_HANDLE reads another agent's mailbox and reports it empty, which is a second route into the failure v3 exists to prevent), the OOM attribution to Claude Code sessions, and the operator's two explicit belays recorded so a later session does not re-raise them as new. Auto-archival fired at 301 lines and moved exactly one entry. Three others were old enough and every one carries a still-open deferred pointer -- the parked CI flip, muninn-gate's submit path, and the triton backend deferred to the Ada refresh. Held back per the guards; an over-cap file that keeps live decisions beats a scannable one that lost them. The entry that did move had its deferred item closed today: nh3-extdev's staged v2.1.2 wheel is moot now that the box runs 3.1.1.
3.6 KiB
[2026-08-28] A stale ALTHING_HANDLE silently reads ANOTHER agent's inbox and reports it empty
Found by pewpew-dev, whose session posted as forseti all day. Mechanism:
ALTHING_HANDLE inherited from the environment
+ nothing binding a shell to the handle it may query
= the env var wins, silently, with no warning and no error
Measured, same shell, same second, no credential, no complaint:
ALTHING_HANDLE=infra-ops postbox status -> infra-ops' mailbox
ALTHING_HANDLE=forseti postbox status -> forseti's mailbox
ALTHING_HANDLE=pewpew-dev postbox status -> pewpew-dev's mailbox
⚠ THE INBOUND HALF IS THE SERIOUS ONE, AND IT IS INVISIBLE
Outbound mis-signing sometimes gets caught: a peer notices the sender cannot hold that context — which is exactly how this surfaced, when forseti was asked a pewpewstudio question.
Inbound never does. A session with a stale handle runs postbox peek, reads SOMEONE ELSE'S
mailbox, and is told — confidently, correctly, nothing broken anywhere — that it has nothing
unread. Measured cost: my reply sat unread until pewpew-dev's operator asked whether they were
blocked on me.
This is a SECOND route into the failure v3 exists to prevent. The guarantee — "an unreachable post office is an OUTAGE, never an empty inbox" — holds, and does not cover this: the post office is reachable and answers correctly, about someone else. Nothing is down, so the outage semantics never fire. forseti has stopped describing that guarantee as though it closes the empty-inbox class; it closes one route into it.
⚠ MY GROUNDING WAS WRONG, AND THE CORRECTION MADE IT WORSE
I measured "41 of 79 project dirs mapped in ~/.althing/session_handles.json" and called the 46
unmapped ones exposed. session_handles.json is a v2 artifact that v3 never opens —
grep -rn session_handles althing/ is empty, and postbox.resolve_config takes --handle then
ALTHING_HANDLE and nothing else. So the exposure is LARGER than my number implied: every
directory is in the same position, because the map is consulted for none of them.
The same stale data source had survived inside my statusline rewrite that morning. I updated
the v2 block's COMMANDS and kept its DATA SOURCE — the commands were the visible half of the
cutover and the source was not. Fixed (8a04d6f): it reads launch-history.json now (written by
dev_launch, shape {cwd: {command: {at, handle}}}, take the most recent by at).
The fix that shipped, and why my proposal was the worse one
I proposed printing the resolution source (handle: forseti (from ALTHING_HANDLE)). forseti
killed it with one observation: postbox status already prints the handle, first field, every
call. pewpew-dev had forseti on screen and it did not register. The information was never
missing; the salience was. That generalised into the rule that chose the design: a line that is
always there teaches the reader to skip it, so a warning beats a field.
Shipped as 3.1.1 — warn (never refuse; a legitimate cross-project send is real) when the cwd's
launch-history names a different handle, on stderr, BEFORE the output it is about. Keyed by
directory across commands, not (directory, command) — one repo hosting a claude and a codex
session under different handles is normal, and a warning that fires on a legitimate case is one
people learn to ignore.
⚠ Its silence is not an all-clear: 8 of 79 directories are in launch-history.json, so the
quiet case is ~90% of the box. forseti put that caveat in a TEST NAME
(test_an_unlaunched_directory_says_nothing) because prose gets skimmed and a test goes red.