vh
c488eadc31
The in-flight section was a day stale: it still described run 3c as the live subject on a box where nothing had moved. Rewritten around what is actually true now -- v3 deployed fleet-wide, the post office relocated to nh3-docker, sec serving on GPU0, run 3c still held on power. Six new decision entries, three of which carry findings that outlive their incident: the inbound half of the handle-resolution bug (a stale ALTHING_HANDLE reads another agent's mailbox and reports it empty, which is a second route into the failure v3 exists to prevent), the OOM attribution to Claude Code sessions, and the operator's two explicit belays recorded so a later session does not re-raise them as new. Auto-archival fired at 301 lines and moved exactly one entry. Three others were old enough and every one carries a still-open deferred pointer -- the parked CI flip, muninn-gate's submit path, and the triton backend deferred to the Ada refresh. Held back per the guards; an over-cap file that keeps live decisions beats a scannable one that lost them. The entry that did move had its deferred item closed today: nh3-extdev's staged v2.1.2 wheel is moot now that the box runs 3.1.1.
61 lines
3.6 KiB
Markdown
61 lines
3.6 KiB
Markdown
# `[2026-08-28]` A stale `ALTHING_HANDLE` silently reads ANOTHER agent's inbox and reports it empty
|
|
|
|
Found by pewpew-dev, whose session posted as **forseti** all day. Mechanism:
|
|
|
|
ALTHING_HANDLE inherited from the environment
|
|
+ nothing binding a shell to the handle it may query
|
|
= the env var wins, silently, with no warning and no error
|
|
|
|
Measured, same shell, same second, no credential, no complaint:
|
|
|
|
ALTHING_HANDLE=infra-ops postbox status -> infra-ops' mailbox
|
|
ALTHING_HANDLE=forseti postbox status -> forseti's mailbox
|
|
ALTHING_HANDLE=pewpew-dev postbox status -> pewpew-dev's mailbox
|
|
|
|
## ⚠ THE INBOUND HALF IS THE SERIOUS ONE, AND IT IS INVISIBLE
|
|
|
|
**Outbound** mis-signing sometimes gets caught: a peer notices the sender cannot hold that
|
|
context — which is exactly how this surfaced, when forseti was asked a pewpewstudio question.
|
|
|
|
**Inbound never does.** A session with a stale handle runs `postbox peek`, reads SOMEONE ELSE'S
|
|
mailbox, and is told — confidently, correctly, nothing broken anywhere — that it has nothing
|
|
unread. Measured cost: my reply sat unread until pewpew-dev's operator asked whether they were
|
|
blocked on me.
|
|
|
|
**This is a SECOND route into the failure v3 exists to prevent.** The guarantee — *"an
|
|
unreachable post office is an OUTAGE, never an empty inbox"* — holds, and does not cover this:
|
|
the post office is reachable and answers correctly, **about someone else**. Nothing is down, so
|
|
the outage semantics never fire. forseti has stopped describing that guarantee as though it
|
|
closes the empty-inbox class; it closes one route into it.
|
|
|
|
## ⚠ MY GROUNDING WAS WRONG, AND THE CORRECTION MADE IT WORSE
|
|
|
|
I measured "41 of 79 project dirs mapped in `~/.althing/session_handles.json`" and called the 46
|
|
unmapped ones exposed. **`session_handles.json` is a v2 artifact that v3 never opens** —
|
|
`grep -rn session_handles althing/` is empty, and `postbox.resolve_config` takes `--handle` then
|
|
`ALTHING_HANDLE` and nothing else. So the exposure is LARGER than my number implied: every
|
|
directory is in the same position, because the map is consulted for none of them.
|
|
|
|
**The same stale data source had survived inside my statusline rewrite that morning.** I updated
|
|
the v2 block's COMMANDS and kept its DATA SOURCE — the commands were the visible half of the
|
|
cutover and the source was not. Fixed (`8a04d6f`): it reads `launch-history.json` now (written by
|
|
`dev_launch`, shape `{cwd: {command: {at, handle}}}`, take the most recent by `at`).
|
|
|
|
## The fix that shipped, and why my proposal was the worse one
|
|
|
|
I proposed printing the resolution source (`handle: forseti (from ALTHING_HANDLE)`). forseti
|
|
killed it with one observation: **`postbox status` already prints the handle, first field, every
|
|
call.** pewpew-dev had `forseti` on screen and it did not register. **The information was never
|
|
missing; the salience was.** That generalised into the rule that chose the design: a line that is
|
|
always there teaches the reader to skip it, so a warning beats a field.
|
|
|
|
Shipped as **3.1.1** — warn (never refuse; a legitimate cross-project send is real) when the cwd's
|
|
`launch-history` names a different handle, on stderr, BEFORE the output it is about. Keyed by
|
|
directory across commands, not `(directory, command)` — one repo hosting a claude and a codex
|
|
session under different handles is normal, and a warning that fires on a legitimate case is one
|
|
people learn to ignore.
|
|
|
|
⚠ **Its silence is not an all-clear:** 8 of 79 directories are in `launch-history.json`, so the
|
|
quiet case is ~90% of the box. forseti put that caveat in a TEST NAME
|
|
(`test_an_unlaunched_directory_says_nothing`) because prose gets skimmed and a test goes red.
|