[Cuarroc]

Fehlgeschlagene Sitzungsanfragen bleiben in der leeren Terminalansicht auch nach einem Seitenwechsel sichtbar.
Bewusstes erneutes Öffnen oder ein neuer Startversuch quittiert den alten Fehler, während die Startsperre erhalten bleibt.
Der Entwurf ist lokal geprüft; unabhängige Reviews sowie die native und die Nutzerabnahme stehen noch aus.

Report

Package: FU-KR08C-LAUNCH-ERROR — implementation delivery, tier A, one draft PR.
Base: 0583073a65a3d760a256fc32519459f2ddfe3e32 (#1908 merged).
Candidate/fix: 2bd9fd06a386e6356811b51bfb90df2c764a54fc.
Red-test commit: 0080c704d3f56f166b842153b410a526df63c490.
Actual author model: gpt-6-astra, effort high, provider OpenAI, observed in the worker's native header and own turn_context on 2026-10-25; not inferred from the requested profile.
RAW: 177 = 144 additions + 33 deletions, including tests/mock/PLAN; no size exception.

Change and ownership

The empty-view launcher retains one in-memory request error across remounts, independently of the existing pending guard. A deliberate reopen or launch clears it. An open chooser renders the alert inside its panel; a closed chooser renders one outside it. Existing truthful German copy is reused. The only browser-mock addition is one explicit first-spawn rejection input. No dependencies, CSS/i18n changes, native seam edits, provider/App/reducer/IPC/shared-design-system changes or new launcher contexts.

Owner: srv-fu-kr08c-launch-error; child ticket 725df5d4-5cd3-4adb-8217-33fb320eee60, predecessor 5a2a38f9, parent 366c57e2-488c-48c1-9405-90b0cf28fab6 remains open. Existing #1908 is not reopened. Root owns reviews, acceptance and integration; the author sets no labels and does not enqueue.

Admission and evidence

2026-10-25: clean assigned branch and HEAD matched exact origin/main before writes. git fetch origin and git log origin/main -1 exit 0; CI run 40192686399 on the exact base was completed/success; gh pr list --state open returned []. bash scripts/sync.sh start and npm run dev:start-check -- --max-cargo 2 --min-free-gb 3.5 exited 0 (13.1 GB free, zero cargo builds). The supplied quota receipt hash matched and was fresh at actual start. Missing --usage was not treated as quota evidence.

Each tests/browser/commit/prepush/push phase ran as one foreground python3 .pa/launch-error-evidence/phase_guard.py && <phase>. The guard checked fresh load/RAM, actual ancestry/processes, exact known-idle identity, cargo roots, exclusive warm slot ownership, jobs=1 and absence of CARGO_PROFILE overrides. No background work was left running. The known idle process was present with the exact authorized identity and stayed untouched; provenance remains unknown. The guard conservatively also counted its waiting shell wrapper. No process stop or server configuration changes.

The memory mirror was absent; live Git/PR/CI plus this brief supplied the bounded evidence. Sourcegraph, dispatcher quota tools and AgentsRoom memory tools were absent from the callable catalog. get_goal returned no existing goal; the supported create_goal recorded this bounded delivery objective without closing an older goal. No exhaustive graph assessment is claimed.

ID	Command / observation	Exit and result
R1	npm run test:unit -- src/screens/terminal/TerminalRoute.test.tsx -t 'shows the same rejected request|acknowledges launch failures' before implementation	1, three compiling public regressions fail: missing remount alerts and stale error after reopen; exact BASE production
T1	npm run test:unit -- src/screens/terminal/TerminalRoute.test.tsx src/sessions/SessionProvider.test.tsx src/sessions/sessionReducer.test.ts	0, 61 tests
TC	npm run typecheck	0
DC	git diff --check	0; clean final working tree
RF	bash scripts/ci/red-first.sh	0, exact BASE/HEAD printed; all three named trailers validated. Gate BASE verdict is missing tests; R1 separately proves actual failing assertions against BASE production
B1	node .pa/launch-error-evidence/capture.mjs base	0, four BASE PNGs, all inspected
B2	node .pa/launch-error-evidence/capture.mjs head	0, four candidate PNGs, all inspected
B3	node .pa/launch-error-evidence/mock-contract.mjs	0, BASE/HEAD flag-absent default/rich/restore responses equal; opt-in first rejection and deliberate subsequent success verified
C	git commit -F <message-file> with normal hooks	0 for both final commits; precommit includes canonical staged bash scripts/ci/secret-scan.sh, no leaks
G	bash scripts/ci/gates.sh lane prepush in the assigned worktree at candidate	0, 281 s; 1747 frontend tests, 2327 Rust tests passed, 7 existing Rust skips
P	git push -u origin codex/fu-kr08c-launch-error with normal full prepush hook	0; hook 0, 184 s; no bypass/light override
V	git ls-remote origin codex/fu-kr08c-launch-error	0, exactly 2bd9fd06a386e6356811b51bfb90df2c764a54fc

The first fix-commit attempt exited 1 at the CRLF source gate because it scanned the uncommitted BASE scratch copy under new paths. The scratch copy was relocated under the existing excluded scratch dist directory (archive retained); no production source or gate was weakened. The repeated normal commit hook passed. Its incomplete first run did not reach the remaining ten precommit gates. The unit runner printed the existing jsdom canvas warning; no new dependency was installed. Filtered red-first runs report unselected tests as skipped; no skip was added to any test.

A1–A8: unchanged acceptance and candidate evidence

A1 — C2, visible failure

"After an explicit launch request rejects while the chooser is mounted, its truthful request-error message is visible and discoverable through role=alert both with the chooser open and after it is closed; the open panel must not cover or clip that message, and only one active copy is exposed."

TerminalRoute.test.tsx:842 checks one alert in the open panel and one after closing. Inspected BASE/HEAD top and bottom captures below show the request text fully visible on HEAD; the downward BASE panel occludes it. Evidence T1, B1, B2; source TerminalLauncher.tsx:65,74.

A2 — D2, failure across remount

"If the user leaves while a launch is pending, the same request's rejection is shown when the empty launcher is mounted again, whether the user returns before or after the rejection; no new launch or route jump is caused by displaying it."

Both new tests at TerminalRoute.test.tsx:835,838 are red on BASE production and green on this candidate. They cover return before/after rejection, exact request-error text, unchanged route and exactly one spawn with no kill/respawn. Evidence R1, T1, RF.

A3 — K1, deliberate acknowledgement

"A deliberate chooser reopen clears the previous launch error before showing fresh choices; an explicit new attempt also starts without the previous error, and a successful attempt leaves no stale failure to reappear on a later empty view."

The regression at TerminalRoute.test.tsx:842 fails at stale-error clearing on BASE and passes on HEAD. It covers reopen, explicit retry while the chooser remains open, pending state, successful settlement and a later empty remount. B3 additionally exercises a real browser retry and empty view after close. Evidence R1, T1, B3.

A4 — preserve closed C1 and provider contract

"Clearing or displaying an error never clears the in-flight launch guard: repeated activation across unmount/remount still produces exactly one spawn_pty until the original request settles, resolve and reject both re-arm deliberate launch, and no timeout, auto-retry, cleanup kill, cancellation or new global-selection guarantee is introduced."

Existing resolve/reject remount guard regressions remain unchanged in assertions (TerminalRoute.test.tsx:737 helper); only their finally acknowledgement changes. T1 passes both re-arm paths, repeated activation and exact spawn counts. Pending setters remain separate from error setters (TerminalLauncher.tsx:20,24,45). No provider, route, timeout, selection or cancellation code changes. Evidence T1 and full prepush.

A5 — truthful outcome, not absence proof

"A rejected openAdHoc Promise is described only as a failed request, never as proof that no PTY/session was created; an already inserted provider-owned session stays visible under the existing contract, and this package adds no session manipulation or new launcher context."

Existing inserted-session subscription-rejection tests at TerminalRoute.test.tsx:670,718 remain green with their original visibility/mutation assertions. Error text remains the existing terminal.launchFailed plus describeError; it says the request failed, not that a PTY is absent. No provider/session manipulation added. Evidence T1; source TerminalLauncher.tsx:48.

A6 — isolated public proof

"New or directly affected deferred-request regressions settle every started request and publicly acknowledge any retained failure in try/finally, including assertion-failure paths, without private reset exports, weak assertions, skips, extra retries or timeout changes; unrelated C3/D3/D4 cleanup is not bundled silently."

New deferred tests settle every started request in finally and then use acknowledgeLaunchFailure at TerminalRoute.test.tsx:800 to unmount/remount the public App and deliberately reopen/close the chooser. Required existing-test changes are listed below. R1 exercises the new tests through assertion failures. No private reset export, added production-module mock, skip, retry or timeout changes. Evidence R1, T1; unrelated C3/D3/D4 remain open.

A7 — inspected browser evidence and unchanged defaults

"A single explicit test-only launch-failure mock input enables BASE/HEAD error captures with the real Glass route, while flag-absent default/rich/restore behavior remains unchanged; the author inspects captures of the chooser-open and chooser-closed failure states and demonstrates non-occlusion for the reachable placement cases, documenting any unproven placement for Root before acceptance."

Exactly one new input, ?launchFailure=1, rejects the first spawn and preserves the existing subsequent success path. The BASE scratch was exported from the exact base and blob-compared: only the identical fixture file differs. B1/B2 use the real Vite/Tauri-browser-mock Glass route, identical input, dark system theme, reduced motion and matching 1440x900 / 1440x1100 viewports. All eight PNGs were inspected. Top and bottom placements are covered; other dimensions/themes, long-error/profile-overflow stress and assistive technologies are unproven and disclosed for Root below. B3 compares flag-absent default/rich/restore responses and two successful spawns per mode across BASE/HEAD, then verifies the opt-in deliberate browser retry.

A8 — bounded delivery and records

"The new follow-up PR stays within 300 RAW lines, carries its own truthful PLAN row, preserves unrelated findings and parent residuals, passes targeted tests and full own prepush with normal verified push, and returns exact candidate-bound evidence to Root without claiming native, installed/effective, whole-Glass or UAT acceptance."

177 RAW lines (144 added + 33 deleted) against the exact merge-base; four allowed files only. Own PLAN row at docs/PLAN.md:257, other rows and subplan unchanged. T1/typecheck/diff/prepush/normal push all exit 0; remote SHA verified. One draft PR, independent tier-A reviews and checked handover pending. Parent/native/installed/effective/whole-Glass/UAT acceptance stays open.

Inspected browser artifacts

Evidence directory in the worker handover: .pa/launch-error-evidence/ (uncommitted artifacts, not added to the public repository). All BASE/HEAD screenshots use ?launchFailure=1#/leitstand/terminal, rich profiles, dark system theme and reduced motion. The BASE archive differs only by the same two-line opt-in fixture patch; SHA-256 ab076d948a320c02b20a83810b1ef1624fc72e9dc4f2393acb1b0290255ab4cd. All other tracked BASE blobs were checked equal.

Capture	Inspected	SHA-256
base-900-open.png	yes	8ff92be58635a32a444cee1867118f778d6d0988d5e1b15ac22e2cf8ccbfb27a
base-900-closed.png	yes	27fb2c541bb3d726268ce7b6f1362e19e1040738ac3777e42e20c5d7f95631a8
base-1100-open.png	yes	64c6ea87e61bae69cdd6098aadc57e2cd30e83dfd5f1a602757fc9dbbe8d77cf
base-1100-closed.png	yes	37a17af6efdca876fdedb241a92e1dc5dc7e00ce7d66c2be75375a72ae6e4d5a
head-900-open.png	yes	824d3db2a704b179fcd1435fcc5f4b59ac17856187dae942e3e7af7a3127aa77
head-900-closed.png	yes	27fb2c541bb3d726268ce7b6f1362e19e1040738ac3777e42e20c5d7f95631a8
head-1100-open.png	yes	5608b012fdb099309131008f3ff26dba9af168bd86cb06d8c89fc916ad4cb507
head-1100-closed.png	yes	37a17af6efdca876fdedb241a92e1dc5dc7e00ce7d66c2be75375a72ae6e4d5a

At 1440x900 the chooser opens above; at 1440x1100 it opens below. BASE downward error center is occluded; HEAD center is uncovered in all four states. HEAD open alert bounds are y=329..368 inside panel y=288.5..568.5 (top) and y=761..800 inside panel y=720.5..1000.5 (bottom). Screenshots visually confirm the full text, not merely center-point visibility. Closed captures are pixel-identical BASE/HEAD. Each capture exposes exactly one active alert and records one explicit spawn. base-geometry.json, head-geometry.json and manifest.json retain measurements and hashes. No captured PNG is uninspected.

Directly forced existing-test cleanup

Candidate src/screens/terminal/TerminalRoute.test.tsx:

• Line 648, rejected spawn/retry: finally publicly acknowledges a retained error if an assertion prevents retry.
• Line 670, late insertion after leaving: finally settles the started deferred request and publicly acknowledges its possible subscription error.
• Line 718, inserted session with rejected exit subscription: finally flushes settlement and publicly acknowledges the retained failure.
• Line 737 helper, resolve/reject remount tests: existing finally settlement remains; public acknowledgement is added for rejection/assertion-failure isolation.

Their original behavior assertions remain. No unrelated C3/D3/D4 cleanup is included. The acknowledgement helper uses the public mounted App, not module resets or private exports.

Finding disposition and review

Finding	Disposition at candidate
R1908-C2	Implemented in 2bd9fd06a386e6356811b51bfb90df2c764a54fc; A1/A7 tests and inspected up/down evidence; Root closure pending
R1908-K1	Implemented in the same fix commit; A3 red/green and browser retry; Root closure pending
R1908-D2	Implemented in the same fix commit; A2 both remount settlement orders red/green; Root closure pending
Closed C1	Preserved by A4 resolve/reject guard regressions; no reopening of #1908
D1, C3/D3/D4, C4/C5/K2/K3/K4/V1	Remain outside this package and open under the existing disposition

Review (Tier A, author family OpenAI/Codex GPT-6 Astra), both bound to head 2bd9fd06a386e6356811b51bfb90df2c764a54fc:

• Anthropic: Claude Code Reviewer subagent (claude-opus-5-5). APPROVE WITH CONDITIONS. Its A1–A6 verdicts: MET. A7/A8 were UNCLEAR only because the evidence was not in its bundle.
• Kimi: Kimi CLI v2.1.1, model kimi-code/k3 per session wire log session_f33427ec…. APPROVE WITH CONDITIONS, with the same A7/A8 evidence condition.
• Root evidence check (closes the A7/A8 conditions):
  • Root inspected base-1100-open, head-1100-open and head-900-open; their sha256 match this report. BASE clips the error at the downward placement. HEAD shows the full text inside the panel in both placements.
  • The report records prepush 0 (281 s), normal push with the hook 0, and ls-remote matching exactly 2bd9fd06, at 177 RAW lines.

ID	Source	Severity	Finding	Disposition
R1911-C1	Anthropic	medium	If openAdHoc rejects after the provider inserted a session (subscribeExit failure), the kept request error reappears on the empty view after that tab is closed. No test asserts this; the finally acknowledgement hides it.	Accepted as intended behaviour, checked against the binding lines. A2: "If the user leaves while a launch is pending, the same request's rejection is shown when the empty launcher is mounted again, whether the user returns before or after the rejection; no new launch or route jump is caused by displaying it." A5: "A rejected openAdHoc Promise is described only as a failed request, never as proof that no PTY/session was created; an already inserted provider-owned session stays visible under the existing contract, and this package adds no session manipulation or new launcher context." The message says only "Sitzungsanfrage fehlgeschlagen." plus the cause, which is true for that request. No acceptance line is broken. Missing assertion for this path: follow-up (test).
R1911-C2	Anthropic	low	The in-panel alert can be scrolled out of view inside the fixed-height chooser when a long profile list has been scrolled.	A7 asks Root to document unproven placements: Root records this as an unproven placement. It is not reachable with the 2-profile fixture. Follow-up.
R1911-C3	Anthropic	low	During the close animation the fading panel briefly overlaps the outside alert. This does not occur with reduced motion.	Recorded as an unproven, transient placement under A7. Follow-up.
R1911-C4	Anthropic	nit	An acknowledgeLaunchFailure failure in finally masks the original assertion, and the alert being gone is not asserted afterwards.	Follow-up (test hygiene, with the B bundle).
R1911-C5 / A1	Anthropic + Kimi	nit	subscribePending now serves both stores; rename to subscribe.	Follow-up.
R1911-A2	Kimi	low	Module state isolation depends on each test's finally acknowledgement; there is no reset export, by A6 design.	Accepted by design (A6 forbids a private reset export). Fragility noted for the B bundle.
R1911-A3	Kimi	nit	Dead optional chaining in finish?.(…) (TerminalRoute.test.tsx:690).	Follow-up.
R1911-A4	Kimi	low	The fixture rejects only the first ad-hoc spawn per page load.	No action; that is the A7 design ("first-launch-rejection").
R1911-A5	Kimi	low	A7/A8 process evidence not in the review bundle.	Closed by the Root evidence check above.

No high finding. One round. Root decision: merge.
Root must arrange two distinct non-author families (the assigned Anthropic + Kimi chain with verified identities) against this fixed candidate. No author self-review is counted. Stabs checked handover, Root acceptance/integration, parent acceptance and native/UAT remain pending.

NICHT ABGEDECKT

• Linux cannot compile/run #[cfg(windows)] tests (run_in_pty, npm_shim, ConPTY, DPAPI) or Windows clippy arms; the Windows lane runs in the merge queue.
• Precommit is not the full lane; prepush does not include the canonical Linux browser-smoke, frontend production build and workflow gates. The explicit mocked browser runs above cover only this package's measured scenarios.
• Existing 7 Rust skips remain; no added skip/retry/timeout or assertion weakening. External updater/router/mirror services are not proved by gates.
• No native OS/real provider start, PTY absence proof, installed/effective state, whole-Glass, parent or UAT acceptance.
• Both observed opening directions are covered at the two listed desktop viewports. Other viewport sizes/themes, long-error/profile-overflow stress and assistive-technology behavior were not proved; Root must retain those evidence limits before acceptance.
• Known idle process untouched; provenance unknown. No claim that leases prove process termination.
• Missing memory mirror and absent Sourcegraph tools limit context; live bounded sources were used. No new QA/team/reviewer run, service, install or release was authorized or performed by this worker. The runner had already populated missing node_modules through the permitted lockfile install before this session.

Plan-ID: FU-KR08C-LAUNCH-ERROR

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-25T13:23:21.688173Z	2bd9fd0	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[Cuarroc]

Root A7 record (unproven placements, documented before acceptance): besides R1911-C2 (scrolled long profile list) and R1911-C3 (close-animation overlap), the following are NOT proven by the inspected captures: other viewport sizes than 1440x900/1440x1100, other themes than dark/system, very long error text, profile-list overflow, assistive-technology behaviour beyond role=alert in tests. Accepted as recorded limits; no automatic exception to A1–A8.

[Cuarroc]

Root acceptance (INTEGRIEREN) for head 2bd9fd06a386e6356811b51bfb90df2c764a54fc:

• A1–A8 (binding, verbatim): all MET per both reviewers plus the Root evidence check. A7 unproven placements are recorded in the PR (C2, C3 and the other sizes/themes/overflow/AT limits).
• Size: 177 RAW lines, 4 allowed files, own PLAN row FU-KR08C-LAUNCH-ERROR. Provider, App and IPC unchanged. The opt-in mock is ?launchFailure=1 only; defaults are unchanged.
• Red-first: Test-First trailers (path::name) on 0080c70 and 2bd9fd0; CI red-first passed.
• Reviews (Tier A, author family OpenAI): Anthropic (claude-opus-5-5) APPROVE WITH CONDITIONS and Kimi (kimi-code/k3 per wire log) APPROVE WITH CONDITIONS. Both bound to 2bd9fd0. Their conditions, A7/A8 evidence, were closed by Root (prepush 0, normal push 0, exact ls-remote, inspected PNGs with matching sha256). No high finding. R1911-C1 is dispositioned against verbatim A2 and A5.
• CI on head: gates (linux), gates (windows), linux_1, linux_2 and red-first all passed. Codex connector (advisory) completed with no findings.
• Evidence is from the browser mock only. Native, installed/effective, Glass-wide and UAT acceptance are not claimed.

Setting review-ok bound to 2bd9fd0.

[Cuarroc]

@Mergifyio queue

[mergify]

queue

☑️ This pull request is already queued

[mergify]

Merge Queue Status

• ✅ Entered queue — 2026-10-25 13:32 UTC · Rule: default · triggered by merge protections
• ✅ Checks passed · on draft merge queue: checking #1911 on main (0583073) #1912
• ✅ Merged — 2026-10-25 13:41 UTC · at 64664930c6275ffdff623e44c82972c32cf1c3ca · merge

This pull request spent 9 minutes 26 seconds in the queue, including 8 minutes 42 seconds running CI.

Required conditions to merge

• check-success = gates (linux)
• check-success = gates (windows)
• check-success = red-first
• github-review-approved [🛡 GitHub repository ruleset rule main-pr-required-checks]
  • fix: preserve truthful empty-terminal launch failures #1911
• label != do-not-merge
  • fix: preserve truthful empty-terminal launch failures #1911
• any of [🛡 GitHub repository ruleset rule main-pr-required-checks]:
  • check-success = @github-actions/gates (linux)
  • check-neutral = @github-actions/gates (linux)
  • check-skipped = @github-actions/gates (linux)
• any of [🛡 GitHub repository ruleset rule main-pr-required-checks]:
  • check-success = @github-actions/gates (windows)
  • check-neutral = @github-actions/gates (windows)
  • check-skipped = @github-actions/gates (windows)
• any of [🛡 GitHub repository ruleset rule main-pr-required-checks]:
  • check-success = @github-actions/red-first
  • check-neutral = @github-actions/red-first
  • check-skipped = @github-actions/red-first
• any of [🛡 GitHub repository ruleset rule main-pr-required-checks]:
  • check-neutral = @mergify/Mergify Merge Protections
  • check-skipped = @mergify/Mergify Merge Protections
  • check-success = @mergify/Mergify Merge Protections