Skip to content

merge queue: checking #871 + #882 + #872 + #873 together on main (7613124), stacked on #875 - #884

Closed
mergify[bot] wants to merge 22 commits into
mainfrom
mergify/merge-queue/4f95d4c18f
Closed

merge queue: checking #871 + #882 + #872 + #873 together on main (7613124), stacked on #875#884
mergify[bot] wants to merge 22 commits into
mainfrom
mergify/merge-queue/4f95d4c18f

Conversation

@mergify

@mergify mergify Bot commented Oct 9, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

🎉 This combination of pull requests has been checked successfully and will be merged soon. 🎉

#871 + #882 + #872 + #873 are queued together for merge on branch main (7613124).

Stacked behind 1 pull request queued ahead of this batch, not part of it. These checks run on a tip that also carries its commits, so a failure here can come from it as much as from #871 + #882 + #872 + #873.

Queued ahead of this batch:

This pull request has been created by Mergify to speculatively check the mergeability of [#871 + #882 + #872 + #873].
You don't need to do anything. Mergify will close this pull request automatically when it is complete.

Required conditions of queue rule default for merge:

Required conditions to stay in the queue:

---
all_scopes: false
checking_base_sha: 9efd6117c398610f9bec7c29e97c7bedd56e91ff
previous_check_retries: []
previous_failed_batches: []
pull_requests:
  - number: 871
    scopes: []
  - number: 882
    scopes: []
  - number: 872
    scopes: []
  - number: 873
    scopes: []
scopes: []
...

Cuarroc and others added 22 commits October 9, 2026 18:50
@Cuarroc
fix(denkraum): harden switch diagnostics and backup metadata
7f1cf71 
Cover all seven DR-16a-H follow-ups after #863 with bounded tests.

Test-First: tools/denkraum/switch.test.mjs::DR16H: backup reports explicit and default probe ports
Test-First: tools/denkraum/switch.test.mjs::DR16H: invalid paths emit exactly one JSON error
Test-First: tools/denkraum/switch.test.mjs::DR16H: filesystem and validation failures retain safe diagnostics
Test-First: tools/denkraum/switch.test.mjs::DR16H: parser diagnostics never expose ledger text or secrets
Test-First: tools/denkraum/switch.test.mjs::DR16H: entry guard uses native realpaths and tolerates failures
Test-First: tools/denkraum/switch.test.mjs::DR16H: compare accepts equal schema and revision
Test-First: tools/denkraum/switch.test.mjs::DR16H: invalid port arguments are rejected before backup
Test-First: tools/denkraum/switch.test.mjs::DR16H: tmp warnings belong only to this ledger including previous temps
Test-First: tools/denkraum/switch.test.mjs::DR16H: backup directory is private on POSIX
Test-First: tools/denkraum/switch.test.mjs::DR16H: symlink drill skips when the capability probe returns EPERM
Test-First: tools/denkraum/switch.test.mjs::DR16H: top-level handler reports the original output failure
@Cuarroc
test(denkraum): expose notification ownership races
25e70b9 
Four compiling assertion failures observed on G2 35fe38e before the delivery fix. Preserve all existing delivery assertions.
@Cuarroc @claude
fix(denkraum): release ledger ownership on signal stop and keep close…
88ac685 
… errors

The CLI entry now handles SIGINT/SIGTERM by closing the server once and
waiting for the store release before exit; a second signal exits at once.
The close hook no longer emits 'error' from the rejection handler: the
failure goes to the callback or one stderr line, and a native close error is
kept as cause. Ownership release errors no longer overwrite an existing cause.

Test-First: tools/denkraum/server-stop.test.mjs::DRSEC-G4a: SIGTERM stop releases ownership and the next process can write
Test-First: tools/denkraum/server-stop.test.mjs::DRSEC-G4a: SIGINT stop releases ownership and the next process can write
Test-First: tools/denkraum/server-stop.test.mjs::DRSEC-G4a: a failing release on signal stop exits non-zero with a short stderr line
Test-First: tools/denkraum/server-stop.test.mjs::DRSEC-G4a: close without callback and failing release logs once and does not crash
Test-First: tools/denkraum/server-stop.test.mjs::DRSEC-G4a: dual close failure keeps the native error as cause of the release failure
Test-First: tools/denkraum/server-stop.test.mjs::DRSEC-G4a: a release failure does not overwrite the cause of the mutation error

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
@Cuarroc
fix(denkraum): retain notification ownership across shared flushes
c1b4192 
Serialize send and result commits across store instances while allowing ordinary receipts. Drain accepted notification work before releasing core ownership.

Test-First: tools/denkraum/store/delivery.test.mjs::DRSEC: two local stores serialize flush while a send is unresolved
Test-First: tools/denkraum/store/delivery.test.mjs::DRSEC: an ordinary receipt commits during an unresolved exclusive send
Test-First: tools/denkraum/store/delivery.test.mjs::DRSEC: serialized retry after a lost response reuses the same event ID
Test-First: tools/denkraum/store/delivery.test.mjs::DRSEC: a second process cannot send while the closing owner has an unresolved send
@Cuarroc @claude
test(denkraum): make webhook timeout injectable so the abort test run…
ebc26eb 
…s in ~20 ms

No-Test: test speed only, same assertions (R824-G1)

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
@Cuarroc @claude
fix(denkraum): release ledger ownership on SIGHUP stop
5f59935 
A closed terminal or ssh session sends SIGHUP, which killed the entry
without releasing the ledger owner record. SIGHUP now takes the same stop
path as SIGINT/SIGTERM (POSIX only; Windows cannot deliver it).

Test-First: tools/denkraum/server-stop.test.mjs::DRSEC-G4a: SIGHUP stop releases ownership and the next process can write

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
@Cuarroc @claude
fix(denkraum): fail a stop after a failed listen and write the failur…
2f89b0f 
…e line synchronously

A stop signal that arrives after a failed listen exited 0 because the
native ERR_SERVER_NOT_RUNNING was treated as success; the clean exit is now
gated on the listening flag. The failure line goes through fs.writeSync(2)
so an immediate exit cannot drop it on a pipe (the existing stderr
assertion stays).

Test-First: tools/denkraum/server-stop.test.mjs::DRSEC-G4a: a stop after a failed listen exits non-zero

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
@Cuarroc @claude
fix(denkraum): close same-file notification flushes during any store …
011c08e 
…close

R873-K1/G1: the closing guard lived per instance while the notification queue
is per file, so a second same-file DeliveryStore could append behind a closing
store's captured tail. The closing count now lives on the shared ownership
context; every same-file store rejects flushNotifications while any close is in
progress, so the captured tail is final and ownership is never released during
an unresolved send. R873-K3: reject with a dedicated STORE_CLOSED code.

Test-First: tools/denkraum/store/delivery.test.mjs::DRSEC: a same-file store cannot start a send once another store began closing
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
@Cuarroc @claude
test(denkraum): retry the signal-stop entry start when a probed port …
55bbb2c 
…was taken

freePort() releases the port before the child binds it; under parallel
load another process can take it (EADDRINUSE seen in the prepush lane).
startEntry now retries that start up to five times on a fresh port.

No-Test: Test-helper only; the retry changes no assertion and the tests it serves stay as they were.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
@Cuarroc @cursoragent
fix(denkraum): quiet happy-path switch diagnostics
fc78b3c 
Stop diagnosing ECONNREFUSED and optional-sidecar ENOENT on the
backup happy path; diagnose primary failures once and keep basenames.

Test-First: tools/denkraum/switch.test.mjs::DR16H: happy-path backup with no sidecars has empty stderr
Test-First: tools/denkraum/switch.test.mjs::DR16H: missing primary ledger prints exactly one diagnostic line
Co-authored-by: Cursor <cursoragent@cursor.com>
@Cuarroc @cursoragent
fix(denkraum): diagnose non-Error throws safely
c2ecd9e 
Stringify thrown values before path and secret redaction so a bare
string rejection prints its text instead of "undefined".

Test-First: tools/denkraum/switch.test.mjs::DR16H: diagnose handles thrown strings
Co-authored-by: Cursor <cursoragent@cursor.com>
@Cuarroc @cursoragent
fix(denkraum): fail closed when entry realpath misses
92501ea 
On realpath failure match case-insensitively on win32; otherwise emit a
JSON error and exit 4 instead of a silent zero when paths diverge.

Test-First: tools/denkraum/switch.test.mjs::DR16H: entry guard fails closed when realpath misses
Co-authored-by: Cursor <cursoragent@cursor.com>
@Cuarroc @cursoragent
fix(denkraum): redact only long secret env values
8fae954 
Skip env redaction for values shorter than 8 characters and cover the
non-SyntaxError diagnose path that actually runs the env loop.

Test-First: tools/denkraum/switch.test.mjs::DR16H: env redaction applies to non-SyntaxError diagnostics
Co-authored-by: Cursor <cursoragent@cursor.com>
@Cuarroc @cursoragent
test(denkraum): probe free ports instead of 4791
198f3f2 
Point bakOk and other backup helpers at an ephemeral free port so the
suite can run beside a live desk; only the default-port probe keeps 4791.

No-Test: harness-only free-port wiring; behavior covered by existing drills
Co-authored-by: Cursor <cursoragent@cursor.com>
@Cuarroc @cursoragent
fix(denkraum): accept only digit port forms
b05c8bb 
Require /^\d{1,5}$/ before the 1..65535 range check and cover the
inclusive boundaries plus rejected coercion forms like +1 and 1e3.

Test-First: tools/denkraum/switch.test.mjs::DR16H: non-digit port forms are rejected
Test-First: tools/denkraum/switch.test.mjs::DR16H: valid boundary ports are accepted
Co-authored-by: Cursor <cursoragent@cursor.com>
@Cuarroc @cursoragent
chore(denkraum): keep switch package within size M
8de8d6c 
Fold the ECONNREFUSED note onto the diagnose guard line so the PR
diff stays at most 300 lines; R871-A7 remains a follow-up.

No-Test: comment-only size trim
Co-authored-by: Cursor <cursoragent@cursor.com>
@Cuarroc @cursoragent
test(denkraum): cover D4 defer/clarify retry and DR12 border width
6e10298 
Extend the root-id retry-guard for pending defer and clarify replays,
and assert sampled contrast controls have border-top-width > 0.

No-Test: coverage-only tests for existing behavior (R870-K2/K3)
Co-authored-by: Cursor <cursoragent@cursor.com>
@mergify @mergify-commit-signer
Merge of #875
9efd611
@mergify @mergify-commit-signer
Merge of #871
f487c0b
@mergify @mergify-commit-signer
Merge of #882
b0aae10
@mergify @mergify-commit-signer
Merge of #872
a90398b
@mergify @mergify-commit-signer
Merge of #873
6709b8a
This was referenced Oct 9, 2026
Merged
Merged
Merged
@mergify mergify Bot closed this Oct 9, 2026
@mergify
mergify Bot deleted the mergify/merge-queue/4f95d4c18f branch October 9, 2026 18:24
@mergify mergify Bot mentioned this pull request Oct 9, 2026
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@Cuarroc