Session relaunch after an unplanned WSL restart: a roster timer and a boot oneshot on the systemd user manager - #1116

…d journal refusals, no repeat of a timed-out tab, private modes

The first read of #1116 at 7a50475 asked for four P2 fixes; the local review found two of them and one more.

- A failed `claude agents --json` is no longer an empty roster. list_sessions returns None; snapshot keeps the
  last good roster and exits 1; relaunch asks again for up to client_wait_s, then refuses, writing and opening
  nothing.
- relaunch-<boot>.json replaces the relaunched marker: status in_progress, partial or complete, each run, and
  each session's calls and outcome (pending, running, failed, uncertain, unconfirmed). Only complete stops a
  relaunch. A rerun reuses the sealed handoff (checked by sha256) and opens only the sessions not running. A run
  first writes this boot's roster as the live sessions plus the ended boot's rows not running yet, and the
  minute snapshot carries those rows while the run is in progress, so a crash before the timer's first
  snapshot is recovered by the next boot. The cap counts runs.
- A timed-out tab call (tab_timeout_s) is an uncertain side effect: the run waits settle_s for the session and
  never calls again. Only a definite failure is retried, after the live list shows the session still absent.
- Rosters, the state and the planned marker are 0600, the handoff 0400, the state directory and rosters 0700;
  the handoff directory is made 0700 only when the tool creates it.
- No journal entry for the ended boot is a refusal: the roster's age at that boot's end cannot be checked.
- The README's plan-restart command runs the installed tool through /usr/bin/python3 -I.

Tests: 38, 16 of them new and 6 changed. Against 9f0127c's module, README and config, 20 fail. Seven of
eight one-line mutations of the fixes failed the module at once; the eighth (a rerun after every session came
back by hand must still complete) now has its own test. handoff_text is unchanged: the retro dry run
reproduces receipts/retro-handoff.md byte for byte. validate rc 0; the registry changes only the five rows of
the edited files.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

…relaunch

The CC adjudication of #1116 at 376f2bb (2026-10-14, bound to the CC micro
39cf4d73) ruled two of Astra's P2s P1: each could open a second live session
of one lane, and no lock or session-id record guarded either.

- F1: a rerun reset an unconfirmed or uncertain session to pending and opened
  it again, while the first `claude -n` could still register; a run stopped
  inside a call (TimeoutStartSec) left no record of it. Each call is now
  recorded in flight before it is made. A rerun leaves an unconfirmed,
  uncertain or in-flight session as it is; only the command center reopens
  one, by name, with `relaunch --reopen <name>`, recorded under `reopened`.
- F2: a failed pre-open query on the first attempt went on to open a tab. A
  call is now made only when the live list reads the session as absent; an
  unreadable list skips the session (`skipped`, nothing opened, retried by a
  rerun).
- F3: plan() gave two roster rows of one name two turns. One turn per name;
  the second row is left to the command center in the handoff.
- F4: the journal-missing and unreadable-state skips exited 0. Both are
  refusals now (exit 1), and the relaunch unit gains
  OnFailure=stack-alert@%n.service, the handler mineru.service uses
  (systemd.unit(5), OnFailure=).

The README documents the outcomes, the rerun rule and the reopen command; the
evidence README and the decision state 45 tests.

Tests: 45, all OK. Against 376f2bb's module, README and unit the seven new
tests fail (8 failures and 1 error; F1 fails in both its subtests). Two tests
that stopped a run at the tab call now stop it at the live-list read before
the call, since a call stopped in flight is unresolved by design and has its
own test. Each of the seven fixes, reverted alone, fails the module. The retro
dry run still reproduces receipts/retro-handoff.md byte for byte.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

The CC adjudication addendum of #1116 at 307f686 (2026-10-15, bound to the
CC DELTA micro c034ba4d) found two P1 gaps in item 2 of the blocker commit,
each able to open a second live session of one lane, and allowed one commit
scoped to that invariant.

- P1-a: a call's result was saved with the outcome still pending, so a run
  stopped in its settle wait left a lane a rerun opened again. The result is
  now saved together with the provisional outcome (unconfirmed after rc 0,
  uncertain after a timeout) before the wait. A session is unresolved when
  a call since its last reopen opened, timed out or is in flight, whatever
  its outcome label says.
- P1-b: a direct --reopen run could overlap the unit's run, and both
  rewrote the whole state. Every relaunch run holds an exclusive fcntl.flock
  on relaunch.lock in the state directory; a run that finds it held is
  refused, exit 1, writing and opening nothing.
- A reopen is spent only by the call it makes (resolved_through), so a
  --reopen run that is skipped or stops before its call leaves the lane
  unresolved.
- A --reopen name that is not an unresolved session this relaunch still has
  to bring back is refused, exit 1, with a refusals entry in the state file.

Tests: 49, all OK. With 307f686's module, the four new tests fail (6
failures across their subtests, plus the count check); the test file is
byte-identical at that run and at this commit (sha256 a0d213c6...). Each of
the five fixes, reverted alone, fails the module. The retro dry run still
reproduces receipts/retro-handoff.md byte for byte. The README and the
decision describe the lock, the provisional outcome and the reopen rules and
state 49 tests.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

…hat registered and exited is absent (#1140)

#1116 follow-up (a), the local review's P2 at 7aad5a0 :533 (the final pass at
c8d7fa9 :547-553; review_output.json sha256 7e01f04a). A session seen running
earlier in a run and missing from the final live list kept its running outcome,
so the run said complete and plan() refused every later rerun as already
relaunched.

- The final pass marks such a session absent and moves its resolved_through
  past its calls: it was seen listed, so its tab start registered, and a rerun
  opens it again without a --reopen (unresolved() is unchanged for a session
  never seen listed).
- complete needs a final list that was read; an unreadable one leaves the run
  partial (exit 1, the alert), and a rerun reads it again.
- README: the absent outcome, the status sentence and the rerun list. The
  decision's test line and the evidence README count: 53.

Fail-first: both new tests failed on c8d7fa9 ('complete' != 'partial'); the
module runs 53 tests OK. Own logic; no upstream mechanism changes.

Co-authored-by: Claude Opus 5.5 <[email protected]>

…n creates; cite the mechanism sources

The remaining P3s on tools/session-relaunch after #1116 (follow-up d). The
code of session_relaunch.py is unchanged.

- README: a dry run is not write-free. Like every run it takes the run lock,
  and run_lock() opens relaunch.lock with O_CREAT (creating the state
  directory when it is missing and setting it to 0700). The README now says
  so; a dry run on a fresh state directory adds exactly relaunch.lock.
- README (CC micro P3-1): only two kinds of refused --reopen are recorded (a
  name that is not unresolved or not still to be relaunched; any --reopen
  while there is nothing to relaunch), and only where the ended boot's
  relaunch state already exists and parses, never in a dry run. plan()'s own
  refusals (no journal entry, an unreadable state), a missing or changed
  sealed handoff, a held run lock and a client that gives no list record
  nothing.
- Decision (CC micro P3-2): the 307f686 sentence no longer says the refusal
  is recorded unconditionally; the 7aad5a0 sentence says a dry run records
  no refusal.
- Test comment (CC micro P3-3): cite the GPT read of 7aad5a0 by its sha256,
  97052bc9bfeee54b8dc2bbd33ff1a95a46b5f28632f7a8ff5926c4679dbdfc56, instead
  of two files that are not in the repository.
- README and decision (GPT fix3 P3-2): pinned vendor sources for the three
  mechanisms, kept apart from the tool's own policy: fcntl.flock
  (https://docs.python.org/3.14/library/fcntl.html#fcntl.flock) and flock(2)
  (https://man7.org/linux/man-pages/man2/flock.2.html, Linux man-pages 6.19);
  subprocess.run(timeout=...)
  (https://docs.python.org/3.14/library/subprocess.html#subprocess.run);
  os.replace (https://docs.python.org/3.14/library/os.html#os.replace). The
  unit's interpreter is /usr/bin/python3 3.14.4; the cited sentences are the
  same in CPython's Doc/library/ at tag v3.14.4. write_atomic never fsyncs,
  so the README claims atomic replacement, not durability.
- README Tests (GPT fix3 P3-5): PublicationSurfaces scans 14 files (the
  decision and every file under tools/session-relaunch/ and the evidence
  folder), not the test module, manifests/evidence.json, PR bodies or commit
  messages; a test ties the stated count to the scanned list.

Tests: 56 (51 + 5), OK under python3 3.13.16 and /usr/bin/python3 3.14.4.
Each new test fails against the 0f4ee07 README, decision and evidence
README; the P3-3 comment fix is text-only. Six in-memory mutations of
session_relaunch.py (no file changed) each fail one of the two new
behavioural tests. validate.py passed after re-registering the four edited
files in manifests/evidence.json.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

…n creates; cite the mechanism sources; private parents

The remaining P3s on tools/session-relaunch after #1116 (follow-up d), and the command center's FULL read of this
change. One commit: the branch was rebuilt on 2026-10-15 at the command center's ruling, with the tree of the earlier
head unchanged, so that no commit on it carries a digest of an unpublished review file.

- README: a dry run is not write-free. Like every run it takes the run lock, and run_lock() opens relaunch.lock with
  O_CREAT (creating the state directory when it is missing, mode 0700). A dry run on a fresh state directory adds
  exactly relaunch.lock and records no refusal.
- README (CC micro P3-1): only two kinds of refused --reopen are recorded (a name that is not unresolved or not still to
  be relaunched; any --reopen while there is nothing to relaunch), and only where the ended boot's relaunch state already
  exists and parses, never in a dry run. plan()'s own refusals (no journal entry, an unreadable state), a missing or
  changed sealed handoff, a held run lock and a client that gives no list record nothing. Each --reopen case asserts
  which refusal's reason fired.
- Decision (CC micro P3-2): the 307f686 sentence no longer says the refusal is recorded unconditionally; the 7aad5a0
  sentence says a dry run records no refusal.
- Test comment (CC micro P3-3): the GPT read of #1116's follow-up at 7aad5a0 is cited by PR, commit and finding (its
  P2; the reviewer's two regression cases are the subtests case=complete and case=capped), not by files outside the
  repository. test_the_tool_and_its_tests_publish_no_full_digest scans the tool, its tests and the evidence README.
- README and decision (GPT fix3 P3-2): pinned vendor sources for the three mechanisms, kept apart from the tool's own
  policy: fcntl.flock (https://docs.python.org/3.14/library/fcntl.html#fcntl.flock) and flock(2)
  (https://man7.org/linux/man-pages/man2/flock.2.html, Linux man-pages 6.19); subprocess.run(timeout=...)
  (https://docs.python.org/3.14/library/subprocess.html#subprocess.run); os.replace
  (https://docs.python.org/3.14/library/os.html#os.replace). The unit's interpreter is /usr/bin/python3 3.14.4; the
  cited sentences are the same in CPython's Doc/library/ at tag v3.14.4. write_atomic never fsyncs, so the README
  claims atomic replacement, not durability.
- README Tests (GPT fix3 P3-5): PublicationSurfaces scans 14 files (the decision and every file under
  tools/session-relaunch/ and the evidence folder); a test ties the stated count to the scanned list.
- Private parents (CC FULL read, P3): Path.mkdir(parents=True) created missing parents at the default mode
  (python/cpython v3.13.16, cbc944f4, Doc/library/pathlib.rst:1476-1478). private_dir() now creates each missing
  directory 0700 (XDG Base Directory 0.8), and an existing parent keeps its mode.

Tests: tests.test_session_relaunch 60 OK at this tree; validate.py passed after re-registering the edited files in
manifests/evidence.json.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

… partial run's unfinished rows (#1116 follow-ups b, c) (#1141)

* Session relaunch: lock the roster against the timer snapshot; carry a partial run's unfinished rows

(c8d7fa9 :512 and :221-223; the co-op's local review of 7aad5a0, by name only). One PR, since
both concern what this boot's roster carries.

- (b) A timer snapshot that read its carry before a starting relaunch saved its
  state, and wrote after the relaunch's seed roster, replaced the seed with the
  live list only. roster_lock() (flock on roster.lock in the state directory)
  is now held by the snapshot from its carry read to its roster write
  (snapshot_live) and by the relaunch while it saves its state and then writes
  the seed. Both holders are short; relaunch.lock stays the run's own lock.
- (c) carried_rows() carried only an in_progress state's rows, so the first
  snapshot after a partial run dropped the lanes the relaunch had not brought
  back and a second crash lost them. A partial state of this boot carries them
  too (minus the ones listed live).
- README: the roster paragraph. The decision's test line and the evidence
  README count: 53.

Fail-first: both new tests failed on c8d7fa9 (the seed replaced by an empty
roster; the partial run's rows missing); with the lock disabled and only the
reorder kept, the race test still fails. The module runs 53 tests OK. Own
logic; flock(2) semantics as the existing relaunch.lock uses them.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Session relaunch: write the seed roster before the state; retire carried rows seen running; cite flock

Fix round for #1141 at 474cf2b:
- GPT read (P2, reproduced): a boot stop between save() and the seed roster left the timer's empty roster
  of this boot as the newest, and the next boot opened nothing. cmd_snapshot now runs before save(), both
  still under roster_lock (the reviewer's seed-first control).
- Local review P2 (:244-245): the carry was taken before any tab opened, so a lane the run brought back
  stayed carried and was listed again after it exited on purpose. retire() drops a row from the carry once
  the run sees its session running (after each tab and in the final list).
- Local review P2 (:153-156): roster_lock and the README cite fcntl.flock at python/cpython v3.13.16
  (cbc944f4) Doc/library/fcntl.rst:176-183 and release-on-close at Linux man-pages-6.9.1
  man/man2/flock.2:69-72; both sources added to receipts/sources.json.

Fail-before (base code, new tests): test_a_boot_stop_right_after_the_state_write_still_relaunches_from_the_seed,
Lists differ: [] != ['cc', 'trading-cc', 'coop']; test_a_lane_brought_back_by_a_partial_run_leaves_the_carry,
{'wsl-architecture-design', 'ns2604-coop'} is not false. After: tests.test_session_relaunch 55 tests OK
(the evidence README's count updated from 53); validate rc 0.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Session relaunch: retire a carried row only when the final list shows its session running

The command center's FULL read of #1141 at b2755a0 (P2, a lane can be dropped silently): a row left the carry the
first time its session was seen running, so when the command center registered and then exited while the next tab
opened, and the boot stopped before the final pass, every snapshot wrote this boot's roster with it neither live
nor carried. The per-tab retire is removed; the final pass retires only sessions its live list shows running, and
an absent session re-enters the carry (the rebase resolution).

test_a_session_that_registers_and_exits_before_a_crash_stays_carried, fail-before at b2755a0:
'wsl-architecture-design' not found in the roster. P3s: the tool README states the final-list rule and that an
absent row re-enters the carry; the decision's and the evidence README's test counts are 66.
After: tests.test_session_relaunch 66 tests OK; validate rc 0.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Session relaunch: one carry mechanism at the final read; the carry test guards it

The GPT fix2 read of #1141 at 07ea567 (2026-10-15, CHANGES_REQUESTED, one P2 blocker): the claim that the carry
regression fails without the re-carry line was false at that head. The fold at 07ea567 made a row leave the carry only
when the final list shows its session running, so an absent session's row never left, and the re-carry line that added
it back had become redundant: removing either the line or the retire rule's running-only selection left the test
passing, since each covered the other.

- tools/session-relaunch/session_relaunch.py: the redundant re-carry line is removed; the final read's retire rule
  (running only) is the one mechanism that keeps an absent session's row carried.
- tests/test_session_relaunch.py: test_a_session_that_registers_and_then_exits_is_carried_again now states what it
  guards. With the retire rule mutated to retire absent rows too, it fails; on this tree it passes (a mutated copy
  in a scratch directory, no repository file changed).

The branch is rebuilt onto main at the command center's ruling of 2026-10-16: the earlier history held two commits that
landed as #1145 in another form; this branch keeps only its own three commits, whose messages are unchanged, and this
fold. The GPT read's adjacent P2s (a stale live sample after finalization, a manually recovered lane carried again, a
same-boot retry reopening recovered lanes) and its P3s are Follow-ups in the body.

After: tests.test_session_relaunch 66 OK; validate rc 0.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Session relaunch: a recovered lane stays recovered; snapshot sampling and the final publication share roster.lock

The fold of the rebuild of #1141 on main fa6cf1a (the command center's rulings of 2026-10-16T03:41Z and 04:39Z). It
answers the co-op's local review of #1141 at aedf554 (P2, :255-256) and the GPT read res1 at aedf554
(GPT-VERDICT-aedf55498.md: follow-ups 2 to 4 joined as one family, and P3s 5 and 7).

- One persisted retirement. A run's final read, and a snapshot after a run that ended partial, record the lanes they see
  running as `retired` in the relaunch state and drop their rows from its carry (retire_into, retire_recovered). A
  retired lane is not carried again (follow-up 3), and a rerun of the same relaunch neither opens it nor carries it: plan()
  leaves it out of the launch set, and the rerun's carry skips it (follow-up 4). A --reopen of a retired lane is refused;
  its own launcher starts it again. A session that registered and then went missing from the final list (absent) is not
  retired and stays carried, as before.
- One synchronization point (follow-up 2). The timer's snapshot samples the live list under roster.lock, and a run
  publishes its final outcomes, retirement and status under the same lock. So a snapshot never writes a list sampled
  before that publication with the carry read after it.
- The roster race test waits until the relaunch reaches the lock, not a one-second sleep (P3 5). The README carry
  wording is updated (P3 7).

Tests: tests/test_session_relaunch.py, 69 (2 new, 2 changed). On aedf554's production code
(fail-first-r2.txt), each of these fails on behaviour:
- the snapshot sampled before the final publication loses the three recovered lanes;
- a rerun opens cc, trading-cc and coop instead of trading-cc;
- the next boot relaunches a lane that recovered late and then stopped.
The handshake race test passes there and on this head. validate rc 0.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Session relaunch: every read-modify-write of the relaunch state under roster.lock; a retired session is satisfied

The commit on ca89139 for the co-op's local review at ca89139 (pr1141-ca891398/review_output.json, two P2s in the
relaunch-lifecycle family; the command center's ruling of 2026-10-16T05:47Z: one normal commit, no rebuild).

- P2 (session_relaunch.py:217-220), every state read-modify-write. plan() read the state before roster.lock, and
  record_refusal() never took the lock, so two interleavings lost a write:
  - a snapshot's retirement was erased by a rerun's stale save;
  - a refusal record was saved over by a snapshot.
  The fix:
  - prepare_run() runs a run's decision and first writes under roster.lock, from plan()'s read to the seed roster and
    the first save; a refused --reopen is recorded inside that span;
  - a dry run writes nothing and takes no roster.lock;
  - a rerun retires the carried lanes it finds live at its start, as a snapshot after that run would, so the retirement
    no longer depends on which of the two ran first.
- P2 (:647-649), completion. A rerun that brought back every lane still owed stayed partial while the lanes it had
  retired earlier were stopped on purpose; main() then exited 1, and further reruns spent the crash-loop budget. A
  retired session now counts as satisfied, and is not marked absent at the final read.

Tests: tests/test_session_relaunch.py, 72 (3 new). Each fails on ca89139's code (fail-first-r3.txt):
- a snapshot started right after plan()'s read: the command center's retirement is erased;
- a snapshot holding its copy while a --reopen is refused: the refusal record is lost (0 != 1);
- a rerun that brings back trading-cc: it stays partial.
validate rc 0.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Session relaunch: roster.lock reentrant in one thread; a rerun's plan reconciled with retirements; refusals locked

The commit on 3436a5b. It answers GPT res2 at ca89139 (res2-pr1141-ca8913985/GPT-VERDICT-ca8913985.md): its blocker
(:548/:588/:617) and its refusal-path follow-up (:526/:532/:538). It folds the FRONT micro at 3436a5b
(fix3-pr1141-3436a5b03/GPT-VERDICT-3436a5b03.md, ACK, 0 blockers): P3 3 here, and P3 2 in the body.

Before this commit, res2's retained probe (review-results/test_relaunch_adjacent.py) ran against 3436a5b as follows:
- completion and lock exclusion: OK;
- the refusal case: FAIL. record_refusal() called on its own rewrote a stale state, because only its caller held the
  lock;
- the stale-plan case: HANG at 60 s. A snapshot injected inside plan(), in the same thread, waited on the
  roster.lock that the run already holds.

The fix:
- roster_lock is reentrant within one thread (a thread-local depth). A nested hold takes no second flock, while another
  thread or process still waits.
- prepare_run reconciles the plan with the state on disk: lanes retired while it planned are dropped from the launch,
  and the run continues from that state.
- record_refusal holds roster_lock itself and appends to the state as read at the write.
- The README's completion paragraph (:77) now counts a retired session as satisfied, as the rule and code do.

The probe at this head: 4 of 4 OK.

Tests: tests/test_session_relaunch.py, 75 (3 new). Each fails on 3436a5b's code as a failure, not a hang
(fail-first-r4.txt):
- the rerun waits on its own roster.lock;
- the refusal loses trading-cc's retirement;
- a nested hold in the same thread waits on its own lock.
validate rc 0. The source-capture gap (micro P3 1, res2 finding 4) stays a Follow-up.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

---------

Co-authored-by: Claude Opus 5.5 <[email protected]>