5c48e5fd8aMEDIUM 1: session_runtime::start() now returns an explicit fresh-launch vs replay disposition (session_start_result), and handle_start_session sets outcome.applied only for a fresh committed launch. An authenticated idempotent start replay therefore never gains connection-scoped teardown authority: a broken pipe during a replay can no longer stop an already-running guest. The control audit event for a replayed delivery carries the replay disposition (start_session:replay:<session>). MEDIUM 2: jsonl_sink truncation now accounts for record delimiters exactly, so current_bytes_ always tracks the physical file; only newline-terminated complete records are retained (no blank or partial lines, bounded read window); the cap is a hard cap (an oversized event is dropped with a structured operator note; a pre-existing oversized journal is bounded with a bounded read at construction). MEDIUM 3: the broken-pipe degrade test now synchronizes through a mutex-protected condition-variable gate handshake that proves the dispatch is parked inside the blocked gate before the client resets, records the start only after the dispatch completes, and the mark_stopping test destroys every registry lock holder (runtime, protocol, registry) before the independent registry reopen so the nonblocking exclusive flock can actually be acquired. |
||
|---|---|---|
| .. | ||
| adapters/sage | ||
| audit | ||
| container | ||
| control | ||
| host | ||
| kernel | ||
| mcp | ||
| net | ||
| policy | ||
| run | ||
| supervisor | ||
| term | ||
| CMakeLists.txt | ||
| gloved_main.cpp | ||
| main.cpp | ||
| remote_exec_main.cpp | ||