[roodboi]

Summary

A native up just after stopping the pool can fail with bridge_socket_identity even though the new provider is healthy. Pinned SmolVM starts expose bridges on independent threads before signalling guest readiness, without joining them. Hack previously audited the sockets immediately.

Fresh boot now waits at most 10 s for the complete private, owned socket set, checking the retained provider before and after every observation and polling at most every 50 ms. Missing nodes and same-user single-link sockets awaiting private mode may converge. Wrong type, user, link count or unreadable identity refuses immediately. Late success refuses. The wait does not chmod, unlink, connect, spawn or stop anything. Running-pool audits stay immediate.

The production fresh-boot sequence now makes the order testable: templates, real socket wait, audit, then disk adoption. Failure uses the existing verified-provider stop and retains failed-boot evidence; it grants no new cleanup authority or clean-shutdown proof.

The recovery subcommand is runtime recover --json. Timeout, unsafe socket, provider-verification failure and unconfirmed failed-boot stop all carry fixed guidance: use the same executor and identical --candidate-root argument used for the failed start. Installed executors use their selected private home; checkout executors use the source checkout via ./hack-local, never the .hack-local state directory. This corrects the previous message and two docs that named a nonexistent command. No project mapping may yet exist for ordinary hack down.

Verification

The same persistent reviewer cleared merge head 24e99804c601dc3e5640c52d1351b061b7fd7a6b, tree 862ba8163e0f0fc4ab19626224c6c662bebc8ee4.

• Three fresh-boot sequence cases drive the real socket waiter and refuse audit/adoption on timeout, unsafe identity or provider loss; a template refusal reaches no later effect. Ten lower-level bridge cases cover complete-set ordering, modes, identity, deadlines and recovery guidance.
• 205 integrated TypeScript tests across three files pass, including a real stub executor showing fixed guidance reaches foreground startup without private detail, a saved mapping or a ready event.
• Default Rust: 1016 library tests passed (38 ignored), plus integration contracts including 71 project tests. All-feature library: 1208 passed (47 ignored). Both all-target Clippy configurations passed.
• Typecheck, lint/privacy, changed-test lint, normal commit hooks, CLI/compiler builds, all eight compiled plan checks and pinned Gitleaks scan pass.
• No VM or real-Caddy acceptance is claimed.

Separate route-test correction

Commit 5ab03504 corrects #770's fake-clock regression, as requested. The old test selected an expected-failure branch when the production default was 60 s, so it did not guard that default. The new test reads HttpProbe::inferred_route unchanged and unconditionally requires readiness at 120 s.

Actual mutation check, with only the production default temporarily changed from 240_000 to 60_000:

cargo test --all-features --lib a_route_first_answering_at_120 …
the production inferred probe must allow readiness at 120 s:
CandidateError { code: "graph_service_failed", service: Some("web"), … }
test result: FAILED. 0 passed; 1 failed
exit status: 101

The 240 s production default was restored before commit. The same test then passes on this integrated head. Request outcomes and time are injected; this does not qualify live network scheduling.

This branch includes a normal merge of next at 31339c7b (#770's squash merge). The merge keeps the corrected route test and both frontend failure stubs. Its tree is byte-identical to the tested 5ab03504 tree; the regression correction remains its own commit.

Release Signal

fix(native): wait for bridge sockets after provider readiness; release intent: fix.

Semantic Surfaces

Native fresh-boot ordering and failure diagnostics; a separate regression-only correction for inferred route readiness. Ownership, disk adoption and recovery gates are preserved.

Risks / Follow-up

Socket metadata does not identify the binder. Freshness depends on the pinned launcher's unlink-before-ready ordering; a provider-pin upgrade must recheck that documented contract.

No signal handler is added. Interruption keeps the existing booting receipt and recovery rules. Portable tests inject host effects, so the lead still owns ten consecutive Mac Ctrl-C scenarios including pool stop/start and a forced-timeout runtime recover --json check when feasible.

Tracks HACK-2175; the regression-only commit follows up HACK-2164.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
hack-docs	Ready	Preview	Nov 13, 2026 3:59pm UTC

[roodboi]

@codex review

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-13T16:01:06.622315Z	24e9980	Manual request
🔒 Security Review	✅ Completed 2026-11-13T16:03:35.874220Z	24e9980	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Another round soon, please!

Reviewed commit: 24726f3e14

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

🛡️ Codex Security Review · Automatically triggered

Security review completed. No security issues were found in this pull request.

Reviewed commit: 24726f3e14

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[roodboi]

Ready for lead: 24726f3

The persistent reviewer cleared this exact head (tree 99ec50a5fffbec3e667445db43a90e2e3977430b). Codex code review completed with no findings; all bot summaries and threads were read. computer pr review-status: CLEAR at 24726f3, zero unresolved bot threads or change requests.

Linux CI run 43428691204 is green: selected unit shards 4–8 (including typecheck/lint/privacy on shard 8), Candidate core, Config compiler on x64 and ARM, test focus, secret scan and docs. Both required aggregates passed. The earlier failed aggregates came from the superseded cancelled run.

Hosted jobs still pending: none. macOS jobs were deferred/not selected; Docker e2e shards, runtime state models, runtime images and Linux process-lifetime were skipped. The successful Docker aggregate does not mean Docker scenarios ran.

HACK-2175 fixes guest-ready arriving before the independently bound bridge sockets. Fresh boot waits at most 10 s for the complete private owned set, with retained provider identity verified on each side of observation. Unsafe identity still refuses immediately. A failed boot uses the existing verified stop and names the same-home executor command runtime down --recover --json.

Portable verification is in the PR body. Remaining acceptance is yours on the Mac: ten consecutive Ctrl-C scenarios, including pool stop followed by the second no-port project on the same home. If feasible, also force the timeout and run the named recovery command. No VM acceptance is claimed. The branch merges cleanly; no freshness-only push was made.

[roodboi]

Pushed fix round at 5ab0350; this supersedes the earlier ready note. The same persistent reviewer cleared this exact head/tree 862ba8163e0f0fc4ab19626224c6c662bebc8ee4.

Commit 6f2f0782 fixes the wrong recovery command in messages/docs/tests, uses the identical candidate-root argument from the failed invocation, adds guidance to provider-verification and failed verified-stop errors while retaining their codes, and ties the real socket wait to the production fresh-boot sequence before audit/adoption. Template refusal, timeout, unsafe sockets and provider loss cannot reach adoption. The guide distinguishes installed homes from checkout roots and makes its env-variable example conditional on explicit selection.

Separate commit 5ab03504 corrects #770's regression: it reads the production default unchanged and always requires readiness at 120 s. The old test could pass when that default was restored to 60 s; that earlier negative-control claim was incorrect.

Actual mutation run, changing ONLY production start_period_ms: 240_000 to 60_000 temporarily:

cargo test --all-features --lib a_route_first_answering_at_120 …
the production inferred probe must allow readiness at 120 s:
graph_service_failed (service: web)
test result: FAILED. 0 passed; 1 failed
exit status: 101

Restored the production default to 240 s before commit; the corrected test passes on the integrated head.

Portable gates passed: three boot-sequence tests and ten bridge tests; 205 integrated TypeScript cases; 1016 default Rust library tests (38 ignored) plus integration contracts, including 71 project tests; 1208 all-feature library tests (47 ignored); both all-target Clippy modes; typecheck, lint/privacy, changed-test lint, CLI/compiler builds, all eight compiled plan checks and pinned Gitleaks.

Normal integration merges retain next through ab29d49 and #770's reviewed head 1457c63, needed for this separate test correction. #770's Mac batch remains yours. No VM acceptance is claimed for #778; ten Ctrl-C repetitions and forced-timeout recovery remain lead-owned. New Ready for lead note follows Linux CI and handled bot review.

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. What shall we delve into next?

Reviewed commit: 5ab03504c2

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

🛡️ Codex Security Review · Automatically triggered

Security review completed. No security issues were found in this pull request.

Reviewed commit: 5ab03504c2

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[roodboi]

Merged next 31339c7 normally into this branch as 24e9980 (no rebase or force-push). The persistent reviewer cleared this exact merge head. Tree 862ba8163e0f0fc4ab19626224c6c662bebc8ee4 is identical to the previously cleared/tested 5ab0350 tree; git diff between those heads is empty.

The route clock regression correction remains its own commit 5ab0350. The add/add resolution retains its unchanged-production-default, unconditional 120 s success assertion; the actual 60 s mutation failure and restored-240 s pass are recorded above. The frontend fixture keeps both bridge and route failure cases.

Existing portable results qualify exactly this tree. New Ready for lead note follows exact-head Linux CI and bot review; the Mac delta review/Ctrl-C loop remain lead-owned.

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. You're on a roll.

Reviewed commit: 24e99804c6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

🛡️ Codex Security Review · Automatically triggered

Security review completed. No security issues were found in this pull request.

Reviewed commit: 24e99804c6

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[roodboi]

Ready for lead: 24e9980

The persistent reviewer cleared this exact merged head and tree 862ba8163e0f0fc4ab19626224c6c662bebc8ee4. Codex code review is clean at the same head; all bot summaries and threads were read. computer pr review-status: CLEAR at 24e9980, zero unresolved bot threads/change requests.

Linux CI run 43458087984 is green: selected unit shards 4–8 (including typecheck/lint/privacy on shard 8), Candidate core, Config compiler on x64 and ARM, test focus, secret scan and docs. Both required aggregates passed.

Hosted jobs still pending: none. macOS jobs/shards 1–3 were deferred/not selected; Docker e2e shards, runtime state models, runtime images and Linux process-lifetime were skipped. The successful Docker aggregate does not mean Docker scenarios ran.

The merge contains next 31339c7 and preserves the separate route-test correction commit 5ab03504. Its actual mutation run fails with ONLY the production default restored to 60 s (exit 101; 0 passed/1 failed, graph_service_failed), and passes with the restored 240 s default. That evidence is recorded in the earlier fix-round note and PR body. The merged tree is identical to the already-tested tree.

The recovery command is runtime recover --json, using the same selected executor and identical --candidate-root argument as the failed start. The boot-sequence, provider-loss guidance and candidate-root clarification fixes are included.

Remaining checks are yours: Opus delta review and ten consecutive Mac Ctrl-C scenarios including pool stop/start; forced-timeout recovery when feasible. No Mac/VM acceptance is claimed by the portable checks. Handing back for that gate and batch merge.