Fix The daemon never reaps its

- Change set: 01M6Q3X16PDW20R7N57BJ5JK6G: Fix The daemon never reaps its
- Worktree: /home/rhiza/code/rhiza.fix-the-daemon-never-reaps-its
- Autonomous: yes
- Started: 2026-11-06T01:13:09Z

## Steps

- build/build (visit 1): pass, then build/render: 1 of 1 leaves passed
- build/render (visit 1): pass, then build/check: exit 0
- build/check (visit 1): pass, then review/code: exit 0
- review/code (visit 1): pass, then review/review: exit 0
- review/review (visit 1): pass, then review/render: 5 of 5 checks passed
- review/render (visit 1): pass, then render-pr: exit 0
- render-pr (visit 1): pass, then open-pr: exit 0
- open-pr (visit 1): pass, then wait-pr: exit 0
- wait-pr (visit 1): pass, then pr-green: held after 38 checks
- pr-green (visit 1): pass, then signoff: exit 0
- signoff (visit 1): pass, then rebase: approved by rule autonomous
- rebase (visit 1): pass, then wait-rebased: exit 0
- wait-rebased (visit 1): pass, then rebased-green: held after 32 checks
- rebased-green (visit 1): pass, then land: exit 0
- land (visit 1): pass, then wait-landed: exit 0
- wait-landed (visit 1): pass, then landed-green: held after 34 checks
- landed-green (visit 1): pass, then rebase-merge: exit 0
- rebase-merge (visit 1): pass, then wait-rebased-merge: exit 0
- wait-rebased-merge (visit 1): pass, then rebased-merge-green: held after 1 checks
- rebased-merge-green (visit 1): pass, then merge: exit 0
- merge (visit 1): pass, then wait-main: exit 0
- wait-main (visit 1): pass, then main-green: held after 1 checks
- main-green (visit 1): pass, then close-out: exit 0
- close-out (visit 1): pass, then ship: exit 0
- ship (visit 1): pass, then end: exit 0

## Leaves

- daemon-reaps-drivers (step build/build): passed: attempt 1: verifier passed
  - attempt 1 builder, session ae8f03c3-d1d2-480e-9331-01a1ae6ac577: pass (said done)
  - attempt 1 verifier, session e0dfc339-9891-48e3-aed2-01a1ae6da9c1: pass (Evidence written by the verifier)
- daemon-reaps-drivers (step review/review): open
  - attempt 2 fixer in cycle 2, session 150b5cdf-f465-45f6-9c66-01a1ae8a424d: pass (said done)
  - attempt 2 verifier in cycle 2, session ba3d8b7b-f3f5-4099-b74f-01a1ae8d664e: pass (Evidence written by the verifier)

## Checks

- compliance (step review/review): passed after 2 cycles
  - cycle 1: failed, check session 6eab1f3a-6e00-413a-86cd-01a1ae7bb131 pass (said done), critic session cc0fa231-0245-4532-94f5-01a1ae8818aa pass (said done)
  - cycle 2: passed, check session 598e62d9-228c-4ef9-9877-01a1aea85af4 pass (said done)
  - round 1 (cycle 1): 1 finding, 1 confirmed
    - f1 major at cmd/rhiza/drivers_linux.go:30 on daemon-reaps-drivers: The leaf's acceptance as written is met: go test -trimpath -count=1 ./cmd/rhiza -run TestReap passes on Linux, the list is <common>/rhiza/drivers (runLogDir is <common>/rhiza/logs), daemonLoop calls ctx.Reap at start and after each tick, and reapList is a no-op off Linux. But this change set's own decision reap-only-own-image-entries, which answers plan review r3 f1 and amends this leaf, is not built. Each entry must record the recording daemon's pid and its start time (field 22 of /proc/self/stat), and the reaper must wait4 only on entries whose daemon pid and start time match the running daemon's, dropping the others without waiting. Here the list holds bare pids (drivers_unix.go writeDrivers/addDriver), and reapList waits on any listed pid whose ppid is the daemon's. After a fresh daemon start (crash, stop/start, systemd restart), a stale pid that a new git, make or hook child reuses gets reaped, and that child's cmd.Wait fails with ECHILD: the exact bug the decision settles. The decision also requires the leaf's test to cover the stale case: an entry recorded under another daemon's pid and start time, whose pid is a live unwaited child, must be dropped and not reaped, and that child's Wait must still return its exit status. reap_test.go has no such case. — confirmed: Checked against the code. This change set's decision reap-only-own-image-entries amends the leaf: each entry must record the driver pid plus the recording daemon's pid and /proc/self/stat start time, the reaper must wait4 only on entries matching the running daemon and drop the rest unwaited, and the leaf's test must add the stale case. drivers_unix.go addDriver/writeDrivers store bare pids. drivers_linux.go reapList waits on any listed pid whose ppid is the daemon's. reap_test.go has only TestReap, with no stale-entry case. After a fresh daemon start, a reused stale pid belonging to a new git/make/hook child would be reaped, and its cmd.Wait would fail with ECHILD. The change set's own decision is unbuilt, so this must be fixed.
  - round 2 (cycle 2): no findings
- quality (step review/review): passed after 1 cycle
  - cycle 1: passed, check session e887e2f1-97c3-4dd7-bd29-01a1ae7c49d5 pass (said done)
  - round 1 (cycle 1): 4 findings, 0 confirmed
    - f1 minor at internal/api/daemon.go:302 on daemon-reaps-drivers: No test covers the daemonLoop wiring. Nothing asserts that ctx.Reap runs at daemon start and on each tick, which the leaf's acceptance claims. TestReap only exercises reapDrivers directly, so dropping the call from daemonLoop would still pass every test.
    - f2 minor at cmd/rhiza/detach_unix.go:57 on daemon-reaps-drivers: There is a pid-reuse window. After the goroutine's cmd.Wait reaps a driver, its pid stays listed until dropDrivers takes driverMu. The same happens for a driver reaped just before a re-exec, whose drop never ran. If the kernel reuses that pid for a git or hook child that os/exec waits on, and that child has already exited, the reaper's isChildOf check passes and wait4 steals its exit status. This is unlikely given sequential pid allocation, but it is the hazard the leaf rules out.
    - f3 nit at cmd/rhiza/reap_test.go:55: isZombie hand-parses /proc/<pid>/stat a second way instead of sharing the parse in drivers_linux.go's isChildOf. The itoa wrapper only stands in for strconv.Itoa.
    - f4 nit at cmd/rhiza/drivers_unix.go:21: readDrivers and writeDrivers drop every error silently, including a failed rename or write. A pid that never reaches the list is the zombie case this fixes, but nothing reports it to the daemon log.
- qa (step review/review): passed after 2 cycles
  - cycle 1: failed, check session c745c78d-dc50-4778-9706-01a1ae7cba51 pass (said done), critic session aff2b446-5c6e-4a23-a171-01a1ae886083 pass (said done)
  - cycle 2: passed, check session c6ad283b-3ff4-46e7-801b-01a1aea88bdc pass (said done)
  - round 1 (cycle 1): 1 finding, 1 confirmed
    - f1 major at cmd/rhiza/drivers_unix.go:48 on daemon-reaps-drivers: The change set's decision reap-only-own-image-entries (which answers plan review r3 f1) says each driver-list entry records the driver pid plus the recording daemon's pid and start time (field 22 of /proc/self/stat). It also says the reaper drops entries from another daemon without waiting on them, and the test covers that stale case. The build does none of this. addDriver writes bare pids, and when the QA run's list was checked by hand it held only '1043834'. reapList (drivers_linux.go:30) calls wait4 on any listed pid whose ppid is the running daemon. reap_test.go has no stale-entry case. So after a fresh daemon start (crash, stop/start, systemd restart), a stale pid that a new git/make/hook child of the daemon reuses still gets reaped, and that child's cmd.Wait fails with ECHILD. That is the bug the decision was made to rule out. — confirmed: The change set's own decision reap-only-own-image-entries requires each entry to carry the recording daemon's pid and start time, a reaper that skips other daemons' entries without waiting, and a stale-entry test. At HEAD, readDrivers/writeDrivers/addDriver (cmd/rhiza/drivers_unix.go) store bare pids. reapList (cmd/rhiza/drivers_linux.go:30) calls wait4 on any listed pid whose ppid is the daemon, and it does no daemon-identity check. reap_test.go has no stale case. After a fresh daemon start, a reused stale pid belonging to a git, make or hook child would be reaped, and that child's Wait would fail with ECHILD.
  - round 2 (cycle 2): no findings
- scope (step review/review): passed after 2 cycles
  - cycle 1: failed, check session 105f51b8-fa67-49e8-a722-01a1ae7d2aab pass (said done), critic session c487829d-14f8-45c7-ad84-01a1ae88af6e pass (said done)
  - cycle 2: passed, check session 8186124d-4634-4d50-af88-01a1aea8c8bb pass (said done)
  - round 1 (cycle 1): 1 finding, 1 confirmed
    - f1 major at cmd/rhiza/drivers_unix.go:49 on daemon-reaps-drivers: The build leaves out part of this change set's own scope. Decision reap-only-own-image-entries, which answers review-01m6q3wz-r3-f1, requires each driver-list entry to record the daemon that wrote it (that daemon's pid and its /proc/self/stat start time). It also requires the reaper to drop entries written by any other daemon without waiting on them, and the test to cover that stale case. addDriver writes only the bare driver pid, and reapList (drivers_linux.go:31) calls Wait4 on any listed pid whose ppid is the running daemon. After a fresh daemon start, a stale pid reused by a git, make or hook child can therefore still be reaped, which causes ECHILD in that child's cmd.Wait. reap_test.go has no stale-entry case. Nothing in the diff goes outside the intent or the leaf: the ctx.Reap hook, the driver list, the reaper and the test all serve the leaf. — confirmed: Checked against the code. Decision reap-only-own-image-entries, part of this change set, requires each driver-list entry to record the recording daemon's pid and /proc/self/stat start time, requires the reaper to wait4 only on entries from the running daemon and drop the rest unwaited, and requires a stale-entry test. addDriver/writeDrivers (drivers_unix.go) store bare pids. reapList (drivers_linux.go:31) waits on any listed pid whose ppid is the daemon's. reap_test.go has only TestReap, with no stale case. After a fresh daemon start, a reused stale pid can still be reaped, and the new child's cmd.Wait then fails with ECHILD. The leaf's own amended scope is unbuilt, so this must be fixed. The same gap was confirmed under compliance f1.
  - round 2 (cycle 2): no findings
- model (step review/review): passed after 1 cycle
  - cycle 1: passed, check session ae85ee70-abf2-4271-bb8b-01a1ae7d7636 pass (said done)
  - round 1 (cycle 1): no findings

## Code checks

- step review/code: pass

## Sign-offs

- signoff (visit 1): approved by rule autonomous

## Sessions

- build/build, session ae8f03c3-d1d2-480e-9331-01a1ae6ac577: tokens input 16, output 5166, cache creation 44656, cache read 423313; helper tokens input 0, output 0, cache creation 0, cache read 0
- build/build, session e0dfc339-9891-48e3-aed2-01a1ae6da9c1: tokens input 18, output 3659, cache creation 31759, cache read 476812; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session 6eab1f3a-6e00-413a-86cd-01a1ae7bb131: tokens input 14, output 2708, cache creation 40451, cache read 405827; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session e887e2f1-97c3-4dd7-bd29-01a1ae7c49d5: tokens input 28, output 5583, cache creation 38329, cache read 826105; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session c745c78d-dc50-4778-9706-01a1ae7cba51: tokens input 60, output 15207, cache creation 63223, cache read 2250531; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session 105f51b8-fa67-49e8-a722-01a1ae7d2aab: tokens input 10, output 2131, cache creation 37463, cache read 264064; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session ae85ee70-abf2-4271-bb8b-01a1ae7d7636: tokens input 14, output 2411, cache creation 34604, cache read 372557; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session cc0fa231-0245-4532-94f5-01a1ae8818aa: tokens input 12, output 2037, cache creation 34018, cache read 317285; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session aff2b446-5c6e-4a23-a171-01a1ae886083: tokens input 10, output 1515, cache creation 28625, cache read 241809; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session c487829d-14f8-45c7-ad84-01a1ae88af6e: tokens input 12, output 1893, cache creation 28566, cache read 294265; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session 150b5cdf-f465-45f6-9c66-01a1ae8a424d: tokens input 16, output 5011, cache creation 31768, cache read 424327; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session ba3d8b7b-f3f5-4099-b74f-01a1ae8d664e: tokens input 48, output 5275, cache creation 42807, cache read 1253765; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session 598e62d9-228c-4ef9-9877-01a1aea85af4: tokens input 20, output 2347, cache creation 39627, cache read 564577; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session c6ad283b-3ff4-46e7-801b-01a1aea88bdc: tokens input 20, output 5311, cache creation 44375, cache read 621860; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session 8186124d-4634-4d50-af88-01a1aea8c8bb: tokens input 10, output 1058, cache creation 35524, cache read 256264; helper tokens input 0, output 0, cache creation 0, cache read 0

Totals: tokens input 308, output 61312, cache creation 575795, cache read 8993361; helper tokens input 0, output 0, cache creation 0, cache read 0