mirror of
https://github.com/mvschwarz/openrig-studio.git
synced 2026-11-07 05:56:21 -10:00
mvschwarz
bd9debce8f
studio-impl found this and the founder found the symptom by opening it. Two studios sharing a STUDIO_DIR share .runtime/, and composing is destructive: the second to boot repainted the first's rail while the first kept serving the routing table it built IN MEMORY at its own boot, and never reads that directory again. The result is an app that is PRESENT, LOOKS INSTALLED, AND CANNOT WORK — a PROVIDERS tab that loaded 200 while every verb behind it 404'd, because the process showing the row had never heard of the provider. No check caught it and none of the obvious ones could: the row is real, the page is real, the 200 is real. Same family as the systemd unit hijack — a second instance quietly overwriting a first's state, invisible because the running process keeps answering. The second boot now refuses, by the rule already applied to ports and units: REFUSE RATHER THAN ADOPT. A stale stamp — one whose port nothing is serving — is taken over and SAID OUT LOUD, because a silent takeover is the same silence this guard exists to remove. LIVENESS IS THE STAMPED PORT, NOT THE PID. A pid can be reused by anything, so a dead studio whose number came round again would refuse a legitimate boot forever. The question that matters is whether something is still SERVING from this .runtime, so that is the one asked — and it deliberately does not ask WHO answers, because a stranger on that port is still a reason to refuse and asking the studio would mean trusting a reply from the process we are unsure about. REPRODUCED BEFORE FIXING, and the control is the point: with the stamp removed, a studio composing ["files"] on one port silently changed a live studio's rail from ["workspace"] to ["floor","files"] while it went on serving. That is the defect, measured. SCOPE I DID NOT PROVE, stated because the commit would otherwise imply it: I reproduced the REPAINT, not the 404. My fixture used an app whose verbs the reference runtime answers itself, so it returned 200 and masked the routing gap; the 404 needs a provider-backed app. The repaint is the cause and is what this removes. Also the first behavioural test tools/studio.mjs has ever had — it is a script with no exports, so its boot has been hand-verified until now. 302 tests.