fix(plain): record and verify spawned windows - #1207
Merged
Merged
Conversation
fujibee
force-pushed
the
fix/1149-owner-witness
branch
2 times, most recently
from
September 13, 2026 20:05
696bf2a to
5e1bf28
Compare
fujibee
force-pushed
the
fix/1149-owner-witness
branch
from
September 14, 2026 02:27
5e1bf28 to
599d9e3
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Resubmission of #1186 (automatically closed when its base branch was deleted).
Plain spawns now use a one-shot child-to-parent handshake because the new window is the first process that can observe its emulator, controlling tty, and owner. A successful launch returns
plain:<emulator>:<tty>and writes a four-column placement record with aboot/boot_startprocess witness; a missing, malformed, or timed-out handshake is a named failure and never falls back to the legacy-sentinel.terminal_detectlikewise produces an emulator-qualified tty when the current measured macOS emulator and controlling tty are observable.Forced despawn reads the record fence, checks that its emulator and tty match the locator, and revalidates every known complete process pair before asking the emulator adapter to close exactly that session. Spawn-time
bootkeys remain distinct from the self-writepidkeys for the CLI process. A stale or incomplete witness fails loudly and keeps the placement record for retry. Unknown future anchor keys are ignored, while known keys are the only accepted evidence.Tests:
bats tests/test_terminal_registry.bats(169/169);bats tests/test_despawn.bats(21/21);bats tests/test_spawn.bats(108/108);bash -n scripts/drivers/terminals/plain/ops.sh;bash -n scripts/spawn.sh;bash -n scripts/despawn.sh.