# Deferred findings register Findings that were investigated, judged not worth acting on now, and closed with an explicit reopen condition. A finding stays closed until its reopen condition is met by a reproducible observation. This register is not a backlog: nothing here is scheduled, and adding a row is not a commitment to act. `docs/design.md` remains authoritative. A row that appears to grant or withdraw a contract is wrong; read the linked section instead. --- ## DF-1 — Duplicated process-identity implementation drift **Status:** deferred. **Observation.** Two independent implementations of `ProcessIdentityInspector` exist, one per persistence domain: | Implementation | Domain | Darwin executable evidence | Linux `processStartIdentity` | Darwin `processStartIdentity` | | --- | --- | --- | --- | --- | | `LocalProcessIdentityInspector` — `transport/receiver-lease.ts` | receiver lease, [§7.1](../design.md#71-lease-behavior) | `/usr/sbin/lsof -a -p -d txt -Fn` | raw `stat` start ticks | raw `ps -o lstart=` value | | `SystemProcessIdentityInspector` — `workflow/system-process-inspector.ts` | workflow lease, [§A.5.1](../design.md#a51-namespace-and-authority) | `ps -o comm=` plus `selectDarwinExecutable` | `linux-start-ticks:` | `darwin-lstart:` | The two therefore disagree on both the Darwin executable source (`lsof` versus `ps comm`) and on the `processStartIdentity` encoding (raw ticks versus prefixed ticks). **Why it is deferred.** The two identities are never compared with each other. Each inspector serves exactly one lease in exactly one persistence namespace, and the namespaces do not share records. The fault-sensitive evidence for that separation is `test/workflow-domain-isolation.test.ts` — "[appendix 38] AMQ correlation never cross-replays or cross-mutates persistence owners". Both encodings are self-consistent within their own domain, so drift between them is currently unobservable. Merging them would touch two fenced lease formats, which is an expensive-to-reverse persistence seam, in exchange for no behavior a user can observe. **Reopen only on:** - a reproducible cross-domain misidentification — a stored identity from one domain being read, compared, or migrated by the other; or - a reproducible Darwin `lsof` fail-closed wedge — `lsof` unavailable, denied, or slow enough that `LocalProcessIdentityInspector` returns `unknown` and the receiver lease refuses acquisition that the workflow-side inspector would have allowed. Neither a code-duplication objection nor a preference for one encoding reopens this row. --- ## DF-2 — Nested inbound work **Status:** deferred. **Observation.** Inbound work can nest: mail can arrive while a run started by earlier mail is still in flight. There is no owner of an "active frame" — no `activeStack`, no `completed` or `resolved` bridge journal state, and no per-frame obligation record. **Why it is deferred.** Every failure this would be introduced to prevent is already observed by an existing fault-sensitive seam. Correlation is carried by immutable per-envelope message ID and thread, not by an ambient current frame, so nesting does not create a new failure class. Adding a frame owner would add a second authority over facts the journal and the ledger already own. **Existing observed seams.** These are the seams that already cover lost-ID, wrong-order, wrong-thread, and forgotten-obligation paths: | Seam | Evidence | | --- | --- | | Priority mapping and deterministic order | `test/priority-delivery-scheduler.test.ts` — "[doc 12] priority mapping and deterministic priority/created/ID order are exact" | | Idle and active-tool delivery states | `test/priority-delivery-scheduler.test.ts` — "[doc 12] idle and active-tool runtime states preserve exact priority delivery without aborting the tool" | | Per-envelope reply provenance | `test/priority-delivery-scheduler.test.ts` — "[doc 16] every coalesced envelope retains immutable reply provenance" | | Cohort journal, dedup, order, and DLQ safety | `test/inbox-pump.test.ts` — "[doc 12,18] a cohort is journaled before exact reads, deduplicated, ordered, and DLQ-safe" | | Cross-domain persistence isolation | `test/workflow-domain-isolation.test.ts` — "[appendix 38] AMQ correlation never cross-replays or cross-mutates persistence owners" | **Reopen only on:** a reproducible lost-ID, wrong-order, wrong-thread, or forgotten-obligation path that lies **outside** every seam listed above. A bug found *inside* one of those seams is an ordinary bug fix in that seam. It is not evidence that a new active-frame owner is needed, and it does not reopen this row. --- ## DF-3 — Spawn identity is sampled during the child's `exec` transition **Status:** deferred. **Observation.** `workflow/worker-process-supervisor.ts` proves child identity with a single `inspect(child.pid)` immediately after `waitForSpawn` resolves. When the launcher is a wrapper script — which is the normal shape for a PATH- or Homebrew-installed `pi`, and the reason [§A.5.1](../design.md#a51-namespace-and-authority) supports PATH launch at all — `waitForSpawn` resolves while `/bin/sh` still owns the image, before `exec` replaces it. Darwin `ps -o comm=` therefore reports a value that changes underneath the sample: ```text t=0ms "/bin/sh" t=50ms "/opt/homebrew/Cellar/node//bin/node" ``` Reproduced 150 spawns of a `#!/bin/sh` + `exec node` wrapper under process churn: ```text {"live":148,"unknown":2} recorded executables: [ ".../bin/node", "/bin/sh" ] diag: Darwin process executable is unavailable ``` Two consequences follow from the one cause: - `selectDarwinExecutable` has no fallback for a child PID — only `pid === process.pid` falls back to `process.execPath` — so a transient non-absolute `comm` yields `unknown` and the attempt fails with "Spawned worker identity could not be proven" (~1.3% under load); - the same launcher records either `/bin/sh` or the node path, so a later comparison in `workflow/workflow-lease.ts` reaches "PID executable changed" and judges a live worker stale. The visible symptom today is that `test/worker-runtime-reload.test.ts` — "worker runtime core survives extension replacement without duplicate UI subscribers" — fails intermittently in the full suite and passes in isolation. **Why it is deferred.** The narrow fix (resample until two reads agree) and the deeper fix (drop `executable` from the identity predicate, leaving pid plus `processStartIdentity` plus `bootIdentity`) trade against each other, and the deeper one weakens Darwin PID-reuse defence because `lstart` has one-second resolution. It also rewrites a persisted lease field, which is an expensive-to-reverse seam requiring the [§17](../design.md#17-versioning-and-compatibility) migration path. Neither belongs inside a worker-control-channel change. **Reopen only on:** any work that touches spawn-time identity capture or the lease staleness predicate, or a reproduced production spawn failure or false-stale judgement outside the test suite. An intermittent red on the reload test alone is this row, not a new finding.