Conversation
…rtup The Source panel could permanently miss the source's state, and then the instrument could not be driven at all: the end-to-end thermal run timed out waiting for a confirmed OFF that would never arrive. SafetyManager records verified-OFF and publishes both source-state topics during start(). The engine starts SafetyManager BEFORE it starts the ZMQ publisher, so those messages queue and are drained the moment the publisher comes up, onto a transport that does not retain. A subscriber still completing its handshake misses that one-shot pair, and nothing ever republishes it. This was invisible because a bug was hiding it. The warm-detector interlock was firing stop_source against a mock second-stage reading of about 77.5 K, and SafetyManager's stop path republishes both topics — by which time the GUI was subscribed. So the panel had been learning the source state as a side effect of a guard firing wrongly. Correcting that guard, which the owner ruled, removed the accident and exposed this. Found by bisection between two probe worktrees that differed only in the interlock configuration; the first bad commit was the configuration change itself, which is correct and stays. The repair is in the publication lifecycle, not in the panel and not in the configuration. A subscriber that attaches at any time can now learn the current authoritative state. What it must NOT do is manufacture certainty: a genuinely unknown state stays unknown, and the controls stay conservative. There is a regression for exactly that, because the tempting fix here is one that reports OFF when it simply has not been told.
|
@codex review Head under review: This is a publication-lifecycle repair on the critical path, so the useful
Stated openly: one broad-suite node |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 34a9ae11ff
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| # subscriber whose handshake completes later. Re-derive this | ||
| # bounded-cadence snapshot from the sole safety authority so a | ||
| # late observer eventually receives truth, including UNKNOWN. | ||
| await self._publish_keithley_channel_states("periodic") |
There was a problem hiding this comment.
When a device-reported OFF proof remains cached after connection or emergency-off, this periodic call recreates it with Reading.now() on every monitor tick even though SourceOffEvidence contains no observation time or expiry. A late GUI therefore cannot distinguish an old hardware readback from a current one: keithley_panel.on_reading() ignores off_evidence, apply_state("off") enables Start, and OFF states are exempt from its stale check. Preserve the original evidence time and publish unknown once that proof is stale rather than continually refreshing its timestamp.
AGENTS.md reference: AGENTS.md:L490-L491
Useful? React with 👍 / 👎.
| publisher._queue = queue | ||
| publisher._session_id = "0" * 32 | ||
| publisher._socket = socket # type: ignore[assignment] | ||
| publisher._running = True | ||
| publisher._task = asyncio.create_task(publisher._publish_loop(queue)) |
There was a problem hiding this comment.
The late-observer regressions replace the ZMQ socket with an attached boolean and invoke _publish_loop() directly, bypassing ZMQPublisher.start(), socket binding, topic subscription, and the PUB/SUB handshake that caused the original loss. These tests can remain green even if a real subscriber attaching after startup never receives the periodic state, so this critical regression needs a real loopback publisher/subscriber test that attaches after publisher startup and repeats the attachment scenario.
AGENTS.md reference: AGENTS.md:L380-L386
Useful? React with 👍 / 👎.
| # subscriber whose handshake completes later. Re-derive this | ||
| # bounded-cadence snapshot from the sole safety authority so a | ||
| # late observer eventually receives truth, including UNKNOWN. | ||
| await self._publish_keithley_channel_states("periodic") |
There was a problem hiding this comment.
Every channel-state reading is treated as a transition by AdaptiveThrottle.observe_runtime_signal(), which advances _transition_until by the configured 30-second holdoff. Because this new call emits two such readings every second and adaptive throttling is enabled in config/housekeeping.yaml, the holdoff now remains permanently in the future, so stable temperature and pressure samples are never thinned. This can substantially increase SQLite growth and eventually turn storage pressure into an experiment-stopping persistence failure; periodic retransmissions need to be excluded from transition holdoff updates.
Useful? React with 👍 / 👎.
| # subscriber whose handshake completes later. Re-derive this | ||
| # bounded-cadence snapshot from the sole safety authority so a | ||
| # late observer eventually receives truth, including UNKNOWN. | ||
| await self._publish_keithley_channel_states("periodic") |
There was a problem hiding this comment.
When _fault() is raised for smua or smub, its immediate publication marks that channel as fault, but the next periodic call supplies no fault_channel; after a successful emergency-off it therefore republishes the same channel as off while the manager is still FAULT_LATCHED. The Keithley panel applies the later state unconditionally, so the channel-specific fault indication disappears about one second after it is raised instead of remaining visible until acknowledgment. Derive periodic channel state from the retained fault latch as well as source activity.
AGENTS.md reference: AGENTS.md:L20-L22
Useful? React with 👍 / 👎.
Landed by the batch lander. The lane's own report and the coordinator's verification are recorded on the pull request.
|
@codex review Head under review: This round answers your four findings and the one red Windows check. The The property to keep pressing on is the one this change could plausibly break: Context: on a tree carrying this branch with the other six in-flight fixes, the Docs gate green at this head; derived pair regenerated as the last commit. |
|
Codex Review: Didn't find any major issues. Nice work! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
@codex review Head under review: This round fixes a regression this branch introduced: after a hazardous command It was resolved as a question about what the record is FOR, not by making the One assertion was changed and I want it looked at rather than waved through: It guaranteed the per-channel fault badge persisted until acknowledgement. What Coordinator's measurements: control 4 red without the change, 28 green with it; Docs gate green at this head; derived pair regenerated as the last commit. |
|
Correction — ignore the SHA in my previous comment. That comment named What happened: the worktree I built the correction in was pinned to an older head The correction itself is real and verified — the per-channel record reports Please disregard the previous request until then. |
… fault After a hazardous command succeeded and a sibling channel was found unmanaged and on, the system reconciled it -- turned it off -- and latched a fault at the manager. This branch had also been marking that channel 'fault' in the per-channel record. That record drives the operator's badge and the Start/Stop enablement, so it reports PHYSICAL state. Reporting 'fault' there showed an alarm on a channel that was physically off and disabled it, while telling the operator nothing the latched manager fault did not already say. One assertion changed, which guaranteed the per-channel fault badge persisted until acknowledgement. What guarantees the incident stays visible now: the manager stays FAULT_LATCHED, its fault_reason retains the exact incident, the GUI gate reason shows it, and the durable operator log records it -- with a new test pinning that both channels read 'off' WHILE the manager remains latched.
|
Codex Review: Didn't find any major issues. 👍 Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
@codex review Head under review: This round fixes a regression this branch introduced. After a hazardous command Resolved as a question about what the record is FOR, not by making the test One assertion changed, and it deserves your scrutiny rather than a nod: It guaranteed the per-channel fault badge persisted until acknowledgement. What Coordinator's measurements: control 4 red without the change, 28 green with it; Docs gate green at this head; derived pair regenerated as the last commit. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d6fb6a5616
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| # subscriber whose handshake completes later. Re-derive this | ||
| # bounded-cadence snapshot from the sole safety authority so a | ||
| # late observer eventually receives truth, including UNKNOWN. | ||
| await self._publish_keithley_channel_states("periodic") |
There was a problem hiding this comment.
This periodic overwrite intentionally makes the per-channel badge reflect physical off/unknown while the manager retains the fault, but the canonical component contract still describes a channel fault as an АВАРИЯ badge that disables that channel (docs/design-system/cryodaq-primitives/keithley-panel.md:197-205), and the operator manual does not explain the new physical-state/manager-latch split (docs/operator_manual.md:187-207). Update those specifications and their governed version/changelog evidence in this slice; otherwise future GUI work and tests are directed toward the superseded persistent-fault presentation.
AGENTS.md reference: AGENTS.md:L537-L539
Useful? React with 👍 / 👎.
|
Correction to my earlier comments on this pull request. I said that The failure was in MY environment. That test spawns a subprocess to prove there With The operational advice was still right — that node is not this branch's problem |
Landed by the batch lander. The lane's own report and the coordinator's verification are recorded on the pull request.
|
@codex review Head under review: Reversion control, run this turn on Ubuntu 22.04: Documentation gate: A correction to my earlier brief on this pull request. I previously said the per-channel What the round asserts, and what to attack. It writes down that per-channel source state and The operator-facing risk is the one worth your attention: if a channel is physically off but The branch's own property must still hold: a subscriber attaching after startup receives the Disclosure: this change was produced and verified with AI assistance. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b443d6df3e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| # subscriber whose handshake completes later. Re-derive this | ||
| # bounded-cadence snapshot from the sole safety authority so a | ||
| # late observer eventually receives truth, including UNKNOWN. | ||
| await self._publish_keithley_channel_states("periodic") |
There was a problem hiding this comment.
When _run_checks() detects a fault, _fault() publishes the channel's fault reading before returning, but this next statement immediately publishes the periodic off/unknown replacement in the same monitor iteration. The GUI drains queued readings every 10 ms and applies them sequentially, so both usually arrive in one drain and the final physical badge is rendered without the documented channel-specific АВАРИЯ cue ever becoming visible. Skip this periodic publication after a transition or retain the fault state for at least one observable cadence.
AGENTS.md reference: AGENTS.md:L529-L535
Useful? React with 👍 / 👎.
|
|
||
| Backend-канал `analytics/keithley_channel_state/{smua,smub}` описывает физическое состояние выхода, а не долговременную защёлку аварии менеджера. `АВАРИЯ` появляется как немедленное событие перехода для затронутого канала. Следующий периодический snapshot публикует `ВЫКЛ`, если есть актуальное подтверждение OFF, или `НЕИЗВЕСТНО`, если такого подтверждения нет. | ||
|
|
||
| Эта смена бейджа не означает, что авария Safety квитирована. Отдельный `analytics/safety_state=fault_latched` и его reason сохраняют инцидент, блокируют обычное управление через Safety gating и остаются авторитетными до разрешённого восстановления. Поэтому `ВЫКЛ` нельзя трактовать как отсутствие latched fault, а `НЕИЗВЕСТНО` — как разрешение повторить команду; при живой связи доступным остаётся только аварийное отключение. |
There was a problem hiding this comment.
When a GUI subscribes after the fault transition, this documented claim does not hold: analytics/safety_state and its exact _fault_reason are published only on transitions, while the new periodic path republishes only channel states. The periodic typed operator snapshot exposes a generic “Safety fault recovery is incomplete” blocker rather than the incident reason, so the source panel can show ВЫКЛ plus a generic gate without revealing that the channel was found unmanaged and on. Republish the latched manager state and reason for late observers, or include that reason in the retained typed authority.
AGENTS.md reference: AGENTS.md:L530-L535
Useful? React with 👍 / 👎.
| "reason": reason, | ||
| "off_evidence": self._reviewed_source_off_evidence.receipt_payload(), | ||
| "off_evidence": published_evidence.receipt_payload(), | ||
| "is_transition": reason != "periodic", |
There was a problem hiding this comment.
When any normal Keithley command returns an unknown outcome, _SmuChannelBlock requires one later source observation and one later Safety observation before clearing its persistent warning. Every packet produced here increments the source observation revision even though is_transition=False, and the independent 1 Hz operator snapshot increments the Safety revision, so the next cadence deterministically declares the outcome reconciled without evidence that the command settled; this is especially invalid for target/limit commands because the repeated on state is identical whether the mutation succeeded or failed. Publish an underlying owner revision or observation time that consumers can compare with the command, rather than allowing retransmitted state to authorize reconciliation.
AGENTS.md reference: AGENTS.md:L530-L535
Useful? React with 👍 / 👎.
Landed by the batch lander. The lane's own report and the coordinator's verification are recorded on the pull request.
|
@codex review Head under review: All three findings from your review of One guard per finding, in the order you raised them:
Suites, measured this turn: No existing test was weakened, skipped or restated; the three new guards are additions. A note on the earlier verdicts. Two clean reviews on this pull request name What I would still like attacked: whether any path can now show the operator a stale latched Disclosure: this change was produced and verified with AI assistance. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 549704a8a7
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| # manager state (including its exact latched reason) and | ||
| # re-derive channel state from the sole safety authority so a | ||
| # late observer eventually receives truth, including UNKNOWN. | ||
| await self._publish_state("periodic") |
There was a problem hiding this comment.
In common long-lived non-running states such as SAFE_OFF, READY, and FAULT_LATCHED, this now emits analytics/safety_state every second, while AdaptiveThrottle.observe_runtime_signal() treats every non-running safety packet as a transition and advances its 30-second holdoff. Stable housekeeping samples therefore remain unthrottled indefinitely, increasing archive growth and potentially reaching the persistence-first failure boundary. The fresh evidence beyond the earlier finding is this newly added safety-state retransmission; the existing guard covers only periodic channel-state packets marked is_transition=False.
AGENTS.md reference: AGENTS.md:L478-L481
Useful? React with 👍 / 👎.
| self._source_observation_revision = max( | ||
| self._source_observation_revision, | ||
| source_observation_revision, |
There was a problem hiding this comment.
When the GUI survives an Engine/bridge restart after a command acquires an unknown outcome, the replacement SafetyManager restarts these revisions at 0, but the channel block retains the prior producer's value and only accepts max(old, new). The latch requires old + 1, so a new producer's initial/current observations cannot reconcile it; because that latch itself blocks start, stop, target, and limit commands, it can remain stranded until the GUI is restarted or enough unrelated physical state changes occur. Bind the revision to a producer/connection generation rather than comparing counters from different Engine incarnations.
AGENTS.md reference: AGENTS.md:L468-L469
Useful? React with 👍 / 👎.
| if is_transition and state != self._source_observed_states[smu_channel]: | ||
| self._source_observation_revisions[smu_channel] += 1 | ||
| self._source_observed_states[smu_channel] = state |
There was a problem hiding this comment.
If a keithley_start command has an unknown outcome because it never reached the manager, the authoritative state remains off and the GUI waits for source_observation_revision + 1. A subsequent emergency_off supplies fresh, decisive OFF evidence but publishes the same off state, so this state-change-only condition leaves the revision unchanged; the Safety half can advance while the source half remains permanently unsatisfied, stranding all normal controls even after the operator used the recovery path. Advance the revision for a genuine new owner observation such as an OFF proof while continuing to exclude mere periodic retransmissions.
Useful? React with 👍 / 👎.
| async def _publish_state(self, reason: str = "") -> None: | ||
| if self._data_broker is None: | ||
| return | ||
| published_reason = self._fault_reason if self._state is SafetyState.FAULT_LATCHED else reason |
There was a problem hiding this comment.
After a fault is acknowledged but recovery preconditions are not yet restored, the state is MANUAL_RECOVERY, so every new periodic call selects its literal argument "periodic" instead of a meaningful retained recovery blocker. MainWindowV2._dispatch_safety_evidence() accepts negative legacy states even after typed authority is present and uses this value as the Keithley gate reason, causing the panel to repeatedly show Управление заблокировано: periodic until another typed snapshot happens to replace it. This is fresh evidence outside the corrected FAULT_LATCHED branch: preserve an actionable operator reason for all non-ready periodic states.
AGENTS.md reference: AGENTS.md:L529-L535
Useful? React with 👍 / 👎.
|
Acknowledged, and this round is not ready. Four findings at I asked you to attack the fix rather than take the node names for it. You did, and what you The archive-growth one is an acceptance criterion, not a nicety. Two findings leave controls stranded, and that is the owner's standing ruling. His words are
The fourth is operator-facing text that says nothing. A lane will take all four. The three guards from the previous round stay and must keep I will not merge this on nine-of-nine green. Green is what it looked like before you found |
Landed by the batch lander. The lane's own report and the coordinator's verification are recorded on the pull request.
|
@codex review Head under review: All four findings from your review of Taking your four in order:
Findings 2 and 3 both ended with start, stop, target and limit blocked. The owner's standing What I would like you to attack now. Making the latched reason survive for late observers is Disclosure: this change was produced and verified with AI assistance. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 045669cdd4
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| publish_task = asyncio.create_task( | ||
| self._publish_keithley_channel_states( | ||
| "emergency_off", | ||
| observed_channels=channels, |
There was a problem hiding this comment.
When cached global OFF evidence is older than stale_timeout_s and the operator successfully runs emergency_off(channel="smua"), _ensure_output_off() confirms that channel but does not refresh the global evidence cache; passing observed_channels only advances its revision. The publisher therefore immediately derives smua from the stale cache and emits unknown, leaving Start, Stop, target, and limit commands unavailable despite the fresh OFF proof. Fresh evidence beyond the earlier emergency-OFF finding is the expired-cache path; retain per-channel evidence and observation time so the exact confirmed channel publishes off.
AGENTS.md reference: AGENTS.md:L20-L22
Useful? React with 👍 / 👎.
| source_is_fresh = self._source_observation_generation > source_generation or ( | ||
| self._source_observation_generation == source_generation | ||
| and self._source_observation_revision >= source_required | ||
| ) |
There was a problem hiding this comment.
If an owner transition is dropped before reaching the GUI—ordinary DataBroker telemetry explicitly permits queue drops at core/broker.py:412-432—the producer revision can already be N+1 while the panel still knows N. After a command gets an unknown outcome, the next periodic retransmission carries that pre-command N+1, and this comparison clears the latch once Safety advances even though no source observation occurred after the command; for target/limit mutations, the repeated on state cannot establish whether the mutation settled. Fresh evidence beyond the prior retransmission finding is the replay of a missed pre-command owner revision, so reconciliation must bind to command-time producer evidence rather than last delivered + 1.
AGENTS.md reference: AGENTS.md:L20-L22
Useful? React with 👍 / 👎.
| elif self._state is SafetyState.MANUAL_RECOVERY and not is_transition: | ||
| recovery_ready, recovery_blocker = self._check_preconditions() | ||
| published_reason = "" if recovery_ready else recovery_blocker | ||
| else: | ||
| published_reason = reason |
There was a problem hiding this comment.
During startup or after an emergency OFF, the manager can remain in SAFE_OFF, but periodic publication falls through here and emits the literal reason "periodic". MainWindowV2._dispatch_safety_evidence() treats every state except ready as negative and forwards that reason to set_safety_ready(False, reason), so the operator repeatedly sees Управление заблокировано: periodic. Fresh evidence beyond the corrected MANUAL_RECOVERY case is this common SAFE_OFF path; publish its current blocker or retained actionable transition reason instead.
AGENTS.md reference: AGENTS.md:L529-L535
Useful? React with 👍 / 👎.
| if self._data_broker is None: | ||
| return | ||
|
|
||
| is_transition = reason != "periodic" |
There was a problem hiding this comment.
When retained OFF evidence crosses stale_timeout_s, a periodic call changes the published channel state from off to unknown, but is_transition remains false solely because the call reason is "periodic". AdaptiveThrottle.observe_runtime_signal() consequently ignores this real loss-of-authority transition and continues thinning configured temperature and pressure channels instead of retaining the 30-second high-resolution transition window. Determine the throttle transition flag from the derived state change, while keeping mere same-state retransmissions false.
Useful? React with 👍 / 👎.
…he Start control Integrates #114 onto the candidate, and fixes one defect that only appears once #114 and #116 are in the same tree. The severing: main_window_v2 now distinguishes an authoritative blocked state from an unavailable one. A current interlock condition warns and may stop a running source; it does not grey out Start. Missing or stale Safety authority still disables ordinary controls, and emergency OFF stays available throughout. AUTHORITATIVE_NOT_READY and AUTHORITY_UNAVAILABLE stay distinct -- collapsing them to one boolean is what took the operator's button away. Conflicts were resolved per file rather than per side, because the two branches do not contest the same behaviour -- they have different bases. safety_manager and keithley_panel keep this candidate's A2 content (evidence staleness, the producer revision, replay-is-not-observation); main_window_v2 and its wiring tests take #114's severing. Taking either side wholesale would have silently reverted the other. THE INTEGRATION DEFECT, found by #114's test once both were present: the panel read the producer revision with `reading.metadata.get("source_observation_revision")`, which returns None when a producer stamps no revision. #116's stricter handling accepts the sentinel or an int, so None fell through both branches, the revision never advanced, and a genuine new observation could never reconcile an unknown command outcome -- leaving the operator's controls latched indefinitely. Absence now means unspecified, not invalid. Neither pull request could have found this alone: #116's tests always stamp a revision and #114's path does not. Verified on the candidate: 298 passed across the wiring, channel-state, panel, safety-manager, driver and sensor suites -- all three blocks' properties holding at once. Block A3. Semantic delta only; documentation and generated artifacts reconcile at freeze.
|
Closing as superseded by master, with the check that establishes it. Master is Identical trees mean this branch contributes no production, test, governance or documentation change that master does not already have. The behaviour this pull request asked for is in master; the branch is not. Reopen this if the tree comparison above is wrong. Nothing here is a judgement about the fix itself, which landed. |
1 participant
The Source panel could permanently miss the source's state, and with it the
end-to-end thermal run could never start. This is the last thing that was
stopping the run in phase
WAIT_SOURCE_OFF.What was wrong
SafetyManager.start()records verified-OFF and publishes both source-statetopics. The engine starts SafetyManager before it starts the ZMQ publisher,
so those messages queue and are drained the instant the publisher comes up —
onto a transport that does not retain. A subscriber still completing its
handshake misses that one-shot pair, and nothing republishes it.
Why nobody had seen it
A bug was hiding it. The warm-detector interlock was firing
stop_sourceagainst a mock second-stage reading of about 77.5 K, and SafetyManager's stop
path republishes both topics — by which time the GUI bridge was live. So the
panel had been learning the source state as a side effect of a guard firing
wrongly.
Correcting that guard to warn instead of stop, which the owner ruled, removed
the accident and exposed the defect underneath. Bisection between two probe
worktrees that differed only in the interlock configuration named the
configuration change itself as the first bad commit — that change is correct
and stays. The defect was always here.
What this does not do
The tempting repair is one that reports OFF when it has simply not been told.
This does not do that:
stop_sourcefor its accidental side effect;A genuinely unknown state stays
unknownand the controls stay conservative.There is a regression for exactly that, because it is the failure mode a
careless fix here would introduce.
Verification
Reversion control, run by the coordinator: with the production change reverted
and the regressions kept, 2 nodes fail; with it applied, 2 pass. The two
nodes are
test_late_transport_observer_receives_authoritative_states_without_interlock_tripand
test_late_transport_observer_preserves_genuinely_unknown_source_state. Thefirst attaches its observer after startup — a subscriber attached before it
does not exercise the defect at all — and asserts no interlock was involved.
End-to-end, measured on a combined worktree carrying this fix plus #110,
#111 and #115, with
detector_warmupataction: warningso no guard isfiring:
start_enabledis still false in that tree, gated separately by"Backend readiness authority". That is #114's subject; #114 is not in this
worktree because it conflicts with #111, and the merge is in progress. This
branch does not by itself make the run pass, and it is not claimed to.
Docs gate green at this head; the derived pair was regenerated as the last
commit.
Not determined
test_run_engine_registers_safety_tasks_before_installing_startup_backstop,which did not settle — and reproduced identically with this repair
reverted, so it is not caused by this change.
Disclosure
Written by an AI lane (
gpt-5.6-sol) under an agent brief; diagnosed by aseparate lane by bisection; verified and landed by the coordinating agent. The
lane could not open a socket in its sandbox and said so rather than guessing —
the end-to-end numbers above are the coordinator's.