fix(service): avoid Windows executable lookup in lease diagnostics (carry #6655)

[lidge-jun]

Summary

• Carry contributor PR fix(service): avoid Windows executable lookup in lease diagnostics #6655 by @luvs01 onto dev from 42a571f13a4d7f62415c82b9c0b4f1a0c7a641b4. Windows lease diagnostics now return null for the optional default executable image label before spawning any diagnostic helper. The shared module remains usable by both Bun and the Node npm/pnpm launcher.
• Keep ownership, PID liveness, busy refusal, stale reclamation, release/delegation, explicit image-resolver injection, and the POSIX ps lookup unchanged. The .d.mts change updates its comment only; declaration types and signatures retain their meaning.
• Carry the applicable English/Korean lifecycle and structure contract updates. Put regression coverage in a sibling service test file and register it in both layout inventories; scripts/test-layout/layout.json remains 1,998 lines without raising any file-size cap.

This is the requested carry even though the original PR currently reports maintainerCanModify=true (the assignment recorded false). The original PR stays open. Its independent maintainer security-review hold is not treated as fulfilled by this carry or by passing local checks.

Co-authored-by: Epinephrine luvs01@hanmail.net

Verification

Validated head: 1c68a50e5c20ea1e16bf8dc396fe524148ac8264.

• Red before the production change: bun test ./tests/service/ownership-mutation-lease-diagnostics.test.ts — exit 1, 3 pass / 1 fail. The Windows regression received the intercepted untrusted-tasklist.exe label instead of null, proving the old diagnostic subprocess path executed without launching a real Windows helper.
• Green after the change: bun test ./tests/service/ownership-mutation-lease-diagnostics.test.ts ./tests/service/service-ownership-state.test.ts — exit 0, 50 pass / 0 fail, 161 assertions. Covers zero Windows diagnostic subprocesses for inspection/status/busy refusal, live old-owner refusal, preserved owner bytes/file identity, read-only stale inspection, dead stale-owner reclamation, POSIX ps arguments/timeout/basename, and explicit image injection. Existing ownership/delegation and late-release protections passed unchanged.
• bun test ./tests/test-layout.test.ts ./tests/test-layout-tooling.test.ts ./tests/ci-workflows/file-size-ratchet.test.ts — exit 0, 27 pass / 0 fail, 640 assertions; both test inventories and repository file-size caps pass.
• bun run typecheck — exit 0.
• bun run structure:check — exit 0, structure/ SSOT checks passed.
• bun run privacy:scan — exit 0, Privacy scan passed.
• git diff --cached --check and git diff --check — exit 0 before commit.
• bun run --cwd docs-site build initially exited 127 because the lane had no Astro installation. bun install --cwd docs-site --frozen-lockfile then exited 0 without tracked dependency changes, and bun run --cwd docs-site build > .tmp/h2-lease-docs-build.log 2>&1 exited 0: 561 pages built and 78,111 internal links checked. Warnings concern untouched remote-link sshconfig highlighting, the empty i18n collection, and a large bundle chunk.

The Windows/POSIX branches are exercised through a temporary platform override and a spawnSync spy in Bun on macOS; this is not native Windows execution. The full local suite was not run, per the bounded parallel-lane assignment and shared-resource policy. Broader platform validation is reserved for the coordinator's final Cross-platform CI. This leaf does not wait for, dispatch, cancel, or rerun CI and does not claim hosted CI passed. Independent security review remains pending with the coordinator before integration.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults. Independent maintainer security review remains pending before integration.

Summary by CodeRabbit

• Bug Fixes

  • Windows lease diagnostics no longer launch a separate program to identify the process. They still report the process ID, whether it is running, the lease age, and recovery guidance.
  • Lease inspection and status checks leave stale ownership unchanged; acquisition can still reclaim it.

• Documentation

  • Updated guidance on executable-name lookup across Windows and POSIX platforms.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-07T13:52:24.500820Z	1c68a50	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository: lidge-jun/opencodex/.coderabbit.yaml
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 2c192ab4-d5c9-46fd-b5c2-b162c9a884dd

📥 Commits

Reviewing files that changed from the base of the PR and between 42a571f and 1c68a50.

📒 Files selected for processing (9)

• docs-site/src/content/docs/ko/reference/cli/lifecycle.md
• docs-site/src/content/docs/reference/cli/lifecycle.md
• scripts/test-layout/layout.json
• src/service/ownership-mutation-lease.d.mts
• src/service/ownership-mutation-lease.mjs
• structure/ops/service-and-sidecars.md
• structure/runtime.md
• tests/fixtures/test-layout-expected.json
• tests/service/ownership-mutation-lease-diagnostics.test.ts

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 7 remain after this review.

---

📝 Walkthrough

Walkthrough

The default Windows lease diagnostic no longer launches tasklist to identify a process image. PID, liveness, lease age, and recovery guidance remain available. POSIX diagnostics continue to use ps, and new tests cover both platform paths.

Changes

Lease Diagnostics

Layer / File(s)

Summary

Platform-specific process image lookup and diagnostics src/service/ownership-mutation-lease.mjs, src/service/ownership-mutation-lease.d.mts, tests/service/ownership-mutation-lease-diagnostics.test.ts, scripts/test-layout/layout.json, tests/fixtures/test-layout-expected.json, docs-site/src/content/docs/reference/cli/lifecycle.md, docs-site/src/content/docs/ko/reference/cli/lifecycle.md, structure/ops/service-and-sidecars.md, structure/runtime.md

The default Windows lookup now returns no process image instead of running tasklist; POSIX retains its bounded ps lookup. Tests cover diagnostics, stale-owner handling during status and acquisition, and an explicitly supplied image resolver. Documentation describes the platform-specific behavior.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 1c68a

The Windows diagnostic omits only the optional executable label. No actionable issue is established; normal cross-platform checks remain appropriate.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 33.33% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 3 functions across 3 files. (6 skipped: 6…	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: Windows lease diagnostics no longer perform executable lookup. The carry reference does not obscure the change.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 33.33% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 3 functions across 3 files. (6 skipped: 6 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Deterministic PR hygiene checks passed.

[lidge-jun]

Maintainer integration into dev (MAINTAINERS.md dev-only maintainer integration; not a self-approval) under the maintainer's delegated "proceed with what is truly necessary" decision of 2026-10-07 (devlog/_plan/261007_held_items).

• Exact head: 1c68a50e5c20ea1e16bf8dc396fe524148ac8264; carries fix(service): avoid Windows executable lookup in lease diagnostics #6655 by @luvs01 with a Co-authored-by trailer.
• Delegated security/correctness review: independent gpt-6.1-sol adversarial review PASS on this head (Windows returns null for the optional image label before any helper runs; POSIX lookup, ownership, liveness and reclamation unchanged; regression red against the parent, green on head).
• Local verification on the exact merge into current origin/dev: lease diagnostics + ownership tests 50 pass; layout/ratchet guards 27 pass; tsc --noEmit 0; structure:check pass.
• Per the owner's train rule, one workflow_dispatch Cross-platform CI (lane=all) runs on the final dev tip.