Repository navigation
fix(node): a respawn is not a first sighting - #6463
Merged
Merged
Conversation
|
Contributor
Visual diffComparing 2 of 86 comparison(s) flagged (>1% pixel diff).
Folder: 0a72fa63cb40. Full PNGs also attached as a workflow artefact. Generated by visual-diff bot. Pixel diffs >1% flagged; eyeball the table before merging. This check is non-blocking — fail = bot bug, not a code problem. |
On a live macOS node, 1,999 of the 2,000 retained Node activity events were "A process was first observed": contactsd 556 times, mdworker_shared 462, Google Chrome Helper 150. The declared 24 hour retention window therefore held 3.1 hours of history, so a sensitive-settings change or a new listener is evicted by operating-system daemon churn long before an operator sees it. The sighting ledger was keyed by the run, that is the PID plus its measured start time. Every respawn of a daemon is a new run, so every respawn read as a first sighting. The run is the right identity for the inventory and for the comparison baseline, and both keep it. It is the wrong identity for the sentence the event states. The ledger now carries a program ledger alongside the run ledger, bounded at 4,096 programs and expiring on the same retained window, so a program absent for the whole window is news again when it returns. Runs of an already-announced program stay in the process list and the baseline without a second announcement. Measured after installing this on that node: 44 announcements, none of them a repeat. The guard reproduces the defect directly and reports 7 sightings for one program against the unfixed ledger where it wants 1. Fixture rows gain distinct program names, because a fixture that shares one name would measure the dedup instead of the case under test. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
vivekchand
force-pushed
the
fix/node-activity-signal
branch
from
October 16, 2026 22:36
0a72fa6 to
5fb63ee
Compare
vivekchand
changed the title
✅ Drift Bot (ClawMetry): no drift detectedDrift Bot analyzed the changed files against this project's blueprints and requirements and found no drift. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Requirement: https://factory.8090.ai/project/b415065f-ab2f-4f53-8864-0c009fd098cb/requirements/d33e1d0b-43c1-4d3f-8d0d-8de6628d0583
Follows #6445, which landed the readable counts, the lsof listener fallback, measured process CPU and the removal of the attribution map. This PR is now only the defect that one did not reach, in
node_activity_store.py.The defect
On a live macOS node, 1,999 of the 2,000 retained events were "A process was first observed":
1,930 of the 1,999 were repeat announcements of 165 programs. The declared 24 hour retention window held 3.1 hours of real history, so a sensitive-settings change or a new listener is evicted by operating-system daemon churn long before an operator sees it. Replay, the event list and the Guard view all read as noise, and the snapshot pushed to cloud carried 2.7 MB of it.
The cause
The sighting ledger was keyed by the run: the PID plus its measured start time. Every respawn of a daemon is a new run, so every respawn satisfied "a process identity not known in the current retained-history context" and announced itself again. The run is the correct identity for the inventory and for the comparison baseline, and both keep it. It is the wrong identity for the sentence the event states.
The fix
A program ledger beside the run ledger, bounded at 4,096 and expiring on the same retained window, so a program absent for the whole window is news again when it returns. A run of an already-announced program still lands in the process list and in the comparison baseline, just without a second announcement.
Verification
process_countreads 454 rather than null.The 2,000 churn events already stored age out over the next 24 hours; nothing is deleted to make the screen look better.
🤖 Generated with Claude Code