feature/Make-serve-refused-no-ps · L-260923-e82e4a

[lchoquel]

Where ps may not run, as in Codex's workspace-write sandbox on macOS, the web app template's make serve started a server it could not record and reported it as exited, and make stop took a running server for another process and dropped its record, so nothing could stop it. Both now refuse as refused: no-ps with the record kept, a running group lsof cannot see is refused the same way as no-lsof, and any server serve or stop meant to stop and could not is reported as failed: still-running with its record kept instead of as stopped. The lifecycle tests skip where ps may not run, so the template's make all passes in that sandbox.

Closes L-260923-e82e4a

🤖 Generated with Claude Code

---

Summary by cubic

Fixes make serve and make stop where ps may not run, as in Codex's workspace-write sandbox on macOS. Previously make serve started a server it couldn't record and reported it as exited, and make stop could take a running server for another process, drop its record, and leave it listening with no way to stop it. Both now refuse as refused: no-ps without signaling anything, keeping the record.

Bug Fixes

• make serve checks it can read a start time before starting anything and refuses with refused: no-ps otherwise.
• make stop refuses as no-ps or no-lsof while a recorded group still runs but can't be identified, keeping the record; a group that has ended is still cleared.
• A server that couldn't be stopped, because the system refused the signal or it outlived SIGKILL, is reported failed: still-running with its record kept instead of stopped.
• Lifecycle tests skip where ps may not run, so make all passes in that sandbox.

Closes L-260923-e82e4a

^{Written for commit d9647b9. Summary will update on new commits.}

[lchoquel]

Reviewed locally with /rev at profile 3 (cubic, Codex and code-review), in three rounds that converged.

Round 1 fixed two defects:

• make stop required ps before it saw that the recorded group had ended, so a stale record was never cleared where ps may not run (0af8708).
• When make serve gave up on a start, it dropped the record and said the server had stopped, even when the group outlived the stop (641b6c5).

Round 2 fixed two more:

• A running group none of whose processes lsof could see was taken for one that had ended, and its record dropped. It is now refused as no-lsof (d9647b9).
• The changelog entry is split into one bullet per change (d9647b9).

cubic's claim that lsof cannot see outside processes in Codex's sandbox did not reproduce: under codex sandbox -c sandbox_mode=workspace-write it read an outside process's working directory. The fix does not depend on it either way.

Round 3 was clean at its bar. Its three findings were deferred to the ledger: one helper for the stop-then-forget sequence, keeping the give-up reason in a still-running verdict, and making that verdict the last line after an unexpected error.