I2126

What it is

Objective

Make the lease probe reach a server whose HTTP workers are all running tool calls, and make it prove it reached the leaseholder, so that a client deciding whether the owner is alive is never answered by a full worker pool or by another process.

Why

The probe a client sends before taking over is GET / (apps/majordomus-cli/src/lease.rs:896-925), served by the same four workers (apps/majordomus-cli/src/http/server.rs:23) that run each tools/call synchronously. Four tool calls that outlast the probe timeout plus the busy grace (about 12 s, apps/majordomus-cli/src/lease.rs:43-62, 555-568) make a healthy server look wedged, and the next client to start takes its lease. is_own (apps/majordomus-cli/src/lease.rs:429) fixes only a server probing itself. GET / is also the most expensive route: it resolves the index and every surface, while /api/v1/live and /api/v1/ready exist (apps/majordomus-cli/src/capability/builtin/health.rs:691,702) and the probe does not use them. The probe compares name, repository_id and leaseholder (apps/majordomus-cli/src/lease.rs:902-905) but not the lease token, pid or started_at, and GET / does not expose them. Baseline audit of 2026-10-09 at master 1fb8d6be44, lifecycle gap 3 and the fencing row.

Now

apps/majordomus-cli/tests/lease_busy.rs covers a live owner that answers late and one that never answers; no test holds every worker busy while a second client elects, and no probe compares the token.

Wanted

The workers only accept; each request is answered on a thread of its own up to MAX_HANDLERS (64), so a lease probe is answered while slow tool calls run, and stop waits a bounded time for handed-off requests. The deferred part, a liveness probe route carrying a digest of the lease token and the check that refuses a server whose token differs, is I2700.

Done when

unknown: the record declares no `completion`

Risk

unknown: the record declares no `risk`

Acceptance

Scope

Touches

apps/majordomus-cli/src/lease.rsapps/majordomus-cli/src/http/server.rsapps/majordomus-cli/src/http/router.rsapps/majordomus-cli/src/capability/builtin/health.rsapps/majordomus-cli/tests/lease_busy.rstest/casesdocs/MCP.md

Not

unknown: the record declares no `non_scope`

Depends on

none

Priority

p1

Profile

implementation

Parallel safe

false

Owner

unknown: the record declares no `owner`

The work so far

Synchronisation

Adapter

scripts/github-sync

Repository

unknown: the derived plan's header carries no repository

External issue

unknown: a live GitHub state; this executable makes no network call, so only `scripts/github-sync --check` can answer it

State there

unknown: a live GitHub state; this executable makes no network call, so only `scripts/github-sync --check` can answer it

Findings

Nothing is wrong with these records.