I2128

What it is

Objective

Make every removal and every rewrite of the lease file conditional on the actor still holding it, and turn the SIGTERM that serve stop sends into the ordered stop the server already has.

Why

Three findings. The signal handler unlinks the lease whenever HELD is set and re-raises with SIG_DFL (apps/majordomus-cli/src/lease.rs:1164-1212, the unlink at 1197-1211), so between a takeover and the old owner's next 500 ms tick a SIGTERM to the old owner unlinks the new owner's lease. take_over reads, compares and then calls remove_file (apps/majordomus-cli/src/lease.rs:778-798) in three steps, so two electors that both judged one lease stale can interleave and the second unlinks the first's fresh lease; publish checks is_mine and then renames the fixed tmp name server.json.tmp (apps/majordomus-cli/src/lease.rs:1082-1107) with no fsync, so a takeover between the check and the rename is overwritten. serve stop sends SIGTERM (apps/majordomus-cli/src/commands/serve.rs:814,890-903) and SharedServer::stop (apps/majordomus-cli/src/shared.rs:282-289, closing episodes and draining the mesh) never runs; apps/majordomus-cli/tests/mcp_shared.rs::sigterm_removes_the_lease_before_the_process_dies asserts the process dies of signal 15, while the comment at apps/majordomus-cli/src/shared.rs:274-281 implies serve stop runs the ordered stop. Every serve stop leaves open episodes for recover_orphans and cuts in-flight answers. LeaseView.pid is documented as informational (apps/majordomus-cli/src/capability/builtin/server.rs:236) although liveness (apps/majordomus-cli/src/lease.rs:742), the spawn claim (apps/majordomus-cli/src/commands/serve.rs:354-356) and serve stop (apps/majordomus-cli/src/commands/serve.rs:814) decide from it. Baseline audit of 2026-10-09 at master 1fb8d6be44, lifecycle gaps 5 and 11, drift 5 and 6. Graceful termination of in-flight responses in the production container is I0906 (fly-deployment); this issue covers the lease and the episodes locally.

Now

Lease removal by the signal handler and by take_over does not re-check the token. serve stop is a hard kill that removes the lease first.

Wanted

The serve loop turns SIGTERM into a flag it polls, waits a bounded time for peers to leave and runs SharedServer::stop; only then is the lease released through the path that checks is_mine. take_over renames the stale file aside under its own token and confirms what it moved before claiming. publish writes a tmp file named for its token and syncs it before the rename. A second SIGTERM, or the bound passing, still ends the process.

Done when

unknown: the record declares no `completion`

Risk

unknown: the record declares no `risk`

Acceptance

Scope

Touches

apps/majordomus-cli/src/lease.rsapps/majordomus-cli/src/shared.rsapps/majordomus-cli/src/commands/serve.rsapps/majordomus-cli/src/capability/builtin/server.rsapps/majordomus-cli/tests/mcp_shared.rsapps/majordomus-cli/tests/serve_lifecycle.rstest/casesdocs/MCP.md

Not

unknown: the record declares no `non_scope`

Depends on

none

Priority

p1

Profile

implementation

Parallel safe

false

Owner

unknown: the record declares no `owner`

The work so far

Synchronisation

Adapter

scripts/github-sync

Repository

unknown: the derived plan's header carries no repository

External issue

unknown: a live GitHub state; this executable makes no network call, so only `scripts/github-sync --check` can answer it

State there

unknown: a live GitHub state; this executable makes no network call, so only `scripts/github-sync --check` can answer it

Findings

Nothing is wrong with these records.