I1503 — A closed session is not closed a second time under the same identity
Stop the session closer from writing a second record for a session that already has one, so that a session identity names one record and the index does not exclude every claimant of it.
DONE wave 0 · p0 · implementation profile · parallel safe
Part of development-runtime — The runtime has a development surface.
Objective
Stop the session closer from writing a second record for a session that already has one, so that a session identity names one record and the index does not exclude every claimant of it.
Why
The identity collision it produces is not a cosmetic finding: the repository reported its state as `degraded`, and because every claimant of a contested identity is excluded, the session was absent from the registry whose whole purpose is to hold it. A record nobody can read is not a record. The data half of this was repaired — four files claimed majordomus://session/s-20260909152316-024f, three of them written the following morning thirteen and fifteen seconds apart by a closer re-closing a session closed the evening before, and each a strict superset of the committed one — but repairing data does not repair the writer, and the writer will produce the next collision.
Current state
Fixed as data on this milestone's own branch: one record kept, the complete one, proved a superset by comparing commit sets rather than assuming it. The writer is unchanged. Nothing refuses a second closure of an already-closed session, and nothing in the commit path notices that two tracked records claim one identity — the collision was found by reading the server's diagnostics, not by a gate.
Desired state
Closing a session that is already closed is a no-op or a refusal, not a second record. A tracked tree in which two objects of any kind claim one identity fails a check before it is committed, rather than degrading the index of whoever reads it next.
Scope
- lib
- .ai/repo/sessions
- test/cases
Out of scope
- Deleting any session record. The repair that preceded this issue kept the complete record and deleted only the partial one it contains.
- The wider question of when an episode begins and ends, which ADR 0052 owns on a branch of its own.
Dependencies
None. This issue is a root of the graph.
Acceptance criteria
- Closing an already-closed session does not produce a second record under the same identity
- A tree carrying two objects that claim one identity is refused by a check, with both paths named
- The repository's own diagnostics report no duplicate_identity on a clean tree
Validation
- bin/majordomus doctor
- bash test/run.sh
Evidence required
- second_close_is_refused
- duplicate_identity_is_gated
Evidence
| covers | type | command | result | at commit |
|---|---|---|---|---|
| second_close_is_refused | test | MJ_TEST_JOBS=2 bash test/run.sh 220_exactly_once_close | tests: 1 passed, 0 failed, 0 skipped (run 2026-10-14 between 07:40Z and 07:58Z on master ce5959db59) | ce5959d |
| duplicate_identity_is_gated | test | MJ_TEST_JOBS=2 bash test/run.sh 72_rust_mcp 63_session_records && cargo test --locked --manifest-path apps/majordomus-cli/Cargo.toml --test cli an_inspection_names_each_diagnostic_and_ends_10_on_an_error | cases: 2 passed, 0 failed; test result: ok. 1 passed; 0 failed (run 2026-10-14 between 07:40Z and 07:58Z on master ce5959db59) | ce5959d |
Risk
Low. The failure mode to avoid is a closer that refuses a legitimate re-close after a crash and leaves a session open forever; the refusal must be specific to an identity that already has a complete record.
Timeline
- started
- 2026-10-14T07:58:26Z
- verified
- —
- completed
- 2026-10-14T07:58:34Z
Those three fields, the evidence above and the state of the dependencies are all the status is made of. There is no status field to disagree with them.
Canonical record: .ai/repo/project/issues/I1503.yaml. Read it back with majordomus plan show I1503.