I2127 — A server that lost its lease hands its sessions on and ends
Make a server that lost or was superseded in its lease answer its existing MCP sessions with session-not-found after a bounded in-flight grace, so their bridges re-attach to the current leaseholder and the old process reaches its own end.
DONE wave 0 · p1 · implementation profile · runs alone
Objective
Make a server that lost or was superseded in its lease answer its existing MCP sessions with session-not-found after a bounded in-flight grace, so their bridges re-attach to the current leaseholder and the old process reaches its own end.
Why
A lost or superseded server keeps serving its existing sessions 'and ends with them' (apps/majordomus-cli/src/http/mcp.rs:113-118). Bridges ping every 20 s (apps/majordomus-cli/src/mcp/bridge.rs:19) and the serve loop counts bridged sessions as attached (apps/majordomus-cli/src/commands/serve.rs:136-146), so a server running replaced code never idles out while any bridge lives, and its clients stay on old code until they exit. docs/MCP.md:48 (the ping) and :50 (the server ends when the last peer goes) together make a superseded server immortal; :118 says only that 'the process ends with them'. Baseline audit of 2026-10-09 at master 1fb8d6be44, lifecycle gap 4 and drift 7.
Current state
After a supersession, a new initialize gets 409 lease_lost (apps/majordomus-cli/src/http/mcp.rs:119-128, apps/majordomus-cli/tests/lease_lost.rs::a_server_that_lost_its_lease_says_so_and_takes_on_nobody_new), but sessions opened before it are served indefinitely.
Desired state
lease::lost records when; for the declared busy grace a superseded server answers its sessions, then closes each one on its next request with 404 session_not_found, which the bridge answers by opening a session, being refused 409 lease_lost and electing the current server; serve ends once it holds no session (superseded_and_alone). A request in flight is answered where it started. Not measured here: the full client path through a real bridge to the new leaseholder (the 404 path it relies on is the bridge's existing one, tested in mcp_shared).
Scope
- apps/majordomus-cli/src/http/mcp.rs
- apps/majordomus-cli/src/shared.rs
- apps/majordomus-cli/src/commands/serve.rs
- apps/majordomus-cli/src/mcp/bridge.rs
- apps/majordomus-cli/tests/lease_lost.rs
- apps/majordomus-cli/tests/mcp_shared.rs
- docs/MCP.md
Dependencies
None. This issue is a root of the graph.
What waits on this
Acceptance criteria
- A bridged client attached to a server whose lease is then taken over is answered by the new leaseholder within the declared grace, with no request lost
- The superseded process exits by itself after its sessions moved, while the bridges are still alive
- A request in flight at the moment of supersession receives its own answer, not a 404
- docs/MCP.md states the grace and that a lost server ends
Validation
- bin/majordomus plan validate
- cargo test --test lease_lost --test mcp_shared
Evidence required
- lost_server_hands_sessions_on_test
- superseded_server_exits_test
Evidence
| covers | type | command | result | at commit |
|---|---|---|---|---|
| lost_server_hands_sessions_on_test | ci | gh run view 38626102499 --log --job 116065669794 (validate on master e8505a431d, rust (3): cargo test --test lease_lost) | lost_server_hands_sessions_on_test names a test never written under that name; proved by tests/lease_lost.rs a_server_that_lost_its_lease_says_so_and_takes_on_nobody_new ... ok in validate run 38626102499 (success) at e8505a431d; delivered by 5bb27f42145 | c0e3585 |
| superseded_server_exits_test | ci | gh run view 38626102499 --log --job 116065669794 (validate on master e8505a431d, rust (3): cargo test --test cov_runtime_a_server) | superseded_server_exits_test names a test never written under that name; proved by tests/cov_runtime_a_server.rs an_unbounded_server_whose_lease_is_taken_over_ends_by_itself ... ok in validate run 38626102499 (success) at e8505a431d; delivered by 5bb27f42145 | c0e3585 |
Timeline
- started
- 2026-10-14T22:12:56Z
- verified
- 2026-10-14T22:13:14Z
- completed
- 2026-10-14T22:13:35Z
Those three fields, the evidence above and the state of the dependencies are all the status is made of. There is no status field to disagree with them.
Canonical record: .ai/repo/project/issues/I2127.yaml. Read it back with majordomus plan show I2127.