I3913 — The executor runs as a user service outside every agent session, restarted after a crash and never after a halt

✕BLOCKED wave 2 · p0 · implementation profile · runs alone

Part of landing-survives-any-session — Landing green work survives any session, any restart and any machine.

Objective

majordomus prs service install, run by the owner, writes a user service (launchd on macOS, systemd --user on Linux) through the one unit writer I2722 owns, running prs drain --continuous for this checkout; prs service status and uninstall manage it. The unit restarts the executor after an exit that is a crash or an outage, and never after a halt (an unverified landing) or a refusal, which keeps the halt of ADR 0101 D7 and the outage bound (CONTINUOUS_TRANSIENT_LIMIT, drain.rs:1886) in force. It logs under the local half and is never written without the owner running the command.

Why

The landing loop of 2026-10-20 to 2026-10-22 lived inside an agent session, so it died with the session and the machine, and every landing a session attempted met the auto-mode classifier. A service outside agent sessions answers both; a review of this plan found that a service restarting without limit would undo the halt.

Current state

No launchd or systemd unit for the executor exists; prs drain runs only on demand; I2722 plans the user-unit writer for the hub.

Desired state

After install the executor runs and lands the next green head; killing it restarts it; a halt or a refusal leaves it stopped and status says why; uninstall leaves nothing behind.

Scope

• apps/majordomus-cli/tests/integration_executor.rs
• apps/majordomus-cli/src/integration
• apps/majordomus-cli/src/commands/prs.rs
• apps/majordomus-cli/src/cli.rs
• docs/INTEGRATION.md
• .ai/repo/project/issues/I3913.yaml

Dependencies

• I3910○READY The integration executor fast-forwards master to every green head, a combined top included, and nothing else lands
• I3911○READY The executor reads its audit trail, its halt and its lease from origin, so any clone continues it and a stale holder is refused
• I2722✕BLOCKED A hub activates a new version under its service manager, checks its health and rolls back by itself

Acceptance criteria

• install writes one unit naming this checkout through I2722's writer; a second install changes nothing
• A killed executor is restarted; an exit by halt or refusal is not (case a_halted_executor_is_not_restarted, proven without a service manager)
• status reports running or not, the last decision and its time; uninstall removes the unit

Validation

• bin/majordomus plan validate
• env -u MAJORDOMUS_SHARE cargo test --manifest-path apps/majordomus-cli/Cargo.toml --lib -- integration::
• env -u MAJORDOMUS_SHARE cargo test --manifest-path apps/majordomus-cli/Cargo.toml --test integration_executor

Evidence required

• survives_a_restart

Evidence

None recorded. Every token above needs a command or an artifact behind it before this issue can be completed; narrative is refused.

Timeline

started

—

verified

—

completed

—

Those three fields, the evidence above and the state of the dependencies are all the status is made of. There is no status field to disagree with them.

Canonical record: .ai/repo/project/issues/I3913.yaml. Read it back with majordomus plan show I3913.