fix(stop): typed stop outcome so a history-only failure does not abort the update (#3008) by lidge-jun · Pull Request #3118 · lidge-jun/opencodex

fix(update): tell a history-only stop failure from a real one

lidge-jun

committed

f29a02a

fix(update): probe the endpoint, and never call a failed service stop history-only

lidge-jun

committed

03fad52

fix(update): stop guessing when the liveness probe cannot answer

lidge-jun

committed

84a4a2a

fix(update): one post-stop decision, and an identity rule that matches

lidge-jun

committed

5b9fd79

fix(update): verify the respawn window, and normalize the host once

lidge-jun

committed

0760918

fix(service): charge the respawn wait only to the backend that respawns

lidge-jun

committed

be41c3e

fix(stop): defer shared teardown until the proxy is proven down

lidge-jun

committed

56235a6

fix(stop): make the deferred teardown a durable obligation

lidge-jun

committed

f921120

fix(stop): bind the deferral to a receipt identity, not to presence

lidge-jun

committed

89386db

fix(stop): gate the restore on the inherited obligation, not just label it

lidge-jun

committed

9a60ccc

fix(stop): put the nonce in the filename so a clear cannot race

lidge-jun

committed

34ba69c

fix(stop): share the receipt naming rule, and stop leaking obligations

lidge-jun

committed

3d8574b

fix(stop): keep an unreadable obligation enforcing, and always leave a receipt

lidge-jun

committed

b4d434f

fix(stop): record endpoint provenance, and re-check obligations after the stop

lidge-jun

committed

754ec33

fix(stop): say what quarantine actually does

lidge-jun

committed

311cf98

fix(restore): finish the Grok half when the Codex half is a no-op

lidge-jun

committed

b643b93

fix(restore): strip the fence on every path, and stop reading a failed scan as empty

lidge-jun

committed

a249c69

fix(stop): make every teardown path report the whole outcome

lidge-jun

committed

920cd1c

fix(stop): refuse a respawnable backend before touching it, not after

lidge-jun

committed

fdb75ab

fix(stop): only a proven absence is safe, and say so in every locale

lidge-jun

committed

01cfde8

fix(stop): give an unreadable scheduler state its own answer, not a loop

lidge-jun

committed

ff641b9

fix(stop): carry the unreadable-scheduler diagnosis into ocx stop too

lidge-jun

committed

cc53ce6

fix(uninstall): stop reading an unreadable service state as "not installed"

lidge-jun

committed

237643c

fix(uninstall): find the orphan, and make the authorization rule callable

lidge-jun

committed

a043e31

fix(uninstall): stop manufacturing proof out of three different unknowns

lidge-jun

committed

be348f8

fix(uninstall): prove every endpoint, and stop reading silence as a dead window

lidge-jun

committed

37f0d1f

docs(devlog): record what 26 review rounds added to the #3008 unit

lidge-jun

committed

0ae6190

Navigation Menu

fix(stop): typed stop outcome so a history-only failure does not abort the update (#3008) - #3118

fix(stop): typed stop outcome so a history-only failure does not abort the update (#3008)#3118
lidge-jun merged 27 commits into
devfrom
codex/3008-stop-taxonomy

Commits on Aug 31, 2026

fix(update): tell a history-only stop failure from a real one

fix(update): probe the endpoint, and never call a failed service stop history-only

fix(update): stop guessing when the liveness probe cannot answer

fix(update): one post-stop decision, and an identity rule that matches

fix(update): verify the respawn window, and normalize the host once

fix(service): charge the respawn wait only to the backend that respawns

fix(stop): defer shared teardown until the proxy is proven down

fix(stop): make the deferred teardown a durable obligation

fix(stop): bind the deferral to a receipt identity, not to presence

fix(stop): gate the restore on the inherited obligation, not just label it

fix(stop): put the nonce in the filename so a clear cannot race

fix(stop): share the receipt naming rule, and stop leaking obligations

fix(stop): keep an unreadable obligation enforcing, and always leave a receipt

fix(stop): record endpoint provenance, and re-check obligations after the stop

fix(stop): say what quarantine actually does

fix(restore): finish the Grok half when the Codex half is a no-op

fix(restore): strip the fence on every path, and stop reading a failed scan as empty

fix(stop): make every teardown path report the whole outcome

fix(stop): refuse a respawnable backend before touching it, not after

fix(stop): only a proven absence is safe, and say so in every locale

fix(stop): give an unreadable scheduler state its own answer, not a loop

fix(stop): carry the unreadable-scheduler diagnosis into ocx stop too

fix(uninstall): stop reading an unreadable service state as "not installed"

fix(uninstall): find the orphan, and make the authorization rule callable

fix(uninstall): stop manufacturing proof out of three different unknowns

fix(uninstall): prove every endpoint, and stop reading silence as a dead window

docs(devlog): record what 26 review rounds added to the #3008 unit