fix: ignore confirmed dead LaunchServices records

[steipete]

A reaped process can remain in LaunchServices' application list. The native generation lookup returned ESRCH, but Peekaboo collapsed that result into unknown metadata. One dead row then made the entire mutation inventory partial and refused otherwise unambiguous application names and bundle IDs.

Preserve explicit native absence separately from permission denial and uncertain metadata. Exclude a row only after two consecutive failed full-BSD generation reads return ESRCH. Partial reads, other errors, readable generations that disappear, and changing/reused identities still make the inventory partial. Existing denied-helper policy, read-only discovery, and generation-pinned explicit-PID targeting remain intact.

Fixes #709.

Validation:

• Before the fix, the new native regression reaped a real child, retained its PID in a synthetic LaunchServices list, and failed with partial inventory plus the missing-generation warning. All other inventory tests passed.
• swift test --package-path Core/PeekabooAutomationKit --filter 'ApplicationInventoryTimeoutTests|SystemIdentityResolverTests': 27 tests passed after the fix, including native absence, uncertainty transitions, denied-helper identity changes, and timeout/cancellation coverage.
• Signed standalone executable linked the production AutomationKit code, used real native generation lookups with a reaped PID retained in a synthetic discovery list, then resolved the live process by both name and bundle. Exit 0:

  PASS: real reaped PID excluded; synthetic LaunchServices inventory complete; name and bundle retain live native generation
  

• Independent signed kernel probe: running child returned 136/136 BSD bytes; after reap, three reads returned 0 bytes with errno 3 (ESRCH), and kill(pid, 0) also reported ESRCH.
• Isolated Codex autoreview: clean at P0–P2. SwiftFormat, SwiftLint, docs lint, and diff checks passed.
• Application-resolution documentation and Unreleased updated. Hosted checks must pass on this exact head before merge.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[cursor]

PR Summary

Medium Risk
Changes mutation-inventory completeness and app name/bundle resolution; incorrect absence handling could hide live apps or accept stale PIDs, though the double-ESRCH gate and unchanged uncertainty paths limit exposure.

Overview
Fixes mutation inventory being marked partial when LaunchServices still lists an exited process, which blocked unambiguous app name and bundle targeting (#709).

Native full-BSD process-generation reads now surface ESRCH as .absent instead of folding it into unknown metadata. Mutation inventory drops a PID only after two consecutive .absent reads; partial reads, other errors, or any flip between absence and a readable/changing generation still omit the row and keep inventory partial (same fail-closed stance as before for denied helpers and explicit-PID targeting).

Docs and changelog describe the stale-row rule; tests cover a real reaped child PID and uncertain identity transitions.

^{Reviewed by Cursor Bugbot for commit 2b6bc23. Bugbot is set up for automated code reviews on this repo. Configure here.}

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed September 12, 2026, 8:16 PM ET / September 13, 2026, 00:16 UTC (Revision 2).

ClawSweeper review

What this changes

Exclude stale macOS application records after two native lookups confirm the process is absent, restoring name and bundle targeting while retaining refusal for uncertain identities.

Merge readiness

✅ Ready for maintainer review

This remains a useful fix: current main and v4.3.4 retain the reported failure mechanism. The scoped native proof supports the change, and no actionable correctness or security defect was found.

Priority: P1
Reviewed head: 2b6bc233416c2650fddecb34e2e7cc638f7478fd

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused repair with relevant native proof, uncertainty coverage, and no actionable findings.
Proof confidence	🐚 platinum hermit (4/6)	Sufficient (terminal): The recorded signed production-AutomationKit run exercised native lookups for a real reaped child retained in synthetic discovery, then observed complete inventory and successful name/bundle resolution preserving the live generation; the independent kernel probe corroborates ESRCH classification.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Verified	Sufficient (terminal): The recorded signed production-AutomationKit run exercised native lookups for a real reaped child retained in synthetic discovery, then observed complete inventory and successful name/bundle resolution preserving the live generation; the independent kernel probe corroborates ESRCH classification.
Evidence reviewed	8 items	Applicable repository policy: Read the full root AGENTS.md; no nested AGENTS.md or maintainer-note files were found under the affected paths. Applied its module, regression-coverage, documentation, and behavioral-evidence guidance within the read-only review contract. Narrow absence exception: Only consecutive absent observations skip a record without a warning. Readable generations still require matching candidate PID and a second matching generation; every uncertain observation preserves partial inventory. Native classification and regression coverage: Absence requires a failed full-BSD lookup with ESRCH; partial reads remain unavailable and successful reads ignore stale errno. Added coverage exercises a real reaped child and five uncertain observation transitions.
Findings	None	None.
Security	None	None.

How this fits together

Peekaboo builds an application inventory from macOS discovery records and native process identities. The mutation planner uses that inventory to select an unambiguous application and retain its process generation for subsequent actions.

flowchart TD
  A[macOS application records] --> B[Native process lookup]
  B --> C{Confirmed absent twice?}
  C -->|Yes| D[Exclude stale record]
  C -->|No| E[Validate identity and metadata]
  E --> F[Complete inventory or refusal]
  D --> F
  F --> G[Exact application selection]
  G --> H[Generation checked action]

Loading

Before merge

None.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Production and test delta	Production +12/-2 lines; tests +84/-3 lines	The small production change has a concrete reported failure and focused native-absence and uncertainty coverage.

Root-cause cluster

Relationship: fixed_by_candidate
Canonical: #709
Summary: This PR directly addresses the confirmed-dead-record failure reported in the linked issue.

Members:

• canonical: 4.3.0: name resolution still fails closed on a terminated LaunchServices record (follow-up to #677) #709 - Contains the affected-release reproduction and is explicitly linked for closure by this candidate fix.
• adjacent_distinct: fix(automation): preserve mutations with inaccessible background services #678 - Merged handling for permission-denied live helpers; terminated-process absence remains a separate case.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Technical review

Best possible solution:

Keep confirmed native absence distinct from uncertainty while preserving complete-inventory selection and generation checks before application actions.

Do we have a high-confidence way to reproduce the issue?

Yes, from source: a listed PID returning ESRCH becomes an omission on current main, and the planner rejects the resulting partial inventory. Native before/after execution is recorded in the PR body, not independently run in this review.

Is this the best way to solve the issue?

Yes. Separating explicit native absence and requiring two agreeing observations repairs the reported failure without relaxing arbitrary-error handling or adding a competing resolution path.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 4338bc31e6cd.

Labels

Label justifications:

• P1: A single stale application record can block ordinary name-targeted desktop automation across unrelated applications.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (terminal): The recorded signed production-AutomationKit run exercised native lookups for a real reaped child retained in synthetic discovery, then observed complete inventory and successful name/bundle resolution preserving the live generation; the independent kernel probe corroborates ESRCH classification.
• proof: sufficient: Contributor real behavior proof is sufficient. The recorded signed production-AutomationKit run exercised native lookups for a real reaped child retained in synthetic discovery, then observed complete inventory and successful name/bundle resolution preserving the live generation; the independent kernel probe corroborates ESRCH classification.

Evidence

What I checked:

• Applicable repository policy: Read the full root AGENTS.md; no nested AGENTS.md or maintainer-note files were found under the affected paths. Applied its module, regression-coverage, documentation, and behavioral-evidence guidance within the read-only review contract. (AGENTS.md:1, 2b6bc233416c)
• Narrow absence exception: Only consecutive absent observations skip a record without a warning. Readable generations still require matching candidate PID and a second matching generation; every uncertain observation preserves partial inventory. (Core/PeekabooAutomationKit/Sources/PeekabooAutomationKit/Services/System/ApplicationService+Discovery.swift:61, 2b6bc233416c)
• Native classification and regression coverage: Absence requires a failed full-BSD lookup with ESRCH; partial reads remain unavailable and successful reads ignore stale errno. Added coverage exercises a real reaped child and five uncertain observation transitions. (Core/PeekabooAutomationKit/Tests/PeekabooAutomationKitTests/ApplicationInventoryTimeoutTests.swift:835, 2b6bc233416c)
• Selection and final-effect safeguards: The planner still rejects incomplete inventories and revalidates the selected process generation and selector metadata. Visibility actions recheck that generation after entering the operation lane and immediately before native dispatch; the patch does not grant authority to an excluded PID. (Core/PeekabooAutomationKit/Sources/PeekabooAutomationKit/Services/System/ApplicationService+ActionOutcomes.swift:461, 2b6bc233416c)
• Recorded native behavior proof: The supplied complete PR body, captured in sourceRevision c1256a482cf6edfaa756cd2edee56faf2665f070d19d95d01dce16ba8c732194, records a signed executable linked to production AutomationKit, real generation lookups for a reaped PID retained in synthetic discovery, complete inventory, and successful live-target name/bundle resolution retaining its native generation. A separate signed probe records full reads while alive and repeated zero-byte ESRCH reads after reap. The 27 passing focused tests are supplemental; this review did not execute them. (2b6bc233416c)
• Still needed on main and latest release: The fetched main still collapses ESRCH into unavailable. Comparing the two production files between v4.3.4 and fetched main produced no differences, so neither contains this absence exception. (Core/PeekabooAutomationKit/Sources/PeekabooAutomationKit/Services/System/SystemIdentityResolver.swift:128, 4338bc31e6cd)

Likely related people:

• unknown: The claimed source-line change could not be verified from bounded local history. (role: source history unknown; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (1 earlier review cycle)

• reviewed 2026-09-12T22:54:52.858Z sha 74094af :: needs maintainer review before merge. :: none