test-stack-up: runtime command-line ownership proof, own runtime is not a port thief, tracked stale-process sweep (#160, #278)

[MendixMau]

#160: an app with no run --local handshake was always unverified

Problem. test-stack-up.sh had two ways to prove ownership: the .docker container label and, since #313, the run-local.json handshake. An app started by Studio Pro's Run Locally, or by a run --local that wrote no handshake, was found by scan and published as APP_OWNERSHIP=unverified. The harness then refused it unless APP_PORT was set by hand on every run, which is what happened in the field (requirements-driven build, 2026-09-25).

Fix. The scan now checks each Mendix-answering port's listener (lsof / ss / netstat). If the listener's command line runs runtimelauncher.jar on THIS project's deployment dir, the port is verified with APP_SOURCE=runtime. The deployment dirs checked are <root>/deployment, <root>/app/deployment, and the dir beside the real .mpr. A verified port is chosen ahead of an earlier unverified one. Freshness is reported as unknown because this script did not build that app. The command line is read from /proc/<pid>/cmdline on Linux (exact argv, resolved through symlinks and the process cwd), from ps -o args= on macOS, and from PowerShell CIM on Git Bash. When it can't be read, the port stays unverified, as before.

Helper dedup. port_holder / holder_text and the parent-pid tree walk move into project-bin/_common.sh as mxtk_port_holder, mxtk_holder_text and mxtk_pid_in_tree. mxtk_pid_args and mxtk_pid_runs_deployment are new there. The change is additive: nothing existing in _common.sh changed. Both scripts now source the moved helpers. If a project's bin/_common.sh is older than these scripts, the script exits 2 and names sync-project.sh, rather than dying mid-run on "command not found".

Refs #262 (follow-up to #313): the project's own runtime is not a port thief

Problem. An independent review of #313 found that check_run_local_ports never excluded this project's own process. A booting runtime binds its ports before it serves a page. In that window --check exited 4 ("INSTRUMENT BLOCKED") about its own java, where it used to say NOT READY (exit 1). --no-docker did the same while Studio Pro booted this project.

Fix. The holder of the port counts as ours if any of these is true:

• it is the live pid in the handshake record, or a descendant of it;
• its command line runs this project's deployment dir (which covers Studio Pro running this project).

In that case the script reports NOT READY and exits 1, naming the holder. A runtime whose command line names another deployment dir is always foreign. Any other holder still blocks with exit 4, which T7 and the new T11b cover. With a live record and a holder that can't be placed (unnamed, or Windows where Git Bash shows no parent pids), the holder is presumed ours.

#278 remainder: hung test shells, and what makes a run INVALID

Problem. Hung journey-runner and monitor shells from earlier retries ran for hours. They filled a trial licence's session cap, and a later run came out INVALID.

Fix.

• test-stack-up.sh --track <pid> [label] records a process this project started in .claude/loop/bg-pids.tsv. Each line holds the pid, the epoch, the ps lstart start time and the label.
• Every run lists tracked processes older than MXTK_STALE_HOURS (default 4) and prints --reap. --check is read-only and does not prune the record.
• --reap stops the stale ones and their children, found by parent pid. It acts only on pids in the record and never matches by name or pattern. A pid whose start time no longer matches its record line has been reused by another process; it is dropped and never signalled.
• Git Bash: --track and --reap say they are unsupported and do nothing.
• skills/test-result-audit.md (an on-demand file, not baseline) gets one line naming the two causes of INVALID that sit outside the app: account lockout and the licence session cap.

Not wired yet: the producer. Nothing calls --track automatically. The obvious producer is project-tests/e2e/journey-runner.js, which another in-flight PR owns tonight. The proposed patch is in the hand-back: at start, the runner calls bin/test-stack-up.sh --track <process.pid> journey-runner, best-effort. Until that lands, an agent tracks its backgrounded runner with --track $!.

Checks

• tests/wave2/test-stack-up-local.sh: 49/49 (5 consecutive clean runs). Against master's script, 16 of the new assertions fail (T8–T14).
  • The fixture drops pipefail, because printf "$OUT" | grep -q hit SIGPIPE intermittently on T2. The child-liveness check is zombie-aware.
• tests/wave2/test-app-restart.sh: 48/48. This includes the new old-_common.sh guard case, which fails on master.
• tests/wave2/test-common-windows.sh project-bin/_common.sh: 10/10.
• Also clean: bin/check-scripts.sh, bin/check-portability.sh, bin/check-no-private-citations.sh, LEAKGUARD_ALLOW_NO_DENYLIST=1 bin/check-no-client-data.sh, bin/check-pr-discipline.sh origin/master. The added-lines denylist grep found nothing.
• Routing was not touched.

Evidence and field-run status

• The runtime command-line shape (… -jar …/runtimelauncher.jar <project>/app/deployment) comes from the test-stack-up.sh: an app started by mxcli run --local always reads APP_OWNERSHIP=unverified, so journey-runner refuses the documented local loop #160 field report. No verbatim capture is committed. None could be taken from this session. The fixtures use a real lsof against real listeners whose argv carries that shape.

• A field run is still owed:

  • a live mxcli run --local with no handshake, and Studio Pro's Run Locally, on macOS and Linux;
  • the Git Bash PowerShell branch;
  • a booting runtime under --check.

  CI is Linux only.

Risks

• Only the evidence changes for existing projects. A port gets verified only with the new command-line proof, and a holder is "ours" only when proven or presumed as above.
• bg_report prints nothing unless a project has used --track.
• APP_SOURCE=runtime is a new value. Consumers (config.js, page-audit.js) read only APP_OWNERSHIP.

Refs #160 (code complete, field run owed)
Refs #278 (producer wiring in journey-runner.js owed)
Refs #262 (follow-up to #313)

🤖 Generated with Claude Code

https://claude.ai/code/session_01VJgWP5vEoAsNsJYqCDMGNw

---

Generated by Claude Code

[MendixMau]

Landed on master as part of the integration squash #329 (commit 31e90ae), after independent review — its Review: line is in that commit message. Closing as superseded.

---

Generated by Claude Code