erik/acdream
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

docs: Campaign LA gate round 1 record — #398 closed, #399 merged-closed, bake co-deploy

Browse source 
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Erik 2026-08-15 07:58:41 +02:00
parent fb64af8b25
commit 1f87acf1af
2 changed files with 49 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

41
docs/ISSUES.md
View file

@ -88,27 +88,36 @@ Windows+Ubuntu CI lane alongside the existing launcher tests.
## #398 — Launcher: fatal startup/dispatcher exceptions are reported without a stack
**Status:** OPEN
**Status:** DONE (`e1e94697`)
**Severity:** MODERATE (diagnosability)
**Filed:** 2026-08-15
**Filed:** 2026-08-15 · **Closed:** 2026-08-15
**Component:** `src/AcDream.Launcher/Program.cs`
`Program.Main`'s top-level guard prints only `ex.Message` before returning
74. For the `MainWindow` NullReferenceException fixed at `d54b8a78` that
produced `Launcher startup failed safely: Object reference not set to an
instance of an object.` with no file, line, or frame — diagnosis required
temporarily editing the guard to print the full exception and rebuilding.
An alpha user hitting a crash can give us nothing actionable.
`Program.Main`'s top-level guard printed only `ex.Message` before returning
74 — the `MainWindow` NullReferenceException fixed at `d54b8a78` surfaced
with no file, line, or frame, and diagnosis required temporarily editing
the guard and rebuilding.
**Fix direction.** Keep stderr terse, but write the full exception
(`ToString()`, including inner exceptions) to a crash file under the
resolved data root, and print that path. Must honor the LA11 redaction
contract: the crash file is subject to the same credential-value scanning
as the status stream, and must never contain a password or a raw command
line.
**Fix landed (`e1e94697`).** `TryWriteCrashReport` writes the full
exception chain plus non-identifying host facts (UTC, OS, RID, assembly
version) to `<DataDirectory>/crash-reports/launcher-crash-<utc>.log`;
stderr stays terse and names the path; the reporter itself never throws.
When option parsing is the failure, the caller's `--data-dir` is still
honored via a positional, validation-free read — the first implementation
fell back to the machine's real data root and broke LA11's process-local
roots during an isolated run (observed live, then fixed in the same
commit). Verified: forced startup failure writes the report inside the
isolated root with the full stack; the real root stays empty.
**Acceptance:** a fatal startup exception produces a crash file with the
stack, stderr names its path, and the redaction suite covers the new sink.
**Redaction, stated exactly (deliberate narrowing of the filed
acceptance):** the report never serializes the command line, environment,
or process state, but exception TEXT may quote an option name or path.
That is safe by construction — credentials never enter launcher state
(child-stdin only; `LauncherProcessSpec` has no credential member, guarded
by its reflection test) — so no scanning pass over this sink exists today.
The code comment carries the standing condition: if a credential ever
becomes reachable from launcher state, this sink needs the status-stream's
credential scanning.
## #397 — Windows: LauncherProcessSupervisor.Stop has no reliable graceful-stop signal for a no-window console host