[lidge-jun]

Summary

Fixes the two new Windows failures in dev batch run 43045070937 (dev 39fd819221). Both are real defects that only the Windows runners exposed.

• windows 8/11, update-windows-installer-witness (from fix(update): name a witnessless update marker and its recovery on refusal #8541): staleUpdateMarkerHint(home, platform) formats recovery guidance for the platform it is given, but built the marker path with the host's path.join. On a Windows runner the POSIX hint therefore showed \home\o'neil\.... The path is now joined with the target platform's separator (win32.join for the Windows hint, posix.join otherwise). Real users always get their own platform, so their output is unchanged.
• windows 1/11, link-ssh-capture-tunnels (from feat(link): opt-in SSH log capture for Remote Link tunnels #8551): under a flood of DEBUG1 lines the capture writer's queue (512 records) filled before the asynchronous writer ran, and the final Permission denied line, the one that explains the failure, was dropped with the rest (queue_overflow dropped 993). The faster macOS/Linux writer hid it. When the queue is full, an error-level line now replaces the oldest queued debug or verbose record (still counted in queue_overflow), so a flood can never push out the line that explains a failure.

The third failure in that run (test 2/5, claude-cli-client-http.test.ts:444, JSON Parse error: Unexpected EOF within 16 ms on self-hosted lidge-ocx-02) is unrelated and not changed here: it passed in the previous dev batch (fb2e3db897, which already contained the claude-cli code), nothing merged since touches claude-cli, and it passes 6/6 locally on 39fd819221.

Verification

• Fail-first, on macOS with platform injection:
  • the hint test now asserts the Windows hint uses \ (ren "C:\Users\a\.opencodex\update-orchestrated.json" ...) and compares each platform's hint against that platform's join; it failed before the fix (the Windows hint carried /);
  • a new capture test pushes 1,500 debug lines and then Permission denied before the writer gets a turn; it failed before the fix (no auth.denied record) and passes now.
• bun test tests/update/update-windows-installer-witness.test.ts tests/update/update-sync-mutex.test.ts tests/update/update-orchestrated-session.test.ts: 82 pass, 0 fail.
• bun test tests/clients/link-ssh-capture.test.ts tests/clients/link-ssh-capture-tunnels.test.ts tests/clients/link-ssh-capture-redact.test.ts tests/cli/cli-link-capture.test.ts: 43 pass, 0 fail.
• bun run typecheck, bun run privacy:scan, bun run structure:check, test-layout, Lab boundary and file-size ratchet: pass.
• tests/helpers/update-import-policy.ts updated for the new node:path import (that parser-backed lint runs in the Windows lane).

NOT RUN: Windows runner (the coordinator reruns the dev batch after merge); the parser-backed update lint (Windows lane only); full bun run test.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

Summary by CodeRabbit

• Bug Fixes
  • SSH capture queues now preserve incoming error-level records when full by replacing an older debug or verbose record. Displaced or refused records are counted as queue overflows.
  • Update marker paths are now formatted consistently for the selected platform.
• Documentation
  • Clarified how SSH capture handles queue overflow.

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-11T16:02:02.435364Z	ff20b81	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

✅ Deterministic PR hygiene checks passed.

[coderabbitai]

Caution

Review failed

The pull request is closed.

Walkthrough

The SSH capture queue now preserves incoming error records at capacity when it can evict a non-error record. Update marker hints now construct paths for the requested platform, with tests for Windows and POSIX behavior.

Changes: SSH capture queue overflow

Layer / File(s)	Summary
Preserve error records at queue capacity src/link/ssh-capture.ts, structure/remote-link.md, tests/clients/link-ssh-capture.test.ts	When the queue is full, an incoming error record replaces the oldest queued non-error record. The displaced or refused record is counted as queue_overflow. The regression test floods the queue before the writer runs and checks that the authentication-denied event is stored.

Platform-specific update marker paths

Layer / File(s)	Summary
Select paths for the requested platform src/update/sync-update-mutex.mjs, tests/helpers/update-import-policy.ts, tests/update/update-windows-installer-witness.test.ts	staleUpdateMarkerHint now uses Windows or POSIX path operations based on the requested platform. Tests check the matching marker paths and rename commands.

Estimated code review effort: 2 (Simple) | ~15 minutes

Change: Bug fix

Possibly related issues

• lidge-jun/opencodex#7297 — The queue change preserves an error-level SSH record when debug or verbose records fill the capture queue. It does not add the durable structured events or opt-in debug interface described by the issue.

Possibly related PRs

• lidge-jun/opencodex#8551 — This PR introduced the SSH capture queue that this change updates and tests.

Suggested labels: bug

Suggested reviewers: luvs01

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[lidge-jun]

Maintainer judgment (dev-red fix for batch run 43045070937)

• Value: returns dev's Windows shards to green for two defects from fix(update): name a witnessless update marker and its recovery on refusal #8541 and feat(link): opt-in SSH log capture for Remote Link tunnels #8551 that only the Windows runners exposed.
• UX change: none for users on their own platform. The update-marker hint's path now always matches the platform it names. Under a flood of SSH debug output, the capture now keeps the error line that explains a failure; before, that line could be dropped.
• Regression evidence: the touched update suites (82) and the SSH capture suites (43) pass. Each new test failed on dev's source and passes on this head, confirmed independently by the reviewer. The queue stays bounded at 512 records, and every dropped or displaced record is still counted.
• Windows impact: the fixes target the two Windows failures; both were reproduced deterministically on macOS through platform injection. Windows runner and real device: NOT RUN here; the coordinator reruns the dev batch after merge.
• Third failure: claude-cli-client-http.test.ts:444 is unrelated flakiness. The same shard passed on four earlier dev batches with the same claude-cli code, it passes locally on 39fd819, and nothing merged since touches claude-cli.
• Verification scope: fresh independent review APPROVE and SECURITY APPROVE on ff20b81136.
• NOT RUN: the parser-backed update lint (Windows lane only; the pinned import row was checked byte for byte), full bun run test. PR CI had no failures at merge time.