From ca63095786e11e240810802343053cd517f0d269 Mon Sep 17 00:00:00 2001
From: funman300 <funman300@gmail.com>
Date: Tue, 11 Aug 2026 05:25:33 +0000
Subject: [PATCH] lifecycle: stop the orphan check going blind when the binary
 is rebuilt

`list_procs` matched on `readlink -f /proc/PID/exe`. Once the binary is
rebuilt -- which happens constantly here, `cargo test` alone is enough -- the
link reads "<path> (deleted)" and -f resolves it to something that matches
nothing. The scan then finds zero processes, so `start`'s orphan check passes
and a second instance can be launched alongside a stray.

Not theoretical. Two orphans were running undetected tonight:

  pid 592731  :42327  a stale-cert redirector left from testing check-tls-parity,
                      still serving F9:16:1A -- the exact certificate whose
                      mismatch cost three live gates
  pid 542693  :42230  a Blaze sidecar debug build from 03:12

Neither was in a client path, so neither was doing harm, but a stray listener
serving the known-bad certificate is precisely what should never sit around
unnoticed.

Fixed by using plain readlink and stripping the " (deleted)" suffix. Shown both
ways: with the bug `status` reports no processes at all for a live pid; with the
fix it reports 604454. The pidfile path was unaffected, which is why `stop` kept
working and hid this.
---
 openfut-blaze-host/sidecar.sh         | 9 ++++++++-
 openfut-redirector-host/redirector.sh | 9 ++++++++-
 2 files changed, 16 insertions(+), 2 deletions(-)

diff --git a/openfut-blaze-host/sidecar.sh b/openfut-blaze-host/sidecar.sh
index 1c47e96..bdfbf03 100755
--- a/openfut-blaze-host/sidecar.sh
+++ b/openfut-blaze-host/sidecar.sh
@@ -79,7 +79,14 @@ list_sidecars() {
   for d in /proc/[0-9]*; do
     pid="${d#/proc/}"
     [[ "$pid" == "$self" ]] && continue
-    exe="$(readlink -f "$d/exe" 2>/dev/null)" || continue
+    # readlink, NOT readlink -f: once the binary is rebuilt the link reads
+    # "<path> (deleted)", and -f resolves that to something that matches
+    # nothing. The orphan check would then be blind to exactly the long-lived
+    # processes it exists to find — verified: two orphans (a stale-cert
+    # redirector and a Blaze sidecar) were both invisible to this until the
+    # suffix was stripped.
+    exe="$(readlink "$d/exe" 2>/dev/null)" || continue
+    exe="${exe% (deleted)}"
     [[ "${exe##*/}" == "openfut-blaze-host" ]] && echo "$pid"
   done
   return 0
diff --git a/openfut-redirector-host/redirector.sh b/openfut-redirector-host/redirector.sh
index ee13ddd..3741b80 100755
--- a/openfut-redirector-host/redirector.sh
+++ b/openfut-redirector-host/redirector.sh
@@ -35,7 +35,14 @@ list_procs() {
   local self=$$ pid exe
   for d in /proc/[0-9]*; do
     pid="${d#/proc/}"; [[ "$pid" == "$self" ]] && continue
-    exe="$(readlink -f "$d/exe" 2>/dev/null)" || continue
+    # readlink, NOT readlink -f: once the binary is rebuilt the link reads
+    # "<path> (deleted)", and -f resolves that to something that matches
+    # nothing. The orphan check would then be blind to exactly the long-lived
+    # processes it exists to find — verified: two orphans (a stale-cert
+    # redirector and a Blaze sidecar) were both invisible to this until the
+    # suffix was stripped.
+    exe="$(readlink "$d/exe" 2>/dev/null)" || continue
+    exe="${exe% (deleted)}"
     [[ "${exe##*/}" == "openfut-redirector-host" ]] && echo "$pid"
   done
   return 0