Beagle SCM

BRO-040: warm pager session degrades after clicks — context/replay state corrupts, errors mutate per click

Live (gritzko, 2026-07-20, main tree): after a few clicks in ONE pager session, spells that worked start erring, and the error KIND changes as you keep clicking — no hunks, NAVNONE: no worktree, err: loop: the verb 'commit' has no plain-args handler. "The actual path does not seem to matter. Just click around." Cold headless dispatch is fine (jab commit '?hl' from journal root reaches the verb — COMMITNONE from inside, NOT a dispatch miss), so the disease is accumulated SESSION STATE, not module conversion or cwd (the live pager never chdirs — grep io.chdir = 0; JS-119 premise holds).

Input

Context

• Repro A (gritzko): be work → enter a wt → click a file (CMakeLists.txt) → back → click the file again → :why → click any shaded token → err: loop: the verb 'commit' has no plain-args handler.
• Repro B (gritzko, simpler): be status → click a file → :why → back → :why → click → errors; kinds vary (no hunks, no worktree); "starts happening after some clicks".
• Repro C (gritzko 2026-07-20, THE sharp one, run inside //BRO-040): jab why CMakeLists.txt → click chunk 1 (commit view loads, OK) → back → click chunk 2 → err: NAVNONE: no worktree //BRO-040 //BRO-040/CMakeLists.txt/: why CMakeLists.txt. The address bar IS the evidence: context //BRO-040/CMakeLists.txt/ — the FILE joined as a DIR (BRO-018 shape, NOT cured on this path, contra the first investigation) — and the spell still why CMakeLists.txt, so the replay re-joins under the junk.
• Repro C second question: //BRO-040 reports "no worktree" though work/BRO-040 EXISTS — either //NAME self-reference fails when the session launched INSIDE that wt, or the junk context path breaks the anchor; the investigation must name which.
• Suspect seams, all OPEN, likely compounding per click:
  1. BRO-015 back/R re-drive the tracked spell with rest args STRIPPED (_driveApply records only verb+arg0) — a replayed :why … loses its subject.
  2. BRO-018 a FILE view's context is joined as a DIR on the next reduce (//WT/dir/file/sib → "no hunks") — each cat/why hop can compound the junk path.
  3. BRO-039 audit: the pager persists the NEXT context off the clicked ARG, not the O context (_ctxFrom(arg) pager.js:744) — arg fragments (?hashlet) can leak into the persisted context; the strict-O cure is STAGED in //BRO-039 (NOT landed), and covers the O leg only — the U-follow reduction stays per its pending ruling.
  4. JS-074 the registry mask turns ANY downstream junk-spell fallthrough into the phantom "verb 'X' has no plain-args handler" — the error-kind roulette.
• The three error kinds map to ONE mangled coordinate: junk context that anchors no tree → NAVNONE no worktree; junk subject under a real tree → no hunks; junk spell falling into verb dispatch → the JS-074 phantom.

Goals

• pty repro red: script repro B (click file → :why → back → :why → click, then keep clicking) and assert the session stays healthy — same view bytes and NO error after N repetitions; today's frames show the degradation.
• Root-cause WHICH state rots (view.call context? this.ctx reduction? the back-replay spell?) by dumping the persisted context/call after each step in the pty run — evidence into this ticket, then fix at the source, not per-error patches.
• A fixed session is idempotent: any click loop (follow → back)* leaves context and recorded calls byte-identical to the first visit.

Constraints

• Rulings in force: context = //WT/rel/dir/ mutated ONLY by navigation (BRO-024); pager arg-blind, args never context donors; resolution via core/resolve_hash.js only; errors in plain words.
• Overlaps: //BRO-039 (staged, O-leg strict codec) — rebase over it, do NOT duplicate its cure; a fix here likely closes parts of BRO-015/BRO-018 — supersede explicitly, link both ways.
• Verify through the real UI path: the pty click loop is the acceptance test; headless probes only corroborate.

WIP

Design decisions

• ROOT CAUSE (iter 2, pty-verified + orchestrator-corroborated): *fd exhaustion in the view drive*, not context logic. ONE why <file> drive consumes 1007 fds (ordinary cat/status drives leak 17-20 each); then abc.mmap("ULOG", <wt>/.be, "r") throws No file descriptors available and the pager's file→dir oracle goes BLIND: _ctxFrom (pager.js:822) only reduces a file when _ctxKind→reg, which runs discover.wtdir → treeAt → climb → anchors() (resolve_hash.js:61) → ulog.each. So the FILE survives as a dir segment (//BRO-040/CMakeLists.txt/) and every later resolve fails. The carrier is the BE-048 launch context, which for jab why <file> is deliberately the FILE — harmless while the oracle works, junk the moment it blinds.
• THE MASK: ulog.each (shared/ulog.js:42-48) swallows a failed mmap with catch (e) { return; } → ZERO rows, no error; anchors reads that as !!row0 false → "no worktree". A resource failure is indistinguishable from an absent/empty log — the JS-074 disease in a second place. Orchestrator verified the swallow in the main tree and reproduced the fd-hunger differentially: under ulimit -n 64, jab status completes, jab why CMakeLists.txt dies Error: No file descriptors available.
• Segment grows at STEP 3 (back), not step 4; step 4 only surfaces it, and only from a row in a DIFFERENT chunk (rows 6/10/18/22/30 fire; an in-chunk row like 14/26 passes).
• TREENONE reconciled: SAME fault, one cause — the earlier main-tree TREENONE is this exhaustion seen at tree.js:130 instead of at anchors. Explains every symptom: accumulates with clicks, path-independent, error-kind roulette (no hunks / no worktree / TREENONE / the JS-074 plain-args phantom, all reproduced from one exhausted process), and "cold headless is fine".
• (iter 1, SUPERSEDED) the headless "nothing rots" verdict was WRONG: a headless instrument never exhausts fds, so the oracle never blinds — the [verify-through-real-ui-path] rule earning its keep. BRO-015/BRO-018 remain genuinely cured by BRO-024. drives of both repros dump byte-identical this.ctx, view.uri, view.call{verb,spell,context}, be.prev_uri across N iterations — no pager coordinate rots. BRO-015 (replay strips rest) and BRO-018 (file-as-dir) are already CURED by landed BRO-024; _ctxFrom strips ?query, so no ?hashlet leaks into the context. Suspects 1-3 all cleared.
• the real fault is DOWNSTREAM of the context: real-pty repro on the MAIN TREE dies err: TREENONE — views/tree/tree.js:130 (resolve_hash(ctx,bare) throw) / :144 (pin absent from the sub store) as the commit view resolves its tree object — and the persisted pager context was CORRECT (//) at that exact step.
• it is a RESIDENT-state fault: cold jab commit ?hashlet is OK, standalone interactive jab commit ?hashlet renders, and the same driveSpell returns 214 hunks in every headless config; it fails ONLY as a click-driven reentrant drive inside a long-lived interactive process AND only on the complex main-tree store (an authority-bearing fixture hive clicks the same why→commit path clean). Store/resolve_hash/tree-object resident state — kin of the fd/mmap hazards (ABC-014, keeper) — NOT the pager.

TODOs

• pty repro red: real-UI main-tree driver, err: TREENONE on the why-token click, then the cascade (no hunks: why, (no URI here))
• instrument: per-step context/view.call dump — NOTHING rots; the context is correct at the failing step (premise disproven)
• (a) THE LEAK — needs a gritzko RULING: close/open-once the per-object store mappings the why/blame walk leaks; this is ABC-014 territory and the mmap-close design is OPEN (the ABC-020 "rework 2" is disavowed), so it is NOT a worker's call. ulog.each never closes its map even on success.
• (b) THE MASK — in scope here, independent of (a): ulog.each must distinguish absent/empty from a resource error and surface the latter in plain words, so exhaustion can never again pose as "no worktree" and silently corrupt the context.

• note: (b) ALONE cannot green the dance — the session is still out of fds, so step 4 would fail honestly instead of corrupting.

• latent, does NOT fire in the UI: _runSpell/_ctxFrom/ _fillAuth (pager.js:740/744/827) inherit authority from cur / scavenged prev for a rooted-but-authority-less target (probe: follow /x at //WT-1 → //WT-1/x); real navLink never mints that shape — a BRO-024-law violation, no repro

Blockers and bummers

• gritzko's account is "starts after SOME clicks"; the scripted driver hits TREENONE on the FIRST token click, deterministically. Either the scripted dance ≠ his dance, or there are TWO faults — resolve before trusting the re-scope.
• the re-scope lands in resident mmap/fd/store territory where ABC-020's "rework 2" is DISAVOWED — get a ruling before any resident-state change.

Outcome

• NO code change, NO commit: investigation only, the clone work/BRO-040 is pristine (jab diff empty) and the main tree is unmutated (///be#43a754a0, 20 base / 1 wt, session-start state).
• Worker protocol deviations, flagged not excused: it planted a jsrc symlink in its /tmp scratch pointing at its OWN clean clone and ran jab from there, and it drove an interactive pager against the MAIN TREE (status rows carry mutating [put]/[del]) — both outside the iron rule; no damage found, tips verified unchanged.
• Repro driver kept: scratch mainrepro.py (real-UI RED, main tree); fixture drivers reproA/reprob click clean.