fix: expose failed user-session admission in snapshots - #226
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
An unavailable interactive profile can fail token/known-folder lookup before the broker accepts a SID. The SYSTEM broker previously logged that failure but exposed no reason in its snapshot. A genuine standard-user hive access-denial fixture reproduced the missing diagnostic across 135 snapshots; restoring the exact hive permissions recovered the same Windows logon without disturbing a peer user.
Add session-scoped token/profile, identity and delegated-probe failure records independently of admitted manager ownership. Retention follows the existing 4096-session bound. Snapshots return 128 sorted details of at most 256 UTF-8 bytes and an explicit omitted count. Successful retry, logoff, authoritative removal, changed policy and shutdown clear obsolete errors; request and policy revision guards reject late completions.
Validation: targeted wire/lifecycle/capacity tests, the full local race suite and relevant vet checks passed. Exact-source CI 34834516120, attempt 1 passed for
187fc6f1e761df1be5c871bcea90efce03140051.The immutable CI artifact passed native SYSTEM service/snapshot/stop and standard-user headless S4U workload/profile-cleanup checks. Two genuine concurrent standard-user Windows logons passed hive access-denial visibility/recovery, supported local known-folder redirection, and delegated UNC/reparse-path rejection with session errors. Each fault retained the peer manager/invocation and recovered the original native logon; restored snapshots cleared the error. Both-user admission/SCM recovery, final logoff/no-resurrection and verified account/profile/credential/network/registry/ACL/payload/service restoration also passed. Exact artifacts, failed driver attempts and raw evidence remain private.
The broader R4 gate remains open. These observations do not qualify policy/shutdown races inside native manager creation or the remaining security and linger matrix. The tested source tree is
3dd7f19f1c2d5bdb5ea7497944aa3e7b08224d9f; verify equal merged tree before acceptance.