[skulitom]

Report

ANODE-BUGS.md B-040 (filed 2026-10-14 by compass-anode-fixer from #44's second review): after a Reconnect refused by a missing prerequisite, a display reconnect answers "The seat was stopped".

Root cause

ReconnectAsync (src/Anode/Daemon/AnodeDaemon.cs) cancelled _bringUpCancellation first, so that an old host startup lets go of the seat gate, and only then, under the gate, checked the machine's prerequisites (_blockingSummary()). When one was missing (Remote Desktop turned off, the listener gone, child sessions disabled) it returned with SetState("error", ...), before PrepareStart made a fresh token. A seat that was running kept its host (_hostReady stayed true), so agents carried on, but two things were now wrong:

• Every later seat_display reconnect failed. DisplayAsync hands the cancelled token to the viewer's reconnect, which disconnects the viewer and then gives up at its first wait: "The seat was stopped while its display was changing", though nothing had stopped, and the viewer was left disconnected.
• The next viewer disconnect dropped the seat. OnViewerDisconnected treats a disconnect in state error as the end of a failed startup: it cancels the bring-up, sets _hostReady = false and disposes the seat-host connection. Agents then got "The seat is not ready (error)" while the seat and its programs were still running.

The viewer's Reconnect and Sign in… buttons are enabled in every state except during a reconnect or a display change, and their tooltip says "The seat and its programs keep running", so this path is reachable whenever a prerequisite goes missing under a running seat (a policy or update turning Remote Desktop off, for example).

Fix

ReconnectAsync now reads the prerequisites once, before it changes anything (and only for a press that can act: one during a reconnect, a display change, a stop or a quit still returns at once, without the probe, which can take about 1.5 s and used to run on the UI thread under the lifecycle lock). If one is missing, or the probe itself fails, and the seat's host is serving (_hostReady), it changes nothing: no cancelled bring-up, no error state, the seat's ready or detached state and advice stay. It logs the refusal and tells the user in the viewer's status line what is missing and that the seat keeps running. With no running host (a failed or stopped seat), a refused Reconnect still cancels the bring-up and reports error with the missing prerequisite, as before, using the same reading.

Tests

• New quick check refused reconnect keeps the seat (Cli/DiagnosticsChecks.cs, RefusedReconnect): a ready seat with a switchable prerequisite and an injected viewer change that, like the real one, gives up when its token is cancelled. A refused Reconnect and a refused Sign in each leave the seat ready with its host; a live and a reconnect display change both succeed after each (the reconnect also proves the refused Sign in left automatic sign-in alone); a later viewer disconnect makes the seat detached with its host, not a failed start; a refused Reconnect on the detached seat keeps its state and advice, and the automatic seat's display reconnect still brings it back; once the prerequisite returns, Reconnect reconnects as before.
• The [compass] Fix: a display change that ends during a stop reports the stopped seat detached #44 case "a refused Reconnect is no stop" in stop during display change moved into the new check, which covers it more strictly (a live change only, before; now live and reconnect).
• viewer sign-in's existing case still covers a refused Sign in on a seat that isn't running (lastError names the missing prerequisite).
• Mutations (each built in Debug and run through selftest --quick): 6 of 6 caught: dropping the running-seat refusal (the old code), a refusal that keeps the state but still cancels the bring-up (fails with B-040's exact "stopped" reply on the reconnect change), one that sets error or detached, one applied to seats that aren't running, and one that stops reporting the prerequisite for a stopped seat. Every restore byte-identical
• Second review (a fresh Claude subagent, read-only; Codex is out of quota until 20 Oct): no P1 or P2. Its five P3s were applied in 131aca4: the probe after the busy check, the refusal text with the missing setting first, two redundant counts dropped from the check, the CHANGELOG naming the listener and saying "a" display reconnect (a password seat's is refused earlier), and this description's button sentence. The mutations above were re-run on 131aca4: 6 of 6 caught; the same reviewer found no credible problem in 131aca4.
• The Codex connector's review of f348f49 found one P2, applied in cefd3cd: the probe had moved out of the method's try/catch, and the toolbar discards the task, so a probe that threw would fail silently. A probe failure is now logged and treated as a missing prerequisite (a running seat keeps its state; a seat that isn't running reports error with the reason), and the quick check covers both. Final mutation run on cefd3cd: 7 of 7 caught (the six above plus a probe failure that lets Reconnect go ahead); evidence in the fixer's scratch folder.
• FOCUS test command (scripts\build.ps1 -QuickTest -OutputDirectory artifacts\pkg-build): passed: Release publish, 109/109 quick checks, docs consistent
• Debug selftest --quick: 109/109

Manual check in a real seat

Optional and low value: with a seat running, turn Remote Desktop off (Settings → System → Remote Desktop), press Reconnect in the viewer, and check the status line names the missing setting, anode status still says ready with agentReady: true, and agents keep working; turn Remote Desktop back on. The quick check covers the logic; this only confirms the viewer's text.

CHANGELOG: one bullet under 0.11.3, which isn't released yet.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-15T22:28:38.974395Z	f348f49	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f348f4918d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Handle failures from the prerequisite probe

When a prerequisite read throws—for example, because access to an HKLM key queried by Preconditions.BlockingSummary is denied—this call now occurs before the method's try/catch. The toolbar handlers discard the returned task with _ = ReconnectAsync(), so the fault is unobserved and the button appears to do nothing, without the logging and error status provided by the previous placement. Keep the probe before lifecycle mutation, but include it in the exception-handling path.

Useful? React with 👍 / 👎.