Two 0.87.15 ship-blockers:
1. mem_check_and_stop test now ALSO greps for the "deferring to next
tick" warning — distinguishes fix from bug. Mutation-confirmed.
2. Extract `refresh_running_after_mem_check` (sets global instead of
echoing so loop-scope flags persist across calls) and drive it
directly from the harness, closing the structurally-untestable
post-mem refresh ERR guard.
Adjacent: log-on-flip gating on both ERR warnings; `log` to stderr;
dangling-TempDir in app::tests reclaim test fixed.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
0.87.7 + 0.87.8 follow-ups:
1. mem_check_and_stop now defers on docker ERR instead of silently
no-op'ing the SIGTERM under pressure.
2. Post-mem_check_and_stop loop refresh now also handles the ERR
sentinel (continues the loop) rather than letting it reset up_for
and defeat MAX_UPTIME.
3. New `vision-manager/test_manager.sh` — 7 smoke tests covering
vision_running's three exit shapes and mem_check_and_stop's ERR
symmetry, via stubbed docker/psql/curl on PATH. Production loop
guarded by MANAGER_TEST_NO_MAIN.
4. New `app::tests::spawn_analysis_daemon_reclaims_orphaned_analyze_leases`
pins the 0.87.7 wire-through: seeds an expired analyze_page lease,
spawns + shuts down, asserts pending + attempts refunded.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Three medium vision-manager findings:
1. **`vision_running()` conflated "container absent" with "inspect
failed".** A transient docker-socket-proxy hiccup made the manager
think vision had stopped, which reset `up_for`/`idle_for` and
defeated MAX_UPTIME. Distinguishes: exit 0 → echo true/false;
"No such container" → false; else → ERR (loop skips tick).
2. **`crawl_running()` fail-closed where `analysis_enabled()` fail-opens.**
A psql `ERR` logged a misleading "RAM mutex" line every tick.
Numeric-guard at the call site with a distinct log.
3. **`start_vision` left wedged containers running** on
`START_HEALTH_TIMEOUT` expiry — pinned forever in not-ready state.
Now `stop_vision` so next tick retries from a clean state.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Backend:
- Log on readiness state transitions (ready<->not-ready) so a misconfigured
ANALYSIS_VISION_HEALTH_URL, which otherwise parks the worker silently
forever, is diagnosable.
- Add unit tests for HttpVisionReadiness: 2xx->ready, non-2xx->not-ready,
connection error->not-ready (the production status mapping had no test).
vision-manager:
- Guard the backlog count against non-numeric output before `-gt`, so a stray
value can't exit-2 and kill the loop under `set -e`.
- Throttle the crawl-mutex "deferring start" log to once per episode.
- Only reset the idle/uptime timers when `docker stop` actually succeeds, so a
failed stop retries next tick instead of waiting a full debounce window.
- Decouple the per-probe curl timeout (HEALTH_TIMEOUT) from the warm-up poll
cadence.
Docs:
- Correct the docker-socket-proxy comment: CONTAINERS+POST permits the full
container lifecycle (not just start/stop); state the real trust boundary.
- Document that the externally-defined mangalord-vision container must share
the compose network for name resolution.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Add a tiny privileged sidecar (vision-manager/) that polls the analysis
backlog in Postgres and starts/stops the mangalord-vision container by name:
start when analyze_page jobs are pending, stop after STOP_DEBOUNCE idle.
It is the single owner of the vision lifecycle and the only component with
Docker access — scoped through tecnativa/docker-socket-proxy (CONTAINERS+POST
only) on an internal-only network, so the internet-facing backend never
touches the socket.
Both helpers sit behind `profiles: [ai]` (vanilla `compose up` is
unaffected). The manager debounces the stop, gates the first request on
GET /health==200 after a cold start, honours a crawl RAM-mutex on the 8 GiB
box, and owns its own idle timer (leak-safe if the backend dies). Backlog
query uses the real schema (state + payload->>'kind'); a read-only DB role
(readonly-role.sql) keeps it off the backend creds.
Bump 0.80.0 -> 0.81.0.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
