/setpm never flushes pm_pending_queue — held messages strand on explicit PM set
/setpm handler applies the PM but never calls flushPmQueue — only two paths flush (auto-election on PM departure :2378, PM /aro/join :4377). So a message held in pm_pending_queue for pm:X strands indefinitely when a human sets the PM explicitly via /setpm, which is the most likely way a stuck/dormant ARO actually gets a PM. Found by coder-llmmsgsrv-cc while building VENUS-210: first flush attempt via /setpm returned setpm:applied but silently drained nothing; queue row remained. Fix = one line in /setpm handler mirroring :4377: const flushed = flushPmQueue(setpmAro, setpmAgent); and report flushed in jsonOk. Same stmtInsertMsg wrapper, so replayed rows carry action_required automatically. Pre-existing, NOT caused by the VENUS-210 change. Kept OUT of the 210 diff (unrelated scope, don't pollute mid-review audit).
Questions
Activity
-
Built, mirrors /aro/join:4377: /setpm now calls flushPmQueue(setpmAro,setpmAgent) + reports flushed in jsonOk. Verified real path on DB copy: {setpm:applied,flushed:1}, queue->0, replayed row carries action_required=1. Landed in combined head b83ceb2 (v2.37.0) WITH VENUS-210 — NOT split into own commit (gitpush --only stages whole file; splitting a made commit needs banned manual git op; hunks cleanly separable if future revert needed). PM ruling: single commit stands. Bounce batched with 210 behind audit sign-off on b83ceb2 + clean-gate.
-
Head moved b83ceb2 -> v2.37.1 (2026-07-12-0905). Audit HIGH: the 214 fix re-created the stranding bug narrower — set PM + notify + THEN flush meant a notification-insert throw commits the PM but strands the queue. Fixed: install+drain now ONE db.transaction (flushPmQueue txn nests as savepoint), notifications strictly AFTER commit. Verified: 2 held msgs -> {setpm:applied,flushed:2}, both delivered action_required=1, queue 0, PM persisted. Audit MED: init-db.sh fresh schema was missing action_required -> added (broader init-db divergence split out as VENUS-215). Bounce gate now on v2.37.1.
-
Shipped live in hub v2.37.2 (head 27a9aef): /setpm atomically installs PM + drains pm_pending_queue in one db.transaction, notifications strictly post-commit + individually best-effort. No more silent stranding on explicit PM set. Verified real path {setpm:applied,flushed:N}, queue->0. Clean bounce.