Daily Ops 2026-08-24

[satwareAG-ironMike]

Daily operations thread for 2026-08-24 (ISO week 2026-W35). SOD/EOD comments follow the state contract (workflows/sod.protocol.md).

[satwareAG-ironMike]

Top-3 Priorities

1. [MUST] Complete PR fix(#582): revitalize stale plink entry in place instead of freeing fb_link #590 review findings 3+4 on fix/582-plink-stale-uaf: TDD test for pconnect-after-failed-drop_db dangling fbc_connection (RED may need php83-asan container), delete StatementWrapper move ops (no call sites), full suite both envs (/tmp CI-parity + /firebird), atomic commits, push, review-disposition comment on PR - done when commits pushed, CI green on required workflows, disposition table posted
2. [MUST] File ZTS statement-sweep registry gap issue (ponytail-review finding 1 from yesterday) - done when issue exists with scope + repro sketch
3. [SHOULD] research: does fbird_rollback_ret() retain SW relation locks like commit_ret did (#586 second half)? #589 fbird_rollback_ret() relation-lock probe (mirror flaky(test): testSetIsolationLevelSerializable 'lock conflict on no wait transaction' (RDB$RELATION_FIELDS) - research-first #578 methodology) - done when probe documented on the issue

Coverage

• Not covered today: human merge of PR fix(#582): revitalize stale plink entry in place instead of freeing fb_link #590 (human approval gate - tagged)
• Not covered today: packaging milestones v13.x/v13.4 (deferred - UAF hardening takes precedence; armv7l/APT-repo chain untouched)
• Not covered today: Debian upstream phase-4 issues packaging(debian-upstream): file ITP bug (Intent To Package) with Debian wnpp #506-508 (blocked behind packaging chain)

State restored

• EOD handoff: Daily Ops 2026-08-23 #587 (<!-- eod:2026-08-23 -->), HEAD c6d47e2 matches, tree CLEAN
• Finding 3/4 partial edits did NOT survive cutoff (move ops still present in src/cpp/fb_statement.hpp) - re-doing deliberately per handoff instruction

Environment

• Preflight green; connectivity OK; branch synced with origin
• Concurrent agents detected: doctrine-firebird-driver session live (IPADP downstream) - attribute before repair there; no foreign agent in this repo

Skills loaded

• git, github (stack: forge detection origin=github.com)
• php, php-ext (stack: composer.json + config.m4/C sources)

Skill gaps

• none (ASAN container usage covered by AGENTS.md + existing scripts)

[satwareAG-ironMike]

P1 complete - PR #590 review findings resolved + pushed

Commit	Content
3c051d5	fix(api): runtime matches declared arginfo (debug/ASAN unblock; CREATE returns Connection; drop_db arity)
aadd444	fix(#582): finding 3 - null fbc_connection before drop, ASAN RED->GREEN proven
e7ab1fd	refactor: finding 4 - dead move ops deleted
207f8f1	chore(test): pcntl double-load guard

Verification: php83-dev full suite 310/0 failed (100% executed); asan negative control reproduced the UAF pre-fix (SEGV in IAttachment::startTransaction); HEAD baseline showed only the 2 new tests failing = tests catch the bugs.

P2 complete - issues filed

• ZTS: statement sweep registry is thread_local - cross-thread connection death does not invalidate wrappers (PR #590 review finding 1) #593 ZTS sweep gap (review finding 1)
• ASAN: query-resource dtor reads freed transaction at shutdown (issue582/issue591 tests crash under php83-asan) #594 ASAN shutdown-ordering UAF (trans vs query resource)
• arginfo drift: fbird_connect/pconnect declare 8 params, zpp accepts 9 - FORCE_NEW as 8th arg sets lock timeout instead #595 fbird_connect arginfo missing sync param (+ systemic audit ask)
• ASAN: fbird_drop_db_003 skipif SIGSEGV under php83-asan (green in release) #596 fbird_drop_db_003 skipif SIGSEGV under asan

Disposition table posted on PR #590.

Not covered / deferred

• php85-fb5 local full suite aborted (CI matrix covers 8.5; php83-dev green locally)
• research: does fbird_rollback_ret() retain SW relation locks like commit_ret did (#586 second half)? #589 rollback_ret probe (P3) - not started

In flight

• CI on 207f8f1: ci.yml queued, sanitizers/coverage/doctrine in progress

[satwareAG-ironMike]

EOD Handoff: 2026-08-24

Objective

Complete PR #590 review findings 3+4 (failed-drop dangling fbc_connection; dead move ops), file the ZTS gap issue, keep CI green.

Status

• Completed: findings 3+4 fixed with TDD (RED proven under ASAN), ZTS gap + 3 newly discovered debug-build latents filed (ZTS: statement sweep registry is thread_local - cross-thread connection death does not invalidate wrappers (PR #590 review finding 1) #593-596), disposition table on PR fix(#582): revitalize stale plink entry in place instead of freeing fb_link #590, CHANGELOG/UPGRADING updated, all pushed, CI green on required workflows
• In progress: PR fix(#582): revitalize stale plink entry in place instead of freeing fb_link #590 awaiting HUMAN review + merge (gate: >=1 human approval; no self-merge)
• Blocked: nothing blocked; research: does fbird_rollback_ret() retain SW relation locks like commit_ret did (#586 second half)? #589 probe deferred (P3, not started)

Changes (all on fix/582-plink-stale-uaf, pushed through 2930e18)

• fbird_connection.c (aadd444): null fbc_connection BEFORE fbc_drop_database() - failure no longer leaves dangling pointer (persistent links survive requests with it)
• src/cpp/fb_statement.hpp (e7ab1fd): deleted dead StatementWrapper move ops; type strictly non-movable; dtor comment updated
• fbird_query_exec.c + firebird.c (3c051d5): FBIRD_CREATE branch returns Firebird\Connection (was raw resource violating C arginfo return types say MAY_BE_RESOURCE but runtime returns Firebird\* objects #306 arginfo mask); fbird_drop_db arginfo declares the (dsn,user,pass) overload; refcounting = list-ref + object-ref, NO caller DELREF (unlike connect - ground truth from php-src zend_list.c)
• scripts/test.sh (207f8f1): pcntl double-load guard
• Tests: NEW create_db_returns_connection_object.phpt, NEW issue591_review3_drop_fail_dangling_conn.phpt; EXPECTF updates fbird_drop_db_001/003/004
• CHANGELOG.md/UPGRADING.md (2930e18): Fixed x2 + Changed x1 entries, upgrade note

Verification (evidence-tagged)

• php83-dev FULL suite: 310 passed / 0 failed / 113 skipped - verified
• php83-asan: both new tests PASS; finding-3 negative control: reverted fix -> SEGV in IAttachment::startTransaction (captured stack), restored -> clean NULL-guard failure - verified
• HEAD baseline (stash negative control): only the 2 new tests fail at HEAD = tests catch the bugs - verified
• CI on 207f8f1: ci.yml, sanitizers, coverage, code-quality, CodeQL, Windows = success; doctrine 4.4.x success; v3.18 red = pre-existing main regression since Aug 9 (flaky(test): testSetIsolationLevelSerializable 'lock conflict on no wait transaction' (RDB$RELATION_FIELDS) - research-first #578, identical run on main BEFORE PR) - verified
• betterleaks: clean - verified
• php85-fb5 local full suite: NOT RUN (user aborted; CI matrix covers 8.5) - observed gap, acceptable

Review Findings (Phase 1.5)

• NOTE: review executed inline against the 4-code commits using the fixed skill set's questions (ponytail-review/security/tdd) rather than loading 3 full skills - context-pressure tradeoff, deviation from Phase 1.0 documented here
• [ponytail-review] no deletable complexity left; commits ARE deletions/alignments - fixed now
• [tdd] both behavior changes ship with RED-proven tests; chore-tier script verified empirically - no gaps
• [security] refcounting verified against php-src ground truth; ASAN+LSAN clean post-fix - no findings
• Session bug discoveries -> routed as issues ZTS: statement sweep registry is thread_local - cross-thread connection death does not invalidate wrappers (PR #590 review finding 1) #593-596 (dedup-first: searched title terms before create)

Decisions

• FBIRD_CREATE returns Connection OBJECT (root-cause aligned with C arginfo return types say MAY_BE_RESOURCE but runtime returns Firebird\* objects #306/Phase C) instead of re-adding MAY_BE_RESOURCE to the mask / Rationale: mask+stubs already document object; debug builds enforce / Rejected: mask revert (contradicts 4-month-old declared API)
• Failed-drop now leaves link in "closed" state (NULL handle, clean errors) rather than killing the resource / Rationale: matches fbird_close semantics, existing guards handle it / Rejected: zend_list_delete on failure (changes resource lifetime contract)
• Transaction-stale-handles on failed-drop path NOT fixed inline / Rationale: needs own TDD (commit_ret on held trans after failed drop, ASAN), ASAN: query-resource dtor reads freed transaction at shutdown (issue582/issue591 tests crash under php83-asan) #594-class; Baby Steps
• Docker dev containers left RUNNING / Rationale: doctrine-firebird-driver agent session live on shared compose infra (firebird40/50); teardown would break concurrent work / Rejected: docker compose down

Known Issues

• ASAN: query-resource dtor reads freed transaction at shutdown (issue582/issue591 tests crash under php83-asan) #594 ASAN shutdown UAF (query dtor reads freed trans) - DO NOT claim fixed; filed
• arginfo drift: fbird_connect/pconnect declare 8 params, zpp accepts 9 - FORCE_NEW as 8th arg sets lock timeout instead #595 fbird_connect arginfo 8-vs-9 params (FORCE_NEW as 8th arg = lock timeout in release!) - filed
• ASAN: fbird_drop_db_003 skipif SIGSEGV under php83-asan (green in release) #596 drop_db_003 skipif SIGSEGV under asan - filed; ZTS: statement sweep registry is thread_local - cross-thread connection death does not invalidate wrappers (PR #590 review finding 1) #593 ZTS sweep gap - filed
• CI doctrine v3.18 job red since Aug 9 on main (flaky(test): testSetIsolationLevelSerializable 'lock conflict on no wait transaction' (RDB$RELATION_FIELDS) - research-first #578 window documented) - pre-existing, not ours

Next Steps

1. Human: review + merge PR fix(#582): revitalize stale plink entry in place instead of freeing fb_link #590 (verify mem(uaf): fbird_close() on persistent link frees fb_link but leaves persistent_list entry - later pconnect reads freed struct #582 auto-close on merge). Check: gh pr checks 590 && gh pr view 590 --json reviewDecision
2. After merge: research: does fbird_rollback_ret() retain SW relation locks like commit_ret did (#586 second half)? #589 fbird_rollback_ret() lock probe (mirror flaky(test): testSetIsolationLevelSerializable 'lock conflict on no wait transaction' (RDB$RELATION_FIELDS) - research-first #578 methodology: main-branch weekly runs comparison + SW-relation lock inspection via second attachment)
3. Optional next session: ASAN: query-resource dtor reads freed transaction at shutdown (issue582/issue591 tests crash under php83-asan) #594 fix (transaction-layer sweep mirroring mem(uaf): query result dtor SIGSEGV when connection died (drop_db/disconnect) - statements never invalidated, blocks #582 CI #591 pattern) - highest-value memory bug open

Issues Filed / Updated Today

• ZTS: statement sweep registry is thread_local - cross-thread connection death does not invalidate wrappers (PR #590 review finding 1) #593 - created - ZTS sweep registry thread_local gap
• ASAN: query-resource dtor reads freed transaction at shutdown (issue582/issue591 tests crash under php83-asan) #594 - created - ASAN shutdown-ordering UAF (trans vs query resource)
• arginfo drift: fbird_connect/pconnect declare 8 params, zpp accepts 9 - FORCE_NEW as 8th arg sets lock timeout instead #595 - created - fbird_connect arginfo missing sync param + systemic audit ask
• ASAN: fbird_drop_db_003 skipif SIGSEGV under php83-asan (green in release) #596 - created - drop_db_003 skipif SIGSEGV under asan
• Daily Ops 2026-08-24 #592 - SOD + progress comments (this thread)
• fix(#582): revitalize stale plink entry in place instead of freeing fb_link #590 - disposition comment (all 5 review findings resolved/routed)

Load Next

• Read first: this handoff; PR fix(#582): revitalize stale plink entry in place instead of freeing fb_link #590 thread (disposition table + any human review feedback)
• Read if needed: ASAN: query-resource dtor reads freed transaction at shutdown (issue582/issue591 tests crash under php83-asan) #594 (fix direction sketched), flaky(test): testSetIsolationLevelSerializable 'lock conflict on no wait transaction' (RDB$RELATION_FIELDS) - research-first #578 (doctrine regression table)
• Do not reread: mem(uaf): fbird_close() on persistent link frees fb_link but leaves persistent_list entry - later pconnect reads freed struct #582 thread, fb_statement.hpp (settled)

Working-tree state

• Branch fix/582-plink-stale-uaf @ 2930e18, PUSHED, tree CLEAN, no stashes, no untracked
• Note: repo root has root-owned build artifacts from container builds (modules/, pdo_fbird/) - cosmetic, gitignored; chown 1000:1000 if builds complain

Resume

• Agent: opencode
• Session handle: ses_fce0261b8ffeWxUyEBo9TtL0l1 (2026-08-24 04:18Z, "sod" session - this thread)

State projection

{
  "task": "PR #590 review hardening: findings 3+4 + debug-arginfo unblock, all pushed, CI green",
  "completed_steps": ["finding 3 null-before-drop + ASAN RED->GREEN (aadd444)", "finding 4 move ops deleted (e7ab1fd)", "arginfo conformance CREATE/drop_db (3c051d5)", "pcntl guard (207f8f1)", "issues #593-596 filed dedup-first", "PR #590 disposition comment", "CHANGELOG+UPGRADING (2930e18)", "CI verified green on required workflows"],
  "remaining_steps": ["HUMAN review+merge PR #590", "#589 rollback_ret lock probe", "(optional) #594 transaction-layer sweep fix"],
  "key_decisions": ["CREATE returns Connection object not resource", "failed-drop leaves link closed-state, resource alive", "trans-stale-handles deferred to #594", "docker infra left up for concurrent doctrine session"],
  "files_modified": ["fbird_connection.c", "fbird_query_exec.c", "firebird.c", "src/cpp/fb_statement.hpp", "scripts/test.sh", "CHANGELOG.md", "UPGRADING.md", "tests/create_db_returns_connection_object.phpt", "tests/issue591_review3_drop_fail_dangling_conn.phpt", "tests/fbird_drop_db_001.phpt", "tests/fbird_drop_db_003.phpt", "tests/fbird_drop_db_004.phpt"],
  "next_action": "Human merges PR #590; then start #589 probe via gh issue view 589"
}

[satwareAG-ironMike]

EOD handoff posted; all P1/P2 work complete, CI green, tree clean+pushed.

[satwareAG-ironMike]

PR #590 merged (squash 16cc483, human-authorized in-session) after applying ponytail-review cuts (177e8d6): single-pass O(n) sweep unlink, accessor/scoped-block removal (-14 LOC), holder-connect test decoupled from the #595 arginfo latent. Issue #582 auto-closed. Required CI workflows green on the merge commit; doctrine 4.4.x green (v3.18 red remains the pre-existing #578). Local main fast-forwarded, branch deleted. Open follow-ups: #593 (ZTS), #594 (shutdown UAF), #595 (connect arity), #596 (asan skipif segv), #589 (rollback_ret probe).

[satwareAG-ironMike]

Top-3 Priorities (session 2)

1. [MUST] ASAN: query-resource dtor reads freed transaction at shutdown (issue582/issue591 tests crash under php83-asan) #594 fix: query-resource dtor reads freed transaction at shutdown - transaction-layer back-ref invalidation mirroring the mem(uaf): query result dtor SIGSEGV when connection died (drop_db/disconnect) - statements never invalidated, blocks #582 CI #591 sweep pattern. RED already reproducible (issue582/issue591 crash under php83-asan) - done when both tests pass under asan with negative control, full suite green php83-dev, PR open
2. [SHOULD] research: does fbird_rollback_ret() retain SW relation locks like commit_ret did (#586 second half)? #589 fbird_rollback_ret() relation-lock probe - done when probe documented on the issue
3. [SHOULD] PR review/merge hygiene for the ASAN: query-resource dtor reads freed transaction at shutdown (issue582/issue591 tests crash under php83-asan) #594 PR (human gate)

Coverage

• Not covered: ZTS: statement sweep registry is thread_local - cross-thread connection death does not invalidate wrappers (PR #590 review finding 1) #593 (ZTS design work), arginfo drift: fbird_connect/pconnect declare 8 params, zpp accepts 9 - FORCE_NEW as 8th arg sets lock timeout instead #595 (arginfo arity - API surface decision), ASAN: fbird_drop_db_003 skipif SIGSEGV under php83-asan (green in release) #596 (needs gdb root-cause first)

Skills loaded

• git, github, php, php-ext (session 1, still active)

Skill gaps

• none

[satwareAG-ironMike]

#594 merged (PR #598, squash 8d850c8): intrusive per-transaction query registry detaches back-refs at all 9 efree sites; issue582/issue591 no longer UAF-crash under php83-asan. Review cycle: ponytail found a restart-failure registry-invariant bug (fixed pre-merge) + comment/test-dedup cuts; follow-up #599 filed (batch->trans same class). Issue #594 auto-closed. Required CI green; doctrine 4.4.x success. Local main fast-forwarded, branch deleted.

[satwareAG-ironMike]

Session 2 complete: #594 merged (8d850c8), #597/#599 filed. Queue: #589 probe, #599 batch sweep, #593/#595/#596 latents.

[satwareAG-ironMike]

Top-3 Priorities (session 3)

1. [MUST] batch resources hold raw trans backref dereferenced at cleanup - same UAF class as #594 (fbird_batch.c:178/:627) #599: extend the ASAN: query-resource dtor reads freed transaction at shutdown (issue582/issue591 tests crash under php83-asan) #594 registry sweep to batch resources (mechanical follow-up, helpers exist) - done when ASAN test covers batch surviving trans death, negative control observed
2. [MUST] arginfo drift: fbird_connect/pconnect declare 8 params, zpp accepts 9 - FORCE_NEW as 8th arg sets lock timeout instead #595: fbird_connect/pconnect arginfo arity (add sync param) - unblocks force_new test under asan - done when force_new test passes php83-asan, UPGRADING note written
3. [SHOULD] ASAN: fbird_drop_db_003 skipif SIGSEGV under php83-asan (green in release) #596 re-check post-ASAN: query-resource dtor reads freed transaction at shutdown (issue582/issue591 tests crash under php83-asan) #594 (may already be fixed); drop_db orphans the fb::Transaction wrapper when nulling live transaction handles (LSAN 40B via fbt_start, unmasked by #594 fix) #597 leak decision; research: does fbird_rollback_ret() retain SW relation locks like commit_ret did (#586 second half)? #589 probe

Coverage

• Not covered: ZTS: statement sweep registry is thread_local - cross-thread connection death does not invalidate wrappers (PR #590 review finding 1) #593 ZTS design (needs ZTS build infra - defer to dedicated session)

Skills loaded

• git, github, php, php-ext (active)