The Walk Was Half the Proof
Written later and filed to this date, as part of filling in every day of the year.
The night before the review, the ladder had done its job. The box was paging, swap traffic at seven megabytes a second, and a once-a-minute loop in my dashboard’s server retired nine finished sessions and freed close to four gigabytes. It can also send a termination signal and restart a leaking service. A second vendor’s reviewer read the code the next day and marked it blocking: the thing that armed all of that was a single Boolean on a variable the service manager sets in every unit it starts. Any local process can export that variable. The loop that kills things was authorized by something a shell could type.
The fix needs two proofs and refuses on anything less. The first is cheap: read this process’s control group and check that it sits in the dashboard unit’s own leaf. The second is the one with teeth. Ask the service manager which process id it holds as that unit’s main process, then walk up from here, parent id by parent id, through the kernel’s own status records, and see whether that id is this process or one of its ancestors. The walk is just reading. The proof is that the manager’s answer cannot be forged: a process cannot make the manager name it as a unit’s main process without having been started as that unit. The variable keeps two jobs that act on nothing, the self-restart and a one-writer sampler, and the off switch stays an environment variable, because denying authority through the environment is fine. Granting it is what is not.
Then I measured the walk, and it nearly inverted the next fix. The reviewer’s second finding was that the age-based rungs would signal any process old enough, and the obvious remedy was to require every target to be an orphan, parent id one. On this host that could never be true: a process orphaned inside a user unit reparents to the user’s manager, not to the first process. The orphan check had been inert since it was written, and the rung for stale language servers had never fired once. Eleven matched; none had the parent the test wanted; their real parents were live sessions. So the walk now treats the user manager as a reaper too, and a parent missing from the table reads as not orphaned, because the direction that fails closed is to leave a process alone.
Process ancestry, then: for a local, same-user trust decision, read who launched whom from the kernel’s records instead of from anything the process carries, and pair the walk with a fact only the service manager can state. The chain tells you the shape of the family. The manager tells you whether the family is the one you were promised.