chore: fail-closed activation guard in drain.sh (session close)

3b23d467a6887db3bb2310d186f9e430372be04b · 2026-08-11 18:50:20 -0700 · steve@designerwallcoverings.com

Files touched

M drain.sh

Diff

commit 3b23d467a6887db3bb2310d186f9e430372be04b
Author: steve@designerwallcoverings.com <steve@designerwallcoverings.com>
Date:   Tue Aug 11 18:50:20 2026 -0700

    chore: fail-closed activation guard in drain.sh (session close)
---
 drain.sh | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/drain.sh b/drain.sh
index 1bb1cdb..bc0bd01 100755
--- a/drain.sh
+++ b/drain.sh
@@ -26,11 +26,10 @@ trap 'rmdir "$LOCKDIR" 2>/dev/null' EXIT
 # activator's daily ledger hard-caps the day's total regardless of per-slot ask.
 SLOT_MAX="${DW_ROTATION_SLOT_MAX:-21}"
 echo "[$(ts)] rotation-activate start slot_max=$SLOT_MAX" >>"$LOG"
-# --- re-intro guard pre-check (TK-10474): abort this tick if the guard drifted (trap releases the lock) ---
+# --- re-intro guard pre-check (TK-10474): FAIL-CLOSED — abort if guard missing/non-exec OR trips (trap frees lock) ---
 GUARD="$HOME/Projects/dw-activation-calendar/scripts/check-reintro-guard.sh"
-if [ -x "$GUARD" ] && ! "$GUARD" >>"$LOG" 2>&1; then
-  echo "[$(ts)] ABORT: re-intro guard drift detected — activation skipped this tick" >>"$LOG"; exit 1
-fi
+if [ ! -x "$GUARD" ]; then echo "[$(ts)] ABORT: re-intro guard missing/not executable — failing closed" >>"$LOG"; exit 1; fi
+if ! "$GUARD" >>"$LOG" 2>&1; then echo "[$(ts)] ABORT: re-intro guard drift detected — activation skipped this tick" >>"$LOG"; exit 1; fi
 /opt/homebrew/bin/node "$EXE" --max "$SLOT_MAX" --commit >>"$LOG" 2>&1
 RC=$?
 echo "[$(ts)] rotation-activate end rc=$RC" >>"$LOG"

← 6074d75 rotation drain: pre-flight re-intro guard check — abort acti · back to Dw Rotation Activator · Unify pre-activation five-field checks ee136fc →