[devantler]

🤖 Generated by the Agentic Engineer

Why

Stopping a backup watch can prematurely remove the recovery check's temporary files, causing a valid backup refresh to fail.

What

Restrict cleanup to the parent process and verify that child cleanup preserves its work while parent cleanup still completes.

Fixes #5824

[devantler]

🤖 Generated by the Agentic Engineer

RED/GREEN at 293a1cfcb88b15136792cb1cef35913cedaa6c98: a real Bash child executing the production cleanup handler in the inherited-trap state first removed the parent's temporary workspace. The repaired handler refuses child cleanup; the parent workspace and live watch survive, then parent cleanup stops and reaps the watch and removes the workspace. The test deliberately selects the documented fork/termination state; it does not claim to measure its timing frequency.

The complete Email credential/recovery package passes locally, including all source, unfinished-Job, ownership, completion, snapshot/mirror and privacy controls. ShellCheck, Go formatting and GolangCI-Lint pass. This is a narrow process-owner fence; no production credential or Job was changed. Hosted CI and current-head review remain required. The defect was observed in the full Go CI of #5820, which stays unready pending repair and fresh passing validation.

[devantler]

🤖 Generated by the Agentic Engineer

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-03T09:31:15.207139Z	293a1cf	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Breezy!

Reviewed commit: 293a1cfcb8

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[devantler]

🤖 Generated by the Agentic Engineer

Readiness rechecked at 293a1cfcb88b15136792cb1cef35913cedaa6c98. I independently read successful CI 41610934733 and its native Email recovery regression job: the real inherited-handler child preserves the parent's workspace/watch, parent cleanup reaps/removes them, and all source/ownership/completion/mirror/privacy refusal controls pass. This directly exercises and evaluates the changed cleanup behavior; it does not claim a fresh production backup.

The current-head Codex review is clean; all reported checks are settled green/skipped; the body contract passes; threads, review bodies and maintainer control reads are clear; no active worktree holder was found. The required aggregate and three required workflows pass. Required code-quality analysis remains unreadable despite configured setup; the normal protected merge API is authoritative under the consumer policy, with no bypass. Production execution remains governed by its existing pipeline and recovery gates, including the separately owned maintenance incident.

[devantler]

🤖 Generated by the Agentic Engineer

The reviewed head 293a1cfcb88b15136792cb1cef35913cedaa6c98 is now in the protected merge queue. The CLI submission was blocked by GraphQL quota; GitHub's documented REST asynchronous queue API accepted the exact head with merge_action=merge_queue and rule bypass disabled. Its terminal native result independently reports enqueued.

Queue admission is not delivery. Merge-group CI, actual main merge, deployment/readback and meaningful operational verification still need collection. The current production-maintenance recovery remains separately owned.

[devantler]

🤖 Generated by the Agentic Engineer

Returned this change to draft while its required validation is refreshed. The newly applicable organization Go workflow is missing at source head 293a1cfcb88b15136792cb1cef35913cedaa6c98; the older successful checks do not establish current readiness. The shared repository validation repair is tracked in #5843 and #5846.

The already-started deployment job completed successfully before this metadata change. The overall merge-group run and its final checks had not completed; no accepted-main delivery or recovery trial is claimed.

Re-entry requires the accepted repair on main, a non-destructive source refresh, every required current-head check, a current-head permitted review and the normal production/recovery gates. Preserve this issue's original start and waiting history. No failed deployment is being retried, and no validation gate is waived.

[devantler]

🤖 Generated by the Agentic Engineer

Native readback now confirms this merged as 08be2b9daf0a5bd3cf518961b58d95b470bc8068. Both changed files match reviewed source 293a1cfcb88b15136792cb1cef35913cedaa6c98, and the merged commit has a valid GitHub signature. The required aggregate passed before merge, following the successful deployment step.

The existing queue entry survived conversion to draft. The normal cancellation arrived after merge and the overall run is cancelled, so it is not recorded as a successful complete run. The repository's required CD recovery verification is now in progress from that merged revision. Operational snapshot/mirror verification remains pending; this does not establish mailbox-data restoration or complete Email recovery.

[devantler]

🤖 Generated by the Agentic Engineer

The normal main recovery deployment passed at 08be2b9daf0a5bd3cf518961b58d95b470bc8068, including every prerequisite and production deployment. The first-attempt backup refresh then completed both snapshot and mirror operations using the reviewed repair.

This completes the pending deployment and backup-refresh verification for this PR. Backup restoration and Stalwart mailbox/Calendar migration remain separate acceptance work; neither is established by this result.