Repository navigation
fleet: laptop SSH unreachable since 2026-10-28 ~11:16Z — all laptop-worktree queue work blocked (MaxStartups pattern or laptop offline) #1667
Description
Problem
Laptop SSH has been unreachable from the sandbox since ~2026-10-28 11:16Z and remains down as of 13:1xZ. Every attempt via ~/tools/laptop-ssh.sh fails with:
Connection closed by UNKNOWN port 65535 (rc 255)
That byte pattern matches the sshd MaxStartups early-drop signature root-caused on 2026-10-25 (see ~/TOOLS.d/laptop.md), but it is equally consistent with the laptop being asleep/offline — it cannot be distinguished from the sandbox side, and that ambiguity is part of the problem.
Impact
Fleet worktrees, edits, builds and tests live on the laptop by hard rule (worker instruction §3; sandbox builds banned 2026-10-27), so this single outage blocks all implementation work in the code queue. Queue tasks parked solely on this outage so far:
- 1777 / PR feat(mcpx): re-initialize on a legacy session 404 and retry once (#1637) #1642 (mcpx: Phase 1 of #1634 — re-initialize on a legacy session 404 and retry the request once #1637): CI-green, needs a one-file conflict resolution on the laptop
- 1616 (mcpx: Phase 2 of #1481 — validate tool arguments at CallTool (enforce, -32602) + structuredContent against outputSchema (warn-only) #1483): gate met, implementation not started
- 1824 (id(web): image upload stores by filename with no collision handling — a second paste named 'image.png' silently un-names the first #1549): verified brief, implementation not started
- 1852 (mcpx: Phase 2 of #1601 — cacheScope at the disk boundary: private never persists, expired seeds expired, stale on refetch error #1603): gate met (PR mcpx: surface ttlMs/cacheScope in mcpclient and expire pool catalogue cache (#1602) #1608 merged), implementation not started
Known pending permanent fix
From the 2026-10-25 root-cause: the laptop's NixOS config still needs services.openssh.settings.MaxStartups = "100:30:300" + a switch timed when no interactive laptop SSH is in use. The connection-multiplexing interim fix in laptop-ssh.sh does not help when no master connection can be established at all.
Acceptance
- Laptop SSH reachable again from the sandbox via
~/tools/laptop-ssh.sh(a plainechoround-trip succeeds). - The parked tasks above can be claimed and worked.
- The MaxStartups permanent fix is either applied or explicitly scheduled, so a burst of fleet connections cannot reproduce the drop pattern.
Activity
dezren39 commentedon Oct 28, 2026
Intake review
## Acceptancesection; treating it as the acceptance-criteria section (no duplicate appended). Labels normalized this pass: addedsource/queue-worker,status/needs-triage,effort/s,area/infra(alreadykind/bug,priority/high).~/tools/laptop-ssh.shecho round-trip, then schedule theservices.openssh.settings.MaxStartups = "100:30:300"switch on the laptop and record it here so the parked tasks can resume.— fleet monitor intake pass, 2026-10-28T13:45Z
dezren39 commentedon Oct 28, 2026
🤖 Agent note · evidence update
Connection closed by UNKNOWN port 65535, zero successes. Queue tasks parked solely on this blocker during the shift: 1830 (aggregator: a garbage or future-dated generatedAt is 'live' forever — the orchestration diagnosis and fleet-feed gate never check that the timestamp parses #1564), 1855 (id(web): AutoSaveManager's generic-error path drops a coalesced follow-up — an edit made during a failed save is never autosaved #1616), 1641 (mcpx: Phase 2 of #1554 — client task execution for taskSupport "required" tools (internal/mcpclient) #1556), 1778 (PR mcpx: re-issue a broken modern request once, tools/call gated on annotations (#1638) #1645 conflict resolution — also half the mcpx: Phase 3 of #1634 — register truth-up (TR-29, PM-06) and nix#203 evidence #1639 Phase 3 gate), 1737 (id(outbox): a parseable torn tail is accepted, then merged into the next record — Outbox::open only drops unterminated final lines that fail to parse #1620). Work that could be done remotely (triage 1741 on aggregator: quota gatherer snapshot dedup ignores credentialId — two ok credentials of one provider interleave into one series and append an alternating noise point every tick #1624) completed normally, so the sandbox/GitHub side is healthy; only the laptop path is down.dezren39 commentedon Oct 28, 2026
Closing — resolved. The 2026-10-28 laptop SSH outage (06:17–~08:53 CDT) was sshd MaxStartups early-drops under fleet connection bursts. The permanent fix is live: the laptop switched to NixOS generation 511 at 12:17 CDT today, and the running sshd config carries MaxStartups 100:30:250 + MaxSessions 50. Operator-verified with 5 parallel cold SSH connections, all successful. Full evidence on dezren39/darwin-nix#1020.