P2 [CRF-3] SnapshotRuntime reads p.chatWorker.manager without synchronization. Close() sets w.manager = nil under w.mu (worker.go:144). This is a data race under the Go memory model.

The handler goroutine can call SnapshotRuntime while Close() runs on another goroutine during shutdown. The race detector will flag it if a shutdown test ever overlaps with a handler call.

Fix: add an InspectChat method on chatWorker that reads manager under the lock before delegating:

func (w *chatWorker) InspectChat(chatID uuid.UUID) []RunnerSnapshot {
    w.mu.Lock()
    manager := w.manager
    w.mu.Unlock()
    if manager == nil {
        return nil
    }
    return manager.InspectChat(chatID)
}

Then call p.chatWorker.InspectChat(chatID) here.

(Hisoka P2, Komugi P3)

🤖

P3 [CRF-4] No forwarding-loop protection. The sibling stream-parts relay sets RelaySourceHeader to prevent a proxied request from bouncing back. This proxy has no equivalent guard.

If ownership transfers between the two DB reads (originator reads WorkerID = B, target re-reads WorkerID = A), the request bounces until context timeout. The window is narrow (ownership must flip during network transit), but the fix is one header check, matching the existing relay convention.

Fix: set a header like X-Coder-Debug-Forwarded: 1 on the outgoing request. On inbound, if the header is present, serve locally regardless of ownership.

(Hisoka P3, Kite P4, Meruem P3, Ryosuke P3)

🤖

P3 [CRF-5] address + r.URL.Path drops query parameters. The endpoint has none today, but the comment on exp_chats.go:7917 says "forward the entire request there and return its response verbatim," and it doesn't.

Fix: address + r.URL.RequestURI()

(Kite P3, Meruem P3, Ryosuke P3, Razor P3)

🤖

P3 [CRF-6] Hardcodes Content-Type: application/json instead of forwarding the upstream's header. If an intermediary between replicas returns a non-JSON error (HTML 502, text/plain), the client receives it labeled as JSON.

Fix: rw.Header().Set("Content-Type", resp.Header.Get("Content-Type"))

(Knov P3, Mafuuu P3)

🤖

P3 [CRF-7] Test title says "verifies heartbeat presence and staleness" but only exercises is_stale == false. The heartbeat is always fresh because it was just upserted. The IsStale: age > float64(chatstate.HeartbeatStaleSeconds) branch at exp_chats.go:7944 is never reached.

To test the stale path: after upserting the heartbeat, advance the quartz clock past HeartbeatStaleSeconds (requires wiring api.Clock through the handler, which is currently blocked by CRF-2), or insert a heartbeat with a backdated timestamp and verify is_stale == true.

(Bisky)

🤖

Nit [CRF-17] content, _ := chatprompt.MarshalParts(...) swallows a potential serialization error. If MarshalParts ever fails, the test proceeds with nil content and the assertions could pass for the wrong reason. Use require.NoError like the other helpers in this file do.

(Bisky)

🤖

Nit [CRF-18] (30s) hardcodes the value of HeartbeatStaleSeconds. If the constant changes, this comment goes stale silently. Drop the parenthetical: // IsStale is true when age exceeds chatstate.HeartbeatStaleSeconds.

(Gon)

🤖

P3 [CRF-1] The pre-existing // Config configures a chat processor. doc comment is now contiguous with the new WorkerID() method. Go godoc attaches it to WorkerID(), whose first sentence reads "Config configures a chat processor." Meanwhile type Config struct (now further down) has no doc comment.

Fix: move // Config configures a chat processor. to directly above type Config struct.

(Netero P3, Kite Nit)

🤖

Nit [CRF-2] time.Since(row.HeartbeatAt) bypasses quartz clock. The API struct carries Clock quartz.Clock, and this file already uses api.Clock.Now() at line 6695. Should be api.Clock.Since(row.HeartbeatAt).Seconds().

(Netero)

🤖

Note [CRF-19] The FILTER clauses hardcode the four current roles (system, user, assistant, tool). The Go handler mirrors this with a fixed four-key map. If a fifth role is added to the chat_message_role enum, total will include it but no by_role bucket will, so the debug output quietly stops summing correctly. For a debug-only endpoint the cost is low, but the loan is worth tracking.

(Knuckle, Melody)

🤖