Commitff97a06aRecorded4 Aug 2026Repositorycourier

Harden poller detection against matching the searching process itself

Message

The harness and probe found pollers with a SUBSTRING search over /proc/<pid>/cmdline. That matches any process whose command line merely contains "--telegram-poller" -- including the very script doing the search.

It cost nothing in the harness, where poller_children() only ever inspects children of a specific courier pid and a measurement script is never one. It cost real confusion in ad-hoc whole-host scans: twice on 2026-08-04 a scan reported extra pollers on the live estate, and both times the extras were the bash/python process running the scan. I was one step from reporting a production incident that did not exist; re-measuring rather than reporting is what caught it.

Detection now requires the LAST argv element to be exactly the flag AND the executable to really be a courier binary. Same defect the worker guide warns about for pgrep -f, rediscovered in a home-grown scanner.

Harness 59/0 and the production-shape probe still pass with the stricter detector, so nothing was passing on a loose match.

Changed
 repro/single_poller_harness.py | 14 +++++++++++---
 repro/two_paths_probe.py       | 12 +++++++++---
 2 files changed, 20 insertions(+), 6 deletions(-)
Diff
repro/single_poller_harness.pymodified
@@ -315,10 +315,18 @@ def poller_children(pid):
315
for c in child_pids(pid):
316
try:
317
with open(f"/proc/{c}/cmdline", "rb") as f:
−318
cmd = f.read().decode("utf-8", "replace")
−319
except (FileNotFoundError, ProcessLookupError, PermissionError):
+318
argv = f.read().decode("utf-8", "replace").rstrip("\0").split("\0")
+319
exe = os.readlink(f"/proc/{c}/exe")
+320
except (FileNotFoundError, ProcessLookupError, PermissionError, OSError):
321
continue
−321
if "--telegram-poller" in cmd:
+322
# Match the LAST argv element exactly, and require the executable to
+323
# really be a courier. A substring search over cmdline matches any
+324
# process whose command line merely CONTAINS the flag -- including the
+325
# very script doing the search. That is the `pgrep -f` self-match
+326
# hazard, and it produced two phantom "extra poller" readings on
+327
# 2026-08-04 before it was caught.
+328
if argv and argv[-1] == "--telegram-poller" and \
+329
os.path.basename(exe).startswith("courier"):
330
found.append(c)
331
return found
332
repro/two_paths_probe.pymodified
@@ -88,10 +88,16 @@ def poller_children(pid):
88
break
89
if ppid != pid:
90
continue
−91
cmd = open(f"/proc/{e}/cmdline", "rb").read().decode("utf8", "replace")
−92
except (FileNotFoundError, ProcessLookupError, PermissionError):
+91
argv = open(f"/proc/{e}/cmdline", "rb").read().decode(
+92
"utf8", "replace").rstrip("\0").split("\0")
+93
exe = os.readlink(f"/proc/{e}/exe")
+94
except (FileNotFoundError, ProcessLookupError, PermissionError, OSError):
95
continue
−94
if "--telegram-poller" in cmd:
+96
# Exact last-argv match AND a real courier executable: a substring
+97
# search matches the searching process itself (the `pgrep -f`
+98
# self-match hazard).
+99
if argv and argv[-1] == "--telegram-poller" and \
+100
os.path.basename(exe).startswith("courier"):
101
out.append(int(e))
102
return out
103