Merge wip/233-two-sessions: ending one session never stops the data server or broker while another session or a job store uses them; no crash when they disappear (#233)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Y1pWhDKvhakdnjg3taYGxM

Author: andy

docs/claude/services/the-gateway-window-no-longer-appears.md

@@ -3,8 +3,8 @@ type: map
 title: "The Gateway window no longer appears"
 area: services
 section: "The Gateway window and session end"
-paths: ["~/.ECCE/mosquitto.server"]
-issues: [93, 97, 185, 191]
+paths: ["~/.ECCE/mosquitto.server", "packaging/dataserver/ecce-dataserver-stop", "packaging/gateway/ecce-gateway-reap", "src/apps/organizer/CalcMgr.C", "src/apps/gateway/Gateway.C"]
+issues: [93, 97, 185, 191, 233]
 ---
 **The Gateway window no longer appears** (#93, 2026-09-22). `ecce`
 starts the services and opens the **Organizer** directly, which is now
@@ -26,4 +26,10 @@ SharedBroker` (mode 3, a systemd service no user can stop, not even
 with Quit and Stop Server), or `~/.ECCE/mosquitto.server` (`ecce-remote-
 setup --server`; mode 2, stopped only by that account's Quit and Stop
 Server). The per-user broker is `mosquitto` on a Unix socket (#213). The data server is
-stopped only by Quit and Stop Server, in every mode (#97).
+stopped only by Quit and Stop Server, in every mode (#97). **Quit and
+Stop Server stops nothing while another session of the account (any
+display) or a job is running** (#233): the Quit dialogs do not offer it
+then (`SessionLease::othersUsingServices`), and `ecce-dataserver-stop
+--if-unused` and `ecce-gateway-reap --stop` refuse
+(`ecce_others_using_services`). Without that, the second of two `ecce`
+on one display took the first one's broker and data server down.

include/util/SessionLease.H

@@ -40,6 +40,14 @@ std::vector<Holder> live(const std::string& statedir,
 bool useLease();
 bool useProc();
 
+// The running ECCE programs that still use this account's data server
+// and broker, apart from this process's session: every program of another
+// session of this state directory (on any display, or with no id), and a
+// job store or job master of any session, since a job reports through
+// both. Holder::key is "" for a program without a session id. The same
+// rule as ecce_others_using_services in ecce-session-lib.sh.
+std::vector<Holder> othersUsingServices();
+
 }  // namespace SessionLease
 
 #endif

packaging/dataserver/ecce-dataserver-stop

@@ -1,14 +1,34 @@
 #!/bin/bash
 # ecce-dataserver-stop: stop the per-user data server started by
 # ecce-dataserver-start.
+#
+#   ecce-dataserver-stop --if-unused   as a session's Quit and Stop Server
+#       runs it: refuse (status 3) while another ECCE session of this
+#       account, on any display, or a running job still uses the server.
 
 set -u
 
+ECCE_HOME="${ECCE_HOME:-/opt/ecce}"
 ECCE_REALUSERHOME="${ECCE_REALUSERHOME:-$HOME}"
 STATEDIR="$ECCE_REALUSERHOME/.ECCE/dataserver"
 CONF="$STATEDIR/httpd.conf"
 PIDFILE="$STATEDIR/logs/httpd.pid"
 
+if [ "${1:-}" = --if-unused ]; then
+  _lib="$(dirname "$(readlink -f "$0")")/ecce-session-lib.sh"
+  [ -r "$_lib" ] || _lib="$ECCE_HOME/bin/ecce-session-lib.sh"
+  if ! . "$_lib"; then
+    echo "ecce-dataserver-stop: cannot read $_lib -- data server left running" >&2
+    exit 3
+  fi
+  others="$(STATEDIR="$ECCE_REALUSERHOME/.ECCE" ecce_others_using_services |
+            awk '{ printf "%s%s %s", sep, $2, $1; sep = ", " }')"
+  if [ -n "$others" ]; then
+    echo "ecce-dataserver-stop: another ECCE session or a job of this user is still running ($others) -- data server left running"
+    exit 3
+  fi
+fi
+
 if [ ! -f "$CONF" ]; then
   echo "ecce-dataserver-stop: data server not running (no config at $CONF)"
   exit 0

packaging/gateway/ecce-gateway-reap

@@ -166,6 +166,15 @@ if [ "$IF_IDLE" = 1 ]; then
   [ -z "$(apps_for_state)" ] || exit 0
   [ -e "$STATEDIR/mosquitto.server" ] && exit 0
 fi
+# But only for its own session: another session of this account, on any
+# display, or a running job still talks through this broker (#233).
+if [ "$EXPLICIT_STOP" = 1 ]; then
+  others="$(ecce_others_using_services | awk '{ printf "%s%s %s", sep, $2, $1; sep = ", " }')"
+  if [ -n "$others" ]; then
+    say "another ECCE session or a job of this user is still running ($others) -- broker left running"
+    exit 0
+  fi
+fi
 
 brokerpid=""
 if [ -f "$STATEDIR/mosquitto.pid" ]; then
@@ -186,7 +195,7 @@ fi
 
 if [ -n "${brokerpid:-}" ]; then
   if [ "$EXPLICIT_STOP" = 1 ]; then
-    say "stop requested, no ECCE session left -- stopping mosquitto broker (pid $brokerpid)"
+    say "stop requested, no other ECCE session or job left -- stopping mosquitto broker (pid $brokerpid)"
   else
     say "last ECCE session of this user ended -- stopping its mosquitto broker (pid $brokerpid)"
   fi

packaging/gateway/ecce-session-lib.sh

@@ -164,6 +164,31 @@ ecce_session_procs() {
   } | awk '!seen[$1]++'
 }
 
+# The running ECCE programs that still use this state directory's data
+# server and broker apart from the given session (default: this
+# process's): every program of another session (or of none), and a job
+# store or job master of any session, since a job reports through both.
+# Lines "<pid> <name> <session id>". SessionLease::othersUsingServices()
+# is the C++ copy, which the Quit dialogs use to decide whether to offer
+# Quit and Stop Server.
+ecce_others_using_services() {
+  local own="${1-${ECCE_SESSION_ID:-}}" pid name sid home
+  while read -r pid name sid; do
+    case "$name" in
+      eccejobstore | eccejobmaster) ;;
+      *) [ -n "$own" ] && [ "$sid" = "$own" ] && continue ;;
+    esac
+    # A /proc entry may be another state directory's (lease entries are
+    # this one's, and their programs carry the same environment).
+    if [ -r "/proc/$pid/environ" ]; then
+      home="$(tr '\0' '\n' <"/proc/$pid/environ" 2>/dev/null |
+              sed -n 's/^ECCE_REALUSERHOME=//p' | head -n1)"
+      [ "${home:-$HOME}" = "${ECCE_REALUSERHOME:-$HOME}" ] || continue
+    fi
+    echo "$pid $name $sid"
+  done < <(ecce_session_procs)
+}
+
 # Is an ECCE program of this session running?
 ecce_session_alive() {
   local pid name sid

src/apps/gateway/Gateway.C

@@ -32,6 +32,7 @@
 #include "util/Preferences.H"
 #include "util/PreferenceLabels.H"
 #include "util/JMSPublisher.H"
+#include "util/SessionLease.H"
 #include "util/TempStorage.H"
 
 #include "dsm/EDSIServerCentral.H"
@@ -656,7 +657,15 @@ void Gateway::exitGateway()
       Iconize(false);
       Show(true);
     }
-    ewxMessageDialog dlg(this, "Do you really want to quit?", "Quit ECCE",
+    // Another session of this account, or a job, still uses the services
+    // (#233); the stop scripts refuse then too.
+    bool canStop = !getenv("ECCE_REMOTE_SERVER") && LocalData::dir().empty();
+    bool inUse = canStop && !SessionLease::othersUsingServices().empty();
+    string question = "Do you really want to quit?";
+    if (inUse)
+      question += "\n\nThe data server and message broker stay running: "
+                  "another ECCE session or a job of yours still uses them.";
+    ewxMessageDialog dlg(this, question, "Quit ECCE",
                          wxOK|wxCANCEL|wxICON_QUESTION,
                          wxDefaultPosition);
     // GitHub #52: plain Quit only ever closed the GUI client -- the
@@ -673,7 +682,7 @@ void Gateway::exitGateway()
     // misleading, so don't.
     // Local data mode has no data server to stop; plain Quit already ends
     // the session and the reaper stops the per-user broker.
-    if (!getenv("ECCE_REMOTE_SERVER") && LocalData::dir().empty())
+    if (canStop && !inUse)
       dlg.AddButton(ID_GATEWAY_QUIT_STOP_SERVER, "Quit and Stop Server");
     int result = dlg.ShowModal();
     if (result == wxID_OK)
@@ -695,7 +704,7 @@ void Gateway::exitGateway()
       // nothing after it runs.
       // A local-mode session started no data server; one running belongs to
       // a server-mode session elsewhere and is not ours to stop.
-      if (LocalData::dir().empty()) (void)system("ecce-dataserver-stop");
+      if (LocalData::dir().empty()) (void)system("ecce-dataserver-stop --if-unused");
       (void)system("ecce-gateway-stop");
     }
   } else {