chore(release): stamp v0.50.269 — bootstrap supervisor fix + 2 v0.50.267 follow-ups

- CHANGELOG.md: v0.50.269 entry detailing #1478 #1479 #1480
- ROADMAP.md: bump to v0.50.269, 3847 tests collected
- TESTING.md: bump header + total to 3847

#1478: nesquena APPROVED self-built bootstrap.py --foreground mode
       (closes #1458 Bug #1, +Opus follow-ups: XPC noise filter, executability guard)
#1479: surgical follow-up to #1473 — Session.compact() now includes pending_user_message
#1480: bfcache pageshow restores active session via loadSession + checkInflightOnBoot

3847 tests pass (+47 net). Opus advisor on stage diff: no blockers.

CHANGELOG.md

@@ -1,5 +1,15 @@
 # Hermes Web UI -- Changelog
 
+## [v0.50.269] — 2026-05-02
+
+### Fixed (1 self-built + 2 contributor follow-ups)
+
+- **`bootstrap.py` `--foreground` mode for process supervisors** (#1478, self-built, closes #1458 Bug #1) — the `bootstrap.py` double-fork pattern (`subprocess.Popen([python, "server.py"], start_new_session=True)` then exit 0) breaks every process supervisor. launchd / systemd / supervisord / runit / s6 see the parent exit, mark the program "completed," and respawn it — but the orphaned server still owns port 8787, so the new bootstrap fails to bind, exits non-zero, supervisor respawns again. Loop until something else crashes the orphan and the next respawn finds the port free. Reporter described this as "the agent fixes it eventually" — that's the loop intermittently succeeding. **Fix:** new `--foreground` flag (and supervisor-environment auto-detection via `INVOCATION_ID` / `JOURNAL_STREAM` / `NOTIFY_SOCKET` / `SUPERVISOR_ENABLED` / `XPC_SERVICE_NAME` / `HERMES_WEBUI_FOREGROUND`). In foreground mode, replace the bootstrap process image with `server.py` via `os.execv` so the supervisor sees the long-lived server as the original child. KeepAlive / Restart=always now work correctly. Plus 1 Opus pre-merge MUST-FIX (`_is_real_supervisor_value()` helper rejects macOS Terminal's noise values like `XPC_SERVICE_NAME=0` and `application.com.apple.Terminal.<UUID>` — without this, every Mac dev running interactive `./start.sh` would silently auto-promote to foreground mode, losing the /health probe and browser open) + 2 SHOULD-FIX (test env-var leakage cleanup, pre-execv `os.access(python_exe, os.X_OK)` guard so a non-executable launcher path raises a clear RuntimeError instead of OSError-then-respawn-loop). 44 regression tests + new `docs/supervisor.md` reference (runnable launchd plist + systemd `.service` + supervisord conf + diagnostic `lsof`/`ppid` recipe). **Bugs #2 (state.db FD leak) and #3 (HTTP-unhealthy wedge) remain open under #1458** awaiting diagnostic data. (`bootstrap.py`, `docs/supervisor.md`, `.gitignore`, `tests/test_bootstrap_foreground.py`)
+
+- **`/api/sessions` payload missing `pending_user_message`** (#1479, by @Thanatos-Z) — surgical 6-LOC follow-up to v0.50.267 #1473. The frontend reload/sidebar recovery filter at `sessions.js:1342-1349` checks both `s.active_stream_id` AND `s.pending_user_message` to keep mid-restore sessions visible, but `Session.compact()` (the dict serialized into the `/api/sessions` payload) was missing `pending_user_message`. The filter only worked via the `active_stream_id` clause. In practice not user-visible because `active_stream_id` and `pending_user_message` are set/cleared atomically together (verified at `api/routes.py:4232-4240`), so any session with the latter also had the former. The fix prevents future drift if the atomicity invariant ever changes. (`api/models.py`, `static/i18n.js`, `tests/test_issue856_session_streaming_state.py`)
+
+- **bfcache `pageshow` doesn't restore active session** (#1480, by @dso2ng) — when a browser restores the WebUI from bfcache (back/forward navigation), the frozen DOM is brought back without re-running boot. Sessions with `active_stream_id` or `pending_user_message` set looked stale in the active pane because the in-flight reattach logic (the v0.50.267 #1473 fix) only ran on fresh page loads. **Fix:** the pageshow handler now `await loadSession(S.session.session_id)` to refresh through the normal load path, then `await checkInflightOnBoot(...)` to reattach SSE. Tightened existing bfcache layout-restore tests via a shared `_pageshow_handler()` helper that walks the listener body via brace matching instead of the prior brittle `[ps_idx:ps_idx + 1600]` window. New `tests/test_1466_bfcache_inflight_reattach.py`. (`static/boot.js`, `tests/test_1045_bfcache_layout_restore.py`, `tests/test_1466_bfcache_inflight_reattach.py`)
+
 ## [v0.50.268] — 2026-05-02
 
 ### Fixed (contributor PR batch — 4 PRs)

ROADMAP.md

@@ -3,7 +3,7 @@
 > Goal: Full 1:1 parity with the Hermes CLI experience via a clean dark web UI.
 > Everything you can do from the CLI terminal, you can do from this UI.
 >
-> Last updated: v0.50.268 (May 02, 2026) — 3800 tests collected
+> Last updated: v0.50.269 (May 02, 2026) — 3847 tests collected
 > Tests: `pytest tests/ --collect-only -q`
 > Source: <repo>/
 

TESTING.md

@@ -1835,8 +1835,8 @@ Bridged CLI sessions:
 
 ---
 
-*Last updated: v0.50.268, May 02, 2026*
-*Total automated tests collected: 3800*
+*Last updated: v0.50.269, May 02, 2026*
+*Total automated tests collected: 3847*
 *Regression gate: tests/test_regressions.py*
 *Run: pytest tests/ -v --timeout=60*
 *Source: <repo>/*