docs: bug-1909..1912 fixed; controller-peers-env-fallback gap notes resolved

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

.wolf/bugs/bug-1911.md

@@ -0,0 +1,58 @@
+---
+id: "bug-1911"
+status: "fixed"
+status_updated: "2026-10-03"
+status_note: ""
+component: "worker"
+severity: "leak"
+timestamp: "2026-10-03T12:14:06Z"
+last_seen: "2026-10-03T12:14:06Z"
+occurrences: 1
+files: ["src/worker/src/main.c"]
+tags: ["asan", "lsan", "worker", "cli"]
+related: []
+fix_commits: ["ef6e562c"]
+---
+
+# bug-1911: worker leaks the -l log-dir string when -h or --version follows -l
+
+## Description
+**Observed:**
+```
+$ xcecd_virtual -l <dir> -h        # rc=1 under ASAN
+==222451==ERROR: LeakSanitizer: detected memory leaks
+Direct leak of 127 byte(s) in 1 object(s) allocated from:
+```
+Same with `--version`. `-l` stores `strdup(optarg)` in `logdir`; the `-h`/default and `--version` cases in the getopt loop (`src/worker/src/main.c` ~L433-465) `return 0` without freeing it.
+
+**Expected:** `-h` and `--version` exit 0 with no leak report, whatever other options precede them.
+**Impact:** under ASAN/LSan the worker's help/version exits 1 with a leak report when `-l` is given first; trivial in release builds (process exits). Pre-existing, found while reviewing controller-peers-env-fallback task 3.2.
+**Found by:** review (controller-peers-env-fallback task 3.2)
+
+## Environment
+- OS: no /etc/os-release; Docker container; NixOS kernel; kernel Linux 6.18.33 x86_64
+- libc: glibc 2.42-47 (interpreter /nix/store/wb6rhpznjfczwlwx23zmdrrw74bayxw4-glibc-2.42-47/lib/ld-linux-x86-64.so.2)
+- Toolchain: gcc (GCC) 15.2.0, meson 1.9.1
+- Build: asan (xce.build)
+- Code: scheduler-framework @ 66520e6b-dirty
+- Deployment: n/a — single local process
+
+## Reproduction
+1. `src/xce.build/worker/xcecd_virtual -l /tmp/x -h; echo rc=$?` (ASAN build)
+2. LeakSanitizer reports a 127-byte direct leak and rc=1. Same with `--version`.
+- Frequency: deterministic, 2026-10-03
+- Evidence: not kept
+
+## Root cause
+In `src/worker/src/main.c`'s getopt loop, `-l` stores `strdup(optarg)` in `logdir`, but the `--version` (`OPT_VERSION`) and `-h`/default cases `return 0` without freeing it. Under ASAN, LeakSanitizer reports the 127-byte block and turns the exit status into 1.
+
+## Fix
+`FREEUP(logdir)` before both `return 0` statements. The other early returns after `-l` (peers parse/validation errors, mkdir failure) already free it.
+
+## Verification
+- Test: `case_worker_help_version_after_logdir_no_leak` in `src/tools/verify-controller-peers-env.sh` — RED before (`expected exit status 0, got 1`), GREEN after.
+- Suites: `xce-build.sh all --incremental` (asan): worker suite and all C tests 127/0, no ASAN/LSan reports; regression script 35/35, 2026-10-03.
+- Live: n/a
+
+## References
+- Related: none