acpmux: withdraw Claude permission cards safely

Merged
TE
11d ago
+772-65

Fixes #24562

Claude Code can withdraw a question it asked: an MCP server's form (an elicitation) or a permission prompt. It sends {type: "control_cancel_request", request_id} when the turn is interrupted or the asking tool call ends.

Withdraw the matching permission card and group item as soon as the agent cancels it. Match both child generation and request id, including direct children, so a delayed cancellation cannot affect a replacement process that reuses the id. Keep early-cancellation markers only while their request handler is active.

Persist hosted withdrawals before acknowledging their host entry. Adoption replays early and registered cancellations, records the resulting decision, and uses an incarnation-bearing marker as the durable host checkpoint; the raw cancellation copy carries no cursor. The rebase preserves the raw-line adoption scans from #26144, including full-fold parity and the parse-count discriminator.

The translator follow-up #26189 emits Claude control cancellations; this backend handler lands first so its notification has a receiver.

Risk: cancellation races with registration, answers, and daemon restart. Regression tests cover both arrival orders, incarnation isolation, recovery, cursor safety, and the settled result returned to a late answer.

Verification:

  • Hosted red-before run 40501330433: the direct-child identity and immediate settled-outcome regressions fail for the expected reasons before their fixes.
  • Hosted verification of the final head d81cc029750c15b2c25d1803a4ca5cf3fb1bd4eb: 40503649561, passed: 6 subsession-answer tests, 5 host-adoption tests, 4 direct-child tests, and clippy with warnings denied.
  • Hosted red-before race tests 40503145217 fail on the lost recovery cancellation and unscoped raw cursor before the fixes.
  • git diff --check and the NEXT pre-push gate pass.
  • Independent Codex Astra xhigh review through acpmux: SHIP at d81cc029750c15b2c25d1803a4ca5cf3fb1bd4eb; no remaining P1/P2 findings.

Agent session: agent session