acpmux: preserve retries and adopted prompt outcomes across restart

Closed
TE
7d ago
+1857-65

Automatic retries survive daemon restart at their original deadline, with a stable prompt ID suppressing duplicate execution. Non-hosted turns interrupted by restart continue immediately; adopted running prompt IDs remain running on resend.

Leo: "I think the various situations we have with cloud and whatnot, like just having that done real nicely will be quite important."
Leo: "ACCEPT IT BREAKING AT SOME POINT BUT IT RESUMES WHATEVER IT INTERRUPTED. END OF STORY FOR THE DAEMON UPDATE."

Recovery reads the journal when saved session metadata lags. It preserves Stop and Web-control decisions, configured retry delays and counts, session-replacement fencing, and cloud-handoff state. Stop records carry the accepted prompt identity before its message is durable; replay also retains legacy cancellation turn IDs independently of message ordering. A stopped retry stays cancelled even when the crash precedes its message or admission record. Restoration validates the attempt against the count saved in its schedule, including configured loops longer than the default.

Table-driven tests cover the write boundaries between failed results, schedules, messages, admission, and terminal decisions, including a second restart. The prompt ledger distinguishes an unadmitted message from a consumed steer, joined prompt, or withdrawn queue entry.

This cohesive state machine and its regression tests span about 1,900 changed lines. Splitting its journal writer, recovery reader, prompt deduplication, and cancellation semantics would leave intermediate commits with incompatible crash behavior. Update timing and hosted-agent adoption are unchanged.

Validation

Final head: b0cf59e49663fc9c798cd50da162122c298cb27d.

  • Original baseline red: 40785474844, job 9f10ff49149244e7a7e9fc6dc0ee28e1: pending_retry_survives_restart_at_its_original_deadline_once fails without the fix.
  • Stop-before-message regression red: 40929465935, job d415049682e84b07a94a52af5acb05a1: preceding f0343b36 replay code with the new tests fails both prompt-ledger and retry-restoration assertions (exit 101).
  • No-message crash regression red: 40930174952, job f723516132e84ece9b4c259a79e83ed6: preceding cd3e5fbe replay fails stopped_without_message and stop_without_message by assertion, each exit 101.
  • Configured fifth-attempt regression red: 40931938819, job 15f317b72c3540ae86a130c16e9278a7: preceding 716ee1f3 restoration with the new test drops the fifth configured attempt (null versus 5, assertion exit 101).
  • Exact-head focused green: 40931946815, job d870290cc9ca4c2099463335b20c9fba: prompt-ledger/recovery tables, cloud handoff, 34 auto-resume integrations, five durable-agent cases, and strict all-target acpmux clippy.
  • Exact-head full library green: 40931955214, job 60296d3cd21a48cea2975265aa0bd74a: 1,696 passed, zero failures.
  • Synthetic-merge validation green: 40932029902, job f829535fbd6344df8efb15442cf4ee29: exact merge 77723f98011ebdd1677ba41e5c39d6819d250cc4 onto base c230bb58a50cf8b35ee7de9f1130bff840c8e459, verified tree 85e75d381717b1cf447598ccad101f1ec7b05a65. Ledger and 11 recovery tests pass; strict all-target acpmux and cmux-tui clippy pass with the required submodule initialized. This closes the earlier merge-only reference to the removed MAX_ATTEMPTS constant.
  • Per-red comparison: 40932244261, job b0c99e879f4d47d6895282b946e45404, compares that exact synthetic merge with its actual base. Both run 64 generator tests with the sole identical test_ir.IrTests.test_live_raw_v12_layout_and_history_contracts_are_exact(command='new-pane-right') assertion. Both report the same NoSwiftUI findings in HomeChatColorsPanel.swift and HomeChatColorsView.swift. These cover the protocol/inventory and cmux-next workflow reds.
  • Independent Astra high/Fast exact-head review: SHIP, no findings, b0cf59e49663fc9c798cd50da162122c298cb27d. The final delta review confirms the durable attempt-count bound; the preceding review covers Stop before any message and after an earlier orphan, including subsequent restarts.

Changelog

Recover automatic retries and running prompt outcomes across daemon restarts.

Agent session: agent session