Repository navigation
Composite request envelopes: batch and replay must cover their steps' worst case or hold a daemon deadline #3325
Description
Follow-up 2a from #2879 (step 1 landed in #2916).
Problem
batch and replay run many steps inside one client request envelope, and neither holds a daemon-side deadline. When the envelope fires, onTimeout: 'reset-daemon' kills the daemon and every session it owns.
batch:timeoutPolicy: DEFAULT_TIMEOUT_POLICY(90 s for the whole request,packages/command-registry/src/registry.ts,name: 'batch').replay:{ ...DEFAULT_TIMEOUT_POLICY, budget: { source: 'flag' } }. With no--timeoutthe envelope is 90 s. With--timeout Xit is exactlyX, and no daemon code reads that budget, so the margin is zero.
One fold step has a proven worst case of about 225 s (FOLD_REQUEST_TIMEOUT_MS = 255_000, ledger in test/integration/provider-scenarios/ios-fold.test.ts). longpress (210 s) and install (180 s) are also batchable or recorded. A batch or .ad replay that contains any of them can overrun the envelope and reset the daemon instead of returning a typed result.
Decision needed
Choose one:
- Derived envelope. The client sums the resolved envelopes of the steps it sends (
batch --steps/--steps-file).replaywould need the client to parse the script first. - Daemon deadline.
batchandreplayhold a daemon-side deadline that ends at least 30 s before the envelope and returns a typed timeout, following thelease_allocateshape (LEASE_ALLOCATION_BUDGET_MS).replay --timeoutis documented as the request's wall-clock maximum (src/commands/replay/index.ts), so its envelope becomesX + 30 s(margin budget mode) instead ofX.
Done when
A provider-scenario test runs batch with one worst-case fold step (the #2879 ledger fake) and replay of a one-line .ad fold script, with and without --timeout. Every run ends in the daemon's typed result, never in a client timeout and daemon reset. test stays unbounded and out of scope.
Activity
thymikee commentedon Oct 20, 2026
Decision: composite request deadlines: use a daemon-side deadline for batch and replay that expires at least 30 seconds before the outer request envelope. Return a typed daemon timeout without resetting the daemon or its sessions. For replay --timeout X, keep X as the operation wall-clock budget and make the outer envelope X + 30 seconds. Keep test unbounded and outside this change. Verify the worst-case fold scenarios required in this issue.
thymikee commentedon Oct 21, 2026
Decision: bounded composite resource operations:
Bounded
batchandreplaymust reject unsupported resource operation shapes before dispatch, runtime admission, resource mutation, or native side effects. Standalone commands and direct unboundedtestbehavior remain unchanged.The rule is shape-specific. Observations and resource start, finish, recovery, report, and export paths must be assessed separately. It also applies when
open,close, or other lifecycle operations would indirectly tear down an existing resource. A registry roster alone is not proof that an operation can settle within the deadline.Use a typed refusal that identifies the unsupported shape and directs callers to the standalone operation. Preserve completed composite progress and replay source information. Do not silently cancel durable cleanup or introduce detached work to make the timeout appear successful. Do not increase execution budgets or the outer response envelope.
This selects pre-dispatch rejection rather than extending durable-resource APIs with a pending-result protocol in #3325. The existing intermediate execution fixes remain subject to full independent review, actual-head validation, and live Android/iOS evidence before publication.
thymikee commentedon Oct 21, 2026
Decision: stack review size: for the requested #3858 split, apply the 2,500-gross-line cap to each parent-to-child PR diff. Also report the cumulative
origin/main...HEADsize for each layer. This records the user's explicit choice for this stack; it does not silently change the repository-wide rule.Each layer must preserve its tests and be safe to merge after its stated prerequisites. The planned order is neutral request ownership, descriptor-owned resource admission, Android input cancellation, Android capture/lifecycle cancellation, Apple retirement and recovery, then deadline activation and public docs. The #3325 completion claim belongs to the final activation layer. No merge is authorized by this decision.
thymikee commentedon Oct 21, 2026
Current state: #3858 merged at
6ac6611ae793aa4801a502c52a4ec31d14b97602(reviewed head70b86fa1800d40b0fd4b891be0d385f164252be3). The merged deadline owner, router, timeout policy, and batch/replay fold provider tests match the reviewed head. Actual-head CI completed with 17 successful checks, one skipped, and one neutral, including Coverage, Integration and all three Smoke checks.The original deadline core is delivered: batch/replay have a daemon work budget and response margin; settled failures preserve typed timeout, completed progress and replay source. The fold ledger provider cases cover batch and replay with default and explicit budgets. Direct unbounded
testremains unchanged. Exact receipts, reviews, negative proofs and attributed simulator/Android live evidence.The accepted resource-operation-shape refusal remains unfinished and is being prepared as a separate PR against merged main. Unsupported steps must be refused before their own admission and resource/native effects; normal enclosing-request lease authentication, renewal and in-flight protection remain unchanged. Prior completed steps and replay source must survive the refusal. No follow-up PR is published yet, so this issue stays open.
No physical Apple device was available. Native-stop/no-overlap and universal settlement within the margin are not claimed. Cancellation-ignoring steps retain existing transport-timeout/liveness recovery; #3193 already preserves a responsive daemon. No devices or source sessions are held by this triage.
thymikee commentedon Oct 21, 2026
Current state: the settled batch/replay deadline core is merged in #3858. The preparatory owner layer is now open as #3887 at
f4b869ab2b1855f17540f75b32c08a13cffae508against main.#3887 adds shared read-only claim/lease inspection, device selection, registry projection and nested-test/disclosure prerequisites. It activates no unsupported resource-shape refusal. Its exact-head local checks and full independent reviews passed; new GitHub CI is running. The public evidence records the receipt, review dispositions, base-negative tests and live limits. The diff is 1,493 gross lines; merged core plus this layer totals 3,286.
The complete operation-shape guard is being implemented separately on top of that exact A head. It must retain the accepted pre-effect refusal, normal outer lease lifecycle, standalone behavior, progress/replay source and suite-owned cleanup rules. Its own parent-to-child diff is capped at 2,500 gross lines, with fresh review, exact-head validation and attributed verification before publication.
This issue remains open until the complete resource policy is delivered and its acceptance is verified. Neither the merged core nor the preparatory PR alone completes it.
Prepare shared resource ownership and selection for #3325 (#3887)
thymikee commentedon Oct 22, 2026
Current state: #3858 delivered the settled batch/replay deadline core, and #3887 is now merged as 9935ef5 (reviewed head a72c9cd; all 19 checks completed with 16 success, 2 skipped, 1 neutral). The reviewed deadline and claim-recovery implementation blobs match the merge.
The accepted resource-operation refusal policy is still unfinished. Its implementation remains local; no resource guard PR is currently open. The existing worker is continuing against merged main, followed by the remaining lifecycle and claim-recovery work and final acceptance. #3325 stays open.
A implementation, validation, and live limits.
thymikee commentedon Oct 22, 2026
Decision: resource-refusal recovery guidance: Preserve the existing ADR 0012 replay agent-takeover behavior: failed step and source/action context, cause and repair guidance, resume ordinals and plan digest, digest validation, corrective-action/last-step safeguards, and secret redaction.
For the new bounded resource-operation refusals, use the typed reason, resource shape, public command name, and plain guidance to rerun the original operation separately with its original arguments/options and the same session/CLI context. For replay, reference the reported failed script step. Do not reconstruct or emit an executable CLI command. A new full trace of earlier actions is not required; existing truthful partial progress remains.
Keep refused-step dispatched:no, no admission/resource/native effects, no post-refusal capture, and suite-owned cleanup that preserves the original failure. This changes recovery-hint requirements only; the accepted resource-refusal policy remains in scope. #3325 stays open until the remaining implementation and acceptance are complete.
The historical takeover feature is documented by structured divergence #1197 and resume #1211, first released in v0.20.0.
Merge origin/main into t3/ios-fill-performance
Merge remote-tracking branch 'origin/main' into wip-3881
thymikee commentedon Oct 22, 2026
Current state: the remaining resource guard is published in two dependent PRs: #3910 at
56c0f47covers operation/nested-suite refusals, and #3911 at37c681cadds session teardown, provider release, and claim-recovery/device-selection admission. The second PR targets the first branch.Both exact clean local gates passed, and independent Sol plus Claude Sonnet reviews report no actionable P0–P2 findings. Android verification covered batch/replay repair and resume, nested attempt cleanup, owned IME preservation/restoration, app-log teardown refusals, dead-owner recovery refusal followed by direct recovery, and Maestro app-only close. The public evidence includes receipts, negative tests, full review results, and explicit limits. Provider/cloud and non-Android selection cases retain routed/unit coverage; no physical-device or cross-daemon atomicity claim is made. All owned device resources have been released.
The simplified refusal hint from Decision6332098234 is retained, together with existing replay takeover, progress, digest/resume safeguards, and secret protection. Each parent-to-child diff is below 2,500 gross lines (1,761 and 2,156). GitHub CI is pending on the published heads. #3325 stays open until both layers merge and acceptance/admin is verified.
thymikee commentedon Oct 22, 2026
Current state: both remaining resource guard PRs are published, validated, and green at their exact heads: #3910
56c0f477has 19 completed checks (17 success, 1 skipped, 1 neutral); stacked #391137c681chas 14 completed checks (12 success, 1 skipped, 1 neutral). Coverage, Integration, guards/package checks, and all Android/Apple/Linux smoke lanes succeeded for both. Neither PR has unresolved inline review threads.The one Linux setup timeout on #3910 was retried once; dependency installation and smoke execution then passed without code or timeout changes. Its original failure remains historical. Independent Sol/Sonnet reviews and the focused #3911 size assessment are complete; exact-head local gates, negative tests, Android live verification, and documented limits are in the public evidence. All owned device resources are released.
The implementation is awaiting maintainer review/merge in dependency order (#3910, then #3911 with its base reconciled as needed). Existing replay takeover and Decision6332098234's simplified refusal hint remain intact. No merge, approval, release, or ready-for-human label action was taken. #3325 stays open until both layers merge and acceptance/admin is verified.
thymikee commentedon Oct 22, 2026
Current state: #3910 (
56c0f47) and #3911 (37c681c) remain CI-green, but new general review findings block merge.#3910's owner is reproducing and correcting repeated nested-test attempts after a typed resource refusal, while retaining legitimate retry behavior for other failures. #3911's owner is assessing the actual IME teardown and reopen paths against the accepted resource policy, plus the requested selection-route live evidence. No IME/reopen policy change has been accepted from the review alone.
The existing owners are handling these concrete follow-ups; no duplicate implementation is running. Corrected source will receive negative proof, fresh review, exact-head validation, and applicable live verification before publication. Current green CI and prior live receipts remain attributed to the published heads. #3325 stays open; no merge, approval, release, or ready-for-human label action was taken.
thymikee commentedon Oct 22, 2026
Decision: owned Android IME restoration in bounded close: Allow caller-authored
closein bounded batch/replay when its only cleanup resource is the owned test IME. Treat restoration of this automatically activated keyboard as ordinary close cleanup. This supersedes the earlier IME-only resource-refusal classification.Retain capture-handle disposal, actual provider-release, and claim-recovery refusals. Preserve existing shutdown and cancellation behavior; add no shutdown-specific ban, timeout buffer, budget, automatic retry, forced cleanup cancellation, pending-result protocol, or universal cleanup-time guarantee. Default emulator open/use/close should restore the captured original keyboard and retire its owned session on success. Failed restoration must remain an observable typed cleanup failure with its existing recovery evidence and ownership protection.
Keep the original resource-operation policy and Decision6332098234's simplified guidance for resource operations that remain refused. Preserve existing replay failed-step context, progress, repair hints and digest-guarded resume. Verify the corrected behavior with routed success/failure/cancellation controls and exact-head Android live verification; previous head results do not certify the correction. #3325 stays open until the remaining layers merge and acceptance/admin is verified.
thymikee commentedon Oct 22, 2026
Current state: #3910 is updated to
a6fd20a7577c4475bf64730db5e8e6dbaa4914a9, correcting repeated nested-test attempts after a typed resource refusal. Both request and manifest retries now stop after one refusal and one recorded prefix action; ordinary failures still retry. The exact-head local gate (6,474 related tests), independent Sol/Sonnet reviews, and Android retry-route verification passed. Updated evidence preserves older heads and adds the a6fd receipt, reviews, negative comparison and live results. Fresh CI is running on a6fd; old-head green CI is not transferred.#3911's owner has integrated a6fd locally and corrected the ordinary reopen over-refusal. The approved IME policy in Decision6346765535 is now being implemented: ordinary owned IME restoration is allowed in bounded close; capture/provider-release refusals and existing shutdown cancellation remain. The remote #3911 is still at
37c681c, so its conflict with the updated parent is expected until the complete validated correction is published. No intermediate push is planned merely to clear that indicator.All device resources from the a6fd verification are released. #3325 remains open until both layers merge and acceptance/admin is verified; no merge, approval, release, or ready-for-human label action was taken.
thymikee commentedon Oct 22, 2026
Current state: #3910 merged at 2026-10-22T19:52:11Z as b08b5e7, from reviewed b920c23. Its exact-head CI completed with 17 successes, one skipped and one neutral, including Coverage, Integration and all three platform smokes. Linux setup and smoke execution succeeded; the earlier setup failures remain historical and their underlying cause is not established. SHA-attributed evidence.
#3911 is the remaining layer. Its corrected local candidate has the approved ordinary IME cleanup, ordinary reopen correction and claim/lifecycle guards, with passing local validation and no blocking Sol/Sonnet findings. The existing owner is reconciling those patches onto actual merged main before final exact-head validation, live verification and publication. The remote PR remains at old 37c681c and now targets main; its green checks do not certify the unpublished correction or clear the branch conflict.
#3325 remains open until the remaining layer merges and acceptance/admin is verified. No device is currently assigned. The terminal #3910 watch is removed; #3911 and the existing hourly follow-up remain active. No merge, approval, release or label action was taken by this coordinator.
thymikee commentedon Oct 22, 2026
Current state: #3911 is updated on main to 87e8e21, completing the local lifecycle/claim correction after merged #3910. Ordinary IME-only close and existing-session reopen are allowed; capture/provider-release and unsafe claim-recovery guards remain. The final diff is 2498 gross lines. Exact clean validation passed with 4522 related tests; Sol/Sonnet found no blocking source issues, with review-history limits preserved. Exact-SHA evidence includes receipts, reviews, old-parent negatives, integration and live results.
Android batch/authored replay restored the original IME and retired owned sessions/claims; Maestro app-only stop and capture-refusal/cleanup routes ran. Reopen/app-switch/relaunch preserved the app-log manifest. Explicit iOS Settings open/close and owned stopped-AVD boot/shutdown succeeded. No-app iOS foreground remained ambiguous; alternate replay resume after direct close returned the documented retired-session limit. Failed native IME restore was not induced. All owned resources are released.
Exact published 87e8 CI completed with 17 successes, one skipped and one neutral, including Coverage, Integration, repository guards and all three platform smokes. Earlier-head checks remain historical. #3325 remains open for maintainer review, the final merge and acceptance/admin verification. Only #3911 remains watched; the existing hourly schedule continues. No merge, approval, release or label action was taken.
Additional reviewer-requested live proof is now published at the same 87e8 head: actual single-step bounded batches for fresh iOS Settings open (matching the standalone device), no-app foreground open with exactly one allowed booted iOS simulator, and boot by stopped owned AVD name all succeeded. Full screened JSON and original-result hashes are linked in the reviewer response. The first foreground setup was ambiguous; only the disposable simulator was rebooted before the valid sole-app run. Earlier direct runs retain their attribution. Both disposable devices were deleted and all owned state released. Source and CI are unchanged; maintainer review/merge and final acceptance/admin remain pending.
thymikee commentedon Oct 23, 2026
Current state: #3325 delivery is merged and acceptance/admin is complete.
The deadline core #3858, shared-owner preparation #3887, operation/nested-test guard #3910 and final lifecycle/claim guard #3911 are all merged. #3911 merged on 2026-10-23T09:41:03Z as 7a1bc78 from reviewed 87e8e21. All 35 B2 changed file blobs match that reviewed head in the merged commit. Exact-head CI completed with 17 successes, one skipped and one neutral, including Coverage, Integration and all three platform smokes. No unresolved inline threads remain; the reviewer explicitly accepted the three bounded-preview batch proofs in comment6353635061.
Acceptance follows the latest Decisions: daemon work deadlines and client margin, operation-shape refusal with truthful progress/source and simplified public-name guidance, preserved replay takeover, and ordinary owned IME restoration on close. The provider fold-ledger scenarios cover default batch/replay and explicit replay budgets through the real HTTP/client envelope; smaller budgets return the daemon timeout and a sufficient budget succeeds. This is cancellation-aware provider proof, not a universal native-stop guarantee. Exact receipts, independent review results, negative comparisons and SHA-attributed Android/iOS/bounded-preview live evidence are preserved in the evidence record.
The recorded retired-session alternate-resume behavior, native failed-IME-restore coverage limit, cross-daemon race window and initial foreground setup ambiguity remain disclosed; none is represented as a universal guarantee. All owned devices, sessions, claims and daemons are released; preserved worktrees and other owners were left intact. No merge, approval, release or label action was performed by this coordinator.
Closing as completed. The terminal PR watch is removed. Only this issue's hourly follow-up will be disabled after verifying closure; unrelated schedules remain unchanged.