stop-messages-from — WorksGood live mirror

Metadata

Status	done
Assigned	`agent-888`
Agent identity	`fbb2d89fe44d6b761bcb4b67748ab3d417f29df70a65f8d9403308f5bb2bab78`
Created	2026-07-26T11:48:17.160790889+00:00
Started	2026-07-26T13:34:53.016110567+00:00
Completed	2026-07-26T14:26:48.939719409+00:00
Tokens	26814128 in / 45801 out

Description

Emergency objective

Eliminate the coordinator behavior logged as Resurrection: reopened due to N pending message(s). A message to a dead agent, terminal attempt, or terminal task must NEVER wake it, reopen the source, refresh liveness, make it ready, transfer ownership, or spawn work. Period.

Required semantics

Messages are durable inert data by default and remain inspectable/auditable. Delivery alone performs no task transition.
Only a currently live attempt explicitly persisted in Waiting(Message) with a matching task/attempt epoch and subscription may request one idempotent resume transition.
Messages addressed to dead/terminal/stale epochs are retained as undeliverable/history; they are not silently retargeted to a later attempt. A human must explicitly reopen/retry and may choose to import history.
Remove pending-message count from generic coordinator readiness, resurrection, liveness, reaper, and done-reconciliation logic. Daemon restart and historical unread messages remain inert.
Repeated/duplicate messages are idempotent and cannot generate spawn storms. Preserve ordinary messaging to live workers and chat surfaces.
Add an exact operator diagnostic showing message state/recipient epoch without implying execution state.

Validation

RED-first regression reproduces Done -> pending message -> Open -> spawn on the old code.
Real daemon/CLI smoke: send many messages to Done, Failed, Abandoned, dead-attempt, and stale-epoch recipients; statuses, readiness, liveness, attempts, worktree ownership, and spawn count remain byte-for-byte unchanged.
Explicit live Waiting(Message) resumes exactly once on its matching message and no other message.
Live worker messaging still delivers normally without changing task status.
Restart with historical pending messages causes zero resurrection/spawn.
Permanent owned smoke scenario and grow-only manifest entry land.
Global binary is installed; focused tests, cargo fmt --check, cargo clippy, build, and smoke pass.

## Emergency objective
Eliminate the coordinator behavior logged as `Resurrection: reopened due to N pending message(s)`. A message to a dead agent, terminal attempt, or terminal task must NEVER wake it, reopen the source, refresh liveness, make it ready, transfer ownership, or spawn work. Period.

## Required semantics
- Messages are durable inert data by default and remain inspectable/auditable. Delivery alone performs no task transition.
- Only a currently live attempt explicitly persisted in `Waiting(Message)` with a matching task/attempt epoch and subscription may request one idempotent resume transition.
- Messages addressed to dead/terminal/stale epochs are retained as undeliverable/history; they are not silently retargeted to a later attempt. A human must explicitly reopen/retry and may choose to import history.
- Remove pending-message count from generic coordinator readiness, resurrection, liveness, reaper, and done-reconciliation logic. Daemon restart and historical unread messages remain inert.
- Repeated/duplicate messages are idempotent and cannot generate spawn storms. Preserve ordinary messaging to live workers and chat surfaces.
- Add an exact operator diagnostic showing message state/recipient epoch without implying execution state.

## Validation
- [ ] RED-first regression reproduces `Done -> pending message -> Open -> spawn` on the old code.
- [ ] Real daemon/CLI smoke: send many messages to Done, Failed, Abandoned, dead-attempt, and stale-epoch recipients; statuses, readiness, liveness, attempts, worktree ownership, and spawn count remain byte-for-byte unchanged.
- [ ] Explicit live `Waiting(Message)` resumes exactly once on its matching message and no other message.
- [ ] Live worker messaging still delivers normally without changing task status.
- [ ] Restart with historical pending messages causes zero resurrection/spawn.
- [ ] Permanent owned smoke scenario and grow-only manifest entry land.
- [ ] Global binary is installed; focused tests, `cargo fmt --check`, `cargo clippy`, build, and smoke pass.

Depends on

Required by

done fix-admission-deferrals

✉ Messages 7 messages (7 unread)

#1user2026-07-26T11:52:06.449668666+00:00delivered

The already-running authoritative lifecycle task was instructed to land the emergency message-inertness patch first after a live `.respond-*` resurrection. Treat that commit as candidate input: independently run the full RED/live matrix, fill any missing direct-reopen or child-responder paths, then install globally. Avoid parallel duplicate implementation.

#2quality-pass-dead2026-07-26T12:00:54.781095602+00:00delivered

Architecture gate complete: follow docs/design-dead-message-resurrection-hotfix.md. Keep the diff scheduler-authority-only; preserve/audit messages; bind at acceptance to attempt epoch; only atomic live Waiting(Message) may request one resume. The doc contains the required behavior matrix, real-daemon spawn/transition fingerprint smoke, legacy migration, mixed-version warning, and safe rollback. Reject any solution that deletes/marks-read messages or only checks final status.

#3implement-authoritative-lifecycle2026-07-26T12:17:52.604958584+00:00delivered

Emergency implementation is being landed here per user: coordinator pending-message resurrection and automatic  creation are removed. Please remain independent verification only and do not modify coordinator/message lifecycle seams; validate installed daemon behavior once my commit is pushed.

#4implement-authoritative-lifecycle2026-07-26T12:17:59.216675032+00:00delivered

Correction: please verify the .respond-* non-creation invariant independently; do not modify coordinator/message lifecycle seams.

#5implement-authoritative-lifecycle2026-07-26T12:24:01.907435373+00:00delivered

Emergency implementation c29ed648 is pushed and exact commit installed globally. Please independently exercise the live daemon against terminal messages and verify no reopen or .respond-* child; report evidence only.

#6implement-authoritative-lifecycle2026-07-26T13:34:56.828921952+00:00read

Authoritative lifecycle implementation is merged to main as 1a265631 (task commit 65b29a1a; emergency patch c29ed648). Permanent credential-free real daemon/CLI smoke tests terminal/open/running message neutrality, no .respond-* child, exact one-shot Waiting(Message) wake, stale worker fencing, restart idempotency, and ledger metadata. Please perform independent verification against merged main.

#7stop-messages-from2026-07-26T13:35:05.709852949+00:00read

Acknowledged — I will independently verify merged main/installed binary with the permanent real-daemon smoke and focused lifecycle/message tests, inspect for missing direct-reopen or responder paths, and make no duplicate lifecycle changes unless verification exposes a gap.

Log

2026-07-26T11:48:17.145809506+00:00 Task paused
2026-07-26T11:48:22.737282328+00:00 Task published
2026-07-26T13:34:53.111495555+00:00 Spawned by coordinator --executor pi --model openai-codex:gpt-5.6-sol --isolation required-worktree
2026-07-26T13:35:05.783198992+00:00 Starting independent verification of merged authoritative lifecycle/message inertness implementation; no duplicate implementation unless a concrete gap is reproduced.
2026-07-26T13:38:32.577991919+00:00 Candidate smoke passed against installed binary, but independent design audit found acceptance gaps: messages do not persist recipient attempt epoch/disposition; Waiting(Message) matches by timestamp only with no persisted subscription/CAS; msg list JSON lacks exact recipient-epoch diagnostic; scenario omits Abandoned/dead-attempt/full fingerprint/spawn ledger and is not owned by this task. Implementing the missing bounded message metadata/subscription + owned smoke coverage.
2026-07-26T14:12:09.547682942+00:00 Implemented missing quality-gate semantics: acceptance-time recipient generation/attempt/subscription binding; fail-closed legacy waits; persisted one-shot selector/CAS receipt; exact msg-list JSON disposition/current epoch/reason/resume diagnostic; no generic coordinator message phase. Expanded owned real-daemon smoke to terminal/dead/stale/live bursts, full fingerprints, nonmatch + one consume under 20-message burst, and restart. Installed candidate and smoke passes.
2026-07-26T14:25:19.499883225+00:00 RED-first evidence: archived vulnerable parent c29ed648^ and ran its focused coordinator regression; output was '[dispatcher] Resurrection: reopened Done task done-task (1 message(s))' and the old test asserted Done→Open. Current owned live smoke then passed all three daemon phases with zero spawn/ownership/readiness drift.
2026-07-26T14:25:19.552369233+00:00 Validated: cargo fmt --check PASS; cargo clippy --all-targets PASS (repository warnings only); cargo build --locked PASS; 37 message unit tests PASS; 36 integration_messaging tests PASS; wait tests and exact subscription/nonmatch/legacy fail-closed coordinator tests PASS; installed-binary lifecycle_message_is_data smoke PASS; final cargo install --path . --locked PASS. Full cargo test ran for 300s and timed out after known unrelated route/profile drift failures (dispatch plan + named-profile role overrides), with no lifecycle/message failures.
2026-07-26T14:26:35.824820046+00:00 Committed: 6d4dfae0 — pushed to remote
2026-07-26T14:26:48.939719719+00:00 Task marked as done