Repository navigation
Integrate native inbox delivery, recovery and compiler corrections - #1092
Merged
Merged
Conversation
When the attempt advertises observer-transfer-v1 and the recorded native is still live, a missing or nonterminal status no longer blocks observer recovery. Keeper attestation and the existing transfer handshake still decide the handoff; without the keeper the recovery refuses EBUSY. Add a fixture case that keeps the native alive and verifies the observer is transferred or retired without killing the native.
Receive.wake_stand reads the pending input and launches it after releasing the session lock when the obligation is held. The law stated the earlier form that always returned Done. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…ceivers admitted Control.receiver_admitted has no stopped-session clause since 250e0f9 ("Keep stopped receiver refresh available"). test_receiver_refreshes_stopped_ and_refuses_unsupported_or_missing_sessions in bend2/test/control.py and docs/bend2/installation.md specify that behaviour. The law still required NOT stopped_session_sql, so it is corrected here and renamed. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The read-call ROLLBACK before close is already on this line (172b13b). This commit carries only the projection fixture tests of 3b124a9: a non-current install against a retained read holder, and a commit that unblocks only after the reader rolls back. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The fixture compiled only the projection installer and busy handler. Include the verbatim read-call section and run a retained read transaction through it before checking that a write commits after the call returns.
The read-call fixture now opens a second connection after baton_sql_read_call returns and commits a write, so process exit cannot release the read lock before the check. The close shim records the connection autocommit state and refuses to close an active transaction; the pre-fix source leaves autocommit=0 and the writer fails with database is locked, while the candidate rollback makes autocommit=1 and the writer commits.
The close shim returned SQLITE_BUSY for an open read transaction, which real SQLite does not. The fixture now calls the real sqlite3_close and reports the actual writer result. The real regression passes on pre-fix f589303 and the candidate, so the read-call close does not explain the observed inbox stall. The source rollback remains as hygiene.
A retained start admitted under a held usage window kept its execution row in phase starting. The row blocked configure for a harness or model change until the window reset, although no native process was ever launched. window_held_start now deletes the row that this admission wrote, under the session lock and before the lock is released. The focused wake-path fixture covers the held start and a route change admitted after it. Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>
The server and app.js emit and read unreadCount, but attention.js, document.js, knowledge.js, order.js, selection.js, the fixtures and the tests still used unacknowledgedCount, so reports owed to a seat dropped out of ordering, the attention band and the knowledge view. The stream also listed the removed 'receipt' change kind, so a recorded read did not refresh the pending counts; the change trigger now records kind 'read'. ui-orchestra-server.test.mjs: 20 pass, 1 fail, 1 skipped, the same single native-binary failure as main. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Takes fix/issue937-wake-starting-20261022 at ff68443 (terminal settlement policy with the linearity repairs) on top of the combined #937 and #950 line. receive.bend conflicts resolved as follows: - start_admitted keeps the writer-lease wrapper and the retained ticket, and carries the Turn.retained Result into started_result. - recover_owned_arguments keeps the writer-lease wrapper and passes the attach_owned Result to recover_owned_attached. - attach_handle keeps the lease-aware attach_recorded and binds the handle with +, as attach_recorded_result does in ff68443. - recover keeps recover_unlocked and recover_tail. recover_tail reports a failure that is not a SQLITE_BUSY blocked cause through report_recovery_pass. - report_recovery_failure, which has no caller, is not carried. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
sqlite-projection.py: the projection now installs 38 native_changes triggers (the message_reads trigger is new) and the messages_recipient_seq index replaces messages_pending, so four trigger counts and the index name were stale; all 13 tests pass again. accept-receive-recovery.py: the controlled-native check required a receipt on every message, but reads no longer write receipts. It now requires a read row for every message, as the driver script already does. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
usage-windows-wake-path.bend delivered through a callback that counted messages with receipt IS NULL and wrote receipt='delivered'. Receipts no longer gate delivery, so the callback now counts owed messages with the shared predicate, records only the delivery, and the checks that expected receipt 'delivered' assert the stored receipt stays empty. A message built with a receipt gets a legacy read row, as in usage-windows-wake.bend, and the --wake-message path reads the owed recipient with the same predicate. usage-windows-wake.bend declared message as returning IO<Unit>; every other definition writes IO(Unit). Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
/run/baton2-native-homelab is a bind mount of the homelab storage. realpath(3) keeps the spelling of a bind mount, so Baton stored paths under /run. Those paths stop naming a directory when the mount is absent. Rewrite the run prefix after each stored realpath in host/control.c (identity, workspace, command, output and agent helper) and in SessionLock.executable. The rewritten target must exist. When the run spelling also exists, both must name the same file. recruit canonicalizes --path before git worktree add. SessionLock.canonical is not changed. Its result is the database lock identity, and try_acquire takes its own realpath, so a one-sided remap would split lock identities. Add scripts/worktree-remap.mjs, a one-shot recovery that rewrites session rows and runs git worktree repair for worktrees that still name the run spelling. Dry-run is the default. Refs #972 Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>
…ption Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
A refusal with no reset time left the owed input with no scheduled wake, so the seat waited for an operator to clear the hold. A named 5-hour or 7-day window now records its upper bound as the reset time. An exhausted window with no recorded reset is held until its latest refusal plus one hour. The continuation then admits the owed input as the probe. A successful attempt writes a provider-success row that clears the refusals it began after. Refusals recorded inside the attempt keep their hold. Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>
Conflicts resolved in the 22 files both branches change: - agent-actions, agent-route, agent-input, wake, delivery: keep #1007's concise action surface and Codex route, remove the acknowledge verb, Acknowledge action, handling scope and settle_codex functions, and use the shared owed predicate instead of receipt IS NULL. - codex-inbox-wake.mjs: deleted as in #1007. Its #723 changes move to the Bend port: the wake trigger fires on message_reads inserts, pending and read counts derive from the read rows, and the terminal report no longer settles input. - mcp-conductor.mjs: baton2_ack removed; the Claude Stop hook records no settlement (reads are recorded when the input is read). - Commit 74097e1 (success-only consumption of delivered inputs) is not carried: consume_delivered, consume_delivered_sql, consume_completed and the completed() native parameter are removed. - accept-*.py drivers, codex-root, compare-coordinators, fixed-coordinator, mcp-root, omp-root and root-wake tests, and the agent-commands and native-question-reply documents take #1007's command surface with #723's read wording. The Claude Stop-settlement tests in mcp-root.py become tests that Stop events leave recorded reads unchanged. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
stop.bend: the clear-stop result counted retainedInputs as messages with receipt IS NULL, which counts every message now that nothing writes a receipt. It counts owed inputs with the shared predicate. receive.py, receive-output.py, check-message-read-index-native.py: nativeInputStatus no longer carries handled and message_reads.handled is no longer written, so the checks read the read state and the read row. ui-orchestra-native.py and accept-root-day.py: the owed-input query and the guidance assertion use read rows instead of receipts. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
message-read-derivation.py named nine definitions and four driver scripts, so stop.bend clear_result_sql kept receipt IS NULL unnoticed. The check now reads every coordinator .bend file except the message-status backfill and every script under bend2/scripts. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
branching-model.bend listed pending Player input with receipt IS NULL and reported the stored receipt of each report. It now uses the shared owed predicate and reports whether the report was read. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The coordinator receive-focused compile overflowed the machine stack twice on one input: first in the carb-phase term_const recursion, then, with that fixed, in pass 1. Two corrections, both on the pinned compiler overlay (bend2/compiler/upstream/comp.ts): - Port the merged CONSTS bound (flip-engineer/bend PR4, source 16b84e13de3a8590ff171e504d0edb56f77f63db): check the cache size after recursive predicate evaluation and immediately before its sole insertion, so recursive frames cannot exceed the 65,536-entry bound. - Convert the recursive walks on the pass-1 path to explicit-stack iteration. v_drop's ann_live and type_live overflowed on deep annotation chains; both now walk pre-order over an explicit stack. The emission tail chains (emit_body, emit_fuse, emit_fork, emit_expr, anf's go) recursed one JS frame per sequential bind or inlined call, and term_any recursed per term level; all now loop or carry an explicit stack, preserving short-circuit and fuse/fork restore order. A/B against the deployed compiler (release 2.0.25-f5185e38-pr967-pr968-e5c4efd-gc1017-bun144-20261023, comp.ts 03552ec6) on the upstream compile and reg suites: 212/212 programs produce byte-identical C or identical failures.
Preserves the PR1087 arm-sharing and convergence regions in bend2/compiler/upstream/comp.ts and adds the audited iterative pass-1 liveness and emission walks from 83da131.
comp.ts moves to the integrated PR1087 plus iterative-emitter source (07714635, 227001 bytes); provenance lock_sha256 is recomputed over the refreshed lock. The maintained staging check verifies provenance against the lock and stages the integrated comp.ts.
Adds archive f22a9bc5 (PR1087 arm sharing, CONSTS insertion bound, iterative pass-1 emitter, Bun 1.4.4 launcher, binary 5de0b620) to the retained compiler allowlist, makes it the workflow default retained archive, and names it in runtime-pin.txt. prepare-native-compiler.py selects it on the homelab runner and extracts the integrated comp.ts 07714635.
The GitHub App credential cannot push workflow files. The corrected archive f22a9bc5 is selected through the existing retained_compiler_archive workflow inputs and the allowlist; the default change is retained as a patch for a workflows-permitted actor.
Merge 846fbdc left two copies of busy and busy_again in the coordinator store; the compiler rejects the duplicate declaration and the b148 receive-focused qualification cannot start. Keeps the copy documented at apply_through_busy.
Retain one copy of the shared store busy helpers while merging the two duplicate-helper corrections. Select the qualified emitter archive and digest for default candidate and target builds, preserving explicit compiler inputs. Co-authored-by: OpenAI Codex <337142399+flip-baton-gpt[bot]@users.noreply.github.com>
This was referenced Oct 26, 2026
Open
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This integrates the retained native-inbox, complete-read, recovery, account-usage and branching work with current main and the corrected Bend compiler. It makes the combined source available for normal package delivery.
Complete owned reads persist in
message_reads. Prompt selection, PostToolUse and Stop hooks derive unread input from those rows. Read admission validates the native conversation, attempt, message body and receiver context. DSH receives complete message bodies. The native Codex inbox route retains its delivery and completion state. Recovery keeps recorded native identity and source context.The compiler includes the bounded constant-cache insertion, iterative emitter traversal, constructor-coverage comparison and finite fact convergence corrections. The maintained self-hosted workflow selects archive SHA256
f22a9bc5d42ebe57d0e46240a5ca407e673bc84a4ba21e6ad2c693cf44b8d651by default for candidate and target builds and preserves explicit compiler inputs. Root verified the installed archive and backend selection. No overall C-generation speedup or permanent memory resolution is claimed yet.Root reviewed the merged messaging paths and corrected the old receipt-settlement conflict. The focused Stop entry passed Bend type and ownership checking; its single native C-generation request is still running through the maintained shared queue. Full package installation and live wake/chat-delivery verification remain open. README bytes match current main.
Included source branches:
00bb79a241a6d45a9d68a74d4794f552b6c49d09f099d2bf3a4e122000a6c2caa9a07448e94b047e8a23cfb6c9e4de2706a409933806bbfe326cd72e938b52ed0c52e207a8c7a33674431b10af491d6514f0749c00272d5f419adabbc294e873f32e4c2df6a8ae1b6a81579ce04b16e107c5c218989767c30e58c9c21214d302f23ec037598a76fef19da111974fb90942fc9afc89ce0cdfd8f3933a1e40d618def1defb92ddceb4066e7e15f95a603b731fb053ab0636c3d821669659d9cb968d0728155131a2500540d1af220e6224140c4eb758b37f7398ccfad9108977cc1d6d1267a1365255ea24acf020f0e3cd91eb459479ef78bfa91bb2c19a67b0a178c8cb16Refs #1054, #776, #723.