bug(runtime-host): paused Graph recovery retries admission and fails Host startup

[99Gaoxiaoqi]

What happened

Recovering persisted Agent Graph work can prevent the entire Runtime Host from starting when the root Session cannot currently admit background execution: it is in Plan mode, or it is a legacy Session without an explicit llmConnectionId.

The supervisor retries the admission rejection three times, then its onError triggers Host drain. Startup subsequently fails with Agent graph coordinator is closed / Runtime Host startup failed and shutdown did not complete cleanly. Restarting the same data root repeats the three attempts.

Expected: preserve the durable checkpoint while that Session waits for explicit account selection / execution resume. The Host should become ready so the user can resolve the Session's configuration.

How to reproduce

This is a historical persisted-state recovery issue; an ordinary Plan toggle and restart is not a confirmed fresh-profile reproduction.

1. Use a disposable copy of a data root containing unfinished Graph work that produces a supervisor checkpoint on recovery.
2. The root Session is in Plan mode, or lacks llmConnectionId while using the ai-sdk backend.
3. Start the production Runtime Host from the unpatched source build.
4. Observe three new retryable_failed entries in agent_graph_supervisor_wake_attempts, followed by Host startup failure.
5. Start the same copy again: another three failed attempts are recorded.

Repeated with isolated copies of an affected pre-upgrade database; the original application data was not changed. A separate synthetic, credential-free Plan recovery fixture was also developed during earlier investigation. Neither the original database nor credentials will be attached.

Environment

• Source build: Maka 0.2.0, commit 5846521372d2dd0d3d2d33dc7784dd046dc3f7c8, built without the local recovery patch.
• OS: macOS 26.5, Apple Silicon.
• Surface: Desktop / production Runtime Host / Agent Graph recovery.
• Runtime used for the latest direct Host verification: Electron 43.4.1's Node 24.18.1.

Logs, screenshots, or additional context

Isolated experiment	New wake attempts	New model-call records	Result
Original state, first startup	3	0	Fails after 503 ms: missing account selection
Same root, second startup	3	0	Fails after 462 ms: missing account selection
Bind the existing account in the copy, retain Plan	3	0	Fails after 920 ms: Plan rejects background execution
Remove existing wake/attempt rows, retain unfinished Graph	3	0	Recovery generates a new wake and fails
Fresh Session, missing account identity and Plan, no Graph work	0	0	Host ready
Original state with local recovery patch	0	0	Host ready

The two admission errors are:

This Session requires an explicit account selection before it can run.
Background and delegated roots cannot execute while the Session is in Plan mode.

These are local admission attempts, not repeated model API requests. The verified behavior is three attempts per startup, recurring on restart; this report does not claim an infinite loop inside one Host process. Both Host timeouts were 60 seconds, well above the observed failure times.

Related but distinct: #3866 / #4626 concern sandbox-answer reconciliation deadlock; #4695 concerns foreground submission before a Plan transition commits.

Automated report prepared and submitted with OpenAI Codex at the human contributor's request. Codex assisted with diagnosis, reproduction, and the proposed fix.

[Adarsh-Me]

take

[99Gaoxiaoqi]

Follow-up verification by OpenAI Codex, at the contributor's request:

The current main f4abd491896d7da7f0732114630f104da9b963a2 also reproduces this with a synthetic, credential-free production HostKernel fixture: a pending Plan/Graph wake gains three failed attempts and the Host fails with INTERNAL_STARTUP_FAILURE. Fixed commit d8eb4abf772b761f40991e1f5874ca7442db048a opens the same database and remains ready without adding attempts. Neither run constructs a model backend. The synthetic run reported produced no reconciliation result; the historical-data runs above also reported Agent graph coordinator is closed.

For a directly reproducible test case, the fix includes four production-composition recovery regressions: configuration resume, ordinary Plan approval, foreground Plan execution, and missing connection identity followed by explicit account selection. All four fail against the baseline implementation and pass with the fix. Use a disposable checkout:

git clone https://github.com/apache/maka.git maka-4991-repro
cd maka-4991-repro
git fetch https://github.com/99Gaoxiaoqi/maka.git fix/defer-paused-graph-wakes
git checkout --detach f4abd491896d7da7f0732114630f104da9b963a2
# Bring in only the new tests; production implementation stays at baseline.
git show d8eb4abf772b761f40991e1f5874ca7442db048a:packages/runtime-host/src/__tests__/execution-composition.test.ts > packages/runtime-host/src/__tests__/execution-composition.test.ts
npm ci
npm run build
node --test --test-name-pattern="production Graph recovery keeps a paused wake" packages/runtime-host/dist/__tests__/execution-composition.test.js

Expected baseline: all four cases fail because recovery adds attempts while the Session is paused (attemptCount is 3, expected 1). In a separate clean checkout of the fix commit, build and run the same command: all four pass, and recovery after explicit resume delivers the checkpoint once. These regression tests use synthetic stores and FakeBackend for post-resume execution; they exercise production admission and need no account or API key.

Final fix validation: 205 related tests passed; root build, lint, format, typecheck, both required knip checks, ASF headers and the protocol epoch guard passed. No original user database, credentials or application backups are shared.

[99Gaoxiaoqi]

Coordination note from OpenAI Codex on behalf of the reporting contributor: the fix already prepared during diagnosis has now been submitted as #4992, covering both Plan pause and missing connection identity, with the regression results above. Posting the link here to avoid duplicate implementation work after the recent claim.