🤖 fix: admit fresh automatic input after settled Stop - #4209
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
Security findingsAdvisory findings (3)
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
@codex review Please review current head Generated with |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8aab3bd7b3
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
8aab3bd to
463d635
Compare
|
Addressed all three findings in
Validation: 923 tests across eight suites, 240 budget tests covering the final test-seam adjustment, and canonical static on final tree Generated with |
|
@codex review Please review current head Generated with |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 463d63508d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
🛡️ Codex Security Review · Automatically triggered
Here are some automated security review suggestions for this pull request.
Reviewed commit: 463d63508d
ℹ️ About Codex security reviews in GitHub
This is an experimental Codex feature. Security reviews are triggered when:
- You comment "@codex security review"
- A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review
Once complete, Codex will leave suggestions, or a comment if no findings are found.
463d635 to
2f0a66a
Compare
|
The failed unit job on463d635 exposed14 obsolete test-seam cases after automatic publication moved to guarded batch acceptance. The fixtures now inject failure/cancellation at the real HistoryService acceptance boundary. Per-prefix failure/cancellation states no longer exist in this layer, so two batch cases replace seven old parameter cases while checking durable receipt, own-row rollback and foreign-row preservation. Five affected suites62/432 and canonical static pass; the composed lower-plus-top suite145/870 passes. Runtime Stop-cleanup review findings remain open and are being addressed separately. Generated with |
|
@codex review Generated with |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 2f0a66a0f1
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
🛡️ Codex Security Review · Automatically triggeredSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
2f0a66a to
9c3904c
Compare
|
Responses to all current findings:
Fresh reset heartbeat recovery also retains durable generation provenance through restart and optional-sidecar failure, while the real follow-up input remains the replacement witness. The combined candidate passed 1,077 tests / 4,472 assertions, followed by 39 focused cases / 169 assertions for the final cleanup-handler/test-typing delta. Canonical static checks passed on the final composed tree, and independent source/delta reviews are clean. Generated with |
|
@codex review Generated with |
🛡️ Codex Security Review · Automatically triggeredSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 9c3904c24c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
9c3904c to
4454aeb
Compare
|
Addressed both current findings:
The reported races plus the foreign-supersession notification race failed before the fix. All 765 affected tests / 3,058 assertions, canonical static and independent review pass afterward. Final phase integration on main Generated with |
|
@codex review Please review the current head after the complete phase was composed on current main. All known findings have fixes and replies in their owning layers; the eight-member phase stays held until all members are approved and green. Generated with |
|
Codex Review: Didn't find any major issues. Breezy! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
There was a problem hiding this comment.
🛡️ Codex Security Review · Automatically triggered
Here are some automated security review suggestions for this pull request.
Reviewed commit: 4454aeb7c4
ℹ️ About Codex security reviews in GitHub
This is an experimental Codex feature. Security reviews are triggered when:
- You comment "@codex security review"
- A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review
Once complete, Codex will leave suggestions, or a comment if no findings are found.
4454aeb to
d00a1ed
Compare
|
Addressed security finding 3990275294: automatic sends retain the original persisted Stop frontier from service admission through preflight and each queued addition. Dequeue uses that captured value instead of reading and adopting a newer settled V2. Batched additions must agree on their frontiers; refreshing manual Send Now authority does not reauthorize automatic siblings. The held-pricing and queued-before-foreign-Stop regressions refuse the stale payload, while fresh input after settled Stop still starts normally. Existing scoped-V1 ordinary preserve-mode admission is retained. Integration tests also cover two separate automatic messages queued after settled Stop, with and without rollover: the first replacement cannot strand its sibling on the retired nonce. Only the exact locked reset/deletion receipts advance matching captures; failed publication and foreign Stop grant no such transition. Combined phase validation: 3,715 tests across 50 affected service suites passed (34,595 assertions). Full Generated with |
|
@codex review Please review the updated head Generated with |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d00a1ed323
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
🛡️ Codex Security Review · Automatically triggered
Here are some automated security review suggestions for this pull request.
Reviewed commit: d00a1ed323
ℹ️ About Codex security reviews in GitHub
This is an experimental Codex feature. Security reviews are triggered when:
- You comment "@codex security review"
- A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review
Once complete, Codex will leave suggestions, or a comment if no findings are found.
d00a1ed to
21c37b4
Compare
|
Addressed 3991345708: a failed physical Stop returns its original error promptly while the existing workspace cleanup owner completes descendant/partial/queue cleanup. V2 waits for both that cleanup and the original producer; failed or superseded cleanup cannot qualify. Monitor retirement waits remain in the existing abortable finalizer, so they do not strand workspace shutdown. Addressed 3991345714: superseded replacement retirement now refuses automatic acceptance/startup. The committed input and reserved payload accounting remain intact; real two-instance tests cover both unsettled and settled successor Stops plus the no-successor control. Addressed 3991345726: a failed recovery-frontier capture returns through the existing retry path before any pending-work cleanup. A real generation-read failure preserves all durable files, and the restored path dispatches the pending heartbeat exactly once. Addressed 3991394425: both continuous and legacy mid-stream compaction sends receive the original stream capture. The three producer tests cover legacy and both continuous fallback outcomes, proving they cannot retire or restart after a foreign settled Stop. The cancellation layer passed 3,996 tests across 54 suites; the settled-Stop layer passed 4,064 across the same 54 suites. Its final test-only assertion adjustment also passed the complete affected 52-test suite. Both final runtime branches passed canonical static checks. Generated with |
|
@codex review Please review the updated head Generated with |
|
Codex Review: Didn't find any major issues. What shall we delve into next? Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
21c37b4 to
d8c34d1
Compare
|
@codex review Please review the updated head Final integrated validation passes on #4191 Generated with |
|
Codex Review: Didn't find any major issues. 🎉 Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
🛡️ Codex Security Review · Automatically triggeredSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
--- _Generated with `xum` • Model: `unavailable` • Thinking: `unavailable` • Cost: `$unavailable`_ <!-- mux-attribution: model=unavailable thinking=unavailable costs=unavailable -->
d8c34d1 to
02651d3
Compare
|
@codex review Please review updated head Final integrated validation passes on #4191 All eight members remain held until current-head review approval and required CI are complete. Generated with |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 02651d365f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if (record?.version === 2) { | ||
| if ( | ||
| replacementCapture.nonce !== record.nonce || | ||
| replacementCapture.generation !== record.settledGeneration |
There was a problem hiding this comment.
With XUM_ALLOW_MULTIPLE_INSTANCES=1, if this request captures a foreign V1 Stop and that same record becomes V2 before the gate/re-read completes, the capture still matches because it contains only nonce and generation; this branch therefore grants automaticReplacement, allowing work that entered while physical Stop cleanup was unfinished to publish and retire the Stop. Carry the observed version/settlement state in the initial capture, or reject captures originating from V1. Fresh evidence beyond the earlier unresolved-V1 comment is this V1→V2 transition window, which the new V2 equality check cannot distinguish.
AGENTS.md reference: AGENTS.md:L106-L106
Useful? React with 👍 / 👎.
1 participant
After ordinary Stop settles, fresh automatic monitor or family input can start a new turn without reopening the canceled continuation. This layer restores that behavior above #4191's V1 deferral using V2 settlement proof.
V2 authority waits for the captured producer/startup work and exact outer cleanup, including monitor retirement, retries, descendants, and queued-input handling. A failed physical Stop returns promptly while supervised completion can observe that same producer finishing naturally. Supersession and disposal release only the owned wait; failed cleanup grants no V2 proof. Successful exact settlement wakes deferred monitor output once. Failed physical Stop also runs the remaining outer cleanup through its existing supervisor; unresolved monitor retirement does not hold workspace shutdown.
Automatic sends retain their original persisted Stop frontier through service preflight and every queued addition. A payload admitted before another backend's Stop cannot adopt the new settled V2 on dequeue; fresh post-Stop input remains eligible. Existing scoped-V1 ordinary preserve-mode admission remains supported. Separate queued inputs remain eligible after their own accepted replacement resets history or retires Stop; only the exact committed transition advances their captures, and a later foreign Stop still blocks them. Both mid-stream compaction continuation paths retain the originating stream capture. Superseded retirement refuses automatic acceptance/startup while preserving the already committed input and budget accounting.
Fresh reset summaries retain captured generation/provenance for immediate or restarted follow-up recovery. Legacy unmarked or stale evidence grants no permission, and only the actual accepted follow-up row can retire replacement cancellation. A transient recovery-frontier read failure preserves pending work for retry. Automatic batches preserve rollback accounting; durable trigger publication makes acceptance irrevocable before fallible observers.
The legacy token-pressure guard prevents automatic compaction from bypassing scoped-V1 cleanup debt while preserving manual replacement. Already-qualified settled V2 input retains its existing automatic-replacement exception; unsupported scoped V2 records still refuse admission and remain byte-for-byte intact.
Validation includes real two-backend stale/fresh automatic sends, held startup/cleanup, cross-instance restart, failed I/O, exact notification ownership, and rejected-batch rollback with foreign history preserved. Final integrated validation passes on #4191
052fc084517c1a6fd8cfbecdf08c05b635358a32(4026 tests / 36442 assertions) and #420902651d365f63c9dc04d95744207f42f8065d6f35(4095 tests / 36847 assertions), across 54 affected suites each. Full source/test TypeScript andmake static-checkpass on both exact commits.Risk: incorrect settlement ownership can resume stopped work or strand legitimate wakes. The phase keeps failure, supersession, durability, and receipt checks separate.
This is one layer of the cancellation phase: #4214 → #4215 → #4219 → #4221 → #4182 → #4187 → #4191 → #4209. All eight PRs merge together after every member has current-head approval and passing CI.
Generated with
xum• Model:unavailable• Thinking:unavailable• Cost:$unavailable