Cancellation provenance: five decisions deferred out of PR 13436 #13502

Active client-close follow-up — 2026-10-08

The active/admission-waiting client Close path is implemented and verified in the still-unmerged PR at 82129f6aad3964dab991cc8fbb69108e081791d8. Local checks and actual native tmux pair show REST Close persists user intent and cold Continue refuses it without a new provider request; runtime disposal remains recoverable. Closing a session that was already idle after an earlier interruption still needs a durable closed marker. Legacy cancellation provenance and unmarked cron/steering ownership remain open. This is a partial implementation update, not acceptance of those limitations or full #6710 closure.

中文：active/等待准入的主动 Close 已实现并验证，原生重启对照拒绝续跑且不新增模型请求；runtime disposal 仍可恢复。先前中断后已空闲再 Close 的持久化关闭标记、旧取消记录来源及无标识 cron/steering 归属仍开放，不宣称完整关闭 #6710 或接受兼容损失。

Why this issue exists

This issue tracks the remaining cancellation-provenance decisions. PR #13436 is open and unmerged, currently at 82129f6aad3964dab991cc8fbb69108e081791d8. The five sections below retain the historical findings from 59937eb561; their old line numbers/signatures and claim that work had shipped are not current implementation or release facts. The design describes known limitations pending a maintainer ruling, not accepted compatibility losses.

Current disposition

Local checks, actual native daemon/ACP tmux pair and byte identity. Six concrete follow-up Criticals are resolved; the unmarked-tail Critical remains open for the residual boundary, as does legacy provenance. This issue stays open.

Test pins for the same area are tracked separately in #13478 and are not duplicated here.

1. cancelledAt is read as user intent, but pre-#13436 builds stamped it for every controlled abort

isLastApiPromptCancelled returns true on state === 'cancelled' && cancelledAt !== undefined (packages/core/src/services/session-api-history.ts:156). At the merge base, recordAdmissionCancellation stamped cancelledAt unconditionally and every non-dispose abort resolved to USER_CANCEL_ABORT_REASON, so a prompt deadline, an HTTP response-close or a superseding prompt all persisted turn_result{state:'cancelled', cancelledAt}.

A user upgrading from a pre-#13436 build therefore has those turns read as explicitly cancelled: buildSessionRecoveryPlanFromApiHistory certifies {kind:'clean', canContinue:false} and recovery is permanently refused, with no version gate able to distinguish the record from one this change wrote.

Needs a new provenance field on the persisted turn_result, written only on the user-cancel branch, threaded Session.ts -> chatRecordingService -> turn-result-record.ts -> session-api-history.ts (four files, two packages). It must stay inside TURN_RESULT_IDENTIFIER_MAX_CHARS, whose validator makes recordTurnResult silently drop over-contract payloads.

2. The unmarked-entry rule is fail-open; which way it should break is a product ruling

getLastApiHistoryPromptId stops at the last user-shaped entry and returns that entry's mark (session-api-history.ts:96-110), so an unmarked tail yields undefined and isLastApiPromptCancelled bails at :124-125. Four producers are confirmed:

• a reminder-bearing notification — only a bare <task-notification> envelope is trimmed, and the live continuedPromptId call site omits ACP_API_USER_PROMPT_OPTIONS
• a cron or loop echo — isSystemNotificationRecord excludes 'cron' and createNotificationRecord never sets promptId
• a pushed mid_turn_user_message — appendApiHistoryRecord marks only type === 'user' && !subtype
• a steering entry pushed after a dropped code_mode_tool_result (session-api-history.ts:305), which makes the merge branch see a model previous and push unmarked

When one lands after a cancelled turn, recovery stays available and a restart can re-offer work the user explicitly stopped — the behaviour #6710 was closed against.

Both candidate fixes were measured and both collide with the documented rule "a newer unmarked user entry prevents an older cancellation from being reused": the mark-based variant breaks 2 tests #13436 added, the hint-based variant breaks 1. Any fix must skip the unmarked entry rather than stamp it, because findApiHistoryPromptIndex returns -1 when one promptId marks two entries. The ruling needed: re-open #6710 for these entrances, or accept re-executing stopped work.

3. Producer-side owner resolution (closes two findings at once)

recordTurnAttempt(promptId: string | undefined, ...) accepts undefined and durably appends an unlinkable turn_attempt (packages/core/src/services/chatRecordingService.ts:3419-3421), while the write guard checks continuesCurrentWorkChain && daemonPromptId && !reattemptRecorded and never continuedPromptId (Session.ts:6907-6911). The owner scan then adopts any later attempt hint with no identity check (session-api-history.ts:133) and rejects on owner.promptId !== promptId (:138), so one ownerless record flips the classification permanently.

The same producer-side gap is what leaves a Retry/Continue cancelled before the model send with a cancelled turn_result and no turn_attempt. Resolving the owner from the accepted recovery plan instead of re-deriving it from live history closes both.

The reader-side alternative is contested: the design doc states "a binding with unknown identity keeps recovery available", so a reader guard that skips unknown-identity bindings needs that sentence overturned first.

4. Two ChannelAgentBridge cancels still cannot express provenance

ChannelAgentBridge.cancelSession(sessionId: string) (packages/channels/base/src/ChannelAgentBridge.ts:292) takes no metadata, so two infrastructure cancels reach the absent-key arm and are stamped user intent:

• ChannelBase.ts:2800 — cancelTimedOutLoopPrompt, reached from the loop-deadline race
• DaemonChannelBridge.ts:925 — void session.cancel() inside stop() teardown

This contradicts the design doc's own rule that deadlines and session teardown carry interruption. Needs the interface widened plus both implementations and both call sites.

The third site named in the same finding — session-dispatch-port.ts over-budget enforcement — was handled by #13436 at 59937eb561; its bridge is the narrower AgentSessionBridge pick, so it needed no widening.

5. Goal pause reasons have no infrastructure-interrupt member

Four GOAL_PAUSE_REASON_USER_INTERRUPT producers exist in Session.ts; #13436 folded INTERRUPTED_PROMPT_ABORT_REASON into two of them, so a Goal turn killed by infrastructure is journalled, carded and emitted as "Interrupted by the user. Run /goal resume to continue." The other two producers read no reason ladder at all.

goal-protocol.ts carries nine pause-reason constants and none means infrastructure interrupt. Needs a new member plus a shared mapping helper across all four producers.