Files
PaperClipAI/server
DottaandPaperclip 215586d127 fix: settle interrupted preparation with a retained cancellation fence (#15022)
## Thinking Path

> - Paperclip is the open source app people use to manage AI agents for
work.
> - A cancelled preparation must preserve history while allowing a new
user turn.
> - Older preparation can retain its cancellation fence but omit the
unwind marker.
> - The controller from that older boot is gone, its lease expired, and
no provider started.
> - Use the same narrow preparation proof for this retained-fence state.
> - The benefit is working Retry and saved-message recovery after
interrupted startup.

## Linked Issues or Issue Description

Refs #15020 and #15015. Related #13293 addresses post-launch recovery.

**What happened?**

A preparation interrupted before native selection retained
`startupCancellation.beforeNativeSelection: true` but no
preparation-settled marker. Its owner expired across restart and it had
no environment leases. The missing-receipt compatibility rule did not
recognize the retained fence, leaving Retry absent and saved messages
deferred.

**Expected behavior**

Admit one new user turn when the preparation evidence agrees, the old
controller expired, and cleanup is complete. Preserve previous results
and do not replay the cancelled input.

**Steps to reproduce**

1. Cancel Paperclip Runner preparation before runtime selection.
2. Retain the cancellation fence without an unwind marker or environment
leases.
3. Restart after its old controller lease expires.
4. Send a new message, select Retry, or allow the saved-message worker
to reconsider new input.
5. Confirm one successor receives only undelivered input. Repeat with
live ownership, invocation evidence, or pending cleanup and confirm
execution stays held.

**Paperclip version or commit**

Reproduced on `94f6f3eb4`.

**Deployment mode**

Authenticated private self-hosted server, built from source.

## What Changed

- Accept a retained before-selection cancellation fence in the expired
historical preparation proof.
- Retain runtime, stage, adapter, ownership expiry, process, event, and
cleanup requirements.
- Extend Retry, fresh-message, partial-queue, concurrent-worker, and
contradictory-evidence tests to both receipt states.
- Document recovery when the preparation-settled marker was not
retained.

## Verification

- Red: five exact-state regressions fail on the parent commit.
- Green: all 203 continuation tests pass, including the five new
regressions and 13 additional negative evidence cases. Process recovery
and queued-comment routes add 413 passing tests.
- A read-only candidate service check against the retained live run
returns Retry eligibility without changing any task state.
- An unrelated containment assertion failed once in CI. All 85 tests in
that route suite pass locally and the CI shard passes on rerun.
- Workspace `pnpm -r typecheck` and `pnpm build` pass.
- Final head `48240de3d`: all 54 CI checks pass, two optional Storybook
checks skip, and Greptile is 5/5 with zero unresolved threads. The
complete local monolithic suite is covered by sharded CI; the earlier
local run was stopped after a workspace case failed, and that case
passed in isolation.
- After merge, deploy the exact merged commit and verify an actual agent
reply through the task composer.

## Risks

A cancellation receipt alone must not certify that provider execution
stopped. This path still requires unresolved preparation, no native
identity or coordinator, an expired controller from another boot, no
launch or provider evidence, and completed environment cleanup.
Current-boot preparation remains held until it settles. No schema or
dependency change.

## Model Used

OpenAI Codex, an agent based on GPT-6. The exact runtime model ID and
context window are not exposed in this session. Used reasoning,
repository tools, code execution, and browser inspection.

## Checklist

- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have searched GitHub for duplicate or related PRs and linked
them above
- [x] I have either (a) linked existing issues with `Fixes: #` / `Closes
#` / `Refs #` OR (b) described the issue in-PR following the relevant
issue template
- [x] I have not referenced internal/instance-local Paperclip issues or
links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip`
URLs)
- [x] My branch name describes the change (e.g. `docs/...`, `fix/...`)
and contains no internal Paperclip ticket id or instance-derived details
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] All Paperclip CI gates are green
- [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups
- [x] I will address all Greptile and reviewer comments before
requesting merge

Co-authored-by: Paperclip <noreply@paperclip.ing>
2026-10-03 00:04:21 -05:00
..