OMP ACP lifecycle: settlement, Stop, crash, restart, status, notifications #73

Summary

Prove and fix the OMP ACP session lifecycle — start, settle, Stop, crash, restart and reattach — and its status, notification and title side effects at least as strongly as the hook-driven legacy path.

Context

• 44madfire/orca#20 reliability list: one writer, fail-closed ownership, no automatic resend, generation-safe cancellation, correct interrupted tools, settlement, crash → explicit failed/stopped, no stale mutation after replacement.
• Legacy status comes from OMP hooks (src/main/agent-hooks/server/server-lifecycle.ts; retired-pane revival src/main/agent-hooks/server/server-status-disposition.ts:74 @76d1b7b). Structured sessions publish into the same store (src/main/native-chat/agent-session-wire/structured-agent-session-status-feed.ts:214, src/main/agent-hooks/server/server-ingest-structured.ts:26 @76d1b7b).
• ACP Stop ends the child after the prompt settles (or 4 000 ms after the cancel) and the next send reloads (src/main/acp/acp-structured-session-adapter.ts:180-187, src/main/acp/acp-structured-stop.ts:25-46 @76d1b7b). The child is ended by stdin EOF first, then a graceful window before any kill: win32 1 500 ms before taskkill /T /F; POSIX supervisor 1 000 ms → SIGTERM → 3 000 ms (src/main/provider-process/provider-process-close.ts:43-50,67-89, provider-process-supervisor.ts:4-21,93-118).
• OMP answers cancelled before its abort persists (packages/coding-agent/src/modes/acp/acp-agent.ts:1086-1100 @53f253f; entry lands 5–28 ms later) but on stdin EOF awaits the pending cancel cleanup before disposing (:161-163,2756-2767). Measured on real 18.6.3/win32 (docs/plans/omp-acp-migration/v2/risk-findings/stop-persistence.md): 34/34 aborted entries persisted with Orca's timing, 0/22 when killed at the response. Residual [INFERENCE]: an abort slower than 1.5 s on win32 would lose the entry; none reproduced.
• Legacy cold restore reopens OMP tabs as terminal view (src/renderer/src/lib/sleeping-agent-session-launch.ts:129 @76d1b7b).
• Reattaching an ACP-created chat uses the handle-chain head and the same workspace cwd as creation (src/main/acp/acp-structured-launch-resolution.ts:105-120,110 @76d1b7b). OMP persists the session before answering session/new (packages/coding-agent/src/modes/acp/acp-agent.ts:1231 @53f253f). So OMP's recorded-cwd check passes, and a missing file takes Orca's explicit "not restored" path (src/main/acp/acp-session-reopen-failure.ts:28-37). No adoption-only provider fix is needed.
• The context ring on reopen comes from the journal (src/main/native-chat/agent-session-wire/structured-agent-session-options-read.ts:163). session/resume skips replay (acp-agent.ts:714-723); Orca has an unused resumePreference knob (src/main/acp/acp-session-setup.ts:29,48).

Scope

• Starting/ready/failed states; settlement for end_turn, cancelled, refusal, max_tokens, errors.
• Stop: cancel, teardown, next send resumes; abort persistence verified (provider issue if reproduced).
• Crash/exit: explicit failed state, unsettled sends unknown, never resent; generation fencing after replacement.
• Restart and reattach: OMP structured tabs restore from the journal (the restart modal is expansion). Reattach uses session/resume via resumePreference (spec-level option; load when resume is not advertised). The ring is shown from the journal. Terminal OMP cold restore is unchanged.
• Store drift: if the agent dir or profile OMP resolves at reattach differs from the identity recorded by Register omp acp as an opt-in structured ACP agent behind the availability gate #68, refuse with a named reason. The journal stays readable, and no new conversation starts silently (D13).
• Single status producer; notifications on done/blocked; first-prompt workspace title rename fed by structured prompts; launch prompt delivered once; one child per session, proven gone on close.

Non-goals

• Features owned by other units (commands, interactions, steering, compaction).

Depends on

• Register omp acp as an opt-in structured ACP agent behind the availability gate #68

Parity rows owned

• P-STRM-02, P-STRM-03, P-META-03, P-RSUM-01, P-HOOK-01, P-HOOK-03, P-HOOK-04, P-RSUM-02, P-DDUP-01, P-DDUP-02, P-STOP-01, P-LNCH-01, P-NAME-01, P-STAT-01, P-NOTF-01, P-PROC-01.

Acceptance criteria

• Sidebar, worktree ps, dashboard and mobile show OMP ACP working/blocked/done from the one store, with no hook rows for the ACP child.
• Stop interrupts the turn; the next message continues the same conversation; OMP's session file contains the aborted turn (assistant with stopReason: "aborted", and for a tool turn a toolResult with isError: true) and a custom:session_exit entry — the child exited on stdin EOF, never by forced kill.
• Killing the child mid-turn yields an explicit failed state; nothing is resent automatically.
• App restart restores OMP ACP chats without duplicate rows, reattaches the same OMP session (session/resume, no replay) and shows the last context usage before any new turn. Terminal OMP restore and Escape policy are unchanged.
• A changed OMP profile/agent dir since creation yields a named refusal, never a silent new session.
• Done/blocked notifications and first-prompt auto-titles fire as for legacy.
• Closing the tab proves the OMP process tree gone (POSIX and Windows).

Required tests

• Kill child mid-turn and during initialize; Stop during a permission request; Stop then immediate send.
• App restart mid-turn; two windows on one session.
• Reattach via resume → zero timeline rows from provider frames; ring from the journal; load fallback when resume is not advertised.
• Profile/agent-dir drift between create and reattach → named refusal; session file deleted → one "not restored" row.
• Launch prompt with slow start → delivered once.
• Adapter teardown (fake child, extend acp-structured-session-adapter-teardown.test.ts): after the agent answers cancelled, stdin ends before any kill; no tree kill before ROOT_ONLY_GRACEFUL_EXIT_MS on win32 and no wrapper SIGTERM on POSIX; a child exiting inside the window is never killed.
• Late-persisting scripted agent: replies cancelled, persists 200 ms later, exits only on EOF → close resolves with the flag set and no kill.
• Real omp (gated on an installed omp, isolated --session-dir, cheap model): Stop mid-stream and mid-bash sleep 30, ≥10 runs each on win32 and POSIX; 10/10 files contain the aborted entries and custom:session_exit, no forced kill recorded; session/load + next prompt shows the aborted turn.
• Terminal OMP hook tests unchanged (Escape inference, retired-pane revival).

Base branch

acp-migration (44madfire/orca).