Tell you when a paired server's restart interrupted your chats, and resume them from one dialog

src/main/native-chat/agent-session-wire/structured-agent-session-host-teardown.ts

@@ -9,7 +9,7 @@ import type { AgentSessionResumeTrigger } from '../../../shared/agent-session-re
 import { SUPERVISED_GRACEFUL_EXIT_MS } from '../../claude/claude-child-exit-proof-ladder'
 import { PROVIDER_SUPERVISOR_MAX_STOP_MS } from '../../provider-process/provider-process-supervisor'
 import { SNAPSHOT_DRAIN_TIMEOUT_MS } from './structured-agent-session-eviction'
-import type { StructuredAgentSessionRestartResume } from './structured-agent-session-restart-resume-host'
+import type { StructuredAgentSessionRestartResume } from './structured-agent-session-restart-resume-contract'
 import {
   evictOwnedStructuredAgentSessions,
   type StructuredAgentSessionLifetimeContext

src/main/native-chat/agent-session-wire/structured-agent-session-host-test-recovery-capsule.ts

@@ -45,6 +45,10 @@ export class TrackedTestRecoveryCapsule extends AgentSessionRecoveryCapsule {
     return this.track(super.dismiss(...args))
   }
 
+  override dismissListed(...args: Parameters<Capsule['dismissListed']>) {
+    return this.track(super.dismissListed(...args))
+  }
+
   override forgetSuperseded(...args: Parameters<Capsule['forgetSuperseded']>) {
     return this.track(super.forgetSuperseded(...args))
   }

src/main/native-chat/agent-session-wire/structured-agent-session-host.ts

@@ -41,10 +41,8 @@ import { StructuredAgentSessionEventRecovery } from './structured-agent-session-
 import { StructuredAgentSessionBackgroundTaskChannel } from './structured-agent-session-background-task-channel'
 import { StructuredAgentSessionClientDelivery } from './structured-agent-session-client-delivery'
 import { StructuredAgentSessionConversations } from './structured-agent-session-conversations'
-import {
-  createStructuredAgentSessionRestartResume,
-  type StructuredAgentSessionRestartResume
-} from './structured-agent-session-restart-resume-host'
+import { createStructuredAgentSessionRestartResume } from './structured-agent-session-restart-resume-host'
+import type { StructuredAgentSessionRestartResume } from './structured-agent-session-restart-resume-contract'
 import { structuredAgentSessionRestartResumeSurfaces } from './structured-agent-session-restart-resume-wiring'
 import * as conversation from './structured-agent-session-host-delivery'
 import { structuredAgentSessionConversationFence } from './structured-agent-session-provider-child'

src/main/native-chat/agent-session-wire/structured-agent-session-restart-audience.test.ts

@@ -34,6 +34,17 @@ it('neither lists nor dismisses an offer the caller cannot show', async () => {
   expect(await offersIn(root)).toEqual([])
 })
 
+it('does not dismiss an offer the caller cannot show, even listed with its interruption', async () => {
+  const { host, root } = await interruptedRestart()
+  const [offer] = await host.restartResume.list()
+  const listed = [{ sessionId: SESSION, recordedAt: offer!.recordedAt }]
+
+  expect(await host.restartResume.dismissListed(listed, cannotShowCodex)).toBe(0)
+  expect(await offersIn(root)).toHaveLength(1)
+  expect(await host.restartResume.dismissListed(listed, showsCodex)).toBe(1)
+  expect(await offersIn(root)).toEqual([])
+})
+
 it('neither continues nor reserves an offer the caller cannot show, named or not', async () => {
   const { host, root, acquire, dispatch } = await interruptedRestart()
 

src/main/native-chat/agent-session-wire/structured-agent-session-restart-failure-ledger.ts

@@ -10,7 +10,8 @@
 import type {
   AgentSessionRecoveryCapsule,
   AgentSessionResumeFailureInput,
-  AgentSessionResumeFailureRecord
+  AgentSessionResumeFailureRecord,
+  ListedRestartOffer
 } from '../../runtime/agent-session-recovery-capsule'
 import type { AgentSessionRecord } from '../../../shared/agent-session-record'
 import type {
@@ -34,7 +35,13 @@ import type { StructuredAgentSessionLogger } from './structured-agent-session-lo
 
 type FailureCapsule = Pick<
   AgentSessionRecoveryCapsule,
-  'listFailed' | 'completeResume' | 'failResume' | 'rollbackResume' | 'dismiss' | 'clearAll'
+  | 'listFailed'
+  | 'completeResume'
+  | 'failResume'
+  | 'rollbackResume'
+  | 'dismiss'
+  | 'dismissListed'
+  | 'clearAll'
 >
 
 export type StructuredAgentSessionRestartFailureLedger = {
@@ -65,6 +72,12 @@ export type StructuredAgentSessionRestartFailureLedger = {
     beforeClearAll: (audience?: StructuredAgentSessionRestartAudience) => void | Promise<void>,
     audience?: StructuredAgentSessionRestartAudience
   ) => Promise<number>
+  /** Forgets offers exactly as a client listed them; see the capsule's `dismissListed`. With an
+   *  audience, only records of agents it sees go. */
+  dismissListed: (
+    listed: readonly ListedRestartOffer[],
+    audience?: StructuredAgentSessionRestartAudience
+  ) => Promise<number>
 }
 
 /** Which continuation outcomes count as the agent not carrying on, and how each is filed. */
@@ -252,6 +265,17 @@ export function createStructuredAgentSessionRestartFailureLedger(deps: {
         // A newer Orca's offers and failures were never shown here, so "dismiss all" keeps them.
         const keep = (marker: AgentSessionResumeMarker) => deps.savedByNewerOrca(marker.sessionId)
         return (await deps.capsule?.clearAll(deps.now(), keep)) ?? 0
+      }),
+    dismissListed: (listed, audience) =>
+      deps.enqueue(async () => {
+        // Decided under the capsule lock, as `dismiss` does.
+        const hidden = audience
+          ? (marker: AgentSessionResumeMarker) => {
+              const record = deps.getRecord(marker.sessionId)
+              return record === null || !audience(record.provider)
+            }
+          : undefined
+        return (await deps.capsule?.dismissListed(listed, deps.now(), hidden)) ?? 0
       })
   }
 }

src/main/native-chat/agent-session-wire/structured-agent-session-restart-ownership.test.ts

@@ -518,3 +518,24 @@ it('files a restart refused by a conflicted claim under its code, with its detai
     ])
   )
 })
+
+it('continues a chat once when two desktops both resume it, and the second hears nothing failed', async () => {
+  const { host } = await interruptedRestart()
+  await host.restartResume.list()
+
+  const [first, second] = await Promise.all([
+    host.restartResume.continueAfterRestart([SESSION], 'desktop-a'),
+    host.restartResume.continueAfterRestart([SESSION], 'desktop-b')
+  ])
+  const later = await host.restartResume.continueAfterRestart([SESSION], 'desktop-b')
+
+  expect([...first.continued, ...second.continued]).toMatchObject([{ outcome: 'continued' }])
+  // The loser reserved nothing, so it sent nothing and has no failure to file or report.
+  expect(later.continued).toEqual([])
+  expect([...first.failed!, ...second.failed!, ...later.failed!]).toEqual([])
+  expect(
+    (await statusNotes(host)).filter(
+      (note) => note.text === AGENT_SESSION_RESTART_CONTINUATION_NOTE
+    )
+  ).toHaveLength(1)
+})

src/main/native-chat/agent-session-wire/structured-agent-session-restart-resume-contract.ts

@@ -1,6 +1,7 @@
 // What a host's restart-resume surface offers: teardown's offer recording, the offer list and its
 // actions, and Continue on a cut reply.
 
+import type { ListedRestartOffer } from '../../runtime/agent-session-recovery-capsule'
 import type { AgentSessionResumeTrigger } from '../../../shared/agent-session-resume-marker'
 import type { createInterruptedContinuation } from './structured-agent-session-interrupted-continuation'
 import type { StructuredAgentSessionContinuationOutcome } from './structured-agent-session-restart-continuation'
@@ -44,6 +45,12 @@ export type StructuredAgentSessionRestartResume = {
     sessionIds?: readonly string[],
     audience?: StructuredAgentSessionRestartAudience
   ) => Promise<number>
+  /** Forgets offers exactly as a client listed them: a chat interrupted again since, or being
+   *  resumed by another action right now, keeps its record. An audience limits it as `dismiss`. */
+  dismissListed: (
+    listed: readonly ListedRestartOffer[],
+    audience?: StructuredAgentSessionRestartAudience
+  ) => Promise<number>
   /** The chat's agent proved a start: its offer ends unless the start is a resume's own. */
   onAgentStarted: (sessionId: string) => void
   /** Continue on a reply an Orca stop cut off, offer or not; the send itself retires any offer. */

src/main/native-chat/agent-session-wire/structured-agent-session-restart-resume-host.ts

@@ -319,6 +319,7 @@ export function createStructuredAgentSessionRestartResume(
         },
         audience
       ),
+    dismissListed: failures.dismissListed,
     continueAfterRestart,
     onAgentStarted: withdrawal.onAgentStarted,
     continueInterrupted: createInterruptedContinuation(continuationHost, readMarkers)

src/main/runtime/agent-session-recovery-capsule-entries.ts

@@ -215,16 +215,90 @@ export function shouldReplaceMarker(
 /** Records "dismiss all" leaves as they were: this host does not list them (a newer Orca's chats). */
 export type KeepRecord = (marker: AgentSessionResumeMarker) => boolean
 
-/** What a "dismiss all" keeps, and how many pending offers it ends. */
+/** What a "dismiss all" keeps, and how many pending offers it ends. A chat another action is
+ *  resuming right now (another device's, on a shared host) stays with its earlier failure for that
+ *  action to settle; the action lease ends a reservation whose action died. */
 export function splitDismissedAll(
   state: Pick<RecoveryCapsuleState, 'entries' | 'failed'>,
   keep: KeepRecord
 ): { kept: Pick<RecoveryCapsuleState, 'entries' | 'failed'>; dismissedPending: number } {
-  const entries = state.entries.filter((entry) => keep(entry.marker))
+  const resuming = new Set(
+    state.entries
+      .filter((entry) => entry.state === 'in-progress')
+      .map((entry) => entry.marker.sessionId)
+  )
+  const kept = (marker: AgentSessionResumeMarker): boolean =>
+    resuming.has(marker.sessionId) || keep(marker)
   return {
-    kept: { entries, failed: state.failed.filter((failure) => keep(failure.marker)) },
+    kept: {
+      entries: state.entries.filter((entry) => kept(entry.marker)),
+      failed: state.failed.filter((failure) => kept(failure.marker))
+    },
     dismissedPending: state.entries.filter(
       (entry) => entry.state === 'pending' && !keep(entry.marker)
     ).length
   }
 }
+
+/** One offer as a client listed it: the chat and the interruption it was shown. */
+export type ListedRestartOffer = { sessionId: string; recordedAt: number }
+
+/** What dismissing listed offers keeps: a record no longer the one listed (a newer interruption),
+ *  and every record of a chat another action is resuming right now. */
+export function splitDismissedListed(
+  state: Pick<RecoveryCapsuleState, 'entries' | 'failed'>,
+  listed: readonly ListedRestartOffer[],
+  keepRecord: KeepRecord = () => false
+): { kept: Pick<RecoveryCapsuleState, 'entries' | 'failed'>; dismissed: Set<string> } {
+  const shown = new Map(listed.map((offer) => [offer.sessionId, offer.recordedAt]))
+  const resuming = new Set(
+    state.entries
+      .filter((entry) => entry.state === 'in-progress')
+      .map((entry) => entry.marker.sessionId)
+  )
+  const dismissed = new Set<string>()
+  const keep = (marker: AgentSessionResumeMarker): boolean => {
+    if (
+      resuming.has(marker.sessionId) ||
+      shown.get(marker.sessionId) !== marker.recordedAt ||
+      keepRecord(marker)
+    ) {
+      return true
+    }
+    dismissed.add(marker.sessionId)
+    return false
+  }
+  return {
+    kept: {
+      entries: state.entries.filter((entry) => keep(entry.marker)),
+      failed: state.failed.filter((failure) => keep(failure.marker))
+    },
+    dismissed
+  }
+}
+
+/** Records the chat itself has since superseded go; witness-keyed, so a newer record stays. */
+export function withoutSuperseded(
+  state: Pick<RecoveryCapsuleState, 'entries' | 'failed'>,
+  superseded: readonly { sessionId: string; recordedAt: number; failedAt?: number }[]
+): Pick<RecoveryCapsuleState, 'entries' | 'failed'> {
+  return {
+    entries: state.entries.filter(
+      (entry) =>
+        entry.state !== 'pending' ||
+        !superseded.some(
+          (gone) =>
+            gone.failedAt === undefined &&
+            gone.sessionId === entry.marker.sessionId &&
+            gone.recordedAt === entry.marker.recordedAt
+        )
+    ),
+    failed: state.failed.filter(
+      (failure) =>
+        !superseded.some(
+          (gone) =>
+            gone.sessionId === failure.marker.sessionId && gone.failedAt === failure.failedAt
+        )
+    )
+  }
+}

src/main/runtime/agent-session-recovery-capsule-read.ts

@@ -0,0 +1,20 @@
+import { readNodeFileWithinLimit } from '../../shared/node-bounded-file-reader'
+import { parseState, type RecoveryCapsuleState } from './agent-session-recovery-capsule-entries'
+
+export const MAX_RECOVERY_CAPSULE_BYTES = 4 * 1024 * 1024
+
+/** The capsule as stored; a missing file is an empty one. Callers hold the file's lock. */
+export async function readRecoveryCapsuleState(filePath: string): Promise<RecoveryCapsuleState> {
+  let raw: string
+  try {
+    raw = (await readNodeFileWithinLimit(filePath, MAX_RECOVERY_CAPSULE_BYTES)).buffer.toString(
+      'utf8'
+    )
+  } catch (error) {
+    if (error instanceof Error && 'code' in error && error.code === 'ENOENT') {
+      return { entries: [], failed: [] }
+    }
+    throw error
+  }
+  return parseState(raw)
+}

src/main/runtime/agent-session-recovery-capsule.test.ts

@@ -270,6 +270,33 @@ describe('durable restart offers', () => {
     expect(await capsule.list(NOW)).toEqual([marker({ sessionId: 'third' }), marker()])
   })
 
+  it('forgets listed records only while they are still the interruption the client listed', async () => {
+    await capsule.record(
+      [marker(), marker({ sessionId: 'second' }), marker({ sessionId: 'third' })],
+      NOW
+    )
+    // Interrupted again after the listing: the newer offer was never shown, so it stays.
+    await capsule.record([marker({ sessionId: 'second', recordedAt: NOW + 5 })], NOW + 5)
+
+    const listed = [SESSION, 'second', 'third'].map((sessionId) => ({ sessionId, recordedAt: NOW }))
+    expect(await capsule.dismissListed(listed, NOW + 6)).toBe(2)
+    expect(await capsule.list(NOW + 6)).toEqual([
+      marker({ sessionId: 'second', recordedAt: NOW + 5 })
+    ])
+  })
+
+  it('leaves a listed chat another action is resuming, and its earlier failure, to that action', async () => {
+    await capsule.record([marker()], NOW)
+    await fileFailure()
+    // A retry on another desktop reserves the failed chat; this desktop listed it before that.
+    await capsule.beginResume([SESSION], 'operation-b', NOW)
+
+    expect(await capsule.dismissListed([{ sessionId: SESSION, recordedAt: NOW }], NOW)).toBe(0)
+    expect(await capsule.listFailed(NOW)).toHaveLength(1)
+    await capsule.failResume('operation-b', [failure({ reason: 'retry_failed' })], NOW)
+    expect(await capsule.listFailed(NOW)).toMatchObject([{ reason: 'retry_failed' }])
+  })
+
   it('forgets every record of any state except the ones kept, without a fence', async () => {
     await capsule.record(
       [marker(), marker({ sessionId: 'second' }), marker({ sessionId: 'kept' })],
@@ -487,16 +514,17 @@ describe('durable restart offers', () => {
     expect(await capsule.list(later)).toEqual([])
   })
 
-  it('dismisses pending and active recovery records', async () => {
+  // On a shared host the action may be another device's resume: dismissing what this listing showed
+  // must not take its reservation, or a refusal it meets would never be filed.
+  it('dismisses pending records and leaves a chat another action is resuming to that action', async () => {
     await capsule.record([marker(), marker({ sessionId: 'second' })], NOW)
     await capsule.beginResume([SESSION], 'operation-a', NOW)
 
     expect(await capsule.clearAll(NOW)).toBe(1)
     expect(await capsule.list(NOW)).toEqual([])
 
-    // A later failed action cannot resurrect a record the user explicitly dismissed.
-    await capsule.rollbackResume('operation-a', NOW)
-    expect(await capsule.list(NOW)).toEqual([])
+    await capsule.failResume('operation-a', [failure()], NOW)
+    expect(await capsule.listFailed(NOW)).toMatchObject([{ marker: marker() }])
   })
 
   it('fences a late teardown write until a genuinely newer interruption', async () => {
@@ -647,3 +675,29 @@ it('does not retain lock timers after reads, writes, or failed publications', as
     vi.useRealTimers()
   }
 })
+
+describe('whether the capsule holds anything', () => {
+  it('is no for a missing file and for one every record left', async () => {
+    expect(await capsule.holdsAnyRecord()).toBe(false)
+    await capsule.record([marker()], NOW)
+    await capsule.dismiss([SESSION], NOW)
+    expect(await capsule.holdsAnyRecord()).toBe(false)
+  })
+
+  it('counts a pending offer, a reservation, and a filed failure alike', async () => {
+    await capsule.record([marker()], NOW)
+    expect(await capsule.holdsAnyRecord()).toBe(true)
+    await capsule.beginResume([SESSION], 'operation-a', NOW)
+    // Reserved, so the listing no longer shows it — the file still holds it.
+    expect(await capsule.list(NOW)).toEqual([])
+    expect(await capsule.holdsAnyRecord()).toBe(true)
+    await capsule.failResume('operation-a', [failure()], NOW)
+    expect(await capsule.list(NOW)).toEqual([])
+    expect(await capsule.holdsAnyRecord()).toBe(true)
+  })
+
+  it('counts unreadable bytes as holding something', async () => {
+    await writeFile(filePath, '{not json')
+    expect(await capsule.holdsAnyRecord()).toBe(true)
+  })
+})