[Juliusolsson05]

Closes #1370.

Problem

orchestration_create_agent waits at most 30 s for the renderer's create-agent answer, and the renderer answers only after the child's provider has started. A healthy but slow start exceeds that: the bundled OpenCode took 16.7, 18.3 and 43.1 s under CPU contention (#1367 review a).

When it does:

• the caller gets OrchestrationOutcomeUnknownError ("do not repeat");
• the tool handler returns without delivering the prompt;
• the late answer is adopted with bootstrapPromptDelivered: false.

The parent ends up with an idle child that never got its brief.

Change (the issue's option a; final head 7956d889)

• The bridge runs the create's bootstrap delivery when a late answer is adopted.

  • createAgent accepts an onLateCreate continuation, kept main-side (a function cannot cross into the renderer) while the request is outstanding.
  • adoptLateResponse runs it once, with the enriched child. An in-time answer or a failed late answer never runs it.
  • A throw becomes a prompt_delivery_failed incident (create_agent_late_bootstrap), and the adoption incident records bootstrapFollows.
  • Adoption keeps a promptDeliveries record that already exists, so a submission recorded before adoption is not lost.

• One delivery for both paths. The handler's bootstrap block is one function (deliverBootstrap) that both the punctual and late paths call, so they cannot drift. That block delivers, arms armPromptWhenReady when the composer is not ready, and marks the bootstrap delivered.

• Bounded retry while the late child is merely not ready (deliverLateBootstrap). The retry delays are 2, 4, 8, 16 and 30 s, about a minute in all. Before every attempt it checks two things:

  • A prompt already landed: if promptSubmissionCount > 0, it stops. A parent that checked and sent the brief itself never gets a second copy.
  • The parent lease: if isParentAttached is false, it stops and records a create_agent_late_bootstrap_parent_gone incident. A parent that closed during a delay must not have its brief start an ownerless child.

  A reservation collision on the late path also counts as "not ready" and is retried. When the retries run out, it records a create_agent_late_bootstrap_never_ready incident.

• The late readiness waiter is guarded too. SessionManager.deliverPromptWhenReady takes a shouldDeliver() check that runs right before the write. The late path passes the parent-lease check through armPromptWhenReady. A refusal writes nothing and returns do-not-retry.

• The parent lease follows the alias chain. OrchestrationBridge.isParentAttached resolves the parent through fix(orchestration): closed children follow their parent's replacement #1369's replacement chain (currentParentId), so a parent that was reloaded or replaced still counts as attached.

• q85 (W2's patch, applied after fix(orchestration): closed children follow their parent's replacement #1369 merged). If marking the late bootstrap delivered fails, an orchestration.bootstrap_mark_failed incident is recorded, because the journal is the late path's only reader. A test covers the replaced-parent case.

• The timeout reply promises an attempt, not a delivery. When a prompt was given, the outcome-unknown message now says: "If the renderer later confirms the child, Agent Code tries to deliver its bootstrap prompt automatically, retrying for about a minute while it starts. That can fail (the child never answers, is never ready, or you close first), so check orchestration_list_agents and orchestration_read_agent (promptSubmitted) before sending the brief yourself, or it may arrive twice."

• Rejected: option b (a longer create deadline). MCP clients have their own tool-call timeouts, and a Codex parent's are shorter than 120 s.

• Plan: docs/plans/2026-09-27-orchestration-late-bootstrap.md.

Tests

• src/main/orchestration/timeoutOutcome.test.ts:
  • the continuation runs once with the adopted child and is never sent to the renderer;
  • it never runs for a failed late answer or an in-time answer;
  • a throwing continuation becomes an incident;
  • the reply carries the attempt wording.
• src/mcp/runtime/orchestrationLateBootstrap.system.test.ts (the real MCP server, tool handler and bridge):
  • a create held past the deadline and then answered gets its bootstrap delivered and marked;
  • each retry delay is pinned exactly;
  • the retry stops on an existing submission, on a gone parent and on a replaced parent (through the alias chain);
  • a reservation collision is retried;
  • send_prompt from the parent stops the retry;
  • the mark failure records its incident.
• src/main/sessionManager.pendingPrompt.test.ts: a refused shouldDeliver writes nothing and returns do-not-retry.
• Fail-first and mutations: the original tests are red on origin/main, and each review fix was red at the head before it. Killed mutations include:
  • adoption skipping the continuation;
  • the handler not registering it;
  • the waiter guard;
  • a pre-recorded submission being dropped;
  • the alias-chain lookup.
• Survives (hygiene only, stated): removing the continuation-map cleanup. An in-time create is never adopted, so a stale entry cannot run; it only occupies memory until the bridge is gone.
• Totals: the touched suites pass (the manager's check: 28/28) and npx tsc -b prints 0 lines. Review rounds 1 and 2 (a/b/c) are fixed, and the manager verified the code MERGE-READY at 7956d889.

🤖 Generated with Claude Code

[Juliusolsson05]

Parked (waiting on #1369). Steering q86: W2's staged patch and the combined #1369→#1375 test are applied here after #1369 merges. #1369 is still open. No work until then.

[Juliusolsson05]

Review disposition (round 1: a, codex at 2e4bd384: FIX-BEFORE-MERGE)

Fixed at cacd7ec0. Detail is in the plan's review table.

Finding	Verdict	Disposition
a1, major: a late delivery refused as not-ready (no readiness gate: OpenCode, Grok) left the child idle despite "delivered automatically"	valid	Fixed: bounded late retries (about a minute), stopping once any prompt has landed on the child, with a never-ready incident. The timeout reply now says to check orchestration_read_agent before sending. Three new system tests, red at the previous head; the no-landed-check mutant is red.
a2, major: the late brief could start after the parent closed mid-spawn	valid	Fixed: the parent's lease is checked before the late delivery, which is skipped with an incident. The child is left for the user. Red at the previous head; the mutant is red.
a survivor: supersedesPendingPrompt	noted	a judges false correct; the late race it would decide is covered by the landed-prompt check.

Every orchestration suite passes (bridge 15, runtime 5, timeout 14, bootstrap-pending 20, duplicate-create 16, late-bootstrap 4), and npx tsc -b prints 0 lines. W2's late-warning patch (temp/q85) still applies after #1369 merges.
b (codex at cacd7ec0): FIX-BEFORE-MERGE, fixed at 5f54f8c0:

Finding	Verdict	Disposition
b1, major: a parent closing during a retry delay still got its brief delivered	valid	Fixed: isParentAttached is checked before every late attempt, with an incident. Red with the check removed.
b2, minor: the FAILED fixtures lacked type, masking the !response.ok guard	valid	Fixed in both fixtures; removing the guard is red.
b survivor: removing every lateCreates.delete passed	valid	Pinned: the map empties in time and late; the mutant is red.

c (codex at cacd7ec0): FIX-BEFORE-MERGE, fixed at ed86637b:

Finding	Verdict	Disposition
c1, major: a parent closing during a retry delay	valid	Already fixed in 5f54f8c0 (the same as b1).
c2, minor: the timeout reply overpromised delivery	valid	Fixed: it says delivery is attempted if the renderer later confirms the child, names how it can fail, and tells the parent how to check before sending.
c survivor: the last retry delay could shrink to 1 ms	valid	Pinned: every wait is checked exactly; the first-delay and last-delay mutants are red.

Round 1 (a, b, c) is complete.

Round 2 (a, b, c codex at ed86637b): all FIX-BEFORE-MERGE, the final round. Fixed at 24066860.

The round-1 fixes are verified: every targeted mutant is red (the per-attempt parent check, the adoption check, the landed-prompt stop, the late retry, the exact delays).

Finding	Verdict	Disposition
a + b, major: a late Claude/Codex readiness waiter could deliver after the parent detached	valid	Fixed: deliverPromptWhenReady takes a shouldDeliver guard, asked when the gate opens, before any write; the late path arms it with the parent-lease check. Red at ed86637b.
c, major: a parent send landing BEFORE the late create answer was erased by adoption, so a second brief followed	valid	Fixed: adoption keeps an existing record. The test goes through the real send_prompt; red at ed86637b.
c, minor: a reservation collision ended the late loop	valid	Fixed: it retries, re-checking the landed count and the parent. Red at ed86637b.
b, minor: the stop test bypassed send_prompt's own bookkeeping	valid	Fixed: it uses the real tool; the bookkeeping mutant is red.

Every orchestration suite passes, sessionManager.pendingPrompt passes 17/17, and npx tsc -b prints 0 lines. ## After #1369 merged (q85 / q86): 7956d889

• Main merged for a real dependency (36830732). The adoptLateResponse conflict keeps this PR's record-preserving set beside fix(orchestration): closed children follow their parent's replacement #1369's noteCreatedChild.
• W2's late-warning patch applied: orchestration.bootstrap_mark_failed on the late path, and the late create + parent-replacement case.
• isParentAttached now resolves through fix(orchestration): closed children follow their parent's replacement #1369's alias chain, so a parent replaced during the late window keeps its brief; only a parent with no live successor is gone. Removing the resolution fails W2's replaced-parent test.

Every orchestration suite passes, and npx tsc -b prints 0 lines. Both review rounds are spent: NEED-MANAGER (manager-verify a/b/c of 7956d889; the round-2 fixes are in 24066860, and the q85 integration is new since).

Manager verification and READY

B6 verified the code at 7956d889 (manager-verify a/b/c, MERGE-READY): a1/b1 (the shouldDeliver guard before the write), c1, c2, the b2 survivor and q85 are fixed, with 3+ mutants killed; 28/28 pass. The body is rewritten: the removed "delivered automatically: do not send it again" quote is replaced by the attempt wording, and the retry, parent-lease, alias-chain and q85 behaviour are described.

merge-gate.sh agent-code 1375 --member --dry: GATE PASS (7956d889, 0 behind main, checks green). READY.