A company goal turn can hold the per-task session lock for hours while its
live dispatcher waits on AWAITING_HUMAN approval cards. The card answers are
themselves session messages, so they queued behind that same lock — a
three-way circular wait (dispatcher waits for the answer, the answer waits
for the lock, the lock waits for the dispatcher) that left late approval
clicks recorded but never delivered, and the parked branches wedged forever.
Timely clicks were unaffected because the inline-wait reply path resolves a
future without touching the lock, which is why only late approvals failed.
Three legs, all verified live on a wedged production run:
1. Lock-free answer path (ws_handler): a reply that explicitly targets a
pending task_user_input / company_work_item_gate checkpoint while the
task lock is held by a live turn is delivered straight through the
engine's checkpoint-resume channel. With a live dispatcher the engine
only persists the input, applies the approval decision, releases the
human wait, and wakes the loop — no second dispatcher, no re-entry.
When the lock is free the serialized path is kept unchanged. Failures
surface to the user instead of silently queueing behind the wedge.
2. Approval treadmill: company runtime parks persisted the blocked call
without its arguments, so the OBS-7 decision bridge could not rebuild
the allowlist context — a late approve resumed the task but recorded no
grant, and the identical command re-blocked and re-parked on a fresh
card every cycle. The runtime park artifact now persists tool_args, the
decision bridge falls back to permission_requests when
pause_request.permission_context is absent, and the legacy checkpoint
migration preserves existing permission_requests entries instead of
rebuilding them empty.
3. OPC_ESCALATION_TIMEOUT_SECONDS env override for the inline approval
wait (default unchanged) so harnesses can exercise the expire/park/
late-click cycle in seconds.
Live verification on the wedged run: both stranded cards resumed (the
second through the lock-free path while the first held the lock), a fresh
10s-expiry card answered late resumed within one second, the decision
bridge recorded the grant on reply, and the run converged to delivery.
Regression: 6 new lock-free path tests + 2 decision-bridge tests; full
suite 1932 passed.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
OBS-4: checkpoint answers for a run whose dispatcher is still live no longer
re-enter _execute_company_mode (re-entry reset live claim registries and the
attempt ledger stamped in-flight cards interrupted until the streak limit
killed them). The executor keeps a _live_run_dispatchers refcount; task and
peer checkpoint resumes deliver the input in place and wake the dispatcher.
Runs without a live dispatcher keep the original re-entry resume semantics.
OBS-7: approval decisions expressed through the chat/checkpoint route now
reach the approval engine instead of being parsed as plain task input
(which _ask_user treated as deny, re-escalating until the card died).
normalize_escalation_reply maps decision tokens/synonyms (never silently
denies free text), escalation_context_for_blocked_tool rebuilds the
allowlist context from pause_request.permission_context, and
_resume_task_checkpoint applies the grant via
apply_deferred_escalation_decision — the same engine path as the UI card.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
LZH-YS1998