P1: Make non-testing Task input and handoff intents restart-convergent

[YueZh127]

Objective

Make non-testing Task input and handoff intents restart-convergent without allowing stale claim generations to consume user side effects.

Review origin and observation baseline

• Found during the final independent review of Talos PR github-devloop implementation for #34 #35.
• Observation baseline: PR github-devloop implementation for #34 #35 head e7bb6412af65d980b676dd693130402343ec7382, based on qa-tools-fkst-staging@748a8e71b0a8b5626dffdedded7778b67ec52382.
• PR github-devloop implementation for #34 #35 intentionally fixes user-operation CAS classification and prevents pending-input or handoff records from being written when the Task CAS loses.
• This issue records the remaining opposite boundary: the Task CAS can succeed before the sidecar record is durably written.
• This is separate from P0 recovery: Make Task claim and lease accounting atomic (#30) #34 claim/machine/profile accounting, P1: Make interactive session action projections converge under completion races #23 interactive action projection convergence, and Talos Testing Tool/QARun contracts.

Current defects

provideInput() commits needs_input -> running before savePendingInput(). A process exit, thrown write, or lost acknowledgement after the Task CAS can leave a running Task with no consumable input. Retrying the user request is rejected because the Task is no longer needs_input.

requestHandoff() commits the Task handoff state and URL before saveHandoff(). The same failures can leave a public Task pointing at a handoff URL whose record does not exist, while a retry is rejected because the Task is already in handoff.

Moving either sidecar write back before the Task CAS is not acceptable: that recreates the stale-generation and orphan-side-effect failures closed by PR #35.

Required authority model

• Bind every pending-input and handoff intent to the exact Task claimId and claimGeneration.
• Use either an authoritative intent embedded in the atomically replaced Task document or a durable operation phase that can be reconciled after restart.
• Materialize and consume sidecar records idempotently; a lost acknowledgement must be distinguishable from a lost write.
• A generation-N input or handoff can never be consumed, exposed, or materialized for generation N+1.
• Standalone MongoDB remains supported. Do not require multi-document transactions or replica-set-only topology.
• MemoryRepository and MongoRepository must expose equivalent observable behavior.
• Internal claim IDs, generations, tokens, and reconciliation state remain absent from public Task/Session APIs, handoff responses, logs, webhooks, and errors.

Acceptance criteria

• Preserve PR github-devloop implementation for #34 #35 behavior: three bounded user CAS retries, 409 concurrent_update for real contention, non-retryable inactive-claim conflict, and zero sidecar writes after a losing CAS.
• Inject a thrown savePendingInput() after the winning Task CAS and prove client retry or reconciliation completes exactly one generation-bound input.
• Inject a lost acknowledgement after a committed pending-input write and prove no duplicate delivery.
• Restart a real standalone Mongo repository after the Task CAS and before input materialization; prove convergence and one-time worker consumption.
• Repeat the thrown-write, lost-acknowledgement, and standalone-Mongo restart matrix for handoff materialization and one-time handoff consumption.
• Expire/requeue generation N and reclaim N+1 at every durable phase; prove no N intent reaches N+1 and no stale URL becomes resolvable.
• Add deterministic barrier-controlled Memory/Mongo service contracts plus HTTP regressions. Do not use sleeps or timing assumptions.
• Run build, typecheck, lint, worker bundle, fixture drift, full tests, the standalone Mongo contract, and all four PR checks.

Scope and sequencing

• This issue covers generic non-testing browse/computer_use Task input and handoff durability only.
• Do not change Talos Testing Tool/QARun/provider/deployment or external schema authority contracts.
• Do not implement P0: Bind terminal action retries to immutable dispatch credentials #29 terminal action provenance, P1: Make interactive lease teardown idempotent across concurrent expiry sweepers #27 concurrent closing teardown, P1: Make interactive session action projections converge under completion races #23 action projection convergence, or P2: Keep Mongo completed-action result lookup indexed #24 completed-result indexing here.
• Before implementation, record the latest merged qa-tools SHA and resolve sequencing against P0: Bind terminal action retries to immutable dispatch credentials #29/P1: Make interactive lease teardown idempotent across concurrent expiry sweepers #27/P1: Make interactive session action projections converge under completion races #23 so repository projection work does not overlap.
• Keep this issue unlabelled and unrouted until its post-merge preflight and isolated FKST target are recorded.
• Use the FKST staging plus separately reviewed Draft integration PR flow; no direct FKST merge to qa-tools, squash, rebase, force-push, auto-merge, or branch deletion.

[YueZh127]

Post-merge preflight and sequencing decision (2026-09-08)

PR #37 has now been delivered by normal merge commit.

• Repository: ChronoAIProject/talos
• Current delivered baseline: qa-tools@f2526873290bf7fc9fc3912abe36ea4f9868e04a
• Merge parents: 748a8e71b0a8b5626dffdedded7778b67ec52382, f104b1664ce1f1048d9aa1dc7e5c18303645b271
• Reviewed implementation head: e7bb6412af65d980b676dd693130402343ec7382
• Reviewed readiness-fix head: 3afcd3773fc174c66b8c2fff76e1cfcff2d7ff61
• Final integration CI: run 34244237242, all four jobs passed at exact staging head f104b166.

Sequencing is resolved as:

#29 -> #27 -> #23 -> #38 -> #24

Rationale: #29 establishes immutable action dispatch authority; #27 closes generation-aware teardown/release races; #23 finalizes Task/action projection convergence. This issue then adds generation-bound input/handoff intent materialization on the settled Task/repository projection model. #24 remains a narrow completed-action Mongo indexing task and follows afterward.

This is an observation/preflight baseline, not authorization to implement from f252687 after predecessors move. Keep #38 unlabelled and unrouted. After #23 merges, record a fresh exact qa-tools SHA, verify the isolated staging head and FKST package authority, then route this issue alone. No temporary authority, Testing Tool/QARun change, direct FKST merge to qa-tools, auto-merge, squash, rebase, force-push, or branch deletion is permitted.

[YueZh127]

Fresh post-merge implementation preflight (2026-09-11)

This comment supersedes the historical sequencing note above and authorizes exactly one current FKST work item.

Immutable repository and session snapshot

• Repository: ChronoAIProject/talos
• Source: qa-tools@2dd6dd27a2928f3d70fd5aad0b862117016a0aa4
• Target: qa-tools-fkst-staging@2dd6dd27a2928f3d70fd5aad0b862117016a0aa4
• Source and target are identical at this routing boundary.
• Active trigger: [session] talos-testing-staging-v3 #40, session talos-testing-staging-v3
• Session ID: cc8fd3be-498d-59bb-8d0f-db8b5cd1f2ff
• Config hash: a74b83337c393db5f2e4b33c38cad1a0ec47d5bab32bd4e436b2561ab7f49243
• Source/target from frozen session config: qa-tools -> qa-tools-fkst-staging
• Auto-merge: off
• Manifest: ChronoAIProject/fkst-hosted@packages:manifests/default-workflows.json
• Package authority at this boundary: packages@313004e98318e0268dac9183ae7f53fea03a540f
• Manifest blob at this boundary: 50f273f7022daf127c417c59eade36b3df8967ce
• Mutable-authority tracker ChronoAIProject/fkst-hosted#6175 remains open; recheck package and manifest authority before every later fix/review boundary.

Revalidated sequencing

• P1: Make interactive lease teardown idempotent across concurrent expiry sweepers #27 was independently revalidated and closed as not planned: its production double-teardown premise is refuted by the guarded CAS delivered with P0: Bind terminal action retries to immutable dispatch credentials #29. Missing two-sweeper regression proof moved to unlabelled P2: Prove concurrent closing-expiry convergence across repositories #45.
• P1: Make interactive session action projections converge under completion races #23 was independently revalidated and closed as completed: P0: Bind terminal action retries to immutable dispatch credentials #29's atomic embedded action model removed the delayed projection race described there.
• P2: Keep Mongo completed-action result lookup indexed #24 has been rewritten to the current unindexed embedded/legacy result-lookup problem and remains open, unlabelled, and unrouted.
• P1: Make non-testing Task terminal events restart-convergent #46 separately tracks the terminal-CAS-to-event-persistence crash window and remains open, unlabelled, and unrouted.
• Production authority, deployment, and canary trackers P0: Add production Testing authority providers and fail-closed adapters #12/P1: Deploy Testing-enabled Talos to a dedicated QA namespace #13/P1: Run the joint macOS arm64 Testing canary and failure matrix #14 remain unlabelled and unrouted.
• Only P1: Make non-testing Task input and handoff intents restart-convergent #38 is authorized for routing now. Dependency text does not authorize or automatically route any successor.

Delivery and review gate

• Scope is only non-testing Task input/handoff restart convergence and atomic one-time handoff consumption as specified in this issue.
• Keep Talos Testing Tool/QARun/provider/deployment contracts unchanged.
• Run build, typecheck, lint, worker bundle, fixture drift, full tests, standalone Mongo contract, and all four PR checks.
• Pin the resulting immutable implementation head and review the complete 2dd6dd27...<head> base-to-head diff independently.
• Fix every finding on the same PR and obtain re-review from the same reviewer.
• Merge the implementation by normal merge commit only into qa-tools-fkst-staging after green CI and review.
• Delivery into qa-tools requires a separate human-created Draft integration PR with its own green CI and review.
• No direct FKST merge to qa-tools, auto-merge, squash, rebase, force-push, or branch deletion.

Routing action after this comment: set YueZh127 as the sole assignee and add only fkst-dev-chronoai-fkst-cloud to #38.

[chronoai-fkst]

👀 Picked up by fkst session talos-testing-staging-v3.

A fkst pod is working this repo's fkst-dev-chronoai-fkst-cloud issues, including this one. The session posts its progress on this issue as it works, and the outcome will be a pull request (or, for issue-producing sessions, linked issues).

[chronoai-fkst]

This issue is managed by workflow software-feature-flow.

Reason:
Selected workflow software-feature-flow from the workflow catalog.

[chronoai-fkst]

Preparing to open a sub-issue for this task.

[chronoai-fkst]

Opened sub-issue #47 for this task.

[chronoai-fkst]

Materialized the walking-skeleton step as sub-issue #47.

[chronoai-fkst]

Preparing to open a sub-issue for this task.

[chronoai-fkst]

Opened sub-issue #50 for this task.