measure what a handoff actually survives

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-07 10:32:18 +00:00
parent df00f6d7a5
commit 3ab57a5839
1 changed files with 33 additions and 0 deletions
@@ -480,6 +480,39 @@ a human watches and steers a conversation that continues without it — which is
 §1.15 shows the chat system was rebuilt to support (durable event log, cursor replay, agent-as-writer,
 session outliving the socket).
 **Measured, 2026-08-07 — the durability claim above is no longer an argument.** Six tests run live
 against the running system, deliberately looking for the break. Method and raw evidence:
 `COMMS/handoff-durability-2026-08-07.md`.
 | what was done to it mid-handoff | turn completed | narration durable |
 |---|---|---|
 | nothing (control) | ✅ | ✅ |
 | `pm2 restart officer` | ✅ | ✅ |
 | **`officer` stopped for 25 s** | ✅ | ✅ **6 events written while the server was down** |
 | target's `claude` process SIGKILLed | ❌ lost | ⚠️ partial, with an explicit error row |
 | next handoff to that same agent | ✅ | ✅ same Claude session resumed |
 | handoff POSTed while `officer` is down | ❌ lost | ❌ no queue, no retry |
 Three things follow, and they change how the outstanding work should be read:
 - **The "no browser open" requirement is satisfied, and so is the harder one.** Not one of these runs had
  a page open, and the middle row is the proof that officer is genuinely off the delivery path: the agent
  sidecar committed the model's own words to Postgres during a 25-second server outage.
 - **A restart costs a *turn*, not an *agent*.** After being killed mid-turn, the receiver resumed the
  identical Claude session on the next handoff and volunteered which work had been lost. Continuity —
  `sessionKey` minted once, write-through map on disk — does the job it was built for. That makes the
  outstanding claude **stage 5** a smaller problem than its position on the list suggests.
 - **The remaining hole is on the *sending* side.** A handoff POSTed while officer is down is refused and
  dropped, and nothing in the introduction text tells the agent to retry — so the sender can believe it
  handed off when it did not. That, not the receiving side, is where store-and-forward would earn its
  keep.
 One topology fact found while setting this up, worth stating here because it is the practical limit on
 working unattended: **`officer-agent` is `sidecar/claude/user-instance.ts`, and every `claude` process on
 the machine is its direct child.** `pm2 restart officer-agent` therefore kills every agent on every
 dashboard at once, mid-turn. `CLAUDE.md` reassures that restarting *officer* is safe — it is, and that is
 verified above — but is silent on this one.
 ### 1.17 The restart payload is temporary — the protocol is not
 > The restart thing is giving me pain right now. Pretty soon that won't be a problem, because I won't