fix(tui): bound the watchdog approval resume and report it

The stall watchdog re-ran the approval handler for a parked call
without checking whether a settlement already existed. An in-flight
settlement was joined, so the attempt hung with the turn, and a
handed-over one was ignored while still counting as recovered, which
suppressed the interrupt without resuming anything.

The handler now reports where a correlation's settlement stands, and
the resume only re-presents the approval when none exists. Otherwise
it falls back to the existing interrupt. The bridge runs at most one
resume at a time, gives it one stall budget before interrupting, and
re-checks that the turn is still stalled before a fallback fires.

Resume attempts flash a status that names the attempt without claiming
the call ran, and record a content-free turn marker for each outcome.
The recovery handle is cleared once the original handler settles.

Bridge tests cover handled, declined, failed, duplicate-tick and
wedged attempts, and unit tests cover the settlement guard.

Author: bwachman

src/session/approval-resume.test.ts

@@ -17,6 +17,7 @@ import { createExtraDeniedPathMatcher } from "../plugins/secret-guard-plugin.js"
 import {
   APPROVAL_DROPPED_NOTICE,
   createApprovalResume,
+  createSuspendedApprovalRecovery,
   requestFromApprovalSnapshot,
   resolveParkedCallIdFromStore,
   resolveSuspendedApprovalFromStore,
@@ -489,6 +490,80 @@ describe("persisted suspended approval proof", () => {
   });
 });
 
+describe("suspended approval recovery", () => {
+  function recoveryWith(
+    status: "idle" | "in-flight" | "handed-over",
+    pending: PendingOperation[] = [operation],
+  ) {
+    const handle = mock(async (_result: SendResult) => true);
+    const recovery = createSuspendedApprovalRecovery({
+      storage: () => storeWith(pending),
+      resume: { handle, status: () => status },
+    });
+    return { recovery, handle };
+  }
+  const result = suspension("corr-A", "echo same");
+
+  test("re-presents the verified approval once when nothing is settling", async () => {
+    const { recovery, handle } = recoveryWith("idle");
+    recovery.capture(result, () => true);
+
+    expect(await recovery.tryResumeOnce()).toBe(true);
+    expect(handle).toHaveBeenCalledTimes(1);
+    // A second attempt for the same capture takes the fallback.
+    expect(await recovery.tryResumeOnce()).toBe(false);
+    expect(handle).toHaveBeenCalledTimes(1);
+  });
+
+  test.each(["in-flight", "handed-over"] as const)(
+    "never re-enters a %s settlement",
+    async (status) => {
+      const { recovery, handle } = recoveryWith(status);
+      recovery.capture(result, () => true);
+
+      expect(await recovery.tryResumeOnce()).toBe(false);
+      expect(handle).not.toHaveBeenCalled();
+    },
+  );
+
+  test("a stale generation, a cleared capture or an unproven store never delivers", async () => {
+    const stale = recoveryWith("idle");
+    stale.recovery.capture(result, () => false);
+    expect(await stale.recovery.tryResumeOnce()).toBe(false);
+
+    const cleared = recoveryWith("idle");
+    cleared.recovery.capture(result, () => true);
+    cleared.recovery.clear();
+    expect(await cleared.recovery.tryResumeOnce()).toBe(false);
+
+    const unproven = recoveryWith("idle", []);
+    unproven.recovery.capture(result, () => true);
+    expect(await unproven.recovery.tryResumeOnce()).toBe(false);
+
+    for (const { handle } of [stale, cleared, unproven]) {
+      expect(handle).not.toHaveBeenCalled();
+    }
+  });
+
+  test("a generation that changes during verification drops the delivery", async () => {
+    let current = true;
+    const handle = mock(async (_result: SendResult) => true);
+    const recovery = createSuspendedApprovalRecovery({
+      storage: () => ({
+        load: async () => {
+          current = false;
+          return await storeWith([operation]).load();
+        },
+      }),
+      resume: { handle, status: () => "idle" },
+    });
+    recovery.capture(result, () => current);
+
+    expect(await recovery.tryResumeOnce()).toBe(false);
+    expect(handle).not.toHaveBeenCalled();
+  });
+});
+
 test("missing or ambiguous stored identity never falls back to an identical history call", async () => {
   for (const pending of [[], [operation, operation]]) {
     const deliver = mock((_message: InboundMessage): void => undefined);

src/session/approval-resume.ts

@@ -53,6 +53,11 @@ export interface ApprovalResume {
    * results so callers can forward them unchanged.
    */
   handle: (result: SendResult) => Promise<boolean>;
+  /**
+   * Where a correlation's settlement stands: `idle` when nothing is gating or
+   * has been handed over, so a fresh `handle` would open the operator surface.
+   */
+  status: (correlationId: string) => "idle" | "in-flight" | "handed-over";
 }
 
 export interface SuspendedApprovalRecovery {
@@ -93,6 +98,11 @@ export function createSuspendedApprovalRecovery(args: {
         return false;
       }
       current.attempted = true;
+      // Re-running `handle` only helps when no settlement exists for this
+      // correlation. An in-flight one would be joined (it is the wedge), and a
+      // handed-over one would be ignored, so both fall back to the abort.
+      if (args.resume.status(current.result.correlationId) !== "idle")
+        return false;
       const storage = args.storage();
       if (storage === undefined) return false;
       try {
@@ -466,6 +476,12 @@ export function createApprovalResume(args: {
   };
 
   return {
+    status: (correlationId) =>
+      handedOver.has(correlationId)
+        ? "handed-over"
+        : inflight.has(correlationId)
+          ? "in-flight"
+          : "idle",
     handle: (result) => {
       if (result.type !== "suspended") return Promise.resolve(false);
       const { correlationId } = result;

src/tui/runner/submit.ts

@@ -395,6 +395,8 @@ export function createSubmitPath(
           );
         }
         await services.approvalResume.handle(result);
+        // Settled: nothing is left for the stall watchdog to re-present.
+        services.suspendedApprovalRecovery.clear();
       });
       return { status: "accepted" };
     } catch (error) {

src/tui/runtime-bridge.ts

@@ -51,6 +51,7 @@ import {
   isStalledForDisplay,
   shouldAbortForStall,
   stallLevel,
+  STALL_APPROVAL_RESUME_MESSAGE,
   STALL_NOTICE_MESSAGE,
   STALL_NOTICE_MS,
   STALL_RECOVERY_MESSAGE,
@@ -178,12 +179,6 @@ export interface TurnMonitorOptions {
   readonly stallNoticeMs?: number;
   /** Registers the periodic tick; returns an unsubscribe. */
   readonly schedule?: (tick: () => void, intervalMs: number) => () => void;
-  /**
-   * Attempts to re-present one already persisted approval suspension. This
-   * deliberately receives no agent, storage, grant, or tool capability: a
-   * true result means the correlated approval path owns the continuation.
-   */
-  readonly tryResumeSuspendedApproval?: () => boolean | Promise<boolean>;
 }
 
 const DEFAULT_TICK_MS = 250;
@@ -241,8 +236,14 @@ export interface SessionBridge {
   gateOpened: () => void;
   /** A previously raised gate resolved. */
   gateClosed: () => void;
+  /**
+   * Registers the attempt to re-present one already persisted approval
+   * suspension when the stall watchdog fires. It receives no agent, storage,
+   * grant, or tool capability: a true result means the correlated approval
+   * path owns the continuation, false falls back to the interrupt.
+   */
   setSuspendedApprovalRecovery: (
-    recovery: (() => boolean | Promise<boolean>) | undefined,
+    recovery: (() => Promise<boolean>) | undefined,
   ) => void;
   dispose: () => void;
   /** Current derived turn phase (progress label, stall clock, quota window). */
@@ -519,7 +520,7 @@ export interface BridgeBag {
   /** callId→name / delta bookkeeping for production-shaped events. */
   mapCtx: StreamMapContext;
   disposed: boolean;
-  suspendedApprovalRecovery: (() => boolean | Promise<boolean>) | undefined;
+  suspendedApprovalRecovery: (() => Promise<boolean>) | undefined;
   turn: TurnState;
   /**
    * Live fleet-lane count from the last `fleet` event (idle-with-fleet).
@@ -2154,6 +2155,9 @@ export function attachSessionBridge(
     flushOccupancyThenWake();
   };
 
+  // When the in-flight approval resume began; at most one runs at a time.
+  let stallResumeStartedAt: number | undefined;
+
   const tick = (): void => {
     if (bag.disposed) return;
     const nowMs = now();
@@ -2224,20 +2228,42 @@ export function attachSessionBridge(
           },
           STALL_RECOVERY_MESSAGE,
         );
-      const resumed =
-        bag.suspendedApprovalRecovery?.() ??
-        monitor?.tryResumeSuspendedApproval?.();
-      if (resumed instanceof Promise) {
-        void resumed.then(
-          (handled) => {
-            if (!handled) recover();
-          },
-          () => recover(),
-        );
+      if (stallResumeStartedAt !== undefined) {
+        // One resume attempt is already out. Give it a single stall budget,
+        // then take the abort so a wedged attempt cannot hold the turn open.
+        if (nowMs - stallResumeStartedAt < stallArgs.stallTimeoutMs) return;
+        stallResumeStartedAt = undefined;
+        recordTurnMarker(bag, "stall-resume:timeout");
+        recover();
         return;
       }
-      if (resumed) return;
-      recover();
+      const resume = bag.suspendedApprovalRecovery;
+      if (resume === undefined) {
+        recover();
+        return;
+      }
+      const startedAt = nowMs;
+      stallResumeStartedAt = startedAt;
+      const settle = (handled: boolean, marker: string): void => {
+        // A timed-out or superseded attempt already took its own outcome.
+        if (stallResumeStartedAt !== startedAt) return;
+        stallResumeStartedAt = undefined;
+        recordTurnMarker(bag, marker);
+        if (handled) return;
+        // Re-evaluate: the turn may have moved on while the attempt ran.
+        if (shouldAbortForStall(stallArgsFor(now()))) recover();
+      };
+      setStatusFlash(shell, STALL_APPROVAL_RESUME_MESSAGE, {
+        ttlMs: RUNTIME_FLASH_MS,
+      });
+      void resume().then(
+        (handled) =>
+          settle(
+            handled,
+            handled ? "stall-resume:handled" : "stall-resume:fallback",
+          ),
+        () => settle(false, "stall-resume:error"),
+      );
       return;
     }
 

src/tui/stall-watchdog.ts

@@ -159,6 +159,13 @@ export const STALL_NOTICE_MESSAGE =
 export const STALL_RECOVERY_MESSAGE =
   "stopped after no response — send again to retry";
 
+/**
+ * Shown while the watchdog re-presents an approval that was already parked.
+ * Names the attempt only: it never claims the parked call ran.
+ */
+export const STALL_APPROVAL_RESUME_MESSAGE =
+  "no response while waiting on approval, re-presenting the pending approval";
+
 /**
  * Shown once a repeated line aborts the turn. Named as degeneration, not a
  * generic failure, so a retry reads as the reasonable next step rather than

src/tui/turn-monitor.test.ts

@@ -12,6 +12,7 @@ import { withTestRenderer } from "./harness.js";
 import { RUNTIME_FLASH_MS } from "./runtime-notices.js";
 import { LIVE_WORD_MS } from "./chrome-state.js";
 import {
+  STALL_APPROVAL_RESUME_MESSAGE,
   STALL_NOTICE_MESSAGE,
   STALL_RECOVERY_MESSAGE,
 } from "./stall-watchdog.js";
@@ -553,6 +554,126 @@ describe("stall watchdog", () => {
   });
 });
 
+describe("stall recovery of a suspended approval", () => {
+  const flush = (): Promise<void> => new Promise((r) => setTimeout(r, 0));
+
+  // A mid-stream hang past the stall budget: the one shape auto-abort acts on.
+  function reachStallBudget(t: Harness) {
+    t.bridge.submit("build it", "immediate");
+    t.bridge.handle({ type: "inference.text.delta", data: { token: "ok" } });
+    t.port.clear();
+    t.advance(1_500);
+  }
+
+  function deferredRecovery() {
+    let calls = 0;
+    let settle!: (handled: boolean) => void;
+    let fail!: (error: Error) => void;
+    const recovery = (): Promise<boolean> => {
+      calls += 1;
+      return new Promise<boolean>((resolve, reject) => {
+        settle = resolve;
+        fail = reject;
+      });
+    };
+    return {
+      recovery,
+      calls: () => calls,
+      resolve: (handled: boolean) => settle(handled),
+      reject: (error: Error) => fail(error),
+    };
+  }
+
+  test("a handled resume suppresses the interrupt and says what it is doing", async () => {
+    await withHarness(async (t) => {
+      const d = deferredRecovery();
+      t.bridge.setSuspendedApprovalRecovery(d.recovery);
+      reachStallBudget(t);
+
+      t.tick();
+      expect(d.calls()).toBe(1);
+      expect(t.shell.statusFlash).toBe(STALL_APPROVAL_RESUME_MESSAGE);
+
+      d.resolve(true);
+      await flush();
+      expect(t.port.calls).toEqual([]);
+    });
+  });
+
+  test("a resume that cannot proceed falls back to the one interrupt", async () => {
+    await withHarness(async (t) => {
+      const d = deferredRecovery();
+      t.bridge.setSuspendedApprovalRecovery(d.recovery);
+      reachStallBudget(t);
+
+      t.tick();
+      d.resolve(false);
+      await flush();
+      expect(t.port.calls).toEqual([{ op: "interrupt" }]);
+      expect(t.shell.statusFlash).toBe(STALL_RECOVERY_MESSAGE);
+    });
+  });
+
+  test("a resume that throws falls back to the interrupt", async () => {
+    await withHarness(async (t) => {
+      const d = deferredRecovery();
+      t.bridge.setSuspendedApprovalRecovery(d.recovery);
+      reachStallBudget(t);
+
+      t.tick();
+      d.reject(new Error("boom"));
+      await flush();
+      expect(t.port.calls).toEqual([{ op: "interrupt" }]);
+    });
+  });
+
+  test("duplicate ticks while a resume is out neither re-enter nor interrupt", async () => {
+    await withHarness(async (t) => {
+      const d = deferredRecovery();
+      t.bridge.setSuspendedApprovalRecovery(d.recovery);
+      reachStallBudget(t);
+
+      t.tick();
+      t.advance(250);
+      t.tick();
+      t.advance(250);
+      t.tick();
+      expect(d.calls()).toBe(1);
+      expect(t.port.calls).toEqual([]);
+
+      d.resolve(false);
+      await flush();
+      expect(t.port.calls).toEqual([{ op: "interrupt" }]);
+    });
+  });
+
+  test("a wedged resume is bounded by one more stall budget", async () => {
+    await withHarness(async (t) => {
+      const d = deferredRecovery();
+      t.bridge.setSuspendedApprovalRecovery(d.recovery);
+      reachStallBudget(t);
+
+      t.tick();
+      t.advance(1_000);
+      t.tick();
+      expect(t.port.calls).toEqual([{ op: "interrupt" }]);
+
+      // The late settle must not interrupt a second time.
+      d.resolve(false);
+      await flush();
+      expect(t.port.calls).toHaveLength(1);
+    });
+  });
+
+  test("no registered recovery keeps the plain abort", async () => {
+    await withHarness(async (t) => {
+      reachStallBudget(t);
+      t.tick();
+      expect(t.port.calls).toEqual([{ op: "interrupt" }]);
+    });
+  });
+});
+
 describe("repetition guard", () => {
   test("a slow but progressing turn is never killed", async () => {
     await withHarness(async (t) => {