Chat: a booting run is waited on, not relaunched (CL-7489)

packages/chat/src/agent-binding.test.ts

@@ -186,12 +186,29 @@ describe("isBeyondWake", () => {
     ).toBe(false);
   });
 
-  test("a completed run is beyond waking — wake is a fresh provision", async () => {
+  test("a completed run that took a turn is beyond waking — wake is a fresh provision", async () => {
     expect(
       await isBeyondWake(fakeDb([]), {
         id: "run_done",
         status: "completed",
+        principalId: "prin_1",
       }),
     ).toBe(true);
   });
+
+  // CL-7490: a deployment `markTerminal`'d before its first trigger ever
+  // landed settles "completed" too (see `workflow-run-store.ts`'s
+  // `markTerminal`), and the store cannot otherwise tell that apart from a
+  // run still mid-boot. Treating it as beyond waking here is exactly the
+  // bug that made a booting run's status read as terminal and relaunched
+  // it out from under its own in-flight sidecar registration.
+  test("a completed run that never took a turn is not beyond waking — the store cannot tell it apart from still booting", async () => {
+    expect(
+      await isBeyondWake(fakeDb([]), {
+        id: "run_never_triggered",
+        status: "completed",
+        principalId: null,
+      }),
+    ).toBe(false);
+  });
 });

packages/chat/src/agent-binding.ts

@@ -314,27 +314,46 @@ export async function readPriorRuns(
 }
 
 /**
- * The statuses a `workflow_run` can hold that mean "this run will never
- * accept mail again". Wake of a reaped or lost instance is a fresh
- * `prepareProvisionedDeployment`, not a reuse of this row.
+ * The statuses a `workflow_run` can hold that are terminal regardless of
+ * whether the run ever took a turn. `"completed"` is deliberately absent
+ * here — a deployment `markTerminal`'d before its first trigger settles
+ * "completed" too (see `workflow-run-store.ts`'s `markTerminal`), and that
+ * is a run that is still booting, not one that will "never accept mail
+ * again". `isBeyondWake` below folds `"completed"` back in only once it
+ * can tell the two apart.
  */
-const TERMINAL_RUN_STATUSES: ReadonlySet<string> = new Set([
+const UNCONDITIONALLY_TERMINAL_RUN_STATUSES: ReadonlySet<string> = new Set([
   "failed",
   "cancelled",
   "canceled",
-  "completed",
 ]);
 
 /**
- * Whether this run is dead: terminal in `workflow_run.status`. A run
- * this returns true for cannot be woken — it can only be relaunched as
- * a fresh provisioned deployment.
+ * Whether this run is dead: terminal in `workflow_run.status`, in a way
+ * that actually means "this run will never accept mail again" rather than
+ * "this deployment never got as far as its first trigger". A run this
+ * returns true for cannot be woken — it can only be relaunched as a fresh
+ * provisioned deployment. A run this returns false for — `"deployed"` or
+ * `"running"`, or `"completed"` with no principal ever anchored to it — is
+ * still live or still booting: waking it means waiting for it to become
+ * routable (`deliverWhenRoutable`), never relaunching it (CL-7490).
+ *
+ * `principalId` is the signal for "ever took a turn": `anchorWithPrincipal`
+ * sets it in the same update that flips `"deployed"` -> `"running"` on a
+ * deployment's first trigger, and a child run is born with one already. A
+ * `"completed"` run with no `principalId` can only be a deployment torn
+ * down before that first trigger ever landed — the store cannot tell that
+ * apart from a mid-boot deployment misreporting itself terminal, so it is
+ * treated as still booting rather than relaunched out from under a caller
+ * that is only waiting on it.
  */
 export async function isBeyondWake(
   _db: DB["db"],
-  run: { id: string; status: string },
+  run: { id: string; status: string; principalId?: string | null },
 ): Promise<boolean> {
-  return TERMINAL_RUN_STATUSES.has(run.status);
+  if (UNCONDITIONALLY_TERMINAL_RUN_STATUSES.has(run.status)) return true;
+  if (run.status !== "completed") return false;
+  return run.principalId !== null && run.principalId !== undefined;
 }
 
 /**

packages/chat/src/platform-adapter.ts

@@ -733,35 +733,18 @@ export function createHubChatPlatform(
         return;
       }
 
-      if (live.run.definitionId === null) {
-        throw new Error(
-          `Cannot wake "${binding.stableId}": its run ${live.run.id} names no definition`,
-        );
-      }
-      const definitionAssetId = await resolveDefinitionAssetId(
-        live.run.definitionId,
-      );
-      if (definitionAssetId === undefined) {
-        throw new Error(
-          `Cannot wake "${binding.stableId}": definition ${live.run.definitionId} has no workflow asset`,
-        );
-      }
-      const prepared = await provisionOnAsset({
-        tenantId: binding.tenantId,
-        deploymentDomain: domainOf(binding.roomAddress),
-        sourceAuthorityPrincipalId:
-          await sourceAuthorityForAsset(definitionAssetId),
-        definitionAssetId,
-        foldedBody: binding.foldedBody,
-      });
-      await repointBinding(
-        deps.db,
-        binding,
-        prepared.runId,
-        prepared.sourcesDigest,
-      );
-      lifecycle?.untrack(binding.liveAddress);
-      lifecycle?.track(prepared.address);
+      // CL-7490: not terminal, and not (yet) routable. A provisioned
+      // anchor stays "deployed" until its first trigger — this is
+      // exactly what a run mid-boot looks like from here, and relaunching
+      // it out from under its own in-flight sidecar registration is what
+      // supersedes the allocation and restarts the boot forever (the
+      // "Deployed agent" line never appears; a fresh sidecar/allocation
+      // shows up every few seconds instead). There is nothing this
+      // function can safely do for a live-but-not-yet-routable run: the
+      // caller's own routable wait (`deliverWhenRoutable`, wired through
+      // `sendRunMailWithReclaimRetry`) is what actually resolves this, by
+      // polling the routing table until the boot finishes or its budget
+      // runs out. A no-op here is the correct "nothing more to do".
     } catch (error) {
       throw wrapWakeInferenceError(error);
     }