M7: Scope an interrupt to its Turn so a failed interrupt leaves no fired abort

[Sandstorm831]

Parent

Spec #276; implementation sub-issue of M7 #275.

What to build

An interrupt that did not stop its Turn leaves no fired abort behind, so the next human Turn, a following Agent Turn, or a following Command step runs normally, and the interrupt Operation settles not-applied when the Turn ended another way. The case is verified real (the spec's scratch probe at fb3ee06): today the Run's single abort signal fires and is never reset. The repair makes an interrupt Turn-scoped, bound per Turn the way Steer and Harness Requests are. An applied Interrupt still rests the Run halted; ADR 0035's Turn-only Interrupt is not built. The execution comments describing the Interactive Harness as closed after each human Turn are rewritten: the Harness is held for the Step and closed once, and detached is recorded after each Turn so a later reopen or the next Agent step can resume (stories 111, 117–119, 121).

Acceptance criteria

• Projection Port tests land first and are red at their base: Turn 1 completes despite an interrupt, and the next human Turn, a following Agent Turn, and a following Command step each run normally.
• After the repair they are green, and the interrupt Operation settles not-applied when the Turn completed another way.
• A rejected interrupt receipt leaves no fired signal behind.
• The stale execution comments are corrected (comment only).
• Headless --json changes only additively.
• CI scenario: the Port tests are green on Windows x64, macOS arm64, and Linux x64.

Blocked by

• M7: Report structural violations from one rule catalogue in a dedicated gate step #277
• M7: Report guidance-structure violations in the contract and check Module guidance shape #278
• M7: Report vendor-provenance violations in the contract #279
• M7: Report release-workflow violations in the contract #280
• M7: Enforce unused code and clear today's findings #281
• M7: Fail lint on any warning and add two OpenCode style rules #282
• M7: Label who holds the Turn and settle an interactive send on admission #290

Implementation packet

Owner: Application (interrupt scoping behind the Projection Port), Run execution comments

Ratchet: Port tests for a failed interrupt followed by a human Turn, an Agent Turn, and a Command step

Deletes: the Run-wide abort signal that stays fired after an interrupt, and the stale closed-per-Turn comments

Gate: ADR 0027 three-OS CI and recorded human evidence, with the slice scenario above.

Dependencies: no new runtime dependency

[Sandstorm831]

Starting context

Files are pinned at b976b6c, which carries #281's unused-code gate. Since the spec's probe at fb3ee06, application.ts, agent.ts, and execution.ts changed only by #281's un-exports (git diff), so the probe's result still holds by source reading. It was not re-run. The #255 line references (agent.ts:369, :918, :462) are still exact at b976b6c.

Blocker first. #290 lands first. It moves the interactive send's settlement from Turn end to admission, in startSendInteractiveTurn/runInteractiveSend, and it amends run-control's deferred settlement and interactive drive lines. Those lines say what tracking.promise holds, and interrupt-turn awaits that promise. Re-read both at #290's merge. The line numbers below are as they stand before it.

Input	Why it matters	Authority
Spec #276 stories 111, 117–121, Implementation Decisions › Interrupt and Steer fixes (Stale comments, Rejected-interrupt abort signal) and Cross-cutting › Module ownership, and Testing Decisions › Seams 3 (the rejected-interrupt bullet and its prior art)	The target and the probe. Interactive: Turn 1 completed despite an interrupt, the Operation said applied, and the next human Turn was interrupted at once. Agent then Agent: the second Turn was interrupted at once. A rejected receipt does the same. Command step: not probed. The spec leaves open the outcome mapping, the not-applied Problem, and when the Operation settles.	Canonical spec
#255 decision items 1 and 4, and ADR 0035 › Interrupt, per Step kind	The origin of the fix, and the later redesign. An applied Interrupt still rests the Run halted, and ADR 0035's Turn-only Interrupt is not built here.	Canonical decision
TrackedRun.abort and interruptTurnAndSettle	The cause. There is one readonly controller per Run. Interrupt aborts it with INTERRUPT_TURN_ABORT, and the Harness receipt is dropped at agent.ts L458-L460. It then reports applied once tracking.promise resolves, and for an Agent step that promise is the whole Run's execution.	Current behavior
runInteractiveSend and executeTrackedRouting	Where the fired signal leaks. Every human Turn gets tracking.abort.signal (L2325), and the whole Routing gets the same signal (L821), so Agent and Command steps share it. interrupted or lost rests halted (L2328-L2334).	Current behavior
driveHarnessTurn, with the per-Turn bindAnswer/bindSteer, the abort wiring, and the unbind; RequestChannel and LiveSteerFn; LiveOverlayState and bindSteer	The model the spec names ("bound per Turn the way Steer and Harness Requests are"). An already-aborted signal interrupts the new Turn at once (L462). Steer's round trip, from bind in execution through the live overlay to steerTurnAndSettle returning the receipt, is the shape to copy.	Current behavior
Command spawn with the signal, cancelled → RunCancelledError, and the real process killing at once on a pre-aborted signal and reporting cancelled; the double's spawnCommand	The Command case, inferred from source. The real spawn is killed at once and throws. Then driveWithAbortProtocol keeps the owner and returns applied without resting the Run. The Process double's commandHandler ignores the signal, so a red Command test needs a handler that returns cancelled for a pre-aborted signal, as the real process does.	Current behavior
Interrupted → cancelled, lost → indeterminate, both halted	The halted rest comes from the Turn's result, not the abort reason, so a Turn-scoped interrupt keeps it.	Current behavior
Abort-reason vocabulary and its re-export	If interrupt stops using the controller, INTERRUPT_TURN_ABORT loses its only writer, and the unused-code gate or lint then fails until it is deleted. RUN_CANCEL_ABORT and SIGNAL_ABORT stay Run-wide.	Current behavior
Stale comments: agent.ts L369-L371, L529-L530, and L918-L930; the truth is in interactiveStepDriver	Comment only. One prepared Harness is held for the Step and closed once. detached is still recorded after each Turn, and #296 relies on that.	Current behavior
turnControlRejected and steerRejected	The candidate Problems for not-applied. Headless has no interrupt command (grep of src/headless), so the --json exposure is the durable snapshot alone.	Current behavior
Port prior art: wire, awaitLiveTurn, the applied-interrupt test, and the interactive entry-Turn interrupt	Fixtures touched: new Port tests land here, red first. The applied case must stay green.	Current tests
Fake Harness: turn script, interrupt, drive, and the shared suite over it	Fixture touched. The fake always accepts and always stops. It has no knob for a rejected interrupt or for an accepted one that the Turn outruns. A knob must keep the shared suite green.	Current tests
Settlement, cancel, and shutdown, Turn interrupt and steer, execution › Invariants, application › Invariants, and Harness › Interrupt	Rewrite the "same one AbortController" and three-reason race text. Keep Windows in mind: every Claude Code interrupt of a live Turn there settles lost.	Current guidance
OpenCode 228e9095ba packages/opencode/src/session/run-state.ts:L52-L86	Prior art: one runner per busy session, removed on idle. A cancel with no runner is a no-op, so no stop outlives its work.	Advisory

Reading rule

Start with the spec's Rejected-interrupt bullet, then interruptTurnAndSettle, driveHarnessTurn's bindings, and the applied-interrupt Port test.

• Red first: land the Port tests for the interactive step, Agent then Agent, and Agent then Command, and see them fail at base before the repair.
• Bind interrupt per Turn beside bindSteer and unbind it at Turn end. A rejected receipt and a Turn that ends another way must leave nothing fired. Cancel and shutdown stay Run-wide.
• Do not settle not-applied by awaiting tracking.promise in an Agent step, because that is the whole Run. Settle on the Turn's own end.
• Everything stays in the Application and execution. No Harness Interface change, and no TUI change.
• Order: this ticket starts after M7: Label who holds the Turn and settle an interactive send on admission #290 merges and edits the same application.ts region and run-control.md, so rebase onto it. This ticket blocks M7: Refuse a failed Codex control call without losing the Turn #297 (settled with the human on 2026-09-30), because M7: Refuse a failed Codex control call without losing the Turn #297 makes a failed Codex Interrupt leave its Turn running, and that Turn must not meet a fired Run-wide signal.
• The unused-code gate runs in check (baseline). Export a new type only if another file imports it.

Open for the human

Choices the spec leaves open, each with the drafting recommendation. They are settled with the human when this context is refreshed for ready-for-agent.

1. Outcome. Recommendation: applied only when the Turn ends interrupted or lost. Reason: lost has to count, because every Windows Claude Code interrupt ends that way.
2. Rejected receipt. Recommendation: it settles not-applied at once.
3. Problem. Recommendation: add an interrupt-rejected Problem, mirroring steer-rejected.
4. INTERRUPT_TURN_ABORT. Recommendation: delete it. It loses its only writer, and the unused-code gate would fail otherwise.

Still unknown:

• Whether a Command step after a fired signal fails at base was not run. This matters, because the red test's Process double must honour a pre-aborted signal as the real process does.
• The spec's probe was not re-run. The only source change since is M7: Enforce unused code and clear today's findings #281's un-exports.

Owner: Application (interrupt scoping behind the Projection Port), Run execution comments
Ratchet: Port tests for a failed interrupt followed by a human Turn, an Agent Turn, and a Command step
Deletes: the Run-wide abort signal that stays fired after an interrupt, and the stale closed-per-Turn comments
Gate: ADR 0027 three-OS CI and recorded human evidence, with the slice scenario above.
Dependencies: no new runtime dependency