Skip to content

fix(vcs): deadline + backoff self-heal for checkpoint capture timeouts - #201

Merged
johnnyelwailer merged 2 commits into
mainfrom
fix/checkpoint-capture-timeout-self-heal
Sep 11, 2026
Merged

johnnyelwailer merged 2 commits into
mainfrom
fix/checkpoint-capture-timeout-self-heal

Conversation

@johnnyelwailer

Copy link
Copy Markdown
Owner

Context

Live incident: in large repositories (many worktrees, submodules, thousands of files) the whole-worktree git add inside GitVcsDriver.checkpoints.captureCheckpoint outlives the generic 30s VcsProcess deadline — most of all while an auto-gc repacks the shared object store (measured 42s on a loaded host). Every turn then surfaced a user-visible "Checkpoint capture failed" activity.

Change

  • The checkpoint index step (whole-worktree git add / ls-files enumeration) gets its own 120s deadline (CHECKPOINT_INDEX_TIMEOUT_MS) instead of the generic 30s default.
  • If a VcsProcessTimeoutError still fires, the capture self-heals: the whole attempt is re-run from a fresh temp index (idempotent by design — temp index seeded from HEAD, update-ref is deterministic) with the same backoff-ladder pattern as the interrupted-turn re-drive (t3team-workflowEngineTurnRetrySupport.ts): 5s, then 30s, then the failure surfaces unchanged.
  • Regression test (it.live — real clock, so the 5s ladder step actually elapses): the first git add times out, the capture succeeds via the retry, and both index steps carry the dedicated deadline.

Verification

  • pnpm typecheck (apps/server): clean
  • pnpm exec vitest run src/vcs/t3team-GitVcsDriverCheckpointIndex.test.ts: 4/4 pass (new self-heal test exercises the real 5s backoff step)

`git add -A` during checkpoint capture ran on the generic 30s VcsProcess
deadline. In large repositories (many worktrees, submodules, thousands of
files) it routinely exceeds that under disk pressure - most of all while
an auto-gc repacks the shared object store - so every turn surfaced a
user-visible "Checkpoint capture failed" activity.

- give the checkpoint index step (whole-worktree add / ls-files) its own
  120s deadline instead of the generic 30s default
- on a VcsProcessTimeoutError, re-run the whole capture from a fresh temp
  index (idempotent by design: temp index seeded from HEAD, update-ref is
  deterministic) with the same backoff-ladder pattern as the
  interrupted-turn re-drive: 5s, then 30s, then surface the failure
- regression test (it.live, real clock): first add times out, the capture
  succeeds via the retry, and both index steps carry the dedicated deadline
@github-actions github-actions Bot added vouch:trusted PR author is trusted by repo permissions or the VOUCHED list. size:M labels Sep 11, 2026
…dary tests

Follows the PR 201 adversarial review (APPROVE, non-blocking findings):
- bound the whole checkpoint self-heal with a 180s total wall-clock
  budget so the serial checkpoint worker is never blocked for the
  ~14-minute worst case of 3 attempts plus backoff
- thread the checkpoint deadline through the git ls-files fallback
  enumeration, matching the documented behavior
- tests: assert the retry uses a fresh GIT_INDEX_FILE; assert
  non-timeout failures are not retried; assert the all-timeout
  boundary propagates after exactly 3 attempts
@github-actions github-actions Bot added size:L and removed size:M labels Sep 11, 2026
@johnnyelwailer
johnnyelwailer merged commit 89ab865 into main Sep 11, 2026
13 of 19 checks passed
@johnnyelwailer
johnnyelwailer deleted the fix/checkpoint-capture-timeout-self-heal branch September 11, 2026 07:42
johnnyelwailer added a commit that referenced this pull request Oct 12, 2026
…eting, linked repos) (#524)

* fix(web): desktop UX fixes (My Work drag, sign-in dialog, loading greeting, linked repos)

- My Work pane and startup gate get the Electron drag header (nx-nexi#199)
- Device-code account sign-in is a dialog, not a truncated sidebar button (#201)
- My Work loading screen: time-of-day greeting + vector animation, no logo (#202)
- Linked repositories: schemeless host/owner/repo gets https://, signed-in
  detection no longer fails on one stale host, Recheck re-probes, larger dialog (#203)

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

* fix(web): sign-in code dialog spacing without restyling DialogPanel

DialogPanel owns its spacing (shadcn/no-restyle failed Lint). Move the gap onto
a plain wrapper, as the other dialogs do.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Philip Jonientz <philip.jonientz@nexplore.ch>
Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

size:L vouch:trusted PR author is trusted by repo permissions or the VOUCHED list.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant