fix(server): provider switches hand off started cancelled runs#34016

isHandoffSourceRun in apps/server/src/orchestration-v2/Orchestrator.ts accepted only completed, failed and interrupted runs. A run that started and then ended 'cancelled' (the provider reported it cancelled; a T3 Stop records 'interrupted') was therefore skipped both on an immediate provider switch (the latestHandoffRun lookup in the send path) and when a queued run on another provider was promoted (the coveredRuns filter). As a result the new provider never saw that run's prompt or response. The predicate now also accepts cancelled runs whose startedAt is non-null. Queued requests cancelled before they started have startedAt null and stay excluded; rolled_back runs stay excluded. The same predicate gates lastDeliveredRunForProviderThread, and there a non-completed run still has to have a provider turn for its attempt, so a cancelled run counts as delivered only if it actually reached the provider. ContextHandoffService's visibleConversationItems already keeps a cancelled run's items, except queued_turn user messages, so the handoff carries the run's visible history with its cancelled status. No new regex or parser. Repro: before the fix the two cancelled rows on factory/repro-34009 failed at assert.isDefined(handoff) and the other five 'hands off' rows passed; all pass after the fix.

Fixes pingdotgg/t3code#34009

Reproduction on main

Commit 1fed70cd19998cee7907f6fde3b4d4290ba99cfc (origin/main). Reproduced through the server's real OrchestratorV2, effect worker and a temporary SQLite database in apps/server/src/orchestration-v2/testkit/ProviderSwitch.integration.test.ts, using test adapters; there was no live UI run. A started turn ends cancelled only when the provider itself reports it (an ACP stopReason cancelled without a T3 Stop, or a Codex turn that ends cancelled). Pressing Stop in T3 records interrupted, which already hands off. No provider on the VM produces a cancelled turn on demand. Steps: added cancelledRunOrdinals to the test adapter and two rows to the existing 'hands off %s' table: (cancelled, immediately, new provider) and (cancelled, through the queue, returning provider). In each, the source provider streams a prompt and response, the turn ends cancelled, then the thread switches provider and sends 'Continue'. Ran vp test run src/orchestration-v2/testkit/ProviderSwitch.integration.test.ts -t "hands off": both cancelled rows fail at assert.isDefined(handoff). The target run has no context handoff, so the new provider never receives the cancelled run's prompt or response. The four existing failed and interrupted rows pass. Temporarily accepting cancelled runs with a non-null startedAt in isHandoffSourceRun made all 7 rows pass; that change was reverted and only the tests were pushed.

Evidence

Environment for every capture: Linux, Chromium, dark theme, 1280×900 CSS pixels. Each commit ran the real web dev app and server from its own worktree with fresh isolated SQLite state (T3CODE_DEV_SEED=0). Both used identical synthetic data and scripted ACP subprocesses through the production adapter.

Steps on both commits:

1. Send the synthetic source prompt. The provider streams ORCHID-34009, then reports cancelled without pressing T3 Stop. Confirm cancelled with non-null startedAt.
2. Switch to a new destination provider and send Continue.
3. In a separate thread, first establish the destination session, then dispatch the source turn and queue Continue on the returning destination.
4. Wait for terminal states and inspect the destination's report of its actual incoming ACP prompt.

Both paths report NO/NO/NO on base and YES/YES/YES on head for receiving the source prompt, response and cancelled status. Head creates the missing handoff, including cancelled run ordinal 2 in the queued-return case. Recordings were visually inspected; final stills passed identical screenshot comparisons at least 500 ms apart (AE=0).

ACP provider script · Browser driver and seed script · Reproduction instructions · Observed runtime summary

AI-assisted; verified with the tests and tools listed above.

Not shown:

• Vendor-specific cancellation generation, including Codex: cancellation was emitted by a deterministic ACP subprocess; no live vendor cancellation was exercised.
• Queued requests cancelled before starting and rolled-back runs remaining excluded: these exclusion cases were not exercised in the app.
• Desktop, mobile, relay and tunnel modes: verification covered the local web client and real server only.

Tests

Before the fix: vp test run src/orchestration-v2/testkit/ProviderSwitch.integration.test.ts -t "hands off" gave 2 failed (the cancelled rows), 5 passed. After the fix: vp test run src/orchestration-v2/testkit/ProviderSwitch.integration.test.ts gave 51/51 passed. vp run check:changed passed format, lint, knip, typecheck (3 packages) and the tests beside the change (5 files).

Not in this change

• The git.cafe credential setup on this VM: the global config sets credential.https://git.cafe.usehttppath=true, but the stored credential has no path, so a plain git push origin fails to authenticate (cafe auth http status reports 'conflicting'). I pushed with -c credential.https://git.cafe.usehttppath=false for that one command and left the global config unchanged. Category: infra/FRICTION.

AI-assisted; verified with the tests and tools listed above.