i confirmed with gh:

• auth is via GH_TOKEN, with project scope
• PR fix: harden agy-acp session binding with state-file persistence #928 exists and matches the claimed item
• project item PVTI_lADOEFbZWM4BUUALzgt3arQ is still Incoming
• no existing marker comment was found

the first write attempt failed before gh ran:

bwrap: No permissions to create new namespace

after that, even trivial commands like pwd failed the same way, so i could not create the GitHub comment or move the project item.

Screening Report

Intent

PR #928 fixes stale or cross-session output in agy-acp by binding ACP sessions to the correct agy conversation more reliably. The operator-visible problem is that latest-file conversation lookup can guess wrong, especially across restarts or concurrent sessions.

Feat

Fix work. It adds snapshot-diff binding, persistent session state, lock-file guarded writes, safer delta extraction, subprocess error handling, and bounded session restore.

Who It Serves

Agent runtime operators and maintainers first. End users benefit indirectly through fewer stale or misbound ACP replies.

Rewritten Prompt

Harden agy-acp session binding so each ACP session maps to the correct agy conversation and remains stable across restarts. Snapshot conversation files before and after first invocation, bind only when exactly one new conversation appears, persist the mapping atomically under ~/.openab/agy-acp/sessions.json, protect state with a lock file, restore on startup, cap memory, preserve leading whitespace in deltas, and return JSON-RPC errors on subprocess failure.

Merge Pitch

This should move forward because it addresses the stale-output class more durably than #927. Risk is moderate: filesystem state, locking, subprocess behavior, and eviction all need careful review.

Best-Practice Comparison

OpenClaw is relevant for durable routing and isolated execution. This PR moves closer by persisting explicit session bindings, though it does not cover broader job persistence, retry/backoff, delivery routing, or run logs.

Hermes Agent is relevant for file locking and atomic persisted daemon state. The fresh-session scheduled-run model does not directly apply.

Implementation Options

1. Conservative: merge subprocess/delta fixes and ambiguity refusal only.
2. Balanced: merge this PR’s persisted binding, locking, atomic write, restore, and tests.
3. Ambitious: change upstream agy so it returns conversation IDs directly.

Comparison Table

Recommendation

Take the balanced path. Advance #928 for detailed review, focusing on lock behavior, atomic write failure modes, corrupted JSON recovery, and whether the 64-session eviction policy can evict active sessions. Close #927 as superseded if #928 lands.

GitHub comment: not created due sandbox failure.
Project action: not moved due sandbox failure.

🔴 F1: Random Eviction Vulnerability

while self.sessions.len() >= MAX_SESSIONS {
    if let Some(key) = self.sessions.keys().next().cloned() {
        self.sessions.remove(&key);
    }
}

HashMap::keys() iteration order is non-deterministic. This evicts an arbitrary session — likely an active one. When that session receives its next prompt, it restores from disk with empty prev_output, causing extract_delta to return the full conversation history (duplicate output to Discord).

Suggested fix: Track last_active timestamp per session and evict the least-recently-used entry (simple O(N) scan is fine for N=64).

🟡 F2: Silent I/O Failures

When lock_state_file returns None or deserialization fails, the code silently falls back to empty state. In production this makes debugging extremely difficult — operators have no signal that persistence is broken.

Suggested fix: Log warnings to stderr on lock/parse failures. Consider returning Result instead of silently defaulting.

🟡 F3: Concurrency Race Condition

When multiple unbound sessions receive prompts simultaneously, each takes a filesystem snapshot, then diffs after the agent responds. If multiple new conversation files appear between snapshots, the safety check (new_files.len() == 1) fails for all sessions, and none can bind.

Suggested fix: Use the session-specific expected path pattern or agent PID to disambiguate, rather than relying on a global diff.

🟡 F4: Missing fsync

The atomic write pattern (write temp → rename) does not call sync_all() on the temp file before renaming. On crash/power-loss, the renamed file may contain incomplete data.

Suggested fix: Add file.sync_all()? before the rename call.

• PR opened: 2026-05-26
• Supersedes: PR fix: harden agy-acp session binding #927 (same fix, different approach)
• Net-new value: Persistent session binding across restarts via state file

• Excellent test classification — integration tests properly marked #[ignore], unit test naming follows test_<scenario>_<expected_outcome> convention
• Lock-file based mutual exclusion is a pragmatic choice for single-node deployment
• Atomic rename pattern for state persistence (just needs fsync)