[JacobStephens2]

Summary

A Run whose failure was caused by the host running out of disk space now hands its issue back instead of charging the failure to it. Out of disk means No space left on device from the OS or git, during worktree creation, a Session trace write, a push and so on.

 claim_ending(failed run)
-  Failed                        # agent-failed if work is on origin
+  Ending::failed(error)
+    out_of_disk(error)?  -> OutOfDisk
+    otherwise            -> Failed (unchanged)

 Claim::end
+  OutOfDisk  -> release even with work on origin:
+                in-progress off, ready-for-agent back,
+                no agent-failed, no Recovery comment
+                (a Security fix still gets agent-failed)

• failed_run::out_of_disk walks the cause chain. It returns true for an io::Error of kind StorageFull, or for a layer whose text contains No space left on device.
  • Chains containing a SessionFailure are never out of disk, because the agent can write its diagnostic.
  • Chains containing TicketsNotDone are never out of disk, because a Spec run's Ticket causes can mix a full disk with genuine failures.
  • Chains containing a Base fix's ChildEnded are never out of disk, because the parent reads the Base fix's cause back as text that can carry its agent's diagnostic.
• No agent-failed label means the Failure limit doesn't count the failure.
• The put-back ready-for-agent is a hand-back, so Pickup retakes the issue only after its settling window. Host limits: wait for free disk space instead of starting sessions that fail on a full disk #2091's disk limit then holds the session until space is free, so a full disk doesn't cause a rapid retry loop.
• The Command log says what to do:
  • The release line reads …, without agent-failed: the host ran out of disk space; free disk space on it, then retry the Command.
  • The same advice follows the cause on stderr.
  • The Recovery lines gain Before retrying: the host ran out of disk space; ….
• ADR 0030 records this as an amendment to ADR 0029's "whatever kind of Command failed" rule.
• Updated docs: the glossary (Claim, Failure limit), the guide, and the hand-written site pages (site/index.html, how-it-works, architecture).

Evidence

Execution evidence

The reproduction is a fake-adapter scenario: a git wrapper on PATH fails git worktree add (or git push) with git's No space left on device message, on an issue whose Issue branch is already on origin.

• Before (production code at main, the new tests applied): cargo test --test out_of_disk

  test a_continuation_whose_worktree_cannot_be_written_for_lack_of_disk_is_handed_back_ready ... FAILED
  test a_push_that_runs_out_of_disk_hands_the_issue_back_and_keeps_earlier_work_on_origin ... FAILED
  test a_failure_that_is_not_out_of_disk_still_labels_agent_failed ... ok
    left: ["bug", "agent-failed"]
   right: ["bug", "ready-for-agent"]
    left: ["agent-failed"]
   right: ["ready-for-agent"]
  

  stderr before: thirdshift: labelling #7 agent-failed, in place of in-progress, so it waits for the Day shift
• After: cargo test --test out_of_disk

  test a_continuation_whose_worktree_cannot_be_written_for_lack_of_disk_is_handed_back_ready ... ok
  test a_push_that_runs_out_of_disk_hands_the_issue_back_and_keeps_earlier_work_on_origin ... ok
  test a_failure_that_is_not_out_of_disk_still_labels_agent_failed ... ok
  test result: ok. 3 passed; 0 failed; 1 ignored
  

Confirmed cause: run::claim_ending mapped every failure to claim::Ending::Failed. For a run with work on origin, such as a Continuation's Issue branch, Ending::Failed swaps in-progress for agent-failed. Nothing distinguished a host cause from an issue cause.

Inline tests:

• claim::tests (47 passed): covers the release with work on origin and a Security fix that still gets agent-failed.
• failed_run::tests (3 passed): covers ENOSPC as an io::Error and as git text, and agent-written diagnostics and TicketsNotDone excluded. The exclusion test failed against the first classifier.
• run_ending::tests (26 passed): covers the advice line and the parent's read-back of the cause.

scripts/affected-tests main:

• npm test --prefix site passed, and npm run docs:check --prefix site passed.
• cargo test had two timing failures, each passing on rerun. Neither test goes near the Claim:
  • process::findings::merged_fix_is_rechecked_after_a_later_fix_fails also flakes on origin/main (1 of 6 runs).
  • triage_pass::recommendation_only_pass_reserves_without_claiming_or_publishing_and_notifies panicked with "the agent never started" after 120s, and passed on rerun.
• Every binary cargo test skipped after that failure was rerun and passed.

Visual evidence

None needed. The site changes are prose inside existing paragraphs, with no layout, CSS or markup structure changed.

Merge Danger

Door: two-way

Reverting restores the old labelling. Issues already released keep ready-for-agent, which is the state the Day shift restored by hand on 2026-11-12.

Blast Radius: labelling

A real issue failure would escape agent-failed and the Failure limit only if its factory-owned cause text says No space left on device. Agent diagnostics, Spec-run Ticket causes and Base fix endings are excluded.

Unaddressed findings

Standards

• command_log duplicates tests/process.rs:767. Declined. Each integration test binary only shares tests/support, and moving this helper there is unrelated churn.
• Shotgun Surgery: the advice bypasses base_fix::Advice. Declined. Advice is the Base fix's labelled advice (Base check:/Retry with:). The out-of-disk advice is one constant, failed_run::OUT_OF_DISK, decided by one predicate, failed_run::out_of_disk / says_out_of_disk.
• Primitive Obsession: substring predicate, no FailureCategory. Declined. By the time run_ending sees the cause it is already text (Cause::full). A new recorded category belongs with the Console display; see the Spec entry below.

Security

None. The Security review found one introduced finding and fixed it: a Base fix agent's diagnostic naming a full disk released the parent Run's Claim without agent-failed. Its regression test is tests/out_of_disk.rs::a_base_fix_agent_saying_the_disk_is_full_does_not_release_the_run_that_waited_on_it.

Spec

• Session trace write scenario ("The same holds when a Session trace write … fails with no space left"). Declined for an integration scenario: no unattended seam yields ENOSPC on the trace write. The trace file is freshly named, and making its directory unwritable gives EACCES, not ENOSPC. The classifier's handling of an io::Error with StorageFull from any layer is covered by failed_run::tests::running_out_of_disk_is_recognised_anywhere_in_the_cause_chain. The push case is covered end to end and pins the exact Preserved: line.
• Inbox / Console shows the failure as a host problem. Not implemented, and filed as Inbox: show a Run that failed because the host ran out of disk as a host problem, not an issue failure #2116 (needs-triage). It is not in the acceptance criteria. How the Inbox (ADR 0023) groups a machine-level failure across runs is a UI decision for the Day shift.

Review coverage: both reviewers read every changed file except site/docs/index.html, which is generated from docs/guide.md and verified with npm run docs:check --prefix site. The second commit's new file, docs/adr/0030-a-full-disk-is-the-hosts-failure-not-the-issues.md, and the later edits to src/recovery.rs were written in response to the review and were not re-reviewed.

Closes #2092

Built with claude 2.1.314 · opus · default effort

Security review outcome

No unaddressed introduced findings.