[pthombre]

What changed and why

A harness that gives up on a model call while a checkpoint holds it abandons that call. Examples are OpenCode stopped at a checkpoint (the fallback when a pause cannot be confirmed, #4274) and a run cancelled while its call is held.

With token capture on, the ledger had already recorded the call, often as a failure row for a request that ended without staging coordinates. Once the request had finished, the policy gate no longer counted it as undelivered, so the row went into the commit. The restored attempt's manifest then reported a failure for a call that no trajectory contains, which masks the sample.

What this PR adds:

• The policy gate remembers abandoned calls: calls whose client left while admission was closed (PolicyGate.abandoned, carried in GateSnapshot.abandoned).
• The commit leaves their rows out, as it does for an undelivered call.
• The resume drops them from the live ledger (FileLineageStore.discard_calls).
• Both policy servers: this works in the single-process and the multi-worker policy server (model_workers.py).

With #4274's pause-at-checkpoint, OpenCode keeps its held call across an in-job checkpoint and reads the reply on continue, so in-job checkpoints rarely abandon a call now. This PR still covers the stop fallback, cancelled runs, and any harness that does not pause.

How it works

sequenceDiagram
  participant H as Harness
  participant G as Policy gate
  participant L as Capture ledger
  participant C as Checkpoint
  H->>G: model call (admitted)
  G->>L: row for the call
  C->>G: close admission (the reply is held)
  H--xG: the client leaves (stopped or cancelled)
  G->>G: remember the call as abandoned
  C->>G: commit
  G-->>C: records without the abandoned call's row
  C->>G: resume
  G->>L: discard the abandoned call's row

Loading

Where this sits in the stack

Stack #4578, on ananthsub/partial-ckpt-fault-tests:

1. feat(sandbox): sandbox and snapshot lifecycle for partial-rollout checkpoints #4220: sandbox checkpointer, release, snapshot index, sandbox lease
2. feat(checkpoint): process-level evidence for resources-owned sandbox checkpoints, their release, and lease expiry #4221
3. feat(checkpoint): ask a long-running agent harness to park when a checkpoint opens #4222
4. feat(sandbox): sandbox owner base for resources servers, with SWE-bench on it #4576
5. feat(checkpoint): harness driver for sandboxed agents that pauses them at checkpoints, with OpenCode on it #4274: the harness driver with pause-at-checkpoint, with OpenCode on it
6. fix(checkpoint): leave the calls a checkpoint abandoned out of the capture ledger #4451 (this PR)
7. fix(checkpoint): wake sandbox command polls while a harness launch is stopped #4553: wake sandbox command polls while a harness launch is stopped; checkpoint-resume docs
8. feat(checkpoint): prepared verification, so a checkpoint never waits for SWE-bench grading #4778: prepared verification
9. feat(sandbox): take a failed checkpoint snapshot again before failing the export #4779: retry a failed checkpoint snapshot
10. fix(token-id-capture): match a tool call OpenCode rewrote as unavailable #4936: match a tool call OpenCode rewrote as unavailable

The change itself touches only the policy model participant and the capture ledger, independently of the sandbox work below it. It is stacked here because the OpenCode run in #4274 is what exposes it. The patch is unchanged from the previous head; only its base moved.

Issue

No tracking issue.

Validation

On this head (c526f2d06; its tree is identical to d3416046a, tested in the rl-gym.nightly container on Slurm, job 8085409):

• Gym suites (SWE-bench, OpenCode, and the checkpoint, sandbox, OpenSandbox and token-capture unit tests): 2298 passed, 9 skipped, 0 failed.
• ruff is clean, and the commit carries Signed-off-by.

The test for this change: tests/unit_tests/test_checkpoint_model.py::test_a_call_abandoned_while_held_is_left_out_of_the_commit_and_dropped_at_resume. A call held at prepare whose client leaves is excluded from the commit's records, and is gone from the live ledger after the resume.

Earlier, on the previous head (the series tip rebased on ananthsub/partial-ckpt-fault-tests 6f3184eaf, jobs 1246655 and 1246856): checkpoint 758 passed, provider 145, sandbox 211, every pilot passed, and e2e 68 passed.

Rollout evidence

Earlier capture-enabled cell-5 run (job 1186019; scenario B, rows 40–47, TOKEN_CAPTURE=1 behind a staging shim):

• Prepare took 6.8 s, and commit took 25.7 s with 6 snapshots.
• The committed capture rows equal the live ones, with 0 failure rows.
• The restore took 12.7 s for 5 rollouts. For every restored rollout, the restored prefix matched, the uncommitted calls were absent, and the first new call continued the last committed one.

32-node runs with the whole stack (jobs 8093570 on the current stack, and earlier 8078235 and 8080199 → 8081456; details in #4274):

• The lineage audits found 0 dangling parents, 0 branches and 0 token breaks.
• No call admitted after a commit was kept by a restored rollout.

Compatibility

None. Only calls abandoned while admission was closed are affected, and they never belonged in a commit.

🤖 Generated with Claude Code

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.