IronClaw restores one-owner delivery recovery

nearai/ironclaw PR #7029 is the inspected primary source: “fix(product): restore durable delivery claim.” The two related records below were inspected as supporting context, not treated as independent confirmation.

The facts

- nearai/ironclaw PR #7029 was created 2026-08-03T00:46:23Z and was closed at inspection; its title is “fix(product): restore durable delivery claim.” - nearai/ironclaw PR #7028 was created 2026-08-03T00:42:32Z and was closed at inspection; its title is “fix(outbound): preserve terminal status during recovery.” - nearai/ironclaw issue #7025 was created 2026-08-02T23:20:47Z and was open at inspection; its title is “[QA] Concurrent coordinators can both send the same durable delivery attempt.” - The repository reported 12587 stars, 1439 open issues, default branch main, and last push 2026-08-03T00:27:47Z. - The latest tagged-release baseline checked was ironclaw-v1.0.0 published 2026-07-27T19:32:01Z.

What changed

nearai/ironclaw PR #7029 reports: Summary Restore the durable Prepared → Sending compare-and-swap as the sole authority for vendor-egress ownership across coordinator/process instances. Return DuplicateSuppressed to a losing claimant and remove the process-local in_flight authority, so a replay does not resolve targets, materialize attachments, or call the adapter. Add a two-coordinator regression contract over one shared durable backend and update the outbound runtime documentation to state the guarantee and its limits. Preserve notice delivery IDs as fresh/random and make no provider exactly-once claim; this fix prevents concurrent drives of the same stable durable delivery fact only. Change Type [x] Bug fix [ ] New feature [ ] Refactor [x] Documentation [ ] CI/Infrastructure [ ] Security [ ] Dependencies Linked

nearai/ironclaw PR #7028 reports: Summary Replace the interrupted-delivery recovery path's unconditional status write with the existing compare-and-swap guarded Sending -> Unknown transition. Count an attempt as recovered only when that guarded transition commits. Add a deterministic coordinator-level regression test that pauses after a stale Sending snapshot, commits Delivered concurrently, and proves recovery preserves the terminal status. Change Type [x] Bug fix [ ] New feature [ ] Refactor [ ] Documentation [ ] CI/Infrastructure [ ] Security [ ] Dependencies Linked Issue Fixes #7017 Validation [x] cargo fmt --all -- --check [ ] cargo clippy --all --benches --tests --examples --all-features -- -D warnings — not run workspace-wide; the changed crate passed cargo clippy -p ironclaw_product --all-targets -- -D warnings.

nearai/ironclaw issue #7025 reports: Environment local (cloned ironclaw) Version / Commit Hash 0399cef53de2b13fe039cc9089d9047744a7877e (current nearai/ironclaw:main, independently reverified 2026-08-02) QA Test Date 2026-08-02 Feature Area Outbound delivery → durable single-flight ownership before vendor egress Steps to Reproduce 1. Check out commit 0399cef53de2b13fe039cc9089d9047744a7877e. 2. Construct two DeliveryCoordinator instances with separate process-local state and separate OutboundStateStorePort handles backed by the same durable store. 3. Submit the same policy-class delivery request to both coordinators so OutboundDeliveryId::for_policy_request produces the same durable delivery ID. 4. Use a barrier-capable target resolver or adapter so both calls finish policy preparation before either completes vendor egress. 5. Release both calls concurrently. 6. Observe that each coordinator admits the delivery ID through its own process-local in_flight HashSet. 7. Observe

Why it matters

Durable delivery requires exclusive claim ownership and monotonic terminal state. Replaying a pending record after a crash is useful only if another coordinator cannot send the same attempt and recovery cannot overwrite a concurrent Delivered receipt. The operational test is whether persisted state, execution authority and visible user outcome describe the same event. Broad retries, hidden suppression or permission expansion can hide the symptom while making the boundary less trustworthy.

Current

The primary record was closed when captured on 2026-08-03. The release baseline was ironclaw-v1.0.0 published 2026-07-27T19:32:01Z. Current repository metadata, pull requests, issues, release records, Google News discovery, Hacker News discovery, Lobsters, Metamesh and the rendered ClawCharts HTML row were checked. ClawCharts selected the subject; it did not prove the claim.

Evidence

The primary URL is https://github.com/nearai/ironclaw/pull/7029. Supporting records are https://github.com/nearai/ironclaw/pull/7028 and https://github.com/nearai/ironclaw/issues/7025. Their source bodies, timestamps and states were captured in the daily evidence bundle. Test counts, reproductions and deployment observations remain attributed to their authors unless explicitly identified as independently rerun.

Source boundary

Open work is described as open, closed work as closed, and operator reports as reports. A pull request is evidence of proposed or reviewed direction, not proof of a shipped release. Issue closure would not by itself prove a deployed fix. Search residue, package mirrors and historically published source spines were excluded.

Operator take

Verify concurrent claims against the same persisted attempt, make terminal states monotonic, retain idempotency downstream, and keep the open QA report visible until the exact race is independently closed. Preserve a before-state receipt, make the smallest reversible change, and verify the original failure independently after intervention.

Caveat

Public project records are mutable. Status, scope and evidence can change after publication. This brief records the inspected state and does not authorize changes to a reader’s deployment.

Source inspected; source state, environment and release boundary remain explicit.