Paperclip
Paperclip makes human feedback delivery restart-safe
Paperclip proposes a durable feedback outbox so acknowledged human comments survive process interruption without duplicate delivery. A companion patch makes the same path recoverable, while queued heartbeat cleanup removes orphan runs that can otherwise keep stale work alive.
paperclipai/paperclip PR #11490 is the inspected primary source: “fix: make feedback delivery restart-safe and recoverable.” The related records below were inspected as supporting context rather than independent confirmation.
The facts
- paperclipai/paperclip PR #11490 was created 2026-08-16T19:46:10Z and was open at inspection; its title is “fix: make feedback delivery restart-safe and recoverable.” - paperclipai/paperclip PR #11491 was created 2026-08-16T20:06:44Z and was open at inspection; its title is “fix: make human feedback delivery restart-safe.” - paperclipai/paperclip PR #11497 was created 2026-08-16T21:37:44Z and was open at inspection; its title is “fix(runtime): reap and sweep orphaned queued heartbeat runs (MAD-891).” - The repository reported 78513 stars, 5090 open issues, default branch master, and last push 2026-08-16T22:14:33Z. - The latest tagged-release baseline checked was v2026.722.0 published 2026-07-22T23:05:41Z.
What changed
paperclipai/paperclip PR #11490 reports: Thinking Path - Paperclip is the open source app people use to manage AI agents for work. - Human feedback must reach the assigned agent after a task enters review. - A server restart can stop a feedback run before process launch and leave no live delivery path. - Recovery must retry once, expose exhaustion, and keep the source comment accurate. - A recovery action must clear only after explicit agent receipts account for every outstanding feedback comment. - The server and UI must agree on delivery state, access control, and retry behavior. - This pull request combines the complete recovery chain and its browser-QA fixes. - The benefit is restart-safe feedback delivery with an operator-visible, auditable repair path. Linked Issues or Issue Description This pull request supersedes the server-only work in Refs #11426 and Refs #11427. It adds the recovery UI and the fixes found during end-to-end browser QA. What happened?** A user could add feedback to an agent-assigned task in review. If the server stopped before the feedback run launched, the task could remain in review without an active run, a queued wake, or a visible repair path. The source comment also did not show whether Paperclip delivered the feedback. Expected behavior** Paperclip must retry eligible feedback once
paperclipai/paperclip PR #11491 reports: Thinking Path - Paperclip is the open source app people use to manage AI agents for work. - Human comments are control-plane inputs that can restart or guide assigned agent work. - A restart or prelaunch failure could separate a saved comment from its wake request. - The UI did not show whether that feedback was queued, delivered, or blocked. - Recovery needed a durable identity and an idempotent replay path. - This pull request adds durable feedback delivery, recovery, and operator controls. - The benefit is that a saved human comment remains actionable across process failures. Linked Issues or Issue Description What happened?** A human comment could be saved while its agent wake request failed before launch. The assigned agent did not receive the first comment, and the board did not show a durable delivery state or a safe retry action. Expected behavior** Paperclip must track each human feedback delivery independently from the process that first handles it. Paperclip must replay eligible feedback after a restart, prevent duplicate work, and show an actionable state to the operator. Steps to reproduce** 1. Assign an issue to an agent. 2. Add a human comment that should wake the assignee. 3. Interrupt the wake path after Paperclip saves the comment but before
paperclipai/paperclip PR #11497 reports: Fixes the wedge diagnosed in MAD-889/MAD-891: a heartbeat run stuck in status = 'queued' with startedAt = null is owned by nothing — no dispatcher re-examines it, and no reaper releases the issue execution lock it holds. Every mutation on the affected issue then 409s with Issue run ownership conflict. Observed live on five issues after a claude_transient_upstream failure storm. A. Land the MAD-622 lease reaper (and correct it) heartbeat-run-liveness.ts (isAbandonedHeartbeatRun, DEFAULT_RUN_LEASE_TTL_MS) existed only as uncommitted working-tree changes and shipped in neither runtime. Committed here, folded into the shared heartbeatRunIsTerminalOrMissing helper rather than duplicated per call site, so every lock-reaping path picks it up. The updatedAt concern was real.** lastActivityAt() fell back to updatedAt, which is bookkeeping, not liveness — retry promotion, wakeup linkage and status re-stamps all push it forward, so a run doing nothing would renew its lease indefinitely and the reaper would be a no-op for exactly this case. For a run that never started, the lease clock now keys off createdAt. Regression test: ignores a bumped updatedAt and keeps the lease clock on createdAt. B. Sweep orphaned queued runs New sweepOrphanedQueuedRuns in heartbeat.ts: selects queued + startedAt IS NULL + createdAt past the lease. For each it **nudges the real dispatcher first** — a drainable queue
Why it matters
Human feedback is control input, not chat garnish. Losing it after acknowledgment or replaying it after recovery can send autonomous work down the wrong branch. The operator test is whether the system remains bounded and its receipts still describe the action after failure, retry or restart.
Current
The primary record was open when captured on 2026-08-17. The tagged-release baseline was v2026.722.0 published 2026-07-22T23:05:41Z. Repository metadata, full source bodies, current pull requests and issues, releases, Google News, Hacker News, Lobsters, Metamesh and the rendered ClawCharts row were inspected. ClawCharts selected the subject; it did not prove the claim.
Evidence
The primary URL is https://github.com/paperclipai/paperclip/pull/11490. Supporting records are https://github.com/paperclipai/paperclip/pull/11491 and https://github.com/paperclipai/paperclip/pull/11497. Source bodies, timestamps and states are preserved in the daily evidence bundle. Test counts and reproductions remain attributed to their authors unless identified as independently rerun.
Source boundary
Open work is described as open, closed work as closed, and operator reports as reports. A pull request is evidence of proposed or reviewed direction, not proof of a shipped release. Search residue, package mirrors and historically published source spines were excluded.
Operator take
Persist acknowledgment and delivery state atomically, make replay idempotent, and sweep orphan heartbeat runs only after their durable ownership can be proved. Preserve a before-state receipt, make the smallest reversible change, and verify the original failure independently.
Caveat
Public project records are mutable. Status, scope and evidence can change after publication. This brief records the inspected state and does not authorize changes to a reader’s deployment.
Source inspected; source state, environment and release boundary remain explicit.