Summary
When a redeploy (scripts/deploy-local.sh) rebuilds the ADV bundle mid-session, the in-process plugin host (dist/index.js, loaded by OpenCode at session start) keeps running the previous bundle generation. Cross-generation Temporal comms then degrade and every plugin tool times out at exactly 10s — with no signal telling the operator the real cause. The failure is indistinguishable from a wedged workflow.
Incident evidence (2026-07-23)
- Deployed bundle rebuilt at
built_at: 2026-07-23T14:06:52Z (hashes verified against dist/plugin-bundle-manifest.json).
- This session's MCP/plugin-host process (
node dist/mcp-server.js, PID 21256) started Wed Jul 22 20:35:28 — ~14h before the rebuild.
- Symptom:
adv_change_show, adv_gate_status, adv_status, adv_doctor, adv_task_show all timed out at 10s simultaneously, while Temporal CLI (server-direct) responded instantly and the target workflow was healthy (StateTransitionCount 82, no failing task).
- Recovery: OpenCode session restart. Post-restart, tools respond in <1s.
Why the deploy script can't fix this
deploy-local.sh correctly rolls workers (self-roll via ADV_TEMPORAL_WORKER_SELF_ROLL=1 or SIGTERM) and emits [ADV:ACTION_REQUIRED] ... Restart OpenCode sessions. But no external script can reload an in-process plugin module inside a live OpenCode session. The MCP read server is Vision-supervised separately. So the plugin host is structurally restart-only.
Proposed fix (detection + loud signal, not auto-restart)
- Plugin host records its loaded bundle generation at load time.
- On tool invocation (or a cheap periodic check), compare loaded generation vs the deployed
dist/plugin-bundle-manifest.json generation.
- On mismatch, short-circuit affected tools with a crisp typed error
PLUGIN_BUNDLE_STALE — "This OpenCode session is running an outdated ADV bundle (loaded vs deployed ); restart OpenCode to reload." — instead of a 10s Temporal timeout.
Acceptance criteria
- A tool called under a stale-generation session returns
PLUGIN_BUNDLE_STALE with loaded-vs-deployed generation identifiers, not a timeout.
- Fresh/consistent generation is unaffected (no false positives).
- Detection cost is bounded (no per-call disk hash of the whole bundle; use the manifest generation field).
- Signal names the remediation (restart OpenCode).
Related
- Deploy worker-roll:
retireDeployWorkerBounce, autoRollStaleWorkerBundle (archived).
- ADR 0008 (
docs/adr/0008-adv-mcp-stdio-via-vision.md) — plugin-host vs Vision-MCP lifecycle split.
- Sibling: orphan session-queue auto-adopt (
autoAdoptOrphanSessionQueues, in flight).
Summary
When a redeploy (
scripts/deploy-local.sh) rebuilds the ADV bundle mid-session, the in-process plugin host (dist/index.js, loaded by OpenCode at session start) keeps running the previous bundle generation. Cross-generation Temporal comms then degrade and every plugin tool times out at exactly 10s — with no signal telling the operator the real cause. The failure is indistinguishable from a wedged workflow.Incident evidence (2026-07-23)
built_at: 2026-07-23T14:06:52Z(hashes verified againstdist/plugin-bundle-manifest.json).node dist/mcp-server.js, PID 21256) started Wed Jul 22 20:35:28 — ~14h before the rebuild.adv_change_show,adv_gate_status,adv_status,adv_doctor,adv_task_showall timed out at 10s simultaneously, while Temporal CLI (server-direct) responded instantly and the target workflow was healthy (StateTransitionCount 82, no failing task).Why the deploy script can't fix this
deploy-local.shcorrectly rolls workers (self-roll viaADV_TEMPORAL_WORKER_SELF_ROLL=1or SIGTERM) and emits[ADV:ACTION_REQUIRED] ... Restart OpenCode sessions. But no external script can reload an in-process plugin module inside a live OpenCode session. The MCP read server is Vision-supervised separately. So the plugin host is structurally restart-only.Proposed fix (detection + loud signal, not auto-restart)
dist/plugin-bundle-manifest.jsongeneration.PLUGIN_BUNDLE_STALE— "This OpenCode session is running an outdated ADV bundle (loaded vs deployed ); restart OpenCode to reload." — instead of a 10s Temporal timeout.Acceptance criteria
PLUGIN_BUNDLE_STALEwith loaded-vs-deployed generation identifiers, not a timeout.Related
retireDeployWorkerBounce,autoRollStaleWorkerBundle(archived).docs/adr/0008-adv-mcp-stdio-via-vision.md) — plugin-host vs Vision-MCP lifecycle split.autoAdoptOrphanSessionQueues, in flight).