fix(orchestrator): router owns origin-routed session completions — stop swarm-synthesis double-posts and suppressed-error leaks (#11634)

[0xSolace]

problem

follow-up to #11578 / #11605 (which sanitized WHAT gets posted). this fixes WHO posts.

coding sub-agent sessions with chat origin metadata had two parallel completion→chat posters for the SAME session:

• sub-agent-router.ts — origin-aware, dedupe-keyed, verify-retry-aware, suppresses respawned-session events, feeds the planner's clean user-facing reply.
• SwarmCoordinatorService.maybeFireSwarmComplete → handleSwarmSynthesis → connector — fires on EVERY terminal event with no knowledge of the router's suppression/dedupe/retry state.

result on a discord-origin "spawn a coding agent" task: 4 messages instead of 2, including:

1. a suppressed-error leak — the false Sub-agent state was lost (process exited without persisting). No automatic action taken. scare, posted by synthesis even though the router had already respawned the session under cap and deliberately suppresses the dead session's events.
2. a double-post — synthesis posts the sub-agent narration AND the planner posts its own clean reply.

ownership rule

the sub-agent-router owns origin-routed sessions. maybeFireSwarmComplete now SKIPS synthesis for a session when ALL of:

• the event is one the router actually posts — task_complete / error (ROUTER_OWNED_TERMINAL_EVENTS), not stopped (the router's shouldInject never injects stopped, so synthesis stays the sole poster for stop/cancel/no-output).
• the session carries the router's origin routing — sessionHasRouterOrigin(meta) mirrors readOrigin's UUID gate EXACTLY (same pickUuid regex, same originRoomId ?? sourceRoomId ?? taskRoomId ?? roomId + taskRoomId ?? roomId fallthrough, reads session metadata ONLY — the same input readOrigin(session) reads). source is optional, matching readOrigin.
• the router is actually live — isActive() (new accessor): !stopped && bound to the ACP stream. false when disabled via ACPX_SUB_AGENT_ROUTER_DISABLED, stopped, or unbound. duck-typed lookup by serviceType string so the coordinator keeps no import edge on the router module. fails safe — a missing router/accessor is treated as "not active" so synthesis keeps posting.

everything else still synthesizes so a terminal status never goes silent: stopped events, no-origin dashboard/API-spawned tasks (the gap synthesis exists to cover), a disabled/unbound router, and coordinator-generated custom-validator verdicts (dispatchCustomValidatorResult — "App verification passed." — which the router never receives; exempted via isCustomValidatorResult).

concurrency correctness

AcpService fans session events out to listeners synchronously without awaiting them, so two terminal events for one session (a router-owned task_complete/error racing a stopped, or duplicate terminals on one exit) would race the ownership/dedupe decision across the getEnrichmentMetadata await — double-posting or swallowing the stopped the router never posts. fixed by serializing terminal-event synthesis per session (terminalCompletionChains): each event chains onto the session's previous terminal handler, so the second observes the first's completed decision. the chain entry is pruned when it is the tail (no unbounded growth) and cleared on reset.

test coverage

swarm-coordinator-service.test.ts (+ sessionHasRouterOrigin unit block):

• router-origin task_complete with active router → synthesis silent
• router-origin error/state-lost (source optional) → synthesis silent (suppressed-error leak fixed)
• no-origin dashboard session → synthesis posts (gap preserved)
• router-origin stopped even with active router → synthesis posts (router never injects stopped)
• router disabled/unbound → synthesis posts (fail-open)
• no router service registered → synthesis posts (fail-safe)
• room UUIDs only in event payload, not session metadata → synthesis posts (mirrors readOrigin's session-metadata-only input; no silent drop)
• session reuse: router-owned task_complete does NOT consume the slot; a later stopped on the same session still fires
• race: two terminal events for a non-router session → fires exactly ONCE
• race: stopped racing a router-owned terminal on the same session → still fires (no swallow)
• sessionHasRouterOrigin both ways (valid UUID roomId+taskRoomId, taskRoomId-from-roomId fallback, source-optional, non-UUID-originRoomId fallthrough, missing-taskRoomId false, non-UUID false, empty false)

sub-agent-router-roundtrip-getters.test.ts:

• isActive() true once bound, false after stop(), false when disabled via ACPX_SUB_AGENT_ROUTER_DISABLED

verification

cd plugins/plugin-agent-orchestrator && npx vitest run __tests__

• baseline (clean develop): 15 failed / 1246 passed — all pre-existing env failures (smithers-orchestrator module resolution, drizzle-orm, @noble/curves, i18n codegen; file-level module-resolution FAILs on spawn-*/stop-agent/task-history).
• with this change: 15 failed / 1283+ passed — same 15 pre-existing failures, ZERO new failures, +net new passing tests.
• touched suites green in isolation: swarm-coordinator-service.test.ts 41/41, sub-agent-router-roundtrip-getters.test.ts + sub-agent-router.test.ts 94/94.

closes #11634

— [sol-relay] — [sol-orch]

[greptile-apps]

Your trial has ended. Reactivate Greptile to resume code reviews.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 99bb63c9-a508-47d0-aaee-fd6c7ed899b5

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch sol/11634-synthesis-ownership

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Your trial has ended. Reactivate Greptile to resume code reviews.

[lalalune]

Reviewed and verified after pushing formatting cleanup commit fd04ae430be9b39d2cc6e8c13b2910138a6df431.

I compared this against the duplicate #11687 and #11634. #11689 is the stronger fix: it implements the router-owned-session skip, keeps stopped/custom-validator completions in synthesis ownership so they do not go silent, and serializes same-session terminal synthesis so duplicate/racing terminal events cannot double-post or consume the wrong dedupe slot.

Local verification on head fd04ae430be9b39d2cc6e8c13b2910138a6df431:

• bun run --cwd plugins/plugin-agent-orchestrator test -- __tests__/unit/swarm-coordinator-service.test.ts __tests__/unit/sub-agent-router-roundtrip-getters.test.ts __tests__/unit/sub-agent-router.test.ts passed: 3 files / 135 tests.
• tsgo --noEmit -p plugins/plugin-agent-orchestrator/tsconfig.json passed after linking worktree package deps.
• Biome check passed for changed orchestrator service/test files.
• git diff --check origin/develop...HEAD and git diff --check passed.

No blocking issues found. This supersedes #11687.

[NubsCarson]

Thanks @0xSolace — good, the sub-agent-router owning the swarm-synthesis dedup is the right call; cloud-money has zero overlap here so it's all yours. This is exactly the coordinate-don't-dup we want. 👍 [cloud-money]

[claude]

Claude encountered an error —— View job

---

I'll analyze this and get back to you.