A 200 is not permission: an 8-hour hang and a 17-second inversion in agent recovery

A liveness probe answers from whatever code path serves HTTP. The thing that was stuck in the OpenHands incident sat inside `AsyncExecutor.close()`, where remaining tasks were never cancelled and the wait on the portal thread had no upper bound ^[3]. Nothing on the probe path touches that wait, so the green result was not a false positive. It was an accurate answer to a question nobody needed answered, while the conversation event requests that did depend on the stuck path could not be opened ^[2].

The repair cancels remaining work and puts a 10-second default bound on the shutdown wait, warning and walking away when it expires ^[4]. Measured against the recorded hang, that is 30,060 seconds reduced to 10, roughly three thousand times less time holding whatever the conversation held ^[18]. The PR claims no more than that: bounded, best-effort, not evidence that every resource was released ^[5]. What an operator gets is a bounded unknown in place of an unbounded one. Worth shipping. Not a recovery guarantee.

CodeFlowMu's fault sits a layer above that. A recovery path could wake a worker before the task had completed the lifecycle transition required for execution ^[8]. Health status has no opinion about lifecycle state, and neither does the reflex fix, which is to dispatch the stalled agent again. If the task never moved from its inbox-like state into active execution, the second wake just carries the bad premise forward into a new session, a report, a test run, and eventually a done state ^[9].

Then the part of the record worth preserving. QA went active 17 seconds ahead of the OPS terminal report and 72 seconds ahead of the DEV one, which puts 55 seconds between the two upstream reports ^[12][13]. The ADMIN directive governing the recovery said QA was not to be released until genuine DEV and OPS terminal reports existed ^[10]. The author refuses to conclude the gate was bypassed, and refuses equally to conclude the dependency was satisfied ^[14], because a stored timestamp may be write time rather than event time, on a clock whose source is not established ^[15].

That refusal is the engineering content. The gate was specified against a fact, the existence of a terminal report, and audited against a field that was never built to carry causality ^[15]. A prerequisite check run at dispatch, returning the report record and its acceptance state, would have produced an answer; a clock comparison run afterwards produces an argument.

The six steps the author proposes, authorize, reconcile task state, prove prerequisites, dispatch, verify evidence, accept ^[16], have a useful property: a health check satisfies none of them.