@ai-dossier/sched 0.51.0 → 0.53.0

package/dist/batch-dispatch.js

@@ -96,9 +96,8 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.MAX_BATCH_AGENT_RESPAWNS = void 0;
+exports.MAX_BATCH_AGENT_RESPAWNS = exports.tailMembersRefusal = void 0;
 exports.memberBranchFor = memberBranchFor;
-exports.tailMembersRefusal = tailMembersRefusal;
 exports.evictMemberAndContinue = evictMemberAndContinue;
 exports.resumeBlockedGate = resumeBlockedGate;
 exports.reconcileStaleBlockedBatches = reconcileStaleBlockedBatches;
@@ -119,6 +118,7 @@ const recovery_1 = require("./recovery");
 const run_log_1 = require("./run-log");
 const scheduler_1 = require("./scheduler");
 const state_1 = require("./state");
+Object.defineProperty(exports, "tailMembersRefusal", { enumerable: true, get: function () { return state_1.tailMembersRefusal; } });
 const teardown_1 = require("./teardown");
 const types_1 = require("./types");
 function emptyResult() {
@@ -162,6 +162,12 @@ function sanitizeUntrustedText(value) {
 function journalEvent(deps, event, unitId, extra = {}) {
     deps.journal.append((0, journal_1.unitEvent)(event, unitId, extra), deps.now());
 }
+/** Stop the slot's agent if it is still alive (pid-start-safe: a reused pid is never signalled). */
+function killLiveAgent(deps, slot) {
+    if (slot.pid !== null && deps.spawnDeps.isAlive(slot.pid, slot.pid_start ?? undefined)) {
+        deps.spawnDeps.kill(slot.pid, slot.pid_start ?? undefined);
+    }
+}
 /**
  * Read a dead batch dispatch's own log and classify it (#629 AC3) — tail,
  * member, fix and report all reach a `dead` agent the same way (`pid` no
@@ -1016,7 +1022,11 @@ function spawnMemberAgent(deps, dispatch, state, slot, batchId, now, result, tar
     // #677: the prompt carries THIS member's own worktree and the integration
     // branch it was cut from — `member-cycle`'s `worktree`/`integration_branch`
     // inputs. The shared batch worktree is no longer a member surface at all.
-    const prompt = (0, dispatch_1.buildMemberPrompt)(dispatch.memberPrompt, memberIssue, batchId, target.member.worktree, batch.branch, review);
+    const prompt = (0, dispatch_1.buildMemberPrompt)(dispatch.memberPrompt, memberIssue, batchId, target.member.worktree, batch.branch, review) +
+        // #822: a member respawned after running the wrong procedure.
+        (batch.reprompted_members.some((r) => r.issue === memberIssue)
+            ? (0, dispatch_1.wrongProcedureDirective)(memberIssue, batchId)
+            : '');
     const logFile = (0, dispatch_1.batchMemberLogPath)(deps.store.runsDir, batchId, target.index, memberIssue);
     // #629: captured BEFORE spawning, mirroring `engine.ts`'s own
     // `spawnAndRecord` — the log is per-role and append-mode, so the size at
@@ -1311,36 +1321,6 @@ function spawnMemberContinuation(deps, config, dispatch, batchId, now, result) {
     }
     claimAndSpawn(deps, config, batchId, 'member', now, (nextState, slot) => spawnMember(deps, dispatch, nextState, slot, batchId, now, result, member));
 }
-/**
- * #832: why the tail must NOT be dispatched over `landed`, or null when it may.
- * The deterministic half of the check the tail agent itself makes before
- * integrating (the members it is told about and the members it derives from
- * the integration branch's boundary commits must agree) — made here for free
- * instead of by a strong-tier agent that then exits `members-mismatch`.
- * `batch.ranges` is the recorded boundary attribution (recomputed at every
- * landing); when it is empty nothing was attributed, so there is nothing to
- * cross-check. Invariant this relies on: `ranges` names only landed members —
- * every exit path that reverts a member also drops its range
- * (`recovery.ts`'s partial dissolve); a path that re-derived `ranges` from
- * `git log` after a revert would make this refuse a healthy batch.
- */
-function tailMembersRefusal(batch, landed) {
-    if (landed.length === 0)
-        return 'no-landed-members';
-    if (batch.ranges.length === 0)
-        return null;
-    const attributed = new Set(batch.ranges.map((r) => r.issue));
-    const missing = landed.filter((issue) => !attributed.has(issue));
-    if (missing.length > 0)
-        return `members-mismatch:no-boundary-commit-${missing.join(',')}`;
-    // The tail derives members from the boundary commits too, and refuses when
-    // the two lists disagree in EITHER direction (review-issue Aggregate Step 1).
-    const landedSet = new Set(landed);
-    const unlanded = [...attributed].filter((issue) => !landedSet.has(issue));
-    return unlanded.length > 0
-        ? `members-mismatch:unlanded-boundary-commit-${unlanded.join(',')}`
-        : null;
-}
 /**
  * #832: the one pre-dispatch verdict for a tail — checked before a slot is
  * claimed and again under the claim's lock. A tail whose respawns are spent
@@ -1353,7 +1333,7 @@ function tailDispatchRefusal(state, batch) {
         return null;
     if (agentRespawnsSpent(batch, 'tail'))
         return 'respawn-cap:tail';
-    return tailMembersRefusal(batch, (0, state_1.validatedMembersOf)(state, batch));
+    return (0, state_1.tailMembersRefusal)(batch, (0, state_1.validatedMembersOf)(state, batch));
 }
 /**
  * Tail/report/fix dispatches (this function, `spawnReportAgent`,
@@ -2091,7 +2071,7 @@ function resumeBlockedGate(deps, config, dispatch, batchId, now) {
         // `suite-unreadable`) — name the actual reason and the operator path
         // instead of a bare illegal-transition error that reads like a bug.
         if (batch.status === 'blocked') {
-            throw new types_1.SchedNotFoundError(`Batch ${batchId} is blocked on '${batch.blocked_reason ?? '?'}', which has no gate recheck: inspect the batch worktree/state named in its journal, then \`sched abandon --batch ${batchId}\` if it is a dead end`);
+            throw new types_1.SchedNotFoundError(`Batch ${batchId} is blocked on '${batch.blocked_reason ?? '?'}', which has no gate recheck (a batch blocked over landed work — dissolve-refused / tail-blocked / members-mismatch / respawn-cap:tail — resumes via \`sched resume --batch\`, #822): inspect the batch worktree/state named in its journal, then \`sched abandon --batch ${batchId}\` if it is a dead end`);
         }
         throw new types_1.IllegalTransitionError('batch', batch.status, 'executing');
     }
@@ -2367,8 +2347,113 @@ function readMemberDispatch(deps, batchId, memberIssue, slot, now) {
         milestone,
         dead,
         blockedNow: (0, groundtruth_1.isMemberBlocked)(milestone, slot.spawned_at),
+        wrongProcedure: (0, groundtruth_1.isWrongProcedureMilestone)(milestone, slot.spawned_at),
     };
 }
+/**
+ * #822: whether a wrong-procedure read counts against THIS dispatch of
+ * `memberIssue`. After a re-prompt, only a milestone posted strictly after
+ * the re-prompt does: the killed first dispatch's milestones still sit
+ * inside the respawn's 60s fence tolerance and would otherwise evict the
+ * member the moment it respawns. No tolerance here — the engine and the
+ * member's CLI stamp times on the same host.
+ */
+function wrongProcedureCounts(batch, memberIssue, read) {
+    if (!read.wrongProcedure || read.milestone === null)
+        return false;
+    const prior = batch.reprompted_members.find((r) => r.issue === memberIssue);
+    if (prior === undefined)
+        return true;
+    const at = Date.parse(read.milestone.at);
+    const repromptedAt = Date.parse(prior.reprompted_at);
+    return Number.isNaN(at) || Number.isNaN(repromptedAt) ? false : at > repromptedAt;
+}
+/**
+ * #822 (#810 proposal 3): the member's dispatch ran the wrong procedure (a
+ * full-cycle-shaped trail — imboard #4174 ran full-cycle as a batch member).
+ * That is a dispatch mistake, not the member's work failing, so the first
+ * time it is RE-PROMPTED: a live agent is stopped (a full-cycle run left going
+ * would open its own PR), the slot is released, and the member is recorded in
+ * `reprompted_members` — the wedge arm (serial) or `spawnParallelMembers`
+ * (parallel) respawns it in place, in the same worktree, with
+ * `wrongProcedureDirective` appended. Returns `'evict'` when the member was
+ * already re-prompted once: the caller evicts it `wrong-procedure`.
+ */
+function repromptWrongProcedure(deps, batchId, memberIssue, milestoneAt, slot, release, now) {
+    // Never respawn into (or release) a worktree the old agent is still in: a
+    // dying full-cycle run could still push, post, or open a PR. Signal it and
+    // decide on a later tick, once it is gone — and so the re-prompt's
+    // `reprompted_at` fence postdates everything it could still post.
+    if (slot.pid !== null && deps.spawnDeps.isAlive(slot.pid, slot.pid_start ?? undefined)) {
+        deps.spawnDeps.kill(slot.pid, slot.pid_start ?? undefined);
+        return 'waiting';
+    }
+    const outcome = deps.store.withLock((s) => {
+        const released = release(s);
+        const b = (0, state_1.findBatch)(released, batchId);
+        if (!b || b.reprompted_members.some((r) => r.issue === memberIssue)) {
+            return { state: released, result: 'evict' };
+        }
+        return {
+            state: (0, state_1.patchBatch)(released, batchId, {
+                reprompted_members: [
+                    ...b.reprompted_members,
+                    { issue: memberIssue, milestone_at: milestoneAt, reprompted_at: now.toISOString() },
+                ],
+            }, now),
+            result: 'reprompted',
+        };
+    });
+    if (outcome === 'reprompted') {
+        journalEvent(deps, 'member-reprompted', unit(batchId), {
+            issue: memberIssue,
+            reason: 'wrong-procedure',
+            milestone_at: milestoneAt,
+            detail: `${WRONG_PROCEDURE_SHAPE} — respawning it once in place with a member-cycle directive`,
+        });
+    }
+    return outcome;
+}
+/** #822: the evidence line every wrong-procedure journal/eviction names. */
+const WRONG_PROCEDURE_SHAPE = 'member posted a full-cycle-shaped milestone (no batch=/mode=slot key)';
+/** #822: the eviction a member earns for running the wrong procedure after its one re-prompt. */
+function wrongProcedureFailure(lastTool, shippedPr = null) {
+    return {
+        reason: shippedPr === null ? 'wrong-procedure' : 'wrong-procedure-shipped',
+        detail: shippedPr === null
+            ? `${WRONG_PROCEDURE_SHAPE} again after its one re-prompt`
+            : `${WRONG_PROCEDURE_SHAPE} and its full-cycle run already reached ship (PR ${shippedPr === 'unknown' ? 'not named' : `#${shippedPr}`}) — evicted without a re-prompt; close or reconcile that PR by hand`,
+        kind: 'evicted',
+        extraKv: {
+            ...(lastTool ? { last_tool: lastTool } : {}),
+            ...(typeof shippedPr === 'number' ? { stray_pr: String(shippedPr) } : {}),
+        },
+    };
+}
+/**
+ * #822: the one wrong-procedure decision shared by both member rails —
+ * `'waiting'` (the old agent is still dying), `'reprompted'`, or the
+ * eviction failure to apply. A run that already shipped is evicted without
+ * a re-prompt.
+ */
+function decideWrongProcedure(deps, batchId, memberIssue, milestone, slot, release, lastTool, now) {
+    const shipped = (0, groundtruth_1.wrongProcedureShippedPr)(milestone);
+    if (shipped !== null) {
+        if (slot.pid !== null && deps.spawnDeps.isAlive(slot.pid, slot.pid_start ?? undefined)) {
+            deps.spawnDeps.kill(slot.pid, slot.pid_start ?? undefined);
+            return 'waiting';
+        }
+        const tool = lastTool();
+        deps.store.withLock((s) => ({ state: release(s), result: undefined }));
+        return wrongProcedureFailure(tool, shipped);
+    }
+    const verdict = repromptWrongProcedure(deps, batchId, memberIssue, milestone.at, slot, release, now);
+    if (verdict === 'waiting')
+        return verdict;
+    // The finished dispatch's run-log entry, exactly once (never while waiting).
+    const tool = lastTool();
+    return verdict === 'reprompted' ? verdict : wrongProcedureFailure(tool);
+}
 /**
  * The eviction a blocked-or-dead member dispatch earns (shared by both rails).
  * #605: only a milestone THIS dispatch posted may name the reason. A dead
@@ -2438,6 +2523,16 @@ function reconcileMemberSlot(deps, config, dispatch, batchId, slot, now, result)
         completeMemberGate(deps, config, dispatch, batchId, batch, memberIssue, now, result);
         return;
     }
+    // #822: a wrong-procedure trail is re-prompted once, then evicted — decided
+    // before the dead/blocked rail, which would otherwise evict it as an
+    // unverified exit at the first sight.
+    if (wrongProcedureCounts(batch, memberIssue, read) && read.milestone !== null) {
+        const decision = decideWrongProcedure(deps, batchId, memberIssue, read.milestone, slot, (s) => releaseSlot(s, batchId, now), () => recordMemberRunLog(deps, dispatch, state0, batchId, batch.executing_member, memberIssue, slot, now), now);
+        if (typeof decision === 'object') {
+            evictMemberAndContinue(deps, config, dispatch, batchId, batch, memberIssue, decision, now, result);
+        }
+        return;
+    }
     if (read.dead &&
         !read.blockedNow &&
         handleDeadDispatchApiError(deps, batchId, (0, dispatch_1.batchMemberLogPath)(deps.store.runsDir, batchId, batch.executing_member, memberIssue), slot.log_offset_at_spawn ?? 0, now)) {
@@ -2778,8 +2873,8 @@ function reconcileTailSlot(deps, config, batchId, slot, now, result) {
         ? null
         : (0, groundtruth_1.batchPhaseBlockedReason)(milestone, ['batch-review', 'batch-ship'], slot.spawned_at);
     if (handedBack !== null) {
-        if (slot.pid !== null && !dead)
-            deps.spawnDeps.kill(slot.pid, slot.pid_start ?? undefined);
+        if (!dead)
+            killLiveAgent(deps, slot);
         blockOnTailHandBack(deps, config, batch, `tail-blocked:${handedBack}`, now, result);
         return;
     }
@@ -3904,9 +3999,7 @@ function reconcileParallelMemberSlot(deps, config, dispatch, batchId, run, slot,
         // into that tree with its pid no longer tracked anywhere (so neither a
         // dissolve nor `sched stop --batch` could stop it). Its work is done —
         // stop it first.
-        if (slot.pid !== null && deps.spawnDeps.isAlive(slot.pid, slot.pid_start ?? undefined)) {
-            deps.spawnDeps.kill(slot.pid, slot.pid_start ?? undefined);
-        }
+        killLiveAgent(deps, slot);
         journalEvent(deps, 'external-advance', unit(batchId), {
             issue: run.issue,
             detail: 'member review done',
@@ -3929,6 +4022,17 @@ function reconcileParallelMemberSlot(deps, config, dispatch, batchId, run, slot,
         result.completed.push(memberUnit);
         return;
     }
+    // #822: re-prompt once, then evict — see the serial rail.
+    const parallelBatch = (0, state_1.findBatch)(state0, batchId);
+    if (parallelBatch &&
+        wrongProcedureCounts(parallelBatch, run.issue, read) &&
+        read.milestone !== null) {
+        const decision = decideWrongProcedure(deps, batchId, run.issue, read.milestone, slot, release, () => recordMemberRunLog(deps, dispatch, state0, batchId, run.index, run.issue, slot, now), now);
+        if (typeof decision === 'object') {
+            evictParallelMember(deps, config, batchId, run, decision, now, result);
+        }
+        return;
+    }
     if (read.dead &&
         !read.blockedNow &&
         handleDeadDispatchApiError(deps, batchId, (0, dispatch_1.batchMemberLogPath)(deps.store.runsDir, batchId, run.index, run.issue), slot.log_offset_at_spawn ?? 0, now, { releaseWith: release })) {
@@ -4239,9 +4343,7 @@ function stopMemberAgent(deps, batchId, issue, now) {
     const slot = (0, state_1.slotForBatchMember)(deps.store.load(), batchId, issue);
     if (slot === undefined)
         return;
-    if (slot.pid !== null && deps.spawnDeps.isAlive(slot.pid, slot.pid_start ?? undefined)) {
-        deps.spawnDeps.kill(slot.pid, slot.pid_start ?? undefined);
-    }
+    killLiveAgent(deps, slot);
     deps.store.withLock((s) => ({
         state: (0, state_1.releaseBatchMemberSlot)(s, batchId, issue, now),
         result: undefined,