@animastor/orchestration 0.1.7 → 0.3.0

package/CHANGELOG.md

@@ -0,0 +1,156 @@
+# Changelog
+
+## 0.3.0 (2026-10-31) — генерация только по явной команде
+
+Правило владельца: GPU-генерация запускается только кнопками «аудио» /
+«картинки» / «всё»; никаких автозапусков следующих стадий и фоновых
+запусков; задачи только на включённые слои. Основание — разбор
+`reports/2026-10-31/auto-image-task-ba-incident.md` (§6, §8). Описание:
+animastor-docs `architecture/COMMAND_ONLY_GENERATION.md`.
+
+**Инвариант:** сцена×стадия попадает в active index / dispatch только при
+активной задаче реестра (создана явной командой, стадия = type задачи), при
+включённом слое и без отмены (cancel flag / tombstone).
+
+### Added
+
+- `runtime/command-gate.js` — единственная точка вычисления инварианта
+  (`getAuthorizedStages`, `isStageAuthorized`), force-набор сцена×стадия,
+  `rollbackGeneratingToDirty`, `blockStageNoWorker`. Экспорт
+  `runtime.commandGate`.
+- ProgressEventsPort: операция `blockSceneStage` (хост помечает команду
+  blocked в реестре и PG).
+
+### Changed (поведение)
+
+- `active-scenes-index.addActiveScene` — запись в active index только при
+  авторизованной стадии; иначе `{ added:false, denied:true }`.
+- `runtime-scheduler.shouldScheduleAssets` — стадии только по гейту; убраны
+  fallback на layer-config без задачи и `isInFlight`-override.
+- `runtime-scheduler.tick/attemptDispatch` — force только для сцен×стадий
+  команды (ключ `animastor:force-dispatch-stages:<book>`, вместо книжного
+  `animastor:force-dispatch:<book>`); `no_worker_available` → стадия blocked
+  (GENERATING → DIRTY, задача blocked), без автоповтора.
+- `markVersionStaleDirty` — только помечает stale, в работу не ставит.
+- `orchestrator.resetScenes` — пишет force-набор вместо книжного флага.
+- `scene-orchestrator.dispatchStage` — NEW-сцена переводит в PENDING только
+  диспатчимую стадию; при `no_worker_available` откат в DIRTY, не PENDING.
+- `reconciliation-engine`:
+  - удалены `PROGRESS_TO_IMAGE` / `PROGRESS_TO_VIDEO`; partial build — только
+    диагностика;
+  - `REGENERATE_MISSING_ASSET`, `MOVE_TO_PENDING`, `RELEASE_STALE_LEASE`,
+    перезапуск аудио в `RECOVER_ORPHAN_ASSETS` — только под активной командой
+    стадии, иначе диагностика; осиротевший GENERATING без команды → DIRTY;
+  - C5 вызывает `deps.interruptIncompleteSessions` (возобновления нет);
+  - C8 `rebuildWorkList` пересобирает только факты asset-state, PENDING и
+    active index не пишет.
+- `scene-window.startScene` — без авторизованной стадии сцену не стартует;
+  `trySlideWindowOnComplete` — за флагом хоста `windowAutoNextEnabled()`
+  (по умолчанию выкл.).
+- `dispatch-engine.repairOrphanGeneratingStates` — опция `target: 'dirty'`.
+
+## 0.2.0 (2026-10-27)
+
+Version-line split for `stage143a-foundation-phase1`: the branch line moves
+`0.1.6 → 0.2.0` so it can never collide with, or be shadowed by, the hotfix
+line. **No functional change** — the content is the `0.1.6` code below (D1 +
+A1 already in this branch).
+
+**The hotfix line is separate:** `0.1.7` (branch `hotfix/d1-d2-a1`) is cut
+from `0.1.4`, not from this line, and carries only D1 + the A1 version-gate
+fallback (D2 and the host side of A1 live in `backend`). `^0.1.x` therefore
+resolves within the `0.1.x` line, while this branch's backend depends on
+`^0.2.0`.
+
+## 0.1.7 (2026-10-27) — hotfix line (содержимое входит в 0.2.0)
+
+Hotfix line (branch `hotfix/d1-d2-a1`, base `78e8f1ae` = `0.1.4`): only the
+D1 and A1-gate fixes are carried in this package. It is a **separate line from
+the `0.1.6` entry of the `stage143a-foundation-phase1` branch** — this package
+is `0.1.4` + the two fixes, not a descendant of `0.1.5`/`0.1.6`.
+
+**In this package:** D1, A1-gate. **In `backend` (not here):** D2 and the host
+side of A1 (`scene-assets-repo.getAssetNullBuild` + runtime adapter + port op).
+
+### Fixed
+
+- `orchestration/orchestrator.js` (D1, stage 146) — the
+  `require('@animastor/generation').artifactNaming` binding lived INSIDE
+  `beginStage()`, but `resetScenes()` also reads it in the stale-PNG/preview
+  pre-delete branch (step 6). Any regeneration that passed `cleanPngUnitIds`
+  therefore threw `ReferenceError: artifactNaming is not defined`, and
+  `/regenerate` returned HTTP 500. The binding now sits at module scope, next
+  to the other module-level requires; `beginStage()` keeps its own
+  `dispatchEngine` lazy require. Behavior is otherwise unchanged.
+- `orchestration/orchestrator.js` (`completeStage` version gate, A1 /
+  stage 146 §5.4) — when `sceneAssets.getAsset(..., buildId)` found no row for
+  THIS build, the gate went fail-closed (DIRTY) even though the key's only row
+  was a legacy `build_id IS NULL` row: `getAsset` filters `build_id = $5`, and
+  `markReady` — the only writer able to stamp `build_id`
+  (`buildIdFromArtifactPath`) — runs BEHIND the gate. The scene then
+  re-dispatched every 5 s tick (`cache_hit` → callback → `stale` → DIRTY)
+  forever. The gate now performs exactly ONE additional read of the SAME key
+  with `build_id IS NULL` (never another build's row, never "latest any row")
+  through the PersistencePort op `sceneAssets.getAssetNullBuild`, applies the
+  SAME version rules (`scene_content_version`, plus
+  `scene_audio_config_version` for audio), and lets `markReady` stamp
+  `build_id` as before. A NULL row whose version is below the scene version
+  still fails the gate (DIRTY), so the loop converges after the next real
+  dispatch instead of spinning. PG errors stay fail-closed.
+
+### Shipped by backend, not by this package
+
+- D2 — `/api/v1/debug/runtime/*` middleware now calls `next()`
+  (`backend/src/routes/debug-routes.cjs`).
+- A1 host side — `sceneAssets.getAssetNullBuild` implementation and delegation
+  (`backend/src/storage/postgres/repositories/scene-assets-repo.js`,
+  `backend/src/storage/runtime-persistence-adapter.js`) plus the op
+  declaration in `runtime/persistence-port.js`.
+
+## 0.1.6 (2026-10-26)
+
+Stage 146 — D1 fix: `artifactNaming` hoisted to module scope.
+Stage 147 — A1 fix: version-gate sees the legacy `build_id IS NULL` row.
+
+### Fixed
+
+- `orchestration/orchestrator.js` — the `require('@animastor/generation')
+  .artifactNaming` binding lived INSIDE `beginStage()`, but
+  `resetScenes()` also reads it in the stale-PNG/preview pre-delete branch
+  (step 6). Any regeneration that passed `cleanPngUnitIds` therefore threw
+  `ReferenceError: artifactNaming is not defined`, and `/regenerate`
+  returned HTTP 500. The binding now sits at module scope, next to the
+  other module-level requires; `beginStage()` keeps its own
+  `dispatchEngine` lazy require. Behavior is otherwise unchanged.
+- `orchestration/orchestrator.js` (`completeStage` version gate, A1 /
+  stage146 §5.4) — when `sceneAssets.getAsset(..., buildId)` found no row
+  for THIS build, the gate went fail-closed (DIRTY) even though the key's
+  only row was a legacy `build_id IS NULL` row: `getAsset` filters
+  `build_id = $5`, and `markReady` — the only writer able to stamp
+  `build_id` (`buildIdFromArtifactPath`) — runs BEHIND the gate. The scene
+  then re-dispatched every 5 s tick (`cache_hit` → callback → `stale` →
+  DIRTY) forever. The gate now performs exactly ONE additional read of the
+  SAME key with `build_id IS NULL` (never another build's row, never
+  "latest any row") through the same PersistencePort op
+  `sceneAssets.getAssetNullBuild`, applies the SAME version rules
+  (`scene_content_version`, plus `scene_audio_config_version` for audio),
+  and lets `markReady` stamp `build_id` as before. A NULL row whose
+  version is below the scene version still fails the gate (DIRTY) — the
+  correct version arrives from `stampSceneVersionsForDispatch` (dispatch
+  step 5.5 stamps ALL rows of the key, incl. `build_id IS NULL`, before
+  every generation/cache_hit), so the loop converges after the next real
+  dispatch instead of spinning. PG errors stay fail-closed.
+
+### Changed (host adapter, A1)
+
+- `backend/src/storage/postgres/repositories/scene-assets-repo.js` — new
+  `getAssetNullBuild` (same key, `build_id IS NULL`, latest NULL row).
+- `backend/src/storage/runtime-persistence-adapter.js` — delegates the new
+  op; `runtime/persistence-port.js` — declares `sceneAssets.getAssetNullBuild`
+  in `OPS` (no SQL crosses the port).
+
+## 0.1.5 (2026-10-26)
+
+Stage 143a — versioned-pointer readers + atomic publication. See the
+player 0.1.2/0.1.3 entries (same stage) for the flag-gated IU-media
+contour this package complements.

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@animastor/orchestration",
-    "version": "0.1.7",
+    "version": "0.3.0",
     "description": "Animastor Orchestration — the generation orchestration/runtime contour of the Animastor backend, physically extracted from the host (§32.30): the unified generation lifecycle owner (orchestrator facade, stage executor, scene callbacks/restoration), the dispatch engine and its lease/quota/retry managers, the reconciliation engine and counter reconciliation, the scene window/scheduler/worker-health, the runtime-result emitter/consumer, and the eight O-2..O-10 port contracts (Persistence, SceneData, PlaceholderAudio, ProgressEvents, AudioFsm, VideoFsm, HubCancel, LayerConfig). The package reaches the host (runtime config slices, Redis-domain state layer, media facades, the S-5 seam registry, the artifact root, the PW-2 workspace resolver) ONLY through the composition-root host-bindings seam — no backend/src require, no storage/book/routes/services, no Redis, no PG, no Express inside.",
     "keywords": [
         "animastor",
@@ -18,7 +18,8 @@
         "src/",
         "test/",
         "README.md",
-        "LICENSE"
+        "LICENSE",
+        "CHANGELOG.md"
     ],
     "scripts": {
         "test": "mocha --exit --require test/test-bindings.js test/*.test.js"

package/src/index.js

@@ -75,6 +75,7 @@ const EAGER_EXPORTS = {
 const RUNTIME_NS = {
     scheduler: './runtime/runtime-scheduler',
     activeScenes: './runtime/active-scenes-index',
+    commandGate: './runtime/command-gate',
     reconciliation: './runtime/reconciliation-engine',
     dispatch: './runtime/dispatch-engine',
     leaseManager: './runtime/lease-manager',

package/src/orchestration/orchestrator.js

@@ -465,7 +465,7 @@ async function reconcile(redis, bookId, chapterId, sceneId) {
 //   options.readdToActiveIndex — вернуть сцены планировщику после reset (default true)
 //
 // Что делает:
-//   1. force-dispatch флаг
+//   1. force-набор: только сцены×стадии этой регенерации
 //   2. событие SCENE_RESET в journal
 //   3. удаление из active index
 //   4. снятие dispatch leases только для сбрасываемых стадий
@@ -497,11 +497,18 @@ async function resetScenes(redis, bookId, buildId, scenes, layerCfg, options = {
     const scopeDisplay = `${scope}${chapterId ? '/' + chapterId : ''}${sceneId ? '/' + sceneId : ''}`;
     log(`[RESET-SCENES] ${bookId}: ${scenes.length} scenes, scope=${scopeDisplay}`);
 
-    // 1. Force-dispatch flag (T1: TTL из TIMEOUTS)
-        await redis.set(
-        `animastor:force-dispatch:${bookId}`, '1',
-        'EX', runtimeConfig.TIMEOUTS.FORCE_DISPATCH_TTL_S
-    );
+    // 1. Force set (T1: TTL из TIMEOUTS). Command-only generation: force
+    // covers EXACTLY the scene×stage pairs reset here (dirty_layers ∩ enabled
+    // layers of the request) — never the whole book (incident 2026-10-30:
+    // one-scene audio regenerate force-dispatched an unrelated image stage).
+    const commandGate = require('../runtime/command-gate');
+    await commandGate.addForceStages(redis, bookId, scenes.map(ds => ({
+        chapter_id: ds.chapter_id,
+        scene_id: ds.scene_id,
+        stages: (ds.dirty_layers || mediaRegistry.listMediaTypes()).filter(stage =>
+            layerCfg?.[`${stage}_enabled`] !== false
+        ),
+    })), runtimeConfig.TIMEOUTS.FORCE_DISPATCH_TTL_S);
 
     // 2. Event journal — start
     await journal.appendSceneEvent(redis, bookId, chapterId || bookId, sceneId || 'all',
@@ -601,10 +608,13 @@ async function resetScenes(redis, bookId, buildId, scenes, layerCfg, options = {
     // Selective generation can defer this until its task registry is ready.
     // Гарантированно выполняется даже при ошибке markDirty (шаг 8).
     if (readdToActiveIndex) {
+        // Command-gated write: only scenes with an authorized stage enter.
+        let readded = 0;
         for (const ds of scenes) {
-            await scheduler.addSceneToActiveIndex(redis, bookId, ds.chapter_id, ds.scene_id);
+            const r = await scheduler.addSceneToActiveIndex(redis, bookId, ds.chapter_id, ds.scene_id);
+            if (r && !r.denied) readded++;
         }
-        log(`[RESET-SCENES] ${bookId}: ${scenes.length} scenes re-added to active index`);
+        log(`[RESET-SCENES] ${bookId}: ${readded}/${scenes.length} scenes re-added to active index (command-gated)`);
     } else {
         log(`[RESET-SCENES] ${bookId}: activation deferred for ${scenes.length} scenes`);
     }

package/src/orchestration/scene-callbacks.js

@@ -277,9 +277,17 @@ async function handleImageCompleted(redis, bookId, chapterId, sceneId, buildId)
     // T1: возвращает { ok, retryable, reason, artifact }
     log(`IMAGE_CALLBACK: ${bookId}/${chapterId}/${sceneId}`);
 
-    const sceneImage = image.resolveCanonicalSceneImage(
+    // Stage 143a: legacy canonical scan first (unchanged behavior, also the
+    // path every host stub knows), then — flag on and scan empty — the
+    // published pointer of this scene build as the completion proof.
+    let sceneImage = image.resolveCanonicalSceneImage(
         artifactRoot(), buildId, bookId, chapterId, sceneId
     );
+    if (!sceneImage && typeof image.resolveVersionedSceneProof === 'function') {
+        sceneImage = await image.resolveVersionedSceneProof(
+            artifactRoot(), buildId, bookId, chapterId, sceneId
+        );
+    }
 
     // Per-asset check
     const assetStates = await state.getAssetStates(redis, bookId, chapterId, sceneId);
@@ -334,7 +342,28 @@ async function handleImageCompleted(redis, bookId, chapterId, sceneId, buildId)
             const stillPending = [];
             for (const uid of dirtyIds) {
                 const pngPath = path.join(buildDir, artifactNaming.sceneImageName(bookId, chapterId, sceneId, uid));
-                if (!fs.existsSync(pngPath)) {
+                if (fs.existsSync(pngPath)) continue;
+                // ── Stage 143a (phase 2a · N1) ─────────────────────
+                // A versioned-only build never writes the canonical file, so
+                // the published pointer is the completion proof for this
+                // unit. Without it the dirty marker is never cleared and the
+                // unit is force-regenerated on EVERY reconcile pass (infinite
+                // regeneration loop with the flag on).
+                // Flag OFF ⇒ the facade answers null with zero PG calls → the
+                // legacy check above decides, exactly as before.
+                // A pointer-store ERROR keeps the unit pending (never cleared
+                // on an unknown verdict) and is logged.
+                let provenByPointer = false;
+                try {
+                    if (image && typeof image.resolveIuImagePath === 'function') {
+                        const published = await image.resolveIuImagePath(
+                            artifactRoot(), buildId, bookId, chapterId, sceneId, uid);
+                        provenByPointer = !!(published && published.status === 'ok');
+                    }
+                } catch (pgErr) {
+                    warn(`[DIRTY-UNITS] pointer proof unavailable for ${uid}: ${pgErr.message} — keeping it pending`);
+                }
+                if (!provenByPointer) {
                     stillPending.push(uid);
                 }
             }
@@ -343,8 +372,31 @@ async function handleImageCompleted(redis, bookId, chapterId, sceneId, buildId)
                 log(`[DIRTY-UNITS-CLEARED] ${bookId}/${chapterId}/${sceneId}: all ${dirtyIds.length} dirty unit(s) completed, cleared`);
                 try {
                     const iuPrefix = artifactNaming.iuImagePrefix(bookId, chapterId, sceneId);
+                    const scenePrefix = artifactNaming.scenePrefix(bookId, chapterId, sceneId);
                     const allFiles = fs.existsSync(buildDir) ? fs.readdirSync(buildDir) : [];
-                    const iuFileCount = allFiles.filter(f => f.startsWith(iuPrefix) && f.endsWith('.png')).length;
+                    // ── Stage 143a (phase 2a · N2) ─────────────────
+                    // Ready units = canonical file names ∪ published pointer
+                    // ids (versioned files are invisible to this scan). The
+                    // counter is a DISPLAY source (consumers clamp it), so a
+                    // pointer-store error here only logs and leaves the
+                    // legacy count — never a readiness decision.
+                    const readyIds = new Set();
+                    for (const f of allFiles) {
+                        if (f.startsWith(iuPrefix) && f.endsWith('.png')) {
+                            readyIds.add(f.startsWith(`${scenePrefix}_`)
+                                ? f.slice(scenePrefix.length + 1, -4)
+                                : f);
+                        }
+                    }
+                    if (image && typeof image.listPublishedIuIdsForScene === 'function') {
+                        try {
+                            const publishedIds = await image.listPublishedIuIdsForScene(buildId, bookId, chapterId, sceneId);
+                            for (const id of publishedIds) readyIds.add(String(id));
+                        } catch (pgErr) {
+                            warn(`[IU-COUNTER-RESET] published ids unavailable for ${bookId}/${chapterId}/${sceneId}: ${pgErr.message} — counting canonical files only`);
+                        }
+                    }
+                    const iuFileCount = readyIds.size;
                     if (iuFileCount > 0) {
                         const progKey = `animastor:iu-progress:${bookId}:${chapterId}:${sceneId}:image`;
                         await redis.set(progKey, String(iuFileCount), 'EX', 14400);

package/src/orchestration/scene-orchestrator.js

@@ -13,10 +13,15 @@ const chunks = lazyHostBinding('media.audio.chunks');
 // orchestrator never requires gpu-dispatcher or the workflow connector.
 const provider = require('@animastor/generation').comfyuiProvider;
 const runtimeScheduler = require('../runtime/runtime-scheduler');
+// Stage 118 (M3): the shared outcome taxonomy — the dispatch engine (runtime
+// tier) and the stage executors (orchestration tier) must classify a
+// "nothing was enqueued" outcome IDENTICALLY.
+const { classifyNotSentReasons } = require('../runtime/dispatch-outcomes');
 // O-2: persistence arrives ONLY through the PersistencePort (host adapter:
 // storage/runtime-persistence-adapter) — the scene-assets repository left
 // this file. SQL lives host-side.
 const persist = require('../runtime/persistence-port').persist;
+const isPersistencePortWired = require('../runtime/persistence-port').isPersistencePortWired;
 // O-3: scene content arrives ONLY through the SceneDataPort (host adapter:
 // storage/scene-data-adapter) — the Book Model facade (../book →
 // @animastor/vbook-runtime) left this file. Aliased `sceneDataPort` because
@@ -63,19 +68,21 @@ const EXECUTORS = {
     video: executeVideoDispatch,
 };
 
-async function startScene(redis, scene, loadedBook, buildId) {
+async function startScene(redis, scene, loadedBook, buildId, stage = 'audio') {
     const bookId = scene.book_id;
     const chapterId = scene.chapter_id;
     const sceneId = scene.scene_id;
 
-    log(`START SCENE: ${bookId}/${chapterId}/${sceneId}`);
+    log(`START SCENE: ${bookId}/${chapterId}/${sceneId} (stage=${stage})`);
 
-    await logEvent(redis, scene, 'SCENE_STARTED', 'audio_pending', {
+    await logEvent(redis, scene, 'SCENE_STARTED', `${stage}_pending`, {
         buildId, bookId, chapterId, sceneId
     });
 
-    // T7: через фасад — единый владелец PENDING
-    await setScenePending(redis, bookId, chapterId, sceneId, 'audio', buildId);
+    // T7: через фасад — единый владелец PENDING. Command-only generation:
+    // only the stage being dispatched becomes PENDING — a NEW scene asked for
+    // `image` must not get an unrequested `audio` PENDING.
+    await setScenePending(redis, bookId, chapterId, sceneId, stage, buildId);
     await runtimeScheduler.addSceneToActiveIndex(redis, bookId, chapterId, sceneId);
     log(`ADDED TO ACTIVE: ${bookId}/${chapterId}/${sceneId}`);
 
@@ -300,8 +307,22 @@ async function executeAudioDispatch(redis, scene, loadedBook, buildId, dispatchI
         const completion = await completeStage(redis, bookId, chapterId, sceneId, 'audio', buildId, dispatchId);
         return { dispatched: false, jobs: 0, completed: completion.completed, reason: 'no_segments' };
     } else {
-        warn(`AUDIO_DISPATCH: generateSceneAudio did not send jobs for ${bookId}/${chapterId}/${sceneId}`);
-        return { dispatched: false, jobs: 0, reason: 'no_jobs_generated' };
+        // Stage 116 (D3) / Stage 118 (B3, M3): nothing was enqueued — carry
+        // the precise reason (no live worker / everything already queued /
+        // ambiguous POST) so the dispatch engine can apply a BOUNDED deferral
+        // instead of a fatal cancel.
+        //
+        // Stage 118 (B3): the merged (pure-dialogue) path and the per-segment
+        // path must produce the SAME classification — the merged branch used
+        // to leave the reason empty, so a pure-dialogue scene kept the
+        // 5-second retry loop. `deferReason` is computed by the host (audio
+        // generation) for EVERY path; the fallback below keeps the historic
+        // 'no_jobs_generated' semantics when the host could not classify it.
+        const deferReason = (result && result.reason === 'no_jobs_accepted' && result.deferReason)
+            ? result.deferReason
+            : 'no_jobs_generated';
+        warn(`AUDIO_DISPATCH: generateSceneAudio did not send jobs for ${bookId}/${chapterId}/${sceneId} (${deferReason})`);
+        return { dispatched: false, jobs: 0, reason: deferReason, retryable: true };
     }
 }
 
@@ -352,8 +373,11 @@ async function executeImageDispatch(redis, scene, loadedBook, buildId, dispatchI
 
     // T3: generateSceneIUImages возвращает количество отправленных jobs
     let jobsSent = 0;
+    // Stage 116 (D3): the result is needed AFTER the try/catch (the deferral
+    // reason) — it must be visible outside the block.
+    let genResult = null;
     try {
-        const genResult = await image.generateSceneIUImages(
+        genResult = await image.generateSceneIUImages(
             redis,
             sceneData,
             bookData,
@@ -377,6 +401,16 @@ async function executeImageDispatch(redis, scene, loadedBook, buildId, dispatchI
         return { dispatched: true, jobs: jobsSent, reason: null };
     }
 
+    // Stage 116 (D3) / Stage 118 (M3): the executor sent NOTHING. That is
+    // not a lost task and not a fatal cancellation — it is a bounded
+    // deferral. The precise reason (no live worker / everything already
+    // queued / ambiguous POST) is carried through so the deferral can be
+    // classified by the shared taxonomy (runtime/dispatch-outcomes).
+    if (genResult && genResult.deferReason) {
+        warn(`IMAGE_DISPATCH: ${bookId}/${chapterId}/${sceneId} — nothing enqueued (${genResult.deferReason}); deferring`);
+        return { dispatched: false, jobs: 0, reason: genResult.deferReason, retryable: true };
+    }
+
     log(`IMAGE_DISPATCH: ${bookId}/${chapterId}/${sceneId} — no jobs sent (cache hit or empty units)`);
     return { dispatched: false, jobs: 0, reason: 'no_jobs_sent' };
 }
@@ -551,15 +585,41 @@ async function executeVideoDispatch(redis, scene, loadedBook, buildId, dispatchI
     await videoOrch.setWaitingChunks(redis, bookId, chapterId, sceneId);
 
     let sentCount = 0;
+    // Stage 116 (D3) / Stage 118 (M3): collect WHY a job was not sent — the
+    // dominant reason becomes the deferral reason (bounded backoff) instead
+    // of the generic 'send_failed'.
+    const notSentReasons = new Map();
     for (const jobSpec of jobsToSend) {
         try {
-            const sendResult = await provider.generate(jobSpec);
+            let sendResult = await provider.generate(jobSpec);
+            // Stage 122 (N2): the group file was probed absent above (a cached
+            // group never reaches this loop), so an `already_completed` verdict
+            // is by construction an ORPHANED completion marker. Free it and
+            // retry ONCE so the video regenerates instead of looping on a
+            // 900 s deferral with the scene stuck in the active index (audit
+            // 121 · N2). The release rides the persistence port — the
+            // orchestration tier cannot require the backend helper directly.
+            // Skipped when the port is unwired (harnesses that don't exercise
+            // orphan cleanup); production always wires it in backend.cjs.
+            if (isPersistencePortWired()) {
+                let released = false;
+                try {
+                    released = await persist('idem.releaseTaskDoneIfOrphan')(redis, sendResult);
+                } catch (_) { released = false; }
+                if (released) {
+                    log(`VIDEO_DISPATCH: orphaned completion marker released for ${jobSpec.job_id} — regenerating`);
+                    sendResult = await provider.generate(jobSpec);
+                }
+            }
             if (sendResult.sent) {
                 sentCount++;
             } else {
-                warn(`VIDEO_DISPATCH: Hub rejected job ${jobSpec.job_id}: ${sendResult.error || 'unknown'}`);
+                const reason = sendResult.reason || 'send_failed';
+                notSentReasons.set(reason, (notSentReasons.get(reason) || 0) + 1);
+                warn(`VIDEO_DISPATCH: Hub rejected job ${jobSpec.job_id}: ${sendResult.error || reason}`);
             }
         } catch (sendErr) {
+            notSentReasons.set('send_failed', (notSentReasons.get('send_failed') || 0) + 1);
             warn(`VIDEO_DISPATCH: provider generate failed for job ${jobSpec.job_id}: ${sendErr.message}`);
         }
     }
@@ -569,8 +629,13 @@ async function executeVideoDispatch(redis, scene, loadedBook, buildId, dispatchI
         return { dispatched: true, jobs: sentCount, reason: null };
     }
 
-    warn(`VIDEO_DISPATCH: ${bookId}/${chapterId}/${sceneId}: all provider.generate calls failed`);
-    return { dispatched: false, jobs: 0, reason: 'send_failed' };
+    // Stage 116 (D3) / Stage 118 (M3): the shared taxonomy decides whether
+    // the outcome is a bounded deferral. EVERY reason must be deferrable —
+    // a single real failure (send_failed) keeps the historic 'send_failed'
+    // semantics (an immediate retry on the next tick).
+    const deferReason = classifyNotSentReasons(notSentReasons) || 'send_failed';
+    warn(`VIDEO_DISPATCH: ${bookId}/${chapterId}/${sceneId}: nothing enqueued (${deferReason})`);
+    return { dispatched: false, jobs: 0, reason: deferReason, retryable: true };
 }
 
 // T4: dispatchStage принимает dispatchId (из dispatch-engine) и передаёт executors
@@ -589,7 +654,7 @@ async function dispatchStage(redis, scene, loadedBook, buildId, overrideStage, d
     );
     if (isNewScene) {
         log(`NEW SCENE: ${bookId}/${chapterId}/${sceneId} (asset-state)`);
-        await startScene(redis, scene, loadedBook, buildId);
+        await startScene(redis, scene, loadedBook, buildId, overrideStage || 'audio');
     }
 
     if (!overrideStage) {
@@ -610,7 +675,19 @@ async function dispatchStage(redis, scene, loadedBook, buildId, overrideStage, d
     result = await executor(redis, scene, loadedBook, buildId, dispatchId);
 
     result = result || { dispatched: false, reason: 'no_result', jobs: 0 };
-    if (!result.dispatched && !result.completed) {
+    if (!result.dispatched && !result.completed && result.reason === 'no_worker_available') {
+        // Command-only generation: no live worker of this type → the stage is
+        // BLOCKED, not re-queued. GENERATING → DIRTY only (never PENDING): the
+        // scheduler marks the command blocked and nothing retries it until a
+        // new command arrives (incident 2026-10-30: endless no_worker loop).
+        const rollback = await require('../runtime/command-gate').rollbackGeneratingToDirty(
+            redis, bookId, chapterId, sceneId, overrideStage, 'no_worker_available');
+        if (!rollback.changed && rollback.reason !== 'state_dirty' && rollback.reason !== 'state_ready') {
+            warn(`DISPATCH_ROLLBACK_FAILED: ${bookId}/${chapterId}/${sceneId} ${overrideStage}: ${rollback.reason} — blocked stage not released`);
+            result.rollbackFailed = true;
+            result.rollbackReason = rollback.reason;
+        }
+    } else if (!result.dispatched && !result.completed) {
         // FSM-валидный rollback (GENERATING → DIRTY → PENDING). Прямой
         // generating→pending запрещён FSM; раньше здесь вызывался setScenePending,
         // rejection молча проглатывался — и сцена навсегда оставалась в GENERATING

package/src/runtime/active-scenes-index.js

@@ -33,12 +33,28 @@ async function getActiveCount(redis) {
 }
 
 /**
- * Add scene to active index when it enters generating/pending state.
+ * Add scene to active index — COMMAND-GATED (generation only by explicit
+ * command, see ./command-gate). The scene enters the index only when at
+ * least one of its stages is authorized: an ACTIVE task-registry task of that
+ * stage targets the scene, the layer is enabled and the book is not
+ * cancelled. Otherwise nothing is written and `{ added:false, denied:true }`
+ * is returned with the per-stage denial reasons.
+ *
+ * This is the ONE write path into the index (scheduler wrapper, regenerate,
+ * reconcile, scene-window, host services and the player all reach it), so
+ * no background path can queue work without a command.
  */
 async function addActiveScene(redis, bookId, chapterId, sceneId) {
     const sceneKey = `${bookId}:${chapterId}:${sceneId}`;
+    // Lazy: command-gate → scene-window → this module (acyclic at load time).
+    const auth = await require('./command-gate').getAuthorizedStages(redis, bookId, chapterId, sceneId);
+    if (auth.stages.size === 0) {
+        const reasons = require('./command-gate').describeDenied(auth.denied);
+        console.log(`[ACTIVE-INDEX] GATE_DENY ${sceneKey}: no command-authorized stage (${reasons}) — not added`);
+        return { added: false, denied: true, sceneKey, reasons: auth.denied };
+    }
     const added = await redis.sadd(ACTIVE_SCENES_KEY, sceneKey);
-    return { added: added > 0, sceneKey };
+    return { added: added > 0, sceneKey, stages: [...auth.stages] };
 }
 
 /**