@feigi/fleet-ctl 3.16.8 → 3.17.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@feigi/fleet-ctl",
-  "version": "3.16.8",
+  "version": "3.17.0",
   "description": "Agent fleet: run-team controller, merge bot, PR reviewer, and the ticket pipeline they share",
   "license": "Apache-2.0",
   "repository": {

package/scripts/dispositions-check.mjs

@@ -8,9 +8,12 @@
 //
 //   dispositions-ok=fix-pr-<M>[-x]:<head>        every rule below held
 //   dispositions-mismatch=fix-pr-<M>[-x]:<head>  at least one entry broke one
-//   dispositions-escalate=fix-pr-<M>[-x]:<head>  every rule held, but a critical
-//                                                or important finding was deferred
-//                                                `remedy-outside-diff`: a human rules
+//   dispositions-escalate=fix-pr-<M>[-x]:<head>  a human rules: either every rule held
+//                                                but a critical or important finding
+//                                                was deferred `remedy-outside-diff`,
+//                                                or a rule broke and an earlier
+//                                                fix-applier's record on the same
+//                                                review already had
 //
 // `<head>` is the review file's `head` — the review the record answers — so a
 // verdict on one review never answers a later one.
@@ -358,6 +361,19 @@ export function withVerdict(rowText, token) {
   return folded === "" ? token : `${folded} · ${token}`;
 }
 
+// Whether a fix-applier on PR `pr` with a lower retry suffix than `member`
+// already has a mismatch or escalate on the ledger for `head` — on any row
+// that resolves to the PR, since a row can be split. A verdict on another
+// review head counts for nothing, so a new review starts the count again.
+export function failedBefore(rows, pr, member, head) {
+  const mine = member.retry ?? "";
+  return rows.some((r) => rowNums(r).pr === pr && r.split(/\s+/).some((w) => {
+    const d = dispositionsToken(w);
+    return d !== null && d.verdict !== "ok" && d.member.number === pr
+      && (d.member.retry ?? "") < mine && sameHead(d.head, head);
+  }));
+}
+
 // ---------------------------------------------------------------------------
 // CLI
 // ---------------------------------------------------------------------------
@@ -475,14 +491,20 @@ function main() {
   const { violations, escalations } = checkDispositions({
     review, record, recordProblem, touched: touchedLines(diff), diffFiles, roots: [review.snapshot, top],
   });
-  const verdict = violations.length > 0 ? "mismatch" : escalations.length > 0 ? "escalate" : "ok";
-  const token = `dispositions-${verdict}=${member.name}:${head}`;
-
   // The verdict lands on the row carrying the member on its own PR's row —
   // where `ledger.mjs dispatch` wrote it, and where the gate reads PR M's
-  // tokens from. No ledger, no row: the exit status below is the verdict.
-  if (ledgerFile !== null) {
-    const data = JSON.parse(runLedger(ledgerFile, ["read"], "read the ledger"));
+  // tokens from. No ledger, no row: the exit status below is the verdict, and
+  // with no earlier fix-applier's verdict to count, a broken rule is always a
+  // mismatch.
+  const data = ledgerFile === null ? null : JSON.parse(runLedger(ledgerFile, ["read"], "read the ledger"));
+  // A mismatch an earlier fix-applier already drew on this review makes this
+  // one the second: it is written as an escalate, which no fix-applier answers.
+  const secondMismatch = violations.length > 0 && data !== null && failedBefore(data.rows, pr, member, head);
+  const verdict = violations.length > 0 ? (secondMismatch ? "escalate" : "mismatch")
+    : escalations.length > 0 ? "escalate" : "ok";
+  const token = `dispositions-${verdict}=${member.name}:${head}`;
+
+  if (data !== null) {
     const row = data.rows.find((r) => rowNums(r).pr === pr && memberTokens(r).some((t) => t.name === member.name));
     if (row === undefined) die(`${member.name} is on no row of PR #${pr} — \`ledger.mjs dispatch\` records a fix-applier before its record can be checked; with no controller, pass --no-ledger`);
     const key = row.split(/\s/)[0];
@@ -495,6 +517,9 @@ function main() {
 
   for (const v of violations) console.error(`${member.name}: ${formatViolation(v)}`);
   for (const x of escalations) console.error(`${member.name}: ${formatEscalation(x)}`);
+  if (secondMismatch) {
+    console.error(`${member.name}: escalate — an earlier fix-applier's record on review ${head} already failed this check; no further fix-applier answers PR #${pr}, a human does`);
+  }
   console.log(JSON.stringify({ member: member.name, pr, head, verdict, token: ledgerFile === null ? null : token, violations, escalations }));
   // exitCode, not exit(): stdout to a pipe is written asynchronously, and an
   // exit() here could cut the payload off.

package/scripts/dispositions-check.test.mjs

@@ -14,7 +14,7 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { deriveRun } from "./fleet-tick.mjs";
-import { touchedLines, checkDispositions, withVerdict, repoPath, formatViolation } from "./dispositions-check.mjs";
+import { touchedLines, checkDispositions, withVerdict, repoPath, formatViolation, failedBefore } from "./dispositions-check.mjs";
 
 const SCRIPT = fileURLToPath(new URL("./dispositions-check.mjs", import.meta.url));
 const LEDGER = fileURLToPath(new URL("./ledger.mjs", import.meta.url));
@@ -255,6 +255,86 @@ test("a re-check replaces the member's own verdict for the same head and never d
   assert.equal(f.okLedger("dispatch", "40", "finisher-pr-40").agent, "fleet-finisher");
 });
 
+// A first mismatch is retried by `fix-pr-<M>-b`; a second on the same review
+// is written as an escalate, which keeps the finisher refused and is the end
+// of the automatic path.
+const badRecord = (f) => {
+  const entries = f.baseEntries();
+  entries[0] = f.entry("survived", 0, { disposition: "defer" });
+  return entries;
+};
+const retry = (f, name = "fix-pr-40-b") => {
+  f.okLedger("dispatch", "40", name);
+  f.okLedger("settle", name, `applied:${f.head.slice(0, 7)}`);
+};
+
+test("a second mismatch on the same review writes dispositions-escalate, and the finisher stays refused", (t) => {
+  const f = fixture(t);
+  f.writeRecord(badRecord(f));
+  mismatch(f.check());
+  retry(f);
+  const r = f.check("fix-pr-40-b");
+  assert.equal(r.status, 1, r.stderr);
+  assert.equal(r.json.verdict, "escalate");
+  assert.equal(r.json.token, `dispositions-escalate=fix-pr-40-b:${f.head}`);
+  assert.match(r.stderr, /^fix-pr-40-b: survived\[0\]: an in-scope survived finding deferred with no reason/m, "the violations are still printed");
+  const row = f.row();
+  assert.ok(row.includes(`dispositions-mismatch=fix-pr-40:${f.head}`) && row.includes(`dispositions-escalate=fix-pr-40-b:${f.head}`), row);
+  const d = f.ledgerCli("dispatch", "40", "finisher-pr-40");
+  assert.equal(d.status, 2);
+  assert.match(d.stderr, /finisher-pr-40: dispositions escalate — fix-pr-40-b deferred .*second mismatch/);
+  // Re-running the escalated member's check is idempotent.
+  const again = f.check("fix-pr-40-b");
+  assert.equal(again.json.verdict, "escalate");
+  assert.equal(f.row().match(/dispositions-escalate=/g).length, 1, f.row());
+});
+
+test("the retry that passes the check ends the refusal, and the first mismatch stays on the row unread", (t) => {
+  const f = fixture(t);
+  f.writeRecord(badRecord(f));
+  mismatch(f.check());
+  retry(f);
+  f.writeRecord(f.baseEntries());
+  okVerdict(f.check("fix-pr-40-b"));
+  assert.ok(f.row().includes(`dispositions-mismatch=fix-pr-40:${f.head}`), "the first fix-applier's verdict is kept");
+  assert.equal(f.okLedger("dispatch", "40", "finisher-pr-40").agent, "fleet-finisher");
+});
+
+test("the first mismatch is a plain mismatch, and a mismatch on an earlier review does not count toward a later one", (t) => {
+  const f = fixture(t);
+  f.writeRecord(badRecord(f));
+  const first = f.check();
+  assert.equal(first.json.verdict, "mismatch");
+  assert.equal(first.json.token, `dispositions-mismatch=fix-pr-40:${f.head}`);
+  // The earlier fix-applier's mismatch answered another review's head.
+  retry(f);
+  f.okLedger("row", "10", f.row().slice(4).replace(`dispositions-mismatch=fix-pr-40:${f.head}`, "dispositions-mismatch=fix-pr-40:deadbee1"));
+  const second = f.check("fix-pr-40-b");
+  assert.equal(second.json.verdict, "mismatch", second.stderr);
+});
+
+test("a mismatch from a later suffix, an ok, or another PR's fix-applier is not an earlier failure", () => {
+  const H = "abc1234";
+  const row = (...tokens) => `#10 impl-10=PR#40 → PR#40 · reviewed=${H}:1/0/0 · ${tokens.join(" · ")}`;
+  const b = { retry: "b" };
+  assert.equal(failedBefore([row(`dispositions-mismatch=fix-pr-40:${H}`)], 40, b, H), true);
+  assert.equal(failedBefore([row(`dispositions-escalate=fix-pr-40:${H}`)], 40, b, H), true);
+  assert.equal(failedBefore([row(`dispositions-ok=fix-pr-40:${H}`)], 40, b, H), false, "an ok is no failure");
+  assert.equal(failedBefore([row(`dispositions-mismatch=fix-pr-40-c:${H}`)], 40, b, H), false, "a later suffix is not earlier");
+  assert.equal(failedBefore([row(`dispositions-mismatch=fix-pr-40-b:${H}`)], 40, b, H), false, "the member itself is not earlier");
+  assert.equal(failedBefore([row(`dispositions-mismatch=fix-pr-40:${H}`)], 40, { retry: null }, H), false, "nor is the first fix-applier's own re-run");
+  assert.equal(failedBefore([row(`dispositions-mismatch=fix-pr-40:fedcba9`)], 40, b, H), false, "another review's head");
+  assert.equal(failedBefore([row(`dispositions-mismatch=fix-pr-41:${H}`)], 40, b, H), false, "another PR's fix-applier");
+  // A split row: the earlier verdict sits on another row that resolves to PR 40.
+  assert.equal(failedBefore(["#11 impl-11=PR#40 → PR#40 · dispositions-mismatch=fix-pr-40:abc1234", "#12 impl-12=PR#41 → PR#41"], 40, b, H), true);
+  // A copy of PR 40's verdict on PR 41's row is a stray: that row does not resolve to PR 40.
+  assert.equal(failedBefore(["#12 impl-12=PR#41 → PR#41 · dispositions-mismatch=fix-pr-40:abc1234"], 40, b, H), false);
+  // The same review named by a short head on one side and a full SHA on the other.
+  const full = `${H}${"0".repeat(33)}`;
+  assert.equal(failedBefore([row(`dispositions-mismatch=fix-pr-40:${H}`)], 40, b, full), true, "an earlier token's short head matches a full check head");
+  assert.equal(failedBefore([row(`dispositions-mismatch=fix-pr-40:${full}`)], 40, b, H), true, "an earlier token's full head matches a short check head");
+});
+
 test("nothing is judged or written when the review file or the git history cannot be read", (t) => {
   const f = fixture(t);
   f.writeRecord(f.baseEntries());

package/scripts/dispositions-gate-prose.test.mjs

@@ -72,16 +72,31 @@ test("the gate says what each refusal asks of the controller", () => {
     "`dispositions unchecked` — no verdict answers that head: run `dispositions-check.mjs` for the fix-applier that answered the review",
   ));
   assert.match(s, phrase(
-    "`dispositions mismatch` — no finisher: post the check's output, which names each violating entry, with `gh pr comment <M>`, and flag the PR for a human",
+    "`dispositions mismatch` — no finisher: the tick prints `DISPATCH fix-pr PR#<M>` for it, and the next-suffix fix-applier answers it",
   ));
   assert.match(s, phrase(
-    "`dispositions escalate` — no finisher, and no retry: a `critical` or `important` finding was deferred `remedy-outside-diff`, which only a human can rule on. Post the check's output, which names each escalated finding, with `gh pr comment <M>`, and flag the PR for a human; dispatch no fix-applier and no finisher for that review's head",
+    "`dispositions escalate` — no finisher, no retry and no further fix-applier: either a `critical` or `important` finding was deferred `remedy-outside-diff`, or a second mismatch was drawn on one review, and only a human can rule on either.",
+  ));
+  assert.match(s, phrase(
+    "Post the check's output, which names each escalated finding or violating entry, with `gh pr comment <M>`, and flag the PR for a human; re-running the check reprints it. Dispatch no fix-applier and no finisher for that review's head",
   ));
   assert.match(s, phrase(
     "it refuses too while a fix-applier on the PR is still live, verdict or not** — `fix-pr-<M>[-x] still live`: settle it, run the check for it, then dispatch again.",
   ));
 });
 
+test("a mismatch is retried once by the next suffix, whose prompt carries the violation list, and a second failure escalates", () => {
+  const s = paragraph(SKILL, "`DISPATCH fix-pr PR#<M>` on a dispositions mismatch", "run-team/SKILL.md", { emphasisTolerant: true });
+  assert.match(s, phrase("is one automatic retry, a review fix-applier named the next suffix (`fix-pr-<M>-b`)"));
+  assert.match(s, phrase(
+    "the review file `<scratch>/review-<M>.json`, the disposition record `<scratch>/dispositions-<M>.json` it rewrites, and the check's violation list **verbatim**",
+  ));
+  assert.match(s, phrase(
+    "A second failure on the same review is written as `dispositions-escalate=fix-pr-<M>-b:<head>` in place of a mismatch: the tick prints no `DISPATCH fix-pr` for it, `dispatch` refuses the finisher naming `dispositions escalate`",
+  ));
+  assert.match(s, phrase("A new review of the PR counts again from none."));
+});
+
 test("a reversed refutation reaches the ledger from the disposition record", () => {
   assert.match(paragraph(SKILL, "`refuted` comes back deliberately as well", "run-team/SKILL.md"), phrase(
     "The fix-applier may reverse one; it records each reversal as a `refuted` entry in its disposition record, the evidence in `reason`, and you copy those entries to the ledger's `ruled` line",

package/scripts/fleet-tick.mjs

@@ -308,11 +308,12 @@ const TIER_VERDICT = /^tier-(ok|mismatch|unverifiable)=([^:\s]+):\S+$/;
 // dispositions-check.mjs's verdict on a review fix-applier's disposition
 // record: `dispositions-ok=fix-pr-<M>[-x]:<head>`,
 // `dispositions-mismatch=…` or `dispositions-escalate=…` (a critical or
-// important deferral that a human rules on), `<head>` the head of the review
-// the record answers. `ledger.mjs dispatch` refuses a finisher on any verdict
-// but ok; the tick holds nothing on one, having no finisher role. A token
-// outside this shape is no verdict at all, which the gate reads as
-// unchecked: fail closed.
+// important deferral, or a second mismatch on one review, that a human rules
+// on), `<head>` the head of the review the record answers. `ledger.mjs
+// dispatch` refuses a finisher on a mismatch or an escalate. A mismatch
+// returns the PR to fixDue for one retry; an escalate is a hold only a human
+// answers, so the tick never re-offers the PR for it. A token outside this
+// shape is no verdict at all, which the gate reads as unchecked: fail closed.
 export function dispositionsToken(tok) {
   const m = /^dispositions-(ok|mismatch|escalate)=([^:\s]+):([0-9a-f]{7,40})$/i.exec(tok);
   if (!m) return null;
@@ -325,21 +326,24 @@ export function dispositionsToken(tok) {
 // `reviewed=` head (7-40 hex) is matched against gh's full headRefOid.
 export const sameHead = (a, b) => a.startsWith(b) || b.startsWith(a);
 
+// Which verdict outranks which when one fix-applier carries more than one for
+// a head: the stricter reading wins.
+const VERDICT_RANK = { ok: 0, mismatch: 1, escalate: 2 };
+
 // A PR's current dispositions verdict against its latest review head: among
 // the tokens answering that head, the one from the fix-applier with the
 // highest retry suffix ("" < "b" < "c" …) — never row-text position, which a
 // `row` rewrite can reorder. One fix-applier carrying two verdicts for one
-// head reads as the stricter: ok < mismatch < escalate. null when no token
-// answers the head.
+// head reads as the stricter one. null when no token answers the head.
 /** @returns {{verdict: "ok"|"mismatch"|"escalate", member: string}|null} */
 export function currentDispositions(tokens, head) {
-  const strictness = { ok: 0, mismatch: 1, escalate: 2 };
   let best = null;
   for (const t of tokens) {
     if (!sameHead(t.head, head)) continue;
     const retry = t.member.retry ?? "";
     const bestRetry = best?.member.retry ?? "";
-    if (best === null || retry > bestRetry || (retry === bestRetry && strictness[t.verdict] > strictness[best.verdict])) best = t;
+    if (best === null || retry > bestRetry
+      || (retry === bestRetry && VERDICT_RANK[t.verdict] > VERDICT_RANK[best.verdict])) best = t;
   }
   return best === null ? null : { verdict: best.verdict, member: best.member.name };
 }
@@ -506,7 +510,7 @@ export function deriveRun({ rows, dispatched, drain }, prs) {
     // by head and retry suffix, never by where a token sits.
     const st = (pr !== null && byPr.get(pr)) || {
       inFlight: false, reviewedAny: false, survived: 0, unverified: 0, reviewFixed: false,
-      fixMembers: new Set(), fixLanded: new Set(), held: [],
+      fixMembers: new Set(), fixLanded: new Set(), conflictLanded: new Set(), held: [],
       conflictOpen: false, reviewedHead: null, pastPinHalt: false, dispositions: [],
     };
     // The finisher-pr token currently deciding `pastPinHalt`, picked by
@@ -558,8 +562,10 @@ export function deriveRun({ rows, dispatched, drain }, prs) {
           if ((o === "no-op" || /^applied:/.test(o)) && !st.fixLanded.has(t.name)
             && (t.outcome !== null || !settledInRow.has(t.name))) {
             st.fixLanded.add(t.name);
-            if (st.conflictOpen) st.conflictOpen = false;
-            else st.reviewFixed = true;
+            if (st.conflictOpen) {
+              st.conflictOpen = false;
+              st.conflictLanded.add(t.name);
+            } else st.reviewFixed = true;
           }
         }
         if (t.family === "finisher-pr" && t.number === pr
@@ -650,6 +656,19 @@ export function deriveRun({ rows, dispatched, drain }, prs) {
   const heldBehind = (st) => (st?.held ?? []).some((n) => open.has(n));
   const conflictHeld = (st) => st !== undefined && st.conflictOpen;
   const fixRunning = (st) => [...st.fixMembers].some((n) => members.get(n).outcome === null);
+  // The latest review's dispositions verdict is a mismatch no later fix-applier
+  // has answered: the verdict is the highest-suffixed one, and no fix-applier
+  // with a higher suffix has landed. A landed one is awaiting its own check, so
+  // the earlier mismatch is not its verdict; a failed or killed one answered
+  // nothing, and so did a conflict fix-applier, which is never checked. An
+  // escalate is a different verdict and is never due.
+  const mismatchDue = (st) => {
+    if (st.reviewedHead === null) return false;
+    const cur = currentDispositions(st.dispositions, st.reviewedHead);
+    if (cur === null || cur.verdict !== "mismatch") return false;
+    const retry = parseMember(cur.member).retry ?? "";
+    return ![...st.fixLanded].some((n) => !st.conflictLanded.has(n) && (parseMember(n).retry ?? "") > retry);
+  };
   // The halt holds only while the head is still past what was reviewed: a
   // `reviewed=` head (7-40 hex) prefix-matching gh's full headRefOid is the
   // head that review read, and there is nothing more to review.
@@ -661,13 +680,14 @@ export function deriveRun({ rows, dispatched, drain }, prs) {
     mergeBotLive: live("merge-bot"),
     reviewsLive: [...byPr.values()].filter((st) => st.inFlight).length,
     // A returned review whose survivors no review fix-applier has answered,
-    // or a conflict hold no fix-applier has cleared — on a PR still open,
-    // with no fix-applier working it and no newer review running. The two
-    // are answered apart (#2328): a landed conflict fix-applier lifts the
-    // hold and leaves survivors it never read due for a review one.
+    // a conflict hold no fix-applier has cleared, or a dispositions mismatch
+    // no retry has answered — on a PR still open, with no fix-applier working
+    // it and no newer review running. The first two are answered apart
+    // (#2328): a landed conflict fix-applier lifts the hold and leaves
+    // survivors it never read due for a review one.
     fixDue: [...byPr.entries()]
       .filter(([n, st]) => open.has(n)
-        && ((st.survived > 0 && !st.reviewFixed) || conflictHeld(st))
+        && ((st.survived > 0 && !st.reviewFixed) || conflictHeld(st) || mismatchDue(st))
         && !fixRunning(st) && !st.inFlight)
       .map(([n]) => n).sort(asc),
     // Open, not signed off, closing an issue (GitHub's own linked set — a

package/scripts/fleet-tick.test.mjs

@@ -8,7 +8,7 @@
 // settled member live, has to go red here.
 import { test } from "node:test";
 import assert from "node:assert/strict";
-import { reconcile, formatLines, actionable, deriveRun, parseShortlist, unclaimed, refreshWhy } from "./fleet-tick.mjs";
+import { reconcile, formatLines, actionable, deriveRun, parseShortlist, unclaimed, refreshWhy, dispositionsToken, currentDispositions } from "./fleet-tick.mjs";
 
 // Every field named, so a test that cares about one number still states the
 // rest — a defaulted field is a guard nobody is pinning.
@@ -720,6 +720,69 @@ test("deriveRun: survivors a review fix-applier already answered stay answered t
   assert.deepEqual([live.fixDue, live.conflictHeld], [[], [21]]);
 });
 
+// A dispositions mismatch is answered by one automatic retry: the PR returns
+// to fix-due on the row that already dispatches fix-appliers, once, until the
+// retry has been checked. A second failure is escalate, and escalate is a hold
+// no fix-applier answers.
+const D = (fix, ...tokens) => `#20 impl-20=PR#21 → PR#21 · reviewed=abc1234:2/0/0 · ${[...fix, ...tokens].join(" · ")}`;
+const MISMATCH = "dispositions-mismatch=fix-pr-21:abc1234";
+const dueAt = (tail, prs = [pr(21)]) => run({ rows: [D(["fix-pr-21=applied:def5678"], ...tail)] }, prs).fixDue;
+
+test("deriveRun: a first dispositions mismatch puts the PR back in fixDue, and the reviewers row prints it", () => {
+  const r = run({ rows: [D(["fix-pr-21=applied:def5678"], MISMATCH)] }, [pr(21)]);
+  assert.deepEqual(r.fixDue, [21]);
+  assert.equal(row(state({ fixDue: r.fixDue }), "reviewers").action, "DISPATCH fix-pr PR#21");
+  // The survivors alone were answered: with an ok verdict the PR is not due.
+  assert.deepEqual(dueAt(["dispositions-ok=fix-pr-21:abc1234"]), []);
+  // No other role's row moves on the mismatch.
+  const others = (fixDue) => reconcile(state({ fixDue })).filter((x) => x.role !== "reviewers");
+  assert.deepEqual(others(r.fixDue), others([]));
+});
+
+test("deriveRun: a mismatch is due whether the review counted survivors or only unverified findings", () => {
+  const unverifiedOnly = run({ rows: [`#20 impl-20=PR#21 → PR#21 · reviewed=abc1234:0/0/2 · fix-pr-21=applied:def5678 · ${MISMATCH}`] }, [pr(21)]);
+  assert.deepEqual(unverifiedOnly.fixDue, [21]);
+});
+
+test("deriveRun: the retry is not re-offered while live, nor before its own check has run, nor after any verdict of its own", () => {
+  assert.deepEqual(dueAt([MISMATCH, "fix-pr-21-b"]), [], "live");
+  assert.deepEqual(dueAt([MISMATCH, "fix-pr-21-b=applied:0123abc"]), [], "settled, its check not yet run: the earlier mismatch is not the retry's answer");
+  assert.deepEqual(dueAt([MISMATCH, "fix-pr-21-b=applied:0123abc", "dispositions-ok=fix-pr-21-b:abc1234"]), [], "ok ends it");
+  assert.deepEqual(dueAt([MISMATCH, "fix-pr-21-b=applied:0123abc", "dispositions-escalate=fix-pr-21-b:abc1234"]), [], "escalate is never due");
+  assert.deepEqual(dueAt([MISMATCH, "fix-pr-21-b=failed"]), [21], "a retry that died leaves the mismatch for a replacement");
+});
+
+test("deriveRun: a landed conflict fix-applier does not answer a mismatch — the retry is still due", () => {
+  assert.deepEqual(dueAt([MISMATCH, "conflict-hold:#21", "fix-pr-21-b"]), [], "the conflict one is live: nothing is re-offered");
+  assert.deepEqual(dueAt([MISMATCH, "conflict-hold:#21", "fix-pr-21-b=applied:0123abc"]), [21], "hold cleared by -b, the mismatch still stands");
+  assert.deepEqual(dueAt([MISMATCH, "fix-pr-21-b=applied:0123abc"]), [], "control: a review -b that landed is awaiting its own check");
+});
+
+test("deriveRun: a dispositions verdict on a row that never recorded a review head answers nothing", () => {
+  const r = run({ rows: [`#20 impl-20=PR#21 → PR#21 · review=wf:x · fix-pr-21=applied:def5678 · ${MISMATCH}`] }, [pr(21)]);
+  assert.deepEqual(r.fixDue, []);
+});
+
+test("deriveRun: the verdict is read by review head and highest retry, never by position in the row", () => {
+  const escalated = ["dispositions-escalate=fix-pr-21-b:abc1234", MISMATCH];
+  assert.deepEqual(dueAt(["fix-pr-21-b=applied:0123abc", ...escalated]), [], "the -b escalate answers, wherever it sits");
+  // A mismatch on an older review does not answer a newer one.
+  const newer = run({ rows: [`#20 impl-20=PR#21 → PR#21 · reviewed=abc1234:2/0/0 · fix-pr-21=applied:def5678 · ${MISMATCH} · review=wf:x reviewed=fedcba9:0/1/0`] }, [pr(21)]);
+  assert.deepEqual(newer.fixDue, [], "the new review has no verdict and no survivors");
+  const rev = run({ rows: [`#20 impl-20=PR#21 → PR#21 · reviewed=abc1234:2/0/0 · fix-pr-21=applied:def5678 · ${MISMATCH} · review=wf:x`] }, [pr(21)]);
+  assert.deepEqual(rev.fixDue, [], "a review running on the PR holds it off");
+  assert.deepEqual(dueAt([MISMATCH], []), [], "a PR no longer open is nobody's work");
+});
+
+test("currentDispositions: escalate parses, and outranks mismatch which outranks ok at one retry suffix", () => {
+  assert.deepEqual(dispositionsToken("dispositions-escalate=fix-pr-21-b:abc1234")?.verdict, "escalate");
+  assert.equal(dispositionsToken("dispositions-escalate=finisher-pr-21:abc1234"), null);
+  const heads = (...s) => currentDispositions(s.map(dispositionsToken), "abc1234");
+  assert.deepEqual(heads("dispositions-ok=fix-pr-21:abc1234", "dispositions-escalate=fix-pr-21:abc1234"), { verdict: "escalate", member: "fix-pr-21" });
+  assert.deepEqual(heads("dispositions-escalate=fix-pr-21:abc1234", "dispositions-mismatch=fix-pr-21:abc1234"), { verdict: "escalate", member: "fix-pr-21" });
+  assert.deepEqual(heads("dispositions-escalate=fix-pr-21:abc1234", "dispositions-ok=fix-pr-21-b:abc1234"), { verdict: "ok", member: "fix-pr-21-b" });
+});
+
 test("deriveRun: a newer review's survivors are not offered beside a live fix-applier, and are due once it settles", () => {
   // `dispatch` would refuse a second live one. Settled, it was dispatched
   // before that review, so it never answered the newer survivors.

package/scripts/ledger-dispatch.test.mjs

@@ -783,6 +783,31 @@ test("the current verdict is the highest-suffixed fix-applier's, in either text
   assert.deepEqual(read().dispatched, ["finisher-pr-40=failed", "finisher-pr-40-b=failed"]);
 });
 
+test("a mismatch is retried by the next fix-applier suffix: ok from it ends the refusal, escalate from it never does", (t) => {
+  const { ok, read, refused } = fixture(t);
+  ok("row", "10", gateRow("1/0/0", `dispositions-mismatch=fix-pr-40:${GATE_HEAD}`));
+  refused(["dispatch", "40", "finisher-pr-40"], /dispositions mismatch/);
+  // The retry is dispatched under the next suffix; the first name is spent.
+  refused(["dispatch", "40", "fix-pr-40"], /fix-pr-40/);
+  ok("dispatch", "40", "fix-pr-40-b");
+  ok("settle", "fix-pr-40-b", `applied:${GATE_HEAD.slice(0, 7)}`);
+  // Settled with no verdict of its own: the earlier mismatch still stands.
+  refused(["dispatch", "40", "finisher-pr-40"], /dispositions mismatch — fix-pr-40's/);
+  ok("row", "10", gateRow("1/0/0", `dispositions-mismatch=fix-pr-40:${GATE_HEAD}`, `dispositions-ok=fix-pr-40-b:${GATE_HEAD}`, "fix-pr-40-b=applied:0123abc"));
+  assert.equal(ok("dispatch", "40", "finisher-pr-40").agent, "fleet-finisher");
+  assert.ok(read().dispatched.includes("finisher-pr-40"));
+  // Escalated instead: a finisher is refused naming it, whichever way the tokens sit.
+  ok("settle", "finisher-pr-40", "failed");
+  const escalated = [`dispositions-mismatch=fix-pr-40:${GATE_HEAD}`, `dispositions-escalate=fix-pr-40-b:${GATE_HEAD}`];
+  for (const tokens of [escalated, [...escalated].reverse()]) {
+    ok("row", "10", gateRow("1/0/0", ...tokens, "fix-pr-40-b=applied:0123abc"));
+    refused(["dispatch", "40", "finisher-pr-40-b"], /finisher-pr-40-b: dispositions escalate — fix-pr-40-b deferred/);
+  }
+  // A new review (a new head) starts the gate over: the old escalate answers nothing.
+  ok("row", "10", `impl-10=PR#40 → PR#40 · reviewed=${GATE_HEAD}:1/0/0 · ${escalated[1]} · review=wf:x reviewed=${OTHER_HEAD}:1/0/0`);
+  refused(["dispatch", "40", "finisher-pr-40-b"], /dispositions unchecked/);
+});
+
 test("a later fix-applier that writes no verdict neither satisfies nor resets the gate", (t) => {
   const { ok, refused } = fixture(t);
   // A conflict-hold fix-applier after the review one: no review file, no token.

package/scripts/ledger.mjs

@@ -1670,8 +1670,9 @@ function dispositionsRefusal(pr, review) {
   }
   if (v.verdict === "escalate") {
     return `dispositions escalate — ${v.member} deferred a finding above suggestion severity because its remedy lies outside the PR's diff, `
-      + `which needs a human's ruling: review ${review.head} gets no finisher and no retry; dispositions-check.mjs --member ${v.member} `
-      + "--scratch <scratch> names each escalated finding by bucket and index, for the PR comment that hands it to a human";
+      + "or its record drew a second mismatch on this review; either needs a human's ruling: "
+      + `review ${review.head} gets no finisher and no retry; dispositions-check.mjs --member ${v.member} `
+      + "--scratch <scratch> names each escalated finding or violating entry by bucket and index, for the PR comment that hands it to a human";
   }
   return null;
 }

package/skills/run-team/SKILL.md

@@ -1393,7 +1393,7 @@ for a token on a ticket's line — never a hand edit.
 |---|---|
 | Implementer report | `verify-sha.sh`; `ledger.mjs settle impl-<N>=PR#<M>`, or `=bailed` and relabel by cause (**Implementer bails before implementing**, below) |
 | Review workflow notification / `review-pr-<n>` report | write `<scratch>/review-<pr>.json`; `reviewed=<head>:<survived>/<refuted>/<unverified>` on the PR's row (**Reviewers**) |
-| Fix-applier report | `ledger.mjs settle fix-pr-<M>=…`; for a fix-applier that answered a review — not one that cleared a conflict hold, which has no review file — `~/.fleet/bin/fleet-run dispositions-check.mjs --member <that member> --scratch <scratch>`, from the checkout root: it judges `<scratch>/dispositions-<M>.json` against `<scratch>/review-<M>.json`, writes `dispositions-ok=`, `dispositions-mismatch=` or `dispositions-escalate=<member>:<head>` onto the PR's row itself, and exits 1 on a mismatch or an escalation, naming each violating or escalated entry's bucket and index, a violation its rule too (an escalation is then the gate paragraph's, below); copy the refutations it reversed — the record's `refuted` entries — to `ruled`; `ledger.mjs filed <N> "<subject>"` for each `unrecorded:` line |
+| Fix-applier report | `ledger.mjs settle fix-pr-<M>=…`; for a fix-applier that answered a review — not one that cleared a conflict hold, which has no review file — `~/.fleet/bin/fleet-run dispositions-check.mjs --member <that member> --scratch <scratch>`, from the checkout root: it judges `<scratch>/dispositions-<M>.json` against `<scratch>/review-<M>.json`, writes `dispositions-ok=`, `dispositions-mismatch=` or `dispositions-escalate=<member>:<head>` onto the PR's row itself, and exits 1 on a mismatch or an escalation, naming each violating or escalated entry's bucket and index, a violation its rule too — **Then dispatch a fix-applier** says what a mismatch asks of you, the gate paragraph below what an escalation does; copy the refutations it reversed — the record's `refuted` entries — to `ruled`; `ledger.mjs filed <N> "<subject>"` for each `unrecorded:` line |
 | Finisher report | `ledger.mjs settle finisher-pr-<M>=labelled` as reported, even when its read-back lacks `ready-to-merge` — the tick's `DISPATCH finisher PR#<M>` catches that next. A **repair** finisher's (one sent on that line) read-back lacking it also gets `gh pr comment <M>` with both finishers' read-backs: the one-shot escalation, where halts comment. `ledger.mjs filed <N> "<subject>"` for each `unrecorded:` line |
 | Finisher report (halted) | `ledger.mjs settle finisher-pr-<M>=halted:<cause>`; `gh pr comment <M>` with the finisher's halt report, cause and evidence; `ledger.mjs filed <N> "<subject>"` for each `unrecorded:` line; then the per-cause rule (**Resolving a finisher halt**, below) |
 | Label seen (persistent Monitor) | nothing to record |
@@ -1562,8 +1562,8 @@ depth** guard table applied in code. Act on each line as it reads:
   blind until it can.
 - `SUGGEST /triage, hold idle` — nothing is admissible after the refresh.
   Suggest, never run (**Queue depth**).
-- `DISPATCH fix-pr PR#<M> …` — a fix-applier per PR, for a review's survivors
-  or a merge bot's `conflict-hold:#<M>` (**Reviewers**). Printed
+- `DISPATCH fix-pr PR#<M> …` — a fix-applier per PR, for a review's survivors,
+  a dispositions mismatch no retry has answered, or a merge bot's `conflict-hold:#<M>` (**Reviewers**). Printed
   ahead of reviews on purpose: finishing what is started beats starting more.
 - `DISPATCH review PR#<M> …` — a review per PR, oldest first, off your turn
   (**Reviewers**).
@@ -2080,6 +2080,22 @@ is a review fix-applier, dispatched as above (#2328). The push moves the
 head after `ready-to-merge`, so the next merge bot refuses it
 `head-moved-after-label-#<M>`: a fresh finisher, per **Failure handling**.
 
+**A `DISPATCH fix-pr PR#<M>` on a dispositions mismatch** — the PR's row carries
+`dispositions-mismatch=<member>:<head>` for its latest review, and no later
+fix-applier has landed — is one automatic retry, a review fix-applier named the
+next suffix (`fix-pr-<M>-b`) and dispatched like the first. Its prompt is the
+first one's, with two paths and a list copied in: the review file
+`<scratch>/review-<M>.json`, the disposition record `<scratch>/dispositions-<M>.json`
+it rewrites, and the check's violation list **verbatim** — the lines
+`dispositions-check.mjs` printed, each naming a bucket, an index and a rule;
+re-run the check for the mismatched member to reprint them. It rewrites the
+record, and when it reports you run the check for it exactly as for the first
+one. `ok` ends it. A second failure on the same review is written as
+`dispositions-escalate=fix-pr-<M>-b:<head>` in place of a mismatch: the tick
+prints no `DISPATCH fix-pr` for it, `dispatch` refuses the finisher naming
+`dispositions escalate`, and you post the check's output with `gh pr comment <M>`
+and flag the PR for a human. A new review of the PR counts again from none.
+
 **A refutation resting on an injection nothing proved landed is not a refutation
 — it is a cell that never ran.** A mutation test and a finding reproduction are
 both failure injections: break something, read what the child does. When the
@@ -2428,14 +2444,16 @@ from the highest-suffixed fix-applier. A PR whose latest review counts
 `0/<n>/0` is not gated. The refusal names its cause. `dispositions
 unchecked` — no verdict answers that head: run `dispositions-check.mjs` for
 the fix-applier that answered the review, as the Fix-applier report edge
-states, then dispatch again. `dispositions mismatch` — no finisher: post the
-check's output, which names each violating entry, with `gh pr comment <M>`, and
-flag the PR for a human; re-running the check reprints it. `dispositions
-escalate` — no finisher, and no retry: a `critical` or `important` finding was
-deferred `remedy-outside-diff`, which only a human can rule on. Post the check's
-output, which names each escalated finding, with `gh pr comment <M>`, and flag
-the PR for a human; dispatch no fix-applier and no finisher for that review's
-head, and expect no `fix-due` row for it. **On any PR with a
+states, then dispatch again. `dispositions mismatch` — no finisher: the tick
+prints `DISPATCH fix-pr PR#<M>` for it, and the next-suffix fix-applier answers
+it (**Then dispatch a fix-applier**). `dispositions escalate` — no finisher, no
+retry and no further fix-applier: either a `critical` or `important` finding was
+deferred `remedy-outside-diff`, or a second mismatch was drawn on one review, and
+only a human can rule on either. Post the check's output, which names each
+escalated finding or violating entry, with `gh pr comment <M>`, and flag the PR
+for a human; re-running the check reprints it. Dispatch no fix-applier and no
+finisher for that review's head, and expect no `fix-due` row for it; a new
+review of the PR starts the check again. **On any PR with a
 returned review, `0/<n>/0` included, it refuses too while a fix-applier on the
 PR is still live, verdict or not** —
 `fix-pr-<M>[-x] still live`: settle it, run the check for it, then dispatch