@feigi/fleet-ctl 3.23.27 → 3.23.29

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@feigi/fleet-ctl",
-  "version": "3.23.27",
+  "version": "3.23.29",
   "description": "Agent fleet: run-team controller, merge bot, PR reviewer, and the ticket pipeline they share",
   "license": "Apache-2.0",
   "repository": {

package/scripts/cell-readout.mjs

@@ -42,10 +42,15 @@
 // with an admissible Pull at X dated on or after the day X's
 // `fleet-implementer-<cell>` definition was most recently added, ruled by its
 // last tier-outcomes.tsv row (a `+`-joined `ticket` field rules each ticket
-// it names); a ticket counts once however many Pulls it took. A verdict FAILS
+// it names) dated on or after the ticket's last such Pull: a ruling never
+// predates the Pull it rules, and a row with both verdict columns blank was
+// never ruled, so it is skipped. A ticket with no such row is no verdict.
+// A ticket counts once however many Pulls it took. A verdict FAILS
 // the quality floor on `minted_false_claim=yes` or `closed_own_ticket=no`; a
-// counted ruling holding anything but `yes` or `no` in either column, blank
-// included, is refused rather than read as a pass.
+// counted ruling holding anything but `yes` or `no` in either column, one
+// blank included, is refused rather than read as a pass. So is a non-blank
+// ruling row of such a ticket whose `run_date` is not `YYYY-MM-DD`: it cannot
+// be placed against the Pull, and dropping it would uncount the ticket.
 // X is to be withdrawn once it has at least STOP.verdicts verdicts and
 // floor failures ÷ verdicts is at least STOP.failRate.
 //
@@ -60,6 +65,8 @@ import { parseTsv as parseMemberTsv } from "./member-outcomes.mjs";
 import { parseFeatures } from "./pr-cost.mjs";
 import { VERDICT, VERDICT_COLUMNS } from "./tier-outcomes.mjs";
 
+const ISO_DATE = /^\d{4}-\d{2}-\d{2}$/;
+
 const NAME = "cell-readout";
 export const GATE = Object.freeze({ comparisons: 10, runDates: 5 });
 export const STOP = Object.freeze({ verdicts: 10, failRate: 0.8 });
@@ -126,28 +133,42 @@ export function readout({ features, members }) {
  * sorted by ticket, `run_date` the ruling's; `stop` is whether the stopping
  * rule withdraws the cell. `verdicts` are parsed tier-outcomes.tsv rows.
  * Throws on a counted ruling whose `closed_own_ticket` or `minted_false_claim`
- * is not `yes` or `no`.
+ * is not `yes` or `no`, and on a non-blank ruling row of a Pulled ticket whose
+ * `run_date` is not `YYYY-MM-DD`.
  */
 export function stoppingRule({ features, members, verdicts, added }) {
   const byKey = new Map(members.map((m) => [key(m.session, m.agent), m]));
-  const ruling = new Map();
-  for (const v of verdicts) for (const t of String(v.ticket).split("+")) ruling.set(t, v);
-  const judged = new Map(Object.keys(added).filter((c) => c !== POLICY_CELL).map((c) => [c, new Map()]));
+  const rulings = new Map();
+  for (const v of verdicts) {
+    if (VERDICT_COLUMNS.every((c) => v[c] === "")) continue;
+    for (const t of String(v.ticket).split("+")) (rulings.get(t) ?? rulings.set(t, []).get(t)).push(v);
+  }
+  // Per cell, each ticket's last admissible Pull: the one its ruling must follow.
+  const charged = new Map(Object.keys(added).filter((c) => c !== POLICY_CELL).map((c) => [c, new Map()]));
   for (const p of features) {
-    const tickets = judged.get(p.chosen_cell);
-    if (!tickets || p.run_date < added[p.chosen_cell] || !ruling.has(p.ticket) || !admissibleMember(p, byKey)) continue;
-    const v = ruling.get(p.ticket);
-    for (const c of VERDICT_COLUMNS) {
-      if (!VERDICT.includes(v[c])) throw new Error(`ticket #${p.ticket} (PR #${v.pr}): ${c} is '${v[c]}', expected yes or no`);
-    }
-    const failed = v.minted_false_claim === "yes" || v.closed_own_ticket === "no";
-    tickets.set(p.ticket, {
-      ticket: p.ticket, pr: v.pr, run_date: v.run_date,
-      closed_own_ticket: v.closed_own_ticket, minted_false_claim: v.minted_false_claim, failed,
-    });
+    const pulls = charged.get(p.chosen_cell);
+    if (!pulls || p.run_date < added[p.chosen_cell] || !admissibleMember(p, byKey)) continue;
+    pulls.set(p.ticket, p);
   }
-  return [...judged].sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0)).map(([cell, tickets]) => {
-    const list = [...tickets.values()].sort((a, b) => Number(a.ticket) - Number(b.ticket));
+  return [...charged].sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0)).map(([cell, pulls]) => {
+    const list = [];
+    for (const p of pulls.values()) {
+      const own = rulings.get(p.ticket) ?? [];
+      for (const r of own) {
+        if (!ISO_DATE.test(r.run_date)) throw new Error(`ticket #${p.ticket} (PR #${r.pr}): run_date is '${r.run_date}', expected YYYY-MM-DD`);
+      }
+      const v = own.findLast((r) => r.run_date >= p.run_date);
+      if (!v) continue;
+      for (const c of VERDICT_COLUMNS) {
+        if (!VERDICT.includes(v[c])) throw new Error(`ticket #${p.ticket} (PR #${v.pr}): ${c} is '${v[c]}', expected yes or no`);
+      }
+      list.push({
+        ticket: p.ticket, pr: v.pr, run_date: v.run_date,
+        closed_own_ticket: v.closed_own_ticket, minted_false_claim: v.minted_false_claim,
+        failed: v.minted_false_claim === "yes" || v.closed_own_ticket === "no",
+      });
+    }
+    list.sort((a, b) => Number(a.ticket) - Number(b.ticket));
     const failures = list.filter((v) => v.failed).length;
     const stop = list.length >= STOP.verdicts && failures / list.length >= STOP.failRate;
     return { cell, since: added[cell], verdicts: list, failures, stop };

package/scripts/cell-readout.test.mjs

@@ -469,3 +469,112 @@ test("stopping rule: a malformed ruling on a ticket with no counted Pull is not
   assert.equal(at.verdicts.length, 4);
   assert.deepEqual(at.verdicts.map((v) => v.failed), [false, true, true, true]);
 });
+
+// ---------------------------------------------------------------------------
+// Which ruling is a Pull's: the last row dated on or after the Pull, a
+// both-blank (never ruled) row skipped.
+
+// A second admissible Pull of an existing ticket at smol-high, in its own session.
+function rePull(w, ticket, date) {
+  const session = `2026-10-02T00-00-00-000Z_v${nextSession++}`;
+  const agent = `impl-${ticket}-re`;
+  w.features.push(pull({ session, agent, ticket, chosen_cell: "smol-high", run_date: date }));
+  w.members.push(member({
+    session, agent, run_date: date, ticket, model: "claude-sonnet-5",
+    effort: "high", subagentType: "fleet-implementer-smol-high",
+  }));
+}
+
+test("stopping rule: a ruling dated before its Pull does not rule it, so only pre-Pull rulings leave the cell with no verdicts; one dated the Pull's own day does", () => {
+  const added = { "smol-high": "2026-10-02" };
+  const stale = world();
+  addVerdicts(stale, "smol-high", 10, 0, { date: "2026-10-05" });
+  for (const v of stale.verdicts) Object.assign(v, { run_date: "2026-09-17", closed_own_ticket: "no" });
+  const at = judged(stale, added, "smol-high");
+  assert.deepEqual(at.verdicts, []);
+  assert.equal(at.failures, 0);
+  assert.equal(at.stop, false);
+
+  const sameDay = world();
+  addVerdicts(sameDay, "smol-high", 10, 0, { date: "2026-10-05" });
+  for (const v of sameDay.verdicts) Object.assign(v, { run_date: "2026-10-05", closed_own_ticket: "no" });
+  const day = judged(sameDay, added, "smol-high");
+  assert.equal(day.verdicts.length, 10, "a ruling landing the same day as its Pull rules it");
+  assert.equal(day.failures, 10);
+  assert.equal(day.stop, true);
+});
+
+test("stopping rule: a re-Pulled ticket is charged with the ruling after its last Pull at the cell, in either corpus order, and with none while that Pull is unruled", () => {
+  const added = { "smol-high": "2026-09-01" };
+  // Pulled 2026-10-02 and ruled 2026-10-03 failing the floor, then re-Pulled 2026-10-05.
+  const build = () => {
+    const w = world();
+    addVerdicts(w, "smol-high", 1, 1);
+    rePull(w, w.features[0].ticket, "2026-10-05");
+    return w;
+  };
+  const unruled = build();
+  const { ticket } = unruled.features[0];
+  assert.deepEqual(judged(unruled, added, "smol-high").verdicts, [], "the earlier ruling predates the re-Pull");
+
+  const later = build();
+  later.verdicts.push(verdict({ ticket, pr: "9002", run_date: "2026-10-06" }));
+  const charged = judged(later, added, "smol-high").verdicts;
+  assert.deepEqual(charged.map((v) => [v.ticket, v.pr, v.run_date, v.failed]), [[ticket, "9002", "2026-10-06", false]]);
+
+  // The stale row appended after the later one, as a backfill would land it.
+  const backfilled = build();
+  backfilled.verdicts.unshift(verdict({ ticket, pr: "9002", run_date: "2026-10-06" }));
+  assert.deepEqual(judged(backfilled, added, "smol-high").verdicts.map((v) => v.pr), ["9002"]);
+});
+
+test("stopping rule: a both-blank row was never ruled: after a real ruling it does not hide it, and a ticket whose only row it is stays uncounted", () => {
+  const w = world();
+  addVerdicts(w, "smol-high", 2, 2);
+  const [real, blank] = w.features.map((p) => p.ticket);
+  w.verdicts.push(verdict({ ticket: real, pr: "1392", run_date: "2026-10-04", closed_own_ticket: "", minted_false_claim: "" }));
+  Object.assign(w.verdicts.find((v) => v.ticket === blank), { closed_own_ticket: "", minted_false_claim: "" });
+  const at = judged(w, { "smol-high": "2026-09-01" }, "smol-high");
+  assert.deepEqual(at.verdicts.map((v) => [v.ticket, v.pr, v.failed]), [[real, String(Number(real) + 5000), true]]);
+});
+
+// What the both-blank skip must NOT accept: a row with one verdict blank is a
+// ruling written half, so selected it is still refused.
+test("stopping rule: a half-blank row after a real ruling is the ticket's ruling and is refused", () => {
+  for (const [col, other] of [["closed_own_ticket", "minted_false_claim"], ["minted_false_claim", "closed_own_ticket"]]) {
+    const w = world();
+    addVerdicts(w, "smol-high", 1, 0);
+    const { ticket } = w.features[0];
+    w.verdicts.push(verdict({ ticket, pr: "1393", run_date: "2026-10-04", [col]: "", [other]: "no" }));
+    assert.throws(() => judged(w, { "smol-high": "2026-09-01" }, "smol-high"),
+      new RegExp(`ticket #${ticket} \\(PR #1393\\): ${col} is '', expected yes or no`), col);
+  }
+});
+
+// A filled ruling whose date cannot be placed against its Pull must not
+// vanish: dropped, its ticket is uncounted and a floor failure goes unreported.
+test("stopping rule: a filled ruling with a blank or malformed run_date is refused, naming the ticket", () => {
+  for (const bad of ["", "10/03/2026", "2026-10-3"]) {
+    const w = world();
+    addVerdicts(w, "smol-high", 1, 0);
+    const [{ ticket }] = w.features;
+    w.verdicts[0].run_date = bad;
+    assert.throws(
+      () => judged(w, { "smol-high": "2026-09-01" }, "smol-high"),
+      new RegExp(`ticket #${ticket} \\(PR #${w.verdicts[0].pr}\\): run_date is '${bad}', expected YYYY-MM-DD`),
+      JSON.stringify(bad),
+    );
+  }
+});
+
+// What that refusal must NOT touch: a never-ruled row has no date to place,
+// and a ticket no live cell's Pull names is not a verdict candidate.
+test("stopping rule: a both-blank row or an unPulled ticket's row needs no run_date", () => {
+  const w = world();
+  addVerdicts(w, "smol-high", 2, 0);
+  const [real, blank] = w.features.map((p) => p.ticket);
+  Object.assign(w.verdicts.find((v) => v.ticket === blank), { closed_own_ticket: "", minted_false_claim: "", run_date: "" });
+  w.verdicts.push(verdict({ ticket: "999", pr: "1", run_date: "n/a" }));
+  const at = judged(w, { "smol-high": "2026-09-01" }, "smol-high");
+  assert.deepEqual(at.verdicts.map((v) => v.ticket), [real]);
+});

package/scripts/recipe-prove.mjs

@@ -57,10 +57,11 @@
 //         repository, origin/main missing, the worktree could not be made), or
 //         a git or filesystem fault stopped it before the cache was settled
 //         (a git command could not be started, the reader's own git
-//         included; the reader's `sh`, `node`, `mktemp` or `cat` could not be
-//         started, or its `node` died mid-read — a `cat` that ran and failed
-//         stays the reader's refusal, exit 1; the cache or its temp file
-//         could not be written). The log directory under $TMPDIR is removed.
+//         included, or that git started and could not run; the reader's `sh`,
+//         `node`, `mktemp` or `cat` could not be started, or its `node` died
+//         mid-read — a `cat` that ran and failed stays the reader's refusal,
+//         exit 1; the cache or its temp file could not be written). The log
+//         directory under $TMPDIR is removed.
 
 import { spawnSync } from "node:child_process";
 import { closeSync, existsSync, mkdirSync, mkdtempSync, openSync, readFileSync, renameSync, rmSync, unlinkSync, writeFileSync } from "node:fs";
@@ -287,9 +288,12 @@ function prove(o, wt, logs) {
 // cache is undone just the same when the read-back is no verdict: an `sh` that
 // could not be started read nothing; a reader that exits READER_COULD_NOT_RUN
 // could not start its `node`, `mktemp` or `cat`, or lost its `node` mid-read;
-// and the reader runs git itself and reads a git that will not start as no
+// and the reader runs git itself and reads a git that will not run as no
 // repository at all, so its refusal is a verdict on what was proven only while
-// git still starts.
+// git still runs. `git --version` is the probe: a working git always passes
+// it, so a git that cannot be started fails it, and so does one that starts
+// and cannot run — a wrapper whose target is gone exits 126 or 127, a killed
+// git has no exit status at all.
 function writeCache(cache, recipe, repo) {
   mkdirSync(dirname(cache), { recursive: true });
   const prior = existsSync(cache) ? readFileSync(cache) : null;
@@ -308,12 +312,15 @@ function writeCache(cache, recipe, repo) {
     else writeFileSync(cache, prior);
     if (r.error && !r.pid) throw cannot(`could not start sh to read the Recipe cache back: ${r.error.message}`);
     if (r.status === READER_COULD_NOT_RUN) throw cannot(`${r.stderr.trim()} — the Recipe cache reader could not run a tool it needs, so its refusal is no verdict on what was proven`);
+    const noVerdict = (why) => cannot(`${why} — the Recipe cache reader runs git, so its refusal is no verdict on what was proven`);
+    let probe;
     try {
-      git(["--version"]);
+      probe = git(["--version"]);
     } catch (e) {
       if (!(e instanceof Refusal)) throw e;
-      throw cannot(`${e.message} — the Recipe cache reader runs git, so its refusal is no verdict on what was proven`);
+      throw noVerdict(e.message);
     }
+    if (!probe.ok) throw noVerdict(`git started but does not run: \`git --version\` did not exit 0${probe.err ? `: ${probe.err}` : " and wrote nothing to stderr"}`);
     throw notProven(`the Recipe cache reader refuses what was proven: ${(r.stderr || r.stdout).trim()}`);
   }
 }

package/scripts/recipe-prove.test.mjs

@@ -665,6 +665,35 @@ test("a git that stops starting before the cache is read back is no verdict, nev
   assert.equal(readFileSync(cachePath(dir), "utf8"), "prior bytes", "a cache the reader never settled is rolled back");
 });
 
+// A git that starts and cannot run fails the reader's own `git rev-parse` just
+// as a git that will not start does, so its refusal is no verdict either. Each
+// stub stands in for one such git: a wrapper whose target is gone exits 126 or
+// 127, and a killed git has no exit status at all. The stubs differ in what
+// they write to stderr, which the message quotes when there is anything to
+// quote. The control — the same PATH with git left in place proves — is the
+// unstartable-git test's. The Test entrypoint rewrites the stub's body, never
+// the stub: that is a hard link to exec-stub.mjs's shared, read-only
+// trampoline.
+const GIT_THAT_CANNOT_RUN = [
+  { name: "exits 126 and writes nothing", body: "exit 126", cause: " and wrote nothing to stderr" },
+  { name: "exits 127 and writes to stderr", body: "echo boom >&2; exit 127", cause: ": boom" },
+  { name: "is killed by a signal", body: "kill -9 $$", cause: ": git was killed by SIGKILL" },
+];
+for (const c of GIT_THAT_CANNOT_RUN) {
+  test(`a git that starts but ${c.name} before the cache is read back is no verdict, never NOT PROVEN — and the prior cache is restored`, () => {
+    const { dir } = repo(MAVEN_FILES);
+    mkdirSync(join(dir, ".fleet"));
+    writeFileSync(cachePath(dir), "prior bytes");
+    const bin = readerPath();
+    const r = prove(dir, ["--install", "true", "--test", `printf '#!/bin/sh\\n${c.body}\\n' > '${join(bin, ".stub-git")}'; echo 'tests 1'`, "--count-line", "tests 1", "--test-count", "1"], { env: { PATH: bin } });
+    assert.equal(r.status, 2, r.err);
+    assert.ok(r.err.includes(`recipe-prove: git started but does not run: \`git --version\` did not exit 0${c.cause} — the Recipe cache reader runs git, so its refusal is no verdict on what was proven`), r.err);
+    assert.doesNotMatch(r.err, /NOT PROVEN/);
+    assert.doesNotMatch(r.err, /not a git repository/);
+    assert.equal(readFileSync(cachePath(dir), "utf8"), "prior bytes", "a cache the reader never settled is rolled back");
+  });
+}
+
 // The reader's own `sh`, taken away the same way: a read-back that never ran
 // read nothing, so it is no verdict either.
 test("an sh that stops starting before the cache is read back is no verdict, never NOT PROVEN — and no cache is left", () => {

package/scripts/run-team-local-hook.test.mjs

@@ -352,6 +352,16 @@ test("close-out: a gh that prints something other than JSON fails the duty namin
   assert.match(r.stderr, /stopping rule failed: gh issue list printed non-JSON \(.*\): "<html>rate limited<\/html>"$/m);
 });
 
+test("close-out --dry-run: a both-blank tier-outcomes row after a ticket's real ruling leaves the count as it was, and the router fit still runs", () => {
+  const rows = floorFailing();
+  rows.tiers.push(tier({ ticket: "100", pr: "1392", closed_own_ticket: "", minted_false_claim: "" }));
+  const f = fixture({ rows });
+  const r = f.run("close-out", ["--dry-run"]);
+  assert.equal(r.status, 0, r.stderr);
+  assert.match(r.stdout, new RegExp(`stopping rule: smol-high 8/10 floor failures since 2026-09-01 — would file "${escape(TITLE)}"`));
+  assert.match(r.stdout, /^run-team-local: router fit: /m);
+});
+
 // ---------------------------------------------------------------------------
 // close-out: the router re-fit cadence