@feigi/fleet-ctl 3.77.0 → 3.77.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@feigi/fleet-ctl",
-  "version": "3.77.0",
+  "version": "3.77.1",
   "description": "Agent fleet: run-team controller, merge bot, PR reviewer, and the ticket pipeline they share",
   "license": "Apache-2.0",
   "repository": {

package/scripts/metrics-refresh.mjs

@@ -16,6 +16,11 @@
 // rows the next drain finds already there, so a second run changes nothing.
 // A pending file that is empty, or blank lines only, is removed with its own
 // line: an append created it and never wrote.
+// The drain takes no lock by design: it assumes only the run's controller
+// appends to the pending file and drains it, serially, so nothing appends
+// between the read and either unlink. One controller per checkout is the
+// rule, but phase 0 refuses a second one at its ledger rotation, which runs
+// after its drain step, so a second controller's drain is not guarded.
 //
 // COST GUARD. `pr-cost.mjs --guard` rewrites `.fleet/cost-guard.json`, which
 // the router reads and fails closed without. It needs all three metrics TSVs;

package/scripts/ticket-router.mjs

@@ -601,6 +601,10 @@ function main() {
       issue: readJson(issuePath), sizing: readJson(F.arg("sizing")), guard: readGuard(readJson(guardPath)), table,
     });
     const pending = F.arg("pending") ?? join(dirname(guardPath), "ticket-features.pending.tsv");
+    // The header decision and the append are not atomic and take no lock. That is
+    // safe only while the run's controller is the only process that routes or
+    // drains on a checkout, doing both serially: one controller per checkout is
+    // the rule, and neither this append nor the drain checks it.
     try {
       mkdirSync(dirname(pending), { recursive: true });
       const header = statSync(pending, { throwIfNoEntry: false })?.size > 0 ? "" : `${COLUMNS.join("\t")}\n`;