@llm4ts/flow 2.30.1 → 2.31.1

package/src/Review.ts

@@ -1,16 +1,26 @@
 import { join } from "node:path"
 import * as Clock from "effect/Clock"
+import * as Duration from "effect/Duration"
 import * as Effect from "effect/Effect"
+import * as Ref from "effect/Ref"
 import * as Schema from "effect/Schema"
 import type { LlmError } from "@llm4ts/core/Errors"
 import type { LlmServiceShape } from "@llm4ts/core/LlmService"
 import type { JsonSchema } from "@llm4ts/core/Models"
-import type { ProcessExecutorShape } from "@llm4ts/core/ProcessExecutor"
+import type { ProcessExecutorShape, ProcessResult } from "@llm4ts/core/ProcessExecutor"
 import { Capabilities } from "@llm4ts/core/Capability"
 import { guarded } from "./CapabilityGuard.ts"
 import type { Chat } from "./Chat.ts"
 import { FlowLlmError, ProcessError, describeFlowError, type FlowError } from "./FlowError.ts"
 import type { PlainFileStoreShape } from "./Persistence.ts"
+import { GateBaseline, isGateIssue, triageGates } from "./GateTriage.ts"
+import {
+  type OracleRules,
+  checkOracle,
+  defaultOracleRules,
+  parseUnifiedDiff,
+  passedCountIn
+} from "./OracleGuard.ts"
 import { cachedReview, fingerprintOf } from "./ReviewCache.ts"
 import {
   Info,
@@ -51,7 +61,13 @@ export class ReviewIssue extends Schema.Class<ReviewIssue>("ReviewIssue")({
   confidence: Schema.Number.pipe(
     Schema.withConstructorDefault(Effect.succeed(1)),
     Schema.withDecodingDefaultKey(Effect.succeed(1))
-  )
+  ),
+  /** A gate failure's triage against the base (ADR 0027); absent for review findings. */
+  origin: Schema.optionalKey(Schema.Literals(["new", "base", "flaky"])),
+  /** How a gate ended: a red exit, killed at the timeout, or a signal exit. */
+  gateClass: Schema.optionalKey(Schema.Literals(["red", "hang", "crash"])),
+  /** Where the gate's full output was written, when the caller asked for a log. */
+  logPath: Schema.optionalKey(Schema.String)
 }) {}
 
 export class ReviewResult extends Schema.Class<ReviewResult>("ReviewResult")({
@@ -59,7 +75,9 @@ export class ReviewResult extends Schema.Class<ReviewResult>("ReviewResult")({
   summary: Schema.String.pipe(
     Schema.withConstructorDefault(Effect.succeed("")),
     Schema.withDecodingDefaultKey(Effect.succeed(""))
-  )
+  ),
+  /** A test gate's passed-test count, when its output had a summary the oracle guard reads (ADR 0027). */
+  passed: Schema.optionalKey(Schema.Int)
 }) {
   get isClean(): boolean {
     return this.issues.length === 0
@@ -241,20 +259,165 @@ export const reviewPrompt = (task: string, diff: string): string =>
     diff
   ].join("\n")
 
-export const fixPrompt = (result: ReviewResult): string =>
-  [
+export interface FixPromptOptions {
+  /** Characters of a gate's output kept in the prompt, from the end. Default 4000. */
+  readonly tailChars?: number
+  /** Name the gate log's path (a CLI coder can open it; an API coder cannot). Default false. */
+  readonly showPaths?: boolean
+}
+
+export const defaultGateTailChars = 4_000
+
+const evidenceNote =
+  "The gate output above is your only runtime evidence. If you are guessing without it, say `confidence: low` in your Findings."
+
+export const fixPrompt = (result: ReviewResult, options: FixPromptOptions = {}): string => {
+  const tailChars = options.tailChars ?? defaultGateTailChars
+  const lines = result.issues.map((issue) => {
+    const gate = isGateIssue(issue)
+    const description =
+      gate && issue.description.length > tailChars
+        ? `…${issue.description.slice(-tailChars)}`
+        : issue.description
+    const path =
+      gate && options.showPaths === true && issue.logPath !== undefined
+        ? ` (full output: ${issue.logPath})`
+        : ""
+    return `- [${issue.severity}] ${issue.title}: ${description}${path}`
+  })
+  const hasGate = result.issues.some(isGateIssue)
+  return [
     "Address these review findings, then stop:",
-    ...result.issues.map((issue) => `- [${issue.severity}] ${issue.title}: ${issue.description}`)
+    ...lines,
+    ...(hasGate ? ["", evidenceNote] : [])
   ].join("\n")
+}
+
+export interface GateTriageOptions {
+  /** The baseline for the code this change started from; `undefined` means no triage. */
+  readonly baseline: Effect.Effect<GateBaseline | undefined, FlowError>
+  /** Root prefixes stripped from gate output before comparing (the work dir, the app dir). */
+  readonly roots: ReadonlyArray<string>
+  /** Re-run the test gate alone to tell a flaky line from a new one; omit to never rerun. */
+  readonly rerunTest?: Effect.Effect<ReviewResult, FlowError>
+}
+
+const listed = (lines: ReadonlyArray<string>): string => lines.map((line) => `  ${line}`).join("\n")
+
+export interface OracleGateOptions {
+  /** The change under review as a unified diff (committed and uncommitted). */
+  readonly diff: Effect.Effect<string, FlowError>
+  readonly rules?: OracleRules
+  /** The plan entry says tests may change (`testsChange: true`); the guard then stays silent. */
+  readonly declared?: boolean
+  /** Tests passing on the base, from its baseline; omitted or `undefined` skips the count check. */
+  readonly baseCount?: Effect.Effect<number | undefined, FlowError>
+}
+
+/**
+ * The oracle guard (ADR 0027 decision 4) joined to a lint result: deleted
+ * test files, added skip or focus markers and a passed-count drop become
+ * Critical issues the fix round can undo. When a count is unknown on either
+ * side the comparison is skipped and said once.
+ */
+export const withOracle = Effect.fn("@llm4ts/flow/Review.withOracle")(function* (
+  lint: ReviewResult,
+  oracle: OracleGateOptions | undefined,
+  events: FlowEventsShape,
+  noted: Ref.Ref<boolean>
+): Effect.fn.Return<ReviewResult, FlowError> {
+  if (oracle === undefined || oracle.declared === true) {
+    return lint
+  }
+  const diff = yield* oracle.diff
+  const base = oracle.baseCount === undefined ? undefined : yield* oracle.baseCount
+  if ((base === undefined || lint.passed === undefined) && !(yield* Ref.get(noted))) {
+    yield* Ref.set(noted, true)
+    yield* events.publish(
+      Info.make({
+        message:
+          "oracle guard: no passed-test count on the base or the change (no summary line the guard reads), count comparison skipped"
+      })
+    )
+  }
+  const issues = checkOracle(
+    parseUnifiedDiff(diff),
+    { base, current: lint.passed },
+    oracle.rules ?? defaultOracleRules,
+    false
+  )
+  return issues.length === 0
+    ? lint
+    : ReviewResult.make({
+        issues: [...lint.issues, ...issues],
+        summary: [lint.summary, "oracle guard"].filter((part) => part.length > 0).join("; "),
+        ...(lint.passed === undefined ? {} : { passed: lint.passed })
+      })
+})
 
-export const mergeReviewResults = (results: ReadonlyArray<ReviewResult>): ReviewResult =>
-  ReviewResult.make({
+/**
+ * Charges a lint result only with what the change caused (ADR 0027).
+ * Inherited lines are published once per `reported` set as Info; with
+ * `rerunTest`, a new line that is green on one rerun of the test gate is
+ * flaky: published, not charged. Without options or a baseline the result
+ * is returned as is.
+ */
+export const applyTriage = Effect.fn("@llm4ts/flow/Review.applyTriage")(function* (
+  lint: ReviewResult,
+  triage: GateTriageOptions | undefined,
+  events: FlowEventsShape,
+  reported: Ref.Ref<ReadonlySet<string>>
+): Effect.fn.Return<ReviewResult, FlowError> {
+  if (triage === undefined || lint.isClean) {
+    return lint
+  }
+  const baseline = yield* triage.baseline
+  if (baseline === undefined) {
+    return lint
+  }
+  let triaged = triageGates(lint, baseline, triage.roots)
+  const seen = yield* Ref.get(reported)
+  const unseen = triaged.inherited.filter((line) => !seen.has(line))
+  if (unseen.length > 0) {
+    yield* Ref.update(reported, (set) => new Set([...set, ...unseen]))
+    yield* events.publish(
+      Info.make({
+        message: `${unseen.length} gate failure(s) inherited from the base, not charged to this change:\n${listed(unseen)}`
+      })
+    )
+  }
+  if (!triaged.blocking.isClean && triaged.newLines.length > 0 && triage.rerunTest !== undefined) {
+    const again = yield* triage.rerunTest
+    const stillRed = new Set(triageGates(again, baseline, triage.roots).newLines)
+    const flaky = triaged.newLines.filter((line) => !stillRed.has(line))
+    if (flaky.length > 0) {
+      yield* events.publish(
+        Info.make({
+          message: `${flaky.length} gate failure(s) flaky (red once, green on rerun), not charged:\n${listed(flaky)}`
+        })
+      )
+      triaged = triageGates(
+        again,
+        GateBaseline.make({ ...baseline, failingLines: [...baseline.failingLines, ...flaky] }),
+        triage.roots
+      )
+    }
+  }
+  return triaged.blocking
+})
+
+export const mergeReviewResults = (results: ReadonlyArray<ReviewResult>): ReviewResult => {
+  const counts = results.flatMap((result) => (result.passed === undefined ? [] : [result.passed]))
+  return ReviewResult.make({
     issues: results.flatMap((result) => result.issues),
     summary: results
       .map((result) => result.summary)
       .filter((summary) => summary.length > 0)
-      .join("; ")
+      .join("; "),
+    // Several gates may count tests (unit and e2e): the sum is what the change must keep.
+    ...(counts.length === 0 ? {} : { passed: counts.reduce((sum, value) => sum + value, 0) })
   })
+}
 
 const processProblem = (
   stdout: ReadonlyArray<string>,
@@ -265,57 +428,107 @@ const processProblem = (
   return detail.length === 0 ? `process exited with code ${exitCode}` : detail
 }
 
+export interface LintCommandOptions {
+  /** Kill the gate after this long; the issue is then `gateClass: "hang"`. Default: never. */
+  readonly timeout?: Duration.Duration
+  /** Write the gate's whole stdout and stderr here; the issue carries `logPath`. */
+  readonly log?: { readonly files: PlainFileStoreShape; readonly path: string }
+}
+
+const gateClassOf = (exitCode: number): "red" | "crash" => (exitCode >= 128 ? "crash" : "red")
+
 export const lintCommand = Effect.fn("@llm4ts/flow/Review.lintCommand")(function* (
   process: ProcessExecutorShape,
   events: FlowEventsShape,
   command: ReadonlyArray<string>,
-  workDir: string
+  workDir: string,
+  options: LintCommandOptions = {}
 ): Effect.fn.Return<ReviewResult, FlowError> {
   const executable = command[0]
   if (executable === undefined) {
     return ReviewResult.make({ issues: [], summary: "" })
   }
+  const label = command.join(" ")
   const started = yield* Clock.currentTimeMillis
+  const run = guarded(
+    Capabilities.Exec(executable),
+    `lint: ${label}`,
+    events,
+    process.run(command, workDir, {}).pipe(
+      Effect.mapError((cause) =>
+        ProcessError.make({
+          message: label,
+          detail: cause.message
+        })
+      )
+    )
+  )
+  // Interrupting `run` interrupts the child through the executor's scope;
+  // `undefined` here means the gate never exited (ADR 0027: a hang is a
+  // gate failure that says so, never a stuck run).
+  const bounded: Effect.Effect<ProcessResult | undefined, FlowError> =
+    options.timeout === undefined
+      ? run
+      : run.pipe(
+          Effect.timeoutOption(options.timeout),
+          Effect.map((option) => (option._tag === "Some" ? option.value : undefined))
+        )
   // A TOOL span (ADR 0026) and a Timed event: the command as configured and
   // its exit code, never its output.
   const result = yield* withKindSpan(
-    `gate ${command.join(" ")}`,
-    { kind: "TOOL", attributes: { [attr.gateCommand]: command.join(" ") } },
-    guarded(
-      Capabilities.Exec(executable),
-      `lint: ${command.join(" ")}`,
-      events,
-      process.run(command, workDir, {}).pipe(
-        Effect.mapError((cause) =>
-          ProcessError.make({
-            message: command.join(" "),
-            detail: cause.message
-          })
-        )
+    `gate ${label}`,
+    { kind: "TOOL", attributes: { [attr.gateCommand]: label } },
+    bounded.pipe(
+      Effect.tap((ran) =>
+        ran === undefined ? Effect.void : Effect.annotateCurrentSpan(attr.gateExit, ran.exitCode)
       )
-    ).pipe(Effect.tap((ran) => Effect.annotateCurrentSpan(attr.gateExit, ran.exitCode)))
+    )
   )
+  const failed = result === undefined || result.exitCode !== 0
   yield* events.publish(
     Timed.make({
       kind: "gate",
-      label: command.join(" "),
+      label,
       ms: (yield* Clock.currentTimeMillis) - started,
-      exitCode: result.exitCode,
-      ...(result.exitCode === 0 ? {} : { failed: true })
+      ...(result === undefined ? {} : { exitCode: result.exitCode }),
+      ...(failed ? { failed: true } : {})
     })
   )
-  if (result.exitCode === 0) {
-    return ReviewResult.make({ issues: [], summary: "lint passed" })
+  let logPath: string | undefined
+  if (options.log !== undefined) {
+    const output =
+      result === undefined ? "" : [...result.stdout, ...result.stderr].join("\n").trim()
+    yield* options.log.files.writeAtomic(options.log.path, output)
+    logPath = options.log.path
   }
+  const passed =
+    result === undefined
+      ? undefined
+      : passedCountIn([...result.stdout, ...result.stderr].join("\n"))
+  if (result !== undefined && result.exitCode === 0) {
+    return ReviewResult.make({
+      issues: [],
+      summary: "lint passed",
+      ...(passed === undefined ? {} : { passed })
+    })
+  }
+  const seconds =
+    options.timeout === undefined ? 0 : Math.round(Duration.toSeconds(options.timeout))
   return ReviewResult.make({
     issues: [
       ReviewIssue.make({
         severity: "Critical",
-        title: `lint failed: ${command.join(" ")}`,
-        description: processProblem(result.stdout, result.stderr, result.exitCode)
+        title: `lint failed: ${label}`,
+        description:
+          result === undefined
+            ? `gate killed: no exit after ${seconds} seconds (LLM4TS_GATE_TIMEOUT)`
+            : processProblem(result.stdout, result.stderr, result.exitCode),
+        gateClass: result === undefined ? "hang" : gateClassOf(result.exitCode),
+        ...(logPath === undefined ? {} : { logPath })
       })
     ],
-    summary: "lint failed"
+    summary: "lint failed",
+    ...(passed === undefined ? {} : { passed })
   })
 })
 
@@ -350,6 +563,12 @@ export interface ReviewAndFixOptions {
     result: ReviewResult,
     settled: boolean
   ) => Effect.Effect<void, FlowError>
+  /** Charge the lint gate only with failures the change caused (ADR 0027). */
+  readonly triage?: GateTriageOptions
+  /** How gate output reaches the coder in the fix prompt. */
+  readonly fix?: FixPromptOptions
+  /** Fail the round when the change deletes or skips tests (ADR 0027 decision 4). */
+  readonly oracle?: OracleGateOptions
 }
 
 export interface ReviewCacheLocation {
@@ -493,13 +712,21 @@ export const reviewAndFixLoop = Effect.fn("@llm4ts/flow/Review.reviewAndFixLoop"
     )
   )
   const format = options.format ?? Effect.void
+  const reported = yield* Ref.make<ReadonlySet<string>>(new Set())
+  const oracleNoted = yield* Ref.make(false)
 
   const reviewOnce = (
     round: number,
     previous: ReviewResult | undefined
   ): Effect.Effect<ReviewResult, FlowError> =>
     Effect.gen(function* () {
-      const lint = yield* options.lint ?? Effect.succeed(ReviewResult.make({ issues: [] }))
+      const lintRaw = yield* options.lint ?? Effect.succeed(ReviewResult.make({ issues: [] }))
+      const lint = yield* withOracle(
+        yield* applyTriage(lintRaw, options.triage, options.events, reported),
+        options.oracle,
+        options.events,
+        oracleNoted
+      )
       if (!lint.isClean) {
         return lint
       }
@@ -585,7 +812,7 @@ export const reviewAndFixLoop = Effect.fn("@llm4ts/flow/Review.reviewAndFixLoop"
       if (settled) {
         return result
       }
-      yield* options.coder.ask(fixPrompt(result))
+      yield* options.coder.ask(fixPrompt(result, options.fix))
       return yield* loop(round + 1, result)
     })
 

package/src/Roster.ts

@@ -63,7 +63,9 @@ export class ExecutorSpec extends Schema.Class<ExecutorSpec>("ExecutorSpec")({
   health: Schema.optionalKey(Schema.String),
   cooldown: Schema.optionalKey(Cooldown),
   /** In a repository roster: removes the user roster's entry with this id. */
-  disabled: Schema.optionalKey(Schema.Boolean)
+  disabled: Schema.optionalKey(Schema.Boolean),
+  /** The autonomy contract profile this executor's coder prompts carry (ADR 0027); default `full`. */
+  contract: Schema.optionalKey(Schema.Literals(["full", "minimal", "off"]))
 }) {}
 
 export class RosterDocument extends Schema.Class<RosterDocument>("RosterDocument")({
@@ -393,6 +395,8 @@ export interface Lease {
   readonly release: Effect.Effect<void>
   /** Took no slot: the context's own coder executor serves the call (see `LeaseOptions.borrow`). */
   readonly borrowed: boolean
+  /** Set when the executor is the context's own coder (not independent), and why; see `ExecutorLeased.because`. */
+  readonly because?: "nobody" | "held" | "out"
 }
 
 export interface LeaseOptions {
@@ -403,15 +407,16 @@ export interface LeaseOptions {
   /** Who is asking, for the events (a story's worktree). */
   readonly label?: string
   /**
-   * The executor holding this context's coder, used without a slot (its
-   * coder is idle while the context makes this call) when independence
-   * cannot be had: no executor outside `avoid` can ever take the role, or
-   * every one in the round that could has all its slots held by coders. A
-   * coder's slot frees only when its story ends, and that story may itself
-   * be waiting on a call like this one — waiting for it would saturate the
-   * roster. An executor that is out of the round is still borrowed in the
-   * first case (the call fails on it, as it would on anyone), never in the
-   * second (a story in the round will free a slot).
+   * The executor holding this context's coder, taken when independence
+   * cannot be had now: no executor outside `avoid` can ever take the role,
+   * every one that could is held by a coder, or every one is out of the
+   * round. A coder's slot frees only when its story ends (which may itself
+   * wait on a call like this one), and an exclusion may last hours; a
+   * reasoning call only ever waits for another call to end. The own
+   * executor is taken on a free slot of its own when it has one, else
+   * without a slot (its coder is idle while the context makes this call).
+   * Out of the round itself, it is still taken when nobody can ever serve
+   * (the call fails on it, as it would on anyone), and waited past otherwise.
    */
   readonly borrow?: ExecutorSpec
 }
@@ -443,6 +448,15 @@ export interface RosterShape {
    * for `role` would then wait for a story to end, not for a call.
    */
   readonly coderHeld: (role: Role, avoid?: ReadonlyArray<string>) => Effect.Effect<boolean>
+  /**
+   * Why a lease for `role` outside `avoid` cannot be served by a call
+   * ending: `held` (every executor in the round is held by coders), `out`
+   * (none is in the round), or `undefined` when one has a slot a call frees.
+   */
+  readonly independenceBlocked: (
+    role: Role,
+    avoid?: ReadonlyArray<string>
+  ) => Effect.Effect<"held" | "out" | undefined>
   /** Free slots for `role` now, across executors in the round. */
   readonly available: (role: Role) => Effect.Effect<number>
   /** Configured slots for `role`. */
@@ -572,11 +586,13 @@ export const makeRoster = Effect.fn("@llm4ts/flow/Roster.make")(function* (
   const leaseOf = (
     spec: ExecutorSpec,
     role: Role,
-    label: string | undefined
+    label: string | undefined,
+    because?: "nobody" | "held" | "out"
   ): Effect.Effect<Lease, never, Scope.Scope> =>
     Effect.gen(function* () {
       const labelled = label === undefined ? {} : { label }
-      yield* events.publish(ExecutorLeased.make({ executor: spec.id, role, ...labelled }))
+      const own = because === undefined ? {} : { because }
+      yield* events.publish(ExecutorLeased.make({ executor: spec.id, role, ...labelled, ...own }))
       const done = yield* Ref.make(false)
       const free = Effect.flatMap(Ref.getAndSet(done, true), (was) =>
         was
@@ -587,7 +603,7 @@ export const makeRoster = Effect.fn("@llm4ts/flow/Roster.make")(function* (
             )
       )
       yield* Effect.addFinalizer(() => free)
-      return { executor: spec, role, release: free, borrowed: false }
+      return { executor: spec, role, release: free, borrowed: false, ...own }
     })
 
   /** A lease over the context's own coder executor: no slot taken, none freed. */
@@ -595,7 +611,7 @@ export const makeRoster = Effect.fn("@llm4ts/flow/Roster.make")(function* (
     spec: ExecutorSpec,
     role: Role,
     label: string | undefined,
-    because: "nobody" | "held"
+    because: "nobody" | "held" | "out"
   ): Effect.Effect<Lease, never, Scope.Scope> =>
     Effect.gen(function* () {
       const labelled = label === undefined ? {} : { label }
@@ -609,7 +625,7 @@ export const makeRoster = Effect.fn("@llm4ts/flow/Roster.make")(function* (
           : events.publish(ExecutorReleased.make({ executor: spec.id, role, ...labelled }))
       )
       yield* Effect.addFinalizer(() => free)
-      return { executor: spec, role, release: free, borrowed: true }
+      return { executor: spec, role, release: free, borrowed: true, because }
     })
 
   /** One attempt: expire, pick, take the slot — all under the lock. */
@@ -658,18 +674,26 @@ export const makeRoster = Effect.fn("@llm4ts/flow/Roster.make")(function* (
       )
     )
 
-  const coderHeld = (role: Role, avoid: ReadonlyArray<string> = []): Effect.Effect<boolean> =>
-    lock.withPermit(
-      Effect.sync(() => {
-        const inRound = eligible(role, avoid)
-        return (
-          inRound.length > 0 &&
-          inRound.every(
-            (spec) => (usage.get(spec.id) ?? { busy: 0, busyCoders: 0 }).busyCoders >= slotsOf(spec)
-          )
-        )
-      })
+  const blockedOutside = (role: Role, avoid: ReadonlyArray<string>): "held" | "out" | undefined => {
+    const inRound = eligible(role, avoid)
+    if (inRound.length === 0) {
+      return "out"
+    }
+    return inRound.every(
+      (spec) => (usage.get(spec.id) ?? { busy: 0, busyCoders: 0 }).busyCoders >= slotsOf(spec)
     )
+      ? "held"
+      : undefined
+  }
+
+  const independenceBlocked = (
+    role: Role,
+    avoid: ReadonlyArray<string> = []
+  ): Effect.Effect<"held" | "out" | undefined> =>
+    lock.withPermit(Effect.sync(() => blockedOutside(role, avoid)))
+
+  const coderHeld = (role: Role, avoid: ReadonlyArray<string> = []): Effect.Effect<boolean> =>
+    Effect.map(independenceBlocked(role, avoid), (blocked) => blocked === "held")
 
   /** Probes every `health` exclusion whose next probe is due; a live one comes back. */
   const probeDue: Effect.Effect<void> = Effect.gen(function* () {
@@ -769,13 +793,37 @@ export const makeRoster = Effect.fn("@llm4ts/flow/Roster.make")(function* (
         leaseOptions.borrow !== undefined && hasRole(leaseOptions.borrow, role)
           ? leaseOptions.borrow
           : undefined
-      /** Borrowing when the round is held by coders needs an executor in the round. */
-      const borrowInRound = (): Effect.Effect<ExecutorSpec | undefined> =>
-        lock.withPermit(
-          Effect.sync(() =>
-            borrow !== undefined && !exclusions.has(borrow.id) ? borrow : undefined
-          )
-        )
+      /**
+       * Independence cannot be had now: the context's own executor, when in
+       * the round, takes the call — on a free slot of its own, else without
+       * one (its coder is idle while the context makes this call).
+       */
+      const takeOwn = (
+        because: "nobody" | "held" | "out"
+      ): Effect.Effect<Lease | undefined, never, Scope.Scope> =>
+        Effect.gen(function* () {
+          if (borrow === undefined) {
+            return undefined
+          }
+          // Out of the round itself, the own executor is still taken when
+          // nobody else can ever serve (the call fails on it, as on anyone).
+          const inRound = yield* lock.withPermit(Effect.sync(() => !exclusions.has(borrow.id)))
+          if (!inRound && because !== "nobody") {
+            return undefined
+          }
+          const own = yield* attempt(role, {
+            ...leaseOptions,
+            avoid: avoid.filter((id) => id !== borrow.id),
+            prefer: borrow.id
+          })
+          yield* waited
+          return own !== undefined && own.id === borrow.id
+            ? yield* leaseOf(own, role, leaseOptions.label, because)
+            : own !== undefined
+              ? // Someone came back between the check and the pick: independent after all.
+                yield* leaseOf(own, role, leaseOptions.label)
+              : yield* borrowedLease(borrow, role, leaseOptions.label, because)
+        })
       let announced = false
       const asked = yield* Clock.currentTimeMillis
       // A lease that had to wait says how long, for the story it is for.
@@ -798,9 +846,9 @@ export const makeRoster = Effect.fn("@llm4ts/flow/Roster.make")(function* (
           return yield* leaseOf(spec, role, leaseOptions.label)
         }
         if (!(yield* canEverServe(role, avoid))) {
-          if (borrow !== undefined) {
-            yield* waited
-            return yield* borrowedLease(borrow, role, leaseOptions.label, "nobody")
+          const own = yield* takeOwn("nobody")
+          if (own !== undefined) {
+            return own
           }
           const reasons = yield* lock.withPermit(
             Effect.sync(() =>
@@ -817,11 +865,11 @@ export const makeRoster = Effect.fn("@llm4ts/flow/Roster.make")(function* (
             reasons: reasons.length === 0 ? ["no executor in the roster takes this role"] : reasons
           })
         }
-        if (yield* coderHeld(role, avoid)) {
-          const own = yield* borrowInRound()
+        const blocked = yield* independenceBlocked(role, avoid)
+        if (blocked !== undefined) {
+          const own = yield* takeOwn(blocked)
           if (own !== undefined) {
-            yield* waited
-            return yield* borrowedLease(own, role, leaseOptions.label, "held")
+            return own
           }
         }
         if (!announced) {
@@ -954,6 +1002,7 @@ export const makeRoster = Effect.fn("@llm4ts/flow/Roster.make")(function* (
     tryLease,
     canEverServe,
     coderHeld,
+    independenceBlocked,
     available,
     slots,
     report,