@overdeck/desktop 0.47.0 → 0.48.0

package/server/record-update-CZh46a2f.js

@@ -0,0 +1,617 @@
+import { n as __esmMin } from "./rolldown-runtime-DNCzzKnI.js";
+import { Bt as resolveStateReadHomeSync, K as getProjectConfigFromWorkspacePath, Q as readIssueRecordSync, Rt as STATE_BRANCH, St as init_auto_commit, U as getIssueRecordPath, V as ensureIssueRecordSync, Y as queueIssueRecordCommit, et as resolveProjectForIssue, hi as init_paths, mi as getOverdeckHome, ot as writeIssueRecordSync, q as init_record, xt as flushAutoCommits, zt as init_state_read_home } from "./config-yaml-BSCqwmX0.js";
+import { c as init_activity_logger, i as emitActivityEntryOncePortable } from "./activity-logger-Co5qljIj.js";
+import { n as init_fs_lock, o as releaseRecordLock, s as withRecordFsLock, t as acquireRecordLock } from "./fs-lock-D_GeJtXl.js";
+import { basename, dirname, join, relative, resolve } from "node:path";
+import { Effect } from "effect";
+import { hostname } from "node:os";
+import { mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { createHash, randomUUID } from "node:crypto";
+//#region ../../lib/pan-dir/state-git-lock.ts
+function stateGitLockPath(gitRoot) {
+	const key = createHash("sha256").update(resolve(gitRoot)).digest("hex");
+	return join(getOverdeckHome(), "locks", "state-git", `${key}.lock`);
+}
+async function withStateGitLock(gitRoot, writerId, recordPath, operation) {
+	const key = resolve(gitRoot);
+	const prior = processQueues$1.get(key) ?? Promise.resolve();
+	let releaseQueue;
+	const gate = new Promise((resolveGate) => {
+		releaseQueue = resolveGate;
+	});
+	const tail = prior.catch(() => void 0).then(() => gate);
+	processQueues$1.set(key, tail);
+	await prior.catch(() => void 0);
+	const lockPath = stateGitLockPath(gitRoot);
+	try {
+		await acquireRecordLock(lockPath, {
+			writerId,
+			recordPath,
+			retryDelaysMs: STATE_GIT_LOCK_RETRY_DELAYS_MS
+		});
+		try {
+			return await operation();
+		} finally {
+			await releaseRecordLock(lockPath);
+		}
+	} finally {
+		releaseQueue();
+		if (processQueues$1.get(key) === tail) processQueues$1.delete(key);
+	}
+}
+var STATE_GIT_LOCK_RETRY_DELAYS_MS, processQueues$1;
+var init_state_git_lock = __esmMin((() => {
+	init_paths();
+	init_fs_lock();
+	STATE_GIT_LOCK_RETRY_DELAYS_MS = [
+		10,
+		20,
+		40,
+		80,
+		160,
+		320,
+		640,
+		1280,
+		2560,
+		5120,
+		10240,
+		10240
+	];
+	processQueues$1 = /* @__PURE__ */ new Map();
+}));
+//#endregion
+//#region ../../lib/pan-dir/push-health.ts
+function defaultPushHealth() {
+	return { consecutiveReconcileFailures: 0 };
+}
+function pushHealthPath(project) {
+	const stateWorktreeName = basename(resolveStateReadHomeSync(project).root);
+	return join(getOverdeckHome(), "push-health", `${stateWorktreeName}.json`);
+}
+function normalizePendingEscalation(value) {
+	if (!value || typeof value !== "object") return void 0;
+	const candidate = value;
+	if (typeof candidate.id !== "string" || typeof candidate.issueId !== "string" || !Number.isInteger(candidate.failureCount) || Number(candidate.failureCount) < 3 || typeof candidate.reason !== "string" || !Array.isArray(candidate.conflictedPaths) || typeof candidate.createdAt !== "string") return;
+	return {
+		id: candidate.id,
+		issueId: candidate.issueId,
+		failureCount: Number(candidate.failureCount),
+		reason: candidate.reason,
+		conflictedPaths: candidate.conflictedPaths.filter((path) => typeof path === "string"),
+		createdAt: candidate.createdAt
+	};
+}
+function normalizePushHealth(value) {
+	if (!value || typeof value !== "object") return defaultPushHealth();
+	const candidate = value;
+	const health = { consecutiveReconcileFailures: Number.isInteger(candidate.consecutiveReconcileFailures) && Number(candidate.consecutiveReconcileFailures) >= 0 ? Number(candidate.consecutiveReconcileFailures) : 0 };
+	if (typeof candidate.lastFailureAt === "string") health.lastFailureAt = candidate.lastFailureAt;
+	if (typeof candidate.lastFailureReason === "string") health.lastFailureReason = candidate.lastFailureReason;
+	if (Array.isArray(candidate.lastConflictedPaths)) health.lastConflictedPaths = candidate.lastConflictedPaths.filter((path) => typeof path === "string");
+	if (typeof candidate.lastSuccessAt === "string") health.lastSuccessAt = candidate.lastSuccessAt;
+	const pendingEscalation = normalizePendingEscalation(candidate.pendingEscalation);
+	if (pendingEscalation) health.pendingEscalation = pendingEscalation;
+	return health;
+}
+function readPushHealth(project) {
+	try {
+		return normalizePushHealth(JSON.parse(readFileSync(pushHealthPath(project), "utf8")));
+	} catch {
+		return defaultPushHealth();
+	}
+}
+function writePushHealth(project, health) {
+	const path = pushHealthPath(project);
+	mkdirSync(dirname(path), { recursive: true });
+	const temporaryPath = `${path}.${process.pid}.${Date.now()}.${temporaryFileSequence++}.tmp`;
+	try {
+		writeFileSync(temporaryPath, `${JSON.stringify(health, null, 2)}\n`);
+		renameSync(temporaryPath, path);
+	} finally {
+		rmSync(temporaryPath, { force: true });
+	}
+}
+async function withPushHealthLock(project, operation) {
+	const path = pushHealthPath(project);
+	const key = resolve(path);
+	const prior = processQueues.get(key) ?? Promise.resolve();
+	let releaseQueue;
+	const gate = new Promise((resolveGate) => {
+		releaseQueue = resolveGate;
+	});
+	const tail = prior.catch(() => void 0).then(() => gate);
+	processQueues.set(key, tail);
+	await prior.catch(() => void 0);
+	const lockPath = `${path}.lock`;
+	try {
+		await acquireRecordLock(lockPath, {
+			writerId: `push-health:${process.pid}`,
+			recordPath: path,
+			retryDelaysMs: STATE_GIT_LOCK_RETRY_DELAYS_MS
+		});
+		try {
+			return operation();
+		} finally {
+			await releaseRecordLock(lockPath);
+		}
+	} finally {
+		releaseQueue();
+		if (processQueues.get(key) === tail) processQueues.delete(key);
+	}
+}
+async function recordReconcileFailure(project, failure) {
+	return withPushHealthLock(project, () => {
+		const previous = readPushHealth(project);
+		const consecutiveReconcileFailures = previous.consecutiveReconcileFailures + 1;
+		const lastFailureAt = (/* @__PURE__ */ new Date()).toISOString();
+		const pendingEscalation = previous.pendingEscalation ?? (consecutiveReconcileFailures === 3 ? {
+			id: randomUUID(),
+			issueId: failure.issueId,
+			failureCount: consecutiveReconcileFailures,
+			reason: failure.reason,
+			conflictedPaths: [...failure.conflictedPaths],
+			createdAt: lastFailureAt
+		} : void 0);
+		const health = {
+			...previous,
+			consecutiveReconcileFailures,
+			lastFailureAt,
+			lastFailureReason: failure.reason,
+			lastConflictedPaths: [...failure.conflictedPaths],
+			...pendingEscalation ? { pendingEscalation } : {}
+		};
+		writePushHealth(project, health);
+		return {
+			health,
+			crossedThreshold: consecutiveReconcileFailures === 3
+		};
+	});
+}
+async function recordReconcileSuccess(project) {
+	return withPushHealthLock(project, () => {
+		const health = {
+			...readPushHealth(project),
+			consecutiveReconcileFailures: 0,
+			lastSuccessAt: (/* @__PURE__ */ new Date()).toISOString()
+		};
+		writePushHealth(project, health);
+		return health;
+	});
+}
+async function markPushEscalationDelivered(project, escalationId) {
+	await withPushHealthLock(project, () => {
+		const current = readPushHealth(project);
+		if (current.pendingEscalation?.id !== escalationId) return;
+		const { pendingEscalation: _delivered, ...health } = current;
+		writePushHealth(project, health);
+	});
+}
+var processQueues, temporaryFileSequence;
+var init_push_health = __esmMin((() => {
+	init_paths();
+	init_state_read_home();
+	init_fs_lock();
+	init_state_git_lock();
+	processQueues = /* @__PURE__ */ new Map();
+	temporaryFileSequence = 0;
+}));
+//#endregion
+//#region ../../lib/pan-dir/record-update.ts
+/** The single locked read-modify-write door for per-issue records. */
+function recordDurabilityBudgetMs() {
+	const parsed = Number(process.env.OVERDECK_RECORD_DURABILITY_BUDGET_MS);
+	return Number.isFinite(parsed) && parsed > 0 ? parsed : DEFAULT_RECORD_DURABILITY_BUDGET_MS;
+}
+async function withRecordDurabilityDeadline(issueId, promise, deadlineMs, budgetMs, onTimeout) {
+	const remaining = deadlineMs - Date.now();
+	if (remaining <= 0) {
+		await onTimeout?.().catch(() => void 0);
+		throw new RecordDurabilityTimeoutError(issueId, budgetMs);
+	}
+	return await new Promise((resolve, reject) => {
+		let settled = false;
+		let timingOut = false;
+		const timer = setTimeout(() => {
+			timingOut = true;
+			(onTimeout?.() ?? Promise.resolve()).catch(() => void 0).finally(() => {
+				settled = true;
+				reject(new RecordDurabilityTimeoutError(issueId, budgetMs));
+			});
+		}, remaining);
+		timer.unref?.();
+		promise.then((value) => {
+			if (settled || timingOut) return;
+			settled = true;
+			clearTimeout(timer);
+			resolve(value);
+		}, (error) => {
+			if (settled || timingOut) return;
+			settled = true;
+			clearTimeout(timer);
+			reject(error);
+		});
+	});
+}
+function updateIssueRecordForWorkspace(workspacePath, issueId, mutator, options = {}) {
+	return updateIssueRecord(resolveProjectForIssue(issueId) ?? getProjectConfigFromWorkspacePath(workspacePath), issueId, mutator, options);
+}
+/**
+* Clear the terminal close-out marker so a reopened issue re-enters the pipeline (sync).
+* Ordinary status writes deliberately preserve closedOut (projectPipeline in records.ts),
+* so reopen needs this explicit inverse of markRecordPipelineClosedOutSync in record.ts
+* (MIN-850, 2026-07-24).
+*/
+function clearRecordPipelineClosedOutSync(project, issueId) {
+	const record = ensureIssueRecordSync(project, issueId);
+	if (!record.pipeline.closedOut && !record.pipeline.closedOutAt) return;
+	record.pipeline.closedOut = void 0;
+	record.pipeline.closedOutAt = void 0;
+	record.pipeline.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
+	queueIssueRecordCommit(project, issueId, writeIssueRecordSync(project, issueId, record));
+}
+async function git(gitRoot, args, options = {}) {
+	return (await execFileAsync("git", args, {
+		cwd: gitRoot,
+		encoding: "utf8",
+		timeout: options.timeoutMs ?? 3e4,
+		maxBuffer: 16 * 1024 * 1024,
+		env: {
+			...process.env,
+			HUSKY: "0"
+		},
+		...options.signal ? { signal: options.signal } : {}
+	})).stdout.trim();
+}
+function throwIfDurabilityAborted(signal) {
+	if (signal?.aborted) throw new Error("Record durability operation aborted at the deadline");
+}
+function gitFailureMessage(error) {
+	if (error && typeof error === "object") {
+		const failure = error;
+		return failure.stderr?.trim() || failure.stdout?.trim() || failure.message;
+	}
+	return String(error);
+}
+function isRemoteRefRaceError(message) {
+	return /non-fast-forward|fetch first|stale info|cannot lock ref.*expected|failed to update ref/i.test(message);
+}
+function porcelainPaths(status) {
+	return status.split("\n").map((line) => line.trimEnd()).filter(Boolean).map((line) => line[2] === " " ? line.slice(3) : line[1] === " " ? line.slice(2) : line).map((path) => path.includes(" -> ") ? path.split(" -> ").at(-1) : path).map((path) => path.replace(/\\/g, "/"));
+}
+function isOwnedStatePath(path) {
+	return path.startsWith("specs/") || path.startsWith("records/");
+}
+async function adoptOrphanedStateWrites(gitRoot, signal) {
+	const paths = porcelainPaths(await git(gitRoot, [
+		"status",
+		"--porcelain=v1",
+		"--untracked-files=all"
+	], { signal }));
+	if (paths.length === 0) return;
+	const unowned = paths.filter((path) => !isOwnedStatePath(path));
+	if (unowned.length > 0) throw new Error(`State reconcile blocked by unowned changes: ${unowned.join(", ")}`);
+	throwIfDurabilityAborted(signal);
+	await git(gitRoot, [
+		"add",
+		"--",
+		"specs",
+		"records"
+	], { signal });
+	throwIfDurabilityAborted(signal);
+	await git(gitRoot, [
+		"commit",
+		"-m",
+		"chore(state): adopt orphaned write before state reconcile (PAN-3296)",
+		"--",
+		"specs",
+		"records"
+	], { signal });
+	console.warn(`[record-update] adopted orphaned state write(s): ${paths.join(", ")}`);
+}
+async function abortRebase(gitRoot, options = {}) {
+	try {
+		await git(gitRoot, ["rebase", "--abort"], {
+			timeoutMs: 5e3,
+			...options
+		});
+	} catch {}
+}
+async function abortMerge(gitRoot, options = {}) {
+	try {
+		await git(gitRoot, ["merge", "--abort"], {
+			timeoutMs: 5e3,
+			...options
+		});
+	} catch {}
+}
+async function resolveMergeConflicts(project, issueId, mutator, gitRoot, recordPath, mergeError, signal) {
+	const relativeRecordPath = relative(gitRoot, recordPath).replace(/\\/g, "/");
+	const conflicts = (await git(gitRoot, [
+		"diff",
+		"--name-only",
+		"--diff-filter=U"
+	], { signal })).split("\n").map((path) => path.trim()).filter(Boolean);
+	if (conflicts.length === 0) throw new Error(gitFailureMessage(mergeError));
+	try {
+		const nonRecordConflicts = conflicts.filter((path) => !path.startsWith("records/"));
+		if (nonRecordConflicts.length > 0) throw new Error(`state merge conflicted outside records/: ${nonRecordConflicts.join(", ")}`);
+		for (const conflictPath of conflicts) {
+			await git(gitRoot, [
+				"checkout",
+				"--theirs",
+				"--",
+				conflictPath
+			], { signal });
+			await git(gitRoot, [
+				"add",
+				"--",
+				conflictPath
+			], { signal });
+		}
+		throwIfDurabilityAborted(signal);
+		if (conflicts.includes(relativeRecordPath)) {
+			const remoteRecord = readIssueRecordSync(project, issueId);
+			if (!remoteRecord) throw new Error(`Remote ${issueId} state record is unreadable`);
+			const result = await mutator(remoteRecord);
+			throwIfDurabilityAborted(signal);
+			writeIssueRecordSync(project, issueId, result ?? remoteRecord);
+			await git(gitRoot, [
+				"add",
+				"--",
+				relativeRecordPath
+			], { signal });
+		}
+		throwIfDurabilityAborted(signal);
+		await git(gitRoot, [
+			"-c",
+			"core.editor=true",
+			"commit",
+			"--no-edit"
+		], { signal });
+	} catch (error) {
+		if (error instanceof StateMergeConflictError) throw error;
+		throw new StateMergeConflictError(gitFailureMessage(error), conflicts);
+	}
+}
+async function restoreRetryableRecord(project, issueId, original, recordPath, signal) {
+	const stateHome = resolveStateReadHomeSync(project);
+	const gitRoot = stateHome.root;
+	const relativeRecordPath = relative(gitRoot, recordPath).replace(/\\/g, "/");
+	await abortRebase(gitRoot, { signal });
+	await abortMerge(gitRoot, { signal });
+	let restored = structuredClone(original);
+	const branch = stateHome.migrated ? STATE_BRANCH : await git(gitRoot, ["branch", "--show-current"], { signal });
+	try {
+		await git(gitRoot, [
+			"fetch",
+			"origin",
+			branch
+		], { signal });
+		restored = JSON.parse(await git(gitRoot, ["show", `origin/${branch}:${relativeRecordPath}`], { signal }));
+	} catch (fetchError) {
+		throwIfDurabilityAborted(signal);
+	}
+	throwIfDurabilityAborted(signal);
+	writeIssueRecordSync(project, issueId, restored);
+	await git(gitRoot, [
+		"add",
+		"--",
+		relativeRecordPath
+	], { signal });
+	try {
+		await git(gitRoot, [
+			"diff",
+			"--cached",
+			"--quiet",
+			"--",
+			relativeRecordPath
+		], { signal });
+		return;
+	} catch (diffError) {
+		throwIfDurabilityAborted(signal);
+	}
+	await git(gitRoot, [
+		"commit",
+		"-m",
+		`chore(records): restore ${issueId} after failed state push`,
+		"--",
+		relativeRecordPath
+	], { signal });
+}
+async function deliverPendingEscalation(project, escalation) {
+	if (!escalation) return;
+	const outcome = await emitActivityEntryOncePortable({
+		id: escalation.id,
+		source: "state-door",
+		level: "error",
+		issueId: escalation.issueId,
+		message: `State pushes for ${project.name} have failed ${escalation.failureCount} times in a row and automatic reconciliation cannot resolve them.`,
+		details: `Conflicted paths: ${escalation.conflictedPaths.join(", ") || "unknown"}. The overdeck-state branch is diverging from origin; run "pan doctor" to see ahead/behind counts, then resolve the conflicted files manually (git merge origin/overdeck-state in the state worktree). Until resolved, durable state written on this machine does not reach other machines.`
+	});
+	if (outcome === "appended" || outcome === "duplicate") await markPushEscalationDelivered(project, escalation.id);
+	else console.warn(`[pan-dir/records] State reconcile escalation ${escalation.id} remains pending after activity delivery returned ${outcome}`);
+}
+async function attemptPendingEscalationDelivery(project, escalation) {
+	if (!escalation) return;
+	let timer;
+	try {
+		const delivered = deliverPendingEscalation(project, escalation).then(() => true);
+		if (!await Promise.race([delivered, new Promise((resolveTimeout) => {
+			timer = setTimeout(() => resolveTimeout(false), PENDING_ESCALATION_DELIVERY_TIMEOUT_MS);
+			timer.unref?.();
+		})])) console.warn(`[pan-dir/records] State reconcile escalation ${escalation.id} remains pending after activity delivery timed out`);
+	} catch (deliveryError) {
+		console.warn(`[pan-dir/records] State reconcile escalation ${escalation.id} remains pending after activity delivery failed: ${gitFailureMessage(deliveryError)}`);
+	} finally {
+		if (timer) clearTimeout(timer);
+	}
+}
+async function recordReconcileFailureHealth(project, issueId, error, conflictedPaths) {
+	try {
+		const { health } = await recordReconcileFailure(project, {
+			issueId,
+			reason: gitFailureMessage(error),
+			conflictedPaths
+		});
+		return health.pendingEscalation;
+	} catch (healthError) {
+		console.warn(`[pan-dir/records] Failed to record reconcile health for ${issueId}: ${gitFailureMessage(healthError)}`);
+		return;
+	}
+}
+async function reconcileStatePush(project, issueId, mutator, recordPath, signal, onPendingEscalation) {
+	const gitRoot = resolveStateReadHomeSync(project).root;
+	let conflictedPaths = [];
+	try {
+		await abortMerge(gitRoot, { signal });
+		await abortRebase(gitRoot, { signal });
+		for (let attempt = 0; attempt < MAX_STATE_PUSH_RECONCILIATIONS; attempt += 1) {
+			throwIfDurabilityAborted(signal);
+			await git(gitRoot, [
+				"fetch",
+				"origin",
+				STATE_BRANCH
+			], { signal });
+			await adoptOrphanedStateWrites(gitRoot, signal);
+			try {
+				await git(gitRoot, [
+					"merge",
+					"--no-edit",
+					`origin/${STATE_BRANCH}`
+				], { signal });
+			} catch (error) {
+				throwIfDurabilityAborted(signal);
+				try {
+					await resolveMergeConflicts(project, issueId, mutator, gitRoot, recordPath, error, signal);
+				} catch (resolveError) {
+					if (resolveError instanceof StateMergeConflictError) conflictedPaths = resolveError.conflictedPaths;
+					await abortMerge(gitRoot, { signal });
+					await abortRebase(gitRoot, { signal });
+					throw new Error(`Failed to reconcile ${issueId} state after push race: ${gitFailureMessage(resolveError)}`, { cause: error });
+				}
+			}
+			try {
+				await git(gitRoot, [
+					"push",
+					"origin",
+					STATE_BRANCH
+				], { signal });
+				const record = readIssueRecordSync(project, issueId);
+				if (!record) throw new Error(`Reconciled ${issueId} state record is unreadable`);
+				try {
+					const health = await recordReconcileSuccess(project);
+					onPendingEscalation?.(health.pendingEscalation);
+				} catch (healthError) {
+					console.warn(`[pan-dir/records] Failed to reset reconcile health for ${issueId}: ${gitFailureMessage(healthError)}`);
+				}
+				return record;
+			} catch (error) {
+				throwIfDurabilityAborted(signal);
+				const message = gitFailureMessage(error);
+				if (!isRemoteRefRaceError(message)) throw new Error(`Failed to push reconciled ${issueId} state: ${message}`, { cause: error });
+			}
+		}
+		throw new Error(`Failed to push ${issueId} state after ${MAX_STATE_PUSH_RECONCILIATIONS} reconciliation attempts`);
+	} catch (error) {
+		onPendingEscalation?.(await recordReconcileFailureHealth(project, issueId, error, conflictedPaths));
+		throw error;
+	}
+}
+async function updateIssueRecord(project, issueId, mutator, options = {}) {
+	const normalizedIssueId = issueId.toUpperCase();
+	const recordPath = getIssueRecordPath(project, normalizedIssueId);
+	const writerId = options.writerId ?? process.env.OVERDECK_AGENT_ID ?? `process-${process.pid}@${hostname()}`;
+	let pendingEscalation;
+	try {
+		const record = await withRecordFsLock(project, normalizedIssueId, {
+			writerId,
+			recordPath
+		}, async () => {
+			const operation = async () => {
+				const current = readIssueRecordSync(project, normalizedIssueId) ?? ensureIssueRecordSync(project, normalizedIssueId);
+				const original = structuredClone(current);
+				const next = await mutator(current) ?? current;
+				const path = writeIssueRecordSync(project, normalizedIssueId, next);
+				if (options.autoCommit === false) return readIssueRecordSync(project, normalizedIssueId) ?? next;
+				const budgetMs = recordDurabilityBudgetMs();
+				const deadlineMs = Date.now() + budgetMs;
+				try {
+					const commitRoot = queueIssueRecordCommit(project, normalizedIssueId, path);
+					const flushed = await withRecordDurabilityDeadline(normalizedIssueId, Effect.runPromise(flushAutoCommits(commitRoot)), deadlineMs, budgetMs);
+					if (flushed.pushed === false) {
+						if (resolveStateReadHomeSync(project).migrated && isRemoteRefRaceError(flushed.reason ?? "")) {
+							const reconcileAbort = new AbortController();
+							const reconcilePromise = reconcileStatePush(project, normalizedIssueId, mutator, path, reconcileAbort.signal, (escalation) => {
+								pendingEscalation = escalation;
+							});
+							return await withRecordDurabilityDeadline(normalizedIssueId, reconcilePromise, deadlineMs, budgetMs, async () => {
+								reconcileAbort.abort();
+								await reconcilePromise.catch(() => void 0);
+								const gitRoot = resolveStateReadHomeSync(project).root;
+								await abortRebase(gitRoot);
+								await abortMerge(gitRoot);
+							});
+						}
+						throw new Error(`Failed to push ${normalizedIssueId} state: ${flushed.reason ?? "unknown push failure"}`);
+					}
+					if (!flushed.committed && !["no diff", "no pending"].includes(flushed.reason ?? "")) throw new Error(`Failed to commit ${normalizedIssueId} state: ${flushed.reason ?? "unknown commit failure"}`);
+					return readIssueRecordSync(project, normalizedIssueId) ?? next;
+				} catch (error) {
+					if (error instanceof RecordDurabilityTimeoutError) throw error;
+					try {
+						const restoreAbort = new AbortController();
+						const restorePromise = restoreRetryableRecord(project, normalizedIssueId, original, path, restoreAbort.signal);
+						await withRecordDurabilityDeadline(normalizedIssueId, restorePromise, deadlineMs, budgetMs, async () => {
+							restoreAbort.abort();
+							await restorePromise.catch(() => void 0);
+						});
+					} catch (restoreError) {
+						if (restoreError instanceof RecordDurabilityTimeoutError) throw restoreError;
+						throw new Error(`Failed to persist ${normalizedIssueId} state and restore retryability: ${gitFailureMessage(restoreError)}`, { cause: error });
+					}
+					throw error;
+				}
+			};
+			const stateHome = resolveStateReadHomeSync(project);
+			return stateHome.migrated ? withStateGitLock(stateHome.root, writerId, recordPath, operation) : operation();
+		});
+		await attemptPendingEscalationDelivery(project, pendingEscalation);
+		return record;
+	} catch (error) {
+		await attemptPendingEscalationDelivery(project, pendingEscalation);
+		throw error;
+	}
+}
+var execFileAsync, MAX_STATE_PUSH_RECONCILIATIONS, DEFAULT_RECORD_DURABILITY_BUDGET_MS, PENDING_ESCALATION_DELIVERY_TIMEOUT_MS, RecordDurabilityTimeoutError, StateMergeConflictError;
+var init_record_update = __esmMin((() => {
+	init_activity_logger();
+	init_state_read_home();
+	init_auto_commit();
+	init_fs_lock();
+	init_push_health();
+	init_state_git_lock();
+	init_record();
+	execFileAsync = promisify(execFile);
+	MAX_STATE_PUSH_RECONCILIATIONS = 3;
+	DEFAULT_RECORD_DURABILITY_BUDGET_MS = 3e4;
+	PENDING_ESCALATION_DELIVERY_TIMEOUT_MS = 1e4;
+	RecordDurabilityTimeoutError = class extends Error {
+		constructor(issueId, budgetMs) {
+			super(`Durability wait for ${issueId} state exceeded ${budgetMs}ms; releasing the record lock. The mutation remains in the local record and the flush continues in the background; callers with a fallback (e.g. the review-verdict fallback and drain) reconcile through it, other writers must retry the write.`);
+			this.name = "RecordDurabilityTimeoutError";
+		}
+	};
+	StateMergeConflictError = class extends Error {
+		constructor(message, conflictedPaths) {
+			super(message);
+			this.conflictedPaths = conflictedPaths;
+			this.name = "StateMergeConflictError";
+		}
+	};
+}));
+//#endregion
+export { updateIssueRecordForWorkspace as a, updateIssueRecord as i, clearRecordPipelineClosedOutSync as n, init_record_update as r, RecordDurabilityTimeoutError as t };
+
+//# sourceMappingURL=record-update-CZh46a2f.js.map

package/server/{record-update-DhI7eySG.js → record-update-DtdJK2Iw.js}

@@ -1,3 +1,3 @@
-import { i as updateIssueRecord, r as init_record_update } from "./record-update-DaOKS7Wb.js";
+import { i as updateIssueRecord, r as init_record_update } from "./record-update-CZh46a2f.js";
 init_record_update();
 export { updateIssueRecord };

package/server/recovery-trip-CSNWSLDn.js

@@ -0,0 +1,77 @@
+import { n as __esmMin } from "./rolldown-runtime-DNCzzKnI.js";
+import { Sn as resolveProjectFromIssueSync, X as readIssueRecord, cn as init_projects, nn as getProjectSync, q as init_record } from "./config-yaml-BSCqwmX0.js";
+import { a as updateIssueRecordForWorkspace, r as init_record_update } from "./record-update-CZh46a2f.js";
+//#region ../../lib/cloister/recovery-trip.ts
+/**
+* PAN-3092: read an existing trip without taking the per-issue record lock.
+*
+* A caller that surfaces lock contention needs to know whether it has already
+* surfaced this episode, and it cannot learn that from a path that takes the
+* contended lock. Best-effort: an unreadable record returns undefined, which
+* callers must treat as "not yet surfaced" so a first warning is never lost.
+*/
+async function findRecoveryTrip(issue, recoveryPath, obligationGeneration) {
+	const normalized = issue.toUpperCase();
+	try {
+		const resolved = resolveProjectFromIssueSync(normalized);
+		if (!resolved) return void 0;
+		const project = getProjectSync(resolved.projectKey);
+		if (!project) return void 0;
+		return ((await readIssueRecord(project, normalized))?.recoveryTrips ?? []).find((trip) => trip.issue === normalized && trip.recoveryPath === recoveryPath && trip.obligationGeneration === obligationGeneration);
+	} catch {
+		return;
+	}
+}
+async function recordRecoveryFailure(workspacePath, issue, recoveryPath, obligationGeneration, threshold = 25, now = /* @__PURE__ */ new Date()) {
+	const normalized = issue.toUpperCase();
+	let outcome;
+	await updateIssueRecordForWorkspace(workspacePath, normalized, (record) => {
+		const trips = [...record.recoveryTrips ?? []];
+		const index = trips.findIndex((trip) => trip.issue === normalized && trip.recoveryPath === recoveryPath && trip.obligationGeneration === obligationGeneration);
+		const prior = index >= 0 ? trips[index] : void 0;
+		if (prior?.open) {
+			outcome = {
+				trip: prior,
+				emitNeedsYou: false
+			};
+			return record;
+		}
+		const tripCount = (prior?.tripCount ?? 0) + 1;
+		const emitNeedsYou = tripCount >= threshold;
+		const trip = {
+			issue: normalized,
+			recoveryPath,
+			obligationGeneration,
+			tripCount,
+			open: emitNeedsYou,
+			...prior?.needsYouEmittedAt ? { needsYouEmittedAt: prior.needsYouEmittedAt } : emitNeedsYou ? { needsYouEmittedAt: now.toISOString() } : {}
+		};
+		if (index >= 0) trips[index] = trip;
+		else trips.push(trip);
+		outcome = {
+			trip,
+			emitNeedsYou
+		};
+		return {
+			...record,
+			recoveryTrips: trips
+		};
+	});
+	return outcome;
+}
+async function acknowledgeRecoveryTrip(workspacePath, issue, recoveryPath, obligationGeneration) {
+	const normalized = issue.toUpperCase();
+	await updateIssueRecordForWorkspace(workspacePath, normalized, (record) => ({
+		...record,
+		recoveryTrips: (record.recoveryTrips ?? []).filter((trip) => !(trip.issue === normalized && trip.recoveryPath === recoveryPath && trip.obligationGeneration === obligationGeneration))
+	}));
+}
+var init_recovery_trip = __esmMin((() => {
+	init_record();
+	init_record_update();
+	init_projects();
+}));
+//#endregion
+export { recordRecoveryFailure as i, findRecoveryTrip as n, init_recovery_trip as r, acknowledgeRecoveryTrip as t };
+
+//# sourceMappingURL=recovery-trip-CSNWSLDn.js.map