@overdeck/desktop 0.47.0 → 0.48.0

package/server/{review-status-CGvlA4o_.js → review-status-CKLk5aZ-.js}

@@ -1,19 +1,22 @@
 import { n as __esmMin } from "./rolldown-runtime-DNCzzKnI.js";
-import { Cn as resolveStateReadHomeSync, Gn as init_projects, Lt as readIssueRecord, Mn as findProjectByPathSync, Mt as getIssueWorkspacePath, Pt as init_record, Sn as init_state_read_home, ar as resolveProjectFromIssueSync, ci as getOverdeckHome, di as packageRoot, f as loadConfigSync, li as init_paths, t as init_config_yaml, zn as getProjectSync, zt as readIssueRecordSync } from "./config-yaml-CxdwhAIA.js";
-import { i as emitActivityTtsSync, o as init_activity_logger, r as emitActivityEntrySync } from "./activity-logger-CyteR4JO.js";
-import { d as getOverdeckDatabaseSync, f as init_infra } from "./infra-BDQDRopn.js";
-import { i as updateIssueRecord, r as init_record_update } from "./record-update-DaOKS7Wb.js";
-import { d as init_cost_sync, i as getCostBreakdownByStageAndModelSync, o as getCostForIssueSync } from "./cost-sync-tOCCGnEt.js";
-import { r as notifyPipelineSync, t as init_pipeline_notifier } from "./pipeline-notifier-D0ALV6Nw.js";
-import { c as init_review_status_sync, d as init_review_status_normalize, f as normalizeReviewStatusSync, l as markWorkspaceStuck$1, n as deleteReviewStatus, o as getReviewStatusFromDbSync, r as getAllReviewStatusesFromDb, s as getReviewStatusesFromDb, t as clearWorkspaceStuck$1, u as upsertReviewStatusSync } from "./review-status-sync-0GxOqeqF.js";
-import { a as registerCanonicalReviewStatusResolver, n as init_review_status_source, o as registerReviewStatusMapReader } from "./review-status-source-DIk1JSow.js";
-import { a as PAN_DIRNAME, d as WORKSPACE_RUNTIME_DIRNAME, p as init_types$3, r as PAN_CONTINUES_DIRNAME } from "./types-Cm5ASJbq.js";
-import { i as init_merge_set, r as getMergeSetSync } from "./merge-set-CBgHfwM0.js";
-import { o as init_lifecycle, r as XBRIEF_FILENAME_SUFFIX, t as LEGACY_VBRIEF_FILENAME_SUFFIX } from "./lifecycle-B4Xdb4cY.js";
+import { Bt as resolveStateReadHomeSync, G as getIssueWorkspacePath, Q as readIssueRecordSync, Sn as resolveProjectFromIssueSync, X as readIssueRecord, Yt as findProjectByPathSync, _i as packageRoot, cn as init_projects, f as loadConfigSync, hi as init_paths, mi as getOverdeckHome, nn as getProjectSync, q as init_record, t as init_config_yaml, zt as init_state_read_home } from "./config-yaml-BSCqwmX0.js";
+import { a as emitActivityEntrySync, c as init_activity_logger, o as emitActivityTtsSync } from "./activity-logger-Co5qljIj.js";
+import { d as getOverdeckDatabaseSync, f as init_infra } from "./infra-CTrmVqc_.js";
+import { i as updateIssueRecord, r as init_record_update } from "./record-update-CZh46a2f.js";
+import { a as getWorkspaceForIssue, o as init_resolver } from "./resolver-BvHd6RE4.js";
+import { t as init_review_status_limits } from "./review-status-limits-4EJDCGHO.js";
+import { r as registerFeedbackAgentStateReader, t as init_agent_state_source } from "./agent-state-source-Ds968-j6.js";
+import { d as init_cost_sync, i as getCostBreakdownByStageAndModelSync, o as getCostForIssueSync } from "./cost-sync-cesi9dp8.js";
+import { r as notifyPipelineSync, t as init_pipeline_notifier } from "./pipeline-notifier-DDfVBJhJ.js";
+import { c as init_review_status_sync, d as init_review_status_normalize, f as normalizeReviewStatusSync, l as markWorkspaceStuck$1, n as deleteReviewStatus, o as getReviewStatusFromDbSync, r as getAllReviewStatusesFromDb, s as getReviewStatusesFromDb, t as clearWorkspaceStuck$1, u as upsertReviewStatusSync } from "./review-status-sync-BxBeHRde.js";
+import { a as registerCanonicalReviewStatusResolver, n as init_review_status_source, o as registerReviewStatusMapReader } from "./review-status-source-7nU3Z2wL.js";
+import { a as PAN_DIRNAME, f as WORKSPACE_RUNTIME_DIRNAME, m as init_types$3, r as PAN_CONTINUES_DIRNAME } from "./types-DzlUKiuf.js";
+import { i as init_merge_set, r as getMergeSetSync } from "./merge-set-DsLjjLEV.js";
+import { o as init_lifecycle, r as XBRIEF_FILENAME_SUFFIX, t as LEGACY_VBRIEF_FILENAME_SUFFIX } from "./lifecycle-D2X3al0D.js";
 import { basename, dirname, join } from "node:path";
 import { Data, Effect } from "effect";
 import { existsSync, readFileSync, readdirSync, statSync } from "fs";
-import { dirname as dirname$1, isAbsolute as isAbsolute$1, join as join$1, posix, relative as relative$1, sep as sep$1 } from "path";
+import { dirname as dirname$1, isAbsolute as isAbsolute$1, join as join$1, posix as posix$1, relative as relative$1, sep as sep$1 } from "path";
 import { homedir } from "os";
 import { hostname } from "node:os";
 import { chmodSync as chmodSync$1, createReadStream as createReadStream$1, existsSync as existsSync$1, linkSync, mkdirSync as mkdirSync$1, promises as promises$1, readFileSync as readFileSync$1, readdirSync as readdirSync$1, renameSync as renameSync$1, rmSync as rmSync$1, statSync as statSync$1, writeFileSync as writeFileSync$1 } from "node:fs";
@@ -47,6 +50,7 @@ function overdeckRowToAgentState(row) {
 		id: row.id,
 		issueId: row.issue_id,
 		workspace: row.workspace,
+		workspaceId: row.workspace_id ?? void 0,
 		role: row.role,
 		model: row.model ?? "",
 		status: row.status,
@@ -104,6 +108,7 @@ function stateToOverdeckParamsForDb(state, updatedAt) {
 		state.role,
 		state.status,
 		state.workspace,
+		state.workspaceId ?? getWorkspaceForIssue(state.issueId)?.id ?? null,
 		state.sessionId ?? null,
 		state.harness ?? "",
 		state.model ?? "",
@@ -165,6 +170,8 @@ function saveOverdeckAgentStateSync(state) {
 }
 var AGENT_COLUMNS_FOR_DB, SELECT_AGENT_SQL;
 var init_agent_state_sync = __esmMin((() => {
+	init_agent_state_source();
+	init_resolver();
 	init_infra();
 	AGENT_COLUMNS_FOR_DB = [
 		"id",
@@ -172,6 +179,7 @@ var init_agent_state_sync = __esmMin((() => {
 		"role",
 		"status",
 		"workspace",
+		"workspace_id",
 		"session_id",
 		"harness",
 		"model",
@@ -218,6 +226,165 @@ var init_agent_state_sync = __esmMin((() => {
 		"updated_at"
 	];
 	SELECT_AGENT_SQL = `SELECT ${AGENT_COLUMNS_FOR_DB.join(", ")} FROM agents`;
+	registerFeedbackAgentStateReader(listOverdeckAgentStatesSync);
+}));
+//#endregion
+//#region ../../lib/pan-dir/pipeline-verdict-merge.ts
+function fields(pipeline) {
+	return pipeline;
+}
+function isTerminal(gate, value) {
+	return typeof value === "string" && TERMINAL_GATE_VALUES[gate].includes(value);
+}
+/** Milliseconds for an ISO/epoch cycle marker, or undefined when it does not parse. */
+function cycleMs(value) {
+	if (typeof value === "number") return Number.isFinite(value) ? value : void 0;
+	if (typeof value !== "string") return void 0;
+	const parsed = Date.parse(value);
+	return Number.isNaN(parsed) ? void 0 : parsed;
+}
+/**
+* Merge a freshly-read on-disk pipeline over a rebuilt one without losing a
+* terminal verdict the rebuild carries.
+*
+* Order of rules:
+*   1. Either side lacks `updatedAt` → the rebuilt block wins (PAN-2587 guard).
+*   2. The rebuilt block is at least as new → it wins outright (PAN-2587).
+*   3. Otherwise `fresh` is the base — newer-wins for every non-verdict field.
+*   4. `fresh` belongs to a strictly newer review cycle → it wins wholesale;
+*      a new cycle legitimately resets the previous cycle's verdicts.
+*   5. Any gate where `rebuilt` holds a terminal verdict and the base does not
+*      keeps the rebuilt status plus its companion fields.
+*/
+function mergePipelineVerdictAware(rebuilt, fresh) {
+	if (!fresh?.updatedAt || !rebuilt?.updatedAt) return rebuilt;
+	if (!(rebuilt.updatedAt < fresh.updatedAt)) return rebuilt;
+	const rebuiltCycle = cycleMs(rebuilt.reviewSpawnedAt);
+	const freshCycle = cycleMs(fresh.reviewSpawnedAt);
+	if (rebuiltCycle !== void 0 && freshCycle !== void 0 && freshCycle > rebuiltCycle) return fresh;
+	let merged;
+	for (const gate of GATE_NAMES) {
+		if (!isTerminal(gate, fields(rebuilt)[gate]) || isTerminal(gate, fields(fresh)[gate])) continue;
+		merged ??= structuredClone(fresh);
+		const target = fields(merged);
+		const source = fields(rebuilt);
+		for (const field of [gate, ...GATE_COMPANIONS[gate]]) if (source[field] === void 0) delete target[field];
+		else target[field] = source[field];
+	}
+	return merged ?? fresh;
+}
+/**
+* Does this status update drive some gate to a terminal verdict it was not
+* already at? That is the write an agent cannot cheaply retry — losing it
+* strands the verdict in the agent's pane — so the journal writer waits out lock
+* contention for it instead of dropping to the workspace fallback on the first
+* collision (PAN-3092). Bookkeeping writes stay single-shot; retrying those
+* would only add lock pressure.
+*/
+function carriesNewTerminalVerdict(previous, update) {
+	return GATE_NAMES.some((gate) => {
+		const next = update[gate];
+		return next !== void 0 && next !== previous[gate] && isTerminal(gate, next);
+	});
+}
+/**
+* Has the journal settled every gate the workspace fallback holds a terminal
+* verdict for? The drain asks this before deleting a fallback as superseded: a
+* newer-but-verdict-free journal write must not consume a verdict that never
+* landed anywhere (PAN-3092; MIN-902 lost its review verdict exactly this way).
+*
+* Coverage is per-gate VALUE equality, not merely "the journal reached some
+* terminal value". `pipeline.updatedAt` is restamped by unrelated bookkeeping —
+* the root defect this issue exists for — so a later whole-pipeline timestamp is
+* no evidence that a journal's differing terminal value is the newer one; it may
+* be an older verdict carried forward while the newer specialist result waits in
+* the fallback. When the values differ the fallback is folded instead, and
+* `mergePipelineVerdictAware` decides the winner from per-gate evidence.
+*/
+function pipelineCoversFallbackVerdicts(journal, fallback) {
+	const journalCycle = cycleMs(journal.reviewSpawnedAt);
+	const fallbackWrittenMs = cycleMs(fallback.updatedAt);
+	if (journalCycle !== void 0 && fallbackWrittenMs !== void 0 && journalCycle > fallbackWrittenMs) return true;
+	const journalFields = fields(journal);
+	const fallbackFields = fields(fallback.pipeline);
+	for (const gate of GATE_NAMES) {
+		const held = fallbackFields[gate];
+		if (!isTerminal(gate, held)) continue;
+		if (journalFields[gate] !== held) return false;
+	}
+	return true;
+}
+/**
+* Which gates hold DIFFERENT terminal verdicts in the journal and the fallback,
+* within the same review cycle?
+*
+* This is the one case the drain cannot resolve: two written terminal verdicts
+* for one gate, and no per-gate timestamp to order them by. The whole-pipeline
+* `updatedAt` is restamped by unrelated bookkeeping, so "the journal's is newer"
+* is exactly the inference PAN-3092 exists to stop making. Callers preserve the
+* fallback and let the stranded-fallback sweep put the conflict in front of an
+* operator rather than picking a winner.
+*/
+function findFallbackVerdictConflicts(journal, fallback) {
+	const journalCycle = cycleMs(journal.reviewSpawnedAt);
+	const fallbackWrittenMs = cycleMs(fallback.updatedAt);
+	if (journalCycle !== void 0 && fallbackWrittenMs !== void 0 && journalCycle > fallbackWrittenMs) return [];
+	const journalFields = fields(journal);
+	const fallbackFields = fields(fallback.pipeline);
+	const conflicts = [];
+	for (const gate of GATE_NAMES) {
+		const held = fallbackFields[gate];
+		if (!isTerminal(gate, held)) continue;
+		const settled = journalFields[gate];
+		if (!isTerminal(gate, settled) || settled === held) continue;
+		conflicts.push({
+			gate,
+			journalValue: String(settled),
+			fallbackValue: String(held)
+		});
+	}
+	return conflicts;
+}
+/** Boolean form of {@link findFallbackVerdictConflicts} for the drain's withhold decision. */
+function pipelineConflictsWithFallbackVerdicts(journal, fallback) {
+	return findFallbackVerdictConflicts(journal, fallback).length > 0;
+}
+var TERMINAL_GATE_VALUES, GATE_COMPANIONS, GATE_NAMES;
+var init_pipeline_verdict_merge = __esmMin((() => {
+	TERMINAL_GATE_VALUES = {
+		reviewStatus: [
+			"passed",
+			"blocked",
+			"failed",
+			"skipped"
+		],
+		testStatus: ["passed", "failed"],
+		uatStatus: ["passed", "failed"],
+		verificationStatus: [
+			"passed",
+			"failed",
+			"skipped"
+		],
+		inspectStatus: [
+			"passed",
+			"blocked",
+			"failed"
+		],
+		mergeStatus: ["merged", "failed"]
+	};
+	GATE_COMPANIONS = {
+		reviewStatus: [
+			"reviewNotes",
+			"reviewedAtCommit",
+			"reviewerVerdicts"
+		],
+		testStatus: ["testNotes"],
+		uatStatus: ["uatNotes"],
+		verificationStatus: ["verificationNotes", "lastVerifiedCommit"],
+		inspectStatus: ["inspectNotes"],
+		mergeStatus: ["mergeNotes", "mergeStep"]
+	};
+	GATE_NAMES = Object.keys(TERMINAL_GATE_VALUES);
 }));
 //#endregion
 //#region ../../lib/pan-dir/records.ts
@@ -244,6 +411,7 @@ function projectPipeline(issueId, status, existing) {
 		issueId,
 		reviewStatus: status?.reviewStatus ?? "pending",
 		testStatus: status?.testStatus ?? "pending",
+		uatStatus: status?.uatStatus,
 		verificationStatus: status?.verificationStatus,
 		inspectStatus: status?.inspectStatus,
 		mergeStatus: status?.mergeStatus,
@@ -260,6 +428,7 @@ function projectPipeline(issueId, status, existing) {
 		...base,
 		reviewNotes: status.reviewNotes,
 		testNotes: status.testNotes,
+		uatNotes: status.uatNotes,
 		verificationNotes: status.verificationNotes,
 		inspectNotes: status.inspectNotes,
 		mergeNotes: status.mergeNotes,
@@ -391,10 +560,15 @@ async function buildIssueRecord(project, issueId, opts = {}) {
 * the status the rebuild projects — observed clobbering PAN-399's passed
 * verdict back to a pre-verdict snapshot. Same newer-wins rule (ISO `updatedAt`
 * comparison) the journal readers use.
+*
+* PAN-3092: newer-wins alone conflates write-recency with verdict-truth, because
+* `projectPipeline` stamps `updatedAt` on every write, verdict or not. The
+* comparison now runs through `mergePipelineVerdictAware`, which keeps
+* newer-wins for every non-verdict field but refuses to drop a terminal verdict
+* in favour of a same-cycle verdict-free write.
 */
 function pickNewerPipeline(rebuilt, fresh) {
-	if (!fresh?.updatedAt || !rebuilt?.updatedAt) return rebuilt;
-	return rebuilt.updatedAt < fresh.updatedAt ? fresh : rebuilt;
+	return mergePipelineVerdictAware(rebuilt, fresh);
 }
 /**
 * PAN-1908 / PAN-1919: rebuild and queue the per-issue permanent record for a
@@ -438,19 +612,46 @@ var init_records = __esmMin((() => {
 	init_agent_state_sync();
 	init_record();
 	init_record_update();
+	init_pipeline_verdict_merge();
 }));
 //#endregion
 //#region ../../lib/overdeck/review-status-record-sync.ts
-function updateIssueRecordForReviewStatusSync(issueId, status) {
-	const write = Promise.resolve(updateIssueRecordForIssue(issueId, status)).then((landed) => {
-		if (landed === false) {
-			writeWorkspaceVerdictFallbackSync(issueId, status);
-			scheduleVerdictFallbackDrain(issueId);
-		} else if (landed === true) trackVerdictFallbackDrain(issueId);
-	}).catch(() => {
+function verdictWriteBackoffDelaysMs() {
+	const raw = process.env.OVERDECK_VERDICT_BACKOFF_DELAYS_MS;
+	if (!raw) return DEFAULT_VERDICT_BACKOFF_DELAYS_MS;
+	const parsed = raw.split(",").map((part) => Number(part.trim())).filter((ms) => Number.isFinite(ms) && ms >= 0);
+	return parsed.length > 0 ? parsed : DEFAULT_VERDICT_BACKOFF_DELAYS_MS;
+}
+/**
+* One journal-write attempt. `false` means the durable write definitively
+* failed; `undefined` (a test double, say) is "unknown", not "failed", and only
+* a definite `true` is safe to treat as a landed write.
+*/
+async function attemptJournalWrite(issueId, status) {
+	try {
+		return await updateIssueRecordForIssue(issueId, status);
+	} catch {
+		return false;
+	}
+}
+function updateIssueRecordForReviewStatusSync(issueId, status, options) {
+	const delays = options?.verdictWrite ? verdictWriteBackoffDelaysMs() : [];
+	const write = (async () => {
+		for (let attempt = 0;; attempt += 1) {
+			const landed = await attemptJournalWrite(issueId, status);
+			if (landed !== false) {
+				if (landed === true) trackVerdictFallbackDrain(issueId);
+				return;
+			}
+			const delay = delays[attempt];
+			if (delay === void 0) break;
+			await new Promise((resolve) => {
+				setTimeout(resolve, delay);
+			});
+		}
 		writeWorkspaceVerdictFallbackSync(issueId, status);
 		scheduleVerdictFallbackDrain(issueId);
-	});
+	})();
 	pendingJournalWrites.add(write);
 	write.finally(() => pendingJournalWrites.delete(write));
 }
@@ -491,6 +692,7 @@ function enrichReviewNotesFromRecordSync(issueId, status) {
 		...status,
 		reviewNotes: pipeline.reviewNotes ?? status.reviewNotes,
 		testNotes: pipeline.testNotes ?? status.testNotes,
+		uatNotes: pipeline.uatNotes ?? status.uatNotes,
 		mergeNotes: pipeline.mergeNotes ?? status.mergeNotes,
 		inspectNotes: pipeline.inspectNotes ?? status.inspectNotes,
 		verificationNotes: pipeline.verificationNotes ?? status.verificationNotes,
@@ -507,6 +709,8 @@ function durableSubset(p) {
 	return {
 		reviewStatus: p.reviewStatus,
 		testStatus: p.testStatus,
+		uatStatus: p.uatStatus ?? void 0,
+		uatNotes: p.uatNotes,
 		mergeStatus: p.mergeStatus ?? void 0,
 		mergeStep: p.mergeStep,
 		inspectStatus: p.inspectStatus ?? void 0,
@@ -708,6 +912,21 @@ async function readWorkspaceVerdictFallback(issueId) {
 * write was in flight stays at the live path for its own drain schedule, and
 * no step ever renames onto a path another process may have just created.
 */
+/**
+* PAN-3092: why is a fallback still pending? A failed drain returns `false` for
+* two materially different reasons — the record write lost to a contended lock,
+* or the fold was deliberately withheld because the journal and the fallback
+* hold different terminal verdicts for one gate. Only the first clears on its
+* own; the second is permanent until an operator picks a verdict, so the sweep
+* must be able to tell them apart before it tells anyone to wait.
+*
+* Read-only and lock-free: the caller is already reporting lock contention.
+*/
+async function findWorkspaceVerdictConflicts(issueId, fallback) {
+	const journal = await readPipeline(issueId);
+	if (!journal?.updatedAt || journal.updatedAt < fallback.updatedAt) return [];
+	return findFallbackVerdictConflicts(journal, fallback);
+}
 async function drainWorkspaceVerdictFallback(issueId) {
 	const claims = claimWorkspaceVerdictFallbackSync(issueId);
 	if (!claims) return true;
@@ -716,16 +935,19 @@ async function drainWorkspaceVerdictFallback(issueId) {
 	const losers = claims.filter((claim) => claim !== winner);
 	const { fallback } = winner;
 	const journal = readPipelineSync(issueId);
-	if (journal?.updatedAt && !(journal.updatedAt < fallback.updatedAt)) {
+	const journalAtLeastAsNew = !!journal?.updatedAt && !(journal.updatedAt < fallback.updatedAt);
+	if (journalAtLeastAsNew && pipelineCoversFallbackVerdicts(journal, fallback)) {
 		for (const claim of claims) rmSync$1(claim.claimPath, { force: true });
 		return true;
 	}
-	if (await updateIssueRecordForIssue(issueId, {
+	const conflicted = journalAtLeastAsNew && pipelineConflictsWithFallbackVerdicts(journal, fallback);
+	const status = {
 		issueId: fallback.issueId,
 		...fallback.pipeline,
 		updatedAt: fallback.updatedAt,
 		readyForMerge: false
-	})) {
+	};
+	if (conflicted ? false : await updateIssueRecordForIssue(issueId, status)) {
 		for (const claim of claims) rmSync$1(claim.claimPath, { force: true });
 		return true;
 	}
@@ -815,12 +1037,21 @@ async function readJournalStatus(issueId) {
 	const [pipeline, fallback] = await Promise.all([readPipeline(issueId), readWorkspaceVerdictFallback(issueId)]);
 	return projectJournalStatus(pipeline, fallback);
 }
-var pendingJournalWrites, FALLBACK_CLEARABLE_FIELDS, drainClaimCounter, DRAIN_RETRY_DELAYS_MS, drainTimers;
+var pendingJournalWrites, DEFAULT_VERDICT_BACKOFF_DELAYS_MS, FALLBACK_CLEARABLE_FIELDS, drainClaimCounter, DRAIN_RETRY_DELAYS_MS, drainTimers;
 var init_review_status_record_sync = __esmMin((() => {
 	init_records();
 	init_record();
+	init_pipeline_verdict_merge();
 	init_projects();
 	pendingJournalWrites = /* @__PURE__ */ new Set();
+	DEFAULT_VERDICT_BACKOFF_DELAYS_MS = [
+		2e3,
+		5e3,
+		1e4,
+		2e4,
+		4e4,
+		8e4
+	];
 	FALLBACK_CLEARABLE_FIELDS = [
 		"strikeTransportRetryCount",
 		"strikeNextAttemptAt",
@@ -1046,6 +1277,7 @@ var init_review_status_reconcile = __esmMin((() => {
 	init_review_status_sync();
 	init_review_convergence();
 	init_projects();
+	init_review_status_limits();
 }));
 //#endregion
 //#region ../../lib/review-dispatch-decision.ts
@@ -1116,7 +1348,7 @@ function createGetModuleFromFilename(basePath = process.argv[1] ? dirname$1(proc
 	return (filename) => {
 		if (!filename) return;
 		const normalizedFilename = isWindows ? normalizeWindowsPath(filename) : filename;
-		let { dir, base: file, ext } = posix.parse(normalizedFilename);
+		let { dir, base: file, ext } = posix$1.parse(normalizedFilename);
 		if (".js" === ext || ".mjs" === ext || ".cjs" === ext) file = file.slice(0, -1 * ext.length);
 		const decodedFile = decodeURIComponent(file);
 		if (!dir) dir = ".";
@@ -6856,9 +7088,9 @@ var init_service = __esmMin((() => {
 //#region ../../lib/telemetry/pipeline.ts
 async function readCanonicalPipelineMembership(issueId) {
 	const [membershipModule, gatherModule, recordModule] = await Promise.all([
-		import("./pipeline-membership-C88VBnhJ.js"),
-		import("./pipeline-membership-gather-4eR-7Tqy.js"),
-		import("./record-BTwWhtBb.js")
+		import("./pipeline-membership-2_okL5bm.js"),
+		import("./pipeline-membership-gather-4F1-tXKI.js"),
+		import("./record-aVzu-LGm.js")
 	]);
 	const project = recordModule.resolveProjectForIssue(issueId);
 	if (!project) return false;
@@ -6909,11 +7141,16 @@ var init_pipeline = __esmMin((() => {
 		"claude-code",
 		"ohmypi",
 		"codex",
-		"acp"
+		"acp",
+		"kimi-code"
 	]);
 }));
 //#endregion
 //#region ../../lib/review-status.ts
+function truncateHistoryNote(notes) {
+	if (!notes || notes.length <= 500) return notes;
+	return notes.slice(0, 499) + "…";
+}
 /**
 * Authoritative "allowed to merge" predicate (PAN-1759). The flywheel
 * orchestrator's pipeline verb says it INTENDS to merge an issue; this record
@@ -7042,49 +7279,59 @@ function setReviewStatusSync(issueId, update, existing) {
 		"failed",
 		"skipped"
 	].includes(update.reviewStatus ?? "") && merged.reviewRequestedAt && (!merged.reviewSpawnedAt || Date.parse(merged.reviewRequestedAt) <= new Date(merged.reviewSpawnedAt).getTime())) merged.reviewRequestedAt = void 0;
-	const history = [...status.history || []];
 	const now = (/* @__PURE__ */ new Date()).toISOString();
-	if (update.reviewStatus && update.reviewStatus !== status.reviewStatus) history.push({
+	const rawHistory = [...status.history || []];
+	if (update.reviewStatus && update.reviewStatus !== status.reviewStatus) rawHistory.push({
 		type: "review",
 		status: update.reviewStatus,
 		timestamp: now,
-		notes: update.reviewNotes
+		...update.reviewNotes ? { notes: update.reviewNotes } : {}
 	});
-	if (update.testStatus && update.testStatus !== status.testStatus) history.push({
+	if (update.testStatus && update.testStatus !== status.testStatus) rawHistory.push({
 		type: "test",
 		status: update.testStatus,
 		timestamp: now,
-		notes: update.testNotes
+		...update.testNotes ? { notes: update.testNotes } : {}
 	});
-	if (update.uatStatus && update.uatStatus !== status.uatStatus) history.push({
+	if (update.uatStatus && update.uatStatus !== status.uatStatus) rawHistory.push({
 		type: "uat",
 		status: update.uatStatus,
 		timestamp: now,
-		notes: update.uatNotes
+		...update.uatNotes ? { notes: update.uatNotes } : {}
 	});
-	if (update.mergeStatus && update.mergeStatus !== status.mergeStatus) history.push({
+	if (update.mergeStatus && update.mergeStatus !== status.mergeStatus) rawHistory.push({
 		type: "merge",
 		status: update.mergeStatus,
 		timestamp: now
 	});
-	if (update.releaseStatus && update.releaseStatus !== status.releaseStatus) history.push({
+	if (update.releaseStatus && update.releaseStatus !== status.releaseStatus) rawHistory.push({
 		type: "release",
 		status: update.releaseStatus,
 		timestamp: now,
-		notes: update.releaseNotes
+		...update.releaseNotes ? { notes: update.releaseNotes } : {}
 	});
-	while (history.length > 10) history.shift();
 	const readyForMerge = (merged.blockerReasons?.length ?? 0) > 0 ? false : update.readyForMerge !== void 0 ? update.readyForMerge : reviewGatesPassedSync(merged);
+	const boundedHistory = rawHistory.slice(-20).map((entry) => ({
+		...entry,
+		notes: entry.notes ? truncateHistoryNote(entry.notes) : void 0
+	}));
+	const dbStatus = normalizeReviewStatusSync({
+		...merged,
+		issueId,
+		updatedAt: now,
+		readyForMerge,
+		history: rawHistory
+	});
 	const updated = normalizeReviewStatusSync({
 		...merged,
 		issueId,
 		updatedAt: now,
 		readyForMerge,
-		history
+		history: boundedHistory
 	});
 	if (readyForMerge && !status.readyForMerge && updated.prUrl) (async () => {
 		try {
-			const { isGitHubAppConfigured, reportCommitStatus } = await import("./github-app-Bmg4R9mv.js");
+			const { isGitHubAppConfigured, reportCommitStatus } = await import("./github-app-CpQSDlv8.js");
 			if (!isGitHubAppConfigured()) return;
 			const prMatch = updated.prUrl.match(/github\.com\/([^/]+)\/([^/]+)\/pull/);
 			if (!prMatch) return;
@@ -7104,9 +7351,10 @@ function setReviewStatusSync(issueId, update, existing) {
 			console.warn(`[review-status] Failed to report commit status: ${err.message}`);
 		}
 	})();
-	updateIssueRecordForReviewStatusSync(issueId, updated);
+	const verdictWrite = carriesNewTerminalVerdict(status, update);
+	updateIssueRecordForReviewStatusSync(issueId, updated, { verdictWrite });
 	try {
-		upsertReviewStatusSync(updated);
+		upsertReviewStatusSync(dbStatus);
 	} catch (err) {
 		const msg = err instanceof Error ? err.message : String(err);
 		console.warn(`[review-status] DB cache write skipped for ${issueId} (${msg}); journal holds the verdict, host will reconcile on read.`);
@@ -7338,8 +7586,8 @@ function emitReactiveLifecycleEvent(type, issueId) {
 }
 async function deliverReviewVerdictFeedbackHostSide(issueId, status) {
 	try {
-		const { deliverReviewVerdictFeedback } = await import("./review-verdict-feedback-HwF6ODFy.js");
-		const { getAgentStateSync } = await import("./agents-ePFVoZbu.js");
+		const { deliverReviewVerdictFeedback } = await import("./review-verdict-feedback-HRY9P4bN.js");
+		const { getAgentStateSync } = await import("./agents-IPSa5kzn.js");
 		const runId = getAgentStateSync(`agent-${issueId.toLowerCase()}-review`)?.reviewRunId;
 		if ((await Effect.runPromise(deliverReviewVerdictFeedback({
 			issueId,
@@ -7382,7 +7630,7 @@ function maybeAutoDispatchReviewHostSide(issueId, status) {
 }
 async function dispatchReviewHostSide(issueId, prUrl) {
 	try {
-		const { hasDurableReviewPipelineHandler, startDurableReviewPipelineHostSide } = await import("./durable-review-pipeline-DP6bIcOY.js");
+		const { hasDurableReviewPipelineHandler, startDurableReviewPipelineHostSide } = await import("./durable-review-pipeline-CStTgOAf.js");
 		if (!hasDurableReviewPipelineHandler()) {
 			if (!loggedMissingPipelineHandler) {
 				loggedMissingPipelineHandler = true;
@@ -7390,7 +7638,7 @@ async function dispatchReviewHostSide(issueId, prUrl) {
 			}
 			return;
 		}
-		const { spawnReviewRoleForIssue } = await import("./review-agent-BTCNkq2h.js");
+		const { spawnReviewRoleForIssue } = await import("./review-agent-CD3RQ-tc.js");
 		if (!await startDurableReviewPipelineHostSide({
 			issueId,
 			...prUrl ? { prUrl } : {},
@@ -7412,13 +7660,13 @@ function maybeRecoverTestVerdictHostSide(issueId, status) {
 }
 async function recoverTestVerdictHostSide(issueId) {
 	try {
-		const { resolveProjectFromIssueSync } = await import("./projects-_n3Zui6K.js");
+		const { resolveProjectFromIssueSync } = await import("./projects-WqMWCdpa.js");
 		const resolved = resolveProjectFromIssueSync(issueId);
 		if (!resolved) return;
 		const { existsSync } = await import("fs");
 		const workspace = join$1(resolved.projectPath, "workspaces", `feature-${issueId.toLowerCase()}`);
 		if (!existsSync(workspace)) return;
-		const { readTestVerdictArtifact } = await import("./test-verdict-BHgTAwIG.js");
+		const { readTestVerdictArtifact } = await import("./test-verdict-NdtgRBuA.js");
 		const artifact = readTestVerdictArtifact(workspace);
 		if (!artifact) return;
 		setReviewStatusSync(issueId, {
@@ -7465,13 +7713,13 @@ function resetPipelineVerdictsForWorkStartSync(issueId, options = {}) {
 }
 async function deliverTestFailureToWorkAgentHostSide(issueId, status) {
 	try {
-		const { resolveProjectFromIssueSync } = await import("./projects-_n3Zui6K.js");
+		const { resolveProjectFromIssueSync } = await import("./projects-WqMWCdpa.js");
 		const resolved = resolveProjectFromIssueSync(issueId);
 		const workspace = resolved ? join$1(resolved.projectPath, "workspaces", `feature-${issueId.toLowerCase()}`) : void 0;
 		const notes = status.testNotes;
 		let feedbackPath;
 		try {
-			const { writeFeedbackFile } = await import("./feedback-writer-CoB9Z6aU.js");
+			const { writeFeedbackFile } = await import("./feedback-writer-CTSuA6lw.js");
 			const r = await Effect.runPromise(writeFeedbackFile({
 				issueId,
 				workspacePath: workspace,
@@ -7483,10 +7731,10 @@ async function deliverTestFailureToWorkAgentHostSide(issueId, status) {
 			if (r.success) feedbackPath = r.filePath;
 		} catch {}
 		const message = `SPECIALIST FEEDBACK: test-agent reported FAILED for ${issueId}.\n\n${feedbackPath ? `MUST READ: ${feedbackPath}\n\n` : ""}${notes ? `${notes.slice(0, 400)}\n\n` : ""}Fix the failing tests, commit and push, then re-run pan done ${issueId}. Do NOT stop at the prompt.`;
-		const { resolveIssueFeedbackTarget, surfaceIssueFeedbackNeedsYou } = await import("./feedback-target-BJ5ZADsu.js");
+		const { resolveIssueFeedbackTarget, surfaceIssueFeedbackNeedsYou } = await import("./feedback-target-D9Tex35_.js");
 		const target = await resolveIssueFeedbackTarget(issueId);
 		if ("agentId" in target) {
-			const { messageAgent } = await import("./agents-ePFVoZbu.js");
+			const { messageAgent } = await import("./agents-IPSa5kzn.js");
 			await messageAgent(target.agentId, message, "internal", { owesRework: true });
 			console.log(`[review-status] delivered test failure to ${target.agentId} for ${issueId} (host-side)`);
 		} else await surfaceIssueFeedbackNeedsYou(issueId, target.reason, {
@@ -7689,8 +7937,10 @@ var init_review_status = __esmMin((() => {
 	init_review_status_source();
 	init_review_status_normalize();
 	init_review_status_record_sync();
+	init_pipeline_verdict_merge();
 	init_review_status_reconcile();
 	init_review_dispatch_decision();
+	init_review_status_limits();
 	init_review_status_read();
 	init_pipeline();
 	registerReviewStatusMapReader(() => getAllReviewStatusesFromDb());
@@ -7732,6 +7982,6 @@ var init_review_status = __esmMin((() => {
 	});
 }));
 //#endregion
-export { synchronizeAnalyticsServices as A, reviewGatesPassedSync as B, setReviewStatusSync as C, resolvePipelineTelemetryContext as D, init_pipeline as E, telemetryEnvironmentForcesOff as F, readJournalStatus as G, findBlockingFindings as H, init_pipeline_agent_reader as I, getOverdeckAgentStateSync as J, readJournalStatusSync as K, registerPipelineTelemetryAgentReader as L, init_install_id as M, init_config as N, getAnalyticsService as O, resolveTelemetryEnabled as P, stateToOverdeckParamsForDb as Q, init_review_dispatch_decision as R, setReviewStatus as S, capturePipelineStageForIssue as T, init_review_findings as U, verificationSatisfied as V, init_review_status_record_sync as W, listOverdeckAgentStatesSync as X, init_agent_state_sync as Y, saveOverdeckAgentStateSync as Z, markWorkspaceStuck as _, clearStuckMergeStatuses as a, setAutoMerge as b, fixStuckCommentedReviews as c, getReviewStatusSync as d, getReviewStatusesSync as f, loadReviewStatusesForIssues as g, loadReviewStatuses as h, clearReviewStatus as i, getOrCreateInstallId as j, init_service as k, fixStuckReadyForMerge as l, loadReadyForMergeFlags as m, ReviewStatusError as n, clearWorkspaceStuck as o, init_review_status as p, AGENT_COLUMNS_FOR_DB as q, clearFeedbackDeliveryStuck as r, dispatchReviewHostSide as s, FEEDBACK_DELIVERY_STUCK_REASON as t, getReviewStatus as u, mergeGateEligibility as v, capturePipelineStage as w, setDeaconIgnored as x, resetPipelineVerdictsForWorkStartSync as y, needsReviewDispatch as z };
+export { listOverdeckAgentStatesSync as $, synchronizeAnalyticsServices as A, reviewGatesPassedSync as B, setReviewStatusSync as C, resolvePipelineTelemetryContext as D, init_pipeline as E, telemetryEnvironmentForcesOff as F, findWorkspaceVerdictConflicts as G, findBlockingFindings as H, init_pipeline_agent_reader as I, readJournalStatusSync as J, init_review_status_record_sync as K, registerPipelineTelemetryAgentReader as L, init_install_id as M, init_config as N, getAnalyticsService as O, resolveTelemetryEnabled as P, init_agent_state_sync as Q, init_review_dispatch_decision as R, setReviewStatus as S, capturePipelineStageForIssue as T, init_review_findings as U, verificationSatisfied as V, drainWorkspaceVerdictFallback as W, AGENT_COLUMNS_FOR_DB as X, readWorkspaceVerdictFallback as Y, getOverdeckAgentStateSync as Z, markWorkspaceStuck as _, clearStuckMergeStatuses as a, setAutoMerge as b, fixStuckCommentedReviews as c, getReviewStatusSync as d, saveOverdeckAgentStateSync as et, getReviewStatusesSync as f, loadReviewStatusesForIssues as g, loadReviewStatuses as h, clearReviewStatus as i, getOrCreateInstallId as j, init_service as k, fixStuckReadyForMerge as l, loadReadyForMergeFlags as m, ReviewStatusError as n, clearWorkspaceStuck as o, init_review_status as p, readJournalStatus as q, clearFeedbackDeliveryStuck as r, dispatchReviewHostSide as s, FEEDBACK_DELIVERY_STUCK_REASON as t, stateToOverdeckParamsForDb as tt, getReviewStatus as u, mergeGateEligibility as v, capturePipelineStage as w, setDeaconIgnored as x, resetPipelineVerdictsForWorkStartSync as y, needsReviewDispatch as z };
 
-//# sourceMappingURL=review-status-CGvlA4o_.js.map
+//# sourceMappingURL=review-status-CKLk5aZ-.js.map

package/server/{review-status-emit-DURrmGYX.js → review-status-emit-CJ7UmEVU.js}

@@ -1,5 +1,5 @@
-import { d as getReviewStatusSync, p as init_review_status } from "./review-status-CGvlA4o_.js";
-import { t as enrichReviewStatus } from "./review-status-enrichment-8NiNXi5W.js";
+import { d as getReviewStatusSync, p as init_review_status } from "./review-status-CKLk5aZ-.js";
+import { t as enrichReviewStatus } from "./review-status-enrichment-DJRgGX7-.js";
 import { Effect } from "effect";
 import { isDeepStrictEqual } from "node:util";
 //#region review-status-emit.ts
@@ -47,4 +47,4 @@ function emitReviewStatusChanged(append, issueId, status) {
 //#endregion
 export { sameCanonicalReviewStatus as n, emitReviewStatusChanged as t };
 
-//# sourceMappingURL=review-status-emit-DURrmGYX.js.map
+//# sourceMappingURL=review-status-emit-CJ7UmEVU.js.map

package/server/{review-status-enrichment-8NiNXi5W.js → review-status-enrichment-DJRgGX7-.js}

@@ -1,5 +1,5 @@
-import { Gn as init_projects, ar as resolveProjectFromIssueSync } from "./config-yaml-CxdwhAIA.js";
-import { M as listSessionNames, w as init_tmux } from "./tmux-CfDHob9M.js";
+import { Sn as resolveProjectFromIssueSync, cn as init_projects } from "./config-yaml-BSCqwmX0.js";
+import { C as init_tmux, j as listSessionNames } from "./tmux-CImZaX4q.js";
 import { Data, Effect } from "effect";
 import { existsSync } from "fs";
 import { join } from "path";
@@ -124,4 +124,4 @@ const enrichReviewStatus = (issueId, status) => Effect.tryPromise({
 //#endregion
 export { enrichReviewStatusFromSessions as n, enrichReviewStatus as t };
 
-//# sourceMappingURL=review-status-enrichment-8NiNXi5W.js.map
+//# sourceMappingURL=review-status-enrichment-DJRgGX7-.js.map