@saadnvd1/agent-os 0.3.637 → 0.3.644

package/lib/orchestrator/armed.ts

@@ -28,6 +28,7 @@ import { review } from "./review";
 import { judge, mergeJudged } from "./signoff";
 import { workspaceTask } from "./targets";
 import { markStatusDirty } from "../status/dirty";
+import { setPr } from "../db/session-parts";
 
 // Judged again at least this often, for what the fingerprint can't see.
 export const ARMED_RECHECK_MS = 5 * 60 * 1000;
@@ -35,10 +36,18 @@ export const ARMED_RECHECK_MS = 5 * 60 * 1000;
 const short = (sha: string) => sha.slice(0, 7);
 
 export function setArmed(sessionId: string, armed: boolean): void {
-  db.prepare(
-    `UPDATE sessions SET merge_armed_at = ${armed ? "COALESCE(merge_armed_at, datetime('now'))" : "NULL"},
-       merge_armed_seen = NULL WHERE id = ?`
-  ).run(sessionId);
+  db.transaction(() => {
+    const row = db
+      .prepare(`SELECT merge_armed_at FROM session_rows WHERE id = ?`)
+      .get(sessionId) as { merge_armed_at: string | null } | undefined;
+    setPr(db, sessionId, {
+      merge_armed_at: !armed
+        ? null
+        : (row?.merge_armed_at ??
+          new Date().toISOString().slice(0, 19).replace("T", " ")),
+      merge_armed_seen: null,
+    });
+  })();
   looked.delete(sessionId);
   markStatusDirty(sessionId);
   notifyStatusChanged();
@@ -57,7 +66,7 @@ export function armingWorkspace(task: Session): string | null {
 function armedTasks(workspaceId: string): Session[] {
   return db
     .prepare(
-      `SELECT s.* FROM sessions s JOIN projects p ON p.id = s.project_id
+      `SELECT s.* FROM session_rows s JOIN projects p ON p.id = s.project_id
        WHERE p.workspace_id = ? AND s.merge_armed_at IS NOT NULL
          AND s.task_status = 'running' AND s.peer_mirror = 0
          AND s.held_by_device IS NULL`
@@ -70,7 +79,7 @@ function armedTasks(workspaceId: string): Session[] {
 function stillArmed(workspaceId: string, taskId: string): boolean {
   if (isPaused(workspaceId)) return false;
   const row = db
-    .prepare(`SELECT merge_armed_at FROM sessions WHERE id = ?`)
+    .prepare(`SELECT merge_armed_at FROM session_rows WHERE id = ?`)
     .get(taskId) as { merge_armed_at: string | null } | undefined;
   return !!row?.merge_armed_at;
 }
@@ -249,17 +258,13 @@ async function mergeOne(
   const seen = `${pr.head}:${failures(verdict.text)}`;
   if (task.merge_armed_seen === seen) return;
   // Counted as sign_off would count it: once per head (the database keys
-  // it), and a gate failing on a second commit goes to Saad.
+  // it), and only a task stuck in a loop goes to Saad (loop-guard.ts).
   if (!stillArmed(workspaceId, task.id)) return;
   const counted = await deps.judge(workspaceId, task);
   if (counted.ok) return merge(workspaceId, task, counted, deps);
   const toSaad = holdingEscalations(task.id).length > 0;
   if (toSaad) setArmed(task.id, false);
-  else
-    db.prepare(`UPDATE sessions SET merge_armed_seen = ? WHERE id = ?`).run(
-      seen,
-      task.id
-    );
+  else setPr(db, task.id, { merge_armed_seen: seen });
   event(
     workspaceId,
     task,
@@ -283,10 +288,7 @@ async function merge(
     const why = error instanceof Error ? error.message : String(error);
     const seen = `${verdict.sha}:merge:${why}`;
     if (task.merge_armed_seen === seen) return;
-    db.prepare(`UPDATE sessions SET merge_armed_seen = ? WHERE id = ?`).run(
-      seen,
-      task.id
-    );
+    setPr(db, task.id, { merge_armed_seen: seen });
     event(
       workspaceId,
       task,

package/lib/orchestrator/ask-approvals.ts

@@ -76,7 +76,7 @@ export function releaseInterruptedClaims(): number {
       `UPDATE orchestrator_asks SET used_at = NULL
        WHERE status = 'approved' AND used_at IS NOT NULL
          AND COALESCE(answer, '') != 'approve (void)'
-         AND (subject IN (SELECT 'task:' || id FROM sessions WHERE task_status = 'running')
+         AND (subject IN (SELECT 'task:' || id FROM session_rows WHERE task_status = 'running')
            -- A PR no task owns: a merge that happened can't happen again.
            OR subject LIKE 'pr:%')`
     )

package/lib/orchestrator/ask-heads.ts

@@ -34,7 +34,7 @@ export async function followAskHeads(
     )
       continue;
     const task = db
-      .prepare(`SELECT * FROM sessions WHERE id = ?`)
+      .prepare(`SELECT * FROM session_rows WHERE id = ?`)
       .get(f!.id) as Session | undefined;
     if (!task || hostLink(task.host_id)) continue;
     try {

package/lib/orchestrator/ask-settle.ts

@@ -44,7 +44,7 @@ function workspaceTasks(workspaceId: string): TaskRow[] {
   return db
     .prepare(
       `SELECT s.id, s.task_status, s.pr_status, s.pr_url, s.pr_number
-       FROM sessions s JOIN projects p ON p.id = s.project_id
+       FROM session_rows s JOIN projects p ON p.id = s.project_id
        WHERE p.workspace_id = ? AND s.task_status IS NOT NULL`
     )
     .all(workspaceId) as TaskRow[];

package/lib/orchestrator/ask-verdict.ts

@@ -0,0 +1,111 @@
+// A PR the loop guard sent to Saad is still judged: the commit his ask
+// names gets the independent review it would have had, and the ask shows
+// CI and that review, so he never approves blind. His approval still
+// merges that commit once (signoff.ts); the verdict informs it, nothing more.
+
+import { getCheck, type CheckRow } from "./checks";
+import { EXTERNAL_PREFIX, openAsks, setAskVerdict, type AskRow } from "./asks";
+import { reviewTarget } from "./external-gates";
+import type { SessionFacts } from "./facts";
+import { holdingEscalations } from "./gates";
+import { APPROVAL_GATES } from "./merge-approvals";
+import { untrusted } from "./untrusted";
+import type { TaskPR } from "../tasks/state";
+
+export interface AskVerdictDeps {
+  review: (workspaceId: string, ref: string) => Promise<unknown>;
+}
+
+const defaults: AskVerdictDeps = {
+  review: (w, ref) => reviewTarget(w, ref),
+};
+
+// Asks whose review was started here, so one that couldn't start (the head
+// moved, gh failed) isn't retried every pass.
+const started = new Set<string>();
+const STARTED_MAX = 1000;
+
+const workId = (subject: string) =>
+  subject.startsWith(EXTERNAL_PREFIX)
+    ? subject
+    : subject.startsWith("task:")
+      ? subject.slice("task:".length)
+      : null;
+
+// Held by the loop guard, not only by an approval Saad asked to give.
+const loopHeld = (id: string) =>
+  holdingEscalations(id).some((h) => !APPROVAL_GATES.includes(h.gate));
+
+export async function followAskVerdicts(
+  workspaceId: string,
+  facts: SessionFacts[],
+  deps: AskVerdictDeps = defaults
+): Promise<void> {
+  for (const ask of openAsks(workspaceId)) {
+    const id = workId(ask.subject);
+    if (ask.kind !== "gate" || !ask.sha || !id || !loopHeld(id)) continue;
+    try {
+      await follow(
+        workspaceId,
+        ask as AskRow & { sha: string },
+        id,
+        facts,
+        deps
+      );
+    } catch (error) {
+      console.error(`Judging ask ${ask.id}'s commit:`, error);
+    }
+  }
+}
+
+async function follow(
+  workspaceId: string,
+  ask: AskRow & { sha: string },
+  id: string,
+  facts: SessionFacts[],
+  deps: AskVerdictDeps
+): Promise<void> {
+  const key = `${ask.id}:${ask.sha}`;
+  if (!getCheck(id, ask.sha, "review") && !started.has(key)) {
+    if (started.size >= STARTED_MAX) started.clear();
+    started.add(key);
+    await deps.review(workspaceId, id);
+  }
+  const pr = facts.find((f) => f.id === id)?.task?.pr;
+  setAskVerdict(
+    ask.id,
+    ask.sha,
+    verdictText(
+      pr?.head === ask.sha ? pr : null,
+      getCheck(id, ask.sha, "review")
+    )
+  );
+}
+
+const REVIEW_MAX = 600;
+
+export function verdictText(
+  pr: Pick<TaskPR, "checks" | "failing"> | null,
+  review: CheckRow | null
+): string {
+  const ci = !pr
+    ? null
+    : pr.checks === "pass"
+      ? "CI passed."
+      : pr.checks === "fail"
+        ? `CI failed${pr.failing ? ` (${untrusted("CI", pr.failing)})` : ""}.`
+        : pr.checks === "pending"
+          ? "CI is running."
+          : "No CI checks.";
+  const detail = (review?.detail ?? "").slice(0, REVIEW_MAX);
+  const said = !review
+    ? "Independent review: not started yet."
+    : review.status === "running"
+      ? "Independent review: running."
+      : review.status === "error"
+        ? `Independent review: couldn't run (${detail}).`
+        : review.status === "pass"
+          ? "Independent review: passed."
+          : `Independent review: blocking findings.\n${untrusted("reviewer", detail)}`;
+  return [ci, said].filter(Boolean).join(" ");
+}

package/lib/orchestrator/asks.ts

@@ -397,3 +397,29 @@ export function moveAskHead(
       .run(to, detail, id, from).changes === 1
   );
 }
+
+// The gates' verdict on the commit an ask names (ask-verdict.ts), kept as
+// the detail's last section and rewritten as it changes. Only while the ask
+// still names `sha`. Returns whether it changed.
+const VERDICT_AT = /\n?Gates at [0-9a-f]{7}: /;
+export const VERDICT_MAX = 800;
+
+export function setAskVerdict(id: number, sha: string, text: string): boolean {
+  const ask = db
+    .prepare(`SELECT detail FROM orchestrator_asks WHERE id = ?`)
+    .get(id) as { detail: string } | undefined;
+  if (!ask) return false;
+  const section = `Gates at ${sha.slice(0, 7)}: ${text}`.slice(0, VERDICT_MAX);
+  const rest = ask.detail.split(VERDICT_AT)[0];
+  const detail =
+    `${rest.slice(0, Math.max(0, MAX_DETAIL - section.length - 1))}\n${section}`.trim();
+  if (detail === ask.detail) return false;
+  return (
+    db
+      .prepare(
+        `UPDATE orchestrator_asks SET detail = ?
+         WHERE id = ? AND status = 'open' AND sha = ?`
+      )
+      .run(detail, id, sha).changes === 1
+  );
+}

package/lib/orchestrator/brakes.ts

@@ -81,7 +81,7 @@ export async function runningCount(
   // minutes, here or there: it holds its slot.
   const moving = db
     .prepare(
-      `SELECT s.id FROM sessions s JOIN projects p ON p.id = s.project_id
+      `SELECT s.id FROM session_rows s JOIN projects p ON p.id = s.project_id
        WHERE p.workspace_id = ? AND s.task_status = 'moving' AND s.peer_mirror = 0`
     )
     .all(workspaceId) as { id: string }[];

package/lib/orchestrator/brief.ts

@@ -1,3 +1,4 @@
+import { LOOP_GUARD_COMMITS } from "./loop-guard";
 import { db, type Project, type Session } from "../db";
 import { getDefaultBranch } from "../git";
 import { getWorkspace } from "../workspaces";
@@ -78,7 +79,7 @@ When the base moves and a task's PR conflicts with it, AgentOS rebases it onto t
 
 Tasks are woken by AgentOS itself when a check fails on their PR's head (with the failing step and the log around the error) and when a collaborator reviews or comments on their PR, and you get one "task X woken: ..." line for each. Don't message a task about the same failure or review; act only if it doesn't fix it.
 
-"Not yet" (CI running or settling, no review of this commit yet) is not a failure: wait for the event and try again. A failure counts against the task once per commit, whichever path judges that commit and however often (a review that blocks counts when its verdict arrives); the same gate failing again on a different commit goes to Saad, with a note in your chat, and from then on only he merges or drops that task. Don't retry it; say so in your chat and move on. ${mergeApprovalsOn() ? APPROVALS_ON : APPROVALS_OFF} \`land\` merges a whole stack only if every open item passes the same gates, and judges each one again at its own head right before merging it.
+"Not yet" (CI running or settling, no review of this commit yet) is not a failure: wait for the event and try again. A failure counts against the task once per commit, whichever path judges that commit and however often (a review that blocks counts when its verdict arrives). A failure is the task's to fix: have it fix the finding and push; every new head is judged afresh (CI, a new review, scope), and an armed task stays armed and merges by itself once a head passes. Only a loop goes to Saad (the loop guard): the same gate failing on ${LOOP_GUARD_COMMITS} commits in a row, or failing the same way (same CI job and failing tests, same blocking findings) on two commits in a row. Then it's with him, with a note in your chat: from then on only he merges or drops that task, and his ask shows CI and a fresh review of the commit he'd approve. Don't retry it; say so in your chat and move on. ${mergeApprovalsOn() ? APPROVALS_ON : APPROVALS_OFF} \`land\` merges a whole stack only if every open item passes the same gates, and judges each one again at its own head right before merging it.
 
 ${noApprovalsOn() ? NO_APPROVALS : ""}## Brakes
 

package/lib/orchestrator/digest.ts

@@ -167,7 +167,7 @@ function tasksSection(
     .prepare(
       `SELECT s.id, s.name, p.name AS project, s.pr_number, s.pr_status, s.view,
          s.merge_armed_at AS armed_at, s.pause_state, s.paused_until, s.pause_note, s.placed_note
-       FROM sessions s JOIN projects p ON p.id = s.project_id
+       FROM session_rows s JOIN projects p ON p.id = s.project_id
        WHERE p.workspace_id = ? AND s.role IS NULL AND s.archived_at IS NULL
          AND s.task_status = 'running'
        ORDER BY s.created_at, s.id`
@@ -223,7 +223,7 @@ function queueSection(workspaceId: string): Section {
             AND b.held_queued = 1 AND b.delivered_at IS NULL AND b.read_at IS NULL) AS held,
          p.name AS project, a.name AS after_name
        FROM task_queue q JOIN projects p ON p.id = q.project_id
-       LEFT JOIN sessions a ON a.id = q.after_task
+       LEFT JOIN session_rows a ON a.id = q.after_task
        WHERE p.workspace_id = ? AND q.status IN ('queued', 'starting', 'failed')
        ORDER BY q.position`
     )

package/lib/orchestrator/escalate.ts

@@ -4,13 +4,13 @@
 
 import { AskRefused, EXTERNAL_PREFIX, raiseAsk, workSubject } from "./asks";
 import {
-  failedTwiceWhy,
   failureOf,
   holdAsk,
   markEscalated,
   recordFailure,
   type GateOutcome,
 } from "./gates";
+import { LOOP_GUARD_COMMITS, stuckBy, stuckWhy } from "./loop-guard";
 import { addNote } from "./notes";
 
 // Puts the ask on Saad's list (or notes why it couldn't be).
@@ -61,7 +61,7 @@ export function escalate(
 ): string {
   if (!failureOf(task.id, gate))
     recordFailure(workspaceId, task.id, gate, why, sha);
-  markEscalated(task.id, gate);
+  markEscalated(task.id, gate, why);
   if (opts.hold) {
     holdAsk(task.id, gate);
     return `Escalated to Saad: ${why}. His ask goes up once ${task.name}'s agent is idle and CI has settled on its latest head, so it names the commit he'd merge; his answer reaches you as an event. Don't retry; say so in your chat.`;
@@ -70,23 +70,36 @@ export function escalate(
   return `Escalated to Saad: ${why}. It's on his asks list; his answer reaches you as an event. Don't retry; say so in your chat.`;
 }
 
-// Counts a gate's failure on this head against the task; the same gate
-// failing on a second, different head goes to Saad (a task's ask held until
-// its agent is done; a PR no task owns has no agent to wait for). The same head judged
-// again, from any path, isn't another failure.
+// Counts a gate's failure on this head against the task. A failure is the
+// task's to fix, head after head; only a loop goes to Saad (loop-guard.ts):
+// a task's ask held until its agent is done, a PR no task owns has no agent
+// to wait for. The same head judged again, from any path, isn't another
+// failure.
 export function countFailure(
   workspaceId: string,
   task: { id: string; name: string },
   o: GateOutcome,
   url: string,
   sha: string,
-  opts: { hold?: boolean } = {}
+  opts: { hold?: boolean; signature?: string | null } = {}
 ): { line: string; escalated: boolean } {
-  const n = recordFailure(workspaceId, task.id, o.gate, o.reason ?? "", sha);
-  const line = `- ${o.gate} failed (${n === 1 ? "first" : "again"}): ${o.reason}`;
-  if (n < 2 || failureOf(task.id, o.gate)?.escalated_at)
-    return { line, escalated: false };
-  const why = failedTwiceWhy(o.gate, o.reason ?? "");
+  recordFailure(
+    workspaceId,
+    task.id,
+    o.gate,
+    o.reason ?? "",
+    sha,
+    opts.signature ?? null
+  );
+  const row = failureOf(task.id, o.gate)!;
+  const nth =
+    row.streak <= 1
+      ? "first"
+      : `again, ${row.streak} of ${LOOP_GUARD_COMMITS} in a row`;
+  const line = `- ${o.gate} failed (${nth}): ${o.reason}`;
+  const by = row.escalated_at ? null : stuckBy(row);
+  if (!by) return { line, escalated: false };
+  const why = stuckWhy(task.id, row, by);
   return {
     line: `${line}\n  ${escalate(workspaceId, task, o.gate, why, url, sha, { hold: opts.hold ?? !task.id.startsWith(EXTERNAL_PREFIX) })}`,
     escalated: true,

package/lib/orchestrator/external-gates.ts

@@ -69,6 +69,7 @@ export async function judgeExternal(
       return {
         checks: pr.checks,
         failing: pr.failing,
+        failingUrl: pr.failingUrl,
         settleIn: ciSettleIn({
           workspaceId,
           taskId: ext.id,

package/lib/orchestrator/external-pr.ts

@@ -94,7 +94,7 @@ const unique = (repos: WorkspaceRepo[]) => [
 function tasksWithPR(workspaceId: string, ref: PRRef): WorkspaceTask[] {
   const rows = db
     .prepare(
-      `SELECT s.*, p.name AS project_name FROM sessions s
+      `SELECT s.*, p.name AS project_name FROM session_rows s
        JOIN projects p ON p.id = s.project_id
        WHERE p.workspace_id = ? AND s.pr_number = ? AND s.task_status IS NOT NULL
        ORDER BY s.created_at DESC`
@@ -125,7 +125,7 @@ async function ownerOf(
     .prepare(
       `SELECT s.*, p.name AS project_name, p.workspace_id AS owner_workspace,
          p.working_directory AS project_dir, p.host_id AS project_host
-       FROM sessions s JOIN projects p ON p.id = s.project_id
+       FROM session_rows s JOIN projects p ON p.id = s.project_id
        WHERE s.task_status IS NOT NULL
          AND (s.pr_number = ? OR (s.branch_name = ? AND s.task_status IN ('running', 'moving', 'moved')))
        ORDER BY s.created_at DESC`

package/lib/orchestrator/facts.ts

@@ -7,7 +7,7 @@
 
 import { db, type Session, type StackItemStatus } from "../db";
 import { statusDetector } from "../status-detector";
-import { cleanRemoteText, hostLink } from "../hosts/remote-api";
+import { hostLink } from "../hosts/remote-api";
 import { peerStatus } from "../hosts/peer-sessions";
 import { chatCompacting, chatState } from "../chat/runner";
 import { chatActivityLine, chatStall, type Stall } from "../chat/activity";
@@ -18,14 +18,13 @@ import { sessionRowInfo } from "../session-meta";
 import { taskView, type TaskPR, type TaskState } from "../tasks";
 import { prFor, storedPR } from "../tasks/session";
 import { lastActiveOf } from "../tasks/last-active";
-import { hostTasks } from "../tasks/remote";
+import * as taskClient from "../tasks/contract/client";
 import { deriveTaskState } from "../tasks";
 import { waitingState } from "./task-state";
 import { commitTime, repoOf } from "./repo";
 import { CHECKLESS_MS, checklessFor, ciSettleIn } from "./task-state";
 import { repoHasCI } from "./repo-ci";
 import { markStatusDirty } from "../status/dirty";
-import { queueEvent } from "./events";
 
 export type FactStatus = "running" | "waiting" | "idle" | "dead";
 
@@ -85,7 +84,7 @@ export function workspaceSessions(
 ): (Session & { project_name: string })[] {
   return db
     .prepare(
-      `SELECT s.*, p.name AS project_name FROM sessions s
+      `SELECT s.*, p.name AS project_name FROM session_rows s
        JOIN projects p ON p.id = s.project_id
        WHERE p.workspace_id = ? AND s.role IS NULL AND s.archived_at IS NULL
          -- A linked machine's own sessions are its orchestrator's to run.
@@ -271,7 +270,6 @@ async function remoteTaskFacts(
     prFor(s).catch(() => null),
     waitingState(s),
   ]);
-  await announceRemotePlan(workspaceId, s);
   const status = peerStatus(s.host_id, s.id) ?? "running";
   const state = deriveTaskState({
     taskStatus: "running",
@@ -288,34 +286,12 @@ async function remoteTaskFacts(
   };
 }
 
-// The plan-written line a held task stored on its machine (plan-step.ts),
-// once per distinct plan: the mirror keeps the last one it told about.
-async function announceRemotePlan(
-  workspaceId: string,
-  s: Session
-): Promise<void> {
-  const link = hostLink(s.host_id);
-  if (!link) return;
-  const view = await hostTasks(link)
-    .then(({ tasks }) => tasks.find((t) => t?.id === s.id))
-    .catch(() => undefined);
-  const note =
-    typeof view?.planNote === "string"
-      ? cleanRemoteText(view.planNote).slice(0, 2000)
-      : "";
-  if (!note || note === s.plan_note) return;
-  db.prepare(`UPDATE sessions SET plan_note = ? WHERE id = ?`).run(note, s.id);
-  queueEvent(workspaceId, `plan-done:${s.id}`, s.id, note);
-}
-
 // A task on another machine is as active as that machine says; one it can't
 // reach is taken as active just now, so nothing reads it as abandoned.
 async function lastActiveFor(s: Session): Promise<number> {
   const link = hostLink(s.host_id);
   if (!link) return lastActiveOf(s);
-  const view = await hostTasks(link)
-    .then(({ tasks }) => tasks.find((t) => t?.id === s.id))
-    .catch(() => undefined);
+  const view = await taskClient.view(link, s.id).catch(() => undefined);
   return typeof view?.lastActiveAt === "number"
     ? view.lastActiveAt
     : Date.now();

package/lib/orchestrator/gates.ts

@@ -2,13 +2,11 @@
  * The merge gates, ported from dispatch orchestrate. Each one passes, waits
  * (not ready yet: CI running or settling, no review of this commit yet),
  * fails, or goes straight to Saad (the repository has no CI at all, never
- * just a head with no checks). Only a failure counts
- * against the task, and a gate failing again on a different commit goes to
- * Saad instead of being retried. A failure counts once per task, gate and
- * head commit, whichever path judged it (the armed watcher, CI finishing,
- * sign_off, done, land, a review's verdict arriving): judging the same head
- * again is never another failure. A pass doesn't reset the count, so a gate
- * that fails on A, passes on B and fails on C has failed twice.
+ * just a head with no checks). Only a failure counts against the task, once
+ * per task, gate and head commit, whichever path judged it (the armed
+ * watcher, CI finishing, sign_off, done, land, a review's verdict arriving):
+ * judging the same head again is never another failure. Every new head is
+ * judged afresh; only a task stuck in a loop goes to Saad (loop-guard.ts).
  */
 
 import { db } from "../db";
@@ -38,6 +36,8 @@ export interface GateInput {
   sha: string;
   checks: ChecksVerdict;
   failing?: string | null;
+  // The failing check's details page, for its log (loop-guard.ts).
+  failingUrl?: string | null;
   // Seconds until CI on this commit counts as settled (tasks/task-state).
   settleIn: number;
   // GitHub's word on merging the PR into its base, and that base's name.
@@ -217,22 +217,31 @@ export interface FailureRow {
   last_sha: string | null;
   // Set while the escalation's ask waits for the agent to finish (held-asks.ts).
   ask_held_at: string | null;
+  // Commits in a row this gate failed on, since it last passed.
+  streak: number;
+  last_signature: string | null;
+  // 1 when the last failure's signature equals the one before it.
+  repeated: number;
+  // Why it went to Saad, as his ask says it.
+  escalated_why: string | null;
 }
 
 // Counts one failure; returns the count now. With `sha`, a failure is
 // counted once per commit: the (task, gate, sha) key in
 // orchestrator_gate_failure_commits decides, so neither a restart nor two
-// evaluations at once count the same head twice.
+// evaluations at once count the same head twice. `signature` is what the
+// loop guard compares between consecutive failures (loop-guard.ts).
 export function recordFailure(
   workspaceId: string,
   sessionId: string,
   gate: string,
   reason: string,
-  sha: string | null = null
+  sha: string | null = null,
+  signature: string | null = null
 ): number {
   return db
     .transaction(countOnce)
-    .immediate(workspaceId, sessionId, gate, reason, sha);
+    .immediate(workspaceId, sessionId, gate, reason, sha, signature);
 }
 
 function countOnce(
@@ -240,28 +249,87 @@ function countOnce(
   sessionId: string,
   gate: string,
   reason: string,
-  sha: string | null
+  sha: string | null,
+  signature: string | null
 ): number {
   const fresh =
     sha === null ||
     db
       .prepare(
-        `INSERT OR IGNORE INTO orchestrator_gate_failure_commits (session_id, gate, sha, workspace_id, reason)
-           VALUES (?, ?, ?, ?, ?)`
+        `INSERT OR IGNORE INTO orchestrator_gate_failure_commits (session_id, gate, sha, workspace_id, reason, signature)
+           VALUES (?, ?, ?, ?, ?, ?)`
       )
-      .run(sessionId, gate, sha, workspaceId, reason).changes > 0;
+      .run(sessionId, gate, sha, workspaceId, reason, signature).changes > 0;
+  // Every SET reads the row as it was before this update.
   db.prepare(
-    `INSERT INTO orchestrator_gate_failures (session_id, gate, workspace_id, count, last_reason, last_sha)
-       VALUES (?, ?, ?, 1, ?, ?)
+    `INSERT INTO orchestrator_gate_failures (session_id, gate, workspace_id, count, last_reason, last_sha, streak, last_signature, repeated)
+       VALUES (@session, @gate, @workspace, 1, @reason, @sha, 1, @signature, 0)
        ON CONFLICT(session_id, gate) DO UPDATE SET
-         count = count + ?,
+         count = count + @fresh,
          last_reason = excluded.last_reason,
-         last_sha = excluded.last_sha`
-  ).run(sessionId, gate, workspaceId, reason, sha, fresh ? 1 : 0);
+         last_sha = excluded.last_sha,
+         streak = streak + @fresh,
+         repeated = CASE WHEN @fresh = 1
+           THEN (streak > 0 AND excluded.last_signature IS NOT NULL AND last_signature IS excluded.last_signature)
+           ELSE repeated END,
+         last_signature = CASE WHEN @fresh = 1 THEN excluded.last_signature ELSE last_signature END`
+  ).run({
+    session: sessionId,
+    gate,
+    workspace: workspaceId,
+    reason,
+    sha,
+    signature,
+    fresh: fresh ? 1 : 0,
+  });
   markStatusDirty(sessionId);
   return failureOf(sessionId, gate)!.count;
 }
 
+// The gate passed at a head: the next failure starts a new streak. An
+// escalated gate keeps its record; Saad has it.
+export function recordPass(sessionId: string, gate: string): void {
+  db.prepare(
+    `UPDATE orchestrator_gate_failures SET streak = 0, last_signature = NULL, repeated = 0
+     WHERE session_id = ? AND gate = ? AND escalated_at IS NULL AND streak > 0`
+  ).run(sessionId, gate);
+}
+
+// Whether this head's failure of the gate is already counted.
+export function failureCounted(
+  sessionId: string,
+  gate: string,
+  sha: string
+): boolean {
+  return !!db
+    .prepare(
+      `SELECT 1 FROM orchestrator_gate_failure_commits WHERE session_id = ? AND gate = ? AND sha = ?`
+    )
+    .get(sessionId, gate, sha);
+}
+
+export interface CommitFailure {
+  sha: string;
+  reason: string | null;
+  signature: string | null;
+}
+
+// The gate's latest `n` failed commits, oldest first.
+export function lastFailures(
+  sessionId: string,
+  gate: string,
+  n: number
+): CommitFailure[] {
+  return (
+    db
+      .prepare(
+        `SELECT sha, reason, signature FROM orchestrator_gate_failure_commits
+         WHERE session_id = ? AND gate = ? ORDER BY rowid DESC LIMIT ?`
+      )
+      .all(sessionId, gate, n) as CommitFailure[]
+  ).reverse();
+}
+
 export function failureOf(sessionId: string, gate: string): FailureRow | null {
   return (
     (db
@@ -272,10 +340,14 @@ export function failureOf(sessionId: string, gate: string): FailureRow | null {
   );
 }
 
-export function markEscalated(sessionId: string, gate: string): void {
+export function markEscalated(
+  sessionId: string,
+  gate: string,
+  why: string | null = null
+): void {
   db.prepare(
-    `UPDATE orchestrator_gate_failures SET escalated_at = datetime('now') WHERE session_id = ? AND gate = ?`
-  ).run(sessionId, gate);
+    `UPDATE orchestrator_gate_failures SET escalated_at = datetime('now'), escalated_why = ? WHERE session_id = ? AND gate = ?`
+  ).run(why, sessionId, gate);
   markStatusDirty(sessionId);
 }
 
@@ -300,9 +372,6 @@ export function heldAskFailures(workspaceId: string): FailureRow[] {
     .all(workspaceId) as FailureRow[];
 }
 
-export const failedTwiceWhy = (gate: string, reason: string) =>
-  `the ${gate} gate failed on two different commits: ${reason}`;
-
 export function escalations(sessionId: string): FailureRow[] {
   return db
     .prepare(