@saadnvd1/agent-os 0.3.639 → 0.3.644

package/lib/db/migrations/20261015T1830_drop_moved_session_columns.ts

@@ -0,0 +1,173 @@
+import type { Migration } from "../migration-types";
+import type { PartTable } from "../session-parts/columns";
+import { createSessionRowsView } from "../session-parts/view";
+import { backupDatabase } from "../backup";
+
+// The moved columns as 20261015T1800 split them, frozen here.
+const PARTS: Record<PartTable, string[]> = {
+  session_tasks: [
+    "task_prompt",
+    "task_brief",
+    "task_status",
+    "task_since",
+    "task_ended_at",
+    "merged_at",
+    "priority",
+    "quick_of",
+    "moved_to",
+    "moved_from",
+    "model_overrides",
+    "lh_card_id",
+    "lh_board_id",
+    "lh_card_list",
+  ],
+  session_prs: [
+    "pr_url",
+    "pr_number",
+    "pr_status",
+    "merge_armed_at",
+    "merge_armed_seen",
+    "rebased_from",
+    "rebased_to",
+    "rebase_asked_head",
+    "pr_wake_since",
+  ],
+  session_plans: [
+    "plan_phase",
+    "plan_only",
+    "plan_decided",
+    "plan_reason",
+    "plan_note",
+    "plan_edits",
+    "plan_waits_for_caller",
+    "plan_handoff_message",
+  ],
+  session_placement: [
+    "peer_mirror",
+    "placed_note",
+    "held_by_device",
+    "held_from",
+    "held_for",
+    "held_for_name",
+    "started_by_device",
+  ],
+  session_pauses: ["pause_state", "paused_until", "pause_id", "pause_note"],
+};
+
+const hasValue = (prefix: string, column: string) =>
+  column === "peer_mirror"
+    ? `COALESCE(${prefix}.${column}, 0) != 0`
+    : `${prefix}.${column} IS NOT NULL`;
+
+// A value in the part table wins (it is the newer write); one only on
+// sessions is carried over.
+const carried = (table: string, column: string) =>
+  column === "peer_mirror"
+    ? `MAX(COALESCE(${table}.${column}, 0), COALESCE(s.${column}, 0))`
+    : `COALESCE(${table}.${column}, s.${column})`;
+
+export default {
+  key: "20261015T1830_drop_moved_session_columns",
+  up: (db) => {
+    // The destructive half of the split (docs/decisions/2026-10-15-split-sessions-table.md):
+    // the 42 moved columns leave sessions. A full copy of the database comes
+    // first, and nothing changes unless it was written. Every value still only
+    // on sessions is carried into its table before the columns go.
+    const parts = Object.entries(PARTS) as [PartTable, string[]][];
+    const remaining = () => {
+      const onSessions = new Set(
+        (
+          db.prepare(`PRAGMA table_info(sessions)`).all() as { name: string }[]
+        ).map((c) => c.name)
+      );
+      return parts.flatMap(([, cs]) => cs).filter((c) => onSessions.has(c));
+    };
+    if (remaining().length === 0) return;
+
+    const sessions = (
+      db.prepare(`SELECT COUNT(*) AS n FROM sessions`).get() as { n: number }
+    ).n;
+    // An empty sessions table holds nothing these columns could lose.
+    if (sessions > 0) backupDatabase(db, "drop-moved-session-columns");
+
+    // Immediate, and re-read inside: another process opening the same
+    // database may have run this between the check and the lock.
+    db.transaction(() => {
+      const left = remaining();
+      if (left.length === 0) return;
+      for (const [table, all] of parts) {
+        const columns = all.filter((c) => left.includes(c));
+        if (columns.length === 0) continue;
+        db.exec(
+          `INSERT INTO ${table} (session_id, ${columns.join(", ")})
+           SELECT s.id, ${columns.map((c) => `s.${c}`).join(", ")}
+             FROM sessions s
+            WHERE (${columns.map((c) => hasValue("s", c)).join(" OR ")})
+              AND NOT EXISTS (SELECT 1 FROM ${table} p WHERE p.session_id = s.id)`
+        );
+        db.exec(
+          `UPDATE ${table} SET
+             ${columns.map((c) => `${c} = ${carried(table, c)}`).join(",\n             ")}
+             FROM sessions s WHERE s.id = ${table}.session_id`
+        );
+        db.exec(`DROP TRIGGER IF EXISTS ${table}_from_sessions_ins`);
+        db.exec(`DROP TRIGGER IF EXISTS ${table}_from_sessions_upd`);
+      }
+
+      // merged_at and task_ended_at are stamped where task_status now lives.
+      // A first write of a status inserts the row; a later one updates it.
+      db.exec(`DROP TRIGGER IF EXISTS sessions_task_ended_at`);
+      db.exec(`DROP TRIGGER IF EXISTS sessions_merged_at`);
+      db.exec(`
+        CREATE TRIGGER IF NOT EXISTS session_tasks_ended_at_upd
+          AFTER UPDATE OF task_status ON session_tasks
+          WHEN NEW.task_status IN ('dropped', 'done')
+            AND OLD.task_status IS NOT NEW.task_status
+            AND NEW.task_ended_at IS OLD.task_ended_at
+        BEGIN
+          UPDATE session_tasks SET task_ended_at = datetime('now')
+           WHERE session_id = NEW.session_id;
+        END
+      `);
+      db.exec(`
+        CREATE TRIGGER IF NOT EXISTS session_tasks_ended_at_ins
+          AFTER INSERT ON session_tasks
+          WHEN NEW.task_status IN ('dropped', 'done')
+            AND NEW.task_ended_at IS NULL
+        BEGIN
+          UPDATE session_tasks SET task_ended_at = datetime('now')
+           WHERE session_id = NEW.session_id;
+        END
+      `);
+      db.exec(`
+        CREATE TRIGGER IF NOT EXISTS session_tasks_merged_at_upd
+          AFTER UPDATE OF task_status ON session_tasks
+          WHEN NEW.task_status = 'merged' AND OLD.task_status IS NOT 'merged'
+            -- unless the same statement set it (an import keeps its own)
+            AND NEW.merged_at IS OLD.merged_at
+        BEGIN
+          UPDATE session_tasks SET merged_at = datetime('now')
+           WHERE session_id = NEW.session_id;
+        END
+      `);
+      db.exec(`
+        CREATE TRIGGER IF NOT EXISTS session_tasks_merged_at_ins
+          AFTER INSERT ON session_tasks
+          WHEN NEW.task_status = 'merged' AND NEW.merged_at IS NULL
+        BEGIN
+          UPDATE session_tasks SET merged_at = datetime('now')
+           WHERE session_id = NEW.session_id;
+        END
+      `);
+
+      db.exec(`DROP VIEW IF EXISTS session_rows`);
+      db.exec(`DROP INDEX IF EXISTS idx_sessions_task_status`);
+      db.exec(`DROP INDEX IF EXISTS idx_sessions_moved_from`);
+      db.exec(`DROP INDEX IF EXISTS idx_sessions_quick_of`);
+      for (const column of left)
+        db.exec(`ALTER TABLE sessions DROP COLUMN ${column}`);
+
+      createSessionRowsView(db, PARTS);
+    }).immediate();
+  },
+} satisfies Migration;

package/lib/db/migrations/20261015T1900_worktree_sweep.ts

@@ -0,0 +1,30 @@
+import type { Migration } from "../migration-types";
+
+export default {
+  key: "20261015T1900_worktree_sweep",
+  up: (db) => {
+    // One row per clean-up run, kept for good, with what it removed and
+    // skipped as JSON; and which sessions' worktrees a run removed, so a
+    // restore can say so. Additive.
+    db.exec(`
+      CREATE TABLE IF NOT EXISTS worktree_sweep_runs (
+        id INTEGER PRIMARY KEY AUTOINCREMENT,
+        started_at TEXT NOT NULL DEFAULT (datetime('now')),
+        finished_at TEXT,
+        dry_run INTEGER NOT NULL DEFAULT 0,
+        removed INTEGER NOT NULL DEFAULT 0,
+        freed_bytes INTEGER NOT NULL DEFAULT 0,
+        skipped INTEGER NOT NULL DEFAULT 0,
+        details TEXT,
+        error TEXT
+      );
+      CREATE TABLE IF NOT EXISTS session_worktree_sweeps (
+        session_id TEXT PRIMARY KEY,
+        path TEXT NOT NULL,
+        branch TEXT,
+        swept_at TEXT NOT NULL DEFAULT (datetime('now')),
+        run_id INTEGER
+      );
+    `);
+  },
+} satisfies Migration;

package/lib/db/migrations/README.md

@@ -35,8 +35,12 @@ export default {
   again.
 - Adding a column to `sessions`? `session_rows` (the view that reads a session
   with its columns from the tables they moved to) lists the columns at the time
-  it was built. Add the name to `SESSION_ROW_COLUMNS` in
+  it was built, in the order of `SESSION_ROW_COLUMNS`. Add the name to `SESSION_ROW_COLUMNS` in
   `lib/db/session-parts/columns.ts` and call `createSessionRowsView(db)` after
   the `ALTER`; `lib/db/split-sessions-migration.test.ts` fails if the view and
-  the table disagree. Columns that belong to a group go in `PART_COLUMNS` and a
-  new migration for that table instead.
+  the table disagree.
+  Columns that belong to a group go in `PART_COLUMNS` and a new migration for
+  that table instead.
+- A destructive step (dropping a column or table) takes a full copy first:
+  `backupDatabase` in `lib/db/backup.ts` (`VACUUM INTO` under
+  `~/.agent-os/backups/`), and throws so the migration stops if it can't.

package/lib/db/session-parts/columns.ts

@@ -84,9 +84,9 @@ export const isMovedColumn = (column: string): boolean =>
 export const partOf = (column: string): PartTable | undefined =>
   partOfColumn.get(column);
 
-// Every column of the sessions table, in order: the shape of a session row
-// and of `session_rows`. A migration that adds a sessions column adds it here
-// and rebuilds the view (createSessionRowsView).
+// The shape of a session row and of `session_rows`, in order: the sessions
+// columns and the moved ones where they always stood. A migration that adds a
+// sessions column adds it here and rebuilds the view (createSessionRowsView).
 export const SESSION_ROW_COLUMNS: readonly string[] = [
   "id",
   "name",

package/lib/db/session-parts/index.ts

@@ -7,3 +7,4 @@ export { setPlan, advancePlan } from "./plans";
 export { setPlacement } from "./placement";
 export { setPause } from "./pauses";
 export { fillMissing } from "./fill";
+export { insertSessionRow, updateSessionRow } from "./rows";

package/lib/db/session-parts/rows.ts

@@ -0,0 +1,69 @@
+import type Database from "better-sqlite3";
+import { PART_TABLES, partOf, type PartTable } from "./columns";
+import { writePart } from "./write";
+
+type Value = string | number | null | undefined;
+
+function split(row: Record<string, Value>) {
+  const own: Record<string, Value> = {};
+  const parts = new Map<PartTable, Record<string, Value>>();
+  for (const [column, value] of Object.entries(row)) {
+    if (value === undefined) continue;
+    const table = partOf(column);
+    if (!table) own[column] = value;
+    else parts.set(table, { ...parts.get(table), [column]: value });
+  }
+  return { own, parts };
+}
+
+const writeParts = (
+  db: Database.Database,
+  id: string,
+  parts: Map<PartTable, Record<string, Value>>
+) => {
+  for (const table of PART_TABLES) {
+    const patch = parts.get(table);
+    if (patch) writePart(db, table, id, patch as never);
+  }
+};
+
+// A session row in its flat shape (sessions columns and moved ones together),
+// written to sessions and the part tables. A moved column left null or unset
+// makes no part row. For seeds, imports and tests.
+export function insertSessionRow(
+  db: Database.Database,
+  row: Record<string, Value> & { id: string }
+): void {
+  const { own, parts } = split(row);
+  for (const [table, patch] of parts) {
+    for (const [c, v] of Object.entries(patch))
+      if (v === null || (c === "peer_mirror" && v === 0)) delete patch[c];
+    if (Object.keys(patch).length === 0) parts.delete(table);
+  }
+  const columns = Object.keys(own);
+  db.transaction(() => {
+    db.prepare(
+      `INSERT INTO sessions (${columns.join(", ")})
+       VALUES (${columns.map((c) => `@${c}`).join(", ")})`
+    ).run(own);
+    writeParts(db, row.id, parts);
+  })();
+}
+
+// Updates any of a session's columns by name, wherever each one lives.
+export function updateSessionRow(
+  db: Database.Database,
+  id: string,
+  patch: Record<string, Value>
+): void {
+  const { own, parts } = split(patch);
+  const columns = Object.keys(own);
+  db.transaction(() => {
+    if (columns.length > 0)
+      db.prepare(
+        `UPDATE sessions SET ${columns.map((c) => `${c} = @${c}`).join(", ")}
+          WHERE id = @__id`
+      ).run({ ...own, __id: id });
+    writeParts(db, id, parts);
+  })();
+}

package/lib/db/session-parts/view.ts

@@ -1,5 +1,5 @@
 import type Database from "better-sqlite3";
-import { PART_COLUMNS, type PartTable } from "./columns";
+import { PART_COLUMNS, SESSION_ROW_COLUMNS, type PartTable } from "./columns";
 
 const ALIAS: Record<PartTable, string> = {
   session_tasks: "t",
@@ -9,11 +9,12 @@ const ALIAS: Record<PartTable, string> = {
   session_pauses: "pa",
 };
 
-// `session_rows`: the sessions table with each moved column read from its own
-// table, under the same names and in the same order, so a row is the flat
-// session it always was. A column with a default on sessions
-// (peer_mirror) keeps it. Rebuild it in any migration that adds a sessions
-// column. `parts` is the split as that migration knew it.
+// `session_rows`: a session with each moved column read from its own table,
+// in the order of SESSION_ROW_COLUMNS (the flat shape a session row always
+// had). A column with a default (peer_mirror) keeps it. Rebuild it in any
+// migration that adds a sessions column. `parts` is the split as that
+// migration knew it; a column on both sessions and a part (before the old
+// columns were dropped) is read from the part.
 export function createSessionRowsView(
   db: Database.Database,
   parts: Record<PartTable, readonly string[]> = PART_COLUMNS
@@ -24,7 +25,13 @@ export function createSessionRowsView(
   const sessionColumns = (
     db.prepare(`PRAGMA table_info(sessions)`).all() as { name: string }[]
   ).map((c) => c.name);
-  const select = sessionColumns
+  const onSessions = new Set(sessionColumns);
+  const known = new Set(SESSION_ROW_COLUMNS);
+  const names = [
+    ...SESSION_ROW_COLUMNS.filter((c) => source.has(c) || onSessions.has(c)),
+    ...sessionColumns.filter((c) => !known.has(c)),
+  ];
+  const select = names
     .map((c) => {
       const alias = source.get(c);
       if (!alias) return `s.${c}`;

package/lib/db/session-parts/write.ts

@@ -15,12 +15,9 @@ const sameAs = (current: unknown, wanted: Value | readonly Value[]): boolean =>
     (w) => (current ?? null) === w
   );
 
-// The one writer of the part tables. Writes the patched columns to the part
-// table, then mirrors the same values onto the legacy sessions columns, which
-// stay until they are dropped (docs/decisions/2026-10-15-split-sessions-table.md):
-// that UPDATE is the only dual-write, and the step that drops the columns
-// deletes it. Returns whether it wrote (false: the session is gone or `when`
-// no longer holds).
+// The one writer of the part tables: writes the patched columns to the part
+// table (docs/decisions/2026-10-15-split-sessions-table.md). Returns whether
+// it wrote (false: the session is gone or `when` no longer holds).
 export function writePart<T extends PartTable>(
   db: Database.Database,
   table: T,
@@ -58,12 +55,7 @@ export function writePart<T extends PartTable>(
            ${columns.map((c) => `${c} = excluded.${c}`).join(", ")}`
       )
       .run(values);
-    if (inserted.changes === 0) return false;
-    db.prepare(
-      `UPDATE sessions SET ${columns.map((c) => `${c} = @${c}`).join(", ")}
-        WHERE id = @id`
-    ).run(values);
-    return true;
+    return inserted.changes > 0;
   });
   return run();
 }

package/lib/done/remote.ts

@@ -4,9 +4,8 @@
 
 import type { Session } from "../db";
 import type { TaskPR } from "../tasks";
-import { git, gitPush } from "../git-exec";
 import { projectPathFor } from "../tasks/session";
-import { PROTECTED_BRANCHES } from "../tasks/finish";
+import { deleteTaskBranch } from "../tasks/remote-branch";
 import { liveChildren } from "../stacks/guard";
 
 export async function deleteMergedRemote(
@@ -14,23 +13,13 @@ export async function deleteMergedRemote(
   pr: TaskPR | null
 ): Promise<boolean> {
   const repo = projectPathFor(s);
-  const branch = s.branch_name;
-  if (
-    !repo ||
-    !branch ||
-    PROTECTED_BRANCHES.has(branch) ||
-    !pr?.head ||
-    liveChildren(s.id).length
-  )
-    return false;
-  const line = await git(
+  if (!repo || !s.branch_name) return false;
+  const out = await deleteTaskBranch({
     repo,
-    ["ls-remote", "--heads", "origin", `refs/heads/${branch}`],
-    { timeout: 30000 }
-  ).catch(() => "");
-  const tip = line.trim().split(/\s+/)[0];
-  if (!tip || tip !== pr.head) return false;
-  return gitPush(repo, ["origin", "--delete", branch], { timeout: 60000 })
-    .then(() => true)
-    .catch(() => false);
+    branch: s.branch_name,
+    prHead: pr?.head,
+    keep: [s.base_branch],
+    hasChildren: liveChildren(s.id).length > 0,
+  });
+  return out.deleted;
 }

package/lib/orchestrator/armed.test-helpers.ts

@@ -0,0 +1,228 @@
+import fs from "fs";
+import os from "os";
+import path from "path";
+import { execFileSync } from "child_process";
+import { beforeAll, beforeEach, vi } from "vitest";
+import type { TaskPR } from "@/lib/tasks/state";
+import type { SessionFacts } from "./facts";
+
+// Shared fixtures for the armed*.test.ts files: a real repository with a
+// local bare remote, gh faked around it. Import this before anything it mocks.
+// Tests change the fake world through S.
+export const S: { pr: TaskPR | null } = { pr: null };
+export const merges: string[][] = [];
+export const isProbe = (args: string[]) =>
+  args[0] === "api" ||
+  (args[0] === "pr" &&
+    args[1] === "list" &&
+    args.includes("statusCheckRollup"));
+
+vi.mock("@/lib/tasks/gh", async (importOriginal) => {
+  const real = await importOriginal<typeof import("@/lib/tasks/gh")>();
+  return {
+    ...real,
+    run: async (cmd: string, args: string[], cwd: string, t?: number) => {
+      if (cmd === "gh" && isProbe(args)) return "0";
+      if (cmd === "gh") {
+        merges.push(args);
+        if (S.pr) S.pr = { ...S.pr, state: "MERGED" };
+        return "";
+      }
+      if (cmd === "tmux") throw new Error("no tmux in tests");
+      return real.run(cmd, args, cwd, t);
+    },
+    findPR: async () => S.pr,
+  };
+});
+vi.mock("@/lib/status-detector", () => ({
+  checkWaitingPatterns: () => false,
+  statusDetector: {
+    refreshCache: async () => {},
+    sessionExists: () => true,
+    getStatus: async () => "idle",
+    titleFor: () => "",
+    getTimestamp: () => 0,
+    hostFor: () => "local",
+    capturePane: async () => "❯ ",
+  },
+}));
+
+export const { db, updateSessionRow } = await import("@/lib/db");
+export const { createProject } = await import("@/lib/projects");
+export const { createWorkspace, setProjectWorkspace } =
+  await import("@/lib/workspaces");
+export const { ensureOrchestrator } = await import("./home");
+export const { runTool } = await import("./serve");
+export const { getCheck, putCheck } = await import("./checks");
+export const { failureOf, recordFailure } = await import("./gates");
+export const { LOOP_GUARD_COMMITS } = await import("./loop-guard");
+export const { seedSession } = await import("./testing");
+export const { setMergeApprovals } = await import("./merge-approvals");
+export const { mergeArmed, armTask } = await import("./armed");
+export const { setPaused } = await import("./pause");
+export const { escalate } = await import("./escalate");
+export const { openAsks, raiseAsk } = await import("./asks");
+export const { judge, mergeJudged } = await import("./signoff");
+export const { rebaseConflicting } = await import("./rebase");
+export const { recordConditions } = await import("./events");
+
+beforeAll(() => {
+  const home = fs.mkdtempSync(path.join(os.tmpdir(), "aos-orch-armed-"));
+  vi.spyOn(os, "homedir").mockReturnValue(home);
+});
+beforeEach(() => {
+  merges.length = 0;
+});
+
+export const git = (cwd: string, ...args: string[]) =>
+  execFileSync("git", args, {
+    cwd,
+    encoding: "utf8",
+    stdio: "pipe",
+    env: { ...process.env, GIT_COMMITTER_DATE: "2026-01-01T00:00:00Z" },
+  }).trim();
+
+export function commit(repo: string, file: string, text: string): string {
+  fs.mkdirSync(path.dirname(path.join(repo, file)), { recursive: true });
+  fs.writeFileSync(path.join(repo, file), text);
+  git(repo, "add", "-A");
+  git(repo, "commit", "-qm", `change ${file}`);
+  git(repo, "push", "-q", "origin", "HEAD");
+  return git(repo, "rev-parse", "HEAD");
+}
+
+export const lines = (n: number, change: Record<number, string> = {}) =>
+  Array.from({ length: n }, (_, i) => change[i + 1] ?? `line ${i + 1}`).join(
+    "\n"
+  ) + "\n";
+
+// A workspace whose project is a real clone, which is also the task's
+// worktree, on its branch with its PR open at the branch's head. `other`
+// is a second clone for moving main.
+export function setup() {
+  setMergeApprovals(false);
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), "aos-armed-repo-"));
+  const remote = path.join(root, "remote.git");
+  const repo = path.join(root, "repo");
+  const other = path.join(root, "other");
+  git(root, "init", "-q", "--bare", "-b", "main", remote);
+  git(root, "clone", "-q", remote, repo);
+  for (const r of [repo]) {
+    git(r, "config", "user.email", "t@example.com");
+    git(r, "config", "user.name", "T");
+  }
+  commit(repo, "src/b.ts", lines(12));
+  git(root, "clone", "-q", remote, other);
+  git(other, "config", "user.email", "o@example.com");
+  git(other, "config", "user.name", "O");
+  git(repo, "checkout", "-qb", "feature/t");
+  const sha = commit(repo, "src/b.ts", lines(12, { 5: "changed five" }));
+
+  const workspace = createWorkspace(`ws-${path.basename(root)}`);
+  const project = createProject({
+    name: `app-${path.basename(root)}`,
+    workingDirectory: repo,
+  });
+  setProjectWorkspace(project.id, workspace.id);
+  ensureOrchestrator(workspace.id);
+  const task = seedSession({
+    projectId: project.id,
+    name: "add-a",
+    task: true,
+    branch: "feature/t",
+  });
+  updateSessionRow(db, task, {
+    base_branch: "main",
+    task_prompt: "Add a",
+    pr_number: 7,
+    worktree_path: repo,
+  });
+  S.pr = {
+    number: 7,
+    url: "https://github.com/o/r/pull/7",
+    state: "OPEN",
+    checks: "pass",
+    head: sha,
+    failing: null,
+    checkCount: 1,
+    attribution: null,
+  };
+  const w = workspace.id;
+  const put = (
+    kind: "review" | "ci",
+    status: "pass" | "block",
+    at = S.pr!.head!
+  ) =>
+    putCheck({
+      workspaceId: w,
+      sessionId: task,
+      sha: at,
+      kind,
+      status,
+      detail:
+        kind === "ci"
+          ? JSON.stringify({ count: S.pr!.checkCount, at: 0 })
+          : "Looks right.",
+    });
+  // CI has looked settled on the head for a while.
+  put("ci", "pass");
+  return {
+    w,
+    repo,
+    other,
+    remote,
+    task,
+    sha,
+    put,
+    // Someone else's PR merged: main moves.
+    moveMain: (file: string, text: string) => {
+      git(other, "pull", "-q", "origin", "main");
+      return commit(other, file, text);
+    },
+    facts: (status: SessionFacts["status"] = "idle"): SessionFacts[] => [
+      {
+        id: task,
+        name: "add-a",
+        project: project.name,
+        view: "terminal",
+        status,
+        activity: null,
+        needsInput: false,
+        lastActive: 0,
+        branch: "feature/t",
+        task: { state: "review", pr: S.pr, blocked: null, ciSettleIn: 0 },
+        stack: null,
+      },
+    ],
+  };
+}
+
+export const events = (w: string) =>
+  (
+    db
+      .prepare(
+        `SELECT key, line FROM orchestrator_events WHERE workspace_id = ? AND key LIKE 'once:%' ORDER BY id`
+      )
+      .all(w) as { key: string; line: string }[]
+  ).map((e) => e.line);
+
+export const armedAt = (task: string) =>
+  (
+    db
+      .prepare(`SELECT merge_armed_at FROM session_rows WHERE id = ?`)
+      .get(task) as { merge_armed_at: string | null }
+  ).merge_armed_at;
+
+export function armedDeps() {
+  const reviews: string[] = [];
+  return {
+    reviews,
+    deps: {
+      judge,
+      merge: mergeJudged,
+      review: async (_w: string, id: string) => {
+        reviews.push(id);
+      },
+    },
+  };
+}

package/lib/orchestrator/armed.ts

@@ -258,7 +258,7 @@ async function mergeOne(
   const seen = `${pr.head}:${failures(verdict.text)}`;
   if (task.merge_armed_seen === seen) return;
   // Counted as sign_off would count it: once per head (the database keys
-  // it), and a gate failing on a second commit goes to Saad.
+  // it), and only a task stuck in a loop goes to Saad (loop-guard.ts).
   if (!stillArmed(workspaceId, task.id)) return;
   const counted = await deps.judge(workspaceId, task);
   if (counted.ok) return merge(workspaceId, task, counted, deps);