@sellable/mcp 0.1.751 → 0.1.753

package/dist/refill-run-loop.js

@@ -78,6 +78,12 @@ const REFILL_DONE_REASONS = new Set([
     "abandoned_stale_checkpoint",
     "signal_search_provider_unavailable",
     "exact_action_complete",
+    // fix(112ay): the fence opened, the fresh plan's head had already drifted
+    // away from the pinned action, and NOTHING executed. The pinned edge was
+    // never attempted, so this terminal must not read as a completion — the
+    // coordinator records no claim and the edge stays selectable when the
+    // planner exposes it as head again.
+    "exact_action_superseded",
 ]);
 // fix(110-20d): a resumed scheduler wait must be mortal. Terminalize a stale
 // checkpoint once the persisted wait entry has aged past this multiple of the
@@ -2105,6 +2111,10 @@ const INHERITED_ATTEMPT_LEDGER_KEYS = [
     "drySourcePrepAttempts",
     "approvalCohortAttempts",
     "erroredCellRepairAttempts",
+    // fix(112aw): mirrors WORKSPACE_ATTEMPT_LEDGER_KEYS — census fingerprints of
+    // confirmed completeness-claim releases must survive the fence inherit or a
+    // continuation would re-authorize the same release and reopen the livelock.
+    "confirmedClaimReleaseAttempts",
 ];
 function inheritAttemptLedgers(base, incoming) {
     if (!incoming)
@@ -2632,11 +2642,26 @@ async function gatePlan(input, deps, ctx) {
         // preflight/fence. Continuing inside this run misattributes later blockers
         // to the original target (for example, a Signal outage reported against a
         // scheduler action) and is the root of cross-action retry loops.
-        return completeTerminal(input, deps, ctx, "exact_action_complete", {
+        //
+        // fix(112ay): head drift BEFORE anything executed is not a completion. Run
+        // 5 (Dotwork td7-28): the sweep fence opened, the in-fence dated capacity
+        // read blocked pending a credit refresh, the fresh head became
+        // approve_messages, and this branch stamped exact_action_complete on a
+        // sweep that NEVER RAN — the coordinator hardened that into a confirmed
+        // claim while a directly-dispatched dated sweep placed 18 cells
+        // immediately. Only a fence that actually executed its pinned (or
+        // sanctioned in-fence) action may claim completion; an unexecuted pin
+        // terminals exact_action_superseded, which records NO claim.
+        const fenceExecutedPinnedAction = Boolean(executedAction);
+        return completeTerminal(input, deps, ctx, fenceExecutedPinnedAction
+            ? "exact_action_complete"
+            : "exact_action_superseded", {
             expectedActionKey,
             nextActionKey,
             nextActionType: stringValue(action.type),
-            guidance: "The pinned exact action is no longer the planner head. Return to the workspace coordinator and preflight the fresh action behind a new fence.",
+            guidance: fenceExecutedPinnedAction
+                ? "The pinned exact action is no longer the planner head. Return to the workspace coordinator and preflight the fresh action behind a new fence."
+                : "The pinned exact action was superseded before this fence executed anything. No completion is claimed; return to the workspace coordinator and preflight the fresh head behind a new fence.",
             plan,
         });
     }

package/dist/tools/refill-sends.js

@@ -253,6 +253,10 @@ const WORKSPACE_ATTEMPT_LEDGER_KEYS = [
     "drySourcePrepAttempts",
     "approvalCohortAttempts",
     "erroredCellRepairAttempts",
+    // fix(112aw): census fingerprints at which a CONFIRMED completeness claim was
+    // released. Stripping this would re-authorize a confirmed release on every
+    // coordinator call and reopen the 112as livelock.
+    "confirmedClaimReleaseAttempts",
 ];
 // A fenced exact run records its bounded attempt receipts on ITS OWN
 // runState; the workspace loop replans from workspaceRunState. Without this
@@ -1499,12 +1503,17 @@ async function selectWorkspaceExactTarget(input, workspacePlanOverride, options
     // opening is barred for those targets (in the selection loop below).
     const completeDeferredTargets = blockedExactTargets.filter((blocked) => blocked.blocker === "complete" ||
         blocked.blocker === "capped_by_scheduler");
-    const waiveCompleteClaims = options.waiveCompleteClaims === true;
+    const waiveCompleteClaims = options.waiveCompleteClaims === true ||
+        options.waiveCompleteClaims === "include_confirmed";
+    const waiveConfirmedClaims = options.waiveCompleteClaims === "include_confirmed";
     const prefilterBlockedTargets = blockedExactTargets.filter((blocked) => blocked.blocker !== "complete" &&
         blocked.blocker !== "capped_by_scheduler" &&
         // fix(112as): on the bounded release pass, a self-issued
         // exact_action_complete claim no longer bars its own edge.
-        !(waiveCompleteClaims && blocked.blocker === "exact_action_complete"));
+        !(waiveCompleteClaims && blocked.blocker === "exact_action_complete") &&
+        // fix(112aw): a census-authorized release also waives CONFIRMED claims.
+        !(waiveConfirmedClaims &&
+            blocked.blocker === EXACT_ACTION_COMPLETE_CONFIRMED_BLOCKER));
     const seenTargetKeys = new Set();
     // fix(112ak): every refusal is recorded so a non-empty-census terminal can
     // name the concrete per-lane blocker instead of reporting a bare dead end.
@@ -1544,16 +1553,61 @@ async function selectWorkspaceExactTarget(input, workspacePlanOverride, options
             return null;
         if (coordinatorExcludedEdges.length === 0)
             return null;
-        if (!coordinatorExcludedEdges.every((edge) => edge.blocker === "exact_action_complete")) {
+        if (!coordinatorExcludedEdges.every((edge) => edge.blocker === EXACT_ACTION_COMPLETE_BLOCKER ||
+            edge.blocker === EXACT_ACTION_COMPLETE_CONFIRMED_BLOCKER)) {
             return null;
         }
         const census = workspaceGapBearingActionableSupply(workspacePlan);
         if (census.actionableRows <= 0 && !census.frontierHasMoreRows) {
             return null;
         }
-        const released = await selectWorkspaceExactTarget(input, workspacePlan, {
+        // fix(112aw): a CONFIRMED claim is a bounded batch receipt, not proof the
+        // edge is done — prepare/approve run in bounded cohorts, so a 50-send day
+        // legitimately needs the SAME edge many times (Dotwork td7-28 run 1:
+        // approve_messages + prepare_messages hardened to confirmed after two
+        // productive batches, then refused the remaining 40-send fill against a
+        // census of 6 approval candidates). Release confirmed claims too, but
+        // only when the gap-bearing census MOVED since the last confirmed
+        // release: a productive batch always changes the census (rows advance
+        // stages), while a dispatch that moved nothing leaves it identical and
+        // the claim stands. That keeps the 112as-b livelock kill, re-keyed on
+        // progress instead of receipt count.
+        const hasConfirmedClaims = coordinatorExcludedEdges.some((edge) => edge.blocker === EXACT_ACTION_COMPLETE_CONFIRMED_BLOCKER);
+        let releaseInput = input;
+        if (hasConfirmedClaims) {
+            const fingerprint = [
+                census.approvalFrontier,
+                census.generateFrontier,
+                census.enrichFrontier,
+                census.rubricFrontier,
+                census.frontierHasMoreRows ? 1 : 0,
+            ].join(":");
+            const priorReleases = Array.isArray(workspaceRunState?.confirmedClaimReleaseAttempts)
+                ? workspaceRunState.confirmedClaimReleaseAttempts
+                : [];
+            if (priorReleases.some((entry) => stringValue(recordValue(entry)?.fingerprint) === fingerprint)) {
+                return null;
+            }
+            releaseInput = {
+                ...input,
+                workspaceRunState: {
+                    ...(workspaceRunState ?? {
+                        version: 1,
+                        senderCursors: [],
+                        laneCooldowns: [],
+                        passRates: [],
+                        coordinatorBlockedExactTargets: [],
+                    }),
+                    confirmedClaimReleaseAttempts: [
+                        ...priorReleases.filter((entry) => Boolean(recordValue(entry))),
+                        { fingerprint, decidedAt: new Date().toISOString() },
+                    ],
+                },
+            };
+        }
+        const released = await selectWorkspaceExactTarget(releaseInput, workspacePlan, {
             ...options,
-            waiveCompleteClaims: true,
+            waiveCompleteClaims: hasConfirmedClaims ? "include_confirmed" : true,
             seedExcludedEdges: [...coordinatorExcludedEdges],
         });
         // The release may only ADD a dispatch. If it fails to bind an edge, fall
@@ -1846,6 +1900,11 @@ async function selectWorkspaceExactTarget(input, workspacePlanOverride, options
                 blocked.blocker === "exact_action_complete") {
                 return false;
             }
+            // fix(112aw): mirror the confirmed-claim waiver after the exact rebind.
+            if (waiveConfirmedClaims &&
+                blocked.blocker === EXACT_ACTION_COMPLETE_CONFIRMED_BLOCKER) {
+                return false;
+            }
             recordExcludedEdge(exactSelectedTarget, blocked, "post_rebind");
             return true;
         })) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sellable/mcp",
-  "version": "0.1.751",
+  "version": "0.1.753",
   "type": "module",
   "description": "Sellable MCP server for Claude Code, Codex, and Hermes campaign workflows",
   "main": "dist/index.js",