agent-dealer 1.1.8 → 1.1.9

package/bundle/server/dist/adapters/agent-health.js

@@ -299,25 +299,83 @@ function claudeUsesThirdPartyProvider() {
  */
 export async function githubIssuesUncached() {
     const status = await runCommand("gh", ["auth", "status"]);
-    const out = status.output.toLowerCase();
-    if (out.includes("enoent") ||
+    return classifyGithubAuthStatus({
+        ok: status.ok,
+        output: status.output,
+        timedOut: status.timedOut,
+    });
+}
+const GITHUB_CLI_MISSING_MESSAGE = "gh CLI not found — install GitHub CLI (`gh`)";
+const GITHUB_AUTH_MESSAGE = "Run `gh auth login` — GitHub CLI auth required to open PRs";
+const GITHUB_UNREACHABLE_MESSAGE = "Can't reach GitHub (network or keyring timeout) — check your VPN; Dealer will retry";
+/**
+ * Output fragments naming a timeout, TLS handshake, DNS or connection failure.
+ * Matched against lowercased `gh` output. `timedout` (no space) covers ETIMEDOUT;
+ * `timeout` covers gh's own "Timeout trying to log in … (keyring)" and the
+ * "timeout while trying to … secret in/from keyring" variants.
+ */
+const GITHUB_UNREACHABLE_PATTERNS = [
+    "timed out",
+    "timeout",
+    "timedout",
+    "tls",
+    "ssl",
+    "handshake",
+    "certificate",
+    "dns",
+    "could not resolve",
+    "no such host",
+    "name resolution",
+    "eai_again",
+    "enotfound",
+    "getaddrinfo",
+    "connection refused",
+    "connection reset",
+    "failed to connect",
+    "could not connect",
+    "network is unreachable",
+    "network unreachable",
+    "econnrefused",
+    "econnreset",
+    "ehostunreach",
+    "enetunreach",
+    "econnaborted",
+    "socket hang up",
+];
+/**
+ * NOT-195: one `gh auth status` classifier shared by the async (`runCommand`) and
+ * sync (`spawnSync`) paths. Four cases, checked in order:
+ *
+ * 1. CLI missing — `ENOENT` (or the pre-existing not-found texts) only. A spawn
+ *    timeout also sets the sync `error`, so any-error-means-missing misread a slow
+ *    network as an absent binary.
+ * 2. Unreachable — spawn timeout, `ETIMEDOUT`, or output naming a timeout / TLS /
+ *    DNS / connection failure. Checked before auth because gh maps some
+ *    connectivity failures onto login/token wording (and the keyring-login timeout
+ *    names neither). Transient: callers defer and retry.
+ * 3. Logged out / invalid token — the pre-existing texts, or any other non-zero exit.
+ * 4. Healthy.
+ */
+export function classifyGithubAuthStatus(probe) {
+    const out = probe.output.toLowerCase();
+    if (probe.spawnErrorCode === "ENOENT" ||
+        out.includes("enoent") ||
         out.includes("not found") ||
-        out.includes("no such file") ||
-        (out.includes("spawn") && out.includes("gh"))) {
-        return [{ code: "github_cli_missing", message: "gh CLI not found — install GitHub CLI (`gh`)" }];
+        out.includes("no such file")) {
+        return [{ code: "github_cli_missing", message: GITHUB_CLI_MISSING_MESSAGE }];
     }
-    if (!status.ok ||
+    if (probe.timedOut ||
+        probe.spawnErrorCode === "ETIMEDOUT" ||
+        GITHUB_UNREACHABLE_PATTERNS.some((p) => out.includes(p))) {
+        return [{ code: "github_unreachable", message: GITHUB_UNREACHABLE_MESSAGE }];
+    }
+    if (!probe.ok ||
         out.includes("not logged in") ||
         out.includes("failed to log in") ||
         out.includes("token in keyring is invalid") ||
         out.includes("re-authenticate") ||
         out.includes("to re-authenticate")) {
-        return [
-            {
-                code: "github_auth",
-                message: "Run `gh auth login` — GitHub CLI auth required to open PRs",
-            },
-        ];
+        return [{ code: "github_auth", message: GITHUB_AUTH_MESSAGE }];
     }
     return [];
 }
@@ -343,27 +401,14 @@ export function githubIssuesSync() {
         env: process.env,
     });
     const output = `${result.stdout ?? ""}${result.stderr ?? ""}${result.error?.message ?? ""}`;
-    const out = output.toLowerCase();
-    let issues = [];
-    if (result.error ||
-        out.includes("enoent") ||
-        out.includes("not found") ||
-        out.includes("no such file")) {
-        issues = [{ code: "github_cli_missing", message: "gh CLI not found — install GitHub CLI (`gh`)" }];
-    }
-    else if (result.status !== 0 ||
-        out.includes("not logged in") ||
-        out.includes("failed to log in") ||
-        out.includes("token in keyring is invalid") ||
-        out.includes("re-authenticate") ||
-        out.includes("to re-authenticate")) {
-        issues = [
-            {
-                code: "github_auth",
-                message: "Run `gh auth login` — GitHub CLI auth required to open PRs",
-            },
-        ];
-    }
+    // NOT-195: same four-case classifier as the async path — a spawnSync timeout sets
+    // `error` (ETIMEDOUT), which must not read as a missing CLI.
+    const issues = classifyGithubAuthStatus({
+        ok: result.status === 0,
+        output,
+        timedOut: result.error?.code === "ETIMEDOUT",
+        spawnErrorCode: result.error?.code,
+    });
     githubIssueCache = { at: Date.now(), issues };
     return issues;
 }

package/bundle/server/dist/adapters/agent-health.test.js

@@ -15,7 +15,7 @@ import { fileURLToPath } from "node:url";
 process.env.AGENT_DEALER_HOME = fs.mkdtempSync(path.join(os.tmpdir(), "dealer-agenthealth-"));
 const { migrate, getDb } = await import("../db/index.js");
 const { createAgent, getAgent } = await import("../repository/agents.js");
-const { healthForAgent, runtimeIssuesUncached, githubIssuesUncached, clearAgentHealthCaches, setCursorProbeTimingForTests, setRunCommandForTests, } = await import("./agent-health.js");
+const { healthForAgent, runtimeIssuesUncached, githubIssuesUncached, githubIssuesSync, classifyGithubAuthStatus, clearAgentHealthCaches, setCursorProbeTimingForTests, setRunCommandForTests, } = await import("./agent-health.js");
 migrate();
 const FAILURE = { ok: false, code: "DECK_UNAVAILABLE", message: "Agent Deck API error: 502" };
 /** Tests inject an empty github list so host `gh auth` does not pollute assertions. */
@@ -461,4 +461,158 @@ The keychain item is stuck. Delete it and sign in again:
         assert.match(issue.message, /expected 127\.0\.0\.1:1110/);
         assert.equal(issue.message.includes("Run agent-deck setup"), false);
     });
+    // ---------------------------------------------------------------------------
+    // NOT-195: a `gh` timeout is a transient network problem (`github_unreachable`),
+    // not "gh CLI not found" or "Run `gh auth login`". Fixtures in
+    // packages/shared/src/fixtures/runtime-auth/gh-auth-status-*.txt.
+    // ---------------------------------------------------------------------------
+    const GH_FIXTURE = (name) => fs.readFileSync(path.join(FIXTURES, name), "utf8");
+    async function uncachedWithGhOutput(output, ok) {
+        setRunCommandForTests(async () => ({ ok, output, timedOut: false }));
+        clearAgentHealthCaches();
+        try {
+            return await githubIssuesUncached();
+        }
+        finally {
+            setRunCommandForTests(null);
+            clearAgentHealthCaches();
+        }
+    }
+    test("NOT-195: keyring-timeout capture reports github_unreachable, not github_auth", async () => {
+        const issues = await uncachedWithGhOutput(GH_FIXTURE("gh-auth-status-keyring-timeout.txt"), false);
+        assert.deepEqual(issues.map((i) => i.code), ["github_unreachable"]);
+        assert.match(issues[0].message, /Can't reach GitHub/);
+        assert.match(issues[0].message, /VPN/);
+        assert.doesNotMatch(issues[0].message, /gh auth login/);
+    });
+    test("NOT-195: logged-out capture still reports github_auth with the gh auth login message", async () => {
+        const issues = await uncachedWithGhOutput(GH_FIXTURE("gh-auth-status-logged-out.txt"), false);
+        assert.deepEqual(issues.map((i) => i.code), ["github_auth"]);
+        assert.match(issues[0].message, /gh auth login/);
+    });
+    test("NOT-195: invalid-token capture still reports github_auth with the gh auth login message", async () => {
+        const issues = await uncachedWithGhOutput(GH_FIXTURE("gh-auth-status-invalid-token.txt"), false);
+        assert.deepEqual(issues.map((i) => i.code), ["github_auth"]);
+        assert.match(issues[0].message, /gh auth login/);
+    });
+    test("NOT-195: logged-in capture leaves github health empty", async () => {
+        const issues = await uncachedWithGhOutput(GH_FIXTURE("gh-auth-status-logged-in.txt"), true);
+        assert.deepEqual(issues, []);
+    });
+    test("NOT-195: an async probe timeout reports github_unreachable, not github_cli_missing", async () => {
+        setRunCommandForTests(async () => ({ ok: false, output: "timeout", timedOut: true }));
+        clearAgentHealthCaches();
+        try {
+            const issues = await githubIssuesUncached();
+            assert.deepEqual(issues.map((i) => i.code), ["github_unreachable"]);
+        }
+        finally {
+            setRunCommandForTests(null);
+            clearAgentHealthCaches();
+        }
+    });
+    test("NOT-195: ETIMEDOUT reports github_unreachable; only ENOENT reports github_cli_missing", async () => {
+        // Sync spawnSync shapes: a timeout sets error.code ETIMEDOUT, a missing binary ENOENT.
+        const timedOut = classifyGithubAuthStatus({
+            ok: false,
+            output: "spawnSync gh ETIMEDOUT",
+            timedOut: true,
+            spawnErrorCode: "ETIMEDOUT",
+        });
+        assert.deepEqual(timedOut.map((i) => i.code), ["github_unreachable"]);
+        const etimedoutOutput = classifyGithubAuthStatus({
+            ok: false,
+            output: "spawnSync gh ETIMEDOUT",
+            timedOut: false,
+            spawnErrorCode: "ETIMEDOUT",
+        });
+        assert.deepEqual(etimedoutOutput.map((i) => i.code), ["github_unreachable"]);
+        const missing = classifyGithubAuthStatus({
+            ok: false,
+            output: "spawnSync gh ENOENT",
+            timedOut: false,
+            spawnErrorCode: "ENOENT",
+        });
+        assert.deepEqual(missing.map((i) => i.code), ["github_cli_missing"]);
+        // A non-ENOENT spawn failure must not read as a missing CLI (fail-closed as auth).
+        const otherSpawnError = classifyGithubAuthStatus({
+            ok: false,
+            output: "spawnSync gh EACCES",
+            timedOut: false,
+            spawnErrorCode: "EACCES",
+        });
+        assert.deepEqual(otherSpawnError.map((i) => i.code), ["github_auth"]);
+        // gh's sibling token-path timeout variant (format verified in the gh 2.78.0 binary:
+        // "%s Timeout trying to log in to %s using token (%s)") is unreachable too.
+        const tokenTimeout = classifyGithubAuthStatus({
+            ok: false,
+            output: "ghe.example.com\n  X Timeout trying to log in to ghe.example.com using token (GH_TOKEN)",
+            timedOut: false,
+        });
+        assert.deepEqual(tokenTimeout.map((i) => i.code), ["github_unreachable"]);
+    });
+    /** A `gh` stub on PATH that prints a captured fixture verbatim and exits with the captured code. */
+    function stubGhOnPath(fixture, exitCode) {
+        const dir = fs.mkdtempSync(path.join(os.tmpdir(), "dealer-gh-stub-"));
+        const bin = path.join(dir, "gh");
+        fs.writeFileSync(bin, `#!/bin/sh\ncat ${JSON.stringify(path.join(FIXTURES, fixture))}\nexit ${exitCode}\n`);
+        fs.chmodSync(bin, 0o755);
+        const prevPath = process.env.PATH ?? "";
+        process.env.PATH = `${dir}${path.delimiter}${prevPath}`;
+        return prevPath;
+    }
+    /**
+     * The sync entry point, through the real spawnSync plumbing. `test:unit` sets
+     * AGENT_DEALER_SKIP_GITHUB_HEALTH=1, which would short-circuit to [] — clear it so
+     * the classifier actually runs.
+     */
+    function syncWithStubGh(fixture, exitCode) {
+        const prevPath = stubGhOnPath(fixture, exitCode);
+        const prevSkip = process.env.AGENT_DEALER_SKIP_GITHUB_HEALTH;
+        delete process.env.AGENT_DEALER_SKIP_GITHUB_HEALTH;
+        clearAgentHealthCaches();
+        try {
+            return githubIssuesSync();
+        }
+        finally {
+            process.env.PATH = prevPath;
+            if (prevSkip === undefined)
+                delete process.env.AGENT_DEALER_SKIP_GITHUB_HEALTH;
+            else
+                process.env.AGENT_DEALER_SKIP_GITHUB_HEALTH = prevSkip;
+            clearAgentHealthCaches();
+        }
+    }
+    test("NOT-195: githubIssuesSync follows the same classification over the three fixtures", async () => {
+        const unreachable = syncWithStubGh("gh-auth-status-keyring-timeout.txt", 1);
+        assert.deepEqual(unreachable.map((i) => i.code), ["github_unreachable"]);
+        assert.match(unreachable[0].message, /Can't reach GitHub/);
+        const loggedOut = syncWithStubGh("gh-auth-status-logged-out.txt", 1);
+        assert.deepEqual(loggedOut.map((i) => i.code), ["github_auth"]);
+        assert.match(loggedOut[0].message, /gh auth login/);
+        const invalidToken = syncWithStubGh("gh-auth-status-invalid-token.txt", 1);
+        assert.deepEqual(invalidToken.map((i) => i.code), ["github_auth"]);
+        const healthy = syncWithStubGh("gh-auth-status-logged-in.txt", 0);
+        assert.deepEqual(healthy, []);
+    });
+    test("NOT-195: github_unreachable marks the agent unhealthy so admission/review defers without spending an attempt", async () => {
+        // Any nonCap health issue fails checkRoleAgentHealthy, and the worker loop routes
+        // that through the existing deferLeasedWorkItemForAgentUnhealthy infra-defer path
+        // (agent_unhealthy outcome — no infra attempt, no review round spent), exactly as
+        // github_auth already behaves. No new wiring: the code IS the defer path.
+        const agent = createAgent({
+            name: "gh-down",
+            runtime: "claude_code",
+            deckId: "00000000-0000-4000-a000-000000000099",
+        });
+        const gh = classifyGithubAuthStatus({
+            ok: false,
+            output: GH_FIXTURE("gh-auth-status-keyring-timeout.txt"),
+            timedOut: false,
+        });
+        assert.deepEqual(gh.map((i) => i.code), ["github_unreachable"]);
+        const result = await healthForAgent(agent, true, new Map(), true, null, gh);
+        assert.equal(result.healthy, false);
+        assert.equal(result.issues.some((i) => i.code === "github_unreachable"), true);
+    });
 }); // describe agent-health (serial)

package/bundle/server/dist/adapters/linear-inbox.js

@@ -1,3 +1,4 @@
+import { resolveLinearRepoLabels } from "@agent-dealer/shared";
 import { DEFAULT_LINEAR_STATE_FILTER, getLinearIntakeConfig } from "../repository/intake-settings.js";
 import { linearGraphqlRequest } from "./linear-graphql.js";
 export { DEFAULT_LINEAR_STATE_FILTER };
@@ -13,7 +14,14 @@ async function linearQuery(operation, query, variables, opts) {
         timeoutMs: opts?.timeoutMs,
     });
 }
-function nodeToCandidate(n) {
+/**
+ * NOT-242: every candidate carries a server-resolved repository hint read from
+ * explicit `repo:` labels. Raw labels stay on the candidate; resolution is
+ * deterministic (one valid label resolves, zero is unresolved, several
+ * conflict, a bad value is invalid) and never guesses from anything else.
+ */
+export function nodeToCandidate(n) {
+    const labels = n.labels?.nodes.map((l) => l.name) ?? [];
     return {
         id: n.id,
         identifier: n.identifier,
@@ -22,7 +30,8 @@ function nodeToCandidate(n) {
         url: n.url,
         state: n.state?.name,
         teamId: n.team?.id,
-        labels: n.labels?.nodes.map((l) => l.name) ?? [],
+        labels,
+        repoResolution: resolveLinearRepoLabels(labels),
     };
 }
 const ISSUE_FIELDS = `

package/bundle/server/dist/adapters/linear-inbox.test.js

@@ -1,6 +1,6 @@
 import { test } from "node:test";
 import assert from "node:assert/strict";
-import { buildIssueFilter, parseLinearIssueRef } from "./linear-inbox.js";
+import { buildIssueFilter, nodeToCandidate, parseLinearIssueRef } from "./linear-inbox.js";
 test("parseLinearIssueRef accepts identifier, URL, and UUID", () => {
     assert.equal(parseLinearIssueRef("NOT-103"), "NOT-103");
     assert.equal(parseLinearIssueRef("  not-90  "), "NOT-90");
@@ -21,6 +21,54 @@ test("buildIssueFilter omits assignee when assigneeMe is false", () => {
         team: { id: { eq: "team-1" } },
     });
 });
+test("nodeToCandidate resolves exactly one repo: label to the canonical identity", () => {
+    const c = nodeToCandidate({
+        id: "uuid-1",
+        identifier: "NOT-242",
+        title: "t",
+        url: "https://linear.app/not-so-fat/issue/NOT-242/t",
+        labels: { nodes: [{ name: "agent-dealer" }, { name: "repo:github.com/not-so-fat/agent-dealer" }] },
+    });
+    // Raw labels stay available alongside the resolved hint.
+    assert.deepEqual(c.labels, ["agent-dealer", "repo:github.com/not-so-fat/agent-dealer"]);
+    assert.equal(c.repoResolution?.status, "resolved");
+    assert.equal(c.repoResolution?.repository, "github.com/not-so-fat/agent-dealer");
+    assert.equal(c.repoResolution?.sourceLabel, "repo:github.com/not-so-fat/agent-dealer");
+});
+test("nodeToCandidate leaves zero repo: labels unresolved and conflicts several", () => {
+    const none = nodeToCandidate({
+        id: "uuid-1",
+        identifier: "NOT-1",
+        title: "t",
+        url: "https://linear.app/x/issue/NOT-1/t",
+        labels: { nodes: [{ name: "agent-dealer" }] },
+    });
+    assert.equal(none.repoResolution?.status, "unresolved");
+    assert.equal(none.repoResolution?.repository, undefined);
+    const conflict = nodeToCandidate({
+        id: "uuid-2",
+        identifier: "NOT-2",
+        title: "t",
+        url: "https://linear.app/x/issue/NOT-2/t",
+        labels: { nodes: [{ name: "repo:github.com/a/one" }, { name: "repo:github.com/b/two" }] },
+    });
+    assert.equal(conflict.repoResolution?.status, "conflict");
+    assert.equal(conflict.repoResolution?.repository, undefined);
+    assert.deepEqual(conflict.repoResolution?.labels, ["repo:github.com/a/one", "repo:github.com/b/two"]);
+});
+test("nodeToCandidate marks a non-GitHub repo: value invalid", () => {
+    const c = nodeToCandidate({
+        id: "uuid-3",
+        identifier: "NOT-3",
+        title: "t",
+        url: "https://linear.app/x/issue/NOT-3/t",
+        labels: { nodes: [{ name: "repo:https://gitlab.com/acme/app" }] },
+    });
+    assert.equal(c.repoResolution?.status, "invalid");
+    assert.equal(c.repoResolution?.repository, undefined);
+    assert.deepEqual(c.repoResolution?.labels, ["repo:https://gitlab.com/acme/app"]);
+    assert.ok(c.repoResolution?.error);
+});
 test("buildIssueFilter includes assignee when assigneeMe is true", () => {
     const filter = buildIssueFilter({
         stateFilter: ["Todo"],

package/bundle/server/dist/coordinator/commands.js

@@ -34,6 +34,7 @@ import { externalMergeStateForIssue } from "./external-merge.js";
 import { detectNonConvergence, formatNonConvergenceReason, reviewHistoryFromEvents, } from "./non-convergence.js";
 import { capEscalationEvents, deferLeasedWorkItemForBaseFetch, deferLeasedWorkItemForDeckOutage, deferLeasedWorkItemForUsageCap, formatCapEscalationReason, usageCapDeferralStartedAt, } from "./usage-cap-defer.js";
 import { dequeueIssue, getQueuedEntryForIssue, markQueueEntryAdmitted, } from "../repository/queue-entries.js";
+import { fetchResumeLiveHeadSha } from "./resume-live-head.js";
 import { getWorkflow } from "./workflows/registry.js";
 import { DEV_REVIEWER_V1_VERSION } from "./workflows/dev-reviewer-v1.js";
 /** Default start template — resolved through the workflow registry (NOT-70). */
@@ -1111,12 +1112,20 @@ export function resolveHumanActionAndAdvance(actionId, resolvedBy, choice, opts)
     // A reviewer-origin infra escalation (session_failed/publish_failed exhausted) tagged
     // its continuation with where to resume: nothing was wrong with the code/PR, only the
     // reviewer session/publish attempt kept failing, so "resume" must re-queue a reviewer
-    // at the still-valid pinned head — not default to an unrelated developer round.
+    // at the pinned head — not default to an unrelated developer round.
     const continuation = parseContinuationPreview(action.continuationPreviewJson);
     const resumeAsReviewer = (action.actionType === "policy_escalation" || action.actionType === "deck_interaction_required") &&
         resolution.choice === "resume" &&
         continuation?.resumeRole === "reviewer" &&
         !!continuation.resumeHeadSha;
+    // NOT-226: the pinned head may be stale — an operator can push a fix to the PR branch
+    // while the issue is parked. Re-check the PR's live head (same `gh pr view` head the
+    // reviewer uses for stale detection) and re-pin to it when it moved. Only when the
+    // issue has a PR; an unknown live head (lookup failure/timeout) keeps today's behavior.
+    const pinnedResumeHeadSha = resumeAsReviewer ? continuation.resumeHeadSha : null;
+    const liveResumeHeadSha = resumeAsReviewer && issue.prNumber != null && opts?.resumeLiveHeadSha ? opts.resumeLiveHeadSha : null;
+    const rePinnedResumeHeadSha = liveResumeHeadSha && liveResumeHeadSha !== pinnedResumeHeadSha ? liveResumeHeadSha : null;
+    const effectiveResumeHeadSha = rePinnedResumeHeadSha ?? pinnedResumeHeadSha;
     // "review"/"review_grant" advance current_round before the next session is queued;
     // "infra"/"none" queue at the round current_round is already at. Computed up front so
     // currentIntent's round number matches the round the queued work item actually carries
@@ -1155,7 +1164,14 @@ export function resolveHumanActionAndAdvance(actionId, resolvedBy, choice, opts)
                     }
                     : {};
     return getDb().transaction(() => {
-        resolveHumanAction(actionId, resolvedBy, { choice });
+        resolveHumanAction(actionId, resolvedBy, {
+            choice,
+            // NOT-226: record the re-pin so the resolved action itself shows which head the
+            // reviewer was re-queued at when the branch had moved while parked.
+            ...(rePinnedResumeHeadSha
+                ? { resumedFromHeadSha: pinnedResumeHeadSha, resumeLiveHeadSha: rePinnedResumeHeadSha }
+                : {}),
+        });
         // stage must be the status this resolution actually lands on (finalStatus), not the
         // generic developer-resume outcome.issueStatus — otherwise a reviewer resume's own
         // human_action.resolved/repair.started events would be recorded under "developing"
@@ -1175,8 +1191,13 @@ export function resolveHumanActionAndAdvance(actionId, resolvedBy, choice, opts)
                 : finalStatus === "closed"
                     ? "Closed"
                     : resumeAsReviewer
-                        ? `Reviewer re-evaluating at ${continuation.resumeHeadSha.slice(0, 8)}`
+                        ? rePinnedResumeHeadSha
+                            ? `Reviewer re-evaluating at ${rePinnedResumeHeadSha.slice(0, 8)} (was ${pinnedResumeHeadSha.slice(0, 8)})`
+                            : `Reviewer re-evaluating at ${pinnedResumeHeadSha.slice(0, 8)}`
                         : `Developer implementing round ${nextRound}`,
+            // NOT-226: the reviewer now evaluates the live head — the issue must point there
+            // too, or the next stale check / resume would keep using the old commit.
+            ...(rePinnedResumeHeadSha ? { headSha: rePinnedResumeHeadSha } : {}),
         });
         if (outcome.workflowOutcome) {
             const finalOutcome = externallyMerged ? "done" : outcome.workflowOutcome;
@@ -1216,8 +1237,8 @@ export function resolveHumanActionAndAdvance(actionId, resolvedBy, choice, opts)
             };
         }
         // Another round: spend the budget this resolution's roundKind names, then queue the
-        // resumed effect — a reviewer at the pinned head for a reviewer-origin infra
-        // escalation, a fresh developer round otherwise.
+        // resumed effect — a reviewer at the pinned head (or the live head it was re-pinned
+        // to, NOT-226) for a reviewer-origin infra escalation, a fresh developer round otherwise.
         switch (outcome.roundKind) {
             case "review_grant":
                 grantReviewRetry(issue.id);
@@ -1256,7 +1277,7 @@ export function resolveHumanActionAndAdvance(actionId, resolvedBy, choice, opts)
                 workflowInstanceId: instance.id,
                 kind: "reviewer",
                 round: issueNow.currentRound,
-                payload: { inputSha: continuation.resumeHeadSha, profileSnapshot: queuedProfileSnapshot(issue, "reviewer") },
+                payload: { inputSha: effectiveResumeHeadSha, profileSnapshot: queuedProfileSnapshot(issue, "reviewer") },
                 idempotencyKey: `${instance.id}:reviewer:resume:${action.id}`,
             })
             : enqueueWorkItem({
@@ -1281,18 +1302,52 @@ export function resolveHumanActionAndAdvance(actionId, resolvedBy, choice, opts)
  * HTTP/CLI entry: same as `resolveHumanActionAndAdvance`, but when `final_review:complete`
  * parks for merge, awaits undraft+merge (`finalizeAutoMerge`) before returning.
  */
-export async function resolveHumanActionAndAdvanceAsync(actionId, resolvedBy, choice) {
+export async function resolveHumanActionAndAdvanceAsync(actionId, resolvedBy, choice, opts) {
     // NOT-221: the lease push runs before anything resolves — a failed lease must leave
     // the action open with the fresh tip, which the sync core below cannot do.
     if (choice === "push_with_lease") {
         return resolvePushWithLeaseAsync(actionId, resolvedBy);
     }
+    // NOT-226: for a reviewer-role resume on an issue with a PR, read the PR's live head
+    // BEFORE the resolving transaction (network must never hold the SQLite write lock).
+    // An explicit opt wins (tests); otherwise look it up, bounded — any failure yields
+    // null and the sync core below keeps today's pinned-head behavior.
+    let resumeLiveHeadSha = opts?.resumeLiveHeadSha;
+    if (resumeLiveHeadSha === undefined) {
+        try {
+            const pendingAction = getHumanAction(actionId);
+            const pendingIssue = pendingAction?.issueId ? getIssue(pendingAction.issueId) : null;
+            const pendingResolution = pendingAction ? parseHumanResolution(pendingAction.actionType, choice) : null;
+            const pendingContinuation = pendingAction
+                ? parseContinuationPreview(pendingAction.continuationPreviewJson)
+                : null;
+            const isReviewerResumeCandidate = !!pendingAction &&
+                pendingAction.status === "open" &&
+                !!pendingIssue &&
+                !!pendingResolution &&
+                (pendingAction.actionType === "policy_escalation" ||
+                    pendingAction.actionType === "deck_interaction_required") &&
+                pendingResolution.choice === "resume" &&
+                pendingContinuation?.resumeRole === "reviewer" &&
+                !!pendingContinuation.resumeHeadSha &&
+                pendingIssue.prNumber != null;
+            resumeLiveHeadSha = isReviewerResumeCandidate
+                ? await fetchResumeLiveHeadSha({ prNumber: pendingIssue.prNumber, repo: pendingIssue.repo })
+                : null;
+        }
+        catch {
+            resumeLiveHeadSha = null;
+        }
+    }
     // NOT-196: the `gh` PR-state read runs here, outside any DB transaction — the sync
     // core below only consumes the pre-read state. Only close choices on issues with a
     // PR number pay for the call; anything unreadable resolves to "unknown" (or
     // undefined when there is nothing to check), both of which keep today's `closed`.
     const externalMergeState = await preReadExternalMergeState(actionId, choice);
-    const result = resolveHumanActionAndAdvance(actionId, resolvedBy, choice, { externalMergeState });
+    const result = resolveHumanActionAndAdvance(actionId, resolvedBy, choice, {
+        resumeLiveHeadSha,
+        externalMergeState,
+    });
     if (!result.ok || !result.pendingMerge)
         return result;
     const action = getHumanAction(actionId);