agent-dealer 1.2.4 → 1.2.6

package/bundle/server/dist/capacity/muse-host.js

@@ -25,10 +25,12 @@
 //   connection (`hasInflightExecution`): a capacity read must not SIGTERM
 //   an admitted turn.
 // - The host launches under a server-owned XDG home
-//   (`prepareMuseServeHome`): the same worker posture as the exec lane's
-//   per-attempt settings (no MCP servers, no subagents, no workflows, no
-//   reminders) plus a symlink to the ambient login, so serve-lane turns
-//   never inherit the operator's ambient config.
+//   (`prepareMuseServeHome`): the deckless worker base posture
+//   (`buildMuseBaseSettings` — no MCP servers, no subagents, no workflows,
+//   no reminders) plus a symlink to the ambient login, so the host never
+//   inherits the operator's ambient config. It runs no sessions; deck-enabled
+//   developer turns each carry their own required `agent-deck` server on the
+//   isolated exec lane.
 // - `usage/changed` is ingested as soon as received; the throttled
 //   on-demand `usage/read` on the same host is the final read.
 // - Restart/crash: usage state is process-local to the host, so a dead host
@@ -51,17 +53,16 @@
 //   for an hour.
 //
 // Execution precondition (NOT-269): only a host that observes the account's
-// provider traffic can answer `usage/read`. Real Dealer Muse turns run
-// through THIS host (`session/start` + `turn/start` via the execution lane
-// below, driven by runners/muse-serve-session.ts) — that traffic is the
-// observation, so the session-boundary refresh hook
-// (`refreshMuseCapacityAfterSession` in coordinator/muse-spawn.ts) is the
-// final `usage/read` that populates 5H/1W. If no genuine turn has populated
-// a complete current pair for an hour, `muse-probe.ts` may use its own host
-// for the bounded paid fallback. When the normal serve execution lane cannot
-// admit a developer turn, that session still falls back to the legacy
-// `muse exec` subprocess before any model work starts; last-good capacity
-// rows remain preserved.
+// provider traffic can answer `usage/read`. NOT-278 removed developer turns
+// from this host: every deck-enabled Muse developer turn runs the isolated
+// `muse exec` lane (coordinator/muse-spawn.ts), which cannot observe the
+// host, so the session-boundary refresh hook
+// (`refreshMuseCapacityAfterSession` in coordinator/muse-spawn.ts) stays
+// honest N/A with last-good rows preserved until a genuine turn observes
+// the host again. If no genuine turn has populated a complete current pair
+// for an hour, `muse-probe.ts` may use its own host for the bounded paid
+// fallback. Per-session Agent Deck support for the serve protocol is a
+// non-goal until the protocol can represent isolated session MCP identity.
 //
 // PRODUCT DECISION (2026-09-26, resolved via human_action on this ticket):
 // the runner migration is in scope for NOT-270, in this same PR, not a
@@ -87,24 +88,43 @@
 //   shell restriction) is unaffected.
 // This question was escalated twice on this ticket (product_scope_decision,
 // resolved both times); the decision above is final for NOT-270's scope.
-import { spawn } from "node:child_process";
+import { execFile, spawn } from "node:child_process";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { MUSE_CLI_ENV, resolveMuseAuthFile, resolveMuseBin } from "../cli-env.js";
-import { buildMuseDeveloperSettings } from "../runners/muse-code-settings.js";
+import { getDataDir } from "../db/index.js";
+import { parseMuseVersion } from "../adapters/muse-capability.js";
+import { buildMuseBaseSettings } from "../runners/muse-config.js";
 import { MSP_USAGE_CHANGED, MUSE_CLIENT_INFO, MUSE_SERVE_ARGV, assertMuseExecMethod, assertMuseReadOnlyMethod, hasMuseCredential, ingestMuseUsagePayload, museCapacityTimeoutMs, museClassifyRpcError, museEvidenceRef, museRefreshThrottleMs, museUuidv7, noteMuseCapacityFailure, parseMuseRpcLine, } from "./muse.js";
+function readResolvedMuseVersion() {
+    return new Promise((resolve) => {
+        execFile(resolveMuseBin(), ["--version"], { encoding: "utf8", timeout: 30_000, env: { ...process.env, ...MUSE_CLI_ENV } }, (err, stdout) => resolve(err ? null : parseMuseVersion(stdout)));
+    });
+}
+/**
+ * NOT-273: dedicated cwd for the coordinator-owned `muse serve` child.
+ * The spawn must never inherit the server process's ambient working
+ * directory (in a maintainer's `npm run dev` checkout that is the repo
+ * itself, where a stray `git add . && git commit` in the child would land
+ * real commits on the checkout). Created if missing.
+ */
+export function resolveMuseHostCwd() {
+    const dir = path.join(getDataDir(), "capacity", "muse-host-home");
+    fs.mkdirSync(dir, { recursive: true });
+    return dir;
+}
 /**
- * NOT-270 serve lane: the owned host must run workers under the same
- * posture as the exec lane's per-attempt settings — no MCP servers, no
- * subagent delegation, no workflows, no reminder child runs — so serve-lane
- * turns never inherit the operator's ambient MCP/subagent config. Builds a
- * server-owned config home carrying `buildMuseDeveloperSettings()` plus a
- * symlink to the ambient login (linked, never read or copied; absent when
- * the operator authenticates with META_API_KEY), and an isolated data home
- * for the host's own session/state. Mirrors the exec lane's per-attempt
- * dirs (`coordinator/muse-spawn.ts`), but process-scoped: one home per host
- * instance, reused across restarts, removed on shutdown.
+ * NOT-278: the owned host never runs a session — it only serves the read-only
+ * handshake/`usage/read` allowlist for capacity, and it is shared across decks, so it
+ * carries the deckless worker base posture (`buildMuseBaseSettings()`: no MCP servers, no
+ * subagent delegation, no workflows, no reminder child runs) and never inherits the
+ * operator's ambient MCP/subagent config. Builds a server-owned config home carrying those
+ * base settings plus a symlink to the ambient login (linked, never read or copied; absent
+ * when the operator authenticates with META_API_KEY), and an isolated data home for the
+ * host's own session/state. Deck-enabled developer turns run on the isolated exec lane
+ * (`coordinator/muse-spawn.ts`), each with its own required `agent-deck` server. Process-
+ * scoped: one home per host instance, reused across restarts, removed on shutdown.
  */
 export function prepareMuseServeHome(ambientAuthFile = resolveMuseAuthFile()) {
     const root = fs.mkdtempSync(path.join(os.tmpdir(), "dealer-muse-serve-"));
@@ -116,7 +136,7 @@ export function prepareMuseServeHome(ambientAuthFile = resolveMuseAuthFile()) {
     fs.chmodSync(root, 0o700);
     fs.chmodSync(configHome, 0o700);
     fs.chmodSync(dataHome, 0o700);
-    fs.writeFileSync(path.join(configHome, "muse", "settings.json"), `${JSON.stringify(buildMuseDeveloperSettings(), null, 2)}\n`, { mode: 0o600 });
+    fs.writeFileSync(path.join(configHome, "muse", "settings.json"), `${JSON.stringify(buildMuseBaseSettings(), null, 2)}\n`, { mode: 0o600 });
     let authLinked = false;
     try {
         if (fs.existsSync(ambientAuthFile)) {
@@ -171,6 +191,14 @@ export class MuseCapacityHost {
     observedOnConnection = false;
     /** Increments on every spawn — tests use it to prove host reuse/restart. */
     connectionEpoch = 0;
+    /**
+     * NOT-277: the Muse version the live child runs — the on-disk binary's reported version, read
+     * immediately before the spawn and again after the handshake; null when unknown or when the
+     * binary changed across the spawn. A long-lived host keeps running the build it started on
+     * after an auto-update, so developer work only uses it when this is the capability-checked
+     * version (see `ensureStartedOnVersion`).
+     */
+    runningVersion = null;
     /**
      * Server-owned XDG home for the host (worker settings + auth link).
      * Built lazily on first spawn, reused across restarts, removed on
@@ -199,9 +227,9 @@ export class MuseCapacityHost {
     /**
      * Env for the host subprocess: the server-owned XDG home always wins over
      * inherited ambient config (the server process itself may run under an
-     * operator XDG home), so serve-lane workers never inherit ambient MCP
-     * servers, subagents, or workflows. Only an explicit XDG override in
-     * `opts.env` (tests) still wins.
+     * operator XDG home), so the host never inherits ambient MCP servers,
+     * subagents, or workflows. Only an explicit XDG override in `opts.env`
+     * (tests) still wins.
      */
     mergedEnv() {
         const home = this.ensureServeHome();
@@ -241,6 +269,7 @@ export class MuseCapacityHost {
         const child = this.child;
         this.child = null;
         this.dead = true;
+        this.runningVersion = null;
         for (const [, p] of this.pending) {
             try {
                 p.resolve({});
@@ -457,8 +486,29 @@ export class MuseCapacityHost {
             this.starting = null;
         }
     }
+    /**
+     * NOT-277: start (or reuse) the host, and report whether it runs `version`. A live host on any
+     * other (or an unknown) version is restarted onto the current on-disk binary when it is idle;
+     * while the connection is in use it is left alone and this returns false. Never true for a
+     * host not known to run `version`. (NOT-278: no developer turn runs on the host any more —
+     * this only gates capacity reads, which are version-independent.)
+     */
+    async ensureStartedOnVersion(version) {
+        if (!(await this.ensureStarted()))
+            return false;
+        if (this.runningVersion === version)
+            return true;
+        if (this.hasInflightExecution() || this.inflightRead)
+            return false;
+        this.killChild();
+        if (!(await this.ensureStarted()))
+            return false;
+        return this.runningVersion === version;
+    }
     async start() {
         this.killChild();
+        const readVersion = this.opts.readVersion ?? (this.opts.command ? async () => null : readResolvedMuseVersion);
+        const versionBefore = await readVersion();
         const timeoutMs = this.opts.timeoutMs ?? museCapacityTimeoutMs();
         const mergedEnv = this.mergedEnv();
         if (!hasMuseCredential(mergedEnv, this.opts.authFilePath ?? resolveMuseAuthFile())) {
@@ -469,7 +519,12 @@ export class MuseCapacityHost {
         const args = this.opts.args ?? [...MUSE_SERVE_ARGV];
         let child;
         try {
-            child = spawn(command, args, {
+            // NOT-273: explicit cwd — never inherit the server process's ambient
+            // working directory (which in dev is the repo checkout itself).
+            const cwd = this.opts.cwd ?? resolveMuseHostCwd();
+            const spawnFn = this.opts.spawnImpl ?? spawn;
+            child = spawnFn(command, args, {
+                cwd,
                 stdio: ["pipe", "pipe", "pipe"],
                 env: { ...mergedEnv, ...MUSE_CLI_ENV },
             });
@@ -566,6 +621,11 @@ export class MuseCapacityHost {
             this.killChild();
             return false;
         }
+        // The spawned build is the on-disk one only if the binary did not change across the spawn.
+        const versionAfter = await readVersion();
+        if (this.isCurrentChild(child)) {
+            this.runningVersion = versionBefore !== null && versionBefore === versionAfter ? versionBefore : null;
+        }
         return true;
     }
     startFailure = null;

package/bundle/server/dist/capacity/muse-host.test.js

@@ -21,7 +21,7 @@ import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 process.env.AGENT_DEALER_HOME = fs.mkdtempSync(path.join(os.tmpdir(), "dealer-muse-host-"));
-import { getMuseCapacityHost, maybeRefreshMuseCapacityFromHost, MuseCapacityHost, prepareMuseServeHome, refreshMuseCapacityFromHost, resetMuseCapacityHostForTests, resetMuseCapacityRefreshState, shutdownMuseCapacityHost, } from "./muse-host.js";
+import { getMuseCapacityHost, maybeRefreshMuseCapacityFromHost, MuseCapacityHost, prepareMuseServeHome, refreshMuseCapacityFromHost, resetMuseCapacityHostForTests, resetMuseCapacityRefreshState, resolveMuseHostCwd, shutdownMuseCapacityHost, } from "./muse-host.js";
 import { ingestMuseUsagePayload, museRefreshThrottleMs, noteMuseCapacityFailure, } from "./muse.js";
 const { migrate } = await import("../db/index.js");
 const { clearAllCapacitySnapshots, listCapacitySnapshots } = await import("../repository/runtime-capacity.js");
@@ -342,6 +342,66 @@ test("a stale child's late close cannot kill its replacement", async () => {
         await host.shutdown();
     }
 });
+// NOT-277: developer work is only served on a host known to run the capability-checked build.
+function versionedHost(versions) {
+    let i = 0;
+    const readVersion = async () => versions[Math.min(i++, versions.length - 1)] ?? null;
+    return new MuseCapacityHost({ ...hostOpts("persistent-full"), readVersion });
+}
+test("the host records the version it was spawned on; a matching host is reused", async () => {
+    const host = versionedHost(["1.4.0-R4161.1"]);
+    try {
+        assert.equal(await host.ensureStartedOnVersion("1.4.0-R4161.1"), true);
+        assert.equal(host.runningVersion, "1.4.0-R4161.1");
+        assert.equal(await host.ensureStartedOnVersion("1.4.0-R4161.1"), true);
+        assert.equal(host.connectionEpoch, 1, "no restart when the host already runs the version");
+    }
+    finally {
+        await host.shutdown();
+    }
+});
+test("an idle host on an older build is restarted onto the confirmed version", async () => {
+    // Spawned on B (before + after the handshake), then the binary is C for the restart.
+    const host = versionedHost(["1.4.0-R4161.1", "1.4.0-R4161.1", "1.4.0-R4302.1"]);
+    try {
+        assert.ok(await host.ensureStarted());
+        assert.equal(host.runningVersion, "1.4.0-R4161.1");
+        assert.equal(await host.ensureStartedOnVersion("1.4.0-R4302.1"), true);
+        assert.equal(host.connectionEpoch, 2, "restarted onto the checked build");
+        assert.equal(host.runningVersion, "1.4.0-R4302.1");
+    }
+    finally {
+        await host.shutdown();
+    }
+});
+test("a busy host on an older build is left alone and not used", async () => {
+    const host = versionedHost(["1.4.0-R4161.1", "1.4.0-R4161.1", "1.4.0-R4302.1"]);
+    try {
+        assert.ok(await host.ensureStarted());
+        // An admitted turn on the shared connection: never torn down under it.
+        const waiting = host.waitForHostNotification(() => false, 5_000);
+        assert.equal(await host.ensureStartedOnVersion("1.4.0-R4302.1"), false);
+        assert.equal(host.connectionEpoch, 1);
+        assert.ok(host.isConnected());
+        await host.shutdown();
+        await waiting;
+    }
+    finally {
+        await host.shutdown();
+    }
+});
+test("a binary that changed across the spawn leaves the host's version unknown (never served)", async () => {
+    // Changes across the first spawn and again across the restart.
+    const host = versionedHost(["1.4.0-R4161.1", "1.4.0-R4302.1", "1.4.0-R4302.1", "1.5.0-R5000.1"]);
+    try {
+        assert.equal(await host.ensureStartedOnVersion("1.4.0-R4302.1"), false);
+        assert.equal(host.connectionEpoch, 2);
+        assert.equal(host.runningVersion, null);
+    }
+    finally {
+        await host.shutdown();
+    }
+});
 test("clean shutdown releases the child process", async () => {
     const host = new MuseCapacityHost(hostOpts("persistent-full"));
     assert.equal((await host.readUsage()).status, "observed");
@@ -413,9 +473,11 @@ test("serve host launches under a server-owned config home with worker settings"
         assert.ok(!String(rec.dataHome).includes(".config"), "data home is not the operator's");
         assert.equal(rec.settingsError, null, "settings.json parses on the launched host");
         const settings = rec.settings;
-        // Same worker posture as the exec lane's per-attempt settings: no MCP
-        // servers, no subagent delegation, no workflows, no reminder child runs.
-        assert.ok(!("mcpServers" in settings), "workers get no MCP servers");
+        // NOT-278: the host runs no sessions, so it carries the deckless worker base posture
+        // (`buildMuseBaseSettings`): no MCP servers, no subagent delegation, no workflows, no
+        // reminder child runs. Deck-enabled developer turns each carry their own required
+        // `agent-deck` server on the isolated exec lane.
+        assert.ok(!("mcpServers" in settings), "the host carries no MCP servers");
         const run = settings.run;
         assert.equal(run.workflow_trigger_mode, "off");
         assert.equal(run.subagent_delegation_mode, "off");
@@ -458,6 +520,70 @@ test("prepareMuseServeHome links the ambient login, or records API-key auth", as
     }
     fs.rmSync(ambientRoot, { recursive: true, force: true });
 });
+test("NOT-273: the serve child spawns with an explicit cwd under the managed data dir", async () => {
+    const { EventEmitter } = await import("node:events");
+    const { getDataDir } = await import("../db/index.js");
+    const seen = [];
+    const hangingChild = () => {
+        const events = new EventEmitter();
+        const fake = {
+            stdin: { write: () => true, on: () => ({}) },
+            stdout: { on: () => ({}) },
+            stderr: { on: () => ({}) },
+            on: events.on.bind(events),
+            // The handshake never answers, but a kill() must still settle the
+            // child like a real process would — otherwise shutdown()'s teardown
+            // has nothing but its 2s unref'd SIGKILL-escalation timer to resolve
+            // on, which races the test runner's own event-loop bookkeeping and
+            // can cancel the test outright (see the child-ticket playbook gotcha:
+            // never await an infinite fake handler).
+            kill: () => {
+                fake.exitCode = 0;
+                queueMicrotask(() => events.emit("close"));
+                return true;
+            },
+            exitCode: null,
+        };
+        return fake;
+    };
+    const host = new MuseCapacityHost({
+        command: process.execPath,
+        args: [FAKE],
+        env: { META_API_KEY: "test-fake-key" },
+        // Handshake never answers — start() still records the exact spawn options.
+        timeoutMs: 100,
+        spawnImpl: ((command, args, options) => {
+            seen.push({ command, args, options });
+            return hangingChild();
+        }),
+    });
+    // This test's fake spawn has no real child process, so nothing else keeps
+    // the event loop busy while the production code's handshake/kill timers
+    // (deliberately unref'd — a real server must never block on them) are
+    // pending. With zero other ref'd handles, some Node versions' test runner
+    // treats the loop as "drained" before those timers fire and cancels the
+    // test outright (cancelledByParent). A trivial ref'd keepalive avoids the
+    // race without touching the production unref'd-timer behavior being tested.
+    const keepalive = setInterval(() => { }, 10);
+    try {
+        // Missing (handshake timeout), not a spawn failure — the spawn happened.
+        assert.equal((await host.readUsage()).status, "missing");
+        assert.equal(seen.length, 1, "exactly one serve spawn");
+        const cwd = seen[0].options.cwd;
+        assert.equal(typeof cwd, "string", "spawn options include an explicit cwd");
+        const dir = cwd;
+        assert.ok(path.isAbsolute(dir), `cwd is absolute, got ${dir}`);
+        assert.notEqual(path.resolve(dir), path.resolve(process.cwd()), "cwd is not the ambient process cwd");
+        assert.ok(dir.startsWith(`${getDataDir()}${path.sep}`), `cwd lives under the managed data dir, got ${dir}`);
+        assert.equal(path.basename(dir), "muse-host-home");
+        assert.ok(fs.existsSync(dir), "the dedicated cwd is created if missing");
+        assert.equal(resolveMuseHostCwd(), dir, "default cwd is the dedicated data-dir home");
+    }
+    finally {
+        await host.shutdown();
+        clearInterval(keepalive);
+    }
+});
 test("no credential short-circuits to missing without spawning", async () => {
     const noAuthDir = fs.mkdtempSync(path.join(os.tmpdir(), "dealer-muse-host-noauth-"));
     const env = { ...process.env, FAKE_MSP_MODE: "persistent-full" };

package/bundle/server/dist/coordinator/admission.test.js

@@ -401,6 +401,91 @@ test("NOT-178: a Muse Code developer without credentials is refused at admission
         setAdmissionHealthCheckerForTests(async () => ({ ok: true }));
     }
 });
+// NOT-277: a Muse Code auto-update is re-validated automatically. A version whose developer
+// shell/write check passes is admitted with no manual step; one that lost it is refused with the
+// versions and capability named; one whose check could not complete is refused, never assumed ok.
+test("NOT-277: a Muse Code update is admitted when capable, refused by name when not", async () => {
+    const { clearAgentHealthCaches, runtimeIssuesUncached } = await import("../adapters/agent-health.js");
+    const { setMuseCapabilityProbeForTests, settleMuseCapabilityCheckForTests } = await import("../adapters/muse-capability.js");
+    const OLD = "1.3.0-R3401.1";
+    const NEW = "1.4.0-R4161.1";
+    const BROKEN = "1.4.0-R4302.1";
+    const stubDir = fs.mkdtempSync(path.join(os.tmpdir(), "dealer-muse-stub-"));
+    const versionFile = path.join(stubDir, "version");
+    const stub = path.join(stubDir, "muse");
+    fs.writeFileSync(stub, `#!/bin/sh\ncat ${JSON.stringify(versionFile)}\n`);
+    fs.chmodSync(stub, 0o755);
+    // The real checker's async path runs `gh auth status` too; CI runners have no gh login,
+    // so a logged-in stub keeps the `ok: true` assertions about Muse alone.
+    const ghStub = path.join(stubDir, "gh");
+    fs.writeFileSync(ghStub, "#!/bin/sh\necho 'Logged in to github.com account dealer-test'\nexit 0\n");
+    fs.chmodSync(ghStub, 0o755);
+    const probed = [];
+    setMuseCapabilityProbeForTests(async (version) => {
+        probed.push(version);
+        if (version === BROKEN)
+            return { status: "missing", detail: "probe session completed without running its shell command" };
+        if (version === "9.9.9-R1")
+            throw new Error("probe session timed out");
+        return { status: "capable" };
+    });
+    const saved = {
+        MUSE_CLI: process.env.MUSE_CLI,
+        META_API_KEY: process.env.META_API_KEY,
+        SKIP: process.env.AGENT_DEALER_SKIP_AGENT_HEALTH,
+        PATH: process.env.PATH,
+    };
+    process.env.MUSE_CLI = stub;
+    process.env.PATH = `${stubDir}${path.delimiter}${process.env.PATH ?? ""}`;
+    process.env.META_API_KEY = "k";
+    delete process.env.AGENT_DEALER_SKIP_AGENT_HEALTH;
+    setAdmissionHealthCheckerForTests(null);
+    clearAgentHealthCaches();
+    /** Muse reports `version`; the next health read sees it and its one-time check settles. */
+    const museReports = async (version) => {
+        fs.writeFileSync(versionFile, `Muse Code ${version.split("-")[0]} (${version})\n`);
+        await runtimeIssuesUncached("muse_code");
+        await settleMuseCapabilityCheckForTests();
+    };
+    try {
+        const issue = readyIssue("muse-updated", { runtimes: { dev: "muse_code", rev: "codex_local" } });
+        const developerHealth = () => checkRoleAgentHealthy(issue, "developer", { deckOnline: true });
+        await museReports(OLD);
+        assert.deepEqual(await developerHealth(), { ok: true });
+        await museReports(NEW);
+        assert.deepEqual(await developerHealth(), { ok: true });
+        assert.deepEqual(probed, [OLD, NEW]);
+        await museReports(BROKEN);
+        enqueueIssue(issue.id);
+        assert.equal(await admitNext(), null);
+        assert.equal(getIssue(issue.id).status, "ready");
+        assert.equal(getActiveWorkflowInstance(issue.id), null);
+        const reason = getQueuedEntryForIssue(issue.id).waitReason;
+        assert.match(reason, /developer unhealthy/);
+        assert.match(reason, new RegExp(`Muse Code updated ${NEW} → ${BROKEN}: developer sessions no longer get shell/write access`));
+        await museReports("9.9.9-R1");
+        const unverified = await developerHealth();
+        assert.equal(unverified.ok, false);
+        assert.match(unverified.reason, new RegExp(`Could not verify Muse Code developer shell/write access after version change \\(${BROKEN} → 9\\.9\\.9-R1\\)`));
+        assert.deepEqual(probed, [OLD, NEW, BROKEN, "9.9.9-R1"]);
+    }
+    finally {
+        for (const [key, value] of Object.entries({
+            MUSE_CLI: saved.MUSE_CLI,
+            META_API_KEY: saved.META_API_KEY,
+            AGENT_DEALER_SKIP_AGENT_HEALTH: saved.SKIP,
+            PATH: saved.PATH,
+        })) {
+            if (value === undefined)
+                delete process.env[key];
+            else
+                process.env[key] = value;
+        }
+        setMuseCapabilityProbeForTests(null);
+        clearAgentHealthCaches();
+        setAdmissionHealthCheckerForTests(async () => ({ ok: true }));
+    }
+});
 // NOT-178: Muse Code is developer-only, so it is never a healthy reviewer — even with the
 // unit-test health skip on, and without probing the CLI.
 test("NOT-178: a Muse Code reviewer is refused regardless of CLI health", async () => {

package/bundle/server/dist/coordinator/args.js

@@ -33,9 +33,10 @@ function claudeDisallowedTools(policy) {
 }
 function buildArgs(runtime, policy, prompt, model, mcpConfigPath, effort) {
     if (runtime === "muse_code") {
-        // Muse's developer argv is built by runners/muse-code-args.ts inside coordinator/muse-spawn.ts
-        // (NOT-181); it needs a per-attempt session id and XDG dirs this pure builder has no place
-        // for. Falling through to the Claude arm below would spawn `muse` with Claude flags.
+        // Muse's developer argv is built by runners/muse-config.ts (`prepareMuseAttempt`,
+        // NOT-278) inside coordinator/muse-spawn.ts; it needs a per-attempt deck, session id, and
+        // XDG dirs this pure builder has no place for. Falling through to the Claude arm below
+        // would spawn `muse` with Claude flags.
         throw new Error("muse_code is not wired through the shared arg builder — its developer argv is built in coordinator/muse-spawn.ts");
     }
     if (runtime === "codex_local") {

package/bundle/server/dist/coordinator/checkpoint.js

@@ -26,9 +26,11 @@ export function emitCheckpointObserved(ev) {
             samplingPrecisionMs: ev.samplingPrecisionMs ?? null,
             branch: ev.branch ?? null,
         },
-        idempotencyKey: ev.kind === "commit" && ev.origin === "salvage"
-            ? `checkpoint:${ev.workerSessionId}:commit:salvage`
-            : `checkpoint:${ev.workerSessionId}:${ev.kind}`,
+        idempotencyKey: ev.resumeSalvage && ev.observedSha
+            ? `checkpoint:resume-salvage:${ev.issueId}:${ev.observedSha}`
+            : ev.kind === "commit" && ev.origin === "salvage"
+                ? `checkpoint:${ev.workerSessionId}:commit:salvage`
+                : `checkpoint:${ev.workerSessionId}:${ev.kind}`,
     });
 }
 /**

package/bundle/server/dist/coordinator/checkpoint.test.js

@@ -167,3 +167,26 @@ test("checkpoints attribute per session across attempts of one issue", async ()
     assert.deepEqual(records.map((r) => r.sessionId).sort(), [sessionId, second.id].sort());
     assert.deepEqual(records.map((r) => r.observedSha).sort(), [COMMIT_SHA, "c".repeat(40)].sort());
 });
+test("NOT-280: resume-salvage checkpoints dedupe per issue on restart but never collide across issues with an identical commit SHA", async () => {
+    const a = await setup();
+    const b = await setup();
+    const emit = (ctx) => emitCheckpointObserved({
+        issueId: ctx.issueId,
+        workflowInstanceId: ctx.instanceId,
+        workerSessionId: ctx.sessionId,
+        role: "developer",
+        stage: "developing",
+        round: 1,
+        kind: "commit",
+        observedSha: COMMIT_SHA,
+        origin: "salvage",
+        resumeSalvage: true,
+    });
+    emit(a);
+    emit(a); // restart re-detecting the same saved tip
+    emit(b); // another issue whose salvage produced the identical commit object
+    assert.equal(checkpointsOf(a.issueId, "commit").length, 1, "restart never duplicates the row");
+    assert.equal(checkpointsOf(b.issueId, "commit").length, 1, "the second issue still gets its own checkpoint");
+    const [row] = listWorkflowEventsForIssue(b.issueId).filter((e) => e.type === "checkpoint.observed");
+    assert.equal(row.workerSessionId, b.sessionId, "tied to its own predecessor session");
+});