agent-dealer 1.2.4 → 1.2.6

package/bundle/server/dist/coordinator/commands.js

@@ -11,7 +11,7 @@ import { canTransitionIssue } from "@agent-dealer/shared";
 import { getDb } from "../db/index.js";
 import { getIssue, incrementIssueRound, incrementIssueInfraAttempts, resetIssueInfraAttempts, grantReviewRetry, transitionIssue, } from "../repository/issues.js";
 import { appendWorkflowEvent, completeWorkflowInstance, getActiveWorkflowInstance, getWorkflowInstance, listWorkflowEventsForIssue, startWorkflowInstance, WorkflowAlreadyActiveError, } from "../repository/workflow-events.js";
-import { createHumanAction, findOpenHumanAction, getHumanAction, listHumanActionsForIssue, resolveHumanAction, updateOpenHumanAction, } from "../repository/human-actions.js";
+import { createHumanAction, findOpenHumanAction, getHumanAction, listHumanActionsForIssue, reopenHumanAction, resolveHumanAction, updateOpenHumanAction, } from "../repository/human-actions.js";
 import { pushLeaseToSha, readRemoteTip } from "../adapters/git-worktree.js";
 import { ensureIssueRepoCheckout } from "../adapters/managed-repo.js";
 import { reconcileFinding, resolveFindingsAbsentFromRound } from "../repository/findings.js";
@@ -28,7 +28,7 @@ import { reasonForWorkerFailedEvent } from "./failure-reason.js";
 import { recordCausesForWorkerFailedEvent } from "./failure-cause.js";
 import { routeDeveloperOutcome, routeReviewerOutcome, } from "./routing.js";
 import { projectDeveloperRoute, projectReviewerRoute } from "./projection.js";
-import { MERGE_FAILURE_EVIDENCE_KEY, MERGE_FAILURE_RESPONSE_OPTIONS, PUSH_DIVERGENCE_EVIDENCE_KEY, PUSH_DIVERGENCE_RESPONSE_OPTIONS, parseHumanResolution, resolveHumanActionOutcome, } from "./human-resolution.js";
+import { MERGE_FAILURE_EVIDENCE_KEY, MERGE_FAILURE_RESPONSE_OPTIONS, PUSH_DIVERGENCE_EVIDENCE_KEY, PUSH_DIVERGENCE_RESPONSE_OPTIONS, WORKTREE_BLOCKER_EVIDENCE_KEY, normalizeResolutionNote, parseHumanResolution, resolveHumanActionOutcome, } from "./human-resolution.js";
 import { AUTO_MERGE_INTENT, finalizeAutoMerge } from "./auto-merge.js";
 import { externalMergeStateForIssue } from "./external-merge.js";
 import { detectNonConvergence, formatNonConvergenceReason, reviewHistoryFromEvents, } from "./non-convergence.js";
@@ -197,7 +197,7 @@ export function activeWorkflowConflictMessage(issueId) {
  * the gate stays on startWorkflow; clearing a stale gate after AC lands lives here so
  * admitNext cannot leave it dangling.
  */
-export function startWorkflowCore(issueId) {
+export function startWorkflowCore(issueId, opts) {
     const issue = getIssue(issueId);
     if (!issue)
         throw new StartPreconditionError(404, "Issue not found");
@@ -233,7 +233,12 @@ export function startWorkflowCore(issueId) {
         workflowInstanceId: instance.id,
         kind: "developer",
         round: 1,
-        payload: { profileSnapshot: queuedProfileSnapshot(issue, "developer") },
+        payload: {
+            profileSnapshot: queuedProfileSnapshot(issue, "developer"),
+            // NOT-272: carry the scope decision only on this first round's payload — later
+            // rounds never see it (the prompt reads it from here, not from the DB).
+            ...(opts?.scopeDecisionNote ? { scopeDecisionNote: opts.scopeDecisionNote } : {}),
+        },
         idempotencyKey: `${instance.id}:developer:1`,
     });
     // NOT-103: every successful start is a force-admit — keep queue state in sync whether
@@ -781,6 +786,19 @@ function applyEffect(issue, instance, effect, route, issueNow, ev, causativeItem
         const pushDivergence = actionType === "policy_escalation" && !resumeAsReviewer
             ? (effect.pushDivergence ?? null)
             : null;
+        // NOT-280: an unchanged worktree blocker (same fingerprint) lands on the action it
+        // already raised — still open, or reopened when a Resume changed nothing — instead of
+        // opening an identical one on every Resume.
+        const blockerFingerprint = effect.kind === "human_action" ? (effect.blockerFingerprint ?? null) : null;
+        if (blockerFingerprint) {
+            const same = sameBlockerAction(issue.id, blockerFingerprint);
+            if (same) {
+                ev.emit("human_action.requested", {
+                    payload: { actionType: same.actionType, actionId: same.id, reopened: true, blockerFingerprint },
+                });
+                return { ...base, humanActionId: same.id };
+            }
+        }
         const action = createHumanAction({
             issueId: issue.id,
             workflowInstanceId: instance.id,
@@ -791,7 +809,9 @@ function applyEffect(issue, instance, effect, route, issueNow, ev, causativeItem
                 ? { review: reviewerOutcome.result, ...(nonConvergence ? { nonConvergence } : {}) }
                 : pushDivergence
                     ? { [PUSH_DIVERGENCE_EVIDENCE_KEY]: pushDivergence }
-                    : undefined,
+                    : blockerFingerprint
+                        ? { [WORKTREE_BLOCKER_EVIDENCE_KEY]: { fingerprint: blockerFingerprint } }
+                        : undefined,
             // issueNow.headSha, not issue.headSha: a stale outcome that itself exhausted the
             // infra budget already patched the newly observed head onto the issue above — the
             // pre-transition issue param would still carry the stale SHA a "resume" must not reuse.
@@ -814,6 +834,51 @@ function applyEffect(issue, instance, effect, route, issueNow, ev, causativeItem
     }
     return base;
 }
+/**
+ * NOT-280: an action reopened for an unchanged blocker (`sameBlockerAction`) can be
+ * resumed again — each Resume of it needs its own work item, so later resolutions of the
+ * same action get an ordinal suffix. The first Resume keeps the plain action-keyed name.
+ */
+function resumeWorkItemKey(issueId, baseKey) {
+    const taken = new Set(listWorkItemsForIssue(issueId).map((w) => w.idempotencyKey));
+    if (!taken.has(baseKey))
+        return baseKey;
+    let n = 2;
+    while (taken.has(`${baseKey}:${n}`))
+        n++;
+    return `${baseKey}:${n}`;
+}
+/**
+ * NOT-280: the issue's most recent action, when it was raised for exactly this worktree
+ * blocker fingerprint and is either still open or was resolved by a Resume — reopened in
+ * that case. Anything else in between (another action, a different choice, a changed
+ * blocker) means state moved, so the caller raises a fresh action.
+ */
+function sameBlockerAction(issueId, fingerprint) {
+    const actions = listHumanActionsForIssue(issueId);
+    const latest = actions[actions.length - 1];
+    if (!latest?.evidenceJson)
+        return null;
+    try {
+        const evidence = JSON.parse(latest.evidenceJson);
+        if (evidence[WORKTREE_BLOCKER_EVIDENCE_KEY]?.fingerprint !== fingerprint)
+            return null;
+    }
+    catch {
+        return null;
+    }
+    if (latest.status === "open")
+        return latest;
+    try {
+        const resolution = latest.resolutionJson ? JSON.parse(latest.resolutionJson) : null;
+        if (resolution?.choice !== "resume")
+            return null;
+    }
+    catch {
+        return null;
+    }
+    return reopenHumanAction(latest.id);
+}
 /**
  * NOT-194: true when the action is a merge-failure escalation (evidence carries
  * `mergeFailure: true`). Pre-NOT-194 open merge-failure actions have no such evidence and
@@ -982,10 +1047,23 @@ export function resolveHumanActionAndAdvance(actionId, resolvedBy, choice, opts)
         return { ok: false, code: 404, error: "Human action not found" };
     if (action.status !== "open")
         return { ok: false, code: 409, error: "Human action already resolved" };
-    const resolution = parseHumanResolution(action.actionType, choice);
+    // NOT-272: same shape validation as the HTTP route (which already applied it) —
+    // defense in depth for direct/CLI callers of this sync entry point.
+    const normalizedNote = normalizeResolutionNote(opts?.note);
+    if (!normalizedNote.ok)
+        return { ok: false, code: 400, error: normalizedNote.error };
+    const resolution = parseHumanResolution(action.actionType, choice, normalizedNote.note);
     if (!resolution) {
         return { ok: false, code: 400, error: `Invalid choice "${choice}" for ${action.actionType}` };
     }
+    // NOT-272: the typed resolution carries the note only for product_scope_decision
+    // (parseHumanResolution drops it for every other action type).
+    const scopeDecisionNote = resolution.actionType === "product_scope_decision" && "note" in resolution
+        ? resolution.note
+        : undefined;
+    const storedResolution = scopeDecisionNote
+        ? { choice, note: scopeDecisionNote }
+        : { choice };
     // NOT-194: narrow policy_escalation choices per action. A merge-failure action offers
     // retry_merge/repair/close only (resume would re-run development on approved work);
     // every other policy_escalation keeps resume/close only. Pre-NOT-194 open merge-failure
@@ -1077,7 +1155,7 @@ export function resolveHumanActionAndAdvance(actionId, resolvedBy, choice, opts)
         }
         try {
             return getDb().transaction(() => {
-                resolveHumanAction(actionId, resolvedBy, { choice });
+                resolveHumanAction(actionId, resolvedBy, storedResolution);
                 appendWorkflowEvent({
                     issueId: issue.id,
                     type: "human_action.resolved",
@@ -1086,7 +1164,10 @@ export function resolveHumanActionAndAdvance(actionId, resolvedBy, choice, opts)
                     stage: issue.status,
                     payload: { actionType: action.actionType, choice },
                 });
-                const { workItem } = startWorkflowCore(issue.id);
+                // NOT-272: this branch is always product_scope_decision (legacy terminal
+                // actions returned above) — the note rides the round-1 payload so the very
+                // next developer round reads it in its prompt.
+                const { workItem } = startWorkflowCore(issue.id, { scopeDecisionNote: scopeDecisionNote });
                 return {
                     ok: true,
                     issueStatus: getIssue(issue.id).status,
@@ -1165,7 +1246,7 @@ export function resolveHumanActionAndAdvance(actionId, resolvedBy, choice, opts)
                     : {};
     return getDb().transaction(() => {
         resolveHumanAction(actionId, resolvedBy, {
-            choice,
+            ...storedResolution,
             // NOT-226: record the re-pin so the resolved action itself shows which head the
             // reviewer was re-queued at when the branch had moved while parked.
             ...(rePinnedResumeHeadSha
@@ -1271,6 +1352,7 @@ export function resolveHumanActionAndAdvance(actionId, resolvedBy, choice, opts)
         // Keyed on the resolved human action, not the round/attempt counters: a
         // "infra" resume resets infra_attempts to 0 every time, so a counter-based key would
         // collide across repeated escalate→resume cycles within the same round.
+        const resumeKey = resumeWorkItemKey(issue.id, `${instance.id}:${resumeAsReviewer ? "reviewer" : "developer"}:resume:${action.id}`);
         const next = resumeAsReviewer
             ? enqueueWorkItem({
                 issueId: issue.id,
@@ -1278,15 +1360,20 @@ export function resolveHumanActionAndAdvance(actionId, resolvedBy, choice, opts)
                 kind: "reviewer",
                 round: issueNow.currentRound,
                 payload: { inputSha: effectiveResumeHeadSha, profileSnapshot: queuedProfileSnapshot(issue, "reviewer") },
-                idempotencyKey: `${instance.id}:reviewer:resume:${action.id}`,
+                idempotencyKey: resumeKey,
             })
             : enqueueWorkItem({
                 issueId: issue.id,
                 workflowInstanceId: instance.id,
                 kind: "developer",
                 round: issueNow.currentRound,
-                payload: { profileSnapshot: queuedProfileSnapshot(issue, "developer") },
-                idempotencyKey: `${instance.id}:developer:resume:${action.id}`,
+                payload: {
+                    profileSnapshot: queuedProfileSnapshot(issue, "developer"),
+                    // NOT-272: a product_scope_decision note rides only this next round's
+                    // payload — later rounds never see it.
+                    ...(scopeDecisionNote ? { scopeDecisionNote } : {}),
+                },
+                idempotencyKey: resumeKey,
             });
         return {
             ok: true,
@@ -1347,6 +1434,7 @@ export async function resolveHumanActionAndAdvanceAsync(actionId, resolvedBy, ch
     const result = resolveHumanActionAndAdvance(actionId, resolvedBy, choice, {
         resumeLiveHeadSha,
         externalMergeState,
+        note: opts?.note,
     });
     if (!result.ok || !result.pendingMerge)
         return result;

package/bundle/server/dist/coordinator/developer-effect.js

@@ -21,11 +21,11 @@ import { getTaskSnapshot } from "./commands.js";
 import { buildDeveloperPrompt } from "./prompts.js";
 import { guidanceForNextSession } from "./guidance.js";
 import { realDeveloperSpawn, developerSessionLogPath } from "./spawn.js";
-import { DEFAULT_BASE_FETCH_TIMEOUT_MS, fastForwardLocalBranchToSha, resolveDeveloperWorktree, safeRemoveWorktree, isWorktreeClean, commitsAhead, pushBranch, mergeBase, branchExists, pushBranchRef, revParseHead, revParseRef, fetchRef, salvageDirtyWorktree, dirtyWorktreeRecoveryCommands, withRepoLock, } from "../adapters/git-worktree.js";
+import { DEFAULT_BASE_FETCH_TIMEOUT_MS, fastForwardLocalBranchToSha, resolveDeveloperWorktree, safeRemoveWorktree, isWorktreeClean, commitsAhead, pushBranch, mergeBase, branchExists, pushBranchRef, revParseHead, revParseRef, fetchRef, salvageDirtyWorktree, dirtyWorktreeRecoveryCommands, withRepoLock, leftoverFingerprint, } from "../adapters/git-worktree.js";
 import { recordIssueBaseSha } from "../repository/issues.js";
 import { ensureIssueRepoCheckout, roleWorktreePathForResolution, resolveCheckoutBaseBranch, } from "../adapters/managed-repo.js";
 import { baseRefCandidates, inspectBranchProgress } from "./branch-progress.js";
-import { prepareWorkerDeckConnection, releaseWorkerDeckConnection } from "../adapters/agent-deck-bind.js";
+import { prepareWorkerDeckConnection, releaseWorkerDeckConnection, verifyWorkerDeckConnection } from "../adapters/agent-deck-bind.js";
 import { realGithubAdapter, pollPrChecks } from "../adapters/github.js";
 import { getWorkerSession, patchRunningSession, recordSessionProcess, setSessionInputSha } from "../repository/worker-sessions.js";
 import { COORDINATOR_PROCESS_OWNER, readProcessStartTime } from "./process-liveness.js";
@@ -675,7 +675,13 @@ export async function runDeveloperEffect(ctx, deps = defaultDeps) {
             return { kind: "base_fetch_failed", reason: resolved.reason };
         }
         if (resolved.kind === "conflict") {
-            return { kind: "worktree_conflict", path: resolved.path, reason: resolved.reason, recoveryCommands: resolved.recoveryCommands };
+            return {
+                kind: "worktree_conflict",
+                path: resolved.path,
+                reason: resolved.reason,
+                recoveryCommands: resolved.recoveryCommands,
+                ...(resolved.fingerprint ? { fingerprint: resolved.fingerprint } : {}),
+            };
         }
         if (resolved.kind === "live_owner") {
             return {
@@ -687,6 +693,56 @@ export async function runDeveloperEffect(ctx, deps = defaultDeps) {
         }
         worktreePath = resolved.path;
         worktreeReused = resolved.kind === "reused";
+        if (resolved.kind === "reused" && resolved.salvage) {
+            // NOT-280: a dead predecessor's dirt was committed on the issue branch (or found
+            // already committed after a restart) — one durable checkpoint per salvage commit,
+            // tied to the predecessor session when Dealer still has its row.
+            // Unlike ordinary checkpoint evidence, this row is a deliverable: if it cannot be
+            // persisted (after one retry) the attempt stops before spawning, leaving the clean
+            // checkout and its salvage tip in place. The next Resume re-detects that tip
+            // (`recovered`) and retries the idempotent insert; an unchanged failure keeps the
+            // same fingerprint, so it reuses its human action instead of opening another.
+            const salvage = resolved.salvage;
+            const recordSalvage = () => emitCheckpointObserved({
+                issueId: issue.id,
+                workflowInstanceId: instance.id,
+                workerSessionId: getWorkerSession(salvage.predecessorSessionId)
+                    ? salvage.predecessorSessionId
+                    : sessionId,
+                role: "developer",
+                stage,
+                round,
+                kind: "commit",
+                observedSha: salvage.commitSha,
+                origin: "salvage",
+                branch: branchName,
+                resumeSalvage: true,
+            });
+            let checkpointError = null;
+            for (let attempt = 0; attempt < 2; attempt++) {
+                try {
+                    recordSalvage();
+                    checkpointError = null;
+                    break;
+                }
+                catch (err) {
+                    checkpointError = err;
+                }
+            }
+            if (checkpointError !== null) {
+                const reason = `Salvage tip ${salvage.commitSha.slice(0, 7)} of dead session ${salvage.predecessorSessionId}'s work ` +
+                    `was committed on ${branchName} at ${worktreePath}, but its durable checkpoint could not be recorded: ` +
+                    `${checkpointError instanceof Error ? checkpointError.message : String(checkpointError)}. ` +
+                    "The checkout was left intact; Resume retries the checkpoint without re-committing.";
+                return {
+                    kind: "worktree_conflict",
+                    path: worktreePath,
+                    reason,
+                    recoveryCommands: [`cd ${worktreePath}`, "git log --oneline -3", "# fix the Dealer database, then Resume"],
+                    fingerprint: await leftoverFingerprint(worktreePath, reason),
+                };
+            }
+        }
         if (resolved.kind === "created" && resolved.baseSha) {
             // NOT-197: record the true branch point while it is known — the verified handoff
             // re-checks it via merge-base, but crash/timeout progress inspection below already
@@ -729,8 +785,7 @@ export async function runDeveloperEffect(ctx, deps = defaultDeps) {
     // the spawn args' tool surface further down. They were resolved separately and had to
     // agree by inspection — the exact shape this stack exists to remove (NOT-134 review).
     const policy = snapshot?.permissionPolicy ?? roleCeiling("developer");
-    // NOT-181: Muse Code workers get no MCP servers and no Agent Deck — nothing is materialized,
-    // verified or released for them, whatever deck the profile happens to carry.
+    // NOT-278: every runtime, Muse included, is fail-closed without a deck — nothing spawns.
     const isMuse = runtime === "muse_code";
     let workerAuthority = null;
     // NOT-225: marks the setup/spawn boundary for the outer catch below. Only a throw
@@ -739,14 +794,14 @@ export async function runDeveloperEffect(ctx, deps = defaultDeps) {
     // adapter_failure path, since the session did start, run, and possibly commit.
     let sessionStarted = false;
     try {
-        if (!isMuse && !snapshot?.deckId) {
+        if (!snapshot?.deckId) {
             await bestEffortRemove(repoPath, worktreePath);
             return {
                 kind: "deck_failure",
                 reason: "Agent profile has no Agent Deck — workers never start without one",
             };
         }
-        if (!isMuse && snapshot?.deckId) {
+        if (!isMuse) {
             const prepared = await prepareWorkerDeckConnection({
                 deckId: snapshot.deckId,
                 worktreePath,
@@ -769,7 +824,27 @@ export async function runDeveloperEffect(ctx, deps = defaultDeps) {
                 deckId: snapshot.deckId,
             });
         }
-        if (taskBriefIsComplete(taskSnapshot) || isMuse) {
+        else {
+            // NOT-278: Muse runs the same live deck preflight without materializing a runtime MCP
+            // config — its settings.json comes only from `prepareMuseAttempt` in the spawn path.
+            // Same mapping: silence is `deck_unavailable`, a bad answer is `deck_failure`.
+            const verified = await verifyWorkerDeckConnection({
+                deckId: snapshot.deckId,
+                worktreePath,
+                callTool: deps.deckCallTool,
+            });
+            if (!verified.ok) {
+                await bestEffortRemove(repoPath, worktreePath);
+                return verified.kind === "deck_unavailable"
+                    ? { kind: "deck_unavailable", reason: verified.reason }
+                    : { kind: "deck_failure", reason: verified.reason };
+            }
+            milestone("deck.connected", `Developer · deck connected (round ${round})`, {
+                deckId: snapshot.deckId,
+            });
+        }
+        // NOT-278: Muse is deck-bound like every other runtime, so the same brief rule applies.
+        if (taskBriefIsComplete(taskSnapshot)) {
             milestone("brief.resolved", `Developer · brief ready (Task/AC complete)`, {
                 resolution: "task_complete",
             });
@@ -782,6 +857,11 @@ export async function runDeveloperEffect(ctx, deps = defaultDeps) {
         const openFindings = listFindingsForIssue(issue.id).filter((f) => f.status === "open" || f.status === "recurring");
         const guidance = guidanceForNextSession(issue.id, sessionId);
         const retryReason = payload.retryReason ?? undefined;
+        // NOT-272: the scope note rides only the work item queued by the resolution —
+        // exactly this round reads it; nothing is re-read from the DB.
+        const scopeDecisionNote = typeof payload.scopeDecisionNote === "string" && payload.scopeDecisionNote.trim()
+            ? payload.scopeDecisionNote.trim()
+            : undefined;
         let priorConclusion;
         let priorVerificationReceipt;
         if (retryReason) {
@@ -813,9 +893,10 @@ export async function runDeveloperEffect(ctx, deps = defaultDeps) {
             priorConclusion,
             priorVerificationReceipt,
             worktreePath,
-            deckId: isMuse ? null : (snapshot?.deckId ?? null),
-            noAgentDeck: isMuse,
+            deckId: snapshot?.deckId ?? null,
+            museDeveloper: isMuse,
             guidance: guidance.length ? guidance : undefined,
+            scopeDecisionNote,
         });
         // NOT-83 review finding: the session is marked `running` (worker-loop.ts) before this
         // handler ever runs, so an abort landing during worktree setup/deck-bind above already
@@ -914,6 +995,9 @@ export async function runDeveloperEffect(ctx, deps = defaultDeps) {
                 effort: snapshot?.effort ?? null,
                 // Frozen profile budget → Muse's `--max-model-steps`; the other runtimes ignore it.
                 maxModelSteps: parsePhaseBudget(snapshot?.budgetJson)?.maxTurns ?? null,
+                // NOT-278: frozen profile deck → the Muse exec attempt (deck headers + pre-spawn
+                // verify). Other runtimes carry their deck via mcpConfigPath/mcpEnv and ignore this.
+                deckId: snapshot?.deckId ?? null,
                 prompt,
                 cwd: worktreePath,
                 timeoutMs: developerEffectConfig.sessionTimeoutMs,
@@ -1286,13 +1370,41 @@ export async function runDeveloperEffect(ctx, deps = defaultDeps) {
             author: "system",
             blobPath: spawned.logPath,
         });
+        // NOT-275: a clean exit (exitCode 0, not timed out, no usage cap) that leaves
+        // the worktree dirty hit the same escalation as a crash before this — the
+        // session did real ticket-scoped work but never ran `git commit`. Salvage
+        // first (same mechanism as the crash/timeout path above): on success fall
+        // through to push/PR as if the agent had committed itself; only when the
+        // salvage commit itself fails do we escalate dirty_worktree with recovery.
         if (!(await isWorktreeClean(worktreePath))) {
-            return {
-                kind: "dirty_worktree",
-                reason: reasonForDirtyWorktree(spawned.logPath, runtime),
-                path: worktreePath,
-                recoveryCommands: dirtyWorktreeRecoveryCommands(repoPath, worktreePath),
-            };
+            const salvaged = await salvageDirtyWorktree(worktreePath, "crash");
+            if (!salvaged.ok) {
+                return {
+                    kind: "dirty_worktree",
+                    reason: `${reasonForDirtyWorktree(spawned.logPath, runtime)} Auto-commit salvage failed: ${salvaged.reason}`,
+                    path: worktreePath,
+                    recoveryCommands: dirtyWorktreeRecoveryCommands(repoPath, worktreePath),
+                };
+            }
+            // NOT-172: durable salvage-commit checkpoint at the existing success point.
+            try {
+                emitCheckpointObserved({
+                    issueId: issue.id,
+                    workflowInstanceId: instance.id,
+                    workerSessionId: sessionId,
+                    role: "developer",
+                    stage,
+                    round,
+                    kind: "commit",
+                    observedSha: salvaged.commitSha,
+                    origin: "salvage",
+                    inputSha: samplerInputSha,
+                    branch: branchName,
+                });
+            }
+            catch {
+                // checkpoint evidence must never fail the attempt itself
+            }
         }
         const ahead = await commitsAhead({ worktreePath, baseRef: `origin/${baseBranch}` });
         if (ahead === 0) {