agent-dealer 1.2.7 → 1.2.8

package/bundle/server/dist/adapters/muse-capability.js

@@ -4,13 +4,21 @@
 // granting developer sessions the shell/write tool, and every developer round after it surfaced
 // only as a generic `dirty_worktree` escalation. So whenever `muse --version` reports a version not
 // yet checked, one real developer-posture session is run whose only path to success is a shell
-// call; the result is cached per version (and persisted, so a restart does not re-bill it):
+// call; the result is cached per version (and persisted, so a restart does not re-bill it).
 //
-//  - capable      → recorded as the confirmed baseline, admission proceeds with no manual step;
-//  - missing      → developer admission blocked, message names old → new version + capability;
-//  - error        → the check could not complete: blocked with a distinct "could not verify"
-//                   message (fail closed), retried after a backoff;
-//  - in flight    → blocked while the one-time check runs (never assumed capable).
+// NOT-308: that gate stalled execution ~15 minutes on an inconclusive (timed-out) probe —
+// "we don't know yet" blocked exactly like a proven regression, retried forever on a flat
+// timer, and never asked anyone to decide. New rule: an update is never assumed guilty.
+// While the current version is unchecked (in flight) or its last result is inconclusive
+// (error), admission proceeds on the last confirmed baseline and verification continues
+// in the background. Only a *confirmed* capability loss (`missing`) blocks admission,
+// and it escalates to exactly one human action per version (acknowledge/override, or pin
+// /roll back outside Dealer). Inconclusive results retry with backoff (1/2/4 min), at most
+// 3 attempts per version; then they escalate once as "could not verify" and stop probing
+// (while a confirmed baseline exists to work on). A fresh install with no confirmed
+// baseline at all keeps fail-closed behavior — and because nothing could ever unblock
+// it otherwise, its inconclusive checks keep retrying at the maximum backoff past
+// exhaustion until a version is confirmed.
 //
 // The probe is a fresh `muse exec` of the on-disk binary (never the long-lived serve host, which can
 // still be the pre-update build). Checks are serialized: a version reported mid-probe is checked
@@ -26,8 +34,16 @@ import path from "node:path";
 import { DEVELOPER_ROLE_CEILING } from "@agent-dealer/shared";
 import { MUSE_CLI_ENV, resolveMuseBin } from "../cli-env.js";
 import { getDataDir } from "../db/index.js";
-/** A probe that could not complete is retried after this long (the block stays up meanwhile). */
-const ERROR_RETRY_MS = 10 * 60_000;
+import { createHumanAction, listHumanActionsByRequestId } from "../repository/human-actions.js";
+/**
+ * NOT-308: an inconclusive check retries with backoff, not a flat timer — the delay after
+ * the Nth consecutive error is ERROR_BACKOFF_MS[N-1]. After MAX_ERROR_ATTEMPTS errors the
+ * version is exhausted: it escalates once as "could not verify" and is never re-probed
+ * automatically (the 4-minute entry is the delay a fourth attempt would have waited —
+ * asserting it never fires is the exhaustion proof).
+ */
+const ERROR_BACKOFF_MS = [60_000, 2 * 60_000, 4 * 60_000];
+const MAX_ERROR_ATTEMPTS = 3;
 const PROBE_TIMEOUT_MS = 5 * 60_000;
 const PROBE_MAX_MODEL_STEPS = 20;
 const STATE_FILE = "muse-capability.json";
@@ -45,23 +61,47 @@ let settledHook = () => { };
 function statePath() {
     return path.join(getDataDir(), STATE_FILE);
 }
+function normalizeChecked(raw, currentVersion) {
+    if (!raw || typeof raw !== "object")
+        return null;
+    const c = raw;
+    if (typeof c.version !== "string" || c.version !== currentVersion)
+        return null;
+    if (c.status !== "capable" && c.status !== "missing" && c.status !== "error")
+        return null;
+    if (typeof c.checkedAt !== "number")
+        return null;
+    const status = c.status;
+    const base = {
+        version: c.version,
+        checkedAt: c.checkedAt,
+        // Pre-NOT-308 files have no attempts counter: a recorded error counts as its first.
+        attempts: typeof c.attempts === "number" ? c.attempts : status === "error" ? 1 : 0,
+        durationMs: typeof c.durationMs === "number" ? c.durationMs : null,
+    };
+    if (status === "capable")
+        return { ...base, status };
+    return { ...base, status, detail: typeof c.detail === "string" ? c.detail : "" };
+}
 function loadState() {
     if (state)
         return state;
     try {
         const parsed = JSON.parse(fs.readFileSync(statePath(), "utf8"));
-        const lastChecked = parsed.lastChecked && typeof parsed.lastChecked.version === "string" ? parsed.lastChecked : null;
         const current = parsed.current && typeof parsed.current.version === "string"
             ? { version: parsed.current.version, from: typeof parsed.current.from === "string" ? parsed.current.from : null }
             : null;
         state = {
             confirmedVersion: typeof parsed.confirmedVersion === "string" ? parsed.confirmedVersion : null,
             current,
-            lastChecked: lastChecked && lastChecked.version === current?.version ? lastChecked : null,
+            lastChecked: normalizeChecked(parsed.lastChecked, current?.version ?? null),
+            overriddenVersions: Array.isArray(parsed.overriddenVersions)
+                ? parsed.overriddenVersions.filter((v) => typeof v === "string")
+                : [],
         };
     }
     catch {
-        state = { confirmedVersion: null, current: null, lastChecked: null };
+        state = { confirmedVersion: null, current: null, lastChecked: null, overriddenVersions: [] };
     }
     return state;
 }
@@ -75,12 +115,36 @@ function saveState(next) {
         console.warn(`[muse-capability] could not persist ${statePath()}: ${String(err)}`);
     }
 }
+/**
+ * NOT-308: the safety net (a dirty, shell-less developer session ending on an unconfirmed
+ * version) cannot await the paid probe, so it registers here: when the check for `version`
+ * settles conclusively bad (`missing`) or inconclusively exhausted, the watcher issue gets
+ * its escalation then. Watchers are best-effort and capped — admission-time `ensure`
+ * covers every verdict anyway, with dedupe.
+ */
+let missWatchers = [];
+function addMissWatcher(version, issueId) {
+    if (missWatchers.some((w) => w.version === version && w.issueId === issueId))
+        return;
+    missWatchers.push({ version, issueId });
+    if (missWatchers.length > 50)
+        missWatchers = missWatchers.slice(-50);
+}
+/** Drop watchers for every version but `keep` (a version change orphaned them). */
+function dropMissWatchersExcept(keep) {
+    if (keep === null)
+        missWatchers = [];
+    else if (missWatchers.some((w) => w.version !== keep)) {
+        missWatchers = missWatchers.filter((w) => w.version === keep);
+    }
+}
 /** Record `version` as the one Muse now reports; a change remembers what it changed from. */
 function observe(version) {
     const s = loadState();
     if (s.current?.version === version)
         return s;
     const from = s.current?.version ?? s.confirmedVersion;
+    dropMissWatchersExcept(version);
     saveState({ ...s, current: { version, from: from !== version ? from : null }, lastChecked: null });
     return state;
 }
@@ -95,7 +159,15 @@ export function parseMuseVersion(output) {
 function transition(from, to) {
     return from && from !== to ? `Muse Code updated ${from} → ${to}` : `Muse Code ${to}`;
 }
-function issueFor(checked, from) {
+function formatDuration(ms) {
+    if (ms === null || !Number.isFinite(ms) || ms < 0)
+        return "unknown time";
+    const s = Math.round(ms / 1000);
+    if (s < 60)
+        return `${s}s`;
+    return `${Math.floor(s / 60)}m ${s % 60}s`;
+}
+function issueFor(checked, from, exhausted = false) {
     if (checked.status === "capable")
         return [];
     const head = transition(from, checked.version);
@@ -108,12 +180,18 @@ function issueFor(checked, from) {
             },
         ];
     }
+    // Reachable only with no confirmed baseline (fresh install): with a baseline, an
+    // inconclusive result never blocks. The check always retries (checkDue keeps an
+    // unconfirmed version on the maximum backoff), so there is no "will not retry" text.
     return [
         {
             code: "runtime_capability",
             message: `Could not verify Muse Code developer ${CAPABILITY} after version change ` +
                 `(${from && from !== checked.version ? `${from} → ` : ""}${checked.version}): ` +
-                `${checked.detail} — developer admission blocked; the check retries automatically`,
+                `${checked.detail} — developer admission blocked` +
+                (exhausted
+                    ? `; escalated for a human decision (no further automatic checks for this version)`
+                    : `; the check retries automatically`),
         },
     ];
 }
@@ -126,17 +204,34 @@ function verifyingIssue(version, from) {
         },
     ];
 }
-/** Current version is unchecked, or its could-not-verify result is due a retry. */
+/** True once an inconclusive version has spent its whole retry budget. */
+function isExhausted(checked) {
+    return checked.status === "error" && checked.attempts >= MAX_ERROR_ATTEMPTS;
+}
+/**
+ * Current version is unchecked, or its could-not-verify result is due its next backoff
+ * retry. An exhausted version stops probing — unless there is no confirmed baseline at
+ * all (fresh install): then stopping would block admission permanently with no path to
+ * unblock (no session can be admitted, so the safety net can never fire), so retries
+ * continue at the maximum backoff until some version is confirmed.
+ */
 function checkDue(s) {
     if (!s.current)
         return false;
     const checked = s.lastChecked;
     if (!checked)
         return true;
-    return checked.status === "error" && Date.now() - checked.checkedAt >= ERROR_RETRY_MS;
+    if (checked.status !== "error")
+        return false;
+    if (!isExhausted(checked)) {
+        return Date.now() - checked.checkedAt >= ERROR_BACKOFF_MS[checked.attempts - 1];
+    }
+    return (s.confirmedVersion === null &&
+        Date.now() - checked.checkedAt >= ERROR_BACKOFF_MS[ERROR_BACKOFF_MS.length - 1]);
 }
 function startCheck(version) {
     const gen = generation;
+    const startedAt = Date.now();
     const promise = (async () => {
         let result;
         try {
@@ -152,7 +247,18 @@ function startCheck(version) {
         // must not overwrite state for the newer one (which is checked next, below).
         if (prev.current?.version !== version)
             return;
-        const checked = { version, checkedAt: Date.now(), ...result };
+        // Only consecutive errors accumulate: a conclusive verdict resets the budget, and a
+        // safety-net forced probe past exhaustion just keeps the version exhausted.
+        const prevAttempts = prev.lastChecked?.version === version && prev.lastChecked.status === "error"
+            ? prev.lastChecked.attempts
+            : 0;
+        const checked = {
+            version,
+            checkedAt: Date.now(),
+            attempts: result.status === "error" ? prevAttempts + 1 : 0,
+            durationMs: Date.now() - startedAt,
+            ...result,
+        };
         saveState({
             ...prev,
             confirmedVersion: result.status === "capable" ? version : prev.confirmedVersion,
@@ -161,9 +267,30 @@ function startCheck(version) {
         const from = prev.current.from;
         if (result.status === "capable") {
             console.log(`[muse-capability] ${transition(from, version)}: developer ${CAPABILITY} confirmed`);
+            dropMissWatchersExcept(null);
         }
-        else {
+        else if (result.status === "missing") {
             console.warn(`[muse-capability] ${issueFor(checked, from)[0].message}`);
+            escalateWatchedVersion(version);
+        }
+        else if (isExhausted(checked)) {
+            // With a baseline the version is done (escalated once, admission on the baseline);
+            // with none the checks continue at the maximum backoff — and admission stays
+            // blocked — until some version is confirmed.
+            console.warn(`[muse-capability] Could not verify Muse Code developer ${CAPABILITY} for ${version} ` +
+                `after ${checked.attempts} inconclusive checks (last probe ran ${formatDuration(checked.durationMs)}): ` +
+                (prev.confirmedVersion
+                    ? `escalating once, no further automatic checks; admission continues on baseline ${prev.confirmedVersion}`
+                    : `escalated for a human decision; automatic checks continue at the maximum backoff; admission stays blocked (no confirmed baseline yet)`));
+            escalateWatchedVersion(version);
+        }
+        else if (checked.status === "error") {
+            console.warn(`[muse-capability] Could not verify Muse Code developer ${CAPABILITY} for ${version} ` +
+                `(attempt ${checked.attempts}/${MAX_ERROR_ATTEMPTS}, last probe ran ${formatDuration(checked.durationMs)}): ` +
+                `${checked.detail} — retrying in ${formatDuration(ERROR_BACKOFF_MS[Math.min(checked.attempts, ERROR_BACKOFF_MS.length) - 1])}; ` +
+                (prev.confirmedVersion
+                    ? `admission continues on baseline ${prev.confirmedVersion}`
+                    : `admission stays blocked (no confirmed baseline yet)`));
         }
     })().finally(() => {
         if (inFlight?.promise === promise)
@@ -179,10 +306,17 @@ function startCheck(version) {
     inFlight = { version, promise };
 }
 /**
- * Capability issues for the currently reported Muse version. Never awaits the probe: a version not
- * yet checked starts one background check and blocks until it settles. Checks are serialized — a
- * version observed while another is being probed waits for that probe, then is checked once.
- * `onSettled` lets the caller drop its health cache so admission unblocks as soon as the result is in.
+ * Capability issues for the currently reported Muse version. Never awaits the probe.
+ *
+ * NOT-308: only evidence of a real capability loss (`missing`, and not overridden by the
+ * operator) blocks admission. An unchecked version or an inconclusive (`error`) result
+ * keeps verifying in the background while admission proceeds on the last confirmed
+ * baseline. With no confirmed baseline at all (fresh install), every unknown blocks —
+ * fail closed until the first version is confirmed.
+ *
+ * Checks are serialized — a version observed while another is being probed waits for
+ * that probe, then is checked once. `onSettled` lets the caller drop its health cache
+ * so admission sees the result as soon as it lands.
  */
 export function museCapabilityIssues(version, onSettled = () => { }) {
     settledHook = onSettled;
@@ -190,9 +324,293 @@ export function museCapabilityIssues(version, onSettled = () => { }) {
     const from = s.current.from;
     if (checkDue(s) && !inFlight)
         startCheck(version);
-    if (s.lastChecked)
-        return issueFor(s.lastChecked, from); // incl. error retry: keep the block up
-    return verifyingIssue(version, from);
+    const checked = s.lastChecked;
+    // Unchecked (including a retry already running): a baseline means "verify in the
+    // background, keep working"; without one the unknown blocks.
+    if (!checked)
+        return s.confirmedVersion ? [] : verifyingIssue(version, from);
+    if (checked.status === "capable")
+        return [];
+    if (checked.status === "missing") {
+        return s.overriddenVersions.includes(checked.version) ? [] : issueFor(checked, from);
+    }
+    // Inconclusive: never a block while any baseline exists to work on. With none, the
+    // block stands but the check keeps retrying at the maximum backoff (checkDue), so the
+    // message always says "retries" — never "no further automatic checks".
+    return s.confirmedVersion ? [] : issueFor(checked, from, false);
+}
+/**
+ * Dedupe key for the one human action per Muse version *and verdict kind* (NOT-308).
+ * Stored as the action's request_id so same-issue races collapse on the existing partial
+ * unique index, and so cross-issue lookups (`listHumanActionsByRequestId`) find it.
+ *
+ * The kind is part of the key because one version can produce both verdicts in sequence:
+ * an exhausted `error` escalates as "unverified", and a later safety-net probe of the
+ * same version can still return `missing`. Sharing one key would let the still-open
+ * "unverified" action swallow the "missing" escalation (wrong text, and dismissing it
+ * would record an override for a verdict the operator never saw). The unkinded form is
+ * only for reading actions written before the key carried a kind.
+ */
+export function museCapabilityRequestId(version, kind) {
+    return kind ? `muse-capability:${kind}:${version}` : `muse-capability:${version}`;
+}
+/** Which verdict kind a prior escalation action belongs to. Legacy rows (unkinded
+ * request_id) are classified by their evidence; a row with no parseable evidence is
+ * conservatively treated as the kind being raised (dedupe, never spam). */
+function actionKindOf(action, fallback) {
+    try {
+        const evidence = action.evidenceJson
+            ? JSON.parse(action.evidenceJson)
+            : null;
+        if (evidence?.kind === "missing" || evidence?.kind === "unverified")
+            return evidence.kind;
+    }
+    catch {
+        // Fall through to the request_id prefix below.
+    }
+    const prefixed = /^muse-capability:(missing|unverified):/.exec(action.requestId ?? "");
+    if (prefixed)
+        return prefixed[1];
+    return fallback;
+}
+/** The `choice` a resolved escalation action was resolved with, if parseable. The
+ * dedicated `muse_capability` resolve path always records `{choice: "acknowledge"}`;
+ * abort/close lifecycle resolutions record a `reason` instead and never a choice. */
+function resolutionChoiceOf(action) {
+    try {
+        const resolution = action.resolutionJson ? JSON.parse(action.resolutionJson) : null;
+        return resolution && typeof resolution === "object" && "choice" in resolution &&
+            typeof resolution.choice === "string"
+            ? resolution.choice
+            : null;
+    }
+    catch {
+        return null;
+    }
+}
+function escalationFor(checked, s) {
+    const from = s.current?.version === checked.version ? s.current.from : s.confirmedVersion;
+    const baseline = s.confirmedVersion ?? "none";
+    if (checked.status === "missing" && !s.overriddenVersions.includes(checked.version)) {
+        const rollback = from
+            ? `, or pin/roll back Muse to ${from} outside Dealer (the next version change is checked automatically)?`
+            : `. Pin/roll back Muse outside Dealer to a working build if needed (the next version change is checked automatically)?`;
+        return {
+            kind: "missing",
+            reason: `${transition(from, checked.version)}: developer sessions no longer get ${CAPABILITY} ` +
+                `(${checked.detail}). Last probe ran ${formatDuration(checked.durationMs)} ` +
+                `(probe timeout ${formatDuration(PROBE_TIMEOUT_MS)}). ` +
+                `Developer admission is blocked for ${checked.version}; last confirmed baseline is ${baseline}.`,
+            question: `Muse Code ${checked.version} lost developer ${CAPABILITY}. Acknowledge to admit developers ` +
+                `on ${checked.version} anyway${rollback}`,
+        };
+    }
+    if (isExhausted(checked) && checked.status === "error") {
+        const detail = checked.detail;
+        // With a baseline, admission proceeds on it and probing stops; with none (fresh
+        // install), admission is blocked and the checks continue at the maximum backoff —
+        // the text must say which, never "continues on baseline none".
+        const standing = s.confirmedVersion
+            ? `Developer admission continues on the last confirmed baseline ${baseline}; ` +
+                `no further automatic checks will run for ${checked.version}.`
+            : `Developer admission is blocked (no confirmed baseline yet); ` +
+                `automatic checks continue at the maximum backoff until a version is confirmed.`;
+        return {
+            kind: "unverified",
+            reason: `Could not verify Muse Code developer ${CAPABILITY} for ${checked.version} after ` +
+                `${checked.attempts} inconclusive checks (last: ${detail}; last probe ran ` +
+                `${formatDuration(checked.durationMs)}, probe timeout ${formatDuration(PROBE_TIMEOUT_MS)}). ` +
+                standing,
+            question: `Muse Code ${checked.version} could not be verified. Acknowledge to dismiss, ` +
+                `or investigate the probe failures` +
+                (s.confirmedVersion
+                    ? ` (roll back to ${baseline} outside Dealer if the new build is suspect)?`
+                    : `?`),
+        };
+    }
+    return null;
+}
+/**
+ * NOT-308: raise the human action for a version the gate cannot clear by itself —
+ * exactly one per version and verdict kind, on whichever issue first observes the
+ * verdict. Later polls (and other issues' admissions) find the open action and skip
+ * creation; a resolved one of the same kind whose resolution chose `acknowledge`
+ * means the operator already decided, so the override is recorded (if missing) and
+ * nothing is re-raised. An action of the *other*
+ * kind neither suppresses this escalation nor counts as a decision on it: dismissing
+ * "could not verify" must never read as overriding a later confirmed "missing".
+ * Returns the open action, or null when nothing was (re)raised. Never blocks admission
+ * itself — the gate reads file state, not this.
+ *
+ * Repair round 3: only a resolved action whose resolution chose `acknowledge` (the
+ * dedicated resolve path's choice) counts as the operator's decision on the verdict.
+ * Abort/close resolve every open action on the issue with `{reason:
+ * "aborted_by_user" | "closed_by_operator"}` — issue lifecycle, not a capability
+ * decision — so such a resolution re-raises a fresh action instead of recording an
+ * override that would silently lift the block.
+ */
+export function ensureMuseCapabilityEscalation(issueId) {
+    const s = loadState();
+    const checked = s.lastChecked;
+    if (!s.current || !checked || checked.version !== s.current.version)
+        return null;
+    const escalation = escalationFor(checked, s);
+    if (!escalation || checked.status === "capable")
+        return null;
+    const detail = checked.detail;
+    const requestId = museCapabilityRequestId(checked.version, escalation.kind);
+    // Same-kind rows under both the current key and the pre-kind legacy key.
+    const seen = new Map();
+    for (const key of [requestId, museCapabilityRequestId(checked.version)]) {
+        for (const action of listHumanActionsByRequestId("muse_capability", key)) {
+            if (!seen.has(action.id))
+                seen.set(action.id, action);
+        }
+    }
+    const sameKind = [...seen.values()].filter((a) => actionKindOf(a, escalation.kind) === escalation.kind);
+    const open = sameKind.find((a) => a.status === "open");
+    if (open)
+        return open;
+    // Only an explicit `acknowledge` resolution is the operator's decision on this
+    // verdict — anything else (abort/close lifecycle reasons, legacy rows with no
+    // parseable choice) falls through and re-raises a fresh action below.
+    const acknowledged = sameKind.some((a) => a.status === "resolved" && resolutionChoiceOf(a) === "acknowledge");
+    if (acknowledged) {
+        if (escalation.kind === "missing")
+            recordMuseCapabilityOverride(checked.version);
+        return null;
+    }
+    return createHumanAction({
+        issueId,
+        actionType: "muse_capability",
+        reason: escalation.reason,
+        question: escalation.question,
+        evidence: {
+            kind: escalation.kind,
+            version: checked.version,
+            from: s.current.from,
+            detail,
+            durationMs: checked.durationMs,
+            capability: CAPABILITY,
+        },
+        responseOptions: [{ choice: "acknowledge", label: `Acknowledge — ${escalation.kind === "missing" ? `admit on ${checked.version}` : "keep working on baseline"}` }],
+        requestId,
+    });
+}
+/** Escalate a safety-net-watched version whose probe just settled badly (best-effort). */
+function escalateWatchedVersion(version) {
+    const owed = missWatchers.filter((w) => w.version === version);
+    missWatchers = missWatchers.filter((w) => w.version !== version);
+    for (const w of owed) {
+        try {
+            ensureMuseCapabilityEscalation(w.issueId);
+        }
+        catch (err) {
+            console.warn(`[muse-capability] could not escalate ${version} on ${w.issueId}: ${String(err)}`);
+        }
+    }
+}
+/**
+ * Record the operator's acknowledge/override for a `missing` version (called by the
+ * `muse_capability` resolve path). The gate stops blocking that version; later versions
+ * are unaffected.
+ */
+export function recordMuseCapabilityOverride(version) {
+    const s = loadState();
+    if (s.overriddenVersions.includes(version))
+        return;
+    saveState({ ...s, overriddenVersions: [...s.overriddenVersions, version].slice(-50) });
+}
+/**
+ * Shell-ish tool names in Muse session logs. `bash` is the observed shell tool
+ * (fixtures + recorded runs); anything containing `shell` is counted defensively —
+ * no known non-shell Muse tool contains it. Unknown future shell names miss the count
+ * and cause one extra verification probe, never a missed regression.
+ */
+const MUSE_SHELL_TOOL_RE = /^(bash|shell)$|^bash[\s_-]|shell/i;
+/**
+ * Count shell tool calls in a Muse session log. Counts both the normalized
+ * `{type:"tool_call", name}` events the spawn writes to logPath and raw
+ * `tool:<name>` envelope operations, whichever the file holds. Returns null when
+ * the log is unreadable or holds no parseable lines — "unknown", never zero, so an
+ * unreadable log alone never fires the safety net.
+ */
+export function countMuseShellToolCalls(logPath) {
+    let raw;
+    try {
+        raw = fs.readFileSync(logPath, "utf8");
+    }
+    catch {
+        return null;
+    }
+    let parsed = 0;
+    let shells = 0;
+    for (const line of raw.split("\n")) {
+        const t = line.trim();
+        if (!t)
+            continue;
+        let event;
+        try {
+            event = JSON.parse(t);
+        }
+        catch {
+            continue;
+        }
+        if (!event || typeof event !== "object" || Array.isArray(event))
+            continue;
+        parsed += 1;
+        const rec = event;
+        if (rec.type === "tool_call" && typeof rec.name === "string" && MUSE_SHELL_TOOL_RE.test(rec.name)) {
+            shells += 1;
+            continue;
+        }
+        const operation = rec.payload?.event;
+        const op = operation?.operation;
+        if (typeof op === "string" && op.startsWith("tool:") && MUSE_SHELL_TOOL_RE.test(op.slice("tool:".length))) {
+            shells += 1;
+        }
+    }
+    return parsed === 0 ? null : shells;
+}
+/**
+ * NOT-308 safety net: a developer session ending with a dirty worktree but zero shell
+ * tool calls is exactly what a shell-less build looks like from the outside, so when
+ * the running Muse version is not yet the confirmed baseline, verify it immediately —
+ * bypassing the error backoff — and escalate a `missing` verdict on this issue.
+ * Fire-and-forget (the probe settles in the background and the watcher escalates);
+ * never throws and never changes the session outcome.
+ */
+export function museCapabilitySafetyNetAfterSession(input) {
+    try {
+        if (input.runtime !== "muse_code" || !input.dirty)
+            return "skipped";
+        const shells = countMuseShellToolCalls(input.logPath);
+        if (shells === null || shells > 0)
+            return "skipped";
+        const version = reportedMuseVersion();
+        if (!version)
+            return "skipped";
+        const s = observe(version);
+        if (s.confirmedVersion === version)
+            return "skipped";
+        const checked = s.lastChecked;
+        if (checked && checked.version === version && checked.status === "missing") {
+            ensureMuseCapabilityEscalation(input.issueId);
+            return "escalated";
+        }
+        addMissWatcher(version, input.issueId);
+        if (inFlight)
+            return "watching";
+        // The suspicion (dirty + shell-less) outranks the error backoff timer: probe now
+        // instead of waiting it out. Exhaustion does not stop this — the session is fresh
+        // evidence, and a `missing` verdict escalates while an `error` just stays exhausted.
+        startCheck(version);
+        return "probed";
+    }
+    catch (err) {
+        console.warn(`[muse-capability] safety net skipped: ${String(err)}`);
+        return "skipped";
+    }
 }
 /** True while a capability check is running (callers use a short health-cache TTL meanwhile). */
 export function museCapabilityCheckInFlight() {
@@ -220,6 +638,7 @@ export function resetMuseCapabilityStateForTests() {
     inFlight = null;
     state = null;
     settledHook = () => { };
+    missWatchers = [];
     fs.rmSync(statePath(), { force: true });
 }
 /** Tests: backdate the last check so the error-retry path can be exercised without waiting. */