agent-dealer 1.2.7 → 1.2.9

package/bundle/server/dist/coordinator/commands.js

@@ -7,9 +7,9 @@
 // duplicate delivery is a no-op. The effect *work* itself runs elsewhere, through a leased
 // worker whose structured result comes back into applyCompletion.
 import fs from "node:fs";
-import { canTransitionIssue } from "@agent-dealer/shared";
+import { canTransitionIssue, tryCompileContract } from "@agent-dealer/shared";
 import { getDb } from "../db/index.js";
-import { getIssue, incrementIssueRound, incrementIssueInfraAttempts, resetIssueInfraAttempts, grantReviewRetry, transitionIssue, } from "../repository/issues.js";
+import { getIssue, incrementIssueRound, incrementIssueInfraAttempts, incrementIssueCiAttempts, resetIssueInfraAttempts, resetIssueCiAttempts, grantReviewRetry, transitionIssue, } from "../repository/issues.js";
 import { appendWorkflowEvent, completeWorkflowInstance, getActiveWorkflowInstance, getWorkflowInstance, listWorkflowEventsForIssue, startWorkflowInstance, WorkflowAlreadyActiveError, } from "../repository/workflow-events.js";
 import { createHumanAction, findOpenHumanAction, getHumanAction, listHumanActionsForIssue, reopenHumanAction, resolveHumanAction, updateOpenHumanAction, } from "../repository/human-actions.js";
 import { pushLeaseToSha, readRemoteTip } from "../adapters/git-worktree.js";
@@ -17,9 +17,10 @@ import { ensureIssueRepoCheckout } from "../adapters/managed-repo.js";
 import { reconcileFinding, resolveFindingsAbsentFromRound } from "../repository/findings.js";
 import { normalizeReviewerResult } from "./reviewer-result.js";
 import { getAgent } from "../repository/agents.js";
-import { githubIssuesSync } from "../adapters/agent-health.js";
+import { githubIssuesSync, invalidateMuseHealthCache } from "../adapters/agent-health.js";
+import { recordMuseCapabilityOverride } from "../adapters/muse-capability.js";
 import { createIssueArtifact, latestIssueArtifact } from "../repository/artifacts.js";
-import { cancelWorkItem, enqueueWorkItem, finishWorkItem, getWorkItem, listWorkItemsForIssue, } from "../repository/work-items.js";
+import { cancelWorkItem, enqueueWorkItem, finishWorkItem, getWorkItem, getWorkItemByIdempotencyKey, listWorkItemsForIssue, } from "../repository/work-items.js";
 import { completeSession, getWorkerSession, listWorkerSessionsForIssue } from "../repository/worker-sessions.js";
 import { killRunProcess } from "../runners/spawn-cli.js";
 import { buildProfileSnapshot, serializeProfileSnapshot } from "./profile-snapshot.js";
@@ -30,9 +31,10 @@ import { routeDeveloperOutcome, routeReviewerOutcome, } from "./routing.js";
 import { projectDeveloperRoute, projectReviewerRoute } from "./projection.js";
 import { MERGE_FAILURE_EVIDENCE_KEY, MERGE_FAILURE_RESPONSE_OPTIONS, PUSH_DIVERGENCE_EVIDENCE_KEY, PUSH_DIVERGENCE_RESPONSE_OPTIONS, WORKTREE_BLOCKER_EVIDENCE_KEY, normalizeResolutionNote, parseHumanResolution, resolveHumanActionOutcome, } from "./human-resolution.js";
 import { AUTO_MERGE_INTENT, finalizeAutoMerge } from "./auto-merge.js";
+import { OPERATOR_VERIFICATION_ARTIFACT_KIND, OPERATOR_VERIFICATION_RESPONSE_OPTIONS, } from "./operator-criteria.js";
 import { externalMergeStateForIssue } from "./external-merge.js";
 import { detectNonConvergence, formatNonConvergenceReason, reviewHistoryFromEvents, } from "./non-convergence.js";
-import { capEscalationEvents, deferLeasedWorkItemForBaseFetch, deferLeasedWorkItemForDeckOutage, deferLeasedWorkItemForUsageCap, formatCapEscalationReason, usageCapDeferralStartedAt, } from "./usage-cap-defer.js";
+import { capEscalationEvents, checksWaitDeferralStartedAt, deferLeasedWorkItemForBaseFetch, deferLeasedWorkItemForChecksPending, deferLeasedWorkItemForDeckOutage, deferLeasedWorkItemForUsageCap, formatCapEscalationReason, formatChecksWaitEscalationReason, usageCapDeferralStartedAt, } from "./usage-cap-defer.js";
 import { dequeueIssue, getQueuedEntryForIssue, markQueueEntryAdmitted, } from "../repository/queue-entries.js";
 import { fetchResumeLiveHeadSha } from "./resume-live-head.js";
 import { getWorkflow } from "./workflows/registry.js";
@@ -53,7 +55,13 @@ export function getTaskSnapshot(issue) {
     const artifact = latestIssueArtifact(issue.id, TASK_SNAPSHOT_ARTIFACT_KIND);
     if (artifact?.contentJson) {
         try {
-            return JSON.parse(artifact.contentJson);
+            const parsed = JSON.parse(artifact.contentJson);
+            // Snapshots frozen before NOT-306 carry no contract — derive it from the
+            // frozen source description so old workflows still render what they ran.
+            if (parsed.executionContract === undefined) {
+                return { ...parsed, executionContract: tryCompileContract(parsed.description) };
+            }
+            return parsed;
         }
         catch {
             // fall through to the live-field fallback below
@@ -66,6 +74,7 @@ export function getTaskSnapshot(issue) {
         repo: issue.repo,
         baseBranch: issue.baseBranch,
         workflowVersion: WORKFLOW_VERSION,
+        executionContract: tryCompileContract(issue.description),
     };
 }
 /**
@@ -83,9 +92,15 @@ export function canEditParkedIssue(issue) {
         return false;
     return !listWorkItemsForIssue(issue.id).some((w) => w.status === "pending" || w.status === "leased");
 }
-/** Re-freezes the snapshot when the operator edited title/description/criteria; returns the changed fields (empty = no-op). */
+/**
+ * Re-freezes the snapshot when the operator edited title/description/criteria
+ * (or the contract compiled from the description); returns the changed fields
+ * (empty = no-op). Source and compiled contract always re-freeze atomically —
+ * one artifact write carries both, so they can never diverge.
+ */
 function refreshTaskSnapshotIfEdited(issue) {
     const frozen = getTaskSnapshot(issue);
+    const liveContract = tryCompileContract(issue.description);
     const changed = [];
     if (frozen.title !== issue.title)
         changed.push("title");
@@ -93,6 +108,9 @@ function refreshTaskSnapshotIfEdited(issue) {
         changed.push("description");
     if (frozen.acceptanceCriteria !== (issue.acceptanceCriteria ?? ""))
         changed.push("acceptanceCriteria");
+    if (JSON.stringify(frozen.executionContract ?? null) !== JSON.stringify(liveContract ?? null)) {
+        changed.push("executionContract");
+    }
     if (changed.length > 0)
         freezeTaskSnapshot(issue);
     return changed;
@@ -109,6 +127,7 @@ function freezeTaskSnapshot(issue) {
             repo: issue.repo,
             baseBranch: issue.baseBranch,
             workflowVersion: WORKFLOW_VERSION,
+            executionContract: tryCompileContract(issue.description),
         },
     });
 }
@@ -118,7 +137,11 @@ function freezeTaskSnapshot(issue) {
  * never changes the eventual session. The worker loop consumes this off the payload and
  * only falls back to a live resolve for a legacy item queued before snapshots were carried.
  */
-function queuedProfileSnapshot(issue, kind) {
+/**
+ * NOT-333: shared with recovery's stranded-reviewer re-enqueue so a recovered round
+ * carries the same frozen profile as a normally routed one.
+ */
+export function queuedProfileSnapshot(issue, kind) {
     const agentId = kind === "developer" ? issue.developerAgentId : issue.reviewerAgentId;
     const agent = agentId ? getAgent(agentId) : null;
     return agent ? serializeProfileSnapshot(buildProfileSnapshot(agent, kind)) : null;
@@ -309,6 +332,12 @@ export async function applyCompletion(workItemId, leaseToken, outcome) {
     if (outcome.kind === "base_fetch_failed") {
         return applyBaseFetchDeferralCompletion(workItemId, leaseToken, outcome);
     }
+    // NOT-311: CI still queued/running (or not yet registered) at the poll timeout —
+    // the session ended cleanly, so the item waits on backoff and re-polls instead of
+    // spending an infra attempt. Past the wait ceiling this escalates to a human.
+    if (outcome.kind === "checks_pending") {
+        return applyChecksPendingCompletion(workItemId, leaseToken, outcome);
+    }
     const routed = getDb().transaction(() => {
         const before = getWorkItem(workItemId);
         if (!before)
@@ -397,6 +426,68 @@ function applyDeckOutageCompletion(workItemId, leaseToken, outage) {
 function applyBaseFetchDeferralCompletion(workItemId, leaseToken, failure) {
     return applyDeferralCompletion(workItemId, leaseToken, failure, (item, issue, instance) => deferLeasedWorkItemForBaseFetch(item, leaseToken, failure, issue, instance));
 }
+/**
+ * NOT-311: CI still pending at the poll timeout — defer with backoff, no attempt
+ * spent. Unlike a deck outage the wait has a ceiling, so the escalation arm raises a
+ * human action naming the stuck PR/SHA once CI has waited too long.
+ */
+function applyChecksPendingCompletion(workItemId, leaseToken, pending) {
+    return applyDeferralCompletion(workItemId, leaseToken, pending, (item, issue, instance) => deferLeasedWorkItemForChecksPending(item, leaseToken, pending, issue, instance), (issue, instance, item) => routeChecksWaitEscalation(issue, instance, item, pending));
+}
+/**
+ * NOT-311: the CI wait passed its ceiling — hand to a human with the PR and head SHA
+ * CI never proved, without spending infra attempts. Mirrors the usage-cap ceiling
+ * escalation (worker.failed + needs_human + policy_escalation).
+ */
+export function routeChecksWaitEscalation(issue, instance, item, pending) {
+    const payload = parseWorkItemPayload(item.payloadJson);
+    const firstDeferredAt = checksWaitDeferralStartedAt(payload) ?? pending.waitStartedAt;
+    const reason = formatChecksWaitEscalationReason(pending, firstDeferredAt);
+    const role = item.kind === "developer" ? "developer" : "reviewer";
+    const ev = eventEmitter(issue, instance, item.workerSessionId, "needs_human", issue.currentRound);
+    for (const type of capEscalationEvents()) {
+        const session = item.workerSessionId ? getWorkerSession(item.workerSessionId) : null;
+        ev.emit(type, {
+            actorType: role,
+            payload: {
+                ...workerSessionPayload({
+                    runtime: session?.runtime ?? null,
+                    model: session?.model ?? null,
+                    sessionId: item.workerSessionId ?? "",
+                    worktreePath: session?.worktreePath,
+                }),
+                outcome: "checks_pending",
+                reason: pending.reason,
+                branch: pending.branch,
+                prNumber: pending.prNumber,
+                headSha: pending.headSha,
+            },
+        });
+    }
+    applyProjectionTransition(issue, {
+        issueStatus: "needs_human",
+        currentOwner: "human",
+        currentIntent: reason,
+        events: capEscalationEvents(),
+    }, {});
+    const action = createHumanAction({
+        issueId: issue.id,
+        workflowInstanceId: instance.id,
+        actionType: "policy_escalation",
+        reason,
+        question: questionFor("policy_escalation", reason),
+        evidence: { checksPending: { ...pending, firstDeferredAt } },
+        responseOptions: responseOptionsFor("policy_escalation"),
+    });
+    ev.emit("human_action.requested", { payload: { actionType: "policy_escalation", actionId: action.id } });
+    return {
+        applied: true,
+        issueStatus: "needs_human",
+        nextWorkItemId: null,
+        humanActionId: action.id,
+        instanceCompleted: false,
+    };
+}
 /**
  * Deferral ceiling exceeded — escalate with cap evidence without spending infra attempts.
  * Used when applyCompletion or the worker loop cannot defer any longer.
@@ -507,6 +598,8 @@ function applyDeveloper(issue, instance, item, outcome) {
         maxReviewRounds: issue.maxReviewRounds,
         infraAttempts: issue.infraAttempts,
         maxInfraAttempts: issue.maxInfraAttempts,
+        ciAttempts: issue.ciAttempts,
+        maxCiAttempts: issue.maxCiAttempts,
     });
     const { projection, effect, advance } = projectDeveloperRoute(route, issue.status, issue.currentRound);
     const ev = eventEmitter(issue, instance, item.workerSessionId, projection.issueStatus, issue.currentRound);
@@ -589,6 +682,9 @@ function applyDeveloper(issue, instance, item, outcome) {
         incrementIssueRound(issue.id);
     else if (advance === "infra")
         incrementIssueInfraAttempts(issue.id);
+    // NOT-313: a CI-repair retry spends ci_attempts, never infra_attempts.
+    else if (advance === "ci")
+        incrementIssueCiAttempts(issue.id);
     const issueNow = getIssue(issue.id);
     return applyEffect(issue, instance, effect, route, issueNow, ev, item.id);
 }
@@ -722,9 +818,10 @@ function findNonConvergence(issue, instance, result) {
     });
     return detectNonConvergence(history, issue.currentRound, floorRound);
 }
-/** Every route that spends an infra attempt (projection.ts's advance === "infra") repeats
- * the same round/head, so its enqueue needs a suffix the plain round/head key doesn't
- * provide to avoid colliding with the previous (terminal) attempt's key.
+/** Every route that spends an infra or CI attempt (projection.ts's advance === "infra"
+ * or "ci") repeats the same round/head, so its enqueue needs a suffix the plain
+ * round/head key doesn't provide to avoid colliding with the previous (terminal)
+ * attempt's key.
  * retry_reviewer_at_new_head belongs here too — a head that cycles A→B→A would otherwise
  * re-derive attempt A's ORIGINAL key (same round, same head) and collide with that
  * now-terminal work item, leaving the issue "reviewing" with no pending item. */
@@ -755,6 +852,21 @@ function applyEffect(issue, instance, effect, route, issueNow, ev, causativeItem
         const attemptSuffix = isInfraRetry(route) ? `:retry-of:${causativeItemId}` : "";
         if (route.next === "retry_developer_with_findings")
             ev.emit("repair.started");
+        let idempotencyKey = `${instance.id}:${kind}:${issueNow.currentRound}${headSuffix}${attemptSuffix}`;
+        // NOT-333: a developer round that pushes nothing (e.g. a resume round that only
+        // updates the PR description) re-derives the exact key of the already-terminal
+        // reviewer item it follows — same instance, same round, same head — so the enqueue
+        // dedupes against that done row and strands the issue in `reviewing` with no pending
+        // work. A terminal duplicate gets the same `:retry-of:<causative work item id>`
+        // shape the infra-retry path uses, so a new row is created; a still-active
+        // (pending/leased) duplicate keeps deduping.
+        if (kind === "reviewer" && attemptSuffix === "") {
+            const existing = getWorkItemByIdempotencyKey(idempotencyKey);
+            if (existing &&
+                (existing.status === "done" || existing.status === "dead" || existing.status === "cancelled")) {
+                idempotencyKey += `:retry-of:${causativeItemId}`;
+            }
+        }
         const next = enqueueWorkItem({
             issueId: issue.id,
             workflowInstanceId: instance.id,
@@ -767,7 +879,7 @@ function applyEffect(issue, instance, effect, route, issueNow, ev, causativeItem
                 ...(effect.branch ? { branch: effect.branch } : {}),
                 profileSnapshot: queuedProfileSnapshot(issue, kind),
             },
-            idempotencyKey: `${instance.id}:${kind}:${issueNow.currentRound}${headSuffix}${attemptSuffix}`,
+            idempotencyKey,
         });
         return { ...base, nextWorkItemId: next.id };
     }
@@ -973,6 +1085,17 @@ function questionFor(actionType, reason, resumeAsReviewer = false, mergeFailure
             // Run-scoped action type directly with its own question text (NOT-95). Case exists
             // only so this function stays total over HumanActionType.
             throw new Error("outbound_delivery_interaction_required is not raised through applyEffect");
+        case "muse_capability":
+            // Never raised through applyEffect — muse-capability.ts creates this action
+            // directly with its own question text (NOT-308). Case exists only so this
+            // function stays total over HumanActionType.
+            throw new Error("muse_capability is not raised through applyEffect");
+        case "operator_verification":
+            // Never raised through applyEffect — auto-merge.ts's operator gate creates
+            // this action directly with a question listing each criterion and its
+            // command (NOT-314). Case exists only so this function stays total over
+            // HumanActionType.
+            throw new Error("operator_verification is not raised through applyEffect");
     }
 }
 /** Exported for db/migrate-to-issues.ts, which must populate the same response options on
@@ -1014,6 +1137,16 @@ export function responseOptionsFor(actionType, resumeAsReviewer = false, opts =
         case "outbound_delivery_interaction_required":
             // Never actually raised through applyEffect — see questionFor's identical case.
             throw new Error("outbound_delivery_interaction_required is not raised through applyEffect");
+        case "muse_capability":
+            // NOT-308: created with its own stored options (muse-capability.ts) — acknowledge
+            // admits on that Muse version (missing) or dismisses (unverified). Never raised
+            // through applyEffect; case exists only so this function stays total.
+            return [{ choice: "acknowledge", label: "Acknowledge" }];
+        case "operator_verification":
+            // Raised by auto-merge.ts's operator gate with these exact options (the
+            // shared constant keeps the two from drifting); listed here so the table
+            // stays total over HumanActionType.
+            return [...OPERATOR_VERIFICATION_RESPONSE_OPTIONS];
     }
 }
 function parseContinuationPreview(json) {
@@ -1052,18 +1185,88 @@ export function resolveHumanActionAndAdvance(actionId, resolvedBy, choice, opts)
     const normalizedNote = normalizeResolutionNote(opts?.note);
     if (!normalizedNote.ok)
         return { ok: false, code: 400, error: normalizedNote.error };
+    // NOT-314: every operator_verification choice requires a non-empty note — the
+    // recorded result (verified), the waiver reason (waive), or what to fix
+    // (repair). parseHumanResolution below also rejects a missing note; this
+    // names the requirement instead of misreporting a valid choice as invalid.
+    if (action.actionType === "operator_verification" && !normalizedNote.note) {
+        return {
+            ok: false,
+            code: 400,
+            error: 'A non-empty note is required to resolve operator_verification (verified: the result, e.g. pasted output; waive: why it is waived; repair: what the next round must fix)',
+        };
+    }
+    // NOT-308: a Muse capability escalation resolves without touching the workflow — it
+    // has no round to spend and no merge to park, and parseHumanResolution (below)
+    // deliberately rejects it since there is no workflow outcome to map. Acknowledging a
+    // `missing` verdict records a per-version override so the admission gate stops
+    // blocking that version; acknowledging `unverified` just dismisses. Works with or
+    // without an active instance (a blocked admission never has one).
+    if (action.actionType === "muse_capability") {
+        if (choice !== "acknowledge") {
+            return { ok: false, code: 400, error: `Invalid choice "${choice}" for muse_capability` };
+        }
+        if (!action.issueId)
+            return { ok: false, code: 500, error: "Human action has no issue" };
+        const museIssue = getIssue(action.issueId);
+        if (!museIssue)
+            return { ok: false, code: 404, error: "Issue not found" };
+        const museInstance = getActiveWorkflowInstance(action.issueId);
+        let evidence = null;
+        try {
+            evidence = action.evidenceJson
+                ? JSON.parse(action.evidenceJson)
+                : null;
+        }
+        catch {
+            evidence = null;
+        }
+        // File first, then the row: if the resolve below fails the action stays open and
+        // the operator retries idempotently; the reverse order could leave a resolved
+        // action whose version still blocks with no way to re-acknowledge.
+        if (evidence?.kind === "missing" && typeof evidence.version === "string" && evidence.version) {
+            recordMuseCapabilityOverride(evidence.version);
+        }
+        // The lifted block must be visible on the next health read, not after the cache TTL.
+        invalidateMuseHealthCache();
+        return getDb().transaction(() => {
+            resolveHumanAction(actionId, resolvedBy, { choice });
+            appendWorkflowEvent({
+                issueId: museIssue.id,
+                ...(museInstance ? { workflowInstanceId: museInstance.id } : {}),
+                type: "human_action.resolved",
+                actorType: "human",
+                actorRef: resolvedBy,
+                stage: museIssue.status,
+                round: museIssue.currentRound,
+                payload: { actionType: action.actionType, choice },
+            });
+            return {
+                ok: true,
+                issueStatus: museIssue.status,
+                nextWorkItemId: null,
+                instanceCompleted: false,
+                restarted: false,
+                triggerReflect: false,
+            };
+        })();
+    }
     const resolution = parseHumanResolution(action.actionType, choice, normalizedNote.note);
     if (!resolution) {
         return { ok: false, code: 400, error: `Invalid choice "${choice}" for ${action.actionType}` };
     }
     // NOT-272: the typed resolution carries the note only for product_scope_decision
-    // (parseHumanResolution drops it for every other action type).
+    // (parseHumanResolution drops it for every other action type — except
+    // operator_verification, whose note is required and always carried).
     const scopeDecisionNote = resolution.actionType === "product_scope_decision" && "note" in resolution
         ? resolution.note
         : undefined;
-    const storedResolution = scopeDecisionNote
-        ? { choice, note: scopeDecisionNote }
-        : { choice };
+    // NOT-314: the repair instruction rides the next developer round's payload;
+    // the verified/waived note is stored on the artifact / waiver event below.
+    const operatorNote = resolution.actionType === "operator_verification" && "note" in resolution
+        ? resolution.note
+        : undefined;
+    const storedResolution = scopeDecisionNote ?? operatorNote ? { choice, note: scopeDecisionNote ?? operatorNote } : { choice };
     // NOT-194: narrow policy_escalation choices per action. A merge-failure action offers
     // retry_merge/repair/close only (resume would re-run development on approved work);
     // every other policy_escalation keeps resume/close only. Pre-NOT-194 open merge-failure
@@ -1108,12 +1311,56 @@ export function resolveHumanActionAndAdvance(actionId, resolvedBy, choice, opts)
     // Park like auto-merge, then the async wrapper runs finalizeAutoMerge outside this txn.
     // NOT-194: a merge-failure retry_merge parks the same way — the old action is resolved
     // first, so a second failure escalates exactly one fresh action with the new reason.
-    if (instance &&
-        ((resolution.actionType === "final_review" &&
-            (resolution.choice === "merge" || resolution.choice === "complete")) ||
-            (resolution.actionType === "policy_escalation" && resolution.choice === "retry_merge"))) {
+    // NOT-314: an operator_verification verified/waive parks the same way — the recorded
+    // result satisfies the gate, so finalizeAutoMerge merges on the very next pass.
+    // (repair takes the generic repair-round path below, never this park.)
+    const parksForMerge = (resolution.actionType === "final_review" &&
+        (resolution.choice === "merge" || resolution.choice === "complete")) ||
+        (resolution.actionType === "policy_escalation" && resolution.choice === "retry_merge") ||
+        (resolution.actionType === "operator_verification" &&
+            (resolution.choice === "verified" || resolution.choice === "waive"));
+    if (instance && parksForMerge) {
         return getDb().transaction(() => {
-            resolveHumanAction(actionId, resolvedBy, { choice });
+            resolveHumanAction(actionId, resolvedBy, storedResolution);
+            // NOT-314: durably record what the merge is authorized by, in the same txn as
+            // the park — `verified` stores the result as an issue artifact (kind
+            // operator_verification, author human) pinned to this head; `waive`
+            // appends an operator_verification.waived workflow event. A later finalize
+            // re-checks the record against the then-current head, so new commits
+            // re-block the gate.
+            if (resolution.actionType === "operator_verification" && operatorNote) {
+                if (resolution.choice === "verified") {
+                    createIssueArtifact({
+                        issueId: issue.id,
+                        kind: OPERATOR_VERIFICATION_ARTIFACT_KIND,
+                        author: "human",
+                        content: {
+                            headSha: issue.headSha,
+                            note: operatorNote,
+                            verifiedBy: resolvedBy,
+                            verifiedAt: new Date().toISOString(),
+                        },
+                    });
+                }
+                else {
+                    appendWorkflowEvent({
+                        issueId: issue.id,
+                        workflowInstanceId: instance.id,
+                        type: "operator_verification.waived",
+                        actorType: "human",
+                        actorRef: resolvedBy,
+                        stage: issue.status,
+                        round: issue.currentRound,
+                        payload: {
+                            actionType: "operator_verification",
+                            choice: "waive",
+                            headSha: issue.headSha,
+                            waivedBy: resolvedBy,
+                            note: operatorNote,
+                        },
+                    });
+                }
+            }
             appendWorkflowEvent({
                 issueId: issue.id,
                 workflowInstanceId: instance.id,
@@ -1122,7 +1369,12 @@ export function resolveHumanActionAndAdvance(actionId, resolvedBy, choice, opts)
                 actorRef: resolvedBy,
                 stage: resolution.actionType === "final_review" ? "final_review" : issue.status,
                 round: issue.currentRound,
-                payload: { actionType: action.actionType, choice: resolution.choice, pendingMerge: true },
+                payload: {
+                    actionType: action.actionType,
+                    choice: resolution.choice,
+                    pendingMerge: true,
+                    ...(operatorNote ? { note: operatorNote } : {}),
+                },
             });
             transitionIssue(issue.id, "final_review", {
                 currentOwner: "system",
@@ -1328,7 +1580,10 @@ export function resolveHumanActionAndAdvance(actionId, resolvedBy, choice, opts)
                 incrementIssueRound(issue.id);
                 break;
             case "infra":
+                // NOT-313: a resume past an infra OR CI-checks escalation grants a fresh
+                // budget of both kinds — the CI budget is not a review-round spend either.
                 resetIssueInfraAttempts(issue.id);
+                resetIssueCiAttempts(issue.id);
                 if (advancesRound)
                     incrementIssueRound(issue.id);
                 break;
@@ -1372,6 +1627,10 @@ export function resolveHumanActionAndAdvance(actionId, resolvedBy, choice, opts)
                     // NOT-272: a product_scope_decision note rides only this next round's
                     // payload — later rounds never see it.
                     ...(scopeDecisionNote ? { scopeDecisionNote } : {}),
+                    // NOT-314: same one-shot ride for an operator_verification repair
+                    // note — only the repair choice reaches this path (verified/waive
+                    // park for merge above), and only this round reads it.
+                    ...(operatorNote ? { operatorRepairNote: operatorNote } : {}),
                 },
                 idempotencyKey: resumeKey,
             });
@@ -1446,7 +1705,9 @@ export async function resolveHumanActionAndAdvanceAsync(actionId, resolvedBy, ch
     return {
         ok: true,
         issueStatus: merged.issueStatus,
-        nextWorkItemId: null,
+        // NOT-310: a retry_merge that hit a textual conflict queues a repair round —
+        // report it like any other queued round instead of dropping it.
+        nextWorkItemId: merged.nextWorkItemId,
         instanceCompleted: merged.instanceCompleted,
         restarted: false,
         triggerReflect: merged.triggerReflect,

package/bundle/server/dist/coordinator/commands.test.js

@@ -635,6 +635,53 @@ test("fail → retry → exhaust → resume → fail again does not collide with
     assert.equal(pending.length, 1, "a fresh item must be enqueued — the old (round, infraAttempts)-keyed row must not be silently reused");
     assert.notEqual(pending[0].id, firstRetryItem.id, "must be a NEW work item, not the pre-escalation retry's now-terminal row");
 });
+test("NOT-333: a resume round that pushes nothing still enqueues a fresh reviewer instead of deduping against the terminal one", async () => {
+    // The NOT-200 shape: reviewer round 1 at head H escalates with a product scope
+    // question, the human resumes, and the developer round changes nothing — so its
+    // handoff re-derives the exact idempotency key of the already-done reviewer item.
+    const issueId = newIssue();
+    startWorkflow(issueId);
+    await complete(issueId, cleanHandoff);
+    const firstReviewer = listWorkItemsForIssue(issueId).find((i) => i.kind === "reviewer");
+    await complete(issueId, {
+        kind: "verdict",
+        result: { ...okReview("escalated"), productScopeQuestion: "Should deleted users retain sessions?" },
+    });
+    const action = listHumanActionsForIssue(issueId).find((a) => a.actionType === "product_scope_decision");
+    const resolved = resolveHumanActionAndAdvance(action.id, "yusuke", "resume");
+    assert.equal(resolved.ok, true);
+    assert.equal(getIssue(issueId).status, "developing");
+    // The resume round pushes nothing: the handoff carries the very same head SHA.
+    const { result } = await complete(issueId, cleanHandoff);
+    assert.equal(result.applied, true);
+    assert.equal(getIssue(issueId).status, "reviewing");
+    assert.equal(getWorkItem(firstReviewer.id).status, "done");
+    const reviewers = listWorkItemsForIssue(issueId).filter((i) => i.kind === "reviewer");
+    const pending = reviewers.filter((i) => i.status === "pending");
+    assert.equal(pending.length, 1, "a fresh reviewer round must be queued, not dropped via a key collision");
+    assert.notEqual(pending[0].id, firstReviewer.id, "must be a NEW work item, not the escalated round's now-terminal row");
+    assert.match(pending[0].idempotencyKey, /:retry-of:/, "the terminal duplicate is disambiguated like an infra retry");
+    assert.equal(JSON.parse(pending[0].payloadJson).inputSha, cleanHandoff.headSha);
+});
+test("NOT-333: a duplicate developer completion while the reviewer is still pending or leased enqueues no second reviewer", async () => {
+    const issueId = newIssue();
+    startWorkflow(issueId);
+    const item = claim(issueId);
+    const first = await applyCompletion(item.id, item.leaseToken, cleanHandoff);
+    assert.equal(first.applied, true);
+    // A retried callback redelivers the same completion while the reviewer is pending.
+    const second = await applyCompletion(item.id, item.leaseToken, cleanHandoff);
+    assert.equal(second.applied, false);
+    // Same while the reviewer is leased — still exactly one active reviewer row.
+    const reviewer = claim(issueId);
+    assert.equal(reviewer.kind, "reviewer");
+    const third = await applyCompletion(item.id, item.leaseToken, cleanHandoff);
+    assert.equal(third.applied, false);
+    const active = listWorkItemsForIssue(issueId).filter((i) => i.kind === "reviewer" && (i.status === "pending" || i.status === "leased"));
+    assert.equal(active.length, 1);
+    assert.equal(active[0].id, reviewer.id);
+    assert.equal(listWorkItemsForIssue(issueId).filter((i) => i.kind === "reviewer").length, 1);
+});
 test("resolving product_scope_decision:resume after a reviewer's escalated+question resumes as the developer", async () => {
     const issueId = newIssue();
     startWorkflow(issueId);

package/bundle/server/dist/coordinator/deck-outage.integration.test.js

@@ -31,15 +31,17 @@ const { deckOutageBackoffMs } = await import("./deck-outage-config.js");
 const UNREACHABLE = "Agent Deck is unreachable — fetch failed";
 before(() => migrate());
 beforeEach(() => {
+    // NOT-305: session-linked playbook_use_receipt artifacts reference worker_sessions,
+    // so child rows (artifacts, usage_events) go before their parents.
     getDb().exec(`
     DELETE FROM review_publications;
+    DELETE FROM artifacts;
     DELETE FROM work_items;
     DELETE FROM human_actions;
     DELETE FROM workflow_events;
     DELETE FROM findings;
-    DELETE FROM worker_sessions;
-    DELETE FROM artifacts;
     DELETE FROM usage_events;
+    DELETE FROM worker_sessions;
     DELETE FROM workflow_instances;
     DELETE FROM issues;
     DELETE FROM runtime_availability;