agent-dealer 1.2.8 → 1.2.10

package/bundle/server/dist/coordinator/commands.js

@@ -9,7 +9,7 @@
 import fs from "node:fs";
 import { canTransitionIssue, tryCompileContract } from "@agent-dealer/shared";
 import { getDb } from "../db/index.js";
-import { getIssue, incrementIssueRound, incrementIssueInfraAttempts, resetIssueInfraAttempts, grantReviewRetry, transitionIssue, } from "../repository/issues.js";
+import { getIssue, incrementIssueRound, incrementIssueInfraAttempts, incrementIssueCiAttempts, resetIssueInfraAttempts, resetIssueCiAttempts, grantReviewRetry, transitionIssue, } from "../repository/issues.js";
 import { appendWorkflowEvent, completeWorkflowInstance, getActiveWorkflowInstance, getWorkflowInstance, listWorkflowEventsForIssue, startWorkflowInstance, WorkflowAlreadyActiveError, } from "../repository/workflow-events.js";
 import { createHumanAction, findOpenHumanAction, getHumanAction, listHumanActionsForIssue, reopenHumanAction, resolveHumanAction, updateOpenHumanAction, } from "../repository/human-actions.js";
 import { pushLeaseToSha, readRemoteTip } from "../adapters/git-worktree.js";
@@ -20,7 +20,7 @@ import { getAgent } from "../repository/agents.js";
 import { githubIssuesSync, invalidateMuseHealthCache } from "../adapters/agent-health.js";
 import { recordMuseCapabilityOverride } from "../adapters/muse-capability.js";
 import { createIssueArtifact, latestIssueArtifact } from "../repository/artifacts.js";
-import { cancelWorkItem, enqueueWorkItem, finishWorkItem, getWorkItem, listWorkItemsForIssue, } from "../repository/work-items.js";
+import { cancelWorkItem, enqueueWorkItem, finishWorkItem, getWorkItem, getWorkItemByIdempotencyKey, listWorkItemsForIssue, } from "../repository/work-items.js";
 import { completeSession, getWorkerSession, listWorkerSessionsForIssue } from "../repository/worker-sessions.js";
 import { killRunProcess } from "../runners/spawn-cli.js";
 import { buildProfileSnapshot, serializeProfileSnapshot } from "./profile-snapshot.js";
@@ -31,9 +31,11 @@ import { routeDeveloperOutcome, routeReviewerOutcome, } from "./routing.js";
 import { projectDeveloperRoute, projectReviewerRoute } from "./projection.js";
 import { MERGE_FAILURE_EVIDENCE_KEY, MERGE_FAILURE_RESPONSE_OPTIONS, PUSH_DIVERGENCE_EVIDENCE_KEY, PUSH_DIVERGENCE_RESPONSE_OPTIONS, WORKTREE_BLOCKER_EVIDENCE_KEY, normalizeResolutionNote, parseHumanResolution, resolveHumanActionOutcome, } from "./human-resolution.js";
 import { AUTO_MERGE_INTENT, finalizeAutoMerge } from "./auto-merge.js";
+import { queueConflictRepairRound } from "./merge-conflict-sync.js";
+import { OPERATOR_VERIFICATION_ARTIFACT_KIND, OPERATOR_VERIFICATION_RESPONSE_OPTIONS, } from "./operator-criteria.js";
 import { externalMergeStateForIssue } from "./external-merge.js";
 import { detectNonConvergence, formatNonConvergenceReason, reviewHistoryFromEvents, } from "./non-convergence.js";
-import { capEscalationEvents, deferLeasedWorkItemForBaseFetch, deferLeasedWorkItemForDeckOutage, deferLeasedWorkItemForUsageCap, formatCapEscalationReason, usageCapDeferralStartedAt, } from "./usage-cap-defer.js";
+import { capEscalationEvents, checksWaitDeferralStartedAt, deferLeasedWorkItemForBaseFetch, deferLeasedWorkItemForChecksPending, deferLeasedWorkItemForDeckOutage, deferLeasedWorkItemForUsageCap, formatCapEscalationReason, formatChecksWaitEscalationReason, usageCapDeferralStartedAt, } from "./usage-cap-defer.js";
 import { dequeueIssue, getQueuedEntryForIssue, markQueueEntryAdmitted, } from "../repository/queue-entries.js";
 import { fetchResumeLiveHeadSha } from "./resume-live-head.js";
 import { getWorkflow } from "./workflows/registry.js";
@@ -136,7 +138,11 @@ function freezeTaskSnapshot(issue) {
  * never changes the eventual session. The worker loop consumes this off the payload and
  * only falls back to a live resolve for a legacy item queued before snapshots were carried.
  */
-function queuedProfileSnapshot(issue, kind) {
+/**
+ * NOT-333: shared with recovery's stranded-reviewer re-enqueue so a recovered round
+ * carries the same frozen profile as a normally routed one.
+ */
+export function queuedProfileSnapshot(issue, kind) {
     const agentId = kind === "developer" ? issue.developerAgentId : issue.reviewerAgentId;
     const agent = agentId ? getAgent(agentId) : null;
     return agent ? serializeProfileSnapshot(buildProfileSnapshot(agent, kind)) : null;
@@ -327,6 +333,18 @@ export async function applyCompletion(workItemId, leaseToken, outcome) {
     if (outcome.kind === "base_fetch_failed") {
         return applyBaseFetchDeferralCompletion(workItemId, leaseToken, outcome);
     }
+    // NOT-311: CI still queued/running (or not yet registered) at the poll timeout —
+    // the session ended cleanly, so the item waits on backoff and re-polls instead of
+    // spending an infra attempt. Past the wait ceiling this escalates to a human.
+    if (outcome.kind === "checks_pending") {
+        return applyChecksPendingCompletion(workItemId, leaseToken, outcome);
+    }
+    // NOT-354: the PR conflicts with its base, so CI will never start. The effect
+    // already ran the base sync; this re-polls the synced head, queues the one
+    // conflict-repair round, or escalates once — never a "Waiting for CI" deferral.
+    if (outcome.kind === "checks_conflicting") {
+        return applyChecksConflictCompletion(workItemId, leaseToken, outcome);
+    }
     const routed = getDb().transaction(() => {
         const before = getWorkItem(workItemId);
         if (!before)
@@ -415,6 +433,208 @@ function applyDeckOutageCompletion(workItemId, leaseToken, outage) {
 function applyBaseFetchDeferralCompletion(workItemId, leaseToken, failure) {
     return applyDeferralCompletion(workItemId, leaseToken, failure, (item, issue, instance) => deferLeasedWorkItemForBaseFetch(item, leaseToken, failure, issue, instance));
 }
+/**
+ * NOT-311: CI still pending at the poll timeout — defer with backoff, no attempt
+ * spent. Unlike a deck outage the wait has a ceiling, so the escalation arm raises a
+ * human action naming the stuck PR/SHA once CI has waited too long.
+ */
+function applyChecksPendingCompletion(workItemId, leaseToken, pending) {
+    return applyDeferralCompletion(workItemId, leaseToken, pending, (item, issue, instance) => deferLeasedWorkItemForChecksPending(item, leaseToken, pending, issue, instance), (issue, instance, item) => routeChecksWaitEscalation(issue, instance, item, pending));
+}
+/**
+ * NOT-354: act on the base sync a conflicting PR's CI wait ran. A clean sync is a
+ * normal CI wait on the pushed head, anchored at the original wait start (the
+ * deferral keeps any persisted `checksWaitStartedAt`), so the ceiling is never
+ * reset. A textual conflict queues the one NOT-310 conflict-repair round while
+ * finishing this item; anything else escalates once.
+ */
+function applyChecksConflictCompletion(workItemId, leaseToken, outcome) {
+    const { sync } = outcome;
+    if (sync.result === "synced") {
+        const headSha = sync.headSha ?? outcome.headSha;
+        return applyChecksPendingCompletion(workItemId, leaseToken, {
+            kind: "checks_pending",
+            reason: `Synced ${outcome.baseBranch} into PR #${outcome.prNumber}; waiting for CI on ${headSha.slice(0, 12)} - no attempt spent`,
+            branch: outcome.branch,
+            prNumber: outcome.prNumber,
+            headSha,
+            waitStartedAt: outcome.waitStartedAt,
+        });
+    }
+    return getDb().transaction(() => {
+        const before = getWorkItem(workItemId);
+        if (!before)
+            return { applied: false, reason: "not_found" };
+        if (before.status === "done" || before.status === "dead" || before.status === "cancelled") {
+            return { applied: false, reason: "already_terminal" };
+        }
+        const issue = getIssue(before.issueId);
+        if (!issue)
+            return { applied: false, reason: "not_found" };
+        const instance = getActiveWorkflowInstance(before.issueId);
+        if (!instance || instance.id !== before.workflowInstanceId) {
+            return { applied: false, reason: "no_active_instance" };
+        }
+        if (sync.result === "repair") {
+            const queued = queueConflictRepairRound({
+                issueId: issue.id,
+                instanceId: instance.id,
+                baseBranch: outcome.baseBranch,
+                branch: outcome.branch,
+                files: sync.files,
+                entry: "checks_wait",
+                finish: { workItemId, leaseToken, result: outcome },
+            });
+            if (queued) {
+                const session = before.workerSessionId ? getWorkerSession(before.workerSessionId) : null;
+                appendWorkflowEvent({
+                    issueId: issue.id,
+                    workflowInstanceId: instance.id,
+                    workerSessionId: before.workerSessionId,
+                    type: "worker.completed",
+                    actorType: "developer",
+                    stage: getIssue(issue.id).status,
+                    round: issue.currentRound,
+                    payload: {
+                        ...workerSessionPayload({
+                            runtime: session?.runtime,
+                            model: session?.model,
+                            sessionId: before.workerSessionId ?? "",
+                            worktreePath: session?.worktreePath,
+                        }),
+                        outcome: outcome.kind,
+                        ...(isPublishOnlyItem(before) ? { publishOnly: true } : {}),
+                    },
+                });
+                return {
+                    applied: true,
+                    issueStatus: getIssue(issue.id).status,
+                    nextWorkItemId: queued.id,
+                    humanActionId: null,
+                    instanceCompleted: false,
+                };
+            }
+            // Lease lost, or the issue left its developer stage — a lost lease applies
+            // nothing; otherwise fall through to the single escalation.
+            if (!getWorkItem(workItemId) || getWorkItem(workItemId).leaseToken !== leaseToken) {
+                return { applied: false, reason: "lease_lost" };
+            }
+        }
+        const item = finishWorkItem(workItemId, leaseToken, { status: "done", result: outcome });
+        if (!item)
+            return { applied: false, reason: "lease_lost" };
+        const reason = sync.result === "escalate"
+            ? sync.reason
+            : `PR #${outcome.prNumber} conflicts with ${outcome.baseBranch}; the conflict-repair round could not be queued.`;
+        const evidence = sync.result === "escalate" ? sync.evidence : { checksConflict: true };
+        return routeChecksConflictEscalation(issue, instance, item, outcome, reason, evidence);
+    })();
+}
+/** NOT-354: the one escalation for a conflicting PR — same shape as the CI-wait
+ * ceiling escalation, naming the PR, base, and (when known) the conflicting files. */
+function routeChecksConflictEscalation(issue, instance, item, outcome, reason, evidence) {
+    const ev = eventEmitter(issue, instance, item.workerSessionId, "needs_human", issue.currentRound);
+    const session = item.workerSessionId ? getWorkerSession(item.workerSessionId) : null;
+    for (const type of capEscalationEvents()) {
+        ev.emit(type, {
+            actorType: "developer",
+            payload: {
+                ...workerSessionPayload({
+                    runtime: session?.runtime ?? null,
+                    model: session?.model ?? null,
+                    sessionId: item.workerSessionId ?? "",
+                    worktreePath: session?.worktreePath,
+                }),
+                outcome: outcome.kind,
+                reason,
+                branch: outcome.branch,
+                baseBranch: outcome.baseBranch,
+                prNumber: outcome.prNumber,
+                headSha: outcome.headSha,
+            },
+        });
+    }
+    applyProjectionTransition(issue, { issueStatus: "needs_human", currentOwner: "human", currentIntent: reason, events: capEscalationEvents() }, {});
+    const action = createHumanAction({
+        issueId: issue.id,
+        workflowInstanceId: instance.id,
+        actionType: "policy_escalation",
+        reason,
+        question: questionFor("policy_escalation", reason),
+        evidence: {
+            ...evidence,
+            checksConflict: {
+                branch: outcome.branch,
+                baseBranch: outcome.baseBranch,
+                prNumber: outcome.prNumber,
+                headSha: outcome.headSha,
+            },
+        },
+        responseOptions: responseOptionsFor("policy_escalation"),
+    });
+    ev.emit("human_action.requested", { payload: { actionType: "policy_escalation", actionId: action.id } });
+    return {
+        applied: true,
+        issueStatus: "needs_human",
+        nextWorkItemId: null,
+        humanActionId: action.id,
+        instanceCompleted: false,
+    };
+}
+/**
+ * NOT-311: the CI wait passed its ceiling — hand to a human with the PR and head SHA
+ * CI never proved, without spending infra attempts. Mirrors the usage-cap ceiling
+ * escalation (worker.failed + needs_human + policy_escalation).
+ */
+export function routeChecksWaitEscalation(issue, instance, item, pending) {
+    const payload = parseWorkItemPayload(item.payloadJson);
+    const firstDeferredAt = checksWaitDeferralStartedAt(payload) ?? pending.waitStartedAt;
+    const reason = formatChecksWaitEscalationReason(pending, firstDeferredAt);
+    const role = item.kind === "developer" ? "developer" : "reviewer";
+    const ev = eventEmitter(issue, instance, item.workerSessionId, "needs_human", issue.currentRound);
+    for (const type of capEscalationEvents()) {
+        const session = item.workerSessionId ? getWorkerSession(item.workerSessionId) : null;
+        ev.emit(type, {
+            actorType: role,
+            payload: {
+                ...workerSessionPayload({
+                    runtime: session?.runtime ?? null,
+                    model: session?.model ?? null,
+                    sessionId: item.workerSessionId ?? "",
+                    worktreePath: session?.worktreePath,
+                }),
+                outcome: "checks_pending",
+                reason: pending.reason,
+                branch: pending.branch,
+                prNumber: pending.prNumber,
+                headSha: pending.headSha,
+            },
+        });
+    }
+    applyProjectionTransition(issue, {
+        issueStatus: "needs_human",
+        currentOwner: "human",
+        currentIntent: reason,
+        events: capEscalationEvents(),
+    }, {});
+    const action = createHumanAction({
+        issueId: issue.id,
+        workflowInstanceId: instance.id,
+        actionType: "policy_escalation",
+        reason,
+        question: questionFor("policy_escalation", reason),
+        evidence: { checksPending: { ...pending, firstDeferredAt } },
+        responseOptions: responseOptionsFor("policy_escalation"),
+    });
+    ev.emit("human_action.requested", { payload: { actionType: "policy_escalation", actionId: action.id } });
+    return {
+        applied: true,
+        issueStatus: "needs_human",
+        nextWorkItemId: null,
+        humanActionId: action.id,
+        instanceCompleted: false,
+    };
+}
 /**
  * Deferral ceiling exceeded — escalate with cap evidence without spending infra attempts.
  * Used when applyCompletion or the worker loop cannot defer any longer.
@@ -525,6 +745,8 @@ function applyDeveloper(issue, instance, item, outcome) {
         maxReviewRounds: issue.maxReviewRounds,
         infraAttempts: issue.infraAttempts,
         maxInfraAttempts: issue.maxInfraAttempts,
+        ciAttempts: issue.ciAttempts,
+        maxCiAttempts: issue.maxCiAttempts,
     });
     const { projection, effect, advance } = projectDeveloperRoute(route, issue.status, issue.currentRound);
     const ev = eventEmitter(issue, instance, item.workerSessionId, projection.issueStatus, issue.currentRound);
@@ -607,6 +829,9 @@ function applyDeveloper(issue, instance, item, outcome) {
         incrementIssueRound(issue.id);
     else if (advance === "infra")
         incrementIssueInfraAttempts(issue.id);
+    // NOT-313: a CI-repair retry spends ci_attempts, never infra_attempts.
+    else if (advance === "ci")
+        incrementIssueCiAttempts(issue.id);
     const issueNow = getIssue(issue.id);
     return applyEffect(issue, instance, effect, route, issueNow, ev, item.id);
 }
@@ -740,9 +965,10 @@ function findNonConvergence(issue, instance, result) {
     });
     return detectNonConvergence(history, issue.currentRound, floorRound);
 }
-/** Every route that spends an infra attempt (projection.ts's advance === "infra") repeats
- * the same round/head, so its enqueue needs a suffix the plain round/head key doesn't
- * provide to avoid colliding with the previous (terminal) attempt's key.
+/** Every route that spends an infra or CI attempt (projection.ts's advance === "infra"
+ * or "ci") repeats the same round/head, so its enqueue needs a suffix the plain
+ * round/head key doesn't provide to avoid colliding with the previous (terminal)
+ * attempt's key.
  * retry_reviewer_at_new_head belongs here too — a head that cycles A→B→A would otherwise
  * re-derive attempt A's ORIGINAL key (same round, same head) and collide with that
  * now-terminal work item, leaving the issue "reviewing" with no pending item. */
@@ -773,6 +999,21 @@ function applyEffect(issue, instance, effect, route, issueNow, ev, causativeItem
         const attemptSuffix = isInfraRetry(route) ? `:retry-of:${causativeItemId}` : "";
         if (route.next === "retry_developer_with_findings")
             ev.emit("repair.started");
+        let idempotencyKey = `${instance.id}:${kind}:${issueNow.currentRound}${headSuffix}${attemptSuffix}`;
+        // NOT-333: a developer round that pushes nothing (e.g. a resume round that only
+        // updates the PR description) re-derives the exact key of the already-terminal
+        // reviewer item it follows — same instance, same round, same head — so the enqueue
+        // dedupes against that done row and strands the issue in `reviewing` with no pending
+        // work. A terminal duplicate gets the same `:retry-of:<causative work item id>`
+        // shape the infra-retry path uses, so a new row is created; a still-active
+        // (pending/leased) duplicate keeps deduping.
+        if (kind === "reviewer" && attemptSuffix === "") {
+            const existing = getWorkItemByIdempotencyKey(idempotencyKey);
+            if (existing &&
+                (existing.status === "done" || existing.status === "dead" || existing.status === "cancelled")) {
+                idempotencyKey += `:retry-of:${causativeItemId}`;
+            }
+        }
         const next = enqueueWorkItem({
             issueId: issue.id,
             workflowInstanceId: instance.id,
@@ -785,7 +1026,7 @@ function applyEffect(issue, instance, effect, route, issueNow, ev, causativeItem
                 ...(effect.branch ? { branch: effect.branch } : {}),
                 profileSnapshot: queuedProfileSnapshot(issue, kind),
             },
-            idempotencyKey: `${instance.id}:${kind}:${issueNow.currentRound}${headSuffix}${attemptSuffix}`,
+            idempotencyKey,
         });
         return { ...base, nextWorkItemId: next.id };
     }
@@ -996,6 +1237,12 @@ function questionFor(actionType, reason, resumeAsReviewer = false, mergeFailure
             // directly with its own question text (NOT-308). Case exists only so this
             // function stays total over HumanActionType.
             throw new Error("muse_capability is not raised through applyEffect");
+        case "operator_verification":
+            // Never raised through applyEffect — auto-merge.ts's operator gate creates
+            // this action directly with a question listing each criterion and its
+            // command (NOT-314). Case exists only so this function stays total over
+            // HumanActionType.
+            throw new Error("operator_verification is not raised through applyEffect");
     }
 }
 /** Exported for db/migrate-to-issues.ts, which must populate the same response options on
@@ -1042,6 +1289,11 @@ export function responseOptionsFor(actionType, resumeAsReviewer = false, opts =
             // admits on that Muse version (missing) or dismisses (unverified). Never raised
             // through applyEffect; case exists only so this function stays total.
             return [{ choice: "acknowledge", label: "Acknowledge" }];
+        case "operator_verification":
+            // Raised by auto-merge.ts's operator gate with these exact options (the
+            // shared constant keeps the two from drifting); listed here so the table
+            // stays total over HumanActionType.
+            return [...OPERATOR_VERIFICATION_RESPONSE_OPTIONS];
     }
 }
 function parseContinuationPreview(json) {
@@ -1080,6 +1332,17 @@ export function resolveHumanActionAndAdvance(actionId, resolvedBy, choice, opts)
     const normalizedNote = normalizeResolutionNote(opts?.note);
     if (!normalizedNote.ok)
         return { ok: false, code: 400, error: normalizedNote.error };
+    // NOT-314: every operator_verification choice requires a non-empty note — the
+    // recorded result (verified), the waiver reason (waive), or what to fix
+    // (repair). parseHumanResolution below also rejects a missing note; this
+    // names the requirement instead of misreporting a valid choice as invalid.
+    if (action.actionType === "operator_verification" && !normalizedNote.note) {
+        return {
+            ok: false,
+            code: 400,
+            error: 'A non-empty note is required to resolve operator_verification (verified: the result, e.g. pasted output; waive: why it is waived; repair: what the next round must fix)',
+        };
+    }
     // NOT-308: a Muse capability escalation resolves without touching the workflow — it
     // has no round to spend and no merge to park, and parseHumanResolution (below)
     // deliberately rejects it since there is no workflow outcome to map. Acknowledging a
@@ -1140,13 +1403,17 @@ export function resolveHumanActionAndAdvance(actionId, resolvedBy, choice, opts)
         return { ok: false, code: 400, error: `Invalid choice "${choice}" for ${action.actionType}` };
     }
     // NOT-272: the typed resolution carries the note only for product_scope_decision
-    // (parseHumanResolution drops it for every other action type).
+    // (parseHumanResolution drops it for every other action type — except
+    // operator_verification, whose note is required and always carried).
     const scopeDecisionNote = resolution.actionType === "product_scope_decision" && "note" in resolution
         ? resolution.note
         : undefined;
-    const storedResolution = scopeDecisionNote
-        ? { choice, note: scopeDecisionNote }
-        : { choice };
+    // NOT-314: the repair instruction rides the next developer round's payload;
+    // the verified/waived note is stored on the artifact / waiver event below.
+    const operatorNote = resolution.actionType === "operator_verification" && "note" in resolution
+        ? resolution.note
+        : undefined;
+    const storedResolution = scopeDecisionNote ?? operatorNote ? { choice, note: scopeDecisionNote ?? operatorNote } : { choice };
     // NOT-194: narrow policy_escalation choices per action. A merge-failure action offers
     // retry_merge/repair/close only (resume would re-run development on approved work);
     // every other policy_escalation keeps resume/close only. Pre-NOT-194 open merge-failure
@@ -1191,12 +1458,56 @@ export function resolveHumanActionAndAdvance(actionId, resolvedBy, choice, opts)
     // Park like auto-merge, then the async wrapper runs finalizeAutoMerge outside this txn.
     // NOT-194: a merge-failure retry_merge parks the same way — the old action is resolved
     // first, so a second failure escalates exactly one fresh action with the new reason.
-    if (instance &&
-        ((resolution.actionType === "final_review" &&
-            (resolution.choice === "merge" || resolution.choice === "complete")) ||
-            (resolution.actionType === "policy_escalation" && resolution.choice === "retry_merge"))) {
+    // NOT-314: an operator_verification verified/waive parks the same way — the recorded
+    // result satisfies the gate, so finalizeAutoMerge merges on the very next pass.
+    // (repair takes the generic repair-round path below, never this park.)
+    const parksForMerge = (resolution.actionType === "final_review" &&
+        (resolution.choice === "merge" || resolution.choice === "complete")) ||
+        (resolution.actionType === "policy_escalation" && resolution.choice === "retry_merge") ||
+        (resolution.actionType === "operator_verification" &&
+            (resolution.choice === "verified" || resolution.choice === "waive"));
+    if (instance && parksForMerge) {
         return getDb().transaction(() => {
-            resolveHumanAction(actionId, resolvedBy, { choice });
+            resolveHumanAction(actionId, resolvedBy, storedResolution);
+            // NOT-314: durably record what the merge is authorized by, in the same txn as
+            // the park — `verified` stores the result as an issue artifact (kind
+            // operator_verification, author human) pinned to this head; `waive`
+            // appends an operator_verification.waived workflow event. A later finalize
+            // re-checks the record against the then-current head, so new commits
+            // re-block the gate.
+            if (resolution.actionType === "operator_verification" && operatorNote) {
+                if (resolution.choice === "verified") {
+                    createIssueArtifact({
+                        issueId: issue.id,
+                        kind: OPERATOR_VERIFICATION_ARTIFACT_KIND,
+                        author: "human",
+                        content: {
+                            headSha: issue.headSha,
+                            note: operatorNote,
+                            verifiedBy: resolvedBy,
+                            verifiedAt: new Date().toISOString(),
+                        },
+                    });
+                }
+                else {
+                    appendWorkflowEvent({
+                        issueId: issue.id,
+                        workflowInstanceId: instance.id,
+                        type: "operator_verification.waived",
+                        actorType: "human",
+                        actorRef: resolvedBy,
+                        stage: issue.status,
+                        round: issue.currentRound,
+                        payload: {
+                            actionType: "operator_verification",
+                            choice: "waive",
+                            headSha: issue.headSha,
+                            waivedBy: resolvedBy,
+                            note: operatorNote,
+                        },
+                    });
+                }
+            }
             appendWorkflowEvent({
                 issueId: issue.id,
                 workflowInstanceId: instance.id,
@@ -1205,7 +1516,12 @@ export function resolveHumanActionAndAdvance(actionId, resolvedBy, choice, opts)
                 actorRef: resolvedBy,
                 stage: resolution.actionType === "final_review" ? "final_review" : issue.status,
                 round: issue.currentRound,
-                payload: { actionType: action.actionType, choice: resolution.choice, pendingMerge: true },
+                payload: {
+                    actionType: action.actionType,
+                    choice: resolution.choice,
+                    pendingMerge: true,
+                    ...(operatorNote ? { note: operatorNote } : {}),
+                },
             });
             transitionIssue(issue.id, "final_review", {
                 currentOwner: "system",
@@ -1411,7 +1727,10 @@ export function resolveHumanActionAndAdvance(actionId, resolvedBy, choice, opts)
                 incrementIssueRound(issue.id);
                 break;
             case "infra":
+                // NOT-313: a resume past an infra OR CI-checks escalation grants a fresh
+                // budget of both kinds — the CI budget is not a review-round spend either.
                 resetIssueInfraAttempts(issue.id);
+                resetIssueCiAttempts(issue.id);
                 if (advancesRound)
                     incrementIssueRound(issue.id);
                 break;
@@ -1455,6 +1774,10 @@ export function resolveHumanActionAndAdvance(actionId, resolvedBy, choice, opts)
                     // NOT-272: a product_scope_decision note rides only this next round's
                     // payload — later rounds never see it.
                     ...(scopeDecisionNote ? { scopeDecisionNote } : {}),
+                    // NOT-314: same one-shot ride for an operator_verification repair
+                    // note — only the repair choice reaches this path (verified/waive
+                    // park for merge above), and only this round reads it.
+                    ...(operatorNote ? { operatorRepairNote: operatorNote } : {}),
                 },
                 idempotencyKey: resumeKey,
             });

package/bundle/server/dist/coordinator/commands.test.js

@@ -635,6 +635,53 @@ test("fail → retry → exhaust → resume → fail again does not collide with
     assert.equal(pending.length, 1, "a fresh item must be enqueued — the old (round, infraAttempts)-keyed row must not be silently reused");
     assert.notEqual(pending[0].id, firstRetryItem.id, "must be a NEW work item, not the pre-escalation retry's now-terminal row");
 });
+test("NOT-333: a resume round that pushes nothing still enqueues a fresh reviewer instead of deduping against the terminal one", async () => {
+    // The NOT-200 shape: reviewer round 1 at head H escalates with a product scope
+    // question, the human resumes, and the developer round changes nothing — so its
+    // handoff re-derives the exact idempotency key of the already-done reviewer item.
+    const issueId = newIssue();
+    startWorkflow(issueId);
+    await complete(issueId, cleanHandoff);
+    const firstReviewer = listWorkItemsForIssue(issueId).find((i) => i.kind === "reviewer");
+    await complete(issueId, {
+        kind: "verdict",
+        result: { ...okReview("escalated"), productScopeQuestion: "Should deleted users retain sessions?" },
+    });
+    const action = listHumanActionsForIssue(issueId).find((a) => a.actionType === "product_scope_decision");
+    const resolved = resolveHumanActionAndAdvance(action.id, "yusuke", "resume");
+    assert.equal(resolved.ok, true);
+    assert.equal(getIssue(issueId).status, "developing");
+    // The resume round pushes nothing: the handoff carries the very same head SHA.
+    const { result } = await complete(issueId, cleanHandoff);
+    assert.equal(result.applied, true);
+    assert.equal(getIssue(issueId).status, "reviewing");
+    assert.equal(getWorkItem(firstReviewer.id).status, "done");
+    const reviewers = listWorkItemsForIssue(issueId).filter((i) => i.kind === "reviewer");
+    const pending = reviewers.filter((i) => i.status === "pending");
+    assert.equal(pending.length, 1, "a fresh reviewer round must be queued, not dropped via a key collision");
+    assert.notEqual(pending[0].id, firstReviewer.id, "must be a NEW work item, not the escalated round's now-terminal row");
+    assert.match(pending[0].idempotencyKey, /:retry-of:/, "the terminal duplicate is disambiguated like an infra retry");
+    assert.equal(JSON.parse(pending[0].payloadJson).inputSha, cleanHandoff.headSha);
+});
+test("NOT-333: a duplicate developer completion while the reviewer is still pending or leased enqueues no second reviewer", async () => {
+    const issueId = newIssue();
+    startWorkflow(issueId);
+    const item = claim(issueId);
+    const first = await applyCompletion(item.id, item.leaseToken, cleanHandoff);
+    assert.equal(first.applied, true);
+    // A retried callback redelivers the same completion while the reviewer is pending.
+    const second = await applyCompletion(item.id, item.leaseToken, cleanHandoff);
+    assert.equal(second.applied, false);
+    // Same while the reviewer is leased — still exactly one active reviewer row.
+    const reviewer = claim(issueId);
+    assert.equal(reviewer.kind, "reviewer");
+    const third = await applyCompletion(item.id, item.leaseToken, cleanHandoff);
+    assert.equal(third.applied, false);
+    const active = listWorkItemsForIssue(issueId).filter((i) => i.kind === "reviewer" && (i.status === "pending" || i.status === "leased"));
+    assert.equal(active.length, 1);
+    assert.equal(active[0].id, reviewer.id);
+    assert.equal(listWorkItemsForIssue(issueId).filter((i) => i.kind === "reviewer").length, 1);
+});
 test("resolving product_scope_decision:resume after a reviewer's escalated+question resumes as the developer", async () => {
     const issueId = newIssue();
     startWorkflow(issueId);