atris 3.74.28 → 3.75.0

package/lib/gm-season.js

@@ -11,7 +11,7 @@
 const fs = require('fs');
 const path = require('path');
 const { atrisRating } = require('./atris-rating');
-const { isProofNotSaved } = require('./release-kind');
+const { isProofNotSaved, isCouldNotStart } = require('./release-kind');
 
 const HOUR_MS = 60 * 60 * 1000;
 const DAY_MS = 24 * HOUR_MS;
@@ -22,13 +22,14 @@ const ACTIVE_MISSION_STATUSES = new Set(['running', 'ready']);
 const KEPT_ACTIONS = new Set(['accepted', 'merged']);
 const FINISHED = new Set(['landed', 'dropped', 'sent_back', 'abandoned']);
 const FORM_LETTER = { landed: 'k', dropped: 'd', sent_back: 'x', abandoned: 'a' };
-const PLAY_WORD = { took: 'took', landed: 'landed', dropped: 'dropped', sent_back: 'sent back', abandoned: 'abandoned', not_needed: 'not needed', held: 'held' };
+const PLAY_WORD = { took: 'took', landed: 'landed', dropped: 'dropped', sent_back: 'sent back', abandoned: 'abandoned', not_needed: 'not needed', held: 'held', could_not_start: 'unstarted' };
 // A person has this long after a drop to say the job did not need doing.
 const NOT_NEEDED_WINDOW_MS = 7 * DAY_MS;
 
 // An outcome is one play:
 // { event_id, task_id, member, title, kind, at, claimed_at, landed_by }
-// kind is took | landed | dropped | sent_back | abandoned | not_needed | held.
+// kind is took | landed | dropped | sent_back | abandoned | not_needed | held |
+// could_not_start.
 // abandoned is a claim that ended archived without landing; a job still in
 // review is pending and not counted. not_needed is a drop or abandon that
 // someone other than the member later confirmed the job never needed; it is
@@ -36,8 +37,14 @@ const NOT_NEEDED_WINDOW_MS = 7 * DAY_MS;
 // because the work is done and its pull request waits for a person, but the
 // proof that says so could not be saved; the release says so in a field
 // (lib/release-kind.js), never in its words. It is not finished either, so it
-// is neither a landing nor a miss. at and claimed_at are epoch ms; claimed_at
-// may be null. landed_by is autoland | you, only on landed.
+// is neither a landing nor a miss. could_not_start is a claim a flight let go
+// before the engine ran, because the build machine could not start the job; the
+// release says so in a field the same way. The member never touched the work, so
+// it is not finished and not a miss either. The field checks itself: a claim the
+// flight marked started (a build_started event after its claim, see
+// markBuildStarted in task-db.js) had its engine asked, so a release that says
+// could_not_start on it is a drop like any other. at and claimed_at are epoch
+// ms; claimed_at may be null. landed_by is autoland | you, only on landed.
 
 function byTimeAsc(a, b) {
   return Number(a.at || 0) - Number(b.at || 0);
@@ -50,7 +57,7 @@ function isFinished(outcome) {
 // jobs = landed + dropped + sent back + abandoned in the window, the same
 // count the rating divides by. Jobs still in review are pending.
 function tally(outcomes) {
-  const out = { took: 0, landed: 0, dropped: 0, sent_back: 0, abandoned: 0, not_needed: 0, held: 0 };
+  const out = { took: 0, landed: 0, dropped: 0, sent_back: 0, abandoned: 0, not_needed: 0, held: 0, could_not_start: 0 };
   for (const o of outcomes || []) {
     if (Object.prototype.hasOwnProperty.call(out, o.kind)) out[o.kind] += 1;
   }
@@ -330,8 +337,13 @@ function outcomeFromEvent(row) {
     member = row.actor || payload.claimed_by;
   } else if (row.event_type === 'claim_released') {
     // A release that carries the proof-not-saved fields is work waiting on a person,
-    // not a drop. Only the fields say so: the same words with no fields stay a drop.
-    kind = isProofNotSaved(payload) ? 'held' : 'dropped';
+    // not a drop. One that carries the could-not-start kind was let go before the
+    // engine ran, so it is not a drop either, unless its claim was marked started
+    // (engine_started): then the kind is false and it is a drop. Only the fields say
+    // so: the same words with no fields stay a drop.
+    kind = isProofNotSaved(payload) ? 'held'
+      : isCouldNotStart(payload) && Number(row.engine_started) !== 1 ? 'could_not_start'
+        : 'dropped';
     member = payload.previous_claimed_by || payload.released_by || row.actor;
   } else if (row.event_type === 'claim_expired') {
     kind = 'dropped';
@@ -420,7 +432,11 @@ function outcomesFromEvents(rows, since = -Infinity) {
     const ended = ['claim_released', 'claim_expired', 'completed', 'reopened', 'archived'].includes(row.event_type);
     if (!play) { if (ended) closed.add(key); continue; }
     if (play.kind === 'took') { plays.push(play); continue; }
-    if (row.event_type === 'claim_released') {
+    // A release that another member's claim follows within two minutes reads as a hand-over, and is left out. That
+    // is a rule about old history, whose releases carry no mark, and it holds for them as it always did. A release
+    // on a claim the engine started (engine_started) is a real miss whoever claims next, and one that could not
+    // start has its own line: neither is a hand-over, so neither is erased.
+    if (row.event_type === 'claim_released' && Number(row.engine_started) !== 1 && play.kind !== 'could_not_start') {
       let next = null;
       for (let j = i + 1; j < ordered.length && ordered[j].task_id === row.task_id; j++) {
         if (ordered[j].event_type === 'claimed') { next = ordered[j]; break; }
@@ -555,6 +571,12 @@ function playEventsSql(extraWhere = '') {
     SELECT e.event_id, e.task_id, e.workspace_root, e.event_type, e.actor, e.payload, e.created_at, e.version,
            t.title, t.claimed_by, t.claimed_at,
            c.event_id AS claim_event_id, c.created_at AS claim_event_at, c.actor AS claim_actor,
+           CASE WHEN e.event_type = 'claim_released' AND c.event_id IS NOT NULL AND EXISTS (
+             SELECT 1 FROM task_events b
+              WHERE b.task_id = e.task_id AND b.version > c.version AND b.version < e.version
+                -- the flight marks a claim started right before it asks the assigned engine
+                AND b.event_type = 'build_started'
+           ) THEN 1 ELSE 0 END AS engine_started,
            CASE WHEN e.event_type = 'archived' AND c.event_id IS NOT NULL AND NOT EXISTS (
              SELECT 1 FROM task_events x
               WHERE x.task_id = e.task_id AND x.version > c.version AND x.version < e.version

package/lib/known-commands.js

@@ -4,7 +4,7 @@ const knownCommands = ['init', 'guide', 'doctor', 'doc-health', 'install', 'work
                        'activate', '_activate', 'agent', 'team', 'chat', 'fast', 'ax', 'console', 'serve', 'login', 'logout', 'whoami', 'switch', 'use', 'accounts', '_resolve', '_profile-email', '_switch-session', 'shell-init', 'update', 'upgrade', 'version', 'help', 'next', 'atris',
                        'clean', 'close', 'harvest', 'verify', 'recover', 'search', 'scout', 'skill', 'member', 'codex-goal', 'app', 'apps', 'learn', 'lesson', 'taste', 'teach', 'plugin', 'experiments', 'bench', 'router', 'tree', 'receipt', 'proof', 'openclaw', 'pull', 'push', 'watch', 'cloud', 'live', 'align', 'terminal', 'computer', 'diff', 'business', 'sync', 'youtube', 'x-search',
                        'ingest', 'query', 'lint', 'loop', 'pulse', 'task', 'mission', 'decide', 'campaign', 'agents', 'probe', 'worktree', 'land', 'caretaker', 'autoland', 'drive', 'aeo', 'slop', 'voice', 'strings', 'write', 'security-review', 'secure', 'deck', 'site', 'theme', 'card', 'reel', 'improve', 'study', 'rainmaker', 'xp', 'play', 'gm', 'game', 'x', 'recap', 'report', 'signup', 'clarity', 'interview', 'meet', 'moves', 'unknowns', 'avail', 'scoreboard', 'scorecard', 'rating', 'sync-checkout', 'zen',
-                       'ci', 'github', 'vercel', 'supabase', 'linear', 'stripe', 'balance', 'usage', 'spend', 'api-key', 'agent-client', 'topup', 'buy', 'transactions', 'hire', 'hires', 'mail', 'design', 'mcp', 'gmail', 'calendar', 'twitter', 'slack', 'imessage', 'integrations', 'setup', 'clean-workspace', 'cw',
+                       'ci', 'github', 'vercel', 'supabase', 'linear', 'stripe', 'balance', 'usage', 'spend', 'api-key', 'agent-client', 'topup', 'buy', 'transactions', 'hire', 'hires', 'mail', 'design', 'mcp', 'gmail', 'google', 'calendar', 'twitter', 'slack', 'imessage', 'integrations', 'setup', 'clean-workspace', 'cw',
                        'fork', 'browse', 'publish', 'pack', 'sleep', 'wake', 'feedback', 'errors', 'wiki', 'code-review', 'cr', 'soul', 'fleet', 'fleet-report', 'loops', 'self-improve', 'compile', 'spaceship', 'truth', 'sign', 'engine', 'engines', 'link', 'playbook', 'feed', 'brief', 'social', 'host', 'people', 'follow', 'unfollow', 'friends', 'msg', 'inbox', 'invite', 'join', 'rsi', 'pay', 'trust'];
 
 // Damerau-Levenshtein edit distance between two short strings. Counts an

package/lib/release-kind.js

@@ -2,16 +2,33 @@
 
 // Why a claim was let go, as a field the rating can read without reading words.
 //
-// One kind exists. The work is done and its pull request is open for a person to
+// Two kinds exist. Both ride on the release event as fields; the reason text is
+// only for people, and nothing ever parses it.
+//
+// proof_not_saved. The work is done and its pull request is open for a person to
 // land, but the proof that says so could not be saved. The builder did its part,
-// so the release is neither a landing nor a drop. The kind and the pull request
-// ride on the release event as fields; the reason text is only for people, and
-// nothing ever parses it.
+// so the release is neither a landing nor a drop. A release says this by passing
+// the kind and the pull request together. The task db refuses half of a marker,
+// and the rating reads a release as this kind only when both are there.
+//
+// could_not_start. The flight let the claim go before the engine ran, because the
+// build machine could not start the job (no room on the disk, a build copy that
+// would not open, a lease that would not set, a brief that would not save). The
+// builder never touched the work, so the release is neither a drop nor a finished
+// job. The kind goes alone, with no pull request, and only the flights pass it.
 //
-// A release says this by passing both fields. The task db refuses half of a
-// marker, and the rating reads a release as this kind only when both are there.
+// The kind checks itself. A builder shares the task store with the flight, so
+// the store and the rating take it only for a claim whose engine was never
+// asked. Right before it asks the assigned engine, the flight writes a
+// build_started event on the claim (see markBuildStarted in task-db.js). A
+// release that carries could_not_start on a claim with that event is an
+// ordinary release, and the rating reads it as a drop. Scout and prep passes
+// run before the mark, so they never count as the build starting.
 
 const PROOF_NOT_SAVED = 'proof_not_saved';
+const COULD_NOT_START = 'could_not_start';
+// The event type of that mark.
+const BUILD_STARTED = 'build_started';
 
 // True for a release event payload that carries the kind and an open pull
 // request it can point at. Anything less is an ordinary release.
@@ -24,4 +41,11 @@ function isProofNotSaved(payload) {
   return (Number.isInteger(pr.number) && pr.number > 0) || /^https?:\/\//i.test(String(pr.url || '').trim());
 }
 
-module.exports = { PROOF_NOT_SAVED, isProofNotSaved };
+// True for a release event payload that carries the could-not-start kind.
+// Anything else, including the same words with no field, is an ordinary release.
+function isCouldNotStart(payload) {
+  if (!payload || typeof payload !== 'object' || Array.isArray(payload)) return false;
+  return payload.kind === COULD_NOT_START;
+}
+
+module.exports = { PROOF_NOT_SAVED, COULD_NOT_START, BUILD_STARTED, isProofNotSaved, isCouldNotStart };

package/lib/task-db.js

@@ -27,7 +27,7 @@ const path = require('path');
 const crypto = require('crypto');
 const { DatabaseSync } = require('node:sqlite');
 const reviewIntegrity = require('./review-integrity');
-const { PROOF_NOT_SAVED } = require('./release-kind');
+const { PROOF_NOT_SAVED, COULD_NOT_START, BUILD_STARTED } = require('./release-kind');
 const dailyLog = require('./daily-log');
 const { isGenericScratchRoot } = require('./scratch-root');
 const { isDecisionTask } = require('./task-decision');
@@ -593,9 +593,50 @@ function workspaceHead(workspaceRoot) {
   }
 }
 
-// Atomic claim. Returns { claimed: true, row } only if THIS call won the row.
-// Race-safe via single UPDATE with WHERE status='open' guard. SQLite serializes
-// writes; busy_timeout absorbs contention. Caller must check `.claimed`.
+// One row change and its history entry are one transaction: both are in the store or neither is, so nobody can see,
+// or compare against, a job whose row says one thing and whose history says another, and a history write that fails
+// takes the row change back with it. BEGIN IMMEDIATE takes the write lock first, so what the writer read is still
+// true when it writes. A caller already inside a transaction of its own joins that one (db.isTransaction says so on
+// the Node versions that have it; on the others SQLite refuses to begin inside one, and that refusal says the same).
+function inWriteTransaction(db, write) {
+  if (db.isTransaction) return write();
+  try {
+    withBusyRetry(() => db.exec('BEGIN IMMEDIATE'));
+  } catch (err) {
+    if (/within a transaction/i.test(String(err && err.message))) return write();
+    throw err;
+  }
+  let result;
+  try {
+    result = write();
+    db.exec('COMMIT');
+  } catch (err) {
+    try { db.exec('ROLLBACK'); } catch { /* the transaction is already gone */ }
+    throw err;
+  }
+  return result;
+}
+
+// The part of a write that holds it to one claim. The caller names a claim by its claimed event (bound twice, once
+// for the NULL test, which leaves a write that names none as it always was). The write goes through only when that
+// event is the job's latest claimed event and is no older than the row's own claim time, which is how an older CLI,
+// that saves the row first and its event a moment later, shows a claim that is not here yet. It sits inside the
+// write itself, one statement, so a claim that lands after the caller's last look is refused too, and it reads the
+// claim by its event, not by a time, which two claims can share.
+const NAMED_CLAIM_SQL = `AND (? IS NULL OR EXISTS (
+  SELECT 1 FROM task_events e
+   WHERE e.task_id = tasks.id
+     AND e.event_type = 'claimed'
+     AND e.event_id = ?
+     AND (tasks.claimed_at IS NULL OR e.created_at >= tasks.claimed_at)
+     AND e.version = (SELECT MAX(version) FROM task_events WHERE task_id = tasks.id AND event_type = 'claimed')))`;
+
+// Atomic claim. Returns { claimed: true, row, event } only if THIS call won the row; event is the claimed event
+// this claim wrote, the one name for it (see latestClaim). Race-safe via single UPDATE with WHERE status='open'
+// guard. SQLite serializes writes; busy_timeout absorbs contention. Caller must check `.claimed`.
+//
+// The row and its claimed event are written in one transaction. Before, the row was claimed first and the event
+// followed a git call later, and in that gap a late release naming the claim before could pass for the new one.
 function claimTask(db, { id, claimedBy, leaseMinutes, leasePid }) {
   if (!id) throw new Error('id required');
   if (!claimedBy) throw new Error('claimedBy required');
@@ -611,27 +652,42 @@ function claimTask(db, { id, claimedBy, leaseMinutes, leasePid }) {
        AND status = 'open'
   `);
   const lease = leaseMinutes == null ? null : JSON.stringify({ until: new Date(now + leaseMinutes * 60000).toISOString(), minutes: leaseMinutes, holder: claimedBy, pid: leasePid });
-  const result = withBusyRetry(() => stmt.run(claimedBy, now, now, lease, lease, id));
-  if (result.changes === 1) {
+  const won = inWriteTransaction(db, () => {
+    const result = withBusyRetry(() => stmt.run(claimedBy, now, now, lease, lease, id));
+    if (result.changes !== 1) return null;
     let row = db.prepare('SELECT * FROM tasks WHERE id = ?').get(id);
-    // First claim wins: a re-claim after a revision keeps the original start.
+    // The commit the workspace sits on is read here, with the write lock held, and only for a claim that won. A claim
+    // that has to wait for the lock is made when it gets it, and a commit that landed in the checkout while it waited
+    // is part of what was there before the job began: read earlier, the start would name a commit older than the claim,
+    // and a job that made no commit could be credited with the one that landed (lib/landing-proof.js). A git that is
+    // slow to answer holds the lock for no longer than workspaceHead lets it wait.
     const startCommit = workspaceHead(row.workspace_root);
+    // First claim wins: a re-claim after a revision keeps the original start.
     const claimedMetadata = row.metadata ? safeJSON(row.metadata) || {} : {};
     if (startCommit && !claimedMetadata.start_commit) {
       claimedMetadata.start_commit = startCommit;
       withBusyRetry(() => db.prepare('UPDATE tasks SET metadata = ? WHERE id = ?').run(JSON.stringify(claimedMetadata), id));
       row = db.prepare('SELECT * FROM tasks WHERE id = ?').get(id);
     }
-    appendTaskEvent(db, {
+    const event = appendTaskEvent(db, {
       taskId: id,
       workspaceRoot: row.workspace_root,
       actor: claimedBy,
       eventType: 'claimed',
       payload: { claimed_by: claimedBy, ...(startCommit ? { start_commit: startCommit } : {}) },
     });
-    const enriched = { ...row, metadata: row.metadata ? safeJSON(row.metadata) : null };
-    appendTaskWorkLog(db, enriched, { actor: claimedBy, title: 'Task claimed' });
-    return { claimed: true, row: enriched };
+    return { row, event };
+  });
+  if (won) {
+    const enriched = { ...won.row, metadata: won.row.metadata ? safeJSON(won.row.metadata) : null };
+    // The work log is a note for people, written once the claim is saved. A note that cannot be written must not
+    // turn a claim that landed into an error: the caller would not learn which claim is its own.
+    try {
+      appendTaskWorkLog(db, enriched, { actor: claimedBy, title: 'Task claimed' });
+    } catch (err) {
+      if (process.env.ATRIS_DEBUG) process.stderr.write(`claim log failed: ${String(err?.message ?? err).replace(/[\r\n]+/g, ' ')}\n`);
+    }
+    return { claimed: true, row: enriched, event: won.event };
   }
   // Either id doesn't exist or status != 'open'. Tell the caller which.
   const row = db.prepare('SELECT id, status, claimed_by FROM tasks WHERE id = ?').get(id);
@@ -639,14 +695,19 @@ function claimTask(db, { id, claimedBy, leaseMinutes, leasePid }) {
   return { claimed: false, reason: 'already_' + row.status, claimed_by: row.claimed_by };
 }
 
-// Lease updates are guarded by the holder and do not create activity events.
-function setLease(db, { id, holder, minutes = 60, pid = process.pid, now = Date.now() }) {
+// Lease updates are guarded by the holder and do not create activity events. A flight also names the claim it
+// made (claimEventId, see NAMED_CLAIM_SQL): the lease is written, renewed, or cleared only while the job is
+// still held under that claim, in the same statement, so a flight that lost its job cannot replace or clear the
+// lease of the claim that came after it, even under the same builder name. One statement is one transaction,
+// and a lease has no history entry, so there is nothing more to keep together.
+function setLease(db, { id, holder, minutes = 60, pid = process.pid, now = Date.now(), claimEventId }) {
   const raw = db.prepare('SELECT metadata FROM tasks WHERE id = ?').get(id);
   const row = getTask(db, id);
   if (!row || row.metadata_unreadable || row.status !== 'claimed' || row.claimed_by !== holder) return false;
+  const named = claimEventId ? String(claimEventId) : null;
   const metadata = { ...(row.metadata || {}), lease: { until: new Date(Number(now) + minutes * 60000).toISOString(), minutes, holder, pid } };
-  return withBusyRetry(() => db.prepare("UPDATE tasks SET metadata = ? WHERE id = ? AND status = 'claimed' AND claimed_by = ? AND metadata IS ?")
-    .run(JSON.stringify(metadata), id, holder, raw.metadata)).changes === 1;
+  return withBusyRetry(() => db.prepare(`UPDATE tasks SET metadata = ? WHERE id = ? AND status = 'claimed' AND claimed_by = ? AND metadata IS ? ${NAMED_CLAIM_SQL}`)
+    .run(JSON.stringify(metadata), id, holder, raw.metadata, named, named)).changes === 1;
 }
 
 function renewLease(db, options) {
@@ -654,21 +715,23 @@ function renewLease(db, options) {
   const metadata = row && row.metadata ? safeJSON(row.metadata) : null;
   const lease = metadata && metadata.lease;
   if (!row || row.status !== 'claimed' || row.claimed_by !== options.holder || !lease || lease.holder !== options.holder || (options.pid != null && lease.pid !== options.pid)) return false;
+  const named = options.claimEventId ? String(options.claimEventId) : null;
   const minutes = options.minutes ?? lease.minutes;
   const now = options.now ?? Date.now();
   const updated = { ...metadata, lease: { until: new Date(Number(now) + minutes * 60000).toISOString(), minutes, holder: options.holder, pid: options.pid ?? lease.pid } };
-  return withBusyRetry(() => db.prepare("UPDATE tasks SET metadata = ? WHERE id = ? AND status = 'claimed' AND claimed_by = ? AND claimed_at IS ? AND metadata IS ?")
-    .run(JSON.stringify(updated), row.id, row.claimed_by, row.claimed_at, row.metadata)).changes === 1;
+  return withBusyRetry(() => db.prepare(`UPDATE tasks SET metadata = ? WHERE id = ? AND status = 'claimed' AND claimed_by = ? AND claimed_at IS ? AND metadata IS ? ${NAMED_CLAIM_SQL}`)
+    .run(JSON.stringify(updated), row.id, row.claimed_by, row.claimed_at, row.metadata, named, named)).changes === 1;
 }
 
-function clearLease(db, { id, holder }) {
+function clearLease(db, { id, holder, claimEventId }) {
   const raw = db.prepare('SELECT metadata FROM tasks WHERE id = ?').get(id);
   const row = getTask(db, id);
   if (!row || !row.metadata || !row.metadata.lease || row.metadata.lease.holder !== holder) return false;
+  const named = claimEventId ? String(claimEventId) : null;
   const metadata = { ...row.metadata };
   delete metadata.lease;
-  return withBusyRetry(() => db.prepare('UPDATE tasks SET metadata = ? WHERE id = ? AND metadata IS ?')
-    .run(JSON.stringify(metadata), id, raw.metadata)).changes === 1;
+  return withBusyRetry(() => db.prepare(`UPDATE tasks SET metadata = ? WHERE id = ? AND metadata IS ? ${NAMED_CLAIM_SQL}`)
+    .run(JSON.stringify(metadata), id, raw.metadata, named, named)).changes === 1;
 }
 
 function pidAlive(pid) {
@@ -743,23 +806,103 @@ function sweepExpiredLeases() {
 // line. A release that must not read as a drop (the work is done and its pull
 // request waits for a person, only the proof could not be saved) also carries a
 // kind and that pull request as fields, so the rating never has to read words.
-// Only the dispatch flight passes them, in its own process; `atris task release`
+// Only the flights pass them, in their own process; `atris task release`
 // takes neither, so a worker cannot excuse its own miss with a flag. The two go
-// together or not at all; half a marker leaves the claim held.
+// together or not at all; half a marker leaves the claim held. One kind goes
+// alone: could_not_start, for a claim let go before the engine ran, takes no
+// pull request and is refused with one.
 const RELEASE_REASON_MAX = 300;
 
 function releaseMarker(kind, pullRequest) {
   const named = kind !== undefined && kind !== null && String(kind).trim() !== '';
   if (!named && !pullRequest) return { marker: null };
+  if (named && String(kind).trim() === COULD_NOT_START && !pullRequest) return { marker: { kind: COULD_NOT_START } };
   const open = cleanOpenPullRequest(pullRequest);
   if (!named || String(kind).trim() !== PROOF_NOT_SAVED || !open) return { invalid: true };
   return { marker: { kind: PROOF_NOT_SAVED, pull_request: open } };
 }
 
-function releaseTask(db, { id, actor, expectedUpdatedAt, reason, kind, pullRequest }) {
+// The claim a job is held under now: its latest claimed event. The event id names that one claim, so a
+// flight that remembers it can tell later whether the job is still held under the claim it made, or was
+// let go and claimed again, even under the same builder name.
+function latestClaim(db, id) {
+  return db.prepare("SELECT event_id, version, actor, created_at FROM task_events WHERE task_id = ? AND event_type = 'claimed' ORDER BY version DESC LIMIT 1").get(id) || null;
+}
+
+// True when the claim event the caller names is the claim the job is held under now. claimTask writes the row and
+// its claimed event in one transaction, so here the two always agree. A claim saved by an older CLI wrote the row
+// first and its event a moment later, and in that gap the latest event is still the claim before it: an event
+// written before the row's own claim time is that older claim, not the one the row holds.
+function claimIsCurrent(row, claim, claimEventId) {
+  if (!claim || claim.event_id !== claimEventId) return false;
+  return row.claimed_at == null || Number(claim.created_at) >= Number(row.claimed_at);
+}
+
+// True when the engine was asked on the job's current claim: a build_started event sits after its latest
+// claimed event (see markBuildStarted).
+function claimMarkedStarted(db, id) {
+  const claim = latestClaim(db, id);
+  return Boolean(claim) && Boolean(db.prepare('SELECT 1 AS hit FROM task_events WHERE task_id = ? AND event_type = ? AND version > ? LIMIT 1').get(id, BUILD_STARTED, claim.version));
+}
+
+// A flight writes this right before it asks the assigned engine, on the claim it made. It is what lets the
+// store and the rating tell a claim let go before the engine ran from one let go after it: a release that
+// says could_not_start on a marked claim is an ordinary release (see releaseTask). Only the holder can mark,
+// and claimEventId, when given, names the one claim the caller made, so a run that lost its claim cannot mark
+// the next run's. Marking twice adds nothing. A refusal writes nothing.
+function markBuildStarted(db, { id, actor, claimEventId }) {
+  if (!id) throw new Error('id required');
+  if (!actor) throw new Error('actor required');
+  withBusyRetry(() => db.exec('BEGIN IMMEDIATE'));
+  try {
+    const row = getTask(db, id);
+    let result;
+    if (!row) result = { marked: false, reason: 'not_found' };
+    else if (row.status !== 'claimed') result = { marked: false, reason: `already_${row.status}`, claimed_by: row.claimed_by || null };
+    else if (row.claimed_by !== actor) result = { marked: false, reason: 'held_by_other', claimed_by: row.claimed_by || null };
+    else {
+      const claim = latestClaim(db, id);
+      if (!claim) result = { marked: false, reason: 'no_claim_event' };
+      else if (claimEventId && !claimIsCurrent(row, claim, claimEventId)) result = { marked: false, reason: 'claim_changed', claimed_by: row.claimed_by || null };
+      else if (claimMarkedStarted(db, id)) result = { marked: true, already: true };
+      else {
+        result = {
+          marked: true,
+          event: appendTaskEvent(db, {
+            taskId: id,
+            workspaceRoot: row.workspace_root,
+            actor,
+            eventType: BUILD_STARTED,
+            payload: { claimed_by: actor, claim_event_id: claim.event_id },
+          }),
+        };
+      }
+    }
+    db.exec('COMMIT');
+    return result;
+  } catch (err) { db.exec('ROLLBACK'); throw err; }
+}
+
+// claimEventId, when given, names the one claim the caller made (see latestClaim). A job that was let go
+// and claimed again since, by anyone, is not the caller's to release: nothing is written. The check is part of
+// the write itself, one statement (see NAMED_CLAIM_SQL), so a claim that lands between the caller's last look and
+// the release is refused too, and it reads the claim by its event, not by a time, which two claims can share.
+//
+// The look, the row write, and the claim_released entry are one transaction (see inWriteTransaction): a history
+// entry that cannot be written takes the release back with it, so a job is never left open with no record of how,
+// and the check cannot pass against a claim whose own entry is not in the store yet.
+//
+// The could-not-start kind checks itself. It is taken only for a claim whose engine was never asked. On a
+// claim marked started (see markBuildStarted) the release goes through as an ordinary release with no kind,
+// and is not refused, so the claim is never left held.
+function releaseTask(db, release) {
+  return inWriteTransaction(db, () => releaseTaskInTransaction(db, release));
+}
+
+function releaseTaskInTransaction(db, { id, actor, expectedUpdatedAt, reason, kind, pullRequest, claimEventId }) {
   if (!id) throw new Error('id required');
   if (!actor) throw new Error('actor required');
-  const { marker, invalid } = releaseMarker(kind, pullRequest);
+  const { marker: asked, invalid } = releaseMarker(kind, pullRequest);
   if (invalid) return { released: false, reason: 'invalid_release_marker' };
   const row = getTask(db, id);
   if (!row) return { released: false, reason: 'not_found' };
@@ -769,8 +912,10 @@ function releaseTask(db, { id, actor, expectedUpdatedAt, reason, kind, pullReque
   if (row.claimed_by !== actor) {
     return { released: false, reason: 'held_by_other', claimed_by: row.claimed_by || null };
   }
+  const marker = asked && asked.kind === COULD_NOT_START && claimMarkedStarted(db, id) ? null : asked;
   const releaseReason = compactEpisodeText(reason, RELEASE_REASON_MAX);
   const now = Date.now();
+  const named = claimEventId ? String(claimEventId) : null;
   const result = withBusyRetry(() => db.prepare(`
     UPDATE tasks
        SET status = 'open',
@@ -781,9 +926,21 @@ function releaseTask(db, { id, actor, expectedUpdatedAt, reason, kind, pullReque
      WHERE id = ?
        AND status = 'claimed'
        AND claimed_by = ?
+       AND claimed_at IS ?
        AND (? IS NULL OR updated_at = ?)
-  `).run(now, id, actor, expectedUpdatedAt ?? null, expectedUpdatedAt ?? null));
-  if (result.changes !== 1) return { released: false, reason: 'stale_task_state', claimed_by: row.claimed_by || null };
+       ${NAMED_CLAIM_SQL}
+  `).run(now, id, actor, row.claimed_at ?? null, expectedUpdatedAt ?? null, expectedUpdatedAt ?? null, named, named));
+  if (result.changes !== 1) {
+    // The job changed between the look and the write. A caller that named its claim is told what the job is now.
+    if (named) {
+      const current = getTask(db, id);
+      if (!current) return { released: false, reason: 'not_found' };
+      if (current.status !== 'claimed') return { released: false, reason: `already_${current.status}`, claimed_by: current.claimed_by || null };
+      if (current.claimed_by !== actor) return { released: false, reason: 'held_by_other', claimed_by: current.claimed_by || null };
+      if (!claimIsCurrent(current, latestClaim(db, id), named)) return { released: false, reason: 'claim_changed', claimed_by: current.claimed_by || null };
+    }
+    return { released: false, reason: 'stale_task_state', claimed_by: row.claimed_by || null };
+  }
   const updated = getTask(db, id);
   const event = appendTaskEvent(db, {
     taskId: id,
@@ -2584,6 +2741,8 @@ module.exports = {
   previewExpiredLeases,
   sweepExpiredLeases,
   releaseTask,
+  latestClaim,
+  markBuildStarted,
   reopenTask,
   backlogTask,
   clearPlanTasks,

package/lib/worktree-space.js

@@ -26,8 +26,6 @@ const GB = 1e9;
 // fail (swap, updates, builds), so start refuses to add another copy.
 const DEFAULT_REAP_BELOW_GB = 25;
 const DEFAULT_REFUSE_BELOW_GB = 10;
-const DEPS_CACHE_KEEP = 3;
-const PARTIAL_MAX_AGE_MS = 60 * 60 * 1000;
 const AGENT_COPIES_DIR = '.agent-worktrees';
 const DEPS_DIR = '.deps';
 const CLONE_TIMEOUT_MS = 10 * 60 * 1000;
@@ -224,6 +222,8 @@ function ensureCachedInstall({ workspace, repoName, hash, lockFile, sourceDir, c
   const entry = depsCacheEntry(workspace, repoName, hash);
   const cached = path.join(entry, 'node_modules');
   if (installedMatchesLock(lockFile, cached)) return cached;
+  // A mismatched existing entry may contain local changes. Do not replace it.
+  if (pathExists(entry)) return null;
   if (!sourceDir || !installedMatchesLock(lockFile, sourceDir)) return null;
   const partial = path.join(depsRepoDir(workspace, repoName), `.partial-${hash}-${process.pid}-${Date.now()}`);
   try {
@@ -233,8 +233,6 @@ function ensureCachedInstall({ workspace, repoName, hash, lockFile, sourceDir, c
     // Build caches are not part of the install and only grow the store.
     removeTree(path.join(partial, 'node_modules', '.cache'));
     if (!installedMatchesLock(lockFile, path.join(partial, 'node_modules'))) return null;
-    // An entry that no longer matches its own lockfile was changed by hand.
-    if (pathExists(entry) && !installedMatchesLock(lockFile, cached)) removeTree(entry);
     try {
       fs.renameSync(partial, entry);
     } catch {
@@ -253,49 +251,12 @@ function touch(target) {
   } catch {}
 }
 
-// Keeps the `keep` most recently used installs per repo and drops partial
-// entries a crashed start left behind.
-function pruneDepsCache({ workspace, repoName, keep = DEPS_CACHE_KEEP, now = Date.now() } = {}) {
-  const dir = depsRepoDir(workspace, repoName);
-  let names = [];
-  try {
-    names = fs.readdirSync(dir);
-  } catch {
-    return [];
-  }
-  const removed = [];
-  const entries = [];
-  for (const name of names) {
-    const full = path.join(dir, name);
-    let mtimeMs = 0;
-    try {
-      mtimeMs = fs.statSync(full).mtimeMs;
-    } catch {
-      continue;
-    }
-    if (name.startsWith('.partial-')) {
-      if (now - mtimeMs > PARTIAL_MAX_AGE_MS) {
-        removeTree(full);
-        removed.push(full);
-      }
-      continue;
-    }
-    if (!name.startsWith('.')) entries.push({ full, mtimeMs });
-  }
-  entries.sort((a, b) => b.mtimeMs - a.mtimeMs);
-  for (const old of entries.slice(keep)) {
-    removeTree(old.full);
-    removed.push(old.full);
-  }
-  return removed;
-}
-
 // Gives a new build copy its node_modules as a clone of a matching install,
 // so the agent skips `npm ci`. Looks in the shared store first, then in the
 // main checkout and other copies of the same repo. Never fails the start:
 // any miss returns { status: 'skipped', reason } and the agent installs as
 // before.
-function seedNodeModules({ target, workspace, repoName, sources = [], clone = cloneTree, keep = DEPS_CACHE_KEEP, isIgnored = () => true } = {}) {
+function seedNodeModules({ target, workspace, repoName, sources = [], clone = cloneTree, isIgnored = () => true } = {}) {
   const startedAt = Date.now();
   const result = (status, reason, extra = {}) => ({ status, reason, ms: Date.now() - startedAt, ...extra });
   const lockFile = path.join(target, 'package-lock.json');
@@ -327,14 +288,13 @@ function seedNodeModules({ target, workspace, repoName, sources = [], clone = cl
     }
   }
   if (!cached) return result('skipped', 'no matching install to clone yet; run npm ci, and later copies will clone it', { hash });
-  // Mark the entry used before cloning so a parallel prune keeps it.
+  // Record use of the entry before cloning it.
   touch(path.dirname(cached));
   const cloned = clone(cached, modules);
   if (!cloned.ok || !installedMatchesLock(lockFile, modules)) {
     removeTree(modules);
     return result('skipped', `clone failed: ${cloned.error || 'install did not match after cloning'}`, { hash });
   }
-  pruneDepsCache({ workspace, repoName, keep });
   return result('cloned', '', { hash, method: cloned.method, source: cached });
 }
 
@@ -351,7 +311,6 @@ module.exports = {
   isInside,
   isScratchPath,
   lockHash,
-  pruneDepsCache,
   seedNodeModules,
   spaceLimits,
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "atris",
-  "version": "3.74.28",
+  "version": "3.75.0",
   "description": "you say what you want in plain words. atris builds it, checks it, and shows you proof.",
   "mcpName": "io.github.atrislabs/atris",
   "main": "bin/atris.js",