muse-crew 0.7.3 → 0.7.5

package/API.md

@@ -194,7 +194,7 @@ Record that a poll tick occurred. Takes no arguments. Used by the dispatcher at
 
 Create a dispatch reservation for a task. Called by the dispatcher workflow BEFORE the worker launches the workflow — the reservation is the atomic claim on the task.
 
-**Atomic:** Uses `INSERT ... ON CONFLICT DO NOTHING`. Returns `acquired: true` if this call created the reservation, `acquired: false` if one already exists. The dispatcher only recommends tasks where `acquired` is true — fail closed on contention.
+**Atomic:** Uses `INSERT ... ON CONFLICT DO UPDATE` with a reclaim guard. Returns `acquired: true` if this call created the reservation OR reclaimed an expired one (the existing row is overwritten only when its `expires_at` is past — no separate reaper, no window where a dead row blocks redispatch). Returns `acquired: false` if a live reservation already exists — the competing dispatcher fails closed. Reclaiming is safe: workflows clear their reservation on self-claim, so an expired row always means the launch died before claiming. The dispatcher only recommends tasks where `acquired` is true — fail closed on contention.
 
 | Field | Type | Notes |
 |-------|------|-------|
@@ -214,7 +214,7 @@ Update a dispatch reservation with the real platform workflow run ID. Called by
 | `task_id` | string | Required. The task that was dispatched. |
 | `run_id` | string | Required. The real platform run ID (e.g. `workflow-run-xxx`). Must not be `"pending-dispatch"`. |
 
-Fails closed: throws if no reservation exists for the task (launching without a reservation is forbidden). Returns `{ ok: true, task_id, run_id }`.
+Fails closed: throws if no reservation exists for the task (launching without a reservation is forbidden). Also records a durable platform run -> task mapping (`platform_run_tasks`) — the worker is the only party that ever knows both IDs at once, and the poll loop's platform-failure monitor resolves the task through this mapping, so a dead run is requeued on the next tick instead of waiting out the zombie-session sweep. Returns `{ ok: true, task_id, run_id }`.
 
 ### `clear-reservation`
 
@@ -295,7 +295,7 @@ The platform records workflow run status in `runtime.workflow_runs` — separate
 
 ### `record-platform-failure`
 
-Record a platform workflow run failure. Correlates with a crew telemetry run by timestamp proximity (±60s) if `crew_run_id` is not provided.
+Record a platform workflow run failure. Correlates the task in this order: (1) the durable `platform_run_tasks` mapping written by `acknowledge-dispatch-run`, (2) timestamp proximity (±60s) between `platform_created_at` and crew telemetry launch time (fallback for runs launched before the mapping existed), (3) an explicit `crew_run_id`/`task_id` when provided. A failure that correlates to no task is kept with `task_id: null` and reported as skipped by retry.
 
 | Field | Type | Notes |
 |-------|------|-------|
@@ -324,6 +324,8 @@ Returns `{ ok: true, failures: [...] }`.
 
 Retry a task whose workflow died on a platform failure. Clears the stale reservation, re-queues the task to `todo`, and increments the retry count. If `retry_count` >= `max_retries` (default 3), parks the task instead.
 
+**Supersede guard:** if a newer platform run has been linked for this task since this failure's run, the task is already owned by the successor — the retry is skipped instead of clobbering live work (a late detection of an old dead run never resets a redispatched task).
+
 | Field | Type | Notes |
 |-------|------|-------|
 | `platform_run_id` | string | Required. |

package/lib/crew-api.js

@@ -582,16 +582,24 @@ commands["reserve-dispatch"] = (db, args) => {
   const ttl = Math.max(60, Math.min(3600, Number(args.ttl_seconds) || 900));
   const dispatchedAt = now();
   const expiresAt = new Date(Date.now() + ttl * 1000).toISOString();
-  // ATOMIC: INSERT with ON CONFLICT DO NOTHING. If a reservation already
-  // exists (even expired — cleanup is separate), we do NOT overwrite it.
-  // The caller must check `acquired` and fail closed if false.
-  // This prevents the last-write-wins race where two dispatchers both
-  // think they own the task.
+  // ATOMIC RECLAIM (2026-09-13): an expired reservation row is reclaimed by
+  // overwriting it inside the same UPSERT — no separate reaper, no window
+  // where a dead row blocks redispatch. A LIVE reservation still wins the
+  // race: the WHERE clause rejects the overwrite and `acquired` stays false,
+  // so the caller fails closed exactly as before.
+  // Safe to reclaim: workflows clear their reservation on self-claim, so an
+  // expired row always means the launch died before claiming — reclaiming it
+  // can never duplicate a running workflow.
   const info = db.prepare(
     `INSERT INTO dispatch_reservations (task_id, run_id, workflow, dispatched_at, expires_at)
      VALUES (?, ?, ?, ?, ?)
-     ON CONFLICT(task_id) DO NOTHING`
-  ).run(args.task_id, args.run_id, args.workflow, dispatchedAt, expiresAt);
+     ON CONFLICT(task_id) DO UPDATE SET
+       run_id = excluded.run_id,
+       workflow = excluded.workflow,
+       dispatched_at = excluded.dispatched_at,
+       expires_at = excluded.expires_at
+     WHERE dispatch_reservations.expires_at <= ?`
+  ).run(args.task_id, args.run_id, args.workflow, dispatchedAt, expiresAt, now());
   const acquired = info.changes > 0;
   return {
     ok: true,
@@ -620,6 +628,17 @@ commands["acknowledge-dispatch-run"] = (db, args) => {
   if (info.changes === 0) {
     throw usageError("no reservation exists for task_id — launch without reservation is forbidden.");
   }
+  // Durable platform run -> task mapping (2026-09-13): the worker is the only
+  // party that ever knows both IDs at once. record-platform-failure resolves
+  // the task through this mapping instead of timestamp proximity, so a dead
+  // platform run is requeued on the next tick instead of waiting out the
+  // 1-hour zombie-session sweep.
+  db.prepare(
+    `INSERT INTO platform_run_tasks (platform_run_id, task_id)
+     VALUES (?, ?)
+     ON CONFLICT(platform_run_id) DO UPDATE SET
+       task_id = excluded.task_id, linked_at = datetime('now')`
+  ).run(args.run_id, args.task_id);
   return { ok: true, task_id: args.task_id, run_id: args.run_id };
 };
 
@@ -727,11 +746,19 @@ commands["record-platform-failure"] = (db, args) => {
   if (!args.platform_run_id) throw usageError("platform_run_id is required.");
   if (!args.error_message) throw usageError("error_message is required.");
   if (!args.platform_created_at) throw usageError("platform_created_at is required.");
-  // Try to correlate with a crew telemetry run by timestamp proximity (±60s).
-  // The workflow doesn't know its platform run_id, so we match on launch time.
+  // Correlate with a crew task. First the durable platform_run_tasks mapping
+  // (written by acknowledge-dispatch-run — the worker is the only party that
+  // ever knows both IDs at once). Timestamp proximity is the fallback for
+  // runs launched before the mapping existed.
   let crewRunId = args.crew_run_id || null;
   let taskId = args.task_id || null;
   let workflow = args.workflow || null;
+  if (!taskId) {
+    const link = db.prepare(
+      "SELECT task_id FROM platform_run_tasks WHERE platform_run_id = ?"
+    ).get(args.platform_run_id);
+    if (link) taskId = link.task_id;
+  }
   if (!crewRunId) {
     const match = db.prepare(
       `SELECT run_id, task_id, workflow FROM workflow_runs
@@ -795,6 +822,25 @@ commands["retry-platform-failure"] = (db, args) => {
   if (!failure.task_id) {
     return { ok: true, action: "skipped", reason: "no task correlated" };
   }
+  // Supersede guard: if a newer platform run was linked for this task after
+  // this failure's run, the task is already owned by the newer run —
+  // requeueing here would clobber live work. Skip instead of retrying.
+  // (Without this, a late Step-0 detection of an old dead run could reset a
+  // task its successor is already working.)
+  const myLink = db.prepare(
+    "SELECT linked_at, rowid AS rid FROM platform_run_tasks WHERE platform_run_id = ?"
+  ).get(args.platform_run_id);
+  if (myLink) {
+    const newer = db.prepare(
+      `SELECT platform_run_id FROM platform_run_tasks
+       WHERE task_id = ? AND platform_run_id != ?
+         AND (linked_at > ? OR (linked_at = ? AND rowid > ?))
+       ORDER BY linked_at DESC, rowid DESC LIMIT 1`
+    ).get(failure.task_id, args.platform_run_id, myLink.linked_at, myLink.linked_at, myLink.rid);
+    if (newer) {
+      return { ok: true, action: "skipped", reason: "superseded by newer run " + newer.platform_run_id };
+    }
+  }
   if (failure.retry_count >= maxRetries) {
     // Park the task — transient failures are not resolving.
     const task = db.prepare("SELECT * FROM tasks WHERE id = ?").get(failure.task_id);

package/lib/schema.sql

@@ -161,3 +161,14 @@ CREATE TABLE IF NOT EXISTS platform_run_failures (
 );
 CREATE INDEX IF NOT EXISTS platform_run_failures_task_id_idx ON platform_run_failures(task_id);
 CREATE INDEX IF NOT EXISTS platform_run_failures_detected_at_idx ON platform_run_failures(detected_at);
+
+-- Durable platform run -> task mapping (2026-09-13). The poll worker is the
+-- only party that ever knows both IDs at once, so acknowledge-dispatch-run
+-- records the pairing here. record-platform-failure resolves the task through
+-- this mapping; the old timestamp-proximity match is a fallback only.
+CREATE TABLE IF NOT EXISTS platform_run_tasks (
+  platform_run_id TEXT PRIMARY KEY,
+  task_id         TEXT NOT NULL REFERENCES tasks(id) ON DELETE CASCADE,
+  linked_at       TEXT NOT NULL DEFAULT (datetime('now'))
+);
+CREATE INDEX IF NOT EXISTS platform_run_tasks_task_id_idx ON platform_run_tasks(task_id);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "muse-crew",
-  "version": "0.7.3",
+  "version": "0.7.5",
   "description": "Opinionated orchestration for Muse — workflows, identities, and tooling for autonomous software development.",
   "license": "UNLICENSED",
   "private": false,

package/workflows/crew-dispatch.js

@@ -141,6 +141,54 @@ function parseBoardJson(boardReturn) {
   );
 }
 
+// Deterministic JSON extraction (2026-09-13): an agent ferrying CLI stdout
+// sometimes wraps it in framing text ("Here is the output:\n{...}") instead
+// of returning it verbatim. A bare JSON.parse then throws and the dispatcher
+// drops a reservation it actually acquired — a lost tick, and (before the
+// atomic reclaim above) a stale row that blocked redispatch permanently.
+// This extractor is mechanical, not interpretive: verbatim parse first,
+// then scan for the first balanced {...} candidate that parses. Throws only
+// when no parseable object exists — the caller fails closed.
+function extractJsonObject(raw) {
+  if (raw !== null && typeof raw === "object") return raw;
+  if (typeof raw !== "string") {
+    throw new Error("extractJsonObject: expected a string or object, got " +
+      (raw === null ? "null" : typeof raw));
+  }
+  try { return JSON.parse(raw.trim()); } catch (e) { /* fall through to scan */ }
+  var start = raw.indexOf("{");
+  while (start !== -1) {
+    var end = matchJsonBrace(raw, start);
+    if (end !== -1) {
+      try { return JSON.parse(raw.slice(start, end + 1)); } catch (e2) { /* keep scanning */ }
+    }
+    start = raw.indexOf("{", start + 1);
+  }
+  throw new Error("extractJsonObject: no parseable JSON object found in agent output");
+}
+
+// Balanced-brace scan honoring string literals and escapes. Returns the
+// index of the brace matching the open brace at `start`, or -1.
+function matchJsonBrace(s, start) {
+  var depth = 0, inStr = false, esc = false;
+  for (var i = start; i < s.length; i++) {
+    var ch = s[i];
+    if (inStr) {
+      if (esc) esc = false;
+      else if (ch === "\\") esc = true;
+      else if (ch === "\"") inStr = false;
+    } else if (ch === "\"") {
+      inStr = true;
+    } else if (ch === "{") {
+      depth++;
+    } else if (ch === "}") {
+      depth--;
+      if (depth === 0) return i;
+    }
+  }
+  return -1;
+}
+
 // Deterministic board projection — the ONLY place task records are shaped.
 // Pure function, no I/O: covered by tests/board-projection.test.js. The
 // retry field is dashboard-owned state (consecutive failures / rejections
@@ -829,7 +877,7 @@ if (recommended.length > 0) {
         "Create a dispatch reservation.\nRun in shell and return the stdout verbatim:\n" + reserveCmd,
         { key: "reserve-" + rec.task_id.slice(0, 8), label: "Reserving dispatch for " + rec.task_id.slice(0, 8) }
       );
-      var reserveParsed = typeof reserveOut === "string" ? JSON.parse(reserveOut) : reserveOut;
+      var reserveParsed = extractJsonObject(reserveOut);
       if (reserveParsed && reserveParsed.acquired) {
         log("Reserved task " + rec.task_id.slice(0, 8));
         acquired.push(rec);
@@ -838,8 +886,10 @@ if (recommended.length > 0) {
         log("SKIPPED task " + rec.task_id.slice(0, 8) + " — reservation not acquired (another dispatcher owns it)");
       }
     } catch (e) {
-      // FAIL CLOSED: If we cannot reserve, we cannot safely recommend.
-      // The task stays eligible for the next poll.
+      // FAIL CLOSED: If we cannot reserve — or cannot deterministically read
+      // the reservation result — we cannot safely recommend. The task stays
+      // eligible; a row created before the parse failure expires via TTL and
+      // is reclaimable by the next tick (atomic reclaim in reserve-dispatch).
       log("SKIPPED task " + rec.task_id.slice(0, 8) + " — reservation failed: " + e.message);
     }
   }