omp-conductor 0.17.1 → 0.18.0

package/src/orchestrator-tick.ts

@@ -103,7 +103,7 @@ import {
   type AskResult,
 } from "./ask.ts";
 import { deliverOperatorMessage } from "./reports.ts";
-import type { ProjectConfig, RecoveryAction, RunRecord } from "./types.ts";
+import type { FailureClass, ProjectConfig, RecoveryAction, RunRecord } from "./types.ts";
 import { dbPath, openStore } from "./store.ts";
 import { digestDue, localDayKey } from "./digest-schedule.ts";
 import { heldNoticeId } from "./notices.ts";
@@ -499,11 +499,47 @@ const AUTONOMOUS_RECOVERY_ACTIONS: Record<RecoveryAction, boolean> = {
   none: false,
 };
 
-/** Bounded name-and-count summary shared by the two recovered-row groups. */
-function recoveredSummary(group: readonly RunRecord[]): string {
+/** The failure-class family that names a turns/wall-clock cap kill. Only these
+ *  rows carry an ordinal: a second cap kill is a decomposition verdict rather
+ *  than a retry candidate, so the prompt must say which attempt it was without
+ *  the orchestrator re-querying the runs table (#711). */
+const CAP_KILL_CLASSES: Record<string, true> = {
+  "turn-cap-progress": true,
+  "turn-cap-spinning": true,
+  "wall-clock-cap-progress": true,
+  "wall-clock-cap-spinning": true,
+};
+
+/** Issue-history lookups answering the two questions about a recovered row:
+ *  has the issue moved on since that row, and how many attempts has it spent.
+ *  Lazy callbacks so the tick can hand the store straight through and the
+ *  digest only pays for the rows it actually reports.
+ */
+export interface RecoveryDigestContext {
+  /** Every attempt of the issue, oldest first — exactly what
+   *  `Store.runsForIssue` returns. The recovered row itself is among the
+   *  answers, so "has the issue moved on" is "is the last element this row". */
+  runsForIssue(issue: number): readonly RunRecord[];
+}
+
+/** Bounded name-and-count summary shared by the two recovered-row groups. A
+ *  cap-kill row also names which attempt it was of the issue's total, taken
+ *  from the issue's own attempt history — never from its position in this
+ *  digest's list (#711).
+ */
+function recoveredSummary(
+  group: readonly RunRecord[],
+  runsForIssue: (issue: number) => readonly RunRecord[],
+): string {
   const named = group
     .slice(0, 5)
-    .map((r) => `${r.failureClass ?? "unknown"} #${r.issue}`)
+    .map((r) => {
+      const label = `${r.failureClass ?? "unknown"} #${r.issue}`;
+      if (r.failureClass === undefined || CAP_KILL_CLASSES[r.failureClass] !== true) return label;
+      const attempts = runsForIssue(r.issue).length;
+      if (attempts === 0) return label;
+      return `${label} (attempt ${r.attempt} of ${attempts})`;
+    })
     .join(", ");
   const rest = group.length > 5 ? `, +${group.length - 5} more` : "";
   return `${group.length} (${named}${rest})`;
@@ -515,12 +551,42 @@ function recoveredSummary(group: readonly RunRecord[]): string {
  * The orchestrator used to write this paragraph by re-deriving it from the run
  * rows every tick. Undefined when nothing was recovered: a line reading "0" is
  * one nobody reads on the day it says 4.
+ *
+ * With {@link RecoveryDigestContext} supplied, a recovered row whose issue has
+ * since gained a newer run — live, pushed-green, or settled to any terminal
+ * state — is history, not news, and is dropped before rendering, so a finished
+ * recovery is never re-reported as this tick's own (#711).
  */
-export function recoveryDigestLine(recovered: readonly RunRecord[]): string | undefined {
+export function recoveryDigestLine(
+  recovered: readonly RunRecord[],
+  ctx?: RecoveryDigestContext,
+): string | undefined {
   if (recovered.length === 0) return undefined;
+  // Memoized per issue: a window can hold two recovered attempts of one issue,
+  // and each row must not re-query the store for the same history.
+  const runsByIssue = new Map<number, readonly RunRecord[]>();
+  const runsForIssue = (issue: number): readonly RunRecord[] => {
+    let runs = runsByIssue.get(issue);
+    if (runs === undefined) {
+      runs = ctx?.runsForIssue(issue) ?? [];
+      runsByIssue.set(issue, runs);
+    }
+    return runs;
+  };
+  const fresh =
+    ctx === undefined
+      ? recovered
+      : recovered.filter((r) => {
+          const runs = runsForIssue(r.issue);
+          // The recovered row is still its issue's newest attempt. Any newer
+          // run means the issue moved on after this row recovered.
+          const latest = runs[runs.length - 1];
+          return latest === undefined || latest.id === r.id;
+        });
+  if (fresh.length === 0) return undefined;
   const handled: RunRecord[] = [];
   const triage: RunRecord[] = [];
-  for (const r of recovered) {
+  for (const r of fresh) {
     if (r.recoveryAction !== undefined && AUTONOMOUS_RECOVERY_ACTIONS[r.recoveryAction]) {
       handled.push(r);
     } else {
@@ -529,10 +595,10 @@ export function recoveryDigestLine(recovered: readonly RunRecord[]): string | un
   }
   const lines: string[] = [];
   if (handled.length > 0) {
-    lines.push(`Auto-recovered since last tick: ${recoveredSummary(handled)} — already handled, do not re-triage these.`);
+    lines.push(`Auto-recovered since last tick: ${recoveredSummary(handled, runsForIssue)} — already handled, do not re-triage these.`);
   }
   if (triage.length > 0) {
-    lines.push(`Recovered but needs Duty 1 triage: ${recoveredSummary(triage)} — inspect these runs.`);
+    lines.push(`Recovered but needs Duty 1 triage: ${recoveredSummary(triage, runsForIssue)} — inspect these runs.`);
   }
   return lines.join("\n");
 }
@@ -560,10 +626,26 @@ export function queueDigestLine(
     const unroutable = summary.holds
       .filter((h) => h.reason.startsWith("unroutable:"))
       .reduce((n, h) => n + h.count, 0);
-    if (unroutable === 0) {
-      return `Queue: ${summary.ready} ready, 0 spare — ${claimed} in flight. Spare depth is what dispatch can actually claim: groom the backlog (Duty 2) before the live runs settle.`;
+    // A residual lifecycle label — a settled run whose state label was never
+    // cleared — is neither spare nor in flight, and `claimed` counts only
+    // live/settling ownership, so name it as Duty 1 reconciliation work rather
+    // than folding it into the grooming instruction (#611).
+    const staleLifecycle = summary.holds
+      .filter((h) => h.reason === "stale-lifecycle")
+      .reduce((n, h) => n + h.count, 0);
+    let line = `Queue: ${summary.ready} ready, 0 spare — ${claimed} in flight`;
+    if (unroutable > 0) {
+      line += `, ${unroutable} unroutable (each unroutable issue needs exactly one "${labelPrefix}<repo>" label)`;
+    }
+    if (staleLifecycle > 0) {
+      line += `, ${staleLifecycle} with a residual lifecycle label (Duty 1: newest run terminal — reconcile the stale agent:in-progress/blocked/failed state)`;
     }
-    return `Queue: ${summary.ready} ready, 0 spare — ${claimed} in flight, ${unroutable} unroutable (each unroutable issue needs exactly one "${labelPrefix}<repo>" label).`;
+    if (unroutable === 0 && staleLifecycle === 0) {
+      line += `. Spare depth is what dispatch can actually claim: groom the backlog (Duty 2) before the live runs settle.`;
+    } else {
+      line += ".";
+    }
+    return line;
   }
   if (summary.routed >= groomBelow) return undefined;
   let line = `Queue: running low — ${summary.routed} routable candidate(s), below the grooming trigger of ${groomBelow}.`;
@@ -2497,8 +2579,18 @@ async function tick(pi: TickApi, ctx: TickContext, config: TickConfig, session:
         // What the daemon already fixed, so the session stops re-deriving that
         // paragraph on every tick (#132). Two intervals wide rather than one: a
         // tick that ran long must not drop the window it was meant to report.
+        // The issue history answers which of those rows are still news: a
+        // recovery whose issue has since moved on is dropped inside the digest
+        // (#711). The project name and store are captured consts so the lookup
+        // callback keeps the flow narrowing the direct calls in this block rely
+        // on.
+        const projectName = scope.projectName;
+        const store = frictionStore;
         const recovered = recoveryDigestLine(
-          frictionStore.recoveredSince(scope.projectName, now - 2 * config.intervalSeconds * 1_000),
+          store.recoveredSince(projectName, now - 2 * config.intervalSeconds * 1_000),
+          {
+            runsForIssue: (issue) => store.runsForIssue(projectName, issue),
+          },
         );
         if (recovered !== undefined) content = `${content}\n${recovered}`;
         // The dispatch pass already persists the numbers that answer "is the

package/src/routing.ts

@@ -39,7 +39,10 @@ export type Unroutable = {
 const MAX_BRANCH_LEN = 60;
 
 /**
- * True only when a human has queued the issue and no run already owns it.
+ * True only when a human has queued the issue, no run already owns it, and
+ * the operator has not parked it. The park label beats the queue label: an
+ * issue carrying both is not eligible, because the queue listing was fetched
+ * before the park landed and must not turn into a claim (#734).
  *
  * The state labels are the interlock against double-dispatch across daemon
  * restarts: the tracker, not the local store, is the source of truth for
@@ -51,8 +54,13 @@ export function isEligible(issue: ReadyIssue, p: ProjectConfig): boolean {
   // sides here, which is the only place labels are matched.
   const labels = new Set(issue.labels);
   if (!labels.has(p.queueLabel)) return false;
-  const { inProgress, blocked, failed } = p.stateLabels;
-  return !labels.has(inProgress) && !labels.has(blocked) && !labels.has(failed);
+  const { inProgress, blocked, failed, backlog } = p.stateLabels;
+  return (
+    !labels.has(inProgress) &&
+    !labels.has(blocked) &&
+    !labels.has(failed) &&
+    !labels.has(backlog)
+  );
 }
 
 /**

package/src/session-host.ts

@@ -55,6 +55,19 @@ export interface SessionHostSpec {
    *  Carried as a plain scalar like the other fields; absent, nothing is staged
    *  on the far side either. */
   ompSettingsFile?: string;
+  /**
+   * The structured-settlement contract (#540): a JSON Schema the session's
+   * `yield` tool validates its `data` payload against. Carried as plain JSON
+   * through the spec, like everything else; absent, the far side passes nothing
+   * to the harness.
+   */
+  outputSchema?: unknown;
+  /** Enforcement policy for {@link outputSchema} — the worker contract is
+   *  `"permissive"`: a schema violation settles with whatever the worker
+   *  produced, never a lost report. */
+  outputSchemaMode?: "permissive" | "strict";
+  /** Force the hidden `yield` tool into this session's toolset (#540). */
+  requireYieldTool?: boolean;
 }
 
 /** Parent → child. */
@@ -192,6 +205,9 @@ export async function runSessionHost(
       ...(spec.verbSocketPath === undefined ? {} : { verbSocketPath: spec.verbSocketPath }),
       ...(spec.readOnly === undefined ? {} : { readOnly: spec.readOnly }),
       ...(spec.ompSettingsFile === undefined ? {} : { ompSettingsFile: spec.ompSettingsFile }),
+      ...(spec.outputSchema === undefined ? {} : { outputSchema: spec.outputSchema }),
+      ...(spec.outputSchemaMode === undefined ? {} : { outputSchemaMode: spec.outputSchemaMode }),
+      ...(spec.requireYieldTool === undefined ? {} : { requireYieldTool: spec.requireYieldTool }),
       // The release audit lives in the daemon's state directory, which this
       // process may not be able to write and must not be trusted to. It
       // becomes a message; the parent performs the durable write.