omp-conductor 0.18.1 → 0.19.0

package/src/escalate.ts

@@ -1040,13 +1040,14 @@ export interface TelegramPlumbingProbe {
 }
 
 /**
- * The session surface the arm waiter actually scans for the challenge reply:
- * {@link armTicks} polls every `.jsonl` transcript *directly inside* these
- * directories — the tick-cwd-derived session directory plus, when the
- * project's claim names a session file elsewhere, that file's directory. The
- * recipient of the reply (a claim's, the DM owner's, or the local poll
- * owner's session file) must land in this set, or the reply can never satisfy
- * the challenge even though inbound works.
+ * The transcript-surface input for {@link telegramPlumbingVerdict}'s session
+ * identity checks: the directories the claim-only proof judges recipients
+ * against (a claim's, the DM owner's, or the local poll owner's session file
+ * must land inside, or a flat reply could land where no challenge would have
+ * looked). Since #614 the *challenge* proof reads conductor acknowledgement
+ * state and never opens a transcript, so callers judging challenge-mode
+ * plumbing omit this — passing it there could report arming impossible while
+ * `arm` succeeds.
  */
 export type TelegramPlumbingScan = { dirs: readonly string[] };
 
@@ -1074,7 +1075,7 @@ export type TelegramPlumbingScan = { dirs: readonly string[] };
  */
 export function telegramPlumbingVerdict(
   sendTopic: number | undefined,
-  scan: TelegramPlumbingScan,
+  scan: TelegramPlumbingScan | undefined,
   probe: TelegramPlumbingProbe,
 ): TelegramPlumbingVerdict {
   const { registry, poll, dmOwner, channel, alive, lockAlive, fresh } = probe;
@@ -1085,14 +1086,21 @@ export function telegramPlumbingVerdict(
     const claim = registry.claims.find((c) => c.threadId === sendTopic);
     if (claim === undefined) return { ok: false, reason: "no-topic-claim" };
     if (claim.pid === undefined || !alive(claim.pid)) return { ok: false, reason: "claim-dead" };
-    if (claim.sessionFile !== undefined && !sessionWithinScan(claim.sessionFile, scan.dirs)) {
+    if (
+      scan !== undefined &&
+      claim.sessionFile !== undefined &&
+      !sessionWithinScan(claim.sessionFile, scan.dirs)
+    ) {
       return { ok: false, reason: "claim-session-outside" };
     }
     recipient = "claim";
   } else {
     if (dmOwner.kind === "ok") {
       if (dmOwner.owner.pid === undefined || !alive(dmOwner.owner.pid)) return { ok: false, reason: "dm-owner-dead" };
-      if (dmOwner.owner.sessionFile === undefined || !sessionWithinScan(dmOwner.owner.sessionFile, scan.dirs)) {
+      if (
+        scan !== undefined &&
+        (dmOwner.owner.sessionFile === undefined || !sessionWithinScan(dmOwner.owner.sessionFile, scan.dirs))
+      ) {
         return { ok: false, reason: "dm-owner-unrelated" };
       }
       recipient = "dm-owner";
@@ -1102,7 +1110,10 @@ export function telegramPlumbingVerdict(
       // record must name that session. A daemon-only or unrelated owner is no
       // recipient: the reply would land in a transcript arm never scans.
       if (poll.kind !== "ok") return { ok: false, reason: "no-dm-owner" };
-      if (poll.owner.sessionFile === undefined || !sessionWithinScan(poll.owner.sessionFile, scan.dirs)) {
+      if (
+        scan !== undefined &&
+        (poll.owner.sessionFile === undefined || !sessionWithinScan(poll.owner.sessionFile, scan.dirs))
+      ) {
         return { ok: false, reason: "no-dm-owner" };
       }
       recipient = "poller";

package/src/failure-class.ts

@@ -103,6 +103,23 @@ export function infraLogSignature(log: string): string | undefined {
   return INFRA_LOG_SIGNATURES.find((signature) => lower.includes(signature));
 }
 
+/**
+ * The cap kills that produced nothing: the worker reached a ceiling with no PR,
+ * no observed head and no salvage commit.
+ *
+ * Named here — beside the table that assigns them — because two callers need
+ * exactly the same set and neither may guess at it: the escalate recovery
+ * quotes the transcript's last tool calls for these classes, and the one-shot
+ * model escalation (#807) fires only for these. Their `-progress` siblings are
+ * deliberately absent: a cap kill *with* work to continue from is a
+ * decomposition verdict, and retrying it on a stronger tier would hide an
+ * oversized slice behind a capability problem.
+ */
+export const SPINNING_CAP_CLASSES: readonly FailureClass[] = [
+  "turn-cap-spinning",
+  "wall-clock-cap-spinning",
+];
+
 /**
  * A stable fingerprint of the infrastructure signature list (#638). The
  * historical reconciliation persists a per-project review cursor stamped with
@@ -315,6 +332,48 @@ export function dispatchInfra(
 // front of the thrown message, so a bare /^git / would never match a real row.
 const DISPATCH_GIT_ERROR = /^(?:Error: )?git .+ exited \d+/s;
 
+/**
+ * Evidence that one review round's resumed session never got as far as a turn,
+ * or `undefined` when the round actually ran (#903).
+ *
+ * The measurement is the round's OWN session, never the run row's cumulative
+ * counters: a revision reuses its run, so `run.turns` already carries every
+ * turn the original attempt spent and would never read zero.
+ *
+ * Deliberately wider than {@link neverStarted}: any zero-turn round that
+ * produced nothing counts, whatever the error text says. The reference
+ * incident is why. During the 2026-08-21/22 worker-UID outage every revision
+ * dispatch died at turn 0 on `EACCES .../config.yml` — an error string no
+ * signature list contained — and each death still consumed one of the PR's
+ * three review rounds, until the ceiling refused any further round and the PR
+ * could not be finished at all. The discriminator that matters is "did the
+ * resumed session take a turn", not which errno the host produced; matching on
+ * errno text is how the next outage spells its failure differently and lands
+ * back in the same deadlock.
+ *
+ * Two things keep the widening honest, and both are the caller's:
+ *  - it decides only whether a round is CHARGED, never whether a run is
+ *    classified — run-level classification is untouched, so an unrecognised
+ *    turn-0 run still reads `unknown` and still spends its attempt;
+ *  - a retried round is bounded by {@link REVIEW_ROUND_INFRA_MAX_RETRIES}, so
+ *    a permanently broken host escalates instead of retrying forever.
+ *
+ * A round that produced a PR, a head or a salvage did work no matter what its
+ * turn counter says, and is never this.
+ */
+export function reviewRoundNeverWorked(round: {
+  turns: number;
+  prUrl?: string;
+  headSha?: string;
+  salvageSha?: string;
+}): string | undefined {
+  if (round.turns !== 0) return undefined;
+  if (round.prUrl !== undefined || round.headSha !== undefined || round.salvageSha !== undefined) {
+    return undefined;
+  }
+  return "the resumed session never took a turn: no turn, no commit and no pushed head";
+}
+
 /** The prefix the draining/restarting process writes to a run it killed. */
 const ADMIN_RESTART_MARKER = "admin restart:";