alissa-tools-github-devloop 0.6.3__tar.gz → 0.7.0__tar.gz

{alissa_tools_github_devloop-0.6.3/src/main/alissa_tools_github_devloop.egg-info → alissa_tools_github_devloop-0.7.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: alissa-tools-github-devloop
-Version: 0.6.3
+Version: 0.7.0
 Summary: ALISSA-TOOLS-GITHUB-DEVLOOP
 Home-page: https://alissa.app
 Author: Fahera

{alissa_tools_github_devloop-0.6.3 → alissa_tools_github_devloop-0.7.0}/src/main/alissa/tools/github/devloop/__main__.py

@@ -165,6 +165,32 @@ def build_parser() -> argparse.ArgumentParser:
         "never auto-resume — a dead-with-PR lane waits for an operator",
     )
 
+    rerequest = over.add_mutually_exclusive_group()
+    rerequest.add_argument(
+        "--rerequest",
+        dest="rerequest_enabled",
+        action="store_true",
+        default=None,
+        help="self-heal a PR whose fix session pushed and then died before "
+        "re-requesting review: once no worker session for it is listed and "
+        "the head has been public past the grace window, re-request review "
+        "mechanically, once per PR/round/head (the default)",
+    )
+    rerequest.add_argument(
+        "--no-rerequest",
+        dest="rerequest_enabled",
+        action="store_false",
+        help="never re-request review mechanically — a push whose session "
+        "died before its terminal act waits for an operator",
+    )
+    over.add_argument(
+        "--rerequest-grace-minutes",
+        type=int,
+        metavar="MINUTES",
+        help="how long the pushed head must have been public before the "
+        "wedge self-heal fires; 0 = use stale_minutes (the default)",
+    )
+
     claims = over.add_mutually_exclusive_group()
     claims.add_argument(
         "--activity-claims",
@@ -221,6 +247,8 @@ def overrides_from(args: argparse.Namespace) -> dict:
         "maintain_label": args.maintain_label,
         "maintain_enabled": args.maintain_enabled,
         "resume_enabled": args.resume_enabled,
+        "rerequest_enabled": args.rerequest_enabled,
+        "rerequest_grace_minutes": args.rerequest_grace_minutes,
         "activity_claims_enabled": args.activity_claims_enabled,
         "dry_run": args.dry_run,
     }
@@ -254,13 +282,15 @@ def log_effective_config(config: Config, login: str) -> None:
     log.info(
         "poll every %ss; dry_run=%s; attempt_cap=%s; stale after %s min; "
         "max_sessions=%s; fix_rounds=%s; maintain=%s (label %r); resume=%s; "
-        "activity_claims=%s",
+        "rerequest=%s (grace %s min); activity_claims=%s",
         config.poll_interval, config.dry_run, config.attempt_cap,
         config.stale_minutes,
         config.max_sessions or "unlimited",
         config.fix_rounds_enabled,
         config.maintain_enabled, config.maintain_label,
         config.resume_enabled,
+        config.rerequest_enabled,
+        config.rerequest_grace_seconds // 60,
         config.activity_claims_enabled,
     )
     log.debug("hub_template: %s", config.hub_template)

{alissa_tools_github_devloop-0.6.3 → alissa_tools_github_devloop-0.7.0}/src/main/alissa/tools/github/devloop/config.py

@@ -63,6 +63,8 @@ CONFIG_KEYS = (
     "maintain_label",
     "maintain_enabled",
     "resume_enabled",
+    "rerequest_enabled",
+    "rerequest_grace_minutes",
     "activity_claims_enabled",
     "dry_run",
 )
@@ -181,6 +183,30 @@ class Config:
     # operator who wants a dead-with-PR lane to wait for a human.
     resume_enabled: bool = True
 
+    # The wedge self-heal (issue #61): the fix edge's crash-recovery net under
+    # FIX_DIRECTIVE's terminal step. A fix session that posted its triage
+    # replies and PUSHED, then died before re-requesting review, leaves the PR
+    # in a state NEITHER daemon can exit -- revloop only sees PRs with a review
+    # requested from its identity, and the fix edge reads the push as "an
+    # implementer is already active". Rather than spawn a session, the daemon
+    # completes the dead one's protocol itself: it re-requests review from the
+    # reviewer whose verdict is being answered, exactly once per (PR, round,
+    # head). Default ON -- it closes a 3+ hour operator-only wedge (observed on
+    # fahera-mx/studio.alissa.app#242, 2026-07-27), it re-requests rather than
+    # spawns (so it can never double-drive a branch), and every side effect
+    # still honors dry_run. false restores the legacy read: the push closes the
+    # edge and a human re-requests.
+    rerequest_enabled: bool = True
+
+    # How long the pushed head must have been public before the self-heal
+    # fires. A live session re-requests SECONDS after its push, so firing on
+    # sight would race it; the window is what turns "a push exists" into "a
+    # push exists and nobody followed it up". 0 means "the fix-session stale
+    # window" (stale_minutes) -- the same clock every other presumed-dead
+    # decision on this edge is made on, and the documented default. Set a
+    # positive value to widen or narrow it independently.
+    rerequest_grace_minutes: int = 0
+
     # Cross-instance spawn dedupe (issue #53): before spawning on any edge,
     # read the trigger artifact's mechanical activity comment and treat a
     # spawn line younger than stale_minutes as an in-flight claim EVEN when
@@ -219,6 +245,15 @@ class Config:
             return default_state_path(self.workspace_root)
         return Path(self.state_path).expanduser()
 
+    @property
+    def rerequest_grace_seconds(self) -> int:
+        """How long a pushed head must have been public before the wedge
+        self-heal fires, in seconds. Read this, never the raw field: 0 is the
+        sentinel for "the fix-session stale window", so the fallback has to
+        live in ONE place or a caller reading the field directly would fire
+        the re-request instantly on a default config."""
+        return (self.rerequest_grace_minutes or self.stale_minutes) * 60
+
     @property
     def manifest_path(self) -> Path:
         return self.workspace_root / "alissa-workspace.yaml"
@@ -321,6 +356,16 @@ class Config:
                 f"max_sessions must be >= 0 (0 = unlimited), got {max_sessions}"
             )
 
+        # 0 is the sentinel for "fall back to stale_minutes" (the documented
+        # default), so the floor is 0 like max_sessions' -- a negative grace
+        # would make the self-heal fire on a head pushed in the future.
+        grace = int(raw.get("rerequest_grace_minutes", cls.rerequest_grace_minutes))
+        if grace < 0:
+            raise ValueError(
+                f"rerequest_grace_minutes must be >= 0 (0 = use stale_minutes), "
+                f"got {grace}"
+            )
+
         interval = int(raw.get("poll_interval", cls.poll_interval))
         if interval < MIN_POLL_INTERVAL:
             raise ValueError(
@@ -353,6 +398,10 @@ class Config:
             resume_enabled=bool(
                 raw.get("resume_enabled", cls.resume_enabled)
             ),
+            rerequest_enabled=bool(
+                raw.get("rerequest_enabled", cls.rerequest_enabled)
+            ),
+            rerequest_grace_minutes=grace,
             activity_claims_enabled=bool(
                 raw.get("activity_claims_enabled", cls.activity_claims_enabled)
             ),

{alissa_tools_github_devloop-0.6.3 → alissa_tools_github_devloop-0.7.0}/src/main/alissa/tools/github/devloop/ghclient.py

@@ -176,6 +176,35 @@ class IdentityMismatch(RuntimeError):
     """Configured developer identity disagrees with the gh token."""
 
 
+class ReviewRequestRejected(RuntimeError):
+    """`request_review` returned 2xx but the reviewer is not on the PR.
+
+    The `requested_reviewers` endpoint answers with the (possibly unchanged)
+    pull request, so a request GitHub declined to honour -- a reviewer without
+    read access, a login that has since been renamed, an author who cannot
+    request themselves -- can come back 2xx with nothing added. The mechanical
+    re-request leans on that field being TRUE afterwards (it is the whole
+    remedy: the reviewer daemon's only entry point is a
+    `review-requested:@me` search), so the response is checked exactly as
+    `assign_self` checks its own.
+
+    The caller's contract is escalate-don't-retry, the same one
+    AssignmentRejected gets on the issue edge and for the same reason: every
+    cause above is PERMANENT and operator-fixable, so retrying achieves
+    nothing but write traffic against an endpoint GitHub has already refused.
+    `loop.DevWatcher._escalate_rerequest_rejected` pages the operator on the
+    PR once and records `loop.rerequest_rejected_kind`, which short-circuits
+    the next poll before any probe is paid for; a NEW head is a new key and
+    gets a fresh attempt.
+
+    What still separates this from AssignmentRejected is the OTHER ledger row
+    it must not write: a refused re-request is never recorded as DONE
+    (`loop.rerequest_kind`). The remedy did not happen, and a row saying it
+    did would re-wedge the PR permanently with nothing left that can see it.
+    Distinct from a transient CommandError on the same call, which keeps the
+    plain retry."""
+
+
 class AssignmentRejected(RuntimeError):
     """`assign_self` returned 2xx but the login is not on the issue.
 
@@ -609,6 +638,79 @@ class GitHub:
             if isinstance(r, dict)
         ]
 
+    def commit_time(self, owner: str, repo: str, sha: str) -> "int | None":
+        """A commit's COMMITTER date as unix seconds, or None when it cannot
+        be read -- the grace window's clock behind the mechanical re-request.
+
+        GitHub's REST API exposes no "when was this ref pushed" field on a pull
+        request, and plain pushes raise no timeline event (only force-pushes
+        do), so the head commit's committer date is the cheapest instant
+        available. It is a LOWER BOUND on the push: a commit created locally
+        and pushed minutes later stamps the earlier moment, so an age measured
+        from it over-estimates how long the head has been public and the grace
+        window can expire marginally early. For the sessions this daemon
+        spawns, commit and push are seconds apart (the directives push
+        immediately after committing), and the caller tightens the bound
+        further by taking the later of this and the review the push answers --
+        the push necessarily postdates that review.
+
+        The GIT-OBJECT endpoint, not `repos/:o/:r/commits/:sha`: the latter
+        ships the commit's full file list and patches (up to 300 files) to
+        deliver one date, while `git/commits/:sha` returns the object alone --
+        a few hundred bytes whatever the commit's size, with the date one
+        level shallower. Immaterial on the steady-state path (the done-marker
+        short-circuits ahead of this call once the remedy has fired) and not
+        immaterial on the transient-retry path, where a poll that keeps
+        failing would otherwise re-fetch a possibly-large merge commit every
+        cycle.
+
+        None on anything unreadable (no such commit, a malformed payload, a
+        date GitHub did not spell in UTC `Z`): the caller treats an unknown
+        push instant as "cannot prove the grace has passed" and defers, which
+        is the fail-safe direction for a call that ends in a mutation."""
+        data = self._api(f"repos/{owner}/{repo}/git/commits/{sha}") or {}
+        committer = data.get("committer") or {}
+        return parse_github_timestamp(committer.get("date"))
+
+    def request_review(self, owner: str, repo: str, number: int, reviewer: str) -> None:
+        """Request review from ONE login on a pull request.
+
+        The API call behind a fix session's terminal step (`gh pr edit
+        --add-reviewer`), performed by the daemon itself when the session that
+        owed it died first. `--input` rather than `-f reviewers[]=...` for the
+        same reason `assign_self` uses it: gh 2.4.0 predates the array syntax
+        and the endpoint wants `{"reviewers": [...]}`.
+
+        The response is the pull request, so the request is verified to have
+        LANDED (see ReviewRequestRejected) -- casefolded, because GitHub logins
+        are case-insensitive while the reviewer set is operator-typed."""
+        payload = json.dumps({"reviewers": [reviewer]})
+        fd, body_path = tempfile.mkstemp(prefix="devloop-rereview-", suffix=".json")
+        try:
+            with os.fdopen(fd, "w") as handle:
+                handle.write(payload)
+            data = self._api(
+                "-X",
+                "POST",
+                f"repos/{owner}/{repo}/pulls/{number}/requested_reviewers",
+                "--input",
+                body_path,
+            )
+        finally:
+            os.unlink(body_path)
+
+        landed = tuple(
+            (r.get("login") or "")
+            for r in ((data or {}).get("requested_reviewers") or [])
+        )
+        if reviewer.casefold() not in {name.casefold() for name in landed}:
+            raise ReviewRequestRejected(
+                f"{owner}/{repo}#{number}: GitHub accepted the request but "
+                f"{reviewer!r} is not among the requested reviewers {landed!r} "
+                f"-- the review request did not land, so the reviewer daemon "
+                f"still cannot see this PR."
+            )
+
     def issue(self, owner: str, repo: str, number: int) -> Issue:
         # `or {}`: run_json returns None on empty stdout, and the siblings
         # (search_issues, assign_self) already guard the same way.

{alissa_tools_github_devloop-0.6.3 → alissa_tools_github_devloop-0.7.0}/src/main/alissa/tools/github/devloop/loop.py

@@ -118,6 +118,28 @@ CHANGES_REQUESTED); COMMENTED-mode reviews defer to the CR6 verdict envelope
 via an injectable reader, and with no readable verdict the edge stays closed
 -- a fix session is never spawned on an ambiguous verdict.
 
+That same edge carries the loop's one MECHANICAL remedy (rerequest_enabled,
+issue #61). "A push since the review means an implementer is answering it" is
+usually true and, when it is not, terminal: a fix session that posted its CR8
+replies and PUSHED, then died before `gh pr edit --add-reviewer`, leaves a PR
+neither daemon can reach -- reviewloop only sees a pending re-request, this
+edge only sees the push -- and it waits for a human (observed
+fahera-mx/studio.alissa.app#242, 2026-07-27: 3+ hours). So a push past a
+`request_changes` head is re-examined rather than trusted: with no pending
+re-request, no live worker session for the PR (the liveness rule verbatim --
+DEAD needs a SUCCESSFUL listing with every candidate absent; INDETERMINATE
+defers), and the head public longer than a grace window
+(rerequest_grace_minutes, default stale_minutes -- a live session re-requests
+seconds after its push and must not be raced), the daemon performs the dead
+session's terminal act ITSELF: one re-request to the reviewer whose verdict
+went unanswered, at most once per (PR, round, HEAD), logged on the activity
+comment. No session is spawned -- the work is already pushed and the triage
+already posted, so what is missing is one API call, not a worker -- and the
+pushed head is reviewed as-is. The ledger row lands only AFTER the call
+succeeds (a remedy recorded but never performed would re-wedge the PR with
+nothing left that can see it), and a further `request_changes` on a new head
+is a new key, so the remedy never loops on one commit.
+
 The pass's THIRD edge is the MAINTENANCE edge (maintain_enabled): open PRs
 an operator labeled `maintain_label` (default `alissa:maintain`) get a
 maintenance session -- merge conflicts on approved-but-unmerged branches,
@@ -250,6 +272,7 @@ from .ghclient import (
     PullRequest,
     RateLimited,
     Review,
+    ReviewRequestRejected,
     parse_github_timestamp,
     parse_task_ref,
 )
@@ -299,6 +322,85 @@ _RESUME_TASK_WITHOUT_ORIGIN = (
     "your implementation task DOWNSTREAM of it before writing code."
 )
 
+# The delivery note (issue #63). A worker's highest-value output is not the
+# diff -- the reviewer can read that -- it is the narrative the diff cannot
+# carry: which readings of the spec it chose, which fallbacks it deliberately
+# did not build, and which criteria this environment simply cannot check. That
+# narrative used to die with the tmux session, forcing the operator to
+# re-derive every criterion by hand. So the note is MANDATED in both places a
+# later reader looks: the worker's own task partition (private to the worker
+# and its validator) and the PR body (what the reviewer and the origin-side
+# validator read). The four section names are FIXED so the note is walkable
+# rather than free prose, and an empty section is stated -- "none" under a kept
+# heading is evidence of a considered nothing; a dropped heading is evidence of
+# nothing at all.
+_DELIVERY_NOTE_DESTINATIONS = (
+    "register a DELIVERY NOTE in BOTH places — as evidence on your "
+    "implementation task, titled `Delivery note`, and as a `## Delivery "
+    "notes` section in the PR body (your task partition is private to you; "
+    "the PR body is what the reviewer and the origin-side validator read). "
+)
+
+# Resume and fix rounds land on a PR that may already carry the section: a
+# second one splits the record the first was created to hold.
+_DELIVERY_NOTE_EXTEND = (
+    "If the PR body already carries a `## Delivery notes` section, EXTEND it "
+    "— never open a second one. "
+)
+
+# A fix round delivers that round, not the whole issue, and its triage calls
+# ARE judgment calls: why a finding was pursued, answered or deferred is
+# exactly what the validator cannot reconstruct from the diff.
+_DELIVERY_NOTE_FIX_SCOPE = (
+    "The note covers THIS round's changes, and your triage decisions are "
+    "judgment calls too — record why each finding was pursued, answered or "
+    "deferred. "
+)
+
+_DELIVERY_NOTE_SECTIONS = (
+    "Four sections, every one present even when it is empty (state `none` "
+    "under it — never omit the heading): **Judgment calls** — every place "
+    "the implementation deviated from or interpreted the issue text, one "
+    "bullet each, with the why; **Not verified — operator's gate** — what "
+    "could NOT be verified in this environment and why, enumerated as a "
+    "checklist the validator can walk; **Verification** — what you actually "
+    "ran (tests, style, types, build) and the honest results, failures "
+    "included; **Scope touched** — the files and areas you actually modified "
+    "against the issue's declared scope, calling out any excursion "
+    "explicitly. Honest bullets, not essays: do NOT restate the diff and do "
+    "NOT pad — your reader is the human validator deciding whether to trust "
+    "this merge. One grammar rule, because this daemon PARSES the body you "
+    "are writing into: never put a GitHub closing keyword (`close`/`closes`/"
+    "`closed`, `fix`/`fixes`/`fixed`, `resolve`/`resolves`/`resolved`) "
+    "directly before an issue reference anywhere in the note — write `issue "
+    "#<n>` or name it in prose instead. A not-verified bullet reading `does "
+    "not fix #<n>` reads to the daemon as a claim that this PR closes that "
+    "issue, and that claim is the ONLY thing standing between another "
+    "issue's work and your branch. The single closing claim this body makes "
+    "is the mandated `Closes #<n>` for the issue you are implementing."
+)
+
+_DELIVERY_NOTE = (
+    "BEFORE the review handoff, "
+    + _DELIVERY_NOTE_DESTINATIONS
+    + _DELIVERY_NOTE_SECTIONS
+)
+
+_RESUME_DELIVERY_NOTE = (
+    "BEFORE the review handoff, "
+    + _DELIVERY_NOTE_DESTINATIONS
+    + _DELIVERY_NOTE_EXTEND
+    + _DELIVERY_NOTE_SECTIONS
+)
+
+_FIX_DELIVERY_NOTE = (
+    "BEFORE you re-request review, "
+    + _DELIVERY_NOTE_DESTINATIONS
+    + _DELIVERY_NOTE_EXTEND
+    + _DELIVERY_NOTE_FIX_SCOPE
+    + _DELIVERY_NOTE_SECTIONS
+)
+
 DEV_DIRECTIVE = (
     "You are an IMPLEMENTER, not a reviewer. Implement GitHub issue "
     "{issue_url} (attempt {attempt} of {cap}) — the issue is your "
@@ -316,7 +418,9 @@ DEV_DIRECTIVE = (
     "body contains `Closes #{number}` and BOTH task refs — the origin task "
     "AND your implementation task: the PR body is the canonical cross-actor "
     "record, and each actor's tasks live in its own partition — and attach "
-    "the PR URL to the task as evidence. Then drive the review handoff with "
+    "the PR URL to the task as evidence. "
+    + _DELIVERY_NOTE
+    + " Then drive the review handoff with "
     "the alissa-pr-review skill, requesting reviewer(s): {reviewers}. In "
     "every review round the ORDER is load-bearing: post your CR8 triage "
     "replies FIRST, then push the fixes and re-request review — the review "
@@ -365,6 +469,8 @@ RESUME_DIRECTIVE = (
     "anchors. Keep the PR body carrying `Closes #{number}` and BOTH task refs "
     "(the origin task AND your implementation task) — restoring them if the "
     "dead session did not. "
+    + _RESUME_DELIVERY_NOTE
+    + " "
     "If the PR already carries review findings, the ORDER is load-bearing: "
     "post your CR8 triage replies FIRST (only the ones missing — never a "
     "duplicate reply on a thread the dead session already answered), THEN "
@@ -395,7 +501,9 @@ FIX_DIRECTIVE = (
     "FIRST verify the triage of every prior review finding per CR8: exactly "
     "one reasoned `[triage:*]` reply on each finding's thread — post any that "
     "are missing. Then fix the pursued findings on the same branch and VERIFY "
-    "locally (run the repo's test/style/type scripts). The ORDER is "
+    "locally (run the repo's test/style/type scripts). "
+    + _FIX_DELIVERY_NOTE
+    + " The ORDER is "
     "load-bearing: triage replies FIRST, then push the fixes, then re-request "
     "review from {reviewer} (`gh pr edit {number} --add-reviewer {reviewer}`) "
     "— the review daemon re-enters on head movement, so pushing before the "
@@ -442,6 +550,8 @@ FIX_RESUME_DIRECTIVE = (
     "the ORIGINAL acceptance criteria the issue set, and VERIFY locally (run "
     "the repo's test/style/type scripts). NEVER force-push: history stays "
     "append-only, or the review threads lose their anchors. "
+    + _FIX_DELIVERY_NOTE
+    + " "
     "The ORDER is load-bearing: triage replies FIRST, then push the fixes, "
     "then re-request review from {reviewer} (`gh pr edit {number} "
     "--add-reviewer {reviewer}`) — the review daemon re-enters on head "
@@ -547,6 +657,21 @@ MAINTAIN_CAP_COMMENT = (
     "`attempt_cap` to re-enter the loop, or remove the label to park the PR."
 )
 
+REREQUEST_REJECTED_COMMENT = (
+    "**Dev loop cannot re-request review** — this PR's round {round} fix "
+    "session pushed `{head}` and then died before re-requesting review, so "
+    "the daemon tried to complete that step for it. GitHub accepted the "
+    "request but did not honour it: `{reviewer}` is not on the PR's requested "
+    "reviewers afterwards — most likely that account lacks read access here, "
+    "has been renamed, or is the PR author (GitHub refuses an author's "
+    "request of themselves). That is a permanent condition, so the daemon "
+    "will not retry it on this head. Nothing else can reach the PR in this "
+    "state either: with no pending re-request, the reviewer daemon's "
+    "`review-requested:@me` search cannot see it. This needs an operator: "
+    "request a review by hand (or fix the reviewer's access), or close the "
+    "PR to park the work."
+)
+
 ASSIGNMENT_REJECTED_COMMENT = (
     "**Dev loop cannot start** — the daemon tried to self-assign this issue "
     "as its in-flight marker, but GitHub silently dropped the assignment: "
@@ -579,6 +704,17 @@ ACTIVITY_HEADER = (
 # line is deduped per episode -- see deferral_activity_kind.
 ACTIVITY_DEFERRED = "deferred"
 
+# The activity-log context prefix for a mechanical re-request (the wedge
+# self-heal). Non-spawn like ACTIVITY_DEFERRED, and for the same reason: the
+# self-heal enqueues NOTHING, so a reader that took its line for a spawn claim
+# would park the lane against every instance including the one that wrote it.
+ACTIVITY_REREQUESTED = "re-requested"
+
+# Line contexts that record something OTHER than a spawn. `activity_claims`
+# skips them: a claim is a promise that a session is running on the lane, and
+# neither a capacity deferral nor a mechanical re-request makes one.
+ACTIVITY_NON_SPAWN = (ACTIVITY_DEFERRED, ACTIVITY_REREQUESTED)
+
 # The reader's grammar for a line `_activity_line` wrote: bullet, UTC
 # timestamp, backticked session name, edge, context. The edge field is
 # non-greedy and em-dash-free so the CONTEXT keeps every em-dash it contains
@@ -638,6 +774,21 @@ ESCALATION_LIVE_STALLED = "live-stalled"
 # PR share a number; the epoch suffix is maintain_cap_kind's job below.
 ESCALATION_MAINTAIN_CAP = "maintain-cap"
 
+# The wedge self-heal's done-marker prefix (see rerequest_kind). Not an
+# operator page -- nothing is escalated and no human is asked for anything --
+# but it is exactly what the `escalations` table is: the ledger of once-per-key
+# acts this daemon has already performed, keyed by a free-form TEXT kind. The
+# `rerequest-` prefix keeps its rows from colliding with any issue-edge kind
+# when an issue and a PR share a number, like every other PR-side kind here.
+ESCALATION_REREQUEST = "rerequest"
+
+# The self-heal's OTHER once-per-key row: the remedy was attempted and GitHub
+# permanently refused it (see ReviewRequestRejected). Deliberately a separate
+# kind from ESCALATION_REREQUEST, because the two say opposite things -- one
+# marks the remedy DONE, the other marks it IMPOSSIBLE on this head -- and a
+# rejected attempt must never read as a completed one.
+ESCALATION_REREQUEST_REJECTED = "rerequest-rejected"
+
 # CR6 verdict words, spelled exactly as reviewloop's alissa.py spells them --
 # the envelope tie-breaker (see DevWatcher.envelope_verdict) must return
 # these strings, so the two daemons read one vocabulary.
@@ -660,6 +811,55 @@ def maintain_cap_kind(labeled_ts: "int | None") -> str:
     return f"{ESCALATION_MAINTAIN_CAP}:e{labeled_ts}"
 
 
+def rerequest_kind(round_: int, head_sha: str) -> str:
+    """The ledger kind that marks ONE mechanical re-request as done.
+
+    Keyed per (PR, round, HEAD) -- the row_slug/number supply the PR, and both
+    of the other two fold into the kind. All three are load-bearing:
+
+    * the ROUND, because a later round is a different unanswered verdict, and
+      round k's self-heal must not silence round k+1's;
+    * the HEAD, because the whole point of the remedy is to get THIS pushed
+      head reviewed. If the reviewer answers with another `request_changes`
+      and a session pushes a new head that again goes unanswered, that is a
+      fresh wedge on a fresh commit and deserves its own re-request. Keyed on
+      (PR, round) alone the second wedge would be silently swallowed;
+    * and together they are what stops a LOOP: within one (round, head) the
+      remedy fires exactly once, whatever the reviewer does next. If the
+      re-request is honoured the edge closes server-side (a pending
+      re-request); if it is dismissed or withdrawn without a verdict, the row
+      is what keeps the daemon from re-requesting into that dismissal every
+      poll forever.
+
+    Delivery contract, unlike every escalation kind beside it: the row lands
+    only AFTER the API call SUCCEEDS. A page that failed to post costs an
+    operator one notification; a re-request that failed to land and was
+    recorded anyway would re-wedge the PR permanently, with the remedy marked
+    done and no automation left that can see it.
+    """
+    return f"{ESCALATION_REREQUEST}:r{round_}@{head_sha}"
+
+
+def rerequest_rejected_kind(round_: int, head_sha: str) -> str:
+    """The ledger kind that bounds ONE permanently-refused re-request.
+
+    Keyed exactly like rerequest_kind (per PR, round and HEAD) so the two
+    rows describe the same act, and so a NEW head -- a fresh push, possibly
+    by a session that can request reviewers -- gets a fresh attempt rather
+    than inheriting the last head's refusal.
+
+    Delivery contract: the OPPOSITE of rerequest_kind's, and matching
+    _escalate_rejection's on the issue edge. This row is recorded even if its
+    operator comment fails to post, because the row's job is to STOP a POST
+    that GitHub has permanently refused -- recording only on a successful
+    comment would leave the daemon writing to that endpoint every poll
+    forever, which is the failure the row exists to end. At most one lost
+    page per (PR, round, head): the same trade every terminal-state
+    escalation here makes.
+    """
+    return f"{ESCALATION_REREQUEST_REJECTED}:r{round_}@{head_sha}"
+
+
 def fix_cap_kind(round_: int) -> str:
     """The ledger kind that dedupes ONE round's fix cap-out operator page.
 
@@ -796,8 +996,13 @@ DAEMON_HEAD_REF = re.compile(r"[A-Za-z0-9._-]+")
 CLOSING_KEYWORD = r"clos(?:e|es|ed)|fix(?:es|ed)?|resolv(?:e|es|ed)"
 
 
-def closes_issue(body: str, owner: str, repo: str, number: int) -> bool:
-    """Does `body` claim to close THIS issue with a GitHub closing keyword?
+def _closing_pattern(owner: str, repo: str, number: str) -> str:
+    """The closing-keyword grammar, with `number` the digits to match.
+
+    Factored out so the two readers -- "does this body close issue 7?" and
+    "which issues does this body close?" -- can never drift apart: one accepts
+    a literal number, the other a capturing `(\\d+)`, and everything ELSE
+    about what counts as a closing claim is stated once.
 
     Accepts every keyword GitHub accepts, case-insensitively, against every
     reference form that resolves to this repo's issue: `#7`, `GH-7`,
@@ -807,22 +1012,46 @@ def closes_issue(body: str, owner: str, repo: str, number: int) -> bool:
     (`Closes: #7` yes, a keyword ending a paragraph followed by a `#7` on the
     next line no): GitHub does not link across the break either, and prose
     like "this fixes:" above a list of issue references must not read as a
-    claim to close them."""
+    claim to close them.
+    """
     ref = (
         r"(?:#|GH-|"
         + re.escape(f"{owner}/{repo}") + r"#|"
         + re.escape(f"https://github.com/{owner}/{repo}/issues/")
         + r")"
     )
-    pattern = (
+    return (
         r"\b(?:" + CLOSING_KEYWORD + r")\b[ \t]*:?[ \t]*"
         + ref
-        + str(number)
+        + number
         + r"(?!\d)"
     )
+
+
+def closes_issue(body: str, owner: str, repo: str, number: int) -> bool:
+    """Does `body` claim to close THIS issue with a GitHub closing keyword?
+    See _closing_pattern for the grammar this asks against."""
+    pattern = _closing_pattern(owner, repo, re.escape(str(number)))
     return re.search(pattern, body, re.IGNORECASE) is not None
 
 
+def closed_issue_numbers(body: str, owner: str, repo: str) -> "tuple[int, ...]":
+    """Every issue number `body` claims to close in THIS repo, in order.
+
+    closes_issue's question asked the other way round, for the caller that
+    holds a PR and needs the issue behind it rather than the reverse (the
+    wedge self-heal, resolving which `develop-*` lane opened this PR so a live
+    one is never re-requested over). Same grammar, same repo scoping -- a
+    `Closes acme/other#7` names another repo's issue and is not returned,
+    because the ledger key it would produce would be a lie.
+    """
+    pattern = _closing_pattern(owner, repo, r"(\d+)")
+    seen: "dict[int, None]" = {}
+    for match in re.finditer(pattern, body or "", re.IGNORECASE):
+        seen.setdefault(int(match.group(1)), None)
+    return tuple(seen)
+
+
 class Action(str, Enum):
     SPAWNED = "spawned"
     IN_FLIGHT = "in-flight"
@@ -923,6 +1152,17 @@ class SessionLiveness:
             return Liveness.INDETERMINATE
         return Liveness.ALIVE if session in self._live else Liveness.DEAD
 
+    def live_with_prefix(self, prefix: str) -> "tuple[str, ...]":
+        """Live session names starting with `prefix`, sorted for a stable log.
+
+        `of()` asks about a name the LEDGER supplied; this asks the roster
+        directly, for the caller that can derive a name shape from GitHub
+        alone (see `pr_session_prefix`). Empty is not evidence of anything on
+        its own -- a failed listing has nothing live in it either -- so every
+        caller checks `listed` first, exactly as `of()` does internally.
+        """
+        return tuple(sorted(n for n in self._live if n.startswith(prefix)))
+
 
 class SessionBudget:
     """The per-pass concurrency budget behind `max_sessions`.
@@ -1021,20 +1261,58 @@ def _oldest_first(found: list) -> list:
     )
 
 
+def _name_slug(owner: str, repo: str) -> str:
+    """`<owner>-<repo>`, squashed to the tmux-safe alphabet.
+
+    The shared root of every worker session name. The owner is folded in
+    because attempt counts are keyed per `owner/repo` (the P3 session-name
+    lesson): `acme/widgets#7` and `other/widgets#7` can both legitimately sit
+    at attempt 1, and a repo-only name would collide their sessions.
+    """
+    return (
+        f"{re.sub(r'[^A-Za-z0-9-]', '-', owner).strip('-').lower()}-"
+        f"{re.sub(r'[^A-Za-z0-9-]', '-', repo).strip('-').lower()}"
+    )
+
+
+def issue_session_prefix(owner: str, repo: str, number: int) -> str:
+    """`develop-<owner>-<repo>-i<n>-` — the name prefix EVERY developer
+    session on this issue shares, whatever attempt it sits at.
+
+    `pr_session_prefix`'s counterpart for the issue edge, and readable for the
+    same second reason: the wedge self-heal matches it against the pass's tmux
+    roster to find a live `develop-*` worker on an issue WITHOUT consulting
+    the ledger. Every argument is derivable from the PR alone (its owner/repo
+    plus a closing-keyword issue number), which is what makes the check
+    survive a ledger this instance never wrote.
+    """
+    return f"develop-{_name_slug(owner, repo)}-i{number}-"
+
+
 def session_name(issue: Issue, attempt: int) -> str:
     """A tmux-safe developer session name:
     `develop-<owner>-<repo>-i<n>-a<attempt>`.
 
     Deterministic on purpose (no nonce, unlike reviewloop): the attempt number
     comes from the ledger's row count, so every spawn gets a fresh number and
-    the name cannot collide with a still-live session. The owner is folded in
-    because the attempt count is keyed per `owner/repo` -- two owners' ledgers
-    count independently, so `acme/widgets#7` and `other/widgets#7` can both
-    legitimately sit at attempt 1 and a repo-only name would collide.
+    the name cannot collide with a still-live session.
+    """
+    return f"{issue_session_prefix(issue.owner, issue.repo, issue.number)}a{attempt}"
+
+
+def pr_session_prefix(pr: PullRequest, edge: str) -> str:
+    """`<edge>-<owner>-<repo>-pr<n>-` — the name prefix EVERY worker session
+    on this pull request shares, whatever round or attempt it sits at.
+
+    The two PR-side session names below are this plus their tail, so the
+    naming rules are stated once (see `_name_slug`). It is also readable on
+    its own: the wedge self-heal matches it against the pass's tmux roster to
+    find live workers on a PR WITHOUT consulting the ledger -- the one
+    liveness question a lost, foreign, or freshly-migrated ledger cannot
+    answer, and the self-heal ends in a mutation, so it must not depend on
+    local memory being intact.
     """
-    owner = re.sub(r"[^A-Za-z0-9-]", "-", issue.owner).strip("-").lower()
-    repo = re.sub(r"[^A-Za-z0-9-]", "-", issue.repo).strip("-").lower()
-    return f"develop-{owner}-{repo}-i{issue.number}-a{attempt}"
+    return f"{edge}-{_name_slug(pr.owner, pr.repo)}-pr{pr.number}-"
 
 
 def fix_session_name(pr: PullRequest, round_: int, attempt: int) -> str:
@@ -1048,9 +1326,7 @@ def fix_session_name(pr: PullRequest, round_: int, attempt: int) -> str:
     owners' PR #16 can both sit at round 1 attempt 1, and a repo-only name
     would collide.
     """
-    owner = re.sub(r"[^A-Za-z0-9-]", "-", pr.owner).strip("-").lower()
-    repo = re.sub(r"[^A-Za-z0-9-]", "-", pr.repo).strip("-").lower()
-    return f"fix-{owner}-{repo}-pr{pr.number}-r{round_}-a{attempt}"
+    return f"{pr_session_prefix(pr, 'fix')}r{round_}-a{attempt}"
 
 
 def maintain_session_name(pr: PullRequest, attempt: int) -> str:
@@ -1064,9 +1340,7 @@ def maintain_session_name(pr: PullRequest, attempt: int) -> str:
     maintain counts are keyed per `owner/repo`, so two owners' PR #16 can
     both sit at attempt 1, and a repo-only name would collide.
     """
-    owner = re.sub(r"[^A-Za-z0-9-]", "-", pr.owner).strip("-").lower()
-    repo = re.sub(r"[^A-Za-z0-9-]", "-", pr.repo).strip("-").lower()
-    return f"maintain-{owner}-{repo}-pr{pr.number}-a{attempt}"
+    return f"{pr_session_prefix(pr, 'maintain')}a{attempt}"
 
 
 def activity_lane(session: str) -> str:
@@ -1118,10 +1392,11 @@ def activity_claims(body: str, now: "float | None" = None) -> "list[ActivityClai
     """Every readable SPAWN record in an activity comment's body.
 
     Spawn records only: a capacity-deferral line explicitly claims nothing (no
-    self-assign, no ledger row, no session -- see _spawn's gate), so reading
-    one as a claim would let a deferring instance park the lane against
-    everybody including itself. The context field is what tells them apart,
-    and `deferred` is the only context that is not a spawn.
+    self-assign, no ledger row, no session -- see _spawn's gate), and neither
+    does a mechanical re-request (it completes a DEAD session's protocol; no
+    session is running afterwards), so reading either as a claim would let an
+    instance park the lane against everybody including itself. The context
+    field is what tells them apart -- see ACTIVITY_NON_SPAWN.
 
     Everything else fails open, one line at a time: a line that does not match
     the grammar, or whose stamp is not an instant, or whose stamp is
@@ -1135,7 +1410,7 @@ def activity_claims(body: str, now: "float | None" = None) -> "list[ActivityClai
         match = ACTIVITY_LINE_RE.match(raw.strip())
         if match is None:
             continue
-        if match.group("context").strip().lower().startswith(ACTIVITY_DEFERRED):
+        if match.group("context").strip().lower().startswith(ACTIVITY_NON_SPAWN):
             continue
         at = parse_activity_timestamp(match.group("ts"))
         if at is None:
@@ -2117,13 +2392,13 @@ class DevWatcher:
         # is the head it reviewed, so commit_id != head_sha means the head
         # moved after the review. A falsy commit_id (older records lack one)
         # cannot be checked and falls through, same as reviewloop.
+        # ...unless nobody is: a push whose session died before re-requesting
+        # review wedges the PR between the two daemons' triggers, and the
+        # self-heal below is the only thing that can complete the dead
+        # session's terminal act. See _push_after_review.
         newest = reviews[-1]
         if newest.commit_id and newest.commit_id != pr.head_sha:
-            return Decision(
-                Action.SKIPPED,
-                f"head {pr.head_sha[:8]} is newer than the reviewed commit "
-                f"{newest.commit_id[:8]} — an implementer is already active",
-            )
+            return self._push_after_review(pr, reviews, newest, roster)
 
         verdict = self._verdict(pr, newest)
         if verdict == VERDICT_APPROVE:
@@ -2331,6 +2606,456 @@ class DevWatcher:
         ]
         return sorted(mine, key=lambda r: r.submitted_at)
 
+    # -- the wedge self-heal (issue #61) -----------------------------------
+
+    def _push_after_review(
+        self,
+        pr: PullRequest,
+        reviews: list[Review],
+        newest: Review,
+        roster: "SessionLiveness | None",
+    ) -> Decision:
+        """The head moved past the review. Is an implementer really active --
+        or did the one who pushed die before re-requesting review?
+
+        Both readings produce the same GitHub state, and until now the edge
+        took the optimistic one unconditionally. The pessimistic one is a real,
+        observed, terminal wedge (fahera-mx/studio.alissa.app#242, 2026-07-27):
+        a fix session posted its CR8 replies, pushed its fix commit, and died
+        before `gh pr edit --add-reviewer`. Neither daemon can exit that state
+        -- reviewloop's ONLY entry point is a `review-requested:@me` search and
+        there is no pending request, while this edge reads the push and stands
+        down -- so the PR waits for a human. It waited three hours.
+
+        The remedy is deliberately NOT a session: the round's work is already
+        pushed and its triage already posted, so what is missing is one API
+        call, and spawning a worker to make it would re-enter a branch that
+        needs nothing done to it. The daemon performs the dead session's
+        terminal act itself and lets the pushed head be reviewed as-is.
+
+        Every gate below is a reason to keep the optimistic reading, in
+        increasing order of cost -- config, then the verdict already in hand,
+        then the local ledger, then the tmux roster the pass already holds,
+        and only last the one extra GitHub call (the head's age). The order is
+        not cosmetic: the common case on this branch is a HEALTHY fix session
+        that pushed thirty seconds ago, and it must fall out on a config read
+        and a string compare, never on a network round-trip.
+        """
+        # The legacy reading, returned unchanged by every gate that declines:
+        # a wedge that is not yet provable is exactly the state this edge has
+        # always described, and nothing downstream may see a new shape for it.
+        active = Decision(
+            Action.SKIPPED,
+            f"head {pr.head_sha[:8]} is newer than the reviewed commit "
+            f"{newest.commit_id[:8]} — an implementer is already active",
+        )
+        if not self.config.rerequest_enabled:
+            return active
+
+        # A push answering an APPROVE (or an unreadable verdict) is ordinary
+        # follow-up work, not an unanswered round: there is nothing for the
+        # reviewer to be re-requested FOR. Only request_changes leaves a
+        # protocol half-finished.
+        if self._verdict(pr, newest) != VERDICT_REQUEST_CHANGES:
+            return active
+
+        # An empty head_sha cannot be re-requested against coherently (it
+        # names no commit to review and would make a nonsense ledger key), and
+        # it is only reachable from a malformed PR payload.
+        if not pr.head_sha:
+            return active
+
+        round_ = len(reviews)
+        attempts = self.state.fix_attempt_count(pr.full_name, pr.number, round_)
+        kind = rerequest_kind(round_, pr.head_sha)
+
+        # Idempotence, checked before anything is spent: the remedy already
+        # fired for this (PR, round, head). Whatever the reviewer did with it
+        # -- honoured it, dismissed it, withdrew from the PR -- this daemon
+        # does not re-request into the same head twice. A NEW head (another
+        # session pushed again) is a new key and gets its own single shot.
+        if self.state.escalated(pr.full_name, pr.number, kind):
+            return Decision(
+                Action.SKIPPED,
+                f"head {pr.head_sha[:8]} is newer than the reviewed commit "
+                f"{newest.commit_id[:8]} and review was already mechanically "
+                f"re-requested once for round {round_} on this head — not "
+                f"re-requesting again (the round is the reviewer's or the "
+                f"operator's now)",
+                attempts,
+                round=round_,
+            )
+
+        # The refusal's mirror of the row above, and the retry bound behind
+        # it: GitHub permanently declined this exact re-request, an operator
+        # was paged on the PR, and re-POSTing every poll would achieve nothing
+        # but write traffic. A fresh push is a fresh key and gets a fresh
+        # attempt -- the refusal is pinned to the head it was refused on, not
+        # to the PR.
+        rejected = rerequest_rejected_kind(round_, pr.head_sha)
+        if self.state.escalated(pr.full_name, pr.number, rejected):
+            return Decision(
+                Action.SKIPPED,
+                f"head {pr.head_sha[:8]} is newer than the reviewed commit "
+                f"{newest.commit_id[:8]} and GitHub permanently refused the "
+                f"mechanical re-request for round {round_} on this head — "
+                f"operator paged on the PR; not retrying",
+                attempts,
+                round=round_,
+            )
+
+        # ALIVE and INDETERMINATE both land here, and both keep the legacy
+        # sentence verbatim: with a live session -- or no evidence either way
+        # -- "an implementer is already active" is exactly what the daemon
+        # believes, and the parenthetical only says on what grounds.
+        liveness, who = self._wedge_liveness(pr, round_, roster)
+        if liveness is not Liveness.DEAD:
+            return Decision(
+                Action.SKIPPED,
+                f"head {pr.head_sha[:8]} is newer than the reviewed commit "
+                f"{newest.commit_id[:8]} — an implementer is already active "
+                f"(session picture: {liveness.value} — {who})",
+                attempts,
+                round=round_,
+            )
+
+        waited = self._head_public_for(pr, newest)
+        grace = self.config.rerequest_grace_seconds
+        if waited is None:
+            return Decision(
+                Action.SKIPPED,
+                f"head {pr.head_sha[:8]} is newer than the reviewed commit "
+                f"{newest.commit_id[:8]} but its push instant could not be "
+                f"read — cannot prove the {int(grace / 60)} min grace has "
+                f"passed; deferring the mechanical re-request",
+                attempts,
+                round=round_,
+            )
+        if waited < grace:
+            return Decision(
+                Action.SKIPPED,
+                f"head {pr.head_sha[:8]} is newer than the reviewed commit "
+                f"{newest.commit_id[:8]} and has only been public "
+                f"{int(waited / 60)} min of the {int(grace / 60)} min grace — "
+                f"a session that just pushed re-requests within seconds; not "
+                f"racing it",
+                attempts,
+                round=round_,
+            )
+
+        return self._rerequest_review(pr, round_, attempts, newest, kind, waited)
+
+    def _wedge_liveness(
+        self, pr: PullRequest, round_: int, roster: "SessionLiveness | None"
+    ) -> "tuple[Liveness, str]":
+        """Is ANY worker session that could be answering this round still
+        running? Returns the reading and the phrase that explains it.
+
+        The three-signal matrix's liveness rule, applied to a whole PR rather
+        than one ledger row -- DEAD requires a listing that SUCCEEDED with
+        every candidate absent from it, and no listing at all is
+        INDETERMINATE, which defers. That direction is the entire safety
+        argument: a tmux hiccup must never manufacture a re-request onto a
+        branch a live session is still pushing to.
+
+        Three candidate sources, because the session that pushed and died is
+        not always a fix session:
+
+        * the fix ledger's newest session for THIS round -- issue #61's
+          literal subject, and the shape #242 took;
+        * every live session on the roster under this PR's own name prefixes
+          (`fix-…-pr<n>-`, `maintain-…-pr<n>-`) -- ledger-independent, so a
+          lost or migrated ledger cannot turn a live worker into a dead one;
+        * the issue-edge lane for every issue this PR's body CLOSES, read BOTH
+          ways -- the ledger's newest session for that issue AND the roster's
+          own `develop-<owner>-<repo>-i<n>-` prefix. Round one is normally
+          answered inline by the `develop-*` session that opened the PR (it
+          blocks in alissa-pr-review, holding its own re-request pending), and
+          when THAT session dies after its push the wedge is identical while
+          the fix ledger is empty. The roster half is what makes this lane as
+          ledger-independent as the two above it: reading a lost ledger as "no
+          session is alive" would re-request over a live implementer
+          mid-round, which is the one thing this gate exists to prevent.
+
+        A candidate the ledger names but the roster does not list is DEAD, and
+        that is the point -- it is the dead session whose act is being
+        completed.
+
+        Known bound, shared with the issue edge's resume and for the same
+        reason: a PR whose body never carried a closing keyword links to no
+        issue, so its `develop-*` lane is not derivable and only the two
+        PR-keyed sources speak for it. DEV_DIRECTIVE mandates `Closes #<n>`,
+        so this is the body of a PR the daemon did not drive; widening it
+        would mean treating any live `develop-*` session anywhere as a reason
+        to defer every PR, which is not evidence about THIS one.
+        """
+        if roster is None or not roster.listed:
+            return Liveness.INDETERMINATE, (
+                "the session listing is unavailable, so the daemon has no "
+                "evidence either way"
+            )
+
+        candidates: list[str] = []
+        row_session = self.state.newest_fix_spawn_session(
+            pr.full_name, pr.number, round_
+        )
+        if row_session:
+            candidates.append(row_session)
+        for issue_number in closed_issue_numbers(pr.body, pr.owner, pr.repo):
+            dev_session = self.state.newest_spawn_session(
+                pr.full_name, issue_number
+            )
+            if dev_session:
+                candidates.append(dev_session)
+            candidates.extend(
+                roster.live_with_prefix(
+                    issue_session_prefix(pr.owner, pr.repo, issue_number)
+                )
+            )
+        for edge in ("fix", "maintain"):
+            candidates.extend(
+                roster.live_with_prefix(pr_session_prefix(pr, edge))
+            )
+
+        alive = sorted(
+            {c for c in candidates if roster.of(c) is Liveness.ALIVE}
+        )
+        if alive:
+            return Liveness.ALIVE, f"{', '.join(alive)} still listed"
+        return Liveness.DEAD, "no worker session for this PR is listed"
+
+    def _head_public_for(
+        self, pr: PullRequest, newest: Review
+    ) -> "float | None":
+        """How long the pushed head has been public, in seconds, or None when
+        that cannot be established.
+
+        The grace window's clock. GitHub publishes no push instant for a pull
+        request head (see `GitHub.commit_time`), so this takes the LATER of
+        two lower bounds: the head commit's own committer date, and the
+        submission of the review the push answers -- the push demonstrably
+        postdates that review, so where a commit was authored long before it
+        was pushed (a rebase, a branch parked for a day) the review's stamp is
+        the tighter and more honest of the two.
+
+        The result is still a lower bound on the true push instant, so the
+        measured age can run slightly LONG and the grace expire slightly
+        early. That is the direction worth documenting rather than hiding:
+        the alternative -- a per-poll walk of the PR's commits or its
+        timeline -- costs more calls to sharpen a number the liveness gate
+        above has already made nearly redundant.
+
+        None whenever the commit cannot be read (CommandError, an absent or
+        malformed date): the caller cannot prove the grace has passed and
+        defers. RateLimited is NOT caught -- like every other GitHub call in
+        the pass it belongs to run_forever's backoff."""
+        try:
+            committed = self.github.commit_time(pr.owner, pr.repo, pr.head_sha)
+        except CommandError as exc:
+            log.warning(
+                "could not read the push instant of %s head %s (%s) — "
+                "deferring the mechanical re-request this poll",
+                pr.pr_slug,
+                pr.head_sha[:8],
+                exc,
+            )
+            return None
+        if committed is None:
+            return None
+        reviewed = parse_github_timestamp(newest.submitted_at)
+        pushed = committed if reviewed is None else max(committed, reviewed)
+        # Clamped at 0.0 for spawn_age's reason: these are wall clocks on two
+        # machines, and a forward-skewed one must read as "just pushed" (the
+        # deferring direction), never as a negative age that compares below
+        # every grace window.
+        return max(0.0, time.time() - pushed)
+
+    def _rerequest_review(
+        self,
+        pr: PullRequest,
+        round_: int,
+        attempts: int,
+        review: Review,
+        kind: str,
+        waited: float,
+    ) -> Decision:
+        """Complete the dead session's terminal act: re-request review from
+        the reviewer whose `request_changes` this round answers, record it,
+        and log one line on the mechanical activity comment.
+
+        The reviewer is `review.author`, exactly as FIX_DIRECTIVE names it --
+        precise, and always resolvable because the review exists.
+
+        Ordering is a delivery contract, not style. The API call goes FIRST
+        and the ledger row lands only on success: a failure must retry next
+        poll, because a remedy marked done that never happened re-wedges the
+        PR permanently with no automation left that can see it. The activity
+        line comes LAST and stays best-effort -- it is telemetry about an act
+        that has already happened, the inverse of a spawn's line (which is
+        published first, because there it is a CLAIM on a lane and a claim
+        after the fact closes nothing). The line is written as a NON-SPAWN
+        context for the same reason: no session exists afterwards for it to
+        claim a lane on behalf of.
+
+        Two instances polling the same PR in the same second can both reach
+        this and both POST; GitHub takes the second as a no-op and the loser's
+        next fetch sees the pending re-request and returns at the guard far
+        above. The cost is a duplicate activity line, which is why this is not
+        gated on the cross-instance claim check -- that check exists to stop
+        duplicate SESSIONS, and there is no session here to duplicate.
+        """
+        reviewer = review.author
+        log.warning(
+            "WEDGE %s round %d: head %s was pushed %.0f min ago answering "
+            "%s's request_changes, no re-request is pending, and no worker "
+            "session for this PR is listed — the fix session died before its "
+            "terminal act; re-requesting review from %s mechanically (once "
+            "per PR/round/head)",
+            pr.pr_slug,
+            round_,
+            pr.head_sha[:8],
+            waited / 60,
+            reviewer,
+            reviewer,
+        )
+
+        if self.config.dry_run:
+            log.info(
+                "[dry-run] would re-request review from %s on %s",
+                reviewer,
+                pr.pr_slug,
+            )
+            return Decision(
+                Action.IN_FLIGHT,
+                f"[dry-run] would mechanically re-request review from "
+                f"{reviewer} for round {round_} (head {pr.head_sha[:8]} "
+                f"pushed {int(waited / 60)} min ago, its session gone)",
+                attempts,
+                round=round_,
+            )
+
+        # The two failure modes are NOT the same failure, and the issue edge
+        # already settled which response each gets. A CommandError is
+        # transient (a 502, a flaky network): don't record, retry next poll.
+        # A ReviewRequestRejected is PERMANENT and operator-fixable -- GitHub
+        # accepted the request and declined to honour it, for a reason no
+        # amount of retrying changes (no read access, a renamed login, an
+        # author requesting themselves) -- so it takes _escalate_rejection's
+        # doctrine verbatim: escalate-don't-retry. Neither path records the
+        # DONE marker: the remedy did not happen either way.
+        try:
+            self.github.request_review(pr.owner, pr.repo, pr.number, reviewer)
+        except ReviewRequestRejected as exc:
+            return self._escalate_rerequest_rejected(
+                pr, round_, attempts, reviewer, exc
+            )
+        except CommandError as exc:
+            log.error(
+                "could not mechanically re-request review from %s on %s: %s "
+                "— NOT recording it; the self-heal retries next poll",
+                reviewer,
+                pr.pr_slug,
+                exc,
+            )
+            return Decision(
+                Action.SKIPPED,
+                f"the mechanical re-request to {reviewer} did not land "
+                f"({exc}) — transient; not recorded, retrying next poll",
+                attempts,
+                round=round_,
+            )
+
+        self.state.record_escalation(pr.full_name, pr.number, kind)
+        self._append_activity(
+            pr.owner,
+            pr.repo,
+            pr.number,
+            self._activity_line(
+                activity_lane(fix_session_name(pr, round_, 0)),
+                "fix edge",
+                f"{ACTIVITY_REREQUESTED} review from {reviewer} — round "
+                f"{round_}'s session pushed {pr.head_sha[:8]} "
+                f"{int(waited / 60)} min ago and died before re-requesting; "
+                f"completing its terminal act mechanically (no session "
+                f"spawned, once per PR/round/head)",
+            ),
+            pr.pr_slug,
+        )
+
+        return Decision(
+            Action.IN_FLIGHT,
+            f"wedge self-healed — review mechanically re-requested from "
+            f"{reviewer} for round {round_} (head {pr.head_sha[:8]} was "
+            f"pushed {int(waited / 60)} min ago and its session is gone); the "
+            f"ball is back in the reviewer's court",
+            attempts,
+            round=round_,
+        )
+
+    def _escalate_rerequest_rejected(
+        self,
+        pr: PullRequest,
+        round_: int,
+        attempts: int,
+        reviewer: str,
+        exc: ReviewRequestRejected,
+    ) -> Decision:
+        """Operator page for a re-request GitHub permanently refused, posted
+        ON the PR -- `_escalate_rejection`'s doctrine on this edge.
+
+        The remedy cannot land and no retry will change that, so the daemon
+        stops trying and tells a human instead. Paging is not optional here
+        for the same reason FIX_CAP_COMMENT is not: with no pending
+        re-request the reviewer daemon's `review-requested:@me` search cannot
+        see this PR at all, so the self-heal was the last automation standing
+        and its silent failure is the wedge the whole feature exists to end.
+        The container log is not where operators find wedges -- the PR is.
+
+        The rejected row is recorded even when the comment fails to post (the
+        cap/assignment trade, spelled out in rerequest_rejected_kind): the
+        row's job is to stop a refused POST, and gating it on a successful
+        comment would leave the daemon writing to that endpoint every poll
+        forever. The DONE marker is NOT recorded -- the remedy never
+        happened, and a later push re-opens the question on its own key.
+
+        NOT dry-run gated, and it does not need to be: the only path here is
+        the live `request_review` call's `except`, and a dry pass returns
+        above it without ever POSTing -- so a dry run cannot be refused,
+        which is exactly right (it performed nothing to be refused)."""
+        kind = rerequest_rejected_kind(round_, pr.head_sha)
+        log.error(
+            "REREQUEST REFUSED %s round %d: GitHub did not honour the "
+            "mechanical re-request of %s on head %s (%s) — permanent and "
+            "operator-fixable; paging the operator on the PR and not "
+            "retrying on this head",
+            pr.pr_slug,
+            round_,
+            reviewer,
+            pr.head_sha[:8],
+            exc,
+        )
+
+        body = REREQUEST_REJECTED_COMMENT.format(
+            round=round_, head=pr.head_sha[:8], reviewer=reviewer
+        )
+        try:
+            self.github.comment(pr.owner, pr.repo, pr.number, body)
+        except CommandError as comment_exc:
+            log.error(
+                "could not post the re-request-refused comment on %s: %s",
+                pr.pr_slug,
+                comment_exc,
+            )
+        self.state.record_escalation(pr.full_name, pr.number, kind)
+        return Decision(
+            Action.ESCALATED,
+            f"GitHub permanently refused the mechanical re-request to "
+            f"{reviewer} for round {round_} on head {pr.head_sha[:8]} "
+            f"({exc}) — operator paged on the PR; not retrying on this head",
+            attempts,
+            round=round_,
+        )
+
     def _escalate_fix_cap(self, pr: PullRequest, round_: int, attempts: int) -> None:
         """Operator page for a fix cap-out, posted ON the PR (the issue
         edge's _escalate shape): log, comment (dry-run gated), and record

alissa_tools_github_devloop-0.7.0/src/main/alissa/tools/github/devloop/version

@@ -0,0 +1 @@
+0.7.0

{alissa_tools_github_devloop-0.6.3 → alissa_tools_github_devloop-0.7.0/src/main/alissa_tools_github_devloop.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: alissa-tools-github-devloop
-Version: 0.6.3
+Version: 0.7.0
 Summary: ALISSA-TOOLS-GITHUB-DEVLOOP
 Home-page: https://alissa.app
 Author: Fahera

alissa_tools_github_devloop-0.6.3/src/main/alissa/tools/github/devloop/version

@@ -1 +0,0 @@
-0.6.3