alissa-tools-github-devloop 0.8.17__tar.gz → 0.8.19__tar.gz

{alissa_tools_github_devloop-0.8.17/src/main/alissa_tools_github_devloop.egg-info → alissa_tools_github_devloop-0.8.19}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: alissa-tools-github-devloop
-Version: 0.8.17
+Version: 0.8.19
 Summary: ALISSA-TOOLS-GITHUB-DEVLOOP
 Home-page: https://alissa.app
 Author: Fahera

{alissa_tools_github_devloop-0.8.17 → alissa_tools_github_devloop-0.8.19}/src/main/alissa/tools/github/devloop/__main__.py

@@ -256,6 +256,16 @@ def build_parser() -> argparse.ArgumentParser:
         help="never complete a draft's handoff mechanically — an unhanded-off "
         "draft waits for an operator (also narrows the PR search to non-drafts)",
     )
+    over.add_argument(
+        "--wedge-minutes",
+        type=int,
+        metavar="MINUTES",
+        help="wedge detection: kill an ALIVE session behind its own still-"
+        "draft, never-handed-off PR once its activity footprint (spawn, last "
+        "head commit, last PR update) is older than this, so the next pass "
+        "resumes it as attempt k+1; 0 = off (the default); floored at "
+        "stale_minutes",
+    )
     over.add_argument(
         "--orphan-grace-minutes",
         type=int,
@@ -401,6 +411,7 @@ def overrides_from(args: argparse.Namespace) -> dict:
         "maintain_label": args.maintain_label,
         "maintain_enabled": args.maintain_enabled,
         "resume_enabled": args.resume_enabled,
+        "wedge_minutes": args.wedge_minutes,
         "rerequest_enabled": args.rerequest_enabled,
         "rerequest_grace_minutes": args.rerequest_grace_minutes,
         "orphan_sweep_enabled": args.orphan_sweep_enabled,

{alissa_tools_github_devloop-0.8.17 → alissa_tools_github_devloop-0.8.19}/src/main/alissa/tools/github/devloop/config.py

@@ -28,12 +28,15 @@ through to the config rather than fail the daemon's boot on a mode of `''`.
 from __future__ import annotations
 
 import json
+import logging
 import os
 import re
 from dataclasses import dataclass, field
 from pathlib import Path
 from typing import Any, Mapping
 
+log = logging.getLogger(__name__)
+
 # What to do when a labeled issue has no matching Alissa origin task (the
 # label may have been applied by hand, outside the Alissa task flow).
 ON_MISSING_WARN = "warn_and_spawn"  # spawn, but log loudly
@@ -147,6 +150,7 @@ CONFIG_KEYS = (
     "maintain_label",
     "maintain_enabled",
     "resume_enabled",
+    "wedge_minutes",
     "rerequest_enabled",
     "rerequest_grace_minutes",
     "orphan_sweep_enabled",
@@ -452,6 +456,33 @@ class Config:
     # operator who wants a dead-with-PR lane to wait for a human.
     resume_enabled: bool = True
 
+    # Wedge detection on the issue edge (issue #110): the activity-footprint
+    # window behind the resume above. Liveness measures session EXISTENCE,
+    # not work: a worker wedged at an interactive prompt reads ALIVE forever,
+    # and behind a still-DRAFT PR (never handed off -- nothing else will ever
+    # move it) the ALIVE defer above is an infinite one (observed on
+    # fahera-mx/studio.alissa.app#1121: 31+ hours behind draft PR #1123,
+    # one stalled page, then silence). With a positive value, an ALIVE
+    # session whose lane is otherwise RESUMABLE (exactly the `_resumable_pr`
+    # admission -- still a draft, no reviewer, self-authored, daemon-shaped
+    # head, a body that CLOSES the issue) and whose activity footprint -- the
+    # NEWEST of the ledger row's spawn, the PR's last update, and the head
+    # commit's date -- is older than this many minutes is killed (the ledger
+    # row's own session name, the same `alissa tmux kill` a healthy handoff
+    # ends with), so the next pass reads it DEAD and the ordinary resume path
+    # above takes over as attempt k+1, counting toward attempt_cap like any
+    # resume. 0 (the default) DISABLES it: absent or 0 preserves the ALIVE
+    # defer bit for bit, so a deployment opts in explicitly. Never fires on
+    # INDETERMINATE (absence of evidence keeps the defer), never on a PR that
+    # left draft or has a reviewer engaged, and never with resume_enabled
+    # false (a kill whose resume cannot fire would only orphan the lane).
+    # Floored at stale_minutes: a wedge window shorter than the staleness
+    # window is a misconfiguration (the branch this runs on is only reached
+    # past stale_minutes), so `build()` clamps it up and warns rather than
+    # failing the boot. Read `wedge_seconds`, which applies the same floor,
+    # never this field.
+    wedge_minutes: int = 0
+
     # The wedge self-heal (issue #61): the fix edge's crash-recovery net under
     # FIX_DIRECTIVE's terminal step. A fix session that posted its triage
     # replies and PUSHED, then died before re-requesting review, leaves the PR
@@ -642,6 +673,22 @@ class Config:
         ready-and-request a draft opened seconds ago on a default config."""
         return (self.orphan_grace_minutes or self.stale_minutes) * 60
 
+    @property
+    def wedge_seconds(self) -> int:
+        """The activity-footprint window behind which an ALIVE session on a
+        resumable draft is killed for resume, in seconds -- 0 means the wedge
+        path is OFF. Read this, never the raw field: unlike the grace knobs
+        above, 0 here is not a sentinel for the stale window but the OFF
+        switch, and a positive value is floored at stale_minutes (the branch
+        this gates is only reached past the stale window, so a shorter
+        window would fire on its first evaluation). `build()` already clamps
+        the field and warns; the floor is applied again here so a Config
+        assembled without `build()` (tests, `dataclasses.replace`) can never
+        read a window below the staleness one."""
+        if self.wedge_minutes <= 0:
+            return 0
+        return max(self.wedge_minutes, self.stale_minutes) * 60
+
     @property
     def janitor_grace_seconds(self) -> int:
         """How long an anchor must have been terminal before its workspace may
@@ -904,6 +951,30 @@ class Config:
                 f"got {orphan_grace}"
             )
 
+        # The wedge window (issue #110). 0 is the OFF switch, not a fallback
+        # sentinel, so the floor is 0 -- a negative value is the only invalid
+        # one. A positive value below stale_minutes is a misconfiguration
+        # (the wedge branch is only reached past the stale window), but not
+        # one worth failing the boot over: clamp it up to stale_minutes and
+        # say so, exactly as the issue's contract asks.
+        wedge = int(raw.get("wedge_minutes", cls.wedge_minutes))
+        if wedge < 0:
+            raise ValueError(
+                f"wedge_minutes must be >= 0 (0 = wedge detection off), "
+                f"got {wedge}"
+            )
+        if 0 < wedge < stale:
+            log.warning(
+                "wedge_minutes=%d is below stale_minutes=%d — a wedge window "
+                "shorter than the staleness window cannot be honoured (the "
+                "wedge branch is only reached past the stale window); "
+                "clamping wedge_minutes up to %d",
+                wedge,
+                stale,
+                stale,
+            )
+            wedge = stale
+
         # The janitor's grace, the reaper's sentinel one rung longer (0 = use
         # reap_grace_minutes). Negative is the only invalid value, and it is
         # the dangerous one: it would license reclaiming a workspace the
@@ -999,6 +1070,7 @@ class Config:
             resume_enabled=bool(
                 raw.get("resume_enabled", cls.resume_enabled)
             ),
+            wedge_minutes=wedge,
             rerequest_enabled=bool(
                 raw.get("rerequest_enabled", cls.rerequest_enabled)
             ),

{alissa_tools_github_devloop-0.8.17 → alissa_tools_github_devloop-0.8.19}/src/main/alissa/tools/github/devloop/ghclient.py

@@ -146,6 +146,16 @@ class PullRequest:
     # base nobody observed. Defaulted like node_id and closed_at -- the edges
     # that only spawn never ask.
     base_ref: str = ""
+    # When GitHub last touched this PR (`updated_at`), unix seconds; None when
+    # the payload carried no readable stamp. GitHub bumps it on every event
+    # that lands on the PR -- a push to the head branch (synchronize), an
+    # edit, a comment, a label, a review -- so it is the cheapest upper bound
+    # on "when did anything last happen here". The issue edge's wedge
+    # detection (issue #110) reads it as one leg of the activity footprint
+    # behind an ALIVE session; it rides the `pull_request()` fetch the resume
+    # probe already pays. Defaulted like the fields above it: the other edges
+    # and their fakes never ask.
+    updated_at: "int | None" = None
 
     @property
     def full_name(self) -> str:
@@ -201,6 +211,7 @@ def _pull_request_from(
         node_id=data.get("node_id") or "",
         closed_at=parse_github_timestamp(data.get("closed_at")),
         base_ref=base.get("ref") or "",
+        updated_at=parse_github_timestamp(data.get("updated_at")),
     )
 
 

{alissa_tools_github_devloop-0.8.17 → alissa_tools_github_devloop-0.8.19}/src/main/alissa/tools/github/devloop/loop.py

@@ -27,11 +27,15 @@ and the merge, a finished session's PR sits open for the whole review loop.
 DEAD alone would therefore fire on the modal happy path. So the resume takes
 a FOURTH signal from the PR the session left behind: the handoff publishes
 itself (`gh pr ready` flips the draft off, then the re-request puts a
-reviewer on it), which makes a PR that is STILL A DRAFT with NO reviewer
-requested the one state that says "this session never handed off". That test
-also keeps the edges disjoint -- the moment a PR leaves draft it belongs to
-the review lifecycle and the fix edge owns it exclusively, so no `develop-*`
-resume can land on a branch a `fix-*` session is already working.
+reviewer on it), which makes a PR that is STILL A DRAFT the one state that
+says "this session never handed off" -- whatever reviewer is on it, because
+a review request on a draft publishes nothing (the reviewer daemon only
+reviews non-draft PRs and the fix edge refuses drafts, so nothing downstream
+can ever move a draft; studio.alissa.app#1204 sat 80 minutes behind exactly
+that shape). That test also keeps the edges disjoint -- the moment a PR
+leaves draft it belongs to the review lifecycle and the fix edge owns it
+exclusively, so no `develop-*` resume can land on a branch a `fix-*` session
+is already working.
 
 The signals so far all describe the PR's STATE, and a sibling task's young
 draft satisfies every one of them; a cross-reference is raised by ANY mention
@@ -72,6 +76,30 @@ behind `resume_enabled`: that switch gates an ACTION the daemon gained, and
 turning it off restores a conservative legacy; this is a guard against a
 DOUBLE SPAWN, and no version of "off" for it is safe.
 
+ALIVE has a blind spot of its own: liveness measures session EXISTENCE, not
+work. A worker wedged at an interactive prompt is a live process and a dead
+worker, and it reads ALIVE forever. Behind a handed-off PR that is harmless
+(the review lifecycle moves the PR, and the reaper collects the session once
+the PR is terminal), but behind a STILL-DRAFT PR nothing else will ever move
+it: pre-handoff the dev session owns the pace, the "review loop can outlast
+stale_minutes" rationale does not apply, and the deferral above is infinite
+(studio.alissa.app#1121 sat 31+ hours behind draft PR #1123, paged once,
+then silence). So the issue edge has an OPT-IN fifth signal on exactly that
+branch -- ALIVE, and `_resumable_pr` admits the PR -- an ACTIVITY FOOTPRINT:
+the newest of the ledger row's spawn, the PR's last update, and the head
+commit's date. A footprint older than `wedge_minutes` (0 = off, the default)
+is a session that exists and does nothing, and the daemon KILLS it -- the
+ledger row's own session name only, the same `alissa tmux kill` a healthy
+handoff ends with -- so the next pass reads it DEAD and the ordinary resume
+above takes over as attempt k+1, counting toward attempt_cap like any
+resume. Nothing about the kill is new machinery on the resume side: it
+manufactures the one signal the matrix already acts on. The invariants are
+the matrix's own -- never on INDETERMINATE (absence of evidence keeps the
+defer), never on a PR that left draft (the wedge sits strictly behind
+`_resumable_pr`), never with `resume_enabled` false (a
+kill whose resume cannot fire would only orphan the lane), and never a
+roster sweep.
+
 The same pass then runs the REVIEW-RESPONSE edge (fix_rounds_enabled): open
 PRs authored by the token identity whose newest substantive review verdict is
 request_changes, with no pending re-request and no push since that review --
@@ -149,7 +177,9 @@ self-heal needs an unanswered review, and the issue-edge resume keys off an
 OPEN labeled issue, which a draft replayed after its issue merged does not
 have (fahera-mx/studio.alissa.app#279, 2026-07-28: an operator found it by
 accident). So the PR search is widened to drafts and every draft is asked the
-handoff question instead of being skipped: self-authored, no reviewer on it,
+handoff question instead of being skipped: self-authored (a reviewer already
+requested on it is NOT a reason to skip -- a request on a draft arms nothing,
+so the sweep readies it and requests only the reviewers still missing),
 a daemon-shaped head ref naming an implementation task (a `TASK-<n>-<DESC>`
 branch or a task ref in the body -- the provenance test, `closes_issue`'s
 role here), no live worker session for the PR (the SAME liveness rule --
@@ -717,8 +747,9 @@ RESUME_DIRECTIVE = (
     "previous developer session on GitHub issue {issue_url} died AFTER "
     "opening its pull request but BEFORE handing it off for review — the "
     "daemon confirmed its session `{dead_session}` is gone from the machine, "
-    "and its DRAFT pull request {pr_url} is still open with no reviewer on "
-    "it. This is attempt {attempt} of {cap}, and your job is to FINISH THAT "
+    "and its DRAFT pull request {pr_url} is still open (a reviewer may "
+    "already be requested on it — that is not a handoff; the ready flip is). "
+    "This is attempt {attempt} of {cap}, and your job is to FINISH THAT "
     "PULL REQUEST, not to start the work over. "
     "{task_instruction} "
     "FIRST hydrate the context you did not live through: read the issue (its "
@@ -1046,14 +1077,24 @@ ACTIVITY_REREQUESTED = "re-requested"
 # including the one that wrote it.
 ACTIVITY_HANDED_OFF = "handed off"
 
+# The activity-log context prefix for a wedge kill (see ESCALATION_WEDGED).
+# Non-spawn like the three above, and more so: the line records that the
+# lane's session was KILLED, the exact opposite of a running session. A reader
+# that took it for a spawn claim would park the lane behind a phantom for up
+# to a stale_minutes window -- against a peer instance during an overlapping
+# deploy, or this daemon after ledger loss, the cases external_claim exists
+# for -- delaying the very resume the kill was issued to unblock.
+ACTIVITY_WEDGE_KILLED = "wedge-killed"
+
 # Line contexts that record something OTHER than a spawn. `activity_claims`
 # skips them: a claim is a promise that a session is running on the lane, and
-# neither a capacity deferral, a mechanical re-request, nor a mechanical
-# handoff makes one.
+# neither a capacity deferral, a mechanical re-request, a mechanical handoff,
+# nor a wedge kill makes one.
 ACTIVITY_NON_SPAWN = (
     ACTIVITY_DEFERRED,
     ACTIVITY_REREQUESTED,
     ACTIVITY_HANDED_OFF,
+    ACTIVITY_WEDGE_KILLED,
 )
 
 # The reader's grammar for a line `_activity_line` wrote: bullet, UTC
@@ -1110,6 +1151,16 @@ ESCALATION_FIX_STALLED = "fix-stalled"
 # neither ping may silence the other.
 ESCALATION_LIVE_STALLED = "live-stalled"
 
+# The wedge kill's once-per-episode marker (see wedge_kind). Not an operator
+# page -- the daemon acted instead of asking -- but, like ESCALATION_REREQUEST,
+# a once-per-key act the `escalations` table is the ledger of: it dedupes the
+# activity-comment line (a kill that has to be repeated must not grow the
+# comment by one line per poll) and it is what the loop-events emitter turns
+# into an `escalation.wedged` event. The KILL itself is never deduped on it:
+# a session that survives its kill is still wedged, and re-killing it every
+# poll is the remedy, not a bug.
+ESCALATION_WEDGED = "wedged"
+
 # The maintenance edge's cap-out kind prefix. The `maintain-` prefix keeps
 # rows from ever colliding with the issue edge's `cap` when an issue and a
 # PR share a number; the epoch suffix is maintain_cap_kind's job below.
@@ -1425,6 +1476,17 @@ def live_stalled_kind(attempt: int) -> str:
     return f"{ESCALATION_LIVE_STALLED}:a{attempt}"
 
 
+def wedge_kind(attempt: int) -> str:
+    """The ledger kind for ONE wedge-kill episode's activity line.
+
+    stalled_kind's episode reasoning again: every attempt can wedge behind
+    its own draft, and attempt k's row must not silence attempt k+1's line.
+    Only the activity line is keyed on it -- the kill is repeated whenever
+    the footprint still warrants it (see ESCALATION_WEDGED).
+    """
+    return f"{ESCALATION_WEDGED}:a{attempt}"
+
+
 def deferral_activity_kind(session: str) -> str:
     """The activity-log kind that dedupes ONE capacity-deferral episode's line.
 
@@ -2356,9 +2418,10 @@ def activity_claims(body: str, now: "float | None" = None) -> "list[ActivityClai
     Spawn records only: a capacity-deferral line explicitly claims nothing (no
     self-assign, no ledger row, no session -- see _spawn's gate), and neither
     does a mechanical re-request (it completes a DEAD session's protocol; no
-    session is running afterwards), so reading either as a claim would let an
-    instance park the lane against everybody including itself. The context
-    field is what tells them apart -- see ACTIVITY_NON_SPAWN.
+    session is running afterwards) nor a wedge kill (it records that the
+    lane's session was just KILLED), so reading any of them as a claim would
+    let an instance park the lane against everybody including itself. The
+    context field is what tells them apart -- see ACTIVITY_NON_SPAWN.
 
     Everything else fails open, one line at a time: a line that does not match
     the grammar, or whose stamp is not an instant, or whose stamp is
@@ -2573,11 +2636,16 @@ class DevWatcher:
         # the session behind the open PR is not running -- but NOT that it was
         # abandoned, because a healthy handoff ends in `alissa tmux kill`. So
         # DEAD only opens the question, and `_resumable_pr` answers it: a
-        # still-draft, no-reviewer PR that CLOSES this issue is one of this
+        # still-draft PR that CLOSES this issue (a reviewer on the draft
+        # changes nothing -- a draft is never handed off) is one of this
         # issue's own sessions that was never handed off, and it
         # is the one case the deferral was always wrong about -- resumed as
         # attempt k+1 with RESUME_DIRECTIVE instead of parking the lane behind
-        # an operator ping. Everything else -- ALIVE, INDETERMINATE, and DEAD
+        # an operator ping. (When the orphan sweep is on it runs EARLIER in
+        # the same pass and readies such a draft mechanically, so the fetch
+        # here sees a non-draft PR and defers -- the sweep's handoff wins
+        # over a resume without any coordination between the edges.)
+        # Everything else -- ALIVE, INDETERMINATE, and DEAD
         # behind a PR already in the review lifecycle -- keeps the floored
         # defer: past STALLED_DEFER_MULTIPLE stale windows it posts a
         # "stalled" operator comment (this deferral sits above the cap check,
@@ -2607,6 +2675,32 @@ class DevWatcher:
                 liveness = self.session_liveness(row_session, roster)
                 if self.config.resume_enabled and liveness is Liveness.DEAD:
                     resume_pr = self._resumable_pr(issue, linked)
+                elif (
+                    self.config.resume_enabled
+                    and self.config.wedge_seconds
+                    and liveness is Liveness.ALIVE
+                    and row_session
+                ):
+                    # Wedge detection (issue #110), the opt-in escape from
+                    # the infinite ALIVE defer. Reached ONLY on ALIVE -- a
+                    # SUCCESSFUL listing that carries the row's own name --
+                    # never on INDETERMINATE, whose absence of evidence keeps
+                    # the defer exactly as the Liveness docstring argues.
+                    # `_wedge_candidate` sits strictly behind `_resumable_pr`
+                    # (a handed-off PR belongs to the review lifecycle) and
+                    # then asks the one question liveness cannot: has this
+                    # lane shown ANY activity inside the wedge window? If
+                    # not, the session is killed here and nothing else
+                    # happens this pass: the next pass reads it DEAD and the
+                    # ordinary resume branch above does the rest. A fresh
+                    # footprint, or a footprint that cannot be read, falls
+                    # through to the floored defer below, unchanged.
+                    wedged = self._wedge_candidate(issue, linked, age)
+                    if wedged is not None:
+                        wedged_pr, footprint = wedged
+                        return self._kill_wedged(
+                            issue, attempts, row_session, wedged_pr, footprint
+                        )
                 if resume_pr is not None:
                     # Fall through to the cap check and the spawn below: a
                     # resume is an ORDINARY attempt (it counts toward
@@ -2626,9 +2720,9 @@ class DevWatcher:
                     # an operator reading the log must not have to guess.
                     why = (
                         "no linked PR is resumable (a handed-off PR — out of "
-                        "draft, or with a reviewer engaged — belongs to the "
-                        "review lifecycle, not to a resume; and a PR that "
-                        "only MENTIONS this issue is another task's work)"
+                        "draft — belongs to the review lifecycle, not to a "
+                        "resume; a PR that only MENTIONS this issue is "
+                        "another task's work)"
                         if liveness is Liveness.DEAD
                         and self.config.resume_enabled
                         else "work may be alive (the review loop can outlast "
@@ -2998,12 +3092,23 @@ class DevWatcher:
 
         What separates the two is the PR the session left behind, because the
         handoff PUBLISHES itself: `gh pr ready` flips the draft off, then the
-        re-request puts a reviewer on it. So a PR that is STILL A DRAFT with
-        NO reviewer requested is one its session never handed off -- the only
-        state a resume is owed. (A session that died in the narrow window
-        between the ready flip and the re-request reads handed-off and keeps
-        the legacy floored defer: conservative on purpose, since that is also
-        exactly what a live review loop looks like from here.)
+        re-request puts a reviewer on it. So a PR that is STILL A DRAFT is one
+        its session never handed off -- the only state a resume is owed --
+        and a reviewer requested on that draft does not change the reading: a
+        request on a draft arms nothing (the reviewer daemon reviews only
+        non-draft PRs, the fix edge refuses drafts), so no automation
+        downstream can ever move it. The two half-states a session can die in
+        are therefore read differently: (a) READY + NO reviewer -- the ready
+        flip landed, the request did not -- reads handed-off here and keeps
+        the legacy floored defer, conservative on purpose since that is also
+        exactly what a live review loop looks like from this edge; where this
+        daemon's own sweep made that flip, the `orphan-ready@<head>` row lets
+        the PR edge's `_finish_orphan_handoff` complete it. (b) DRAFT +
+        reviewer -- the request landed, the flip did not (studio#1204: 80
+        minutes behind a draft with `alissa-app` on it) -- is resumable when
+        the session is DEAD, exactly like a review-less draft, and deferred
+        while ALIVE; with the orphan sweep on, that sweep readies it earlier
+        in the same pass, so the resume yields to the mechanical handoff.
 
         That same test settles the cross-edge race: the moment a PR leaves
         draft it belongs to the review lifecycle, and the fix edge -- which
@@ -3080,16 +3185,24 @@ class DevWatcher:
             # still a PR whose base can strand it, and the guard's own author
             # test is what keeps it off PRs that are not ours.
             self._check_stacked_base(pr)
-            if not pr.draft or pr.requested_reviewers:
+            if not pr.draft:
                 log.info(
-                    "%s: %s has been handed off (draft=%s, reviewers=%s) — "
-                    "not a resume candidate; the review lifecycle owns it",
+                    "%s: %s has been handed off (out of draft, reviewers=%s) "
+                    "— not a resume candidate; the review lifecycle owns it",
                     issue.issue_slug,
                     url,
-                    pr.draft,
                     ", ".join(pr.requested_reviewers) or "none",
                 )
                 continue
+            if pr.requested_reviewers:
+                log.info(
+                    "%s: %s is still a DRAFT with %s requested — a review "
+                    "request on a draft is not a handoff (the ready flip is), "
+                    "so this PR is a resume candidate",
+                    issue.issue_slug,
+                    url,
+                    ", ".join(pr.requested_reviewers),
+                )
             if pr.author != self.github.login:
                 log.warning(
                     "%s: %s is authored by %r, not the developer identity — "
@@ -3167,6 +3280,206 @@ class DevWatcher:
         )
         return False
 
+    def _wedge_candidate(
+        self, issue: Issue, linked: "list[str]", spawn_age: float
+    ) -> "tuple[PullRequest, float] | None":
+        """The wedge decision's evidence: the one resumable PR behind this
+        ALIVE session and the age of the lane's activity footprint, or None
+        when the lane must keep its defer.
+
+        Two gates, in order. First `_resumable_pr`, verbatim -- the wedge
+        path inherits every admission test the resume has (still a draft,
+        self-authored, daemon-shaped head, a body that CLOSES this issue,
+        exactly one candidate; a reviewer requested on the draft is not a
+        handoff and does not exclude it), because the kill it licenses is
+        only safe where the resume that follows it is: a PR that has left
+        draft belongs to the review lifecycle, and a live review loop behind
+        an ALIVE session is the healthy shape this daemon was built around.
+        Then the footprint (`_footprint_age`):
+        None means unreadable, and unreadable keeps the defer -- the same
+        fail-safe every other presumed-dead decision here makes.
+
+        Cost: nothing beyond what the DEAD branch already pays for the same
+        lane -- `_resumable_pr`'s one GET per linked PR -- except the head
+        commit fetch, which `_footprint_age` only makes once the cheap legs
+        have already run past the window."""
+        pr = self._resumable_pr(issue, linked)
+        if pr is None:
+            return None
+        footprint = self._footprint_age(pr, spawn_age)
+        if footprint is None:
+            return None
+        window = self.config.wedge_seconds
+        if footprint < window:
+            log.debug(
+                "%s: session behind draft PR %s reads alive with a footprint "
+                "%.0f min old (wedge window %d min) — not wedged",
+                issue.issue_slug,
+                pr.url,
+                footprint / 60,
+                window // 60,
+            )
+            return None
+        return pr, footprint
+
+    def _footprint_age(
+        self, pr: PullRequest, spawn_age: float
+    ) -> "float | None":
+        """How long ago this lane last showed ANY activity, in seconds: the
+        YOUNGEST of the ledger row's spawn, the PR's last update, and the
+        head commit's committer date. None when that cannot be established.
+
+        The three legs are the three places a working session leaves a
+        mark. The spawn is the floor (a session younger than the window
+        cannot be wedged yet -- it is still starting). `updated_at` is
+        GitHub's own "anything happened here" stamp: it moves on every push
+        to the head (synchronize), every edit, comment, label and review,
+        and it rides the `pull_request()` fetch the resume probe already
+        paid, so on the common path the footprint costs no call at all. The
+        head commit's date is the third leg, read only once the first two
+        have ALREADY run past the window: it is redundant with `updated_at`
+        on every push GitHub saw, so paying for it while the cheap legs
+        still prove activity would be a per-poll GET for a question already
+        answered. Where it IS read it is the last word before a kill, and
+        an unreadable commit (CommandError, or a payload with no date)
+        answers None rather than "old" -- the daemon does not kill a
+        session over evidence it could not read. RateLimited is NOT caught:
+        like every other GitHub call in the pass it belongs to run_forever's
+        backoff."""
+        now = time.time()
+        youngest = spawn_age
+        if pr.updated_at is not None:
+            youngest = min(youngest, max(0.0, now - pr.updated_at))
+        if youngest < self.config.wedge_seconds:
+            return youngest
+        try:
+            committed = self.github.commit_time(pr.owner, pr.repo, pr.head_sha)
+        except CommandError as exc:
+            log.warning(
+                "wedge: could not read the head commit date of %s (%s) — "
+                "the footprint cannot be established, so the session keeps "
+                "its defer this poll",
+                pr.pr_slug,
+                exc,
+            )
+            return None
+        if committed is None:
+            log.warning(
+                "wedge: head commit %s of %s carries no readable date — the "
+                "footprint cannot be established, so the session keeps its "
+                "defer this poll",
+                pr.head_sha[:8],
+                pr.pr_slug,
+            )
+            return None
+        return min(youngest, max(0.0, now - committed))
+
+    def _kill_wedged(
+        self,
+        issue: Issue,
+        attempts: int,
+        session: str,
+        pr: PullRequest,
+        footprint: float,
+    ) -> Decision:
+        """Kill the ledger row's own session so the next pass can resume
+        the lane, and say so everywhere an operator would look.
+
+        The kill is the daemon's own session-kill machinery -- one `alissa
+        tmux kill <name>` on exactly the row's recorded name, the same act a
+        healthy handoff ends with, never a roster sweep. It is the ONLY side
+        effect this pass has on the lane: no assignment changes, no ledger
+        row is written for an attempt, nothing is enqueued. The decision
+        stays IN_FLIGHT -- the lane is still deferred behind its draft --
+        and what changes is the NEXT evaluation: a successful listing
+        without this name reads DEAD, `_resumable_pr` admits the same PR
+        it admitted here, and the ordinary resume spawns attempt k+1 (or,
+        at the cap, pages the operator exactly as any resume would). A
+        kill that fails is logged and the defer holds; the next poll makes
+        the same decision and tries again, which is the remedy for a
+        session that will not die, not a loop to guard against.
+
+        The activity comment gets ONE line per episode (keyed
+        wedge_kind(attempts)), recorded only after the line lands so a
+        transient failure retries -- the comment is the cross-actor record
+        of why this session vanished, and the recorded row is what the
+        loop-events emitter turns into `escalation.wedged`. Every side
+        effect honours dry_run."""
+        minutes = int(footprint / 60)
+        window = self.config.wedge_seconds // 60
+        log.warning(
+            "wedged: alive session %s with no footprint for %d min behind "
+            "draft PR #%d (%s) — killed for resume (%s attempt %d; wedge "
+            "window %d min; the next pass reads it dead and resumes as "
+            "attempt %d, counting toward attempt_cap %d)",
+            session,
+            minutes,
+            pr.number,
+            pr.url,
+            issue.issue_slug,
+            attempts,
+            window,
+            attempts + 1,
+            self.config.attempt_cap,
+        )
+        reason = (
+            f"attempt {attempts} is wedged: its session {session} reads alive "
+            f"but the lane's activity footprint is {minutes} min old (wedge "
+            f"window {window} min) behind still-draft PR {pr.url} — "
+        )
+        if self.config.dry_run:
+            log.info("[dry-run] would kill wedged session %s", session)
+            return Decision(
+                Action.IN_FLIGHT,
+                reason + "[dry-run] would kill it for resume",
+                attempts,
+                session=session,
+                defer_token=loop_events_mod.DEFER_IN_FLIGHT,
+            )
+        try:
+            self.alissa.kill_session(session)
+        except CommandError as exc:
+            log.warning(
+                "wedge: could not kill %s (%s) — kills are best-effort; the "
+                "lane keeps its defer and the kill is retried next poll",
+                session,
+                exc,
+            )
+            return Decision(
+                Action.IN_FLIGHT,
+                reason + f"the kill failed ({exc}); deferring",
+                attempts,
+                session=session,
+                defer_token=loop_events_mod.DEFER_IN_FLIGHT,
+            )
+        kind = wedge_kind(attempts)
+        if not self.state.escalated(issue.full_name, issue.number, kind):
+            landed = self._append_activity(
+                issue.owner,
+                issue.repo,
+                issue.number,
+                self._activity_line(
+                    session,
+                    "issue edge",
+                    f"{ACTIVITY_WEDGE_KILLED} — the session read alive but the lane's "
+                    f"activity footprint (spawn / last head commit / last PR "
+                    f"update) was {minutes} min old behind still-draft PR "
+                    f"{pr.url}; killed so the next pass resumes it as attempt "
+                    f"{attempts + 1}",
+                ),
+                issue.issue_slug,
+            )
+            if landed:
+                self.state.record_escalation(issue.full_name, issue.number, kind)
+        return Decision(
+            Action.IN_FLIGHT,
+            reason + f"killed for resume; the next pass reads it dead and "
+            f"resumes as attempt {attempts + 1}",
+            attempts,
+            session=session,
+            defer_token=loop_events_mod.DEFER_IN_FLIGHT,
+        )
+
     def _escalate_rejection(self, issue: Issue, exc: AssignmentRejected) -> Decision:
         """Escalate-don't-retry: a silently dropped assignment is a permanent,
         operator-fixable condition (push access), and without the in-flight
@@ -4178,17 +4491,18 @@ class DevWatcher:
                 f"identity — not this daemon's to hand off",
             )
 
-        # A draft already carrying a review request is not unhanded-off: a
-        # session (or a human) put a reviewer on it deliberately and simply has
-        # not flipped it ready. Nothing here is owed, and readying it would
-        # take that decision away from whoever made it.
-        if pr.requested_reviewers:
-            return Decision(
-                Action.SKIPPED,
-                f"draft already carries a review request "
-                f"({', '.join(pr.requested_reviewers)}) — its handoff is "
-                f"someone's deliberate work in progress, not an orphan",
-            )
+        # A draft already carrying a review request is NOT excluded (issue
+        # #113). The sweep used to read a reviewer on a draft as someone's
+        # deliberate work in progress, but a request on a draft arms nothing
+        # -- the reviewer daemon reviews only non-draft PRs and the fix edge
+        # refuses drafts -- and the issue edge read the same shape as "handed
+        # off", so a session that died between its `--add-reviewer` and its
+        # `gh pr ready` (studio.alissa.app#1204: 80 minutes of silence after
+        # a 10-hour attempt) left a draft NO edge would ever move. The
+        # liveness gate below is what protects a deliberately-parked draft:
+        # a live session behind it is never swept, and for a DEAD one the
+        # sweep does the FIRST half only -- the ready flip -- and requests
+        # just the configured reviewers that are not already on the PR.
 
         # head_ref reaches nothing but log lines here (the sweep spawns no
         # session, so it never becomes a worktree path or a shell token), but
@@ -4523,36 +4837,64 @@ class DevWatcher:
           not retried on this head (escalate-don't-retry, `_escalate_rejection`
           verbatim).
 
+        A draft that ALREADY carries a review request (issue #113) takes the
+        same walk minus the request: the session died between its
+        `--add-reviewer` and its `gh pr ready`, so the flip is the only act
+        still owed. `request_reviews` is skipped entirely when every
+        configured reviewer is already on the PR -- re-requesting an
+        already-requested reviewer is a no-op on GitHub, but it must not be
+        recorded as a fresh request -- and requests only the missing ones
+        otherwise. Both ledger rows still land, so the once-per-(PR, head)
+        guarantee and `_owes_orphan_handoff` keep holding on this shape.
+
         The activity line comes LAST and stays best-effort: it is telemetry
         about acts that have already happened, and it is written as a NON-SPAWN
         context because no session exists for it to claim a lane on behalf of.
         """
-        reviewers = self.config.reviewers
-        log.warning(
-            "ORPHAN DRAFT %s (%s): head %s has been public %.0f min, no "
-            "reviewer is requested, and no worker session for this PR is "
-            "listed — the session that opened it died before handing it off; "
-            "marking it ready and requesting %s mechanically (once per "
-            "PR/head)",
-            pr.pr_slug,
-            task_ref,
-            pr.head_sha[:8],
-            waited / 60,
-            ", ".join(reviewers),
-        )
+        already, missing = self._orphan_reviewers_split(pr)
+        if already:
+            log.warning(
+                "ORPHAN DRAFT %s (%s): head %s has been public %.0f min, %s "
+                "already requested on it, and no worker session for this PR "
+                "is listed — the session that opened it died after its "
+                "review request but before flipping it ready (a request on a "
+                "draft arms nothing); marking it ready mechanically%s (once "
+                "per PR/head)",
+                pr.pr_slug,
+                task_ref,
+                pr.head_sha[:8],
+                waited / 60,
+                ", ".join(already),
+                f" and requesting {', '.join(missing)}" if missing else "",
+            )
+        else:
+            log.warning(
+                "ORPHAN DRAFT %s (%s): head %s has been public %.0f min, no "
+                "reviewer is requested, and no worker session for this PR is "
+                "listed — the session that opened it died before handing it "
+                "off; marking it ready and requesting %s mechanically (once "
+                "per PR/head)",
+                pr.pr_slug,
+                task_ref,
+                pr.head_sha[:8],
+                waited / 60,
+                ", ".join(missing),
+            )
 
         if self.config.dry_run:
+            request = (
+                f"request {', '.join(missing)}"
+                if missing
+                else f"request nobody ({', '.join(already)} already requested)"
+            )
             log.info(
-                "[dry-run] would mark %s ready and request review from %s",
-                pr.pr_slug,
-                ", ".join(reviewers),
+                "[dry-run] would mark %s ready and %s", pr.pr_slug, request
             )
             return Decision(
                 Action.IN_FLIGHT,
                 f"[dry-run] would mechanically hand off draft head "
                 f"{pr.head_sha[:8]} (public {int(waited / 60)} min, its "
-                f"session gone): mark ready + request "
-                f"{', '.join(reviewers)}",
+                f"session gone): mark ready + {request}",
                 task_ref=task_ref,
             )
 
@@ -4582,6 +4924,28 @@ class DevWatcher:
 
         return self._request_orphan_reviewers(pr, task_ref, waited)
 
+    def _orphan_reviewers_split(
+        self, pr: PullRequest
+    ) -> "tuple[tuple[str, ...], tuple[str, ...]]":
+        """The configured reviewers, split by what the PR already carries:
+        (already requested, still missing), each in config order.
+
+        Casefolded like `_reviewer_reviews`: the configured set is
+        operator-typed and GitHub logins are case-insensitive, so `Alissa-App`
+        in the config and `alissa-app` on the PR are one reviewer, not a
+        missing one. Stated once because the sweep and the completion path
+        both need exactly this answer -- the request must never name a
+        reviewer who is already on the PR (a no-op on GitHub that would still
+        be recorded, and logged, as a fresh request)."""
+        on_pr = {r.casefold() for r in pr.requested_reviewers}
+        already = tuple(
+            r for r in self.config.reviewers if r.casefold() in on_pr
+        )
+        missing = tuple(
+            r for r in self.config.reviewers if r.casefold() not in on_pr
+        )
+        return already, missing
+
     def _owes_orphan_handoff(self, pr: PullRequest) -> bool:
         """Did THIS daemon ready this exact head and still owe it a reviewer?
 
@@ -4623,6 +4987,14 @@ class DevWatcher:
         entitled to finish its own handoff). Not re-run is the grace window --
         it was satisfied when the flip fired, and the head has not moved since
         (a moved head would be a different key with no ready row at all).
+
+        Reached only for a PR with NO pending request (evaluate_pr's own
+        guard sits above this). So a draft that already carried a reviewer
+        can never arrive here: it left draft carrying that reviewer, and the
+        pending-request guard reads it as in review. That is why
+        `_request_orphan_reviewers` never leaves that shape half-recorded --
+        a failed request for the MISSING reviewers there is given up on and
+        the handoff completed on the spot (round-1 review fix, PR #114).
         """
         if not self._owes_orphan_handoff(pr) or not self.config.reviewers:
             return None
@@ -4671,43 +5043,73 @@ class DevWatcher:
         this is the completion path (where that number is a poll or more old
         and would be reported as fact).
 
-        Failure handling mirrors `_rerequest_review`'s exactly: a
-        ReviewRequestRejected is permanent and operator-fixable (escalate,
-        don't retry, and never record the DONE marker); a CommandError is
-        transient (record nothing, retry next poll). The READY row stays in
-        both cases -- the flip really did happen, and re-flipping an
-        already-ready PR is not what the retry needs to do."""
-        reviewers = self.config.reviewers
-        try:
-            landed = self.github.request_reviews(
-                pr.owner, pr.repo, pr.number, reviewers
-            )
-        except ReviewRequestRejected as exc:
-            return self._escalate_orphan_rejected(pr, task_ref, exc)
-        except CommandError as exc:
-            log.error(
-                "could not request review from %s on %s: %s — NOT recording "
-                "the handoff; the sweep retries next poll",
-                ", ".join(reviewers),
-                pr.pr_slug,
-                exc,
-            )
-            return Decision(
-                Action.SKIPPED,
-                f"the PR was marked ready but the review request did not land "
-                f"({exc}) — transient; not recorded, retrying next poll",
-                task_ref=task_ref,
-            )
+        Only the configured reviewers NOT already on the PR are requested
+        (`_orphan_reviewers_split`, issue #113). When every one of them is
+        already requested -- the draft the session put a reviewer on before
+        dying, or a completion-path PR someone requested by hand between
+        polls -- no call is made at all: the DONE marker lands, the activity
+        line says who was already there, and the reviewer daemon already sees
+        the PR.
+
+        Failure handling on the review-less shape mirrors
+        `_rerequest_review`'s exactly: a ReviewRequestRejected is permanent
+        and operator-fixable (escalate, don't retry, and never record the
+        DONE marker); a CommandError is transient (record nothing, retry next
+        poll). The READY row stays in both cases -- the flip really did
+        happen, and re-flipping an already-ready PR is not what the retry
+        needs to do.
+
+        On the PARTIAL shape -- some configured reviewers already on the PR,
+        the call carrying only the missing rest -- neither doctrine applies
+        (round-1 review fix, PR #114). `request_reviews` raises only when
+        nothing in THAT call landed, which here does not mean nobody is on
+        the PR: the flip landed and `already` is requested, so the PR is in
+        review and the reviewer daemon sees it. The refusal page would be
+        false ("never marked ready or sent to a reviewer"), and a retry is
+        structurally impossible: next poll the pending-request guard in
+        evaluate_pr reads the PR as in review before `_finish_orphan_handoff`
+        is reached, so a ready row left down would stick on that head
+        forever. So a failed request for the missing subset, permanent or
+        transient, is logged as given up on -- naming who IS on the PR --
+        and the handoff is completed: DONE row, activity line."""
+        already, missing = self._orphan_reviewers_split(pr)
+        landed: tuple[str, ...] = ()
+        if missing:
+            try:
+                landed = self.github.request_reviews(
+                    pr.owner, pr.repo, pr.number, missing
+                )
+            except ReviewRequestRejected as exc:
+                if not already:
+                    return self._escalate_orphan_rejected(pr, task_ref, exc)
+                self._log_orphan_reviewers_given_up(pr, missing, already, exc)
+            except CommandError as exc:
+                if not already:
+                    log.error(
+                        "could not request review from %s on %s: %s — NOT "
+                        "recording the handoff; the sweep retries next poll",
+                        ", ".join(missing),
+                        pr.pr_slug,
+                        exc,
+                    )
+                    return Decision(
+                        Action.SKIPPED,
+                        f"the PR was marked ready but the review request "
+                        f"did not land ({exc}) — transient; not recorded, "
+                        f"retrying next poll",
+                        task_ref=task_ref,
+                    )
+                self._log_orphan_reviewers_given_up(pr, missing, already, exc)
 
-        dropped = tuple(r for r in reviewers if r not in landed)
-        if dropped:
-            log.warning(
-                "%s: GitHub silently dropped reviewer(s) %s from the "
-                "mechanical handoff; %s landed, so the PR IS in review",
-                pr.pr_slug,
-                ", ".join(dropped),
-                ", ".join(landed),
-            )
+            dropped = tuple(r for r in missing if r not in landed)
+            if dropped and landed:
+                log.warning(
+                    "%s: GitHub silently dropped reviewer(s) %s from the "
+                    "mechanical handoff; %s landed, so the PR IS in review",
+                    pr.pr_slug,
+                    ", ".join(dropped),
+                    ", ".join(landed + already),
+                )
 
         self.state.record_escalation(
             pr.full_name, pr.number, orphan_kind(pr.head_sha)
@@ -4717,6 +5119,23 @@ class DevWatcher:
             if waited is not None
             else ""
         )
+        if landed and already:
+            acted = (
+                f"marked ready and requested review from {', '.join(landed)} "
+                f"({', '.join(already)} already requested)"
+            )
+            died = "before handing it off"
+        elif landed:
+            acted = f"marked ready and requested review from {', '.join(landed)}"
+            died = "before handing it off"
+        else:
+            noun = "reviewer" if len(already) == 1 else "reviewers"
+            verb = "was" if len(already) == 1 else "were"
+            acted = (
+                f"marked ready ({noun} {', '.join(already)} {verb} already "
+                f"requested)"
+            )
+            died = "before flipping it"
         self._append_activity(
             pr.owner,
             pr.repo,
@@ -4724,22 +5143,51 @@ class DevWatcher:
             self._activity_line(
                 orphan_activity_lane(pr),
                 "orphan sweep",
-                f"{ACTIVITY_HANDED_OFF} — marked ready and requested review "
-                f"from {', '.join(landed)}; the session that opened this draft "
-                f"died before handing it off{age}, so the daemon completed its "
-                f"protocol (no session spawned, once per PR/head)",
+                f"{ACTIVITY_HANDED_OFF} — {acted}; the session that opened "
+                f"this draft died {died}, so the daemon completed its "
+                f"protocol{age} (no session spawned, once per PR/head)",
             ),
             pr.pr_slug,
         )
 
+        if landed:
+            requested = f"and review requested from {', '.join(landed)}"
+        else:
+            requested = (
+                f"(review already requested from {', '.join(already)}, no "
+                f"new request made)"
+            )
         return Decision(
             Action.IN_FLIGHT,
-            f"orphaned draft handed off — marked ready and review requested "
-            f"from {', '.join(landed)} for head {pr.head_sha[:8]}; the ball is "
-            f"in the reviewer's court",
+            f"orphaned draft handed off — marked ready {requested} for head "
+            f"{pr.head_sha[:8]}; the ball is in the reviewer's court",
             task_ref=task_ref,
         )
 
+    @staticmethod
+    def _log_orphan_reviewers_given_up(
+        pr: PullRequest,
+        missing: "tuple[str, ...]",
+        already: "tuple[str, ...]",
+        exc: Exception,
+    ) -> None:
+        """The partial shape's one failure path (see
+        `_request_orphan_reviewers`): the request for the configured
+        reviewers NOT yet on the PR failed, `already` IS on it, and no retry
+        can ever reach this PR again -- so the missing reviewers are given up
+        on, out loud, and the handoff completes with who is there."""
+        log.warning(
+            "%s: could not request review from %s on the mechanical handoff "
+            "(%s) — giving up on them: %s already requested and the PR is out "
+            "of draft, so it IS in review; the daemon will not retry (the "
+            "pending request reads as in review from here on), request them "
+            "by hand if wanted",
+            pr.pr_slug,
+            ", ".join(missing),
+            exc,
+            ", ".join(already),
+        )
+
     def _escalate_orphan_rejected(
         self, pr: PullRequest, task_ref: "str | None", exc: Exception
     ) -> Decision:

{alissa_tools_github_devloop-0.8.17 → alissa_tools_github_devloop-0.8.19}/src/main/alissa/tools/github/devloop/loop_events.py

@@ -122,8 +122,12 @@ _FOREIGN_RE = re.compile(r"^foreign-session:(.+)$")
 
 # Escalation kinds anchored on a repo ISSUE; everything else that names a
 # number names a PULL REQUEST (the fix/maintain/orphan/rerequest families all
-# key the PR number into the ledger's `issue` column).
-_ISSUE_ANCHORED = ("cap", "assignment", "stalled", "live-stalled")
+# key the PR number into the ledger's `issue` column). `wedged` is the issue
+# edge's wedge kill (loop.ESCALATION_WEDGED, recorded against the issue the
+# lane is working, not the draft PR behind it) -- PR and issue numbers share
+# GitHub's namespace, so a kind missing here does not merely mislabel, it
+# points the operator at an unrelated PR or at nothing.
+_ISSUE_ANCHORED = ("cap", "assignment", "stalled", "live-stalled", "wedged")
 
 
 def _ms(ts: "int | float | str") -> int:

alissa_tools_github_devloop-0.8.19/src/main/alissa/tools/github/devloop/version

@@ -0,0 +1 @@
+0.8.19

{alissa_tools_github_devloop-0.8.17 → alissa_tools_github_devloop-0.8.19/src/main/alissa_tools_github_devloop.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: alissa-tools-github-devloop
-Version: 0.8.17
+Version: 0.8.19
 Summary: ALISSA-TOOLS-GITHUB-DEVLOOP
 Home-page: https://alissa.app
 Author: Fahera

alissa_tools_github_devloop-0.8.17/src/main/alissa/tools/github/devloop/version

@@ -1 +0,0 @@
-0.8.17