alissa-tools-github-devloop 0.8.35__tar.gz → 0.8.37__tar.gz

{alissa_tools_github_devloop-0.8.35/src/main/alissa_tools_github_devloop.egg-info → alissa_tools_github_devloop-0.8.37}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: alissa-tools-github-devloop
-Version: 0.8.35
+Version: 0.8.37
 Summary: ALISSA-TOOLS-GITHUB-DEVLOOP
 Home-page: https://alissa.app
 Author: Fahera

{alissa_tools_github_devloop-0.8.35 → alissa_tools_github_devloop-0.8.37}/src/main/alissa/tools/github/devloop/fleet_vitals.py

@@ -36,6 +36,15 @@ The roster rule the contract cares most about: `sessions` and `sessionList`
 are `null` — not `{live: 0, managed: 0}` — when the listing could not be
 read. A machine whose tmux blinked is not an idle machine, and the Factory
 must be able to tell the two apart.
+
+Seat parking (issue #153, studio.alissa.app seat-parking design §2.2/§2.4)
+adds the `idle` block — the seat's own idle verdict (`parking.idle_block`),
+with `drainedAt` while a drain holds — so Studio can re-check a park against
+the seat's OWN snapshot. The console's drain pushes one snapshot before it
+answers (`FleetVitalsPusher.push_now`). Until Studio's schema carries the
+block (the design's lane L3), a strict 400 naming `idle` makes the pusher
+resend without it and leave it out for IDLE_REPROBE_S: the vitals the Factory
+already renders never go dark over a field nobody reads yet.
 """
 
 from __future__ import annotations
@@ -46,6 +55,7 @@ import time
 from datetime import datetime, timezone
 from typing import Callable, Mapping, Sequence
 
+from . import parking
 from .alissa_client import AlissaAuthError, AlissaClient, AlissaError
 from .config import Config
 from .version import version as running_version
@@ -74,6 +84,12 @@ PUSHED = "pushed"
 SKIPPED = "skipped"
 FAILED = "failed"
 
+# How long a snapshot leaves the `idle` block out after Studio refused it as
+# an unknown key (a schema that predates seat parking), before it offers the
+# block again. An hour: one extra POST an hour against an old Studio, and a
+# newly deployed one starts receiving the block within the hour.
+IDLE_REPROBE_S = 3600.0
+
 
 def _session_grammar() -> "Callable[[str], object]":
     """The daemon's own session-name parser, resolved late.
@@ -189,6 +205,8 @@ def build_snapshot(
     now: "float | int | None" = None,
     memory: "Mapping | None" = None,
     parse_session: "Callable[[str], object] | None" = None,
+    queued: "int | None" = None,
+    drain: "Mapping | None" = None,
 ) -> "dict":
     """The contract body for one pass, from the console's builders.
 
@@ -199,7 +217,12 @@ def build_snapshot(
     the `sysinfo.memory_usage` reading, taken by the caller so a test can
     hand in a fixture. Pure assembly over the sources: the only IO is what
     `Sources` does (state.db, `tmux list-panes` + `/proc` per live session,
-    the cached rate and PyPI reads)."""
+    the cached rate and PyPI reads).
+
+    `queued` (the undispatched alissa queue items, None when unread) and
+    `drain` (the holding drain row, or None) feed the `idle` block, whose
+    owed / timers come from the latest poll snapshot and whose live /
+    managed come from `roster` -- the same reading as `sessions`."""
     parse = parse_session or _session_grammar()
     now_ts = heartbeat_at if now is None else now
 
@@ -246,6 +269,12 @@ def build_snapshot(
             + int(latest.get("revert_candidates") or 0)
         )
 
+    roster_live, roster_managed = parking.roster_counts(roster)
+    idle = parking.idle_block(
+        latest, live=roster_live, managed=roster_managed, queued=queued,
+        drain=drain, now=now_ts,
+    )
+
     drift = sources.drift()
     return {
         "schemaVersion": SCHEMA_VERSION,
@@ -263,6 +292,7 @@ def build_snapshot(
         "queueDepth": queue_depth,
         "kpis": None,
         "inbox": inbox,
+        "idle": idle,
     }
 
 
@@ -321,6 +351,9 @@ class FleetVitalsPusher:
         self._memory = memory_reader
         self._clock = clock
         self._not_activated_warned = False
+        # Until when the `idle` block is left out (Studio refused it as an
+        # unknown key); 0 = offer it.
+        self._idle_refused_until = 0.0
         self.last: "dict | None" = None
 
     def push_pass(self, roster: "Sequence[Mapping] | None") -> str:
@@ -328,10 +361,26 @@ class FleetVitalsPusher:
         FAILED (the caller quotes it in the poll summary). A snapshot that
         cannot be BUILT is a failure too — one WARNING, nothing sent."""
         heartbeat = self._clock()
+        return self._push(roster, heartbeat, heartbeat)
+
+    def push_now(self, roster: "Sequence[Mapping] | None") -> str:
+        """The console's out-of-pass push (the drain handshake, issue #153):
+        the same snapshot, its `heartbeatAt` the daemon's LAST completed pass
+        (the console completes none of its own -- stamping now would read as
+        a heartbeat the loop never gave), `asOf` now. PUSHED or FAILED."""
+        snaps = self.sources.snapshots(1)
+        now = self._clock()
+        heartbeat = snaps[0]["ts"] if snaps else now
+        return self._push(roster, heartbeat, now)
+
+    def _push(
+        self, roster: "Sequence[Mapping] | None", heartbeat: float, now: float,
+    ) -> str:
         try:
             snapshot = fit_to_body_cap(build_snapshot(
                 self.sources, roster=roster, heartbeat_at=heartbeat,
-                memory=self._memory(),
+                now=now, memory=self._memory(),
+                queued=self.sources.queued(), drain=self.sources.drain(),
             ))
         except Exception as exc:
             log.warning(
@@ -339,9 +388,17 @@ class FleetVitalsPusher:
                 "pushed this pass; the next pass builds a fresh one", exc,
             )
             return FAILED
+        if now < self._idle_refused_until:
+            snapshot.pop("idle", None)
         self.last = snapshot
         return self._post(snapshot)
 
+    @staticmethod
+    def _refuses_idle(exc: AlissaError) -> bool:
+        """A 400 that names the `idle` key: a Studio whose strict schema
+        predates seat parking (the design's lane L3 adds the field)."""
+        return exc.status == 400 and "idle" in str(exc.detail)
+
     def _post(self, snapshot: "dict") -> str:
         try:
             self.client.post_fleet_vitals(snapshot)
@@ -352,6 +409,18 @@ class FleetVitalsPusher:
             self._warn_failed(exc)
             return FAILED
         except AlissaError as exc:
+            if "idle" in snapshot and self._refuses_idle(exc):
+                self._idle_refused_until = self._clock() + IDLE_REPROBE_S
+                log.warning(
+                    "fleet vitals: Studio refused the seat-parking `idle` "
+                    "block (status %s: %s) — its schema predates it; "
+                    "resending without it, and leaving it out for %d min",
+                    exc.status, exc.detail, int(IDLE_REPROBE_S // 60),
+                )
+                trimmed = dict(snapshot)
+                trimmed.pop("idle")
+                self.last = trimmed
+                return self._post(trimmed)
             self._warn_failed(exc)
             return FAILED
         sessions = snapshot.get("sessions") or {}

{alissa_tools_github_devloop-0.8.35 → alissa_tools_github_devloop-0.8.37}/src/main/alissa/tools/github/devloop/loop.py

@@ -463,6 +463,7 @@ from typing import Callable, Sequence
 from . import janitor
 from . import fleet_vitals as fleet_vitals_mod
 from . import loop_events as loop_events_mod
+from . import parking as parking_mod
 from . import prompts as prompts_mod
 from .alissa import MANAGED_PREFIX, SHELL_COMMANDS, Alissa
 from .alissa_client import AlissaClient
@@ -2833,6 +2834,25 @@ class Decision:
     # and on the capacity valve, whose Action.DEFERRED already says it.
     # Observational like `resume`: only the loop-events emitter reads it.
     defer_token: str | None = None
+    # The seat-parking verdict (issue #153): whether this candidate is OWED
+    # -- the seat's own work, or a clock the seat owns, is still running on
+    # it -- or settled. None takes the action's default (`decision_owed`);
+    # the sites that know better say so. `timer` is the seat-owned clock
+    # behind an owed verdict, `(kind, until)` with `kind` one of
+    # parking.TIMER_KINDS and `until` a unix second. Observational: only the
+    # poll snapshot (and from it the idle block) reads them.
+    owed: bool | None = None
+    timer: "tuple[str, int] | None" = None
+
+
+def decision_owed(decision: Decision) -> bool:
+    """Whether a decision leaves its candidate OWED (seat-parking design
+    §2.1): an explicit verdict on the decision wins; otherwise every action
+    but a skip or a cap is the seat's own work in progress -- a spawn, an
+    attempt in flight, a deferral, an escalation posted this pass."""
+    if decision.owed is not None:
+        return decision.owed
+    return decision.action.value in parking_mod.OWED_ACTIONS
 
 
 def _oldest_first(found: list) -> list:
@@ -3370,6 +3390,17 @@ class DevWatcher:
         self.github = github or GitHub(config.developer_login)
         self.alissa = alissa or Alissa()
         self.state = state or State(config.state_db)
+        # Seat parking (issue #153): a drain -- and any spawn claim a dead
+        # process left behind -- never outlives the daemon that saw it. A
+        # redeploy (the wake) or a restart boots with the flag down.
+        try:
+            self.state.reset_parking()
+        except sqlite3.Error as exc:
+            log.warning(
+                "parking: could not clear the drain flag at boot (%s) — a "
+                "drain left by the previous process holds until its TTL "
+                "runs out", exc,
+            )
         # The COMMENTED-mode verdict tie-breaker (see no_envelope_verdict):
         # injectable so the future Alissa-envelope reader is one constructor
         # argument, not a rewrite of the verdict logic.
@@ -3474,6 +3505,39 @@ class DevWatcher:
             return Liveness.INDETERMINATE
         return roster.of(session)
 
+    def _stale_timer(self, age: float) -> "tuple[str, int]":
+        """The seat-owned stale window of a spawn row `age` seconds old
+        (issue #153): it ends when the row turns stale, and until then the
+        lane's attempt is the seat's in-flight work."""
+        return (
+            parking_mod.TIMER_STALE_WINDOW,
+            int(time.time() - age) + self.config.stale_minutes * 60,
+        )
+
+    def _stall_timer(
+        self, repo_slug: str, number: int, kind: str, age: float
+    ) -> "tuple[str, int] | None":
+        """The clock of a stall ping (`kind`, STALLED_DEFER_MULTIPLE x the
+        stale window after the spawn) that has not gone out yet, or None once
+        it has. A seat must not park across it: the ping would then fire on
+        the first pass after the wake, the very stall the parking design
+        (§2.9) says no park may manufacture (issue #153)."""
+        if self.state.escalated(repo_slug, number, kind):
+            return None
+        stalled_after = STALLED_DEFER_MULTIPLE * self.config.stale_minutes * 60
+        return (
+            parking_mod.TIMER_STALE_WINDOW, int(time.time() - age) + stalled_after,
+        )
+
+    @staticmethod
+    def _grace_timer(waited: float, grace: float) -> "tuple[str, int]":
+        """A grace the seat waits out before it acts on its own (the
+        mechanical re-request, the orphan handoff): reported as a stale
+        window, the timer kind for a wait the seat owns (issue #153)."""
+        return (
+            parking_mod.TIMER_STALE_WINDOW, int(time.time() - waited + grace),
+        )
+
     def evaluate(
         self,
         owner: str,
@@ -3509,6 +3573,7 @@ class DevWatcher:
                 f"attempt {attempts} enqueued {int(age)}s ago",
                 attempts,
                 session=session_name(issue, attempts),
+                timer=self._stale_timer(age),
             )
 
         # The one dedupe signal that survives an instance change, consulted
@@ -3648,6 +3713,15 @@ class DevWatcher:
                         issue.full_name, number, stalled_kind(attempts)
                     ):
                         self._escalate_stalled(issue, attempts, age, linked)
+                    # Parking (issue #153): the lane is the seat's until its
+                    # stall ping has gone out -- a seat parked across that
+                    # clock would post it on the first pass after the wake
+                    # -- and, past it, while the session might still be
+                    # there. A dead session behind a PR nobody may resume
+                    # waits on the review lifecycle: settled.
+                    stall_timer = self._stall_timer(
+                        issue.full_name, number, stalled_kind(attempts), age
+                    )
                     # Name WHY the deferral held: a dead session behind a
                     # handed-off PR is a different story from a live one, and
                     # an operator reading the log must not have to guess.
@@ -3670,6 +3744,11 @@ class DevWatcher:
                         attempts,
                         session=session_name(issue, attempts),
                         defer_token=loop_events_mod.DEFER_IN_FLIGHT,
+                        owed=(
+                            stall_timer is not None
+                            or liveness is not Liveness.DEAD
+                        ),
+                        timer=stall_timer,
                     )
             else:
                 # No linked open PR: the IMPLEMENT phase, before the session
@@ -3770,6 +3849,10 @@ class DevWatcher:
                         self._escalate_live_stalled(
                             issue, attempts, age, live_session, liveness
                         )
+                    live_stall_timer = self._stall_timer(
+                        issue.full_name, number, live_stalled_kind(attempts),
+                        age,
+                    )
                     return Decision(
                         Action.IN_FLIGHT,
                         f"attempt {attempts} is stale ({int(age / 60)} min) "
@@ -3781,6 +3864,7 @@ class DevWatcher:
                         attempts,
                         session=live_session,
                         defer_token=loop_events_mod.DEFER_IN_FLIGHT,
+                        timer=live_stall_timer,
                     )
                 # DEAD is not yet "died in the implement phase" (issue #144,
                 # design §8.4): the session is gone and no PR is OPEN, but a
@@ -3876,6 +3960,84 @@ class DevWatcher:
         reenqueued: bool = False,
         resume_pr: "PullRequest | None" = None,
         dead_session: "str | None" = None,
+    ) -> Decision:
+        """The issue edge's spawn, behind the drain gate (`_drain_gated`)."""
+        return self._drain_gated(
+            session_name(issue, attempt), attempt, issue.issue_slug,
+            lambda: self._spawn_claimed(
+                issue, attempt, task_number, budget,
+                reenqueued=reenqueued, resume_pr=resume_pr,
+                dead_session=dead_session,
+            ),
+        )
+
+    def _drain_gated(
+        self,
+        name: str,
+        attempt: int,
+        slug: str,
+        spawn: "Callable[[], Decision]",
+        round_: "int | None" = None,
+    ) -> Decision:
+        """Every spawn path's drain gate (seat-parking design §2.4, issue
+        #153): claim the spawn of `name` against the drain flag, run `spawn`
+        under the claim, and drop the claim however it ends.
+
+        The gate sits ABOVE every side effect of the spawn -- the capacity
+        reserve, the hub fetch, the self-assign, the activity line, the
+        `alissa tmux queue add`, the ledger row -- so a drained seat touches
+        nothing on any edge, and the item stays a clean candidate (DEFERRED
+        claims nothing, exactly like the capacity valve). The claim and the
+        flag are read and written in one immediate transaction on each side
+        (`State.claim_spawn` / `State.set_drain`): a drain that lands while
+        this spawn is between its gate and its enqueue sees the claim and
+        refuses itself, so a park can never race a spawn. A ledger that
+        cannot answer stands the spawn down too -- a spawn that cannot prove
+        the seat is not drained does not happen."""
+        try:
+            drain = self.state.claim_spawn(name)
+        except sqlite3.Error as exc:
+            log.warning(
+                "%s: could not claim the spawn of %s against the drain flag "
+                "(%s) — standing it down this pass", slug, name, exc,
+            )
+            return Decision(
+                Action.DEFERRED,
+                f"spawn stood down: the state ledger could not prove the "
+                f"seat is not drained ({exc}); retrying next poll",
+                attempt, round=round_,
+                defer_token=loop_events_mod.DEFER_DRAINED,
+            )
+        if drain is not None:
+            since = parking_mod.iso(drain["drained_at"])
+            until = parking_mod.iso(drain["expires_at"])
+            log.info(
+                "%s: not spawning %s — the seat is drained for parking since "
+                "%s (until %s)", slug, name, since, until,
+            )
+            return Decision(
+                Action.DEFERRED,
+                f"spawns held — the seat is drained for parking since {since} "
+                f"(until {until}: {drain['reason'] or 'no reason given'}); "
+                f"retrying once it is undrained",
+                attempt, round=round_,
+                defer_token=loop_events_mod.DEFER_DRAINED,
+            )
+        try:
+            return spawn()
+        finally:
+            self.state.release_spawn(name)
+
+    def _spawn_claimed(
+        self,
+        issue: Issue,
+        attempt: int,
+        task_number: int | None,
+        budget: "SessionBudget | None" = None,
+        *,
+        reenqueued: bool = False,
+        resume_pr: "PullRequest | None" = None,
+        dead_session: "str | None" = None,
     ) -> Decision:
         name = session_name(issue, attempt)
         # The max_sessions gate, FIRST -- before the self-assign that marks
@@ -3928,7 +4090,7 @@ class DevWatcher:
 
         hub, problem = self._ensure_hub(issue.owner, issue.repo)
         if problem is not None:
-            return Decision(Action.SKIPPED, problem, attempt)
+            return Decision(Action.SKIPPED, problem, attempt, owed=True)
 
         task_ref = f"TASK-{task_number}" if task_number is not None else None
         with_origin = (
@@ -5181,6 +5343,7 @@ class DevWatcher:
                     pr.full_name, number, round_
                 ) or fix_session_name(pr, round_, attempts),
                 round=round_,
+                timer=self._stale_timer(age),
             )
 
         # A round nothing was spawned for yet -- but the PREVIOUS round's fix
@@ -5285,6 +5448,10 @@ class DevWatcher:
                         self._escalate_fix_live_stalled(
                             pr, round_, attempts, age, row_session or ""
                         )
+                    fix_live_timer = self._stall_timer(
+                        pr.full_name, number,
+                        fix_live_stalled_kind(round_, attempts), age,
+                    )
                     return Decision(
                         Action.IN_FLIGHT,
                         f"fix attempt {attempts} for round {round_} is stale "
@@ -5297,6 +5464,7 @@ class DevWatcher:
                         or fix_session_name(pr, round_, attempts),
                         round=round_,
                         defer_token=loop_events_mod.DEFER_IN_FLIGHT,
+                        timer=fix_live_timer,
                     )
                 if liveness is not Liveness.DEAD:
                     return Decision(
@@ -5326,6 +5494,13 @@ class DevWatcher:
                         pr.full_name, number, fix_stalled_kind(round_, attempts)
                     ):
                         self._escalate_fix_stalled(pr, round_, attempts, age)
+                    # Parking (issue #153), the issue edge's rule: owed until
+                    # the stall ping is out, and past it while the session
+                    # might still be there; a dead one waits on a human.
+                    fix_stall_timer = self._stall_timer(
+                        pr.full_name, number,
+                        fix_stalled_kind(round_, attempts), age,
+                    )
                     return Decision(
                         Action.IN_FLIGHT,
                         f"fix attempt {attempts} for round {round_} is stale "
@@ -5339,6 +5514,11 @@ class DevWatcher:
                         or fix_session_name(pr, round_, attempts),
                         round=round_,
                         defer_token=loop_events_mod.DEFER_IN_FLIGHT,
+                        owed=(
+                            fix_stall_timer is not None
+                            or liveness is not Liveness.DEAD
+                        ),
+                        timer=fix_stall_timer,
                     )
 
         # The per-round budget ran dry: stop and page the operator ON the
@@ -5552,6 +5732,7 @@ class DevWatcher:
                 f"(session picture: {liveness.value} — {who})",
                 attempts,
                 round=round_,
+                owed=True,
             )
 
         waited = self._head_public_for(pr, newest)
@@ -5565,6 +5746,7 @@ class DevWatcher:
                 f"passed; deferring the mechanical re-request",
                 attempts,
                 round=round_,
+                owed=True,
             )
         if waited < grace:
             return Decision(
@@ -5576,6 +5758,8 @@ class DevWatcher:
                 f"racing it",
                 attempts,
                 round=round_,
+                owed=True,
+                timer=self._grace_timer(waited, grace),
             )
 
         return self._rerequest_review(pr, round_, attempts, newest, kind, waited)
@@ -5798,6 +5982,7 @@ class DevWatcher:
                 f"({exc}) — transient; not recorded, retrying next poll",
                 attempts,
                 round=round_,
+                owed=True,
             )
 
         self.state.record_escalation(pr.full_name, pr.number, kind)
@@ -6045,6 +6230,7 @@ class DevWatcher:
                 f"draft PR is not orphaned — session picture: "
                 f"{liveness.value} ({who})",
                 task_ref=task_ref,
+                owed=True,
             )
 
         waited = self._draft_public_for(pr)
@@ -6056,6 +6242,7 @@ class DevWatcher:
                 f"read — cannot prove the {int(grace / 60)} min grace has "
                 f"passed; deferring the mechanical handoff",
                 task_ref=task_ref,
+                owed=True,
             )
         if waited < grace:
             return Decision(
@@ -6065,6 +6252,8 @@ class DevWatcher:
                 f"a session hands its own draft off within minutes; not "
                 f"racing it",
                 task_ref=task_ref,
+                owed=True,
+                timer=self._grace_timer(waited, grace),
             )
 
         # Last, because it is a configuration problem rather than a property
@@ -7232,6 +7421,29 @@ class DevWatcher:
         reenqueued: bool = False,
         dead_session: "str | None" = None,
         confirmed_dead: "str | None" = None,
+    ) -> Decision:
+        """The fix edge's spawn, behind the drain gate (`_drain_gated`)."""
+        return self._drain_gated(
+            fix_session_name(pr, round_, attempt), attempt, pr.pr_slug,
+            lambda: self._spawn_fix_claimed(
+                pr, round_, attempt, review, budget,
+                reenqueued=reenqueued, dead_session=dead_session,
+                confirmed_dead=confirmed_dead,
+            ),
+            round_=round_,
+        )
+
+    def _spawn_fix_claimed(
+        self,
+        pr: PullRequest,
+        round_: int,
+        attempt: int,
+        review: Review,
+        budget: "SessionBudget | None" = None,
+        *,
+        reenqueued: bool = False,
+        dead_session: "str | None" = None,
+        confirmed_dead: "str | None" = None,
     ) -> Decision:
         skipped = self._foreign_head_skip(pr, attempt)
         if skipped is not None:
@@ -7287,7 +7499,7 @@ class DevWatcher:
 
         hub, problem = self._ensure_hub(pr.owner, pr.repo)
         if problem is not None:
-            return Decision(Action.SKIPPED, problem, attempt)
+            return Decision(Action.SKIPPED, problem, attempt, owed=True)
 
         template = (
             FIX_RESUME_DIRECTIVE if dead_session is not None else FIX_DIRECTIVE
@@ -7441,6 +7653,7 @@ class DevWatcher:
                 f"(the label stays until the session completes)",
                 attempts,
                 session=maintain_session_name(pr, attempts),
+                timer=self._stale_timer(age),
             )
 
         # The cross-instance claim check, before the epoch re-basing: whether
@@ -7540,6 +7753,24 @@ class DevWatcher:
         *,
         reenqueued: bool = False,
         limited: bool = False,
+    ) -> Decision:
+        """The maintenance edge's spawn, behind the drain gate
+        (`_drain_gated`)."""
+        return self._drain_gated(
+            maintain_session_name(pr, attempt), attempt, pr.pr_slug,
+            lambda: self._spawn_maintain_claimed(
+                pr, attempt, budget, reenqueued=reenqueued, limited=limited,
+            ),
+        )
+
+    def _spawn_maintain_claimed(
+        self,
+        pr: PullRequest,
+        attempt: int,
+        budget: "SessionBudget | None" = None,
+        *,
+        reenqueued: bool = False,
+        limited: bool = False,
     ) -> Decision:
         skipped = self._foreign_head_skip(pr, attempt)
         if skipped is not None:
@@ -7569,7 +7800,7 @@ class DevWatcher:
 
         hub, problem = self._ensure_hub(pr.owner, pr.repo)
         if problem is not None:
-            return Decision(Action.SKIPPED, problem, attempt)
+            return Decision(Action.SKIPPED, problem, attempt, owed=True)
 
         # The resolved reviewers, re-requested after the push (which stales
         # any approve). With none resolved the session falls back to the
@@ -7749,6 +7980,12 @@ class DevWatcher:
 
         row = self.state.revert_spawn(pr.full_name, number, labeled_ts)
         if row is not None:
+            # Parking (issue #153): a label application the seat already
+            # answered is settled once its spawn row leaves the stale window
+            # -- the revert has no stale retry, and a session still at work
+            # is counted by the roster, not here.
+            revert_age = time.time() - int(row["spawned_at"])
+            fresh = revert_age < self.config.stale_minutes * 60
             return Decision(
                 Action.IN_FLIGHT,
                 f"revert session {row['session']} already spawned for the "
@@ -7756,6 +7993,8 @@ class DevWatcher:
                 f"application; unlabel and re-label to ask again)",
                 int(row["attempt"]),
                 session=str(row["session"]),
+                owed=fresh,
+                timer=self._stale_timer(revert_age) if fresh else None,
             )
 
         # Refusal 1: not the loop's own merge. The lever undoes the LOOP's
@@ -7927,6 +8166,25 @@ class DevWatcher:
         labeled_iso: str,
         default_branch: str,
         budget: "SessionBudget | None" = None,
+    ) -> Decision:
+        """The revert edge's spawn, behind the drain gate (`_drain_gated`)."""
+        return self._drain_gated(
+            revert_session_name(pr, attempt), attempt, pr.pr_slug,
+            lambda: self._spawn_revert_claimed(
+                pr, attempt, labeled_ts, labeler, labeled_iso,
+                default_branch, budget,
+            ),
+        )
+
+    def _spawn_revert_claimed(
+        self,
+        pr: PullRequest,
+        attempt: int,
+        labeled_ts: int,
+        labeler: str,
+        labeled_iso: str,
+        default_branch: str,
+        budget: "SessionBudget | None" = None,
     ) -> Decision:
         name = revert_session_name(pr, attempt)
         # The max_sessions gate before the ledger row (as in _spawn_maintain):
@@ -7944,7 +8202,7 @@ class DevWatcher:
 
         hub, problem = self._ensure_hub(pr.owner, pr.repo)
         if problem is not None:
-            return Decision(Action.SKIPPED, problem, attempt)
+            return Decision(Action.SKIPPED, problem, attempt, owed=True)
 
         task = revert_task_number(pr.body)
         task_ref = f"TASK-{task}"
@@ -11165,6 +11423,11 @@ class DevWatcher:
             "round": decision.round,
             "session": decision.session,
             "task_ref": decision.task_ref,
+            "owed": decision_owed(decision),
+            "timer": (
+                {"kind": decision.timer[0], "until": decision.timer[1]}
+                if decision.timer is not None else None
+            ),
         }
 
     def _write_snapshot(
@@ -11264,7 +11527,8 @@ class DevWatcher:
                     raise
                 except CommandError as exc:
                     log.error("%s: %s", slug, exc)
-                    decision = Decision(Action.SKIPPED, str(exc))
+                    # Owed: an evaluation that failed is unknown, never settled.
+                    decision = Decision(Action.SKIPPED, str(exc), owed=True)
 
             level = logging.INFO if decision.action != Action.SKIPPED else logging.DEBUG
             log.log(level, "%s → %s (%s)", slug, decision.action.value, decision.reason)
@@ -11306,7 +11570,8 @@ class DevWatcher:
                 raise
             except CommandError as exc:
                 log.error("%s: %s", slug, exc)
-                decision = Decision(Action.SKIPPED, str(exc))
+                # Owed: an evaluation that failed is unknown, never settled.
+                decision = Decision(Action.SKIPPED, str(exc), owed=True)
 
             level = logging.INFO if decision.action != Action.SKIPPED else logging.DEBUG
             log.log(level, "%s → %s (%s)", slug, decision.action.value, decision.reason)
@@ -11344,7 +11609,8 @@ class DevWatcher:
                 raise
             except CommandError as exc:
                 log.error("%s: %s", slug, exc)
-                decision = Decision(Action.SKIPPED, str(exc))
+                # Owed: an evaluation that failed is unknown, never settled.
+                decision = Decision(Action.SKIPPED, str(exc), owed=True)
 
             level = logging.INFO if decision.action != Action.SKIPPED else logging.DEBUG
             log.log(level, "%s → %s (%s)", slug, decision.action.value, decision.reason)
@@ -11378,7 +11644,8 @@ class DevWatcher:
                 raise
             except CommandError as exc:
                 log.error("%s: %s", slug, exc)
-                decision = Decision(Action.SKIPPED, str(exc))
+                # Owed: an evaluation that failed is unknown, never settled.
+                decision = Decision(Action.SKIPPED, str(exc), owed=True)
 
             level = logging.INFO if decision.action != Action.SKIPPED else logging.DEBUG
             log.log(level, "%s → %s (%s)", slug, decision.action.value, decision.reason)