alissa-tools-github-devloop 0.8.3__tar.gz → 0.8.4__tar.gz

{alissa_tools_github_devloop-0.8.3/src/main/alissa_tools_github_devloop.egg-info → alissa_tools_github_devloop-0.8.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: alissa-tools-github-devloop
-Version: 0.8.3
+Version: 0.8.4
 Summary: ALISSA-TOOLS-GITHUB-DEVLOOP
 Home-page: https://alissa.app
 Author: Fahera

{alissa_tools_github_devloop-0.8.3 → alissa_tools_github_devloop-0.8.4}/src/main/alissa/tools/github/devloop/loop.py

@@ -353,6 +353,7 @@ import calendar
 import dataclasses
 import logging
 import re
+import sqlite3
 import time
 from collections import Counter
 from dataclasses import dataclass
@@ -6330,6 +6331,26 @@ class DevWatcher:
                 except CommandError as exc:
                     backoff = min(backoff * 2, 900)
                     log.error("poll failed: %s — retrying in %ds", exc, backoff)
+                except sqlite3.Error as exc:
+                    # The BACKSTOP for the strict half of the state layer
+                    # (issue #76). The bookkeeping writes degrade on their own
+                    # (state._best_effort) and never arrive here; what does is
+                    # a spawn-ledger write, which must NOT be swallowed -- a
+                    # forgotten spawn row would let the daemon re-spawn over
+                    # live work. Abandoning the pass and retrying is the honest
+                    # middle: the ledger is intact, the cause is named, and a
+                    # volume that goes read-only under a running daemon costs a
+                    # backed-off retry instead of the process. That is the
+                    # whole lesson of the 2026-07-29 revloop incident -- a
+                    # local storage fault must never be terminal for an
+                    # unattended loop.
+                    backoff = min(backoff * 2, 900)
+                    log.error(
+                        "poll abandoned: the state ledger raised %s — this is "
+                        "a LOCAL storage fault (a read-only or wedged volume), "
+                        "not a GitHub or auth failure; retrying in %ds",
+                        exc, backoff,
+                    )
                 time.sleep(backoff)
             except KeyboardInterrupt:
                 log.info("stopping")

{alissa_tools_github_devloop-0.8.3 → alissa_tools_github_devloop-0.8.4}/src/main/alissa/tools/github/devloop/state.py

@@ -69,15 +69,26 @@ and a bare-name key would collide their ledgers into one row.
 from __future__ import annotations
 
 import json
+import logging
 import sqlite3
 import time
 from pathlib import Path
+from typing import Callable
+
+log = logging.getLogger(__name__)
 
 # Poll-snapshot retention: the newest N rows are kept, older pruned on write.
 # Fixed, not a config key -- the table is an observation buffer for the UI,
 # and a bounded ring is all the console needs (it reads the recent tail).
 SNAPSHOT_RETENTION = 1000
 
+# How many consecutive best-effort write failures get their own WARN before the
+# stream is suppressed. A wedged volume fails EVERY write of EVERY poll, so an
+# unbounded warning is a log flood that buries the daemon's actual work; the
+# first few carry the diagnosis, and the recovery line (always logged) reports
+# the total the streak reached. See State._best_effort.
+DEGRADED_WARN_STREAK = 3
+
 SCHEMA = """
 CREATE TABLE IF NOT EXISTS spawns (
     repo_slug  TEXT    NOT NULL,
@@ -153,10 +164,46 @@ _COLUMN_MIGRATIONS = (
 )
 
 
+# The dedupe-gate tables, and the column order _flush_pending_gates replays
+# them in: (key column, number column, kind column, timestamp column). Both are
+# `INSERT OR IGNORE` targets keyed on their first three columns, which is what
+# makes a replay safe to run against rows that may already exist.
+_GATE_REPLAY = {
+    "escalations": ("repo_slug", "issue", "kind", "escalated_at"),
+    "activity_log": ("repo_slug", "number", "kind", "logged_at"),
+}
+
+
+def _migrate_columns(db: sqlite3.Connection) -> None:
+    """Apply the additive column migrations `IF NOT EXISTS` cannot: add any
+    _COLUMN_MIGRATIONS column missing from an already-existing table.
+    Idempotent -- the live column set is checked first, so a fresh DB (the
+    column already in SCHEMA) and a re-open both no-op.
+
+    Module-level, taking the connection: State._reconnect has to bring a
+    REPLACEMENT handle up to the same schema as __init__ did, and a method
+    bound to self._db could not be used before the swap."""
+    for table, column, ddl in _COLUMN_MIGRATIONS:
+        live = {row["name"] for row in db.execute(f"PRAGMA table_info({table})")}
+        if column not in live:
+            db.execute(f"ALTER TABLE {table} ADD COLUMN {column} {ddl}")
+
+
 class State:
     def __init__(self, path: Path):
         path = Path(path).expanduser()
         path.parent.mkdir(parents=True, exist_ok=True)
+        self._path = path
+        # Length of the current streak of failed best-effort writes; 0 while
+        # the store is healthy. Drives both the reconnect attempt and the
+        # warning suppression (see _best_effort).
+        self._degraded = 0
+        # Dedupe keys whose row could NOT be written, mapped to the timestamp
+        # the row would have carried. Consulted by escalated() and
+        # activity_logged() so a gate that exists to fire ONCE still fires once
+        # while the store is unwritable, and REPLAYED by _flush_pending_gates
+        # when writes work again -- see _degraded_gate.
+        self._pending_gates: "dict[tuple[str, str, int, str], int]" = {}
         self._db = sqlite3.connect(str(path))
         self._db.row_factory = sqlite3.Row
         self._db.executescript(SCHEMA)
@@ -164,19 +211,214 @@ class State:
         self._db.commit()
 
     def _migrate(self) -> None:
-        """Apply the additive column migrations `IF NOT EXISTS` cannot: add any
-        _COLUMN_MIGRATIONS column missing from an already-existing table.
-        Idempotent -- the live column set is checked first, so a fresh DB (the
-        column already in SCHEMA) and a re-open both no-op."""
-        for table, column, ddl in _COLUMN_MIGRATIONS:
-            live = {
-                row["name"]
-                for row in self._db.execute(f"PRAGMA table_info({table})")
-            }
-            if column not in live:
+        """Apply the additive column migrations to this State's connection."""
+        _migrate_columns(self._db)
+
+    # -- best-effort writes (the 2026-07-29 volume incident, issue #76) -----
+    #
+    # This ledger sits on the same platform volume the daemon's config does,
+    # and that volume can go read-only underneath a RUNNING process -- which is
+    # exactly what happened to the revloop sibling on 2026-07-29: a telemetry
+    # write raised `attempt to write a readonly database` and took the whole
+    # poll loop down with it. Losing telemetry is a nuisance; losing the daemon
+    # needs a human.
+    #
+    # So the writes are split by what a LOST ROW actually costs:
+    #
+    #   best-effort  record_snapshot / record_activity / record_escalation --
+    #                observation and dedupe bookkeeping. Their side effect (the
+    #                snapshot row, the posted comment) either does not exist yet
+    #                or has ALREADY landed on GitHub by the time the row is
+    #                written, so a dropped row degrades the ledger -- a missing
+    #                console sample -- and nothing more.
+    #
+    #                The two that are DEDUPE GATES are additionally contained
+    #                in memory (_degraded_gate): "degrade" must mean a stale
+    #                console, not the same operator comment re-posted to a real
+    #                GitHub issue once per poll for the length of an outage this
+    #                daemon is built to survive for hours (PR #77 review r1).
+    #
+    #   strict       record_spawn / record_fix_spawn / record_maintain_spawn --
+    #                the attempt ledger. A dropped row makes the daemon forget a
+    #                session it just launched: it would re-spawn over live work
+    #                and mis-count the attempt cap. That must not be swallowed,
+    #                so those keep raising -- and loop.run_forever now catches
+    #                sqlite3.Error at the pass boundary, so raising costs a
+    #                backed-off retry instead of the process.
+    #
+    # Callers do not choose: the classification lives on the method, so a new
+    # call site inherits the right posture from the method it calls.
+
+    def _reconnect(self) -> bool:
+        """Replace the connection after a failed write, then let the caller
+        retry it once.
+
+        Attempted on EVERY failure, not just the first of a streak, and that is
+        deliberate: when sqlite opens a file it cannot write, the handle is
+        read-only for its whole life, so a store that recovers underneath a
+        once-reconnected daemon would stay broken until someone restarted the
+        container -- the precise opposite of self-healing, and the same shape of
+        bug as the crash this whole change is undoing. The cost of being
+        generous is one sqlite3.connect() per failed write, i.e. a syscall or
+        two per poll while degraded, against a recovery that needs no human.
+
+        The new connection is opened BEFORE the old one is dropped, so a failed
+        reconnect leaves the working handle in place. Closing first would trade
+        a store that is merely unwritable for one that cannot even be READ --
+        and every staleness and dedupe decision the daemon makes is a read.
+
+        The replacement gets the SCHEMA and the column migrations applied, the
+        same as __init__. sqlite3.connect() CREATES an empty database at a
+        missing path, and the documented recovery for the 2026-07-29 incident
+        was a human wiping the volume -- do that under a running daemon and a
+        bare reconnect would report success on a schema-less handle, after
+        which every (strict) read raises `no such table` and the daemon spins
+        at the backoff cap forever: alive, warning, and unable to decide
+        anything. `CREATE TABLE IF NOT EXISTS` throughout means re-applying is
+        idempotent, and on an intact read-only database it needs no write at
+        all, so this stays cheap on the path that actually runs."""
+        try:
+            db = sqlite3.connect(str(self._path))
+            db.row_factory = sqlite3.Row
+            db.executescript(SCHEMA)
+            _migrate_columns(db)
+            db.commit()
+        except sqlite3.Error as exc:
+            log.debug("state: reconnect to %s failed: %s", self._path, exc)
+            return False
+        try:
+            self._db.close()
+        except sqlite3.Error:
+            pass
+        self._db = db
+        return True
+
+    def _degraded_gate(self, table: str, repo_slug: str, number: int,
+                       kind: str, ts: int, wrote: bool) -> None:
+        """Remember a dedupe key whose row did not land, with the timestamp the
+        row would have carried. `escalated()` / `activity_logged()` consult it,
+        so a gate that exists to fire exactly once still fires exactly once
+        while the store is unwritable -- instead of re-posting its comment
+        every poll.
+
+        The key is released by _flush_pending_gates, NOT by a later call from
+        the same call site: every one of those is itself gated on this key, so
+        once it is held the code that would write the row is unreachable (PR
+        #77 review round 2). `ts` is captured here rather than at replay time
+        because `escalated_at` is an audit field for when the escalation was
+        first RAISED -- the row must not claim the volume's recovery time."""
+        key = (table, repo_slug, number, kind)
+        if wrote:
+            self._pending_gates.pop(key, None)
+        else:
+            self._pending_gates.setdefault(key, ts)
+
+    def _gate_pending(self, table: str, repo_slug: str, number: int,
+                      kind: str) -> bool:
+        return (table, repo_slug, number, kind) in self._pending_gates
+
+    def _flush_pending_gates(self) -> None:
+        """Land the deferred dedupe rows now that a write has succeeded.
+
+        This is the half that makes the in-memory containment two-way, and
+        without it the containment is a TRAP: every call site reads
+        escalated() / activity_logged() first, the in-memory key already
+        answers True, so record_escalation is never called for that key again
+        and the row would never land at all. The costs are not hypothetical --
+        `escalations` is not only a comment receipt but the orphan sweep's
+        state breadcrumb (orphan_ready_kind records that THIS daemon flipped a
+        PR ready), so a row that never lands means a restarted daemon re-runs
+        mark_ready and request_reviews against that head; and the console
+        sidecar is a separate process that can only see the table.
+
+        `INSERT OR IGNORE` throughout, so replaying a row that already exists
+        is a no-op. A still-failing store keeps every key and tries again on
+        the next successful write."""
+        if not self._pending_gates:
+            return
+        landed = []
+        for key, ts in list(self._pending_gates.items()):
+            table, repo_slug, number, kind = key
+            columns = _GATE_REPLAY[table]
+            try:
                 self._db.execute(
-                    f"ALTER TABLE {table} ADD COLUMN {column} {ddl}"
+                    f"INSERT OR IGNORE INTO {table} "
+                    f"({', '.join(columns)}) VALUES (?,?,?,?)",
+                    (repo_slug, number, kind, ts),
+                )
+                self._db.commit()
+            except sqlite3.Error as exc:
+                log.debug(
+                    "state: replay of %s deferred while the ledger is still "
+                    "unwritable (%s)", table, exc,
                 )
+                break
+            landed.append(key)
+        for key in landed:
+            self._pending_gates.pop(key, None)
+        if landed:
+            log.warning(
+                "state: replayed %d dedupe row(s) deferred while the ledger "
+                "was unwritable; %d still pending",
+                len(landed), len(self._pending_gates),
+            )
+
+    def _note_write_ok(self, what: str) -> None:
+        """Close out a degraded streak once a write lands again: report the
+        total it reached, so the suppressed middle of a long outage is still
+        accounted for in the log, and re-arm the warnings."""
+        if self._degraded:
+            log.warning(
+                "state: %s succeeded -- the ledger at %s is accepting writes "
+                "again after %d failed write(s)",
+                what, self._path, self._degraded,
+            )
+            self._degraded = 0
+        # Unconditional, not folded into the branch above: a partial replay
+        # leaves keys behind with the streak already reset, and they must still
+        # get their next chance.
+        self._flush_pending_gates()
+
+    def _best_effort(self, what: str, write: Callable[[], None]) -> bool:
+        """Run one bookkeeping write so a failing store degrades this ledger
+        instead of killing the caller. Returns whether the row landed.
+
+        `what` names the write for the log. Only sqlite3.Error is caught -- a
+        TypeError from a malformed call site is a bug and still raises."""
+        try:
+            write()
+        except sqlite3.Error as exc:
+            # Leave no half-open transaction behind: the READS are strict, and
+            # they are what every staleness and dedupe decision runs on.
+            try:
+                self._db.rollback()
+            except sqlite3.Error:
+                pass
+            if self._reconnect():
+                try:
+                    write()
+                except sqlite3.Error as retry_exc:
+                    exc = retry_exc
+                else:
+                    self._note_write_ok(what)
+                    return True
+            self._degraded += 1
+            if self._degraded <= DEGRADED_WARN_STREAK:
+                log.warning(
+                    "state: %s failed (%s) -- the ledger at %s is not "
+                    "accepting writes; the daemon keeps polling with degraded "
+                    "bookkeeping (failure %d of this streak)",
+                    what, exc, self._path, self._degraded,
+                )
+                if self._degraded == DEGRADED_WARN_STREAK:
+                    log.warning(
+                        "state: suppressing further write-failure warnings "
+                        "until the ledger recovers (one line will report the "
+                        "total)",
+                    )
+            return False
+        self._note_write_ok(what)
+        return True
 
     def close(self) -> None:
         self._db.close()
@@ -423,7 +665,13 @@ class State:
     def escalated(self, repo_slug: str, issue: int, kind: str) -> bool:
         """Whether an escalation of this KIND was already raised. Kinds
         dedupe independently -- a cap-out row never silences an
-        assignment-rejection comment, and vice versa."""
+        assignment-rejection comment, and vice versa.
+
+        Answers True as well when the row could not be WRITTEN this run (see
+        _degraded_gate): the comment went out, so the gate it stands for is
+        closed whether or not sqlite accepted the receipt."""
+        if self._gate_pending("escalations", repo_slug, issue, kind):
+            return True
         row = self._db.execute(
             "SELECT 1 FROM escalations WHERE repo_slug=? AND issue=? AND kind=?",
             (repo_slug, issue, kind),
@@ -433,13 +681,33 @@ class State:
     def record_escalation(self, repo_slug: str, issue: int, kind: str) -> None:
         """Idempotent per kind: OR IGNORE keeps the FIRST escalation's
         timestamp, so `escalated_at` is an audit field for when this kind of
-        escalation was first raised, not the most recent re-raise."""
-        self._db.execute(
-            "INSERT OR IGNORE INTO escalations "
-            "(repo_slug, issue, kind, escalated_at) VALUES (?,?,?,?)",
-            (repo_slug, issue, kind, int(time.time())),
+        escalation was first raised, not the most recent re-raise.
+
+        BEST-EFFORT (see _best_effort): every caller posts the operator comment
+        BEFORE recording, so the row is a dedupe gate, never the escalation
+        itself. Raising here would abandon a poll pass over bookkeeping for a
+        comment that already landed. Dropping the row is not free either -- it
+        would re-open the gate and re-post the comment every poll -- so a
+        failed write is CONTAINED in memory (_degraded_gate) and REPLAYED by
+        _flush_pending_gates on the next write that succeeds. The gate holds
+        meanwhile, and the row lands with its original timestamp. The replay is
+        what makes that true: this call site is itself gated on the key, so it
+        will never be reached a second time to write the row itself."""
+        ts = int(time.time())
+
+        def write() -> None:
+            self._db.execute(
+                "INSERT OR IGNORE INTO escalations "
+                "(repo_slug, issue, kind, escalated_at) VALUES (?,?,?,?)",
+                (repo_slug, issue, kind, ts),
+            )
+            self._db.commit()
+
+        self._degraded_gate(
+            "escalations", repo_slug, issue, kind, ts,
+            self._best_effort(
+                f"record_escalation({repo_slug}#{issue}, {kind})", write),
         )
-        self._db.commit()
 
     # -- mechanical activity comment dedupe -------------------------------
     #
@@ -459,7 +727,13 @@ class State:
     def activity_logged(self, repo_slug: str, number: int, kind: str) -> bool:
         """Whether this activity KIND already landed a line -- the
         once-per-episode gate for capacity-deferral telemetry. Independent of
-        `escalated()`: a deferral line is not an operator escalation."""
+        `escalated()`: a deferral line is not an operator escalation.
+
+        Contained in memory on a failed write, exactly like `escalated()`: the
+        line is already on the comment, so an unwritable ledger must not turn
+        "one line per episode" into one line per poll."""
+        if self._gate_pending("activity_log", repo_slug, number, kind):
+            return True
         row = self._db.execute(
             "SELECT 1 FROM activity_log WHERE repo_slug=? AND number=? AND kind=?",
             (repo_slug, number, kind),
@@ -470,13 +744,28 @@ class State:
         """Idempotent per kind: OR IGNORE keeps the first line's timestamp.
         Recorded by the caller only AFTER the append lands, so a transient
         comment failure retries next poll and the line lands exactly once per
-        episode."""
-        self._db.execute(
-            "INSERT OR IGNORE INTO activity_log "
-            "(repo_slug, number, kind, logged_at) VALUES (?,?,?,?)",
-            (repo_slug, number, kind, int(time.time())),
+        episode.
+
+        BEST-EFFORT (see _best_effort): this is the dedupe gate for a
+        MECHANICAL log line -- telemetry by construction, and already posted by
+        the time it is called. Contained in memory on failure like
+        record_escalation, so an unwritable store costs neither the poll pass
+        nor a repeated line."""
+        ts = int(time.time())
+
+        def write() -> None:
+            self._db.execute(
+                "INSERT OR IGNORE INTO activity_log "
+                "(repo_slug, number, kind, logged_at) VALUES (?,?,?,?)",
+                (repo_slug, number, kind, ts),
+            )
+            self._db.commit()
+
+        self._degraded_gate(
+            "activity_log", repo_slug, number, kind, ts,
+            self._best_effort(
+                f"record_activity({repo_slug}#{number}, {kind})", write),
         )
-        self._db.commit()
 
     # -- poll snapshots (the UI sidecar's exhaust buffer) ------------------
 
@@ -503,38 +792,50 @@ class State:
         to JSON. `deferred` counts the max_sessions-deferred items of the
         pass (defaults to 0 so callers predating the valve keep working).
         Purely observational -- written on every pass, dry-run included --
-        and pruned on write, so the table is self-bounding."""
-        self._db.execute(
-            "INSERT INTO poll_snapshots "
-            "(ts, duration_ms, issue_candidates, pr_candidates, "
-            "maintain_candidates, reaped, spawned, in_flight, skipped, "
-            "escalated, capped, deferred, stages_json) "
-            "VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?)",
-            (
-                int(time.time()),
-                duration_ms,
-                issue_candidates,
-                pr_candidates,
-                maintain_candidates,
-                reaped,
-                spawned,
-                in_flight,
-                skipped,
-                escalated,
-                capped,
-                deferred,
-                json.dumps(stages, separators=(",", ":")),
-            ),
-        )
-        # Prune on write: keep the newest SNAPSHOT_RETENTION rows by id. The
-        # autoincrement id is monotonic across prunes, so "newest" is well
-        # defined even when a wall-clock step would leave `ts` unordered.
-        self._db.execute(
-            "DELETE FROM poll_snapshots WHERE id NOT IN "
-            "(SELECT id FROM poll_snapshots ORDER BY id DESC LIMIT ?)",
-            (SNAPSHOT_RETENTION,),
-        )
-        self._db.commit()
+        and pruned on write, so the table is self-bounding.
+
+        BEST-EFFORT (see _best_effort), and the most consequential of the
+        three: this is the ONE state write EVERY poll pass makes
+        unconditionally, so it was also the one guaranteed to meet a volume
+        that had gone read-only -- and to take the poll loop down with it on
+        the very first pass, exactly as it did to the revloop sibling on
+        2026-07-29. A console that goes stale is the right price for a daemon
+        that keeps polling."""
+        def write() -> None:
+            self._db.execute(
+                "INSERT INTO poll_snapshots "
+                "(ts, duration_ms, issue_candidates, pr_candidates, "
+                "maintain_candidates, reaped, spawned, in_flight, skipped, "
+                "escalated, capped, deferred, stages_json) "
+                "VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?)",
+                (
+                    int(time.time()),
+                    duration_ms,
+                    issue_candidates,
+                    pr_candidates,
+                    maintain_candidates,
+                    reaped,
+                    spawned,
+                    in_flight,
+                    skipped,
+                    escalated,
+                    capped,
+                    deferred,
+                    json.dumps(stages, separators=(",", ":")),
+                ),
+            )
+            # Prune on write: keep the newest SNAPSHOT_RETENTION rows by id.
+            # The autoincrement id is monotonic across prunes, so "newest" is
+            # well defined even when a wall-clock step would leave `ts`
+            # unordered.
+            self._db.execute(
+                "DELETE FROM poll_snapshots WHERE id NOT IN "
+                "(SELECT id FROM poll_snapshots ORDER BY id DESC LIMIT ?)",
+                (SNAPSHOT_RETENTION,),
+            )
+            self._db.commit()
+
+        self._best_effort("record_snapshot", write)
 
     def read_snapshots(self, limit: "int | None" = None) -> "list[dict]":
         """The UI reader: poll snapshots newest-first, each with its per-item

alissa_tools_github_devloop-0.8.4/src/main/alissa/tools/github/devloop/version

@@ -0,0 +1 @@
+0.8.4

{alissa_tools_github_devloop-0.8.3 → alissa_tools_github_devloop-0.8.4/src/main/alissa_tools_github_devloop.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: alissa-tools-github-devloop
-Version: 0.8.3
+Version: 0.8.4
 Summary: ALISSA-TOOLS-GITHUB-DEVLOOP
 Home-page: https://alissa.app
 Author: Fahera

alissa_tools_github_devloop-0.8.3/src/main/alissa/tools/github/devloop/version

@@ -1 +0,0 @@
-0.8.3