alissa-tools-github-devloop 0.8.3__tar.gz → 0.8.5__tar.gz

{alissa_tools_github_devloop-0.8.3/src/main/alissa_tools_github_devloop.egg-info → alissa_tools_github_devloop-0.8.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: alissa-tools-github-devloop
-Version: 0.8.3
+Version: 0.8.5
 Summary: ALISSA-TOOLS-GITHUB-DEVLOOP
 Home-page: https://alissa.app
 Author: Fahera

{alissa_tools_github_devloop-0.8.3 → alissa_tools_github_devloop-0.8.5}/src/main/alissa/tools/github/devloop/ghclient.py

@@ -135,6 +135,17 @@ class PullRequest:
     # instant that window runs from. Defaulted for the same reason as node_id:
     # the three spawn edges never ask, and neither do their fakes.
     closed_at: "int | None" = None
+    # The branch this PR would merge INTO (`base.ref`). Carried for the
+    # stacked-base guard: a PR based on a sibling task's branch rather than on
+    # the repository's default branch strands its diff the moment that parent
+    # merges -- GitHub retargets the child, the child merges into a branch that
+    # is no longer anywhere, and the PR reads "merged" while the default branch
+    # never receives the work (fahera-mx/studio.alissa.app#330/#333/#334).
+    # Empty when the payload carried no readable base: that reads as UNKNOWN,
+    # never as a mismatch, so a thin payload can never page an operator about a
+    # base nobody observed. Defaulted like node_id and closed_at -- the edges
+    # that only spawn never ask.
+    base_ref: str = ""
 
     @property
     def full_name(self) -> str:
@@ -160,6 +171,7 @@ def _pull_request_from(
     the listing reads it from each entry.
     """
     head = data.get("head") or {}
+    base = data.get("base") or {}
     # Users carry `login`, teams `slug`; both hold the review-response edge
     # closed -- a pending TEAM re-request still means the ball is in a
     # reviewer's court, so it must not read as "awaiting the author".
@@ -188,6 +200,7 @@ def _pull_request_from(
         requested_reviewers=requested,
         node_id=data.get("node_id") or "",
         closed_at=parse_github_timestamp(data.get("closed_at")),
+        base_ref=base.get("ref") or "",
     )
 
 
@@ -316,6 +329,10 @@ def _is_rate_limited(exc: proc.CommandError) -> bool:
 class GitHub:
     def __init__(self, login: str | None = None):
         self._login = login
+        # Memoised `default_branch()` answers, keyed (owner, repo). See that
+        # method for why a repository's default branch is cached for the
+        # process lifetime while `pull_request()` deliberately is not.
+        self._default_branches: "dict[tuple[str, str], str]" = {}
 
     def token_login(self) -> str:
         """Who the gh token actually belongs to. `gh api --jq` prints scalars
@@ -672,6 +689,36 @@ class GitHub:
         data = self._api(f"repos/{owner}/{repo}/pulls/{number}") or {}
         return _pull_request_from(data, owner, repo, number=number)
 
+    def default_branch(self, owner: str, repo: str) -> str:
+        """The repository's default branch, as GitHub reports it.
+
+        The stacked-base guard's reference point, and it is FETCHED rather than
+        assumed: `main` is a convention, not a fact. Forks keep whatever the
+        upstream had, repositories created before 2020 default to `master`, and
+        a house style of `develop` is ordinary -- comparing a PR's base against
+        a hardcoded literal would page every operator on such a repo about
+        every correctly-based PR, which is worse than the failure it guards.
+        Empty when the payload carries no readable `default_branch`; the guard
+        reads that as UNKNOWN and stands down, never as a mismatch.
+
+        MEMOISED for the process lifetime, keyed (owner, repo). Unlike
+        `pull_request()` -- deliberately uncached, because draft state and
+        review requests change under the daemon by the minute -- a default
+        branch is quasi-immutable: it changes on a deliberate repository-
+        settings edit, which is rare and operator-driven. Without the memo this
+        would be one extra GET per own open PR per poll, forever, on a
+        comparison whose answer never moves. The stale window a rename opens is
+        bounded and cheap: until the daemon restarts, PRs based on the NEW
+        default read as stacked and each raises its one advisory comment --
+        noisy, never an action, and the guard performs no remediation by
+        design.
+        """
+        key = (owner, repo)
+        if key not in self._default_branches:
+            data = self._api(f"repos/{owner}/{repo}") or {}
+            self._default_branches[key] = data.get("default_branch") or ""
+        return self._default_branches[key]
+
     def branch_pulls(
         self, owner: str, repo: str, head_ref: str
     ) -> "tuple[PullRequest, ...]":

{alissa_tools_github_devloop-0.8.3 → alissa_tools_github_devloop-0.8.5}/src/main/alissa/tools/github/devloop/loop.py

@@ -353,6 +353,7 @@ import calendar
 import dataclasses
 import logging
 import re
+import sqlite3
 import time
 from collections import Counter
 from dataclasses import dataclass
@@ -502,6 +503,30 @@ _FIX_DELIVERY_NOTE = (
     + _DELIVERY_NOTE_SECTIONS
 )
 
+# The base-branch rule (issue #78) -- the prevention half of the stacked-base
+# guard, whose detection half pages an operator after the fact. A worker whose
+# task depends on a sibling task's unmerged work is tempted to open its PR ON
+# that branch, and the temptation is reasonable: it makes the diff readable.
+# What it actually does is strand the work. When the parent merges first,
+# GitHub retargets the child onto a branch nothing reads any more; the child
+# then merges into that detached branch and reports success while the default
+# branch never receives the diff (fahera-mx/studio.alissa.app#330/#333/#334 --
+# re-landed by hand as a cherry-pick). The rule names the DEFAULT BRANCH rather
+# than `main` for the same reason the daemon-side check reads it from the API:
+# `main` is a convention, and a worker on a repo defaulting to `master` or
+# `develop` would follow the letter of a `main` rule straight into the failure.
+_DEFAULT_BASE = (
+    "One rule about the PR's BASE: open it against the repository's DEFAULT "
+    "branch (`gh repo view --json defaultBranchRef` if you are unsure) and "
+    "never against another task's branch. Basing on a sibling task's branch to "
+    "make your diff read cleanly is how work gets silently stranded: when that "
+    "parent merges first, GitHub retargets your PR onto a branch nothing reads "
+    "any more, your merge reports success, and the diff never reaches the "
+    "default branch. If your work depends on another task's, say so in the PR "
+    "body and let the operator sequence the merges — ordering between tasks is "
+    "release gating's job, not the PR graph's. "
+)
+
 # The approve-verdict rule (issue #68). An APPROVE hands the branch to the
 # operator, who may merge it the very next second -- observed live on
 # fahera-mx/studio.alissa.app#275: round 4 approved with three [minor]s
@@ -512,7 +537,9 @@ _FIX_DELIVERY_NOTE = (
 # The remedy is a rule about WHERE the work goes, not about how fast the worker
 # is: after an approve the branch is merge-racy BY DEFINITION, so no amount of
 # hurrying makes a push to it safe. Approval-attached [pursue] findings become a
-# fresh branch off main and a follow-up PR -- exactly the recovery that incident
+# fresh branch off the DEFAULT branch (issue #78: not off the approved branch,
+# and not off a sibling task's) and a follow-up PR -- exactly the recovery that
+# incident
 # improvised, made the FIRST move instead of the fallback -- and that PR gets
 # driven to a completed handoff in the same session, because a follow-up nobody
 # reviews is the orphan-draft half of this same issue.
@@ -526,8 +553,10 @@ _APPROVE_FOLLOWUP = (
     "branch. An approved branch is merge-racy by definition: the operator may "
     "merge it at any moment, and a commit pushed after the squash-merge is "
     "silently lost. Findings attached to an approve that you triage "
-    "`[pursue]` are implemented as a NEW branch off main and a FOLLOW-UP pull "
-    "request — never as another push to the approved branch — whose body names "
+    "`[pursue]` are implemented as a NEW branch off the repository's DEFAULT "
+    "branch (never off the approved branch, and never off another task's "
+    "branch) and a FOLLOW-UP pull request opened against that same default "
+    "branch — never as another push to the approved branch — whose body names "
     "the source PR and review round plus BOTH task refs (origin + "
     "implementation), and you drive that follow-up's handoff to completion in "
     "THIS session (ready + review re-request), never leaving it a draft. "
@@ -561,6 +590,7 @@ DEV_DIRECTIVE = (
     "AND your implementation task: the PR body is the canonical cross-actor "
     "record, and each actor's tasks live in its own partition — and attach "
     "the PR URL to the task as evidence. "
+    + _DEFAULT_BASE
     + _DELIVERY_NOTE
     + " Then drive the review handoff with "
     "the alissa-pr-review skill, requesting reviewer(s): {reviewers}. In "
@@ -856,6 +886,23 @@ ORPHAN_REJECTED_COMMENT = (
     "park the work."
 )
 
+STACKED_BASE_COMMENT = (
+    "**Dev loop: this pull request is not based on the default branch** — it "
+    "targets `{base}`, but `{full_name}`'s default branch is `{default}`. A PR "
+    "stacked on another task's branch strands its own work: when the parent "
+    "merges, GitHub retargets this PR onto a branch that no longer receives "
+    "anything, the merge reports success, and the diff never reaches "
+    "`{default}` (fahera-mx/studio.alissa.app#330 / #333 / #334 — the work had "
+    "to be re-landed by hand as a cherry-pick). The daemon has changed "
+    "NOTHING: retargeting a PR after its parent merged silently widens the "
+    "diff to everything the parent carried, so the disposition is yours. "
+    "Operator options: retarget this PR to `{default}` while the parent is "
+    "still open (`gh pr edit {number} --base {default}`), or let it merge into "
+    "the parent knowing the work lands only when the parent does, or close it "
+    "and re-open the branch against `{default}`. Ordering between tasks "
+    "belongs to release gating, not to the PR graph."
+)
+
 ASSIGNMENT_REJECTED_COMMENT = (
     "**Dev loop cannot start** — the daemon tried to self-assign this issue "
     "as its in-flight marker, but GitHub silently dropped the assignment: "
@@ -1003,6 +1050,19 @@ ESCALATION_ORPHAN = "orphan"
 ESCALATION_ORPHAN_READY = "orphan-ready"
 ESCALATION_ORPHAN_REJECTED = "orphan-rejected"
 
+# The stacked-base guard's operator page (issue #78). Keyed on the BARE kind --
+# once per PR for its whole life, not per head and not per base -- because the
+# page describes the PR's SHAPE, not an event on it: a mismatched base is one
+# standing condition with one operator decision behind it, and re-paging every
+# time the head moves would turn a structural warning into a per-push nag on a
+# PR whose operator is already engaged. The cost of the bare key is stated
+# rather than hidden: a PR retargeted from one non-default branch to another
+# does not page again, which is the right trade when the first page already
+# named the default branch and the risk. The `stacked-` prefix keeps these rows
+# from colliding with any issue-edge kind when an issue and a PR share a
+# number, like every other PR-side kind here.
+ESCALATION_STACKED_BASE = "stacked-base"
+
 # CR6 verdict words, spelled exactly as reviewloop's alissa.py spells them --
 # the envelope tie-breaker (see DevWatcher.envelope_verdict) must return
 # these strings, so the two daemons read one vocabulary.
@@ -2711,6 +2771,14 @@ class DevWatcher:
             pr = self.github.pull_request(issue.owner, issue.repo, int(tail))
             if pr.state != "open":
                 continue  # closed between the timeline walk and now
+            # The issue edge's own first sight: this is where a linked open PR
+            # is admitted into the daemon's evaluation, and the stacked-base
+            # guard rides the fetch that already happened. Placed ABOVE the
+            # resumability tests on purpose -- a PR that is not a resume
+            # candidate (handed off, foreign-shaped, another task's work) is
+            # still a PR whose base can strand it, and the guard's own author
+            # test is what keeps it off PRs that are not ours.
+            self._check_stacked_base(pr)
             if not pr.draft or pr.requested_reviewers:
                 log.info(
                     "%s: %s has been handed off (draft=%s, reviewers=%s) — "
@@ -2986,6 +3054,16 @@ class DevWatcher:
         if pr.state != "open":
             return Decision(Action.SKIPPED, "PR closed between search and fetch")
 
+        # FIRST SIGHT of an own open PR on this edge -- the earliest moment the
+        # daemon holds a fetched PR object, and therefore where the stacked-base
+        # guard belongs. Deliberately ABOVE the draft split: with the orphan
+        # sweep on (the default) the search returns drafts, so a PR opened
+        # against a sibling task's branch is paged on the first poll after it is
+        # opened, while retargeting is still free. It is advisory only -- it
+        # changes nothing about the decision below it, which is why its return
+        # value is not consulted here.
+        self._check_stacked_base(pr)
+
         # A draft is out of review by definition (same belt-and-braces as
         # reviewloop's CR1 re-check -- a PR can flip back to draft between
         # search and fetch even when the search excluded drafts). It is also
@@ -4409,6 +4487,102 @@ class DevWatcher:
             task_ref=task_ref,
         )
 
+    def _check_stacked_base(self, pr: PullRequest) -> bool:
+        """Page the operator ONCE when an own open PR is not based on the
+        repository's default branch. Returns whether the page was raised.
+
+        The 2026-07-30 studio incident in one line: a worker opened its PR with
+        base `TASK-1628865936-FORMS-T5` -- its parent task's branch -- instead
+        of the default branch. The parent merged first; GitHub retargeted the
+        child onto a branch nothing reads any more; the child then "merged"
+        into that detached branch, so the PR showed merged, the default branch
+        never received the diff, and the daemon's own accounting degraded to
+        "attempt has opened no pull request" (a PR merged into a branch is
+        invisible to its issue's edge). The work had to be re-landed by hand.
+
+        This guard is ADVISORY BY CONSTRUCTION. It comments and returns; it
+        never retargets, closes, parks, or changes what the calling edge
+        decides. Retargeting is the tempting remedy and the wrong one: after
+        the parent has merged, moving the base to the default branch re-opens
+        the diff against a different merge-base and silently widens the PR to
+        everything the parent carried. Which of the three dispositions is right
+        depends on facts only a human has, so the daemon states the risk and
+        stops.
+
+        Timing is the whole point: the page fires on FIRST SIGHT -- the first
+        poll on which any edge fetches the PR -- because every remedy is cheap
+        while the parent is still open and expensive afterwards. A check at
+        merge time would always be too late.
+
+        Three guards below it, all fail-safe:
+
+        * the PR must be OURS (`author == login`). The callers reach here with
+          own PRs by construction (`author:@me` search, and the resume probe
+          re-checks), but a foreign PR's base is a foreign author's business
+          and this must never comment on one;
+        * a base or a default branch that reads EMPTY is UNKNOWN, not a
+          mismatch. A thin payload, a repository fetch that came back without
+          `default_branch` -- neither is evidence of anything, and paging on
+          absent data is how a guard teaches operators to ignore it;
+        * the ledger row is checked BEFORE the default-branch fetch, so a PR
+          already paged costs nothing further per poll -- the steady state for
+          a stacked PR that the operator has decided to let ride.
+
+        Delivery contract: the row lands only AFTER the comment posts (the
+        stalled pings' contract, not the cap-outs'). This page is the only
+        signal an operator gets for a condition that is otherwise invisible,
+        and nothing else in the system will ever raise it again, so a transient
+        POST failure must retry on the next poll rather than be recorded as
+        delivered. Dry-run logs and records nothing, like every other page.
+        """
+        if pr.author != self.github.login:
+            return False
+        if not pr.base_ref:
+            return False  # no readable base: unknown, never a mismatch
+        if self.state.escalated(
+            pr.full_name, pr.number, ESCALATION_STACKED_BASE
+        ):
+            return False
+        default = self.github.default_branch(pr.owner, pr.repo)
+        if not default or pr.base_ref == default:
+            return False
+
+        log.error(
+            "STACKED BASE %s: the PR targets %r but %s's default branch is "
+            "%r — a PR based on another task's branch strands its work when "
+            "that parent merges; paging the operator on the PR (the daemon "
+            "changes nothing: the disposition is the operator's)",
+            pr.pr_slug,
+            pr.base_ref,
+            pr.full_name,
+            default,
+        )
+
+        body = STACKED_BASE_COMMENT.format(
+            base=pr.base_ref,
+            default=default,
+            full_name=pr.full_name,
+            number=pr.number,
+        )
+        if self.config.dry_run:
+            log.info("[dry-run] would comment on %s:\n%s", pr.pr_slug, body)
+            return False
+
+        try:
+            self.github.comment(pr.owner, pr.repo, pr.number, body)
+        except CommandError as exc:
+            log.error(
+                "could not post the stacked-base comment on %s: %s — not "
+                "recording the page; it retries next poll",
+                pr.pr_slug,
+                exc,
+            )
+            return False
+        self.state.record_escalation(
+            pr.full_name, pr.number, ESCALATION_STACKED_BASE
+        )
+        return True
+
     def _escalate_fix_cap(self, pr: PullRequest, round_: int, attempts: int) -> None:
         """Operator page for a fix cap-out, posted ON the PR (the issue
         edge's _escalate shape): log, comment (dry-run gated), and record
@@ -6330,6 +6504,26 @@ class DevWatcher:
                 except CommandError as exc:
                     backoff = min(backoff * 2, 900)
                     log.error("poll failed: %s — retrying in %ds", exc, backoff)
+                except sqlite3.Error as exc:
+                    # The BACKSTOP for the strict half of the state layer
+                    # (issue #76). The bookkeeping writes degrade on their own
+                    # (state._best_effort) and never arrive here; what does is
+                    # a spawn-ledger write, which must NOT be swallowed -- a
+                    # forgotten spawn row would let the daemon re-spawn over
+                    # live work. Abandoning the pass and retrying is the honest
+                    # middle: the ledger is intact, the cause is named, and a
+                    # volume that goes read-only under a running daemon costs a
+                    # backed-off retry instead of the process. That is the
+                    # whole lesson of the 2026-07-29 revloop incident -- a
+                    # local storage fault must never be terminal for an
+                    # unattended loop.
+                    backoff = min(backoff * 2, 900)
+                    log.error(
+                        "poll abandoned: the state ledger raised %s — this is "
+                        "a LOCAL storage fault (a read-only or wedged volume), "
+                        "not a GitHub or auth failure; retrying in %ds",
+                        exc, backoff,
+                    )
                 time.sleep(backoff)
             except KeyboardInterrupt:
                 log.info("stopping")

{alissa_tools_github_devloop-0.8.3 → alissa_tools_github_devloop-0.8.5}/src/main/alissa/tools/github/devloop/state.py

@@ -69,15 +69,26 @@ and a bare-name key would collide their ledgers into one row.
 from __future__ import annotations
 
 import json
+import logging
 import sqlite3
 import time
 from pathlib import Path
+from typing import Callable
+
+log = logging.getLogger(__name__)
 
 # Poll-snapshot retention: the newest N rows are kept, older pruned on write.
 # Fixed, not a config key -- the table is an observation buffer for the UI,
 # and a bounded ring is all the console needs (it reads the recent tail).
 SNAPSHOT_RETENTION = 1000
 
+# How many consecutive best-effort write failures get their own WARN before the
+# stream is suppressed. A wedged volume fails EVERY write of EVERY poll, so an
+# unbounded warning is a log flood that buries the daemon's actual work; the
+# first few carry the diagnosis, and the recovery line (always logged) reports
+# the total the streak reached. See State._best_effort.
+DEGRADED_WARN_STREAK = 3
+
 SCHEMA = """
 CREATE TABLE IF NOT EXISTS spawns (
     repo_slug  TEXT    NOT NULL,
@@ -153,10 +164,46 @@ _COLUMN_MIGRATIONS = (
 )
 
 
+# The dedupe-gate tables, and the column order _flush_pending_gates replays
+# them in: (key column, number column, kind column, timestamp column). Both are
+# `INSERT OR IGNORE` targets keyed on their first three columns, which is what
+# makes a replay safe to run against rows that may already exist.
+_GATE_REPLAY = {
+    "escalations": ("repo_slug", "issue", "kind", "escalated_at"),
+    "activity_log": ("repo_slug", "number", "kind", "logged_at"),
+}
+
+
+def _migrate_columns(db: sqlite3.Connection) -> None:
+    """Apply the additive column migrations `IF NOT EXISTS` cannot: add any
+    _COLUMN_MIGRATIONS column missing from an already-existing table.
+    Idempotent -- the live column set is checked first, so a fresh DB (the
+    column already in SCHEMA) and a re-open both no-op.
+
+    Module-level, taking the connection: State._reconnect has to bring a
+    REPLACEMENT handle up to the same schema as __init__ did, and a method
+    bound to self._db could not be used before the swap."""
+    for table, column, ddl in _COLUMN_MIGRATIONS:
+        live = {row["name"] for row in db.execute(f"PRAGMA table_info({table})")}
+        if column not in live:
+            db.execute(f"ALTER TABLE {table} ADD COLUMN {column} {ddl}")
+
+
 class State:
     def __init__(self, path: Path):
         path = Path(path).expanduser()
         path.parent.mkdir(parents=True, exist_ok=True)
+        self._path = path
+        # Length of the current streak of failed best-effort writes; 0 while
+        # the store is healthy. Drives both the reconnect attempt and the
+        # warning suppression (see _best_effort).
+        self._degraded = 0
+        # Dedupe keys whose row could NOT be written, mapped to the timestamp
+        # the row would have carried. Consulted by escalated() and
+        # activity_logged() so a gate that exists to fire ONCE still fires once
+        # while the store is unwritable, and REPLAYED by _flush_pending_gates
+        # when writes work again -- see _degraded_gate.
+        self._pending_gates: "dict[tuple[str, str, int, str], int]" = {}
         self._db = sqlite3.connect(str(path))
         self._db.row_factory = sqlite3.Row
         self._db.executescript(SCHEMA)
@@ -164,19 +211,214 @@ class State:
         self._db.commit()
 
     def _migrate(self) -> None:
-        """Apply the additive column migrations `IF NOT EXISTS` cannot: add any
-        _COLUMN_MIGRATIONS column missing from an already-existing table.
-        Idempotent -- the live column set is checked first, so a fresh DB (the
-        column already in SCHEMA) and a re-open both no-op."""
-        for table, column, ddl in _COLUMN_MIGRATIONS:
-            live = {
-                row["name"]
-                for row in self._db.execute(f"PRAGMA table_info({table})")
-            }
-            if column not in live:
+        """Apply the additive column migrations to this State's connection."""
+        _migrate_columns(self._db)
+
+    # -- best-effort writes (the 2026-07-29 volume incident, issue #76) -----
+    #
+    # This ledger sits on the same platform volume the daemon's config does,
+    # and that volume can go read-only underneath a RUNNING process -- which is
+    # exactly what happened to the revloop sibling on 2026-07-29: a telemetry
+    # write raised `attempt to write a readonly database` and took the whole
+    # poll loop down with it. Losing telemetry is a nuisance; losing the daemon
+    # needs a human.
+    #
+    # So the writes are split by what a LOST ROW actually costs:
+    #
+    #   best-effort  record_snapshot / record_activity / record_escalation --
+    #                observation and dedupe bookkeeping. Their side effect (the
+    #                snapshot row, the posted comment) either does not exist yet
+    #                or has ALREADY landed on GitHub by the time the row is
+    #                written, so a dropped row degrades the ledger -- a missing
+    #                console sample -- and nothing more.
+    #
+    #                The two that are DEDUPE GATES are additionally contained
+    #                in memory (_degraded_gate): "degrade" must mean a stale
+    #                console, not the same operator comment re-posted to a real
+    #                GitHub issue once per poll for the length of an outage this
+    #                daemon is built to survive for hours (PR #77 review r1).
+    #
+    #   strict       record_spawn / record_fix_spawn / record_maintain_spawn --
+    #                the attempt ledger. A dropped row makes the daemon forget a
+    #                session it just launched: it would re-spawn over live work
+    #                and mis-count the attempt cap. That must not be swallowed,
+    #                so those keep raising -- and loop.run_forever now catches
+    #                sqlite3.Error at the pass boundary, so raising costs a
+    #                backed-off retry instead of the process.
+    #
+    # Callers do not choose: the classification lives on the method, so a new
+    # call site inherits the right posture from the method it calls.
+
+    def _reconnect(self) -> bool:
+        """Replace the connection after a failed write, then let the caller
+        retry it once.
+
+        Attempted on EVERY failure, not just the first of a streak, and that is
+        deliberate: when sqlite opens a file it cannot write, the handle is
+        read-only for its whole life, so a store that recovers underneath a
+        once-reconnected daemon would stay broken until someone restarted the
+        container -- the precise opposite of self-healing, and the same shape of
+        bug as the crash this whole change is undoing. The cost of being
+        generous is one sqlite3.connect() per failed write, i.e. a syscall or
+        two per poll while degraded, against a recovery that needs no human.
+
+        The new connection is opened BEFORE the old one is dropped, so a failed
+        reconnect leaves the working handle in place. Closing first would trade
+        a store that is merely unwritable for one that cannot even be READ --
+        and every staleness and dedupe decision the daemon makes is a read.
+
+        The replacement gets the SCHEMA and the column migrations applied, the
+        same as __init__. sqlite3.connect() CREATES an empty database at a
+        missing path, and the documented recovery for the 2026-07-29 incident
+        was a human wiping the volume -- do that under a running daemon and a
+        bare reconnect would report success on a schema-less handle, after
+        which every (strict) read raises `no such table` and the daemon spins
+        at the backoff cap forever: alive, warning, and unable to decide
+        anything. `CREATE TABLE IF NOT EXISTS` throughout means re-applying is
+        idempotent, and on an intact read-only database it needs no write at
+        all, so this stays cheap on the path that actually runs."""
+        try:
+            db = sqlite3.connect(str(self._path))
+            db.row_factory = sqlite3.Row
+            db.executescript(SCHEMA)
+            _migrate_columns(db)
+            db.commit()
+        except sqlite3.Error as exc:
+            log.debug("state: reconnect to %s failed: %s", self._path, exc)
+            return False
+        try:
+            self._db.close()
+        except sqlite3.Error:
+            pass
+        self._db = db
+        return True
+
+    def _degraded_gate(self, table: str, repo_slug: str, number: int,
+                       kind: str, ts: int, wrote: bool) -> None:
+        """Remember a dedupe key whose row did not land, with the timestamp the
+        row would have carried. `escalated()` / `activity_logged()` consult it,
+        so a gate that exists to fire exactly once still fires exactly once
+        while the store is unwritable -- instead of re-posting its comment
+        every poll.
+
+        The key is released by _flush_pending_gates, NOT by a later call from
+        the same call site: every one of those is itself gated on this key, so
+        once it is held the code that would write the row is unreachable (PR
+        #77 review round 2). `ts` is captured here rather than at replay time
+        because `escalated_at` is an audit field for when the escalation was
+        first RAISED -- the row must not claim the volume's recovery time."""
+        key = (table, repo_slug, number, kind)
+        if wrote:
+            self._pending_gates.pop(key, None)
+        else:
+            self._pending_gates.setdefault(key, ts)
+
+    def _gate_pending(self, table: str, repo_slug: str, number: int,
+                      kind: str) -> bool:
+        return (table, repo_slug, number, kind) in self._pending_gates
+
+    def _flush_pending_gates(self) -> None:
+        """Land the deferred dedupe rows now that a write has succeeded.
+
+        This is the half that makes the in-memory containment two-way, and
+        without it the containment is a TRAP: every call site reads
+        escalated() / activity_logged() first, the in-memory key already
+        answers True, so record_escalation is never called for that key again
+        and the row would never land at all. The costs are not hypothetical --
+        `escalations` is not only a comment receipt but the orphan sweep's
+        state breadcrumb (orphan_ready_kind records that THIS daemon flipped a
+        PR ready), so a row that never lands means a restarted daemon re-runs
+        mark_ready and request_reviews against that head; and the console
+        sidecar is a separate process that can only see the table.
+
+        `INSERT OR IGNORE` throughout, so replaying a row that already exists
+        is a no-op. A still-failing store keeps every key and tries again on
+        the next successful write."""
+        if not self._pending_gates:
+            return
+        landed = []
+        for key, ts in list(self._pending_gates.items()):
+            table, repo_slug, number, kind = key
+            columns = _GATE_REPLAY[table]
+            try:
                 self._db.execute(
-                    f"ALTER TABLE {table} ADD COLUMN {column} {ddl}"
+                    f"INSERT OR IGNORE INTO {table} "
+                    f"({', '.join(columns)}) VALUES (?,?,?,?)",
+                    (repo_slug, number, kind, ts),
+                )
+                self._db.commit()
+            except sqlite3.Error as exc:
+                log.debug(
+                    "state: replay of %s deferred while the ledger is still "
+                    "unwritable (%s)", table, exc,
                 )
+                break
+            landed.append(key)
+        for key in landed:
+            self._pending_gates.pop(key, None)
+        if landed:
+            log.warning(
+                "state: replayed %d dedupe row(s) deferred while the ledger "
+                "was unwritable; %d still pending",
+                len(landed), len(self._pending_gates),
+            )
+
+    def _note_write_ok(self, what: str) -> None:
+        """Close out a degraded streak once a write lands again: report the
+        total it reached, so the suppressed middle of a long outage is still
+        accounted for in the log, and re-arm the warnings."""
+        if self._degraded:
+            log.warning(
+                "state: %s succeeded -- the ledger at %s is accepting writes "
+                "again after %d failed write(s)",
+                what, self._path, self._degraded,
+            )
+            self._degraded = 0
+        # Unconditional, not folded into the branch above: a partial replay
+        # leaves keys behind with the streak already reset, and they must still
+        # get their next chance.
+        self._flush_pending_gates()
+
+    def _best_effort(self, what: str, write: Callable[[], None]) -> bool:
+        """Run one bookkeeping write so a failing store degrades this ledger
+        instead of killing the caller. Returns whether the row landed.
+
+        `what` names the write for the log. Only sqlite3.Error is caught -- a
+        TypeError from a malformed call site is a bug and still raises."""
+        try:
+            write()
+        except sqlite3.Error as exc:
+            # Leave no half-open transaction behind: the READS are strict, and
+            # they are what every staleness and dedupe decision runs on.
+            try:
+                self._db.rollback()
+            except sqlite3.Error:
+                pass
+            if self._reconnect():
+                try:
+                    write()
+                except sqlite3.Error as retry_exc:
+                    exc = retry_exc
+                else:
+                    self._note_write_ok(what)
+                    return True
+            self._degraded += 1
+            if self._degraded <= DEGRADED_WARN_STREAK:
+                log.warning(
+                    "state: %s failed (%s) -- the ledger at %s is not "
+                    "accepting writes; the daemon keeps polling with degraded "
+                    "bookkeeping (failure %d of this streak)",
+                    what, exc, self._path, self._degraded,
+                )
+                if self._degraded == DEGRADED_WARN_STREAK:
+                    log.warning(
+                        "state: suppressing further write-failure warnings "
+                        "until the ledger recovers (one line will report the "
+                        "total)",
+                    )
+            return False
+        self._note_write_ok(what)
+        return True
 
     def close(self) -> None:
         self._db.close()
@@ -423,7 +665,13 @@ class State:
     def escalated(self, repo_slug: str, issue: int, kind: str) -> bool:
         """Whether an escalation of this KIND was already raised. Kinds
         dedupe independently -- a cap-out row never silences an
-        assignment-rejection comment, and vice versa."""
+        assignment-rejection comment, and vice versa.
+
+        Answers True as well when the row could not be WRITTEN this run (see
+        _degraded_gate): the comment went out, so the gate it stands for is
+        closed whether or not sqlite accepted the receipt."""
+        if self._gate_pending("escalations", repo_slug, issue, kind):
+            return True
         row = self._db.execute(
             "SELECT 1 FROM escalations WHERE repo_slug=? AND issue=? AND kind=?",
             (repo_slug, issue, kind),
@@ -433,13 +681,33 @@ class State:
     def record_escalation(self, repo_slug: str, issue: int, kind: str) -> None:
         """Idempotent per kind: OR IGNORE keeps the FIRST escalation's
         timestamp, so `escalated_at` is an audit field for when this kind of
-        escalation was first raised, not the most recent re-raise."""
-        self._db.execute(
-            "INSERT OR IGNORE INTO escalations "
-            "(repo_slug, issue, kind, escalated_at) VALUES (?,?,?,?)",
-            (repo_slug, issue, kind, int(time.time())),
+        escalation was first raised, not the most recent re-raise.
+
+        BEST-EFFORT (see _best_effort): every caller posts the operator comment
+        BEFORE recording, so the row is a dedupe gate, never the escalation
+        itself. Raising here would abandon a poll pass over bookkeeping for a
+        comment that already landed. Dropping the row is not free either -- it
+        would re-open the gate and re-post the comment every poll -- so a
+        failed write is CONTAINED in memory (_degraded_gate) and REPLAYED by
+        _flush_pending_gates on the next write that succeeds. The gate holds
+        meanwhile, and the row lands with its original timestamp. The replay is
+        what makes that true: this call site is itself gated on the key, so it
+        will never be reached a second time to write the row itself."""
+        ts = int(time.time())
+
+        def write() -> None:
+            self._db.execute(
+                "INSERT OR IGNORE INTO escalations "
+                "(repo_slug, issue, kind, escalated_at) VALUES (?,?,?,?)",
+                (repo_slug, issue, kind, ts),
+            )
+            self._db.commit()
+
+        self._degraded_gate(
+            "escalations", repo_slug, issue, kind, ts,
+            self._best_effort(
+                f"record_escalation({repo_slug}#{issue}, {kind})", write),
         )
-        self._db.commit()
 
     # -- mechanical activity comment dedupe -------------------------------
     #
@@ -459,7 +727,13 @@ class State:
     def activity_logged(self, repo_slug: str, number: int, kind: str) -> bool:
         """Whether this activity KIND already landed a line -- the
         once-per-episode gate for capacity-deferral telemetry. Independent of
-        `escalated()`: a deferral line is not an operator escalation."""
+        `escalated()`: a deferral line is not an operator escalation.
+
+        Contained in memory on a failed write, exactly like `escalated()`: the
+        line is already on the comment, so an unwritable ledger must not turn
+        "one line per episode" into one line per poll."""
+        if self._gate_pending("activity_log", repo_slug, number, kind):
+            return True
         row = self._db.execute(
             "SELECT 1 FROM activity_log WHERE repo_slug=? AND number=? AND kind=?",
             (repo_slug, number, kind),
@@ -470,13 +744,28 @@ class State:
         """Idempotent per kind: OR IGNORE keeps the first line's timestamp.
         Recorded by the caller only AFTER the append lands, so a transient
         comment failure retries next poll and the line lands exactly once per
-        episode."""
-        self._db.execute(
-            "INSERT OR IGNORE INTO activity_log "
-            "(repo_slug, number, kind, logged_at) VALUES (?,?,?,?)",
-            (repo_slug, number, kind, int(time.time())),
+        episode.
+
+        BEST-EFFORT (see _best_effort): this is the dedupe gate for a
+        MECHANICAL log line -- telemetry by construction, and already posted by
+        the time it is called. Contained in memory on failure like
+        record_escalation, so an unwritable store costs neither the poll pass
+        nor a repeated line."""
+        ts = int(time.time())
+
+        def write() -> None:
+            self._db.execute(
+                "INSERT OR IGNORE INTO activity_log "
+                "(repo_slug, number, kind, logged_at) VALUES (?,?,?,?)",
+                (repo_slug, number, kind, ts),
+            )
+            self._db.commit()
+
+        self._degraded_gate(
+            "activity_log", repo_slug, number, kind, ts,
+            self._best_effort(
+                f"record_activity({repo_slug}#{number}, {kind})", write),
         )
-        self._db.commit()
 
     # -- poll snapshots (the UI sidecar's exhaust buffer) ------------------
 
@@ -503,38 +792,50 @@ class State:
         to JSON. `deferred` counts the max_sessions-deferred items of the
         pass (defaults to 0 so callers predating the valve keep working).
         Purely observational -- written on every pass, dry-run included --
-        and pruned on write, so the table is self-bounding."""
-        self._db.execute(
-            "INSERT INTO poll_snapshots "
-            "(ts, duration_ms, issue_candidates, pr_candidates, "
-            "maintain_candidates, reaped, spawned, in_flight, skipped, "
-            "escalated, capped, deferred, stages_json) "
-            "VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?)",
-            (
-                int(time.time()),
-                duration_ms,
-                issue_candidates,
-                pr_candidates,
-                maintain_candidates,
-                reaped,
-                spawned,
-                in_flight,
-                skipped,
-                escalated,
-                capped,
-                deferred,
-                json.dumps(stages, separators=(",", ":")),
-            ),
-        )
-        # Prune on write: keep the newest SNAPSHOT_RETENTION rows by id. The
-        # autoincrement id is monotonic across prunes, so "newest" is well
-        # defined even when a wall-clock step would leave `ts` unordered.
-        self._db.execute(
-            "DELETE FROM poll_snapshots WHERE id NOT IN "
-            "(SELECT id FROM poll_snapshots ORDER BY id DESC LIMIT ?)",
-            (SNAPSHOT_RETENTION,),
-        )
-        self._db.commit()
+        and pruned on write, so the table is self-bounding.
+
+        BEST-EFFORT (see _best_effort), and the most consequential of the
+        three: this is the ONE state write EVERY poll pass makes
+        unconditionally, so it was also the one guaranteed to meet a volume
+        that had gone read-only -- and to take the poll loop down with it on
+        the very first pass, exactly as it did to the revloop sibling on
+        2026-07-29. A console that goes stale is the right price for a daemon
+        that keeps polling."""
+        def write() -> None:
+            self._db.execute(
+                "INSERT INTO poll_snapshots "
+                "(ts, duration_ms, issue_candidates, pr_candidates, "
+                "maintain_candidates, reaped, spawned, in_flight, skipped, "
+                "escalated, capped, deferred, stages_json) "
+                "VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?)",
+                (
+                    int(time.time()),
+                    duration_ms,
+                    issue_candidates,
+                    pr_candidates,
+                    maintain_candidates,
+                    reaped,
+                    spawned,
+                    in_flight,
+                    skipped,
+                    escalated,
+                    capped,
+                    deferred,
+                    json.dumps(stages, separators=(",", ":")),
+                ),
+            )
+            # Prune on write: keep the newest SNAPSHOT_RETENTION rows by id.
+            # The autoincrement id is monotonic across prunes, so "newest" is
+            # well defined even when a wall-clock step would leave `ts`
+            # unordered.
+            self._db.execute(
+                "DELETE FROM poll_snapshots WHERE id NOT IN "
+                "(SELECT id FROM poll_snapshots ORDER BY id DESC LIMIT ?)",
+                (SNAPSHOT_RETENTION,),
+            )
+            self._db.commit()
+
+        self._best_effort("record_snapshot", write)
 
     def read_snapshots(self, limit: "int | None" = None) -> "list[dict]":
         """The UI reader: poll snapshots newest-first, each with its per-item

alissa_tools_github_devloop-0.8.5/src/main/alissa/tools/github/devloop/version

@@ -0,0 +1 @@
+0.8.5

{alissa_tools_github_devloop-0.8.3 → alissa_tools_github_devloop-0.8.5/src/main/alissa_tools_github_devloop.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: alissa-tools-github-devloop
-Version: 0.8.3
+Version: 0.8.5
 Summary: ALISSA-TOOLS-GITHUB-DEVLOOP
 Home-page: https://alissa.app
 Author: Fahera

alissa_tools_github_devloop-0.8.3/src/main/alissa/tools/github/devloop/version

@@ -1 +0,0 @@
-0.8.3