alissa-tools-github-orcloop 0.4.0__tar.gz → 0.4.2__tar.gz

{alissa_tools_github_orcloop-0.4.0/src/main/alissa_tools_github_orcloop.egg-info → alissa_tools_github_orcloop-0.4.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: alissa-tools-github-orcloop
-Version: 0.4.0
+Version: 0.4.2
 Summary: ALISSA-TOOLS-GITHUB-ORCLOOP
 Home-page: https://alissa.app
 Author: Fahera

{alissa_tools_github_orcloop-0.4.0 → alissa_tools_github_orcloop-0.4.2}/src/main/alissa/tools/github/orcloop/console.py

@@ -48,6 +48,8 @@ import hashlib
 import hmac
 import html
 import logging
+import socket
+import sys
 import threading
 from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
 from typing import Any
@@ -68,6 +70,14 @@ WORKPLAN_PATH = "/workplan"
 HEALTH_PATH = "/healthz"
 
 
+def _static_prefix(fmt: str) -> str:
+    """A log format's literal head, up to its first placeholder.
+
+    The one thing that can be taken from a logging call whose arguments are
+    untrusted: it is written in the source, not received from a socket."""
+    return fmt.split("%", 1)[0].strip() or "error"
+
+
 def session_token(passcode: str) -> str:
     """The cookie value for a passcode. Never the passcode itself."""
     return hmac.new(
@@ -137,29 +147,86 @@ class ConsoleHandler(BaseHTTPRequestHandler):
     # -- plumbing ----------------------------------------------------------
 
     def log_message(self, fmt: str, *args: Any) -> None:
-        """Access logging at DEBUG, with the query string removed.
-
-        The passcode may arrive as `?passcode=...` exactly once (the unlock
-        redirect), and the default implementation would write that whole line
-        to stderr. Dropping the query is what makes the query-param unlock safe
-        to offer at all.
+        """The base class's catch-all sink, kept as a backstop.
+
+        `log_request` and `log_error` below override the only two callers
+        `BaseHTTPRequestHandler` has for this method, so nothing in today's
+        flow reaches it -- but leaving it un-overridden would let any future
+        stdlib caller write the raw request line to stderr, which is the
+        behaviour both of those exist to prevent. It renders the same
+        stripped label and nothing from `args`; the reasoning for that is on
+        `_request_label` and `log_error`."""
+        log.debug("console %s", self._request_label())
+
+    def _request_label(self) -> str:
+        """`<METHOD> <path>` with the query string removed, and safe to build
+        at any point in the request's life. Every logging path starts here, so
+        there is exactly one place that touches `self.path`.
 
         `self.path` MUST be read defensively. It is set by `parse_request`, and
-        this method runs before that on every path where the request line was
-        never parsed: a malformed request line, a bad HTTP version, a request
-        line over 64KB (all three reach here through `send_error` ->
-        `log_error`), and an idle connection hitting `timeout` above. An
+        the callers below run before that on every path where the request line
+        was never parsed: a malformed request line, a bad HTTP version, a
+        request line over 64KB (all three arrive through `send_error` ->
+        `log_error`), and an idle connection hitting `timeout`. An
         `AttributeError` here escapes `handle()`, so the stdlib's own `400`
         never gets sent AND `socketserver.handle_error` dumps a traceback --
         unauthenticated, below the gate, once per connection. A daemon that
         demotes `SKIPPED` to DEBUG for the sake of an unattended log must not
-        let anyone who can open a socket write a traceback into it."""
+        let anyone who can open a socket write a traceback into it.
+
+        The query string is dropped for the other half of the same standard:
+        the passcode arrives as `?passcode=...` exactly once, on the unlock,
+        and the default implementation would write that whole line out."""
         try:
             raw = getattr(self, "path", None)
             path = urlparse(raw).path if raw else "-"
         except ValueError:  # pragma: no cover - urlparse is total for str
             path = "(unparseable)"
-        log.debug("console %s %s", getattr(self, "command", "-"), path)
+        return f"{getattr(self, 'command', None) or '-'} {path}"
+
+    def log_request(self, code: "int | str" = "-", size: "int | str" = "-") -> None:
+        """A served request, WITH its status code.
+
+        The code comes from this method's own argument, never from the
+        stdlib's `log_request` format -- that one is
+        `'"%s" %s %s' % (self.requestline, code, size)`, and `requestline`
+        carries the full path INCLUDING the query string, which is the one
+        thing this class exists to keep out of the log (the passcode arrives
+        there once, on the unlock). So the line is rebuilt from the stripped
+        label instead of formatted from the request line."""
+        log.debug("console %s -> %s", self._request_label(), code)
+
+    def log_error(self, fmt: str, *args: Any) -> None:
+        """An error the stdlib is reporting: its STATUS CODE, never its text.
+
+        The code is what an operator who turned DEBUG on because the console is
+        answering 400s came for -- through 0.4.0 they got a line with no
+        method, no path and no code, because these paths run before
+        `parse_request` sets any of them.
+
+        Nothing from `args` is interpolated, and that rule is deliberately
+        stronger than scrubbing the query out of the rendered string. The first
+        version of this method rendered `fmt % args` on the reasoning that
+        neither sender's FORMAT carries a request line -- which is true, and
+        irrelevant: `parse_request` passes `"Bad request syntax (%r)" %
+        requestline` as `send_error`'s MESSAGE ARGUMENT, so the whole line,
+        query string and passcode included, arrived in `args`. The format is
+        not the payload. A rule that depends on having enumerated the senders
+        correctly is a rule that fails the next time one of them changes, so
+        this one does not enumerate them:
+
+        * an integer first argument is a status code (`send_error` passes one)
+          and is rendered as an integer;
+        * anything else falls back to the format's own static prefix, up to its
+          first placeholder -- `Request timed out:` for the timeout path.
+
+        The second reason to render nothing from `args`: the request line is
+        capped just under 64KB by `readline(65537)`, so rendering it let any
+        client that could open a socket write ~60KB of its own choosing into
+        the daemon's log, once per connection, below the gate."""
+        code = args[0] if args and isinstance(args[0], int) else None
+        detail = f"code {int(code)}" if code is not None else _static_prefix(fmt)
+        log.debug("console %s: %s", self._request_label(), detail)
 
     def _send(self, status: int, body: str, ctype: str = "text/html; charset=utf-8",
               extra: "list[tuple[str, str]] | None" = None) -> None:
@@ -288,6 +355,31 @@ class ConsoleHandler(BaseHTTPRequestHandler):
         self._send(200, render_page(plan, refresh_seconds=self.context.poll_interval))
 
 
+class _ConsoleServer(ThreadingHTTPServer):
+    """`ThreadingHTTPServer` that reports a broken connection as one line.
+
+    The base class answers ANY exception escaping a handler with
+    `traceback.print_exc()` to stderr, and the commonest one here is not a bug:
+    a client that disconnects mid-response (a browser navigating away, a
+    platform TCP health probe, anything that reads a prefix and hangs up)
+    raises `ConnectionResetError`/`BrokenPipeError` out of `wfile.write`.
+    Unhandled, each one prints a multi-line traceback -- unauthenticated, below
+    the gate, once per occurrence, which is the same standard the request-line
+    guard on `_request_label` is written to.
+
+    Found while re-verifying the `log_error` fix against a live socket rather
+    than reported by a review; the two are one class of defect, so they are
+    fixed together. Anything that is NOT a disconnect keeps the base class's
+    traceback: a real bug in a handler must stay loud."""
+
+    def handle_error(self, request, client_address) -> None:
+        exc = sys.exc_info()[1]
+        if isinstance(exc, (ConnectionResetError, BrokenPipeError, socket.timeout)):
+            log.debug("console: client went away (%s)", type(exc).__name__)
+            return
+        super().handle_error(request, client_address)
+
+
 def _handler_for(context: ConsoleContext) -> type:
     """A handler class bound to one context.
 
@@ -336,7 +428,7 @@ class Console:
         return self._server.server_address[:2]  # type: ignore[return-value]
 
     def start(self) -> None:
-        server = ThreadingHTTPServer(
+        server = _ConsoleServer(
             (self._host, self._port), _handler_for(self._context)
         )
         server.daemon_threads = True

{alissa_tools_github_orcloop-0.4.0 → alissa_tools_github_orcloop-0.4.2}/src/main/alissa/tools/github/orcloop/loop.py

@@ -319,6 +319,14 @@ released before a feed switch):
   the merge already happened, so holding the close would only strand the task.
 * Closed with NO merged closing PR -> the `closed-unmerged` escalation only;
   the task is NOT mutated (a human closed it, or the work was abandoned).
+* The origin task itself cannot be READ (404) on `ORIGIN_MISSING_MAX_ATTEMPTS`
+  distinct polls (O22, issue #58) -> the close loop for that item is ABANDONED:
+  a `closeloop-terminal:origin-archived` ledger row, exactly one comment on the
+  GitHub issue, and no Alissa read or write for it ever again. A task that
+  404s to the token that created it has been archived past the workspace's
+  retention window or deleted, and no retry recovers that -- while retrying
+  pages the one artifact guaranteed unreachable, which is how this daemon spent
+  four days generating a denied write per poll per item. See `_origin_missing`.
 * The origin task already moved on (validated/cancelled/blocked/... -- the
   operator drove it by hand) -> skip and log, never fight the operator.
 
@@ -334,7 +342,11 @@ longer than the same `release_blocked_floor_days` floor -- measured on the
 FAILURE, not the task's age, so a transient rate limit on a long-queued task
 never pages -- because a hold that could never page is how a task goes quiet
 forever), and `closeloop-failed:a<j>` (a close-loop mutation failed; retried
-with a floor between attempts, each attempt paging once).
+with a floor between attempts, each attempt paging once). One escalation is
+NOT posted on the task: `closeloop-terminal:origin-archived` is about a task
+that cannot be read, so its only channel is the GitHub issue -- and there the
+issue comment is PRIMARY, its delivery gating the ledger row, rather than the
+best-effort second copy every other page treats it as.
 
 NO SILENT STATES: every candidate and every released issue produces exactly one
 logged `Decision` each pass -- a deferral (`held`) always leaves a per-poll log
@@ -387,6 +399,7 @@ from .alissa_client import (
     VIEW_HEADLINE,
     AlissaClient,
     AlissaError,
+    AlissaNotFound,
     AlissaTransient,
     BodyOfWork,
     BowMember,
@@ -522,6 +535,73 @@ ESCALATION_CLOSELOOP_FAILED = "closeloop-failed"
 ESCALATION_ALREADY_MERGED = "already-merged"
 ESCALATION_DEDUPE_UNREADABLE = "dedupe-unreadable"
 
+# The close edge gave up on an item for good, with the REASON folded into the
+# kind (`closeloop-terminal:<reason>`, the same "narrow the dedupe scope by
+# folding more key into the string" the ledger's kind column is TEXT for). The
+# row is read back with a prefix scan, so the reason an operator sees in the
+# skip line every later poll comes out of the ledger rather than out of a
+# constant this code happens to pick -- which is what makes the reason a
+# recorded fact instead of a log-time guess.
+#
+# One reason today (O22, issue #58): the origin task's own read answers 404
+# forever, because the task was ARCHIVED after validation (the platform's
+# `autoArchiveDays` default) or deleted. Nothing about that self-heals, so
+# every close-loop attempt after it is spent producing a failure -- and, worse,
+# the failure's escalation targets that same unreachable task, so the daemon
+# generates a denied write per poll per item, forever (the studio Convex
+# `apiAddComment` NO_ACCESS storm this constant ends).
+ESCALATION_CLOSELOOP_TERMINAL = "closeloop-terminal"
+CLOSELOOP_TERMINAL_ORIGIN_ARCHIVED = "origin-archived"
+
+# How many close-loop passes may see the origin task answer 404 before the item
+# is given up on. A 404 is a PERMANENT status in the client's taxonomy, but
+# "permanent" there is a classification and not an observation (the argument
+# `_close_evidence_unwritable` makes at length): a task can 404 for a few
+# seconds while the API is mid-failover, and giving up on the first one would
+# spend a one-way remedy on a blip. Three DISTINCT polls is the same shape as
+# the O14 context floor -- long enough that a blip cannot reach it, short
+# enough that the item drains within a poll interval or three rather than
+# staying in the ledger for hours.
+#
+# Counted in POLLS and not in seconds, unlike `CLOSELOOP_RETRY_FLOOR_SECONDS`:
+# the point of that floor is to stop hammering an endpoint that might recover,
+# and this path issues exactly one read per poll and then stops touching Alissa
+# at all, so there is nothing to throttle -- while an hours-long clock would
+# leave a known-dead item generating denied writes for those hours.
+ORIGIN_MISSING_MAX_ATTEMPTS = 3
+
+# NOT an operator page: one row per poll that saw the origin task 404, so the
+# count of CONSECUTIVE failed reads survives a restart and, crucially, ADVANCES
+# AT ALL.
+#
+# This is the ledger the incident was missing. The failure used to be counted
+# by the `closeloop-failed:a<j>` page rows -- and those are recorded by
+# `_escalate` only AFTER its primary comment lands, on the Alissa task. When the
+# task is the artifact that 404'd, that comment is denied (NO_ACCESS), no row is
+# written, and the next poll recomputes attempt 1 from an empty ledger: the
+# production log showed `(attempt 1)` on every poll for four days. So this row
+# is written by the loop itself, before anything can refuse it -- a counter
+# whose advance depends on a remote write is not a counter.
+#
+# `marker:` for the reason the other markers carry it: `escalations_matching` is
+# a prefix reader, and these rows must stay out of every prefix read of a page
+# kind.
+#
+# CLEARED THE MOMENT A READ ANSWERS (`_origin_answered`), which is what makes
+# the count CONSECUTIVE rather than lifetime-cumulative -- the distinction the
+# round-1 `[major]` turned on. Cumulative counting reaches the bound on three
+# unrelated blips spread over days, and the item it then abandons for good may
+# be perfectly alive: an item whose close-loop WRITE keeps failing stays in the
+# ledger for days on the retry floor, and every one of those retries is another
+# chance to catch a 404 that means nothing. Abandonment is irreversible and
+# self-silencing, so the evidence for it has to be an unbroken run -- and the
+# page that announces it says "consecutive", which a lifetime count would make
+# a false claim. The audit-trail argument for keeping spent rows loses to that:
+# the same argument applies to `marker:dedupe-unreadable`, which is cleared for
+# exactly this reason (a blip that clears must not make the next outage look
+# days old).
+ORIGIN_MISSING_ATTEMPT = "marker:origin-missing"
+
 # The close edge could not write its evidence AT ALL -- not the enriched
 # delivery record, not the bare confirmation line -- for longer than the
 # close-loop retry floor, so the hand-off completed WITHOUT evidence (O17,
@@ -674,6 +754,43 @@ def closeloop_failed_kind(attempt: int) -> str:
     return f"{ESCALATION_CLOSELOOP_FAILED}:a{attempt}"
 
 
+def closeloop_terminal_kind(reason: str) -> str:
+    """The ledger kind recording that the close edge gave up on an item, with
+    the REASON in the key (`closeloop-terminal:<reason>`).
+
+    Folding the reason in rather than storing it beside the row keeps the
+    ledger's two-column shape and makes the row self-describing: the terminal
+    short-circuit reads the reason straight back out of the kind it matched, so
+    the operator-facing skip line names the cause that was actually recorded."""
+    return f"{ESCALATION_CLOSELOOP_TERMINAL}:{reason}"
+
+
+def closeloop_terminal_reason(kind: str) -> str:
+    """The reason back out of a `closeloop-terminal:<reason>` kind. Empty for a
+    row with no reason at all -- which cannot be written by the helper above,
+    but a ledger is a file on disk and reading it defensively costs nothing."""
+    return kind.partition(":")[2]
+
+
+def truncate_error(exc: object, limit: int) -> str:
+    """An exception's text, capped at `limit` characters with an explicit
+    marker. The marker matters more than the cap: a silently shortened error
+    message reads like the endpoint's own words."""
+    text = str(exc)
+    if len(text) <= limit:
+        return text
+    return text[:limit].rstrip() + f" […truncated at {limit} characters]"
+
+
+def origin_missing_attempt_kind(attempt: int) -> str:
+    """The ledger row for ONE poll that found the origin task unreadable
+    (`marker:origin-missing:a<j>`). Per-attempt keying, like
+    `closeloop_failed_kind`, so the row count IS the attempt number under the
+    ledger's idempotent (task, kind) insert -- two writes of the same attempt
+    can never inflate it, and a restart cannot reset it."""
+    return f"{ORIGIN_MISSING_ATTEMPT}:a{attempt}"
+
+
 # --- escalation copy -------------------------------------------------------
 
 UNRELEASABLE_COMMENT = (
@@ -773,6 +890,53 @@ CLOSELOOP_FAILED_ISSUE_COMMENT = (
     "Retrying; operator help may be needed."
 )
 
+# The GitHub-issue page that ENDS a close loop whose origin task is gone (O22,
+# issue #58). It has no task-comment twin, and that absence is the whole design:
+# the artifact this page is about is the one artifact that cannot receive it. A
+# comment on an archived task is refused with NO_ACCESS, and a refusal whose
+# target already answered 404 to a READ is permanent by construction -- so the
+# GitHub issue, which this daemon can always write, is the PRIMARY channel here
+# rather than the best-effort second copy it is everywhere else.
+#
+# Tense, by the O17 rule (a page posted before its act may not use the past
+# tense): this is posted BEFORE the ledger row that makes the give-up stick, and
+# the row is only written once the page has landed, so everything terminal is
+# stated as what the orchestrator WILL do. The one past-tense claim it makes --
+# the reads that already failed -- is the one thing that has already happened.
+#
+# It also states what is NOT touched. The trigger label may still be sitting on
+# the issue, and leaving it is deliberate (parking is the operator's call, the
+# same rule the park path holds), so the page says so rather than leaving a
+# reader to wonder whether a labelled issue is still claimed.
+#
+# The `{error}` it embeds is TRUNCATED to `ORIGIN_MISSING_ERROR_MAX_CHARS`. This
+# is the first API error text this daemon renders onto a GITHUB issue -- every
+# other `{error}` goes to the Alissa task, and the one pre-existing issue-only
+# page embeds no exception at all -- and its length and content are whatever the
+# endpoint chose to return. In practice it is one benign line; the cap is there
+# so a page on a durable, more widely readable surface stays predictable however
+# the endpoint's error shape changes. Truncated rather than replaced by the
+# status class: "Task not found or not accessible" is the sentence that tells an
+# operator what happened, and dropping it to render `404` would cost the reader
+# the one useful part.
+ORIGIN_MISSING_ERROR_MAX_CHARS = 300
+ORIGIN_MISSING_ISSUE_COMMENT = (
+    "**Orchestrator: close loop abandoned — origin task unreachable** — this "
+    "issue is closed by a merged pull request, but its origin Alissa task "
+    "{ref} could not be read on {attempts} consecutive polls: {error}. A task "
+    "that answers 404 to the orchestrator's own token is gone in practice — "
+    "archived after validation (the workspace's auto-archive window) or "
+    "deleted — and nothing about that recovers on a retry. So the orchestrator "
+    "is abandoning the close loop for this issue: it will make no further "
+    "reads or writes against {ref}, and this is the only comment it will post "
+    "about this failure. Nothing here is being changed — the merge stands, and "
+    "the `{label}` label, if it is still on this issue, is left exactly as it "
+    "is (parking is the operator's call, never the orchestrator's). If that "
+    "task still exists and still matters, close its loop by hand: satisfy its "
+    "validation criteria, attach this issue's merged pull request as evidence, "
+    "and move it to `pending_validation`."
+)
+
 # The TERMINAL page of the close edge (O17, issue #44). Everything a page has to
 # say when the daemon stops: what it could not do, what it is doing anyway, that
 # it will not try that again, and what is left for a human. The last part
@@ -1549,7 +1713,7 @@ class Orchestrator:
         self,
         task_number: int,
         kind: str,
-        task_comment: str,
+        task_comment: str | None,
         issue: Issue | None = None,
         issue_comment: str | None = None,
     ) -> bool:
@@ -1570,27 +1734,67 @@ class Orchestrator:
         every future attempt AND every future page) can gate on the receipt
         instead of re-reading the ledger and hoping the two stay in step. Every
         pre-existing caller ignores it, which is unchanged behaviour: a page
-        that could not be posted was already retried next poll."""
+        that could not be posted was already retried next poll.
+
+        `task_comment=None` DECLARES THE TASK CHANNEL UNREACHABLE (O22, issue
+        #58) and moves the primary role to the GitHub issue: the Alissa comment
+        is not attempted at all, and the issue comment's delivery becomes the
+        receipt the dedupe row is recorded behind. The one caller is the page
+        about a task whose own READ answered 404 -- writing a comment to it
+        would be refused with NO_ACCESS, which is exactly what the loop did for
+        four days: a denied write per poll per item, no row recorded, and an
+        attempt counter frozen at 1 forever. A refusal whose target already
+        404'd on a read is permanent by construction, so the right number of
+        attempts at it is zero. Carrying the decision in the copy argument
+        rather than a separate flag is deliberate: there is then no way to
+        declare the channel dead and still pass it a comment that would be
+        silently dropped. With no issue to write either there is no channel at
+        all, and the page cannot be delivered -- so nothing is recorded and the
+        caller is told, rather than latching a page nobody will ever see."""
         if self.state.escalated(task_number, kind):
             return True
         ref = f"TASK-{task_number}"
         if self.config.dry_run:
-            log.info("[dry-run] would escalate %s on %s:\n%s", kind, ref, task_comment)
+            log.info(
+                "[dry-run] would escalate %s on %s:\n%s",
+                kind, ref, task_comment if task_comment is not None else issue_comment,
+            )
             return False
 
-        try:
-            self.alissa.add_comment(ref, task_comment)
-        except AlissaError as exc:
+        issue_channel = issue is not None and issue_comment is not None
+        if task_comment is None and not issue_channel:
             log.error(
-                "could not post %s escalation on %s: %s — not recording; "
-                "retries next poll", kind, ref, exc,
+                "%s escalation on %s has no reachable channel (the task is "
+                "unreadable and there is no issue to comment on) — not "
+                "recording", kind, ref,
             )
             return False
 
+        if task_comment is not None:
+            try:
+                self.alissa.add_comment(ref, task_comment)
+            except AlissaError as exc:
+                log.error(
+                    "could not post %s escalation on %s: %s — not recording; "
+                    "retries next poll", kind, ref, exc,
+                )
+                return False
+
         if issue is not None and issue_comment is not None:
             try:
                 self.github.comment(issue.owner, issue.repo, issue.number, issue_comment)
             except (CommandError, RateLimited) as exc:
+                if task_comment is None:
+                    # PRIMARY here, not best-effort: with the task channel dead
+                    # this is the only place the operator can be told, so a
+                    # failure to post is a failure to page and must not record.
+                    log.error(
+                        "could not post %s escalation on %s (the task is "
+                        "unreadable, so the issue %s is the only channel): %s "
+                        "— not recording; retries next poll",
+                        kind, ref, issue.issue_slug, exc,
+                    )
+                    return False
                 log.warning(
                     "best-effort issue comment for %s failed on %s: %s",
                     kind, issue.issue_slug, exc,
@@ -3390,6 +3594,30 @@ class Orchestrator:
                 task_number,
             ))
 
+        # The close edge gave up on this item for good (O22, issue #58). Same
+        # short-circuit and the same reasoning as `closed-unmerged` above --
+        # before the GitHub round-trips, because the decision can never change
+        # -- and here it also carries the promise the terminal page made: no
+        # further Alissa reads or writes for this item, on any pass. The reason
+        # comes out of the ledger row rather than being re-derived, so the line
+        # an operator reads names the cause that was actually recorded.
+        terminal = self.state.escalations_matching(
+            task_number, ESCALATION_CLOSELOOP_TERMINAL + ":"
+        )
+        if terminal:
+            # `[0]` is the OLDEST row, which `escalations_matching` now
+            # guarantees: only one reason can exist today, but the kind is a
+            # prefix scan precisely so reasons can be added, and the day a
+            # second one lands this line must name the one that actually ended
+            # the loop rather than whichever row the database returned first.
+            reason = closeloop_terminal_reason(str(terminal[0]["kind"])) or "unspecified"
+            return self._logged(ref, Decision(
+                Action.SKIPPED,
+                f"{slug}: close loop abandoned ({reason}) — terminal, already "
+                f"escalated",
+                task_number,
+            ))
+
         try:
             issue = self.github.issue(owner, repo, number)
         except (CommandError, RateLimited) as exc:
@@ -3781,8 +4009,16 @@ class Orchestrator:
             # silently untouched. A refused/partial answer arrives as the same
             # `AlissaError` a failed read does and takes the same retry path.
             task = self.alissa.get_task(ref, view=VIEW_FULL)
+        except AlissaNotFound as exc:
+            # The origin task is not merely refusing this write -- it cannot be
+            # READ. Routed away from `_closeloop_failed` (O22, issue #58),
+            # because that path's whole remedy is "page the task and retry",
+            # and both halves are wrong here: the page targets the artifact
+            # that just 404'd, and the retry has nothing left to succeed at.
+            return self._origin_missing(task_number, ref, slug, issue, exc)
         except AlissaError as exc:
             return self._closeloop_failed(task_number, slug, issue, exc, prior)
+        self._origin_answered(task_number, ref)
 
         if task.status not in CLOSE_EXPECTED_STATES:
             if task.status == CLOSE_HANDOFF_STATE:
@@ -4037,6 +4273,177 @@ class Orchestrator:
             slug, ref, failing_for, exc,
         )
 
+    def _origin_answered(self, task_number: int, ref: str) -> None:
+        """The origin read answered, so any run of failed reads is OVER: drop
+        the attempt rows.
+
+        This is what makes `_origin_missing`'s bound a count of CONSECUTIVE
+        polls. Without it the rows are cumulative over the item's lifetime, and
+        three unrelated 404 blips -- spread over days, on an item the close
+        loop is retrying for an unrelated reason -- abandon a task that is
+        alive and readable, permanently and silently. Same shape and same
+        reasoning as `_dedupe_answered`, including the read-before-write guard
+        so the ordinary path (no rows) does not write on every close pass.
+
+        Deliberately NOT gated on `dry_run`: a dry run cannot reach
+        `_origin_missing` at all (`_close_loop` returns before the read), so
+        there are no rows for it to clear and no side effect to suppress. The
+        guard below means it does not even query."""
+        if not self.state.escalations_matching(task_number, ORIGIN_MISSING_ATTEMPT + ":"):
+            return
+        cleared = self.state.clear_escalations_matching(
+            task_number, ORIGIN_MISSING_ATTEMPT
+        )
+        log.info(
+            "%s: the origin task reads again — clearing %d unreadable-attempt "
+            "row(s); the give-up counter starts from zero", ref, cleared,
+        )
+
+    def _origin_missing(
+        self, task_number: int, ref: str, slug: str, issue: Issue, exc: AlissaNotFound
+    ) -> tuple[str, Decision]:
+        """The origin task's own read answered 404. Retry a bounded number of
+        polls, then give up on the item for good -- ledgered, paged once on the
+        GitHub issue, and never read or written again.
+
+        THE INCIDENT THIS ENDS (issue #58, root-caused 2026-08-04). Four
+        released-and-merged items whose origin tasks had been validated and
+        then auto-archived sat in the ledger for days. Each poll: `get_task`
+        404s, `_closeloop_failed` pages `closeloop-failed:a<j>` -- whose PRIMARY
+        channel is a comment on that same archived task -- the write is denied
+        `NO_ACCESS`, `_escalate` therefore records nothing, and the next poll
+        recomputes attempt 1 from an empty ledger. Neither the read nor the
+        denied write was terminal, so the pair repeated every ~80s per item,
+        forever, and the set grew as more closed loops aged past the archive
+        window. Three separate things had to be true for that to happen, and
+        this method contradicts all three:
+
+        * **The counter did not advance**, because the only thing counting was
+          a row written behind a remote comment that could not land. The
+          attempt rows here are written by the loop itself, first, before
+          anything can refuse them -- so the count is a fact about polls, not
+          about writes.
+        * **The escalation targeted the unreachable artifact.** With the task
+          channel declared dead (`task_comment=None`), the page goes to the
+          GitHub issue, which this daemon can always write, and the daemon
+          never attempts a write it knows will be denied.
+        * **Nothing was terminal.** A permanently missing task cannot be
+          closed by anyone, so the loop for it is over; the only open question
+          is whether a human was told. The ledger row says so, and the
+          short-circuit in `_evaluate_close` reads it before touching anything.
+
+        Why the bound is polls and not a single 404: see
+        `ORIGIN_MISSING_MAX_ATTEMPTS`. Why only `AlissaNotFound` gets here: a
+        403 is the OTHER shape, and it is operator-fixable (a role can be
+        re-granted, and the existing paged-and-floored retry is the right
+        answer for it); a 404 to the token that created the task is not
+        something an operator can grant their way out of.
+
+        Why the give-up gates on the page having LANDED, exactly like
+        `_close_evidence_unwritable`: the ledger row stops every future poll
+        from looking at this item, so recording it behind an undelivered page
+        would make the item disappear in silence -- which is the same class of
+        bug as the storm, merely quieter. No row, no give-up, retry next poll.
+
+        Why the attempts have to be CONSECUTIVE, and are (`_origin_answered`
+        clears the rows the moment a read answers): the remedy is one-way, so
+        the evidence for it must be an unbroken run. Counting cumulatively
+        reaches the bound on three unrelated blips days apart -- reachable
+        through this file's own retry machinery, since an item whose close-loop
+        WRITE keeps failing sits in the ledger for days on
+        `CLOSELOOP_RETRY_FLOOR_SECONDS`, offering one more chance per hour to
+        catch a meaningless 404 -- and would abandon a live, readable task
+        under a page claiming it was gone.
+
+        Why the give-up RETRY is floored once the bound is reached: while the
+        page cannot be delivered nothing settles, so without a floor this path
+        would write a row and attempt a GitHub comment on every poll, forever
+        -- an unbounded retry generating a failed remote write per poll, which
+        is the shape issue #58 exists to kill, merely moved to the other
+        channel. The floor is `CLOSELOOP_RETRY_FLOOR_SECONDS`, the same clock
+        `_close_loop` puts between failed mutations, and it applies ONLY past
+        the bound: the first attempts must stay poll-paced or a known-dead item
+        would take hours to drain instead of the polls the issue asks for.
+
+        What is NOT done here: the trigger label is not touched (parking stays
+        the operator's call, the rule the park path holds), the issue is not
+        closed or re-opened, and no Alissa write of any kind is attempted."""
+        prior = self.state.escalations_matching(task_number, ORIGIN_MISSING_ATTEMPT + ":")
+        if len(prior) >= ORIGIN_MISSING_MAX_ATTEMPTS:
+            last_at = max(int(row["escalated_at"]) for row in prior)
+            waited = self._now() - last_at
+            if waited < CLOSELOOP_RETRY_FLOOR_SECONDS:
+                return self._logged(ref, Decision(
+                    Action.HELD,
+                    f"{slug}: origin task unreadable and the terminal page has "
+                    f"not been delivered; next delivery attempt floored "
+                    f"({len(prior)} attempt(s) so far)",
+                    task_number,
+                ))
+        attempt = len(prior) + 1
+        # `at=` the loop's own clock, not the ledger's `time.time()` default:
+        # the floor above MEASURES against this timestamp, and the state
+        # module's own docstring names that as the condition for passing one.
+        self.state.record_escalation(
+            task_number, origin_missing_attempt_kind(attempt), at=int(self._now()),
+        )
+
+        if attempt < ORIGIN_MISSING_MAX_ATTEMPTS:
+            log.warning(
+                "%s: origin task %s could not be READ (%s) — attempt %d of %d; "
+                "retrying next poll before giving up on this item",
+                slug, ref, exc, attempt, ORIGIN_MISSING_MAX_ATTEMPTS,
+            )
+            return self._logged(ref, Decision(
+                Action.HELD,
+                f"{slug}: origin task unreadable (attempt {attempt} of "
+                f"{ORIGIN_MISSING_MAX_ATTEMPTS}): {exc}",
+                task_number,
+            ))
+
+        delivered = self._escalate(
+            task_number,
+            closeloop_terminal_kind(CLOSELOOP_TERMINAL_ORIGIN_ARCHIVED),
+            None,  # the task channel IS the artifact that 404'd
+            issue,
+            ORIGIN_MISSING_ISSUE_COMMENT.format(
+                ref=ref, attempts=attempt, label=self.config.label,
+                error=truncate_error(exc, ORIGIN_MISSING_ERROR_MAX_CHARS),
+            ),
+        )
+        if not delivered:
+            log.error(
+                "%s: giving up on the close loop for %s, but the terminal page "
+                "could not be delivered to the issue — NOT recording the "
+                "give-up; retries next poll", slug, ref,
+            )
+            return self._logged(ref, Decision(
+                Action.HELD,
+                f"{slug}: origin task unreadable and the terminal page could "
+                f"not be posted — not settling",
+                task_number,
+            ))
+
+        self._wp_closure(
+            task_number=task_number, ref=ref, repo=issue.full_name,
+            issue_number=issue.number,
+            terminal_reason=CLOSELOOP_TERMINAL_ORIGIN_ARCHIVED,
+        )
+        log.error(
+            "%s: GAVE UP on the close loop for %s after %d attempts — the "
+            "origin task is permanently unreadable (%s); the issue was "
+            "commented once and this item is now terminal (%s): no further "
+            "Alissa reads or writes",
+            slug, ref, attempt, exc, CLOSELOOP_TERMINAL_ORIGIN_ARCHIVED,
+        )
+        return self._logged(ref, Decision(
+            Action.ESCALATED,
+            f"{slug}: origin task permanently unreadable after {attempt} "
+            f"attempts — close loop abandoned "
+            f"({CLOSELOOP_TERMINAL_ORIGIN_ARCHIVED}), issue commented once",
+            task_number,
+        ))
+
     def _closeloop_failed(
         self, task_number: int, slug: str, issue: Issue, exc: Exception, prior: list
     ) -> tuple[str, Decision]:

{alissa_tools_github_orcloop-0.4.0 → alissa_tools_github_orcloop-0.4.2}/src/main/alissa/tools/github/orcloop/state.py

@@ -67,15 +67,21 @@ CREATE TABLE IF NOT EXISTS meta (
 """
 
 
-# The only `escalations` kinds `clear_escalation` will remove: two outage clocks
+# The only `escalations` kinds the clear methods will remove: two outage clocks
 # and the two pages they raise -- the O9 dedupe check and the O14 context read --
-# all four of which describe a condition that can END (see `clear_escalation`).
-# Spelled as literals here rather than imported from `loop`, which imports this
-# module; `test_loop` pins that the loop's constants and this set stay the same
-# four strings.
+# plus the O22 origin-missing attempt counter, all of which describe a condition
+# that can END (see `clear_escalation`). Spelled as literals here rather than
+# imported from `loop`, which imports this module; `test_loop` pins that the
+# loop's constants and this set stay the same five strings.
+#
+# `marker:origin-missing` is the one entry that names a PREFIX rather than a
+# whole kind: its rows are `marker:origin-missing:a<j>`, one per poll, and they
+# are cleared as a family by `clear_escalations_matching` -- a counter of
+# CONSECUTIVE failures is only consecutive if a success resets it.
 CLEARABLE_KINDS = frozenset({
     "marker:dedupe-unreadable", "dedupe-unreadable",
     "marker:context-unreadable", "context-unreadable",
+    "marker:origin-missing",
 })
 
 
@@ -208,20 +214,57 @@ class State:
         self._db.commit()
         return cursor.rowcount > 0
 
+    @staticmethod
+    def _like_prefix(prefix: str) -> str:
+        """`prefix` as a LIKE pattern, with `%`/`_`/`\\` escaped so a literal
+        wildcard in a kind cannot widen the match."""
+        escaped = prefix.replace("\\", "\\\\").replace("%", "\\%").replace("_", "\\_")
+        return escaped + "%"
+
     def escalations_matching(self, task_number: int, prefix: str) -> "list[sqlite3.Row]":
-        """Escalation rows for this task whose `kind` starts with `prefix`.
+        """Escalation rows for this task whose `kind` starts with `prefix`,
+        OLDEST FIRST.
 
         The close-loop retry uses this to count prior `closeloop-failed:a<j>`
         attempts (the row count IS the last attempt number) and to floor the
-        next retry off the newest `escalated_at`. `prefix` is escaped for LIKE
-        so a literal `%`/`_` in a kind cannot widen the match."""
-        escaped = prefix.replace("\\", "\\\\").replace("%", "\\%").replace("_", "\\_")
+        next retry off the newest `escalated_at`.
+
+        The ordering is part of the contract, not an implementation detail: a
+        caller that reads ONE row out of a multi-row family (the O22 terminal
+        reason, `rows[0]`) would otherwise name whichever row SQLite happened to
+        return first, and the failure would be a silently wrong log line rather
+        than an error. Oldest-first is the useful order for every caller here --
+        the first row is the observation that started the condition."""
         return self._db.execute(
             "SELECT task_number, kind, escalated_at FROM escalations "
-            "WHERE task_number=? AND kind LIKE ? ESCAPE '\\'",
-            (task_number, escaped + "%"),
+            "WHERE task_number=? AND kind LIKE ? ESCAPE '\\' "
+            "ORDER BY escalated_at ASC, kind ASC",
+            (task_number, self._like_prefix(prefix)),
         ).fetchall()
 
+    def clear_escalations_matching(self, task_number: int, prefix: str) -> int:
+        """Forget every row of a clearable FAMILY at once; returns how many went.
+
+        The plural of `clear_escalation`, for a condition whose rows are keyed
+        per attempt (`marker:origin-missing:a<j>`) rather than by a single kind.
+        The allowlist check is on the PREFIX, so a family is clearable as a
+        whole or not at all -- a caller cannot reach a page kind by handing this
+        a prefix of it, and `CLEARABLE_KINDS` stays the one place that decides
+        what may be forgotten."""
+        if prefix not in CLEARABLE_KINDS:
+            raise ValueError(
+                f"{prefix!r} is not a clearable family: only "
+                f"{sorted(CLEARABLE_KINDS)} are. Escalation rows are an audit "
+                "trail; a condition that ends needs its own clearable kind, "
+                "not the deletion of a page."
+            )
+        cursor = self._db.execute(
+            "DELETE FROM escalations WHERE task_number=? AND kind LIKE ? ESCAPE '\\'",
+            (task_number, self._like_prefix(prefix)),
+        )
+        self._db.commit()
+        return cursor.rowcount
+
     # --- loop-level scratch ------------------------------------------------
 
     def get_meta(self, key: str) -> "str | None":

alissa_tools_github_orcloop-0.4.2/src/main/alissa/tools/github/orcloop/version

@@ -0,0 +1 @@
+0.4.2

{alissa_tools_github_orcloop-0.4.0 → alissa_tools_github_orcloop-0.4.2}/src/main/alissa/tools/github/orcloop/workplan.py

@@ -255,6 +255,15 @@ class Closure:
     merged: bool = False
     merged_at: float | None = None
     closed_loop: bool = False  # the walk reached pending_validation
+    # Why the close edge STOPPED without reaching `pending_validation` (O22,
+    # issue #58) -- currently only `origin-archived`, a task the orchestrator
+    # can no longer read. Empty on every ordinary closure, and mutually
+    # exclusive with `closed_loop` by construction: a loop is either handed off
+    # or abandoned, never both. Recorded rather than rendered: the board's job
+    # is showing work that still needs a human, and an abandoned item's page is
+    # already on its GitHub issue -- so this is the projection's record of the
+    # disposition, for a view that wants it, not a new coupling to the store.
+    terminal_reason: str = ""
     delivery_notes: str = ""
     at: float = 0.0
     # Parsed ONCE, in `record_closure`, from `delivery_notes`. The body is
@@ -978,9 +987,25 @@ def _build_kpis(
         c for c in closures
         if c.merged and c.merged_at is not None and c.merged_at >= at - RECENT_SECONDS
     ]
+    # Counted off the SAME set the Validated column draws from: a status whose
+    # ref carries a `closed_loop` closure. The two share a label on one page,
+    # so they have to share a population as well as a clock (the clock was the
+    # other half, fixed in round 2).
+    #
+    # `_narrow` admits `depends_on` refs deliberately -- an upstream status
+    # riding inside a dependant's payload is the only free source of
+    # `validated` -- but such a ref has neither a member card nor a closure, so
+    # counting it here produced a tile the board could not account for. It
+    # still serves the narrowing it was added for; it just does not reach this
+    # tile. Not lossy in practice: a task orcloop ever sees at `validated` is
+    # one it drove, so it carries a closure until that closure ages out of the
+    # window -- and once it has, the column could not show it either.
+    settled = {c.ref for c in closures if c.closed_loop}
     validated = [
         s for s in statuses.values()
-        if s.status == VALIDATED_STATUS and s.at >= at - RECENT_SECONDS
+        if s.status == VALIDATED_STATUS
+        and s.at >= at - RECENT_SECONDS
+        and s.ref in settled
     ]
     return (
         Kpi(

{alissa_tools_github_orcloop-0.4.0 → alissa_tools_github_orcloop-0.4.2}/src/main/alissa/tools/github/orcloop/workplan_html.py

@@ -54,9 +54,11 @@ from .workplan import (
 # seen when some other task depends on it (see `workplan`'s module docstring).
 VALIDATED_FOOTNOTE = (
     "“Validated” counts tasks this daemon actually observed at `validated` "
-    "inside the window. orcloop hands off at `pending_validation` and stops "
-    "polling a task, so a validation it never had a reason to read is not "
-    "counted here — this figure is a floor, not a total."
+    "inside the window, and only those this loop itself closed — the tile and "
+    "the Validated column are drawn from one set. orcloop hands off at "
+    "`pending_validation` and stops polling a task, so a validation it never "
+    "had a reason to read is not counted here — this figure is a floor, not a "
+    "total."
 )
 
 LANE_GUIDE = (

{alissa_tools_github_orcloop-0.4.0 → alissa_tools_github_orcloop-0.4.2/src/main/alissa_tools_github_orcloop.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: alissa-tools-github-orcloop
-Version: 0.4.0
+Version: 0.4.2
 Summary: ALISSA-TOOLS-GITHUB-ORCLOOP
 Home-page: https://alissa.app
 Author: Fahera

alissa_tools_github_orcloop-0.4.0/src/main/alissa/tools/github/orcloop/version

@@ -1 +0,0 @@
-0.4.0