alissa-tools-github-revloop 0.31.10__tar.gz → 0.31.11__tar.gz

{alissa_tools_github_revloop-0.31.10/src/main/alissa_tools_github_revloop.egg-info → alissa_tools_github_revloop-0.31.11}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: alissa-tools-github-revloop
-Version: 0.31.10
+Version: 0.31.11
 Summary: ALISSA-TOOLS-GITHUB-REVLOOP
 Home-page: https://alissa.app
 Author: Fahera

{alissa_tools_github_revloop-0.31.10 → alissa_tools_github_revloop-0.31.11}/src/main/alissa/tools/github/revloop/fleet_vitals.py

@@ -41,6 +41,15 @@ Design rules, all load-bearing:
   user has not activated the loop app) warns ONCE per boot with the activate
   URL and logs at DEBUG after, because it is a fixed condition the operator
   resolves out of band, and the next pass after activation lands on its own.
+
+Seat parking (issue #157, studio.alissa.app seat-parking design §2.2/§2.4)
+adds the `idle` block -- the seat's own idle verdict (`parking.idle_block`),
+with `drainedAt` while a drain holds -- so Studio can re-check a park against
+the seat's OWN snapshot. The console's drain pushes one snapshot before it
+answers (`FleetVitalsPusher.push_now`). Until Studio's schema carries the
+block (the design's lane L3), a strict 400 naming `idle` makes the pusher
+resend without it and leave it out for IDLE_REPROBE_S: the vitals the Factory
+already renders never go dark over a field nobody reads yet.
 """
 
 from __future__ import annotations
@@ -51,6 +60,7 @@ import time
 from datetime import datetime, timezone
 from typing import TYPE_CHECKING, Any, Callable
 
+from . import parking
 from .alissa import parse_session_name, session_repo_slug
 from .alissa_client import (
     NOT_ACTIVATED,
@@ -87,6 +97,12 @@ VITALS_PUSHED = "pushed"
 VITALS_SKIPPED = "skipped"
 VITALS_FAILED = "failed"
 
+# How long a snapshot leaves the `idle` block out after Studio refused it as
+# an unknown key (a schema that predates seat parking), before it offers the
+# block again. An hour: one extra POST an hour against an old Studio, and a
+# newly deployed one starts receiving the block within the hour.
+IDLE_REPROBE_S = 3600.0
+
 # The operator's lever per inbox kind, in the Factory's `lever` slot. The
 # cap-out and the stability hold are both lifted by the same re-entry ack;
 # a stalled episode is the console's retry-now (or a reap).
@@ -252,6 +268,11 @@ def build_snapshot(
     optional field degrades to null on its own -- a broken tmux does not
     blank the memory split, and vice versa -- and `kpis` is always null (an
     orcloop-only section).
+
+    `idle` (seat parking, issue #157) is the seat's idle block: owed and
+    timers from the newest poll snapshot, live / managed from the SAME roster
+    read as `sessions`, queued from the alissa queue, and `drainedAt` while
+    a drain holds.
     """
     stamp = time.time() if now is None else now
     snaps = sources.snapshots(DURATION_POINTS)
@@ -277,6 +298,12 @@ def build_snapshot(
         )
         session_list = [_session_row(r, repos) for r in ordered[:LIST_CAP]]
     inbox = [_inbox_row(item) for item in sources.inbox()["live"][:LIST_CAP]]
+    live, managed = parking.roster_counts(rows)
+    idle = parking.idle_block(
+        snaps[0] if snaps else None,
+        live=live, managed=managed, queued=sources.queued(),
+        drain=sources.drain(), now=stamp,
+    )
     return {
         "schemaVersion": SCHEMA_VERSION,
         "seat": SEAT,
@@ -297,6 +324,7 @@ def build_snapshot(
         "queueDepth": _int_or_none(queue_depth),
         "kpis": None,
         "inbox": inbox,
+        "idle": idle,
     }
 
 
@@ -366,6 +394,9 @@ class FleetVitalsPusher:
         # every later refusal is a DEBUG line. The push itself is still
         # attempted every pass -- the pass after activation lands on its own.
         self._not_activated_warned = False
+        # Until when the `idle` block is left out (Studio refused it as an
+        # unknown key); 0 = offer it.
+        self._idle_refused_until = 0.0
 
     def build(self, *, heartbeat_at: "int | float", queue_depth: "int | None") -> dict:
         """This pass's contract body, fitted to the API's caps."""
@@ -400,9 +431,31 @@ class FleetVitalsPusher:
                 type(exc).__name__, exc,
             )
             return VITALS_FAILED
+        if self._clock() < self._idle_refused_until:
+            snapshot.pop("idle", None)
         if self.config.dry_run:
             log.info("[dry-run] would push fleet vitals (%s)", describe(snapshot))
             return VITALS_SKIPPED
+        return self._post(snapshot)
+
+    def push_now(self) -> str:
+        """The console's out-of-pass push (the drain handshake, issue #157):
+        the same snapshot, its `heartbeatAt` the daemon's LAST completed pass
+        -- the console completes none of its own, and stamping now would read
+        as a heartbeat the loop never gave -- and `asOf` now. `queueDepth` is
+        null: the slot queue lives in the daemon's memory, and the console
+        cannot say. One of VITALS_PUSHED, VITALS_SKIPPED or VITALS_FAILED."""
+        snaps = self._sources.snapshots(1)
+        heartbeat = snaps[0]["ts"] if snaps else self._clock()
+        return self.push_once(heartbeat_at=heartbeat, queue_depth=None)
+
+    @staticmethod
+    def _refuses_idle(exc: AlissaError) -> bool:
+        """A 400 that names the `idle` key: a Studio whose strict schema
+        predates seat parking (the design's lane L3 adds the field)."""
+        return exc.status == 400 and "idle" in str(exc.detail)
+
+    def _post(self, snapshot: dict) -> str:
         try:
             result = self._client.post_fleet_vitals(snapshot)
         except AlissaAuthError as exc:
@@ -412,6 +465,17 @@ class FleetVitalsPusher:
             self._warn_failed(exc)
             return VITALS_FAILED
         except AlissaError as exc:
+            if "idle" in snapshot and self._refuses_idle(exc):
+                self._idle_refused_until = self._clock() + IDLE_REPROBE_S
+                log.warning(
+                    "fleet-vitals: Studio refused the seat-parking `idle` "
+                    "block (status %s: %s) — its schema predates it; "
+                    "resending without it, and leaving it out for %d min",
+                    exc.status, exc.detail, int(IDLE_REPROBE_S // 60),
+                )
+                trimmed = dict(snapshot)
+                trimmed.pop("idle")
+                return self._post(trimmed)
             self._warn_failed(exc)
             return VITALS_FAILED
         log.info(

{alissa_tools_github_revloop-0.31.10 → alissa_tools_github_revloop-0.31.11}/src/main/alissa/tools/github/revloop/loop.py

@@ -24,6 +24,7 @@ from enum import Enum
 from pathlib import Path
 from typing import Callable
 
+from . import parking as parking_mod
 from . import prompts as prompts_mod
 from .alissa import (
     COMMIT_READINESS_TRAILER_LABEL,
@@ -2201,6 +2202,32 @@ class Decision:
     # exactly as `checks_held` is -- the operator's remedy is the account,
     # not a session slot.
     prompt_held: bool = False
+    # `drained` marks a QUEUED that the seat-parking drain held back (issue
+    # #157): orcloop asked the console to drain the seat for a park, so the
+    # round is owed and stands down before its first side effect. Same column,
+    # its own stage, excluded from the gate's capacity summary like the two
+    # holds above -- the remedy is the park/wake cycle, not a session slot.
+    drained: bool = False
+    # The seat-parking verdict (issue #157): whether this PR is OWED -- the
+    # seat's own work, or a clock the seat owns, is still running on it -- or
+    # settled. None takes the action's default (`decision_owed`); the sites
+    # that know better say so. `timer` is the seat-owned clock behind an owed
+    # verdict, `(kind, until)` with `kind` one of parking.TIMER_KINDS and
+    # `until` a unix second. Observational: only the poll snapshot (and from
+    # it the idle block) reads them.
+    owed: bool | None = None
+    timer: "tuple[str, int] | None" = None
+
+
+def decision_owed(decision: Decision) -> bool:
+    """Whether a decision leaves its PR OWED (seat-parking design §2.1): an
+    explicit verdict on the decision wins; otherwise every action but a
+    convergence, a cap or a skip is the seat's own work in progress -- a
+    round spawned, queued, in flight or held, a verdict still to post, an
+    escalation posted this pass."""
+    if decision.owed is not None:
+        return decision.owed
+    return decision.action.value in parking_mod.OWED_STAGES
 
 
 @dataclass(frozen=True)
@@ -3095,7 +3122,15 @@ class ReviewWatcher:
 
         age = self.state.spawn_age(pr.full_name, number, round_)
         if age is not None and age < STALE_ROUND_SECONDS:
-            return Decision(Action.IN_FLIGHT, f"round {round_} enqueued {int(age)}s ago", round_)
+            return Decision(
+                Action.IN_FLIGHT,
+                f"round {round_} enqueued {int(age)}s ago",
+                round_,
+                timer=(
+                    parking_mod.TIMER_STALE_WINDOW,
+                    int(time.time() - age + STALE_ROUND_SECONDS),
+                ),
+            )
         if age is not None:
             deferred = self._defer_stale_round(pr, round_, age, cap)
             if deferred is not None:
@@ -3345,11 +3380,19 @@ class ReviewWatcher:
                 "the review-request snapshot says",
                 pr.slug, round_, pr.head_sha[:8], since, _stamp(verdict_at), cooldown,
             )
+            # Owed (issue #157): the request still stands, and whether the
+            # round is admitted is decided when the cooldown ends -- a moment
+            # nothing on GitHub marks, so a seat parked across it would never
+            # be woken for a round it owes.
             return Decision(
                 Action.SKIPPED,
                 f"head {pr.head_sha[:8]} had a verdict {int(since)}s ago — inside "
                 f"the {cooldown}s post-verdict cooldown",
                 round_,
+                owed=True,
+                timer=(
+                    parking_mod.TIMER_STALE_WINDOW, int(verdict_at + cooldown)
+                ),
             )
 
         requested = self._fresh_request_at(pr)
@@ -3506,7 +3549,10 @@ class ReviewWatcher:
         # PR that was deferred while the fleet was full, and is refused once the
         # census clears, keeps its seat forever.
         self._waiting.pop((pr.full_name, pr.number), None)
-        return Decision(Action.SKIPPED, problem, round_)
+        # Owed (issue #157): an owed round the seat cannot start for a reason
+        # of its own -- no review task yet, no hub -- is not settled, and its
+        # remedy (a task, a hub) moves nothing a parked seat is woken by.
+        return Decision(Action.SKIPPED, problem, round_, owed=True)
 
     # -- the product-stability guard (issue #105) ---------------------------
 
@@ -3858,6 +3904,10 @@ class ReviewWatcher:
                     f"{rollup.summary} ({int(waited)}s of {bound}s)",
                     round_,
                     checks_held=True,
+                    timer=(
+                        parking_mod.TIMER_CHECKS_HOLD,
+                        int(time.time() - waited + bound),
+                    ),
                 )
             )
 
@@ -4064,10 +4114,16 @@ class ReviewWatcher:
         # The responder's account hold is excluded for the same reason: the
         # remedy is the account, not a freed slot, and the hold has its own
         # WARNING every pass it stands (see poll_once).
+        # A drained round is excluded too (issue #157): a seat being parked
+        # holds every spawn by design, and a park outlasting the stall window
+        # must not page as a review outage.
         held = [
             (slug, d)
             for slug, d in results
-            if d.action is Action.QUEUED and not d.checks_held and not d.prompt_held
+            if d.action is Action.QUEUED
+            and not d.checks_held
+            and not d.prompt_held
+            and not d.drained
         ]
         if not held:
             self._gate_stall.clear()
@@ -4231,6 +4287,7 @@ class ReviewWatcher:
                 f"yet — {reason}",
                 round_,
                 task_ref=task.ref,
+                timer=(parking_mod.TIMER_STALE_WINDOW, int(time.time() + left)),
             )
 
         judged = str(row["head_sha"] or pr.head_sha)
@@ -4482,6 +4539,10 @@ class ReviewWatcher:
                     f"({int(held // 60)}m held in total)",
                     round_,
                     task_ref=task.ref,
+                    timer=(
+                        parking_mod.TIMER_CHECKS_HOLD,
+                        int(time.time() - waited + bound),
+                    ),
                 ),
                 state=rollup.state,
             )
@@ -6071,6 +6132,95 @@ class ReviewWatcher:
         reenqueued: bool = False,
         checks: str = "",
         stability: "StabilityNotice | None" = None,
+    ) -> Decision:
+        """The round spawn, behind the drain gate (`_drain_gated`). The
+        session name is drawn ONCE, here: it carries a nonce, and the claim
+        must name the session the spawn then enqueues."""
+        name = session_name(pr, round_)
+        return self._drain_gated(
+            pr,
+            round_,
+            name,
+            lambda: self._spawn_claimed(
+                pr, round_, task, cap, name,
+                reenqueued=reenqueued, checks=checks, stability=stability,
+            ),
+        )
+
+    def _drain_gated(
+        self,
+        pr: PullRequest,
+        round_: int,
+        name: str,
+        spawn: "Callable[[], Decision]",
+    ) -> Decision:
+        """The round spawn's drain gate (seat-parking design §2.4, issue
+        #157): claim the spawn of this round's session against the drain
+        flag, run `spawn` under the claim, and drop the claim however it ends.
+
+        The gate sits ABOVE every side effect of the spawn -- the hub add,
+        the `alissa tmux queue add`, the census bump, the ledger row, the
+        activity line -- so a drained seat touches nothing, and the round
+        stays owed: a QUEUED `drained` decision writes no spawn row, burns no
+        round number and spends no attempt, exactly like the slot gate. The
+        claim and the flag are read and written in one immediate transaction
+        on each side (`State.claim_spawn` / `State.set_drain`): a drain that
+        lands while this spawn is between its gate and its ledger write sees
+        the claim and refuses itself, so a park can never race a spawn. A
+        ledger that cannot answer stands the spawn down too -- a spawn that
+        cannot prove the seat is not drained does not happen.
+
+        Dry-run READS the flag and claims nothing: it shares the production
+        state path, and a dry pass must write no durable row."""
+        try:
+            if self.config.dry_run:
+                drain = self.state.drain()
+            else:
+                drain = self.state.claim_spawn(name)
+        except sqlite3.Error as exc:
+            log.warning(
+                "%s round %d: could not claim the spawn against the drain flag "
+                "(%s) — standing it down this pass", pr.slug, round_, exc,
+            )
+            return Decision(
+                Action.QUEUED,
+                f"round {round_} stood down — the state ledger could not prove "
+                f"the seat is not drained ({exc}); retrying next poll",
+                round_,
+                drained=True,
+            )
+        if drain is not None:
+            since = parking_mod.iso(drain["drained_at"])
+            until = parking_mod.iso(drain["expires_at"])
+            log.info(
+                "%s round %d: not spawning — the seat is drained for parking "
+                "since %s (until %s)", pr.slug, round_, since, until,
+            )
+            return Decision(
+                Action.QUEUED,
+                f"round {round_} held — the seat is drained for parking since "
+                f"{since} (until {until}: {drain['reason'] or 'no reason given'}); "
+                f"retrying once it is undrained",
+                round_,
+                drained=True,
+            )
+        try:
+            return spawn()
+        finally:
+            if not self.config.dry_run:
+                self.state.release_spawn(name)
+
+    def _spawn_claimed(
+        self,
+        pr: PullRequest,
+        round_: int,
+        task: Task | None,
+        cap: int,
+        name: str,
+        *,
+        reenqueued: bool = False,
+        checks: str = "",
+        stability: "StabilityNotice | None" = None,
     ) -> Decision:
         # `task is None` here means spawn_anyway/warn_and_spawn: the skip mode
         # was decided in _refused_before_start, above the CI gate, so a round
@@ -6111,7 +6261,6 @@ class ReviewWatcher:
         else:
             assignment = f"You've been assigned Alissa review task {task.ref}."
 
-        name = session_name(pr, round_)
         if plan:
             template = PLAN_ROUND_1_DIRECTIVE if round_ == 1 else PLAN_ROUND_K_DIRECTIVE
         else:
@@ -6130,7 +6279,9 @@ class ReviewWatcher:
 
         hub, problem = self._ensure_hub(pr, task_ref=task.ref if task else None)
         if problem is not None:
-            return Decision(Action.SKIPPED, problem, round_)
+            # Owed (issue #157): the round is owed and the hub could not be
+            # provisioned -- unknown, never settled.
+            return Decision(Action.SKIPPED, problem, round_, owed=True)
 
         self.alissa.enqueue_reviewer(
             session=name,
@@ -7504,7 +7655,9 @@ class ReviewWatcher:
                 raise
             except CommandError as exc:
                 log.error("%s: %s", slug, exc)
-                decision = Decision(Action.SKIPPED, str(exc))
+                # Owed (issue #157): an evaluation that failed is unknown,
+                # never settled.
+                decision = Decision(Action.SKIPPED, str(exc), owed=True)
 
             level = logging.INFO if decision.action != Action.SKIPPED else logging.DEBUG
             log.log(level, "%s → %s (%s)", slug, decision.action.value, decision.reason)
@@ -7668,6 +7821,10 @@ class ReviewWatcher:
             # Same column again; its own stage because the operator's remedy
             # is different from both: the reviewer ACCOUNT (issue #138).
             stage = "prompt-held"
+        elif decision.drained:
+            # Same column once more; its own stage because nothing is wrong:
+            # the seat is being parked (issue #157).
+            stage = "drained"
         return {
             "slug": slug,
             "number": int(tail),
@@ -7677,6 +7834,14 @@ class ReviewWatcher:
             "stage": stage,
             "reason": decision.reason,
             "task_ref": decision.task_ref,
+            # The seat-parking verdict (issue #157): read back by the idle
+            # block (`parking.idle_block`), so the block costs no GitHub call.
+            "owed": decision_owed(decision),
+            "timer": (
+                {"kind": decision.timer[0], "until": decision.timer[1]}
+                if decision.timer is not None
+                else None
+            ),
         }
 
     def _write_snapshot(
@@ -7744,6 +7909,7 @@ class ReviewWatcher:
         # SystemExit pass through (neither is an `Exception`), and only startup
         # -- resolve_config, before this loop is ever entered -- still exits
         # fast.
+        self._reset_parking()
         backoff = self.config.poll_interval
         failures = PollFailures()
         while True:
@@ -7789,6 +7955,29 @@ class ReviewWatcher:
                 log.info("stopping")
                 return
 
+    def _reset_parking(self) -> None:
+        """The daemon's boot clears the drain flag and every spawn claim
+        (seat-parking design §2.4, issue #157): a drain -- and any claim a
+        dead process left behind -- never outlives the daemon that saw it, so
+        a redeploy (the wake) or a restart starts with the flag down.
+
+        Here, at the top of `run_forever`, and not in the constructor: the
+        one-shot modes (`--once`, `--pr`) build a watcher too, and a hand-run
+        diagnostic must not lift a drain orcloop is holding on the running
+        daemon. Never under --dry-run, which shares the production state path
+        and writes no durable state. A ledger that cannot be written leaves
+        the flag to its TTL, and says so."""
+        if self.config.dry_run:
+            return
+        try:
+            self.state.reset_parking()
+        except sqlite3.Error as exc:
+            log.warning(
+                "parking: could not clear the drain flag at boot (%s) — a "
+                "drain left by the previous process holds until its TTL runs "
+                "out", exc,
+            )
+
     def _note_poll_failure(
         self, failures: PollFailures, exc: Exception, backoff: int
     ) -> None:

alissa_tools_github_revloop-0.31.11/src/main/alissa/tools/github/revloop/parking.py

@@ -0,0 +1,222 @@
+"""Seat parking -- the reviewer seat's own idle verdict and the drain it
+enforces (studio.alissa.app docs/design/managed-dark-factory-seat-parking.md
+§2.1, §2.2, §2.4; issue #157, lane L5 -- devloop's L4 contract, for rounds).
+
+orcloop parks this seat (removes its Railway deployment) only when the seat
+itself says there is nothing to do, and wakes it on demand. This module holds
+the revloop half of that contract, shared by the daemon (which records the
+verdict per pass on its poll snapshot and pushes it with the fleet vitals) and
+the console (which serves it on ``GET /api/state`` and runs the drain
+handshake):
+
+* **The idle block.** ``{asOf, passAt, owed, live, managed, queued, timers,
+  drainedAt}``. `owed` counts the PRs whose LAST evaluation was an action or
+  a clock the seat owns: an owed round (spawned, queued for a slot, held for
+  the head's checks, held by the drain), a round in flight inside its stale
+  window, a verdict still to be posted natively, an escalation posted this
+  pass, the post-verdict cooldown, an evaluation that failed. A PR the seat
+  has settled -- converged, capped, already stability-held, waiting on a
+  fresh re-request, out of scope -- is not owed. Each pass records the
+  verdict per PR on its poll snapshot's stage (`owed`, `timer`), so the block
+  is read back from the snapshot and costs no GitHub call. `live` / `managed`
+  / `queued` are read from tmux and the alissa queue by whoever builds the
+  block.
+* **Unknown is never idle.** No snapshot yet -> `owed` is null; a listing
+  that failed -> `live` / `managed` / `queued` are null. `idle_refusals`
+  reads every null as a refusal.
+* **The drain.** A flag with a TTL in `state.db` (`State.set_drain`), cleared
+  when the daemon boots. While it holds, the round spawn stands down before
+  its first side effect (`ReviewWatcher._drain_gated`).
+"""
+
+from __future__ import annotations
+
+from collections.abc import Iterable, Mapping, Sequence
+from datetime import datetime, timezone
+
+# The timer kinds of the design's idle block (§2.1), the union both seats
+# share. revloop emits two: `stale_window` (a round in flight inside its stale
+# window, the post-verdict cooldown, a native post's grace or back-off) and
+# `checks_hold` (a round, or an approve, waiting on the head's CI rollup). A
+# stability hold carries no clock -- it waits on an operator's ack, a comment
+# that wakes a parked seat by itself -- so `stability_hold` is never emitted.
+TIMER_STALE_WINDOW = "stale_window"
+TIMER_CHECKS_HOLD = "checks_hold"
+TIMER_KINDS = (
+    TIMER_STALE_WINDOW, "respawn", "limited_hold", "stability_hold",
+    TIMER_CHECKS_HOLD,
+)
+
+# The drain's TTL: the design's handshake asks for 300 s. The ceiling bounds a
+# drain nobody undrains -- a seat that refuses every spawn is an outage, so no
+# caller may hold it for longer than this without asking again.
+DRAIN_TTL_DEFAULT = 300
+DRAIN_TTL_MAX = 900
+DRAIN_REASON_MAX = 200
+
+# A spawn claim older than this is a spawn whose daemon died between its drain
+# gate and its ledger write; it stops refusing drains (the boot clears it).
+SPAWN_CLAIM_TTL = 600
+
+# D2's freshness rule: the seat's last pass is within this many poll
+# intervals, or its loop is wedged -- stalled, not idle.
+FRESH_PASS_INTERVALS = 2
+
+# The stages that are owed when the stage carries no verdict of its own (a
+# snapshot written before the field existed): every action but a convergence,
+# a cap or a skip is the seat's own work in progress. The refined stage names
+# `_stage_record` writes (`stale-re-enqueued`, `deferred`, `checks-held`,
+# `prompt-held`, `drained`) are refinements of owed actions, so they are
+# owed too.
+OWED_STAGES = frozenset({
+    "spawned", "stale-re-enqueued", "in-flight", "deferred", "queued",
+    "checks-held", "prompt-held", "drained", "awaiting-post", "posted",
+    "abandoned", "escalated",
+})
+
+
+def iso(ts: "float | int | None") -> "str | None":
+    """A unix timestamp as an ISO-8601 UTC instant (whole seconds, `Z`)."""
+    if ts is None:
+        return None
+    return datetime.fromtimestamp(int(ts), tz=timezone.utc).strftime(
+        "%Y-%m-%dT%H:%M:%SZ"
+    )
+
+
+def stage_owed(stage: Mapping) -> bool:
+    """Whether one poll-snapshot stage is owed: its own `owed` verdict, or,
+    on a stage written before the verdict existed, its stage's default."""
+    owed = stage.get("owed")
+    if isinstance(owed, bool):
+        return owed
+    return str(stage.get("stage") or "") in OWED_STAGES
+
+
+def stage_timer(stage: Mapping) -> "dict | None":
+    """One stage's timer as the block's `{kind, until, ref}`, or None. `ref`
+    is the PR's slug (`owner/repo#16`)."""
+    timer = stage.get("timer")
+    if not isinstance(timer, Mapping):
+        return None
+    kind = timer.get("kind")
+    until = timer.get("until")
+    if (
+        kind not in TIMER_KINDS
+        or isinstance(until, bool)
+        or not isinstance(until, (int, float))
+    ):
+        return None
+    return {"kind": kind, "until": iso(until), "ref": stage.get("slug")}
+
+
+def queued_items(queues: object) -> "int | None":
+    """How many items wait in the alissa tmux queue (`alissa tmux queue ls
+    --json`, every queue) and have not been dispatched yet -- a dispatched
+    item stays listed with its `lastDispatchedAt`, and its session is then
+    in the tmux listing instead. None when the listing is not a list (it
+    could not be read: unknown, not empty)."""
+    if not isinstance(queues, list):
+        return None
+    count = 0
+    for queue in queues:
+        if not isinstance(queue, Mapping):
+            continue
+        for item in queue.get("items") or ():
+            if isinstance(item, Mapping) and not item.get("lastDispatchedAt"):
+                count += 1
+    return count
+
+
+def roster_counts(
+    rows: "Sequence[Mapping] | None",
+) -> "tuple[int | None, int | None]":
+    """`(live, managed)` from the console's session rows
+    (`Sources.session_rows`) -- the fleet-vitals `sessions` rule, so the idle
+    block and the snapshot's `sessions` can never disagree. `(None, None)`
+    when the roster could not be listed."""
+    if rows is None:
+        return None, None
+    return (
+        sum(1 for r in rows if r.get("live")),
+        sum(1 for r in rows if r.get("managed")),
+    )
+
+
+def idle_block(
+    snapshot: "Mapping | None",
+    *,
+    live: "int | None",
+    managed: "int | None",
+    queued: "int | None",
+    drain: "Mapping | None",
+    now: "float | int",
+) -> dict:
+    """The seat's idle block from its latest poll snapshot (None before the
+    first pass) and the caller's live readings. `drain` is the holding drain
+    row (`State.drain`) or None."""
+    stages: "Iterable[Mapping]" = (snapshot or {}).get("stages") or ()
+    owed: "int | None" = None
+    timers: "list[dict]" = []
+    if snapshot is not None:
+        owed = 0
+        for stage in stages:
+            if stage_owed(stage):
+                owed += 1
+            timer = stage_timer(stage)
+            if timer is not None:
+                timers.append(timer)
+    timers.sort(key=lambda t: (t["until"] or "", t["ref"] or ""))
+    return {
+        "asOf": iso(now),
+        "passAt": iso(snapshot.get("ts")) if snapshot else None,
+        "owed": owed,
+        "live": live,
+        "managed": managed,
+        "queued": queued,
+        "timers": timers,
+        "drainedAt": iso(drain.get("drained_at")) if drain else None,
+    }
+
+
+def _parse_iso(value: object) -> "float | None":
+    if not isinstance(value, str):
+        return None
+    try:
+        return datetime.strptime(value, "%Y-%m-%dT%H:%M:%SZ").replace(
+            tzinfo=timezone.utc
+        ).timestamp()
+    except ValueError:
+        return None
+
+
+def idle_refusals(
+    idle: Mapping, *, poll_interval: "float | int", now: "float | int",
+) -> "list[str]":
+    """D2's invariant over one idle block: the reasons the seat is NOT idle,
+    empty when it is. Every unknown (a null count, a missing pass) is a
+    refusal -- unknown is not idle."""
+    out: "list[str]" = []
+    for key in ("live", "managed", "queued"):
+        value = idle.get(key)
+        if value is None:
+            out.append(f"{key} unknown")
+        elif value:
+            out.append(f"{key}={value}")
+    owed = idle.get("owed")
+    if owed is None:
+        out.append("owed unknown (no completed pass)")
+    elif owed:
+        out.append(f"owed={owed}")
+    timers = idle.get("timers") or []
+    if timers:
+        out.append(f"{len(timers)} timer(s) running")
+    pass_at = _parse_iso(idle.get("passAt"))
+    if pass_at is None:
+        out.append("no completed pass")
+    elif now - pass_at > FRESH_PASS_INTERVALS * float(poll_interval):
+        out.append(
+            f"last pass {int(now - pass_at)}s ago (over "
+            f"{FRESH_PASS_INTERVALS} × {int(poll_interval)}s)"
+        )
+    return out

{alissa_tools_github_revloop-0.31.10 → alissa_tools_github_revloop-0.31.11}/src/main/alissa/tools/github/revloop/state.py

@@ -351,6 +351,29 @@ CREATE TABLE IF NOT EXISTS poll_snapshots (
 -- and never read by the daemon itself -- it is the console's window onto the
 -- effective allowlist (`/api/state` renders it beside `repos`), so it is
 -- telemetry-class: a write that fails costs a warning, not the refresh.
+-- Seat parking (studio.alissa.app seat-parking design §2.4, issue #157).
+-- `seat_drain` holds at most ONE row -- the drain orcloop asked the console
+-- for, its TTL as an absolute `expires_at` -- and `spawn_claims` one row per
+-- round spawn between its drain gate and its ledger write. The daemon clears
+-- both when it boots (`reset_parking`), so neither outlives the process that
+-- saw it: the design calls the flag "in memory", and the console and the
+-- daemon are two processes whose only shared memory is this file. A drain and
+-- a claim are each taken inside ONE `BEGIN IMMEDIATE` transaction that also
+-- reads the other table, so sqlite's writer lock serialises them: either the
+-- claim lands first and the drain sees it (and refuses), or the drain lands
+-- first and the claim sees it (and the spawn stands down).
+CREATE TABLE IF NOT EXISTS seat_drain (
+    id         INTEGER PRIMARY KEY CHECK (id = 1),
+    drained_at INTEGER NOT NULL,
+    expires_at INTEGER NOT NULL,
+    reason     TEXT    NOT NULL DEFAULT ''
+);
+
+CREATE TABLE IF NOT EXISTS spawn_claims (
+    session    TEXT    NOT NULL PRIMARY KEY,
+    claimed_at INTEGER NOT NULL
+);
+
 CREATE TABLE IF NOT EXISTS derived_repos (
     repo       TEXT    NOT NULL PRIMARY KEY,
     bow_id     TEXT    NOT NULL DEFAULT '',
@@ -2008,3 +2031,104 @@ class State:
         )
         self._db.commit()
         return True
+
+    # -- seat parking: the drain flag and the spawn claims (issue #157) ------
+
+    def drain(self, now: "float | None" = None) -> "dict | None":
+        """The drain that holds now -- `{drained_at, expires_at, reason}` --
+        or None when there is none or its TTL has run out. An expired row is
+        not deleted here (a read never writes); it simply stops holding."""
+        at = int(time.time() if now is None else now)
+        row = self._db.execute(
+            "SELECT drained_at, expires_at, reason FROM seat_drain WHERE id=1"
+        ).fetchone()
+        if row is None or int(row["expires_at"]) <= at:
+            return None
+        return dict(row)
+
+    def set_drain(
+        self, ttl: int, reason: str, now: "float | None" = None,
+        claim_ttl: int = 600,
+    ) -> "tuple[dict, list[dict]]":
+        """Raise the drain flag for `ttl` seconds and return it with the spawn
+        claims standing at that instant (younger than `claim_ttl` -- an older
+        one is a spawn whose process died mid-way, cleared at the next boot).
+        ONE immediate transaction, so a spawn either claimed before this (and
+        is in the list) or claims after it (and sees the flag). A drain that
+        is already up is replaced: a re-drain restarts the TTL. Raises
+        sqlite3.Error -- the caller answers it as a drain that did not
+        happen."""
+        at = int(time.time() if now is None else now)
+        self._db.commit()
+        self._db.execute("BEGIN IMMEDIATE")
+        try:
+            self._db.execute(
+                "INSERT OR REPLACE INTO seat_drain "
+                "(id, drained_at, expires_at, reason) VALUES (1,?,?,?)",
+                (at, at + int(ttl), reason),
+            )
+            claims = [
+                dict(row) for row in self._db.execute(
+                    "SELECT session, claimed_at FROM spawn_claims "
+                    "WHERE claimed_at > ? ORDER BY claimed_at",
+                    (at - int(claim_ttl),),
+                ).fetchall()
+            ]
+            self._db.commit()
+        except sqlite3.Error:
+            self._db.rollback()
+            raise
+        drain = {"drained_at": at, "expires_at": at + int(ttl), "reason": reason}
+        return drain, claims
+
+    def clear_drain(self) -> bool:
+        """Lower the drain flag. True when a row was there to clear (expired
+        or not). Raises sqlite3.Error."""
+        cur = self._db.execute("DELETE FROM seat_drain")
+        self._db.commit()
+        return cur.rowcount > 0
+
+    def claim_spawn(self, session: str, now: "float | None" = None) -> "dict | None":
+        """Claim the right to spawn `session`: None when the claim landed,
+        else the drain that refused it. The read of the flag and the claim
+        are one immediate transaction (see `set_drain`). Raises sqlite3.Error:
+        a spawn that cannot prove the seat is not drained does not happen."""
+        at = int(time.time() if now is None else now)
+        self._db.commit()
+        self._db.execute("BEGIN IMMEDIATE")
+        try:
+            row = self._db.execute(
+                "SELECT drained_at, expires_at, reason FROM seat_drain "
+                "WHERE id=1 AND expires_at > ?",
+                (at,),
+            ).fetchone()
+            if row is not None:
+                self._db.rollback()
+                return dict(row)
+            self._db.execute(
+                "INSERT OR REPLACE INTO spawn_claims (session, claimed_at) "
+                "VALUES (?,?)",
+                (session, at),
+            )
+            self._db.commit()
+        except sqlite3.Error:
+            self._db.rollback()
+            raise
+        return None
+
+    def release_spawn(self, session: str) -> None:
+        """Drop `session`'s spawn claim once its spawn has landed or stood
+        down. Best-effort: a claim that cannot be dropped only makes a drain
+        refuse until it ages out (or the next boot clears it)."""
+        def write() -> None:
+            self._db.execute("DELETE FROM spawn_claims WHERE session=?", (session,))
+            self._db.commit()
+
+        self._write_telemetry(write, "release_spawn")
+
+    def reset_parking(self) -> None:
+        """Boot: no drain and no spawn claim survives a daemon restart (the
+        design's "clears at boot"). Raises sqlite3.Error."""
+        self._db.execute("DELETE FROM seat_drain")
+        self._db.execute("DELETE FROM spawn_claims")
+        self._db.commit()

alissa_tools_github_revloop-0.31.11/src/main/alissa/tools/github/revloop/version

@@ -0,0 +1 @@
+0.31.11

{alissa_tools_github_revloop-0.31.10 → alissa_tools_github_revloop-0.31.11}/src/main/alissa/tools/github/revloop/webui/__main__.py

@@ -13,8 +13,11 @@ import argparse
 import os
 import sys
 from pathlib import Path
+from typing import Callable
 
+from ..alissa_client import AlissaClient
 from ..config import Config, load_config_file, resolve_config_path
+from ..fleet_vitals import FleetVitalsPusher
 from ..version import version
 from .auth import Auth, PasscodeUnset, require_passcode
 from .server import App, make_server
@@ -77,6 +80,22 @@ def resolve_config(args: argparse.Namespace) -> Config:
     return Config.build(workspace_root, file_data, overrides)
 
 
+def _drain_pusher(
+    config: Config, sources: Sources,
+) -> "Callable[[], str] | None":
+    """The drain handshake's vitals push (seat parking, issue #157): the
+    daemon's own pusher, built on the console's Sources, when the push is on
+    and the config is not a dry run (a dry daemon pushes nothing either).
+    The token is the CLI's own `ALISSA_API_TOKEN`, read by `AlissaClient`,
+    exactly as the daemon's pusher reads it."""
+    if not config.fleet_vitals_enabled or config.dry_run:
+        return None
+    pusher = FleetVitalsPusher(
+        config, sources, AlissaClient(base=config.alissa_endpoint)
+    )
+    return pusher.push_now
+
+
 def main(argv: "list[str] | None" = None) -> int:
     args = build_parser().parse_args(argv)
 
@@ -106,7 +125,7 @@ def main(argv: "list[str] | None" = None) -> int:
     secure_cookie = _env_flag(os.environ.get("ALISSA_UI_SECURE_COOKIE"))
     app = App(
         auth=auth, sources=sources, version=version.value,
-        secure_cookie=secure_cookie,
+        secure_cookie=secure_cookie, push_vitals=_drain_pusher(config, sources),
     )
     server = make_server(app, args.host, args.port)
 

{alissa_tools_github_revloop-0.31.10 → alissa_tools_github_revloop-0.31.11}/src/main/alissa/tools/github/revloop/webui/server.py

@@ -20,6 +20,12 @@ Route map:
                        (accept | decline | escape; session + CSRF required;
                        409 not_waiting when the pane is not parked on one,
                        409 not_answerable for an account-level notice)
+  POST /action/drain -> seat parking's drain handshake (issue #157): raise
+                       the drain flag for `ttlS` seconds, answer the idle
+                       block, and keep the flag only if the seat is idle --
+                       then push a vitals snapshot BEFORE answering
+                       (session + CSRF required)
+  POST /action/undrain -> lower the drain flag (session + CSRF required)
 
 Every action POST is gated on BOTH the signed session cookie AND a CSRF token
 bound to it, and every action is audit-logged to stdout as a JSON line.
@@ -29,14 +35,16 @@ from __future__ import annotations
 
 import json
 import re
+import sqlite3
 import sys
+import time
 from http import HTTPStatus
 from http.cookies import SimpleCookie
 from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
 from typing import Any, Callable
 from urllib.parse import parse_qs
 
-from .. import prompts
+from .. import parking, prompts
 from ..alissa import SAFE_SESSION, capture_pane_argv, send_keys_argv
 from ..proc import CommandError, run as proc_run
 from .auth import SESSION_COOKIE, Auth
@@ -105,12 +113,18 @@ class App:
         run: "Callable[..., str]" = proc_run,
         audit: "Callable[[str, dict], None]" = _default_audit,
         secure_cookie: bool = False,
+        push_vitals: "Callable[[], str] | None" = None,
+        clock: "Callable[[], float]" = time.time,
     ) -> None:
         self.auth = auth
         self.sources = sources
         self.version = version
         self._run = run
         self._audit = audit
+        # The drain's vitals push (`FleetVitalsPusher.push_now`), or None when
+        # the push is off (issue #157).
+        self._push_vitals = push_vitals
+        self._clock = clock
         # Add `Secure` to the session cookie. Off by default (the localhost-HTTP
         # posture, where Secure would break the cookie), switched on for the
         # reverse-proxied-under-TLS posture auth.py contemplates so the cookie
@@ -236,6 +250,91 @@ class App:
         return 200, {"ok": True, "message": "answered", "kind": finding.kind,
                      "keys": list(keys)}
 
+    def drain(self, ttl_s: Any = None, reason: Any = None) -> "tuple[int, dict]":
+        """`POST /action/drain` (seat-parking design §2.4, issue #157): the
+        first step of a park. (status, payload); every outcome is audited.
+
+        Raises the drain flag for `ttl_s` seconds (default 300, at most
+        parking.DRAIN_TTL_MAX) and only THEN reads the idle block -- so a
+        round spawn that slips in before the flag is either a claim the drain
+        sees or a session (or an owed stage) the block counts. When the block
+        breaks D2 (a live, managed or queued session, anything owed, a timer,
+        a stale pass, an unknown) or a spawn holds a claim, the flag comes
+        straight back down and the answer is `drained: false` with the
+        reasons. When the drain holds, a vitals snapshot carrying
+        `idle.drainedAt` is pushed BEFORE the answer, because that snapshot
+        is what Studio re-checks before it removes anything; the answer says
+        how the push went."""
+        if ttl_s is None:
+            ttl = parking.DRAIN_TTL_DEFAULT
+        elif (
+            isinstance(ttl_s, int) and not isinstance(ttl_s, bool)
+            and 0 < ttl_s <= parking.DRAIN_TTL_MAX
+        ):
+            ttl = ttl_s
+        else:
+            self._audit("drain", {"ok": False, "error": "bad ttlS", "ttlS": ttl_s})
+            return 400, {"drained": False, "error": (
+                f"ttlS must be an integer in 1..{parking.DRAIN_TTL_MAX}"
+            )}
+        if reason is None:
+            reason = ""
+        if not isinstance(reason, str) or len(reason) > parking.DRAIN_REASON_MAX:
+            self._audit("drain", {"ok": False, "error": "bad reason"})
+            return 400, {"drained": False, "error": (
+                f"reason must be a string of at most "
+                f"{parking.DRAIN_REASON_MAX} characters"
+            )}
+        try:
+            drain, claims = self.sources.set_drain(ttl, reason)
+        except sqlite3.Error as exc:
+            self._audit("drain", {"ok": False, "error": str(exc)})
+            return 503, {"drained": False, "error": "state_unavailable"}
+        idle = self.sources.idle()
+        refusals = parking.idle_refusals(
+            idle, poll_interval=self.sources.config.poll_interval,
+            now=self._clock(),
+        )
+        refusals += [f"spawn in progress: {c['session']}" for c in claims]
+        if idle.get("drainedAt") is None:
+            refusals.append("the drain flag could not be read back")
+        if refusals:
+            try:
+                self.sources.clear_drain()
+            except sqlite3.Error as exc:
+                # The TTL still bounds it, and the spawn gate reads the flag
+                # strictly; say so rather than pretend it is down.
+                refusals.append(f"the flag could not be cleared ({exc})")
+            else:
+                idle = dict(idle, drainedAt=None)
+            self._audit("drain", {
+                "ok": False, "ttlS": ttl, "reason": reason, "refusals": refusals,
+            })
+            return 200, {"drained": False, "refusals": refusals, "idle": idle}
+        vitals = self._push_vitals() if self._push_vitals is not None else "skipped"
+        self._audit("drain", {
+            "ok": True, "ttlS": ttl, "reason": reason, "vitals": vitals,
+        })
+        return 200, {
+            "drained": True,
+            "drainedAt": parking.iso(drain["drained_at"]),
+            "expiresAt": parking.iso(drain["expires_at"]),
+            "idle": idle,
+            "vitals": vitals,
+        }
+
+    def undrain(self) -> "tuple[int, dict]":
+        """`POST /action/undrain`: lower the drain flag -- orcloop's step 4
+        on any failure of a park. Idempotent: undraining a seat that is not
+        drained answers `cleared: false`. (status, payload), audited."""
+        try:
+            cleared = self.sources.clear_drain()
+        except sqlite3.Error as exc:
+            self._audit("undrain", {"ok": False, "error": str(exc)})
+            return 503, {"drained": True, "error": "state_unavailable"}
+        self._audit("undrain", {"ok": True, "cleared": cleared})
+        return 200, {"drained": False, "cleared": cleared}
+
     def retry(
         self, repo_slug: "str | None", number: Any, round_: Any
     ) -> "tuple[bool, str]":
@@ -388,7 +487,10 @@ class Handler(BaseHTTPRequestHandler):
             )
             return
         # Everything below is a state-changing action: session + CSRF required.
-        if path in ("/action/kill", "/action/retry", "/action/answer"):
+        if path in (
+            "/action/kill", "/action/retry", "/action/answer",
+            "/action/drain", "/action/undrain",
+        ):
             if not self._authed():
                 self._send_json({"error": "unauthorized"},
                                 status=HTTPStatus.UNAUTHORIZED)
@@ -397,6 +499,16 @@ class Handler(BaseHTTPRequestHandler):
                 self._send_json({"error": "csrf"}, status=HTTPStatus.FORBIDDEN)
                 return
             payload = self._json_body()
+            if path == "/action/drain":
+                status, body = self.app.drain(
+                    payload.get("ttlS"), payload.get("reason")
+                )
+                self._send_json(body, status=status)
+                return
+            if path == "/action/undrain":
+                status, body = self.app.undrain()
+                self._send_json(body, status=status)
+                return
             if path == "/action/answer":
                 status, body = self.app.answer(
                     payload.get("session"), payload.get("verb")

{alissa_tools_github_revloop-0.31.10 → alissa_tools_github_revloop-0.31.11}/src/main/alissa/tools/github/revloop/webui/sources.py

@@ -1,4 +1,5 @@
-"""The console's read-only data layer (plus the one retry-now UPDATE).
+"""The console's read-only data layer (plus the retry-now UPDATE and the
+seat-parking drain flag).
 
 Every panel the dashboard renders is assembled here from four kinds of source,
 in strict budget order:
@@ -36,7 +37,13 @@ page) instead of quietly conjuring an empty state.db that renders exactly like
 an idle daemon -- the one distinction the console exists to make, and easy to
 get wrong because `--workspace-root` defaults to the cwd.
 
-The single mutation is `retry_now`: it ages the newest ledger row of one round
+Seat parking (issue #157) adds the idle block (`idle`, the seat's own verdict
+for orcloop's park rule) and the drain flag's two writes, `set_drain` /
+`clear_drain`, which the console's `/action/drain` and `/action/undrain` call.
+Unlike every read here those RAISE on a ledger they cannot reach: a drain that
+did not happen must never be answered as one that did.
+
+The other mutation is `retry_now`: it ages the newest ledger row of one round
 past the stale window (an UPDATE, via `State.age_out_spawn`), so the daemon's
 own re-enqueue path can respawn it on its next pass. No new retry logic lives
 here -- the console only moves a clock the daemon already reads. It reports a
@@ -54,6 +61,7 @@ import urllib.request
 from pathlib import Path
 from typing import Callable
 
+from .. import parking
 from ..alissa import REVIEW_SESSION_PREFIX
 from ..config import Config
 from ..loop import (
@@ -613,6 +621,66 @@ class Sources:
         tail = text.splitlines()[-lines:]
         return {"path": str(path), "lines": tail}
 
+    # -- seat parking (issue #157) -----------------------------------------
+
+    def queued(self) -> "int | None":
+        """Undispatched items in the alissa tmux queue (every queue on the
+        machine), or None when `alissa tmux queue ls --json` cannot be read
+        -- unknown, never zero."""
+        return parking.queued_items(
+            self._safe_json(["alissa", "tmux", "queue", "ls", "--json"])
+        )
+
+    def drain(self) -> "dict | None":
+        """The drain that holds now (`State.drain`), or None. A state.db
+        that cannot be read answers None: the console then shows no drain,
+        and the daemon's own gate reads the ledger strictly."""
+        now = self._wall()
+        return self._read_state(None, lambda st: st.drain(now))
+
+    def idle(self, rows: object = None, *, read_rows: bool = True) -> dict:
+        """The seat's idle block (`parking.idle_block`): owed and timers from
+        the newest poll snapshot, live / managed from the session rows (read
+        here unless the caller hands in the rows it already holds, None
+        meaning the roster could not be listed), queued from the alissa
+        queue, and `drainedAt` while a drain holds. A failed listing is null
+        counts, never zeros."""
+        if read_rows:
+            rows = self.session_rows()
+        snaps = self.snapshots(1)
+        live, managed = parking.roster_counts(
+            rows if isinstance(rows, list) else None
+        )
+        return parking.idle_block(
+            snaps[0] if snaps else None,
+            live=live, managed=managed, queued=self.queued(),
+            drain=self.drain(), now=self._wall(),
+        )
+
+    def set_drain(self, ttl: int, reason: str) -> "tuple[dict, list[dict]]":
+        """Raise the drain flag (`State.set_drain`, with the spawn claims
+        standing at that instant). Raises sqlite3.Error -- an absent state.db
+        included: a console with no daemon state has nothing to drain, and a
+        drain must never be the thing that creates one."""
+        if not self.state_present():
+            raise sqlite3.OperationalError(
+                f"no state.db at {self.config.state_db}"
+            )
+        with State(self.config.state_db) as st:
+            return st.set_drain(
+                ttl, reason, now=self._wall(),
+                claim_ttl=parking.SPAWN_CLAIM_TTL,
+            )
+
+    def clear_drain(self) -> bool:
+        """Lower the drain flag (`State.clear_drain`): True when a row was
+        cleared. Raises sqlite3.Error; an absent state.db has no flag up, so
+        it answers False."""
+        if not self.state_present():
+            return False
+        with State(self.config.state_db) as st:
+            return st.clear_drain()
+
     # -- the retry-now mutation --------------------------------------------
 
     def retry_now(self, repo_slug: str, number: int, round_: int) -> str:
@@ -662,7 +730,10 @@ class Sources:
         # missing from `stats` and its row shows "--" for CPU%/RSS for one
         # poll. Self-healing in ~10s, and cheaper than walking /proc twice.
         proc_index = sysinfo.build_index(self._proc_root)
-        sessions = self.sessions(index=proc_index)
+        # One roster read feeds the session table and the idle block; the
+        # block needs the unlistable None the table degrades to [].
+        rows = self.session_rows(index=proc_index)
+        sessions = rows or []
         rate = self.rate_limit()
         disk = sysinfo.disk_usage(self.config.workspace_root)
         memory = sysinfo.cgroup_memory(self._cgroup_root)
@@ -752,6 +823,9 @@ class Sources:
             # IS resident, this is what names the holder.
             "top_procs": top_procs,
             "log": self.log_tail(),
+            # Seat parking (issue #157): the seat's own idle verdict, read by
+            # orcloop's park rule (design §2.1, §2.2).
+            "idle": self.idle(rows, read_rows=False),
         }
 
     def inbox(self) -> dict:

{alissa_tools_github_revloop-0.31.10 → alissa_tools_github_revloop-0.31.11/src/main/alissa_tools_github_revloop.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: alissa-tools-github-revloop
-Version: 0.31.10
+Version: 0.31.11
 Summary: ALISSA-TOOLS-GITHUB-REVLOOP
 Home-page: https://alissa.app
 Author: Fahera

{alissa_tools_github_revloop-0.31.10 → alissa_tools_github_revloop-0.31.11}/src/main/alissa_tools_github_revloop.egg-info/SOURCES.txt

@@ -14,6 +14,7 @@ src/main/alissa/tools/github/revloop/fleet_vitals.py
 src/main/alissa/tools/github/revloop/ghclient.py
 src/main/alissa/tools/github/revloop/loop.py
 src/main/alissa/tools/github/revloop/loop_events.py
+src/main/alissa/tools/github/revloop/parking.py
 src/main/alissa/tools/github/revloop/proc.py
 src/main/alissa/tools/github/revloop/prompts.py
 src/main/alissa/tools/github/revloop/prreview.py

alissa_tools_github_revloop-0.31.10/src/main/alissa/tools/github/revloop/version

@@ -1 +0,0 @@
-0.31.10