Same-agent intake guard now also matches siblings sharing a
sourceParentTaskId, so repeated heartbeats from one parent task
can't bypass dedup just because triage rewrites the title.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Implement the hard-archived delete contract: add a typed `ArchivedTaskDeleteError`, map hard-archived task deletes to HTTP 410 Gone at both the store and routes layers, and document the invariant in the soft-delete verification matrix.
Fusion-Task-Id: FN-5196
Merges the Layer 2.5 scope-auto-widen feature (FN-5226) into the merger: a new evaluator module that automatically widens a task's declared file scope based on git attribution prior to the existing scope partition gate, wired into `merger.ts` with full audit taxonomy, persisted task metadata, and re
Fusion-Task-Id: FN-5226
A task that picked up status='queued' or overlapBlockedBy while waiting in
todo (file-scope overlap with a higher-priority peer) was carrying those
todo-dispatch markers into in-review, where the merge gate then permanently
refused with "task is marked 'queued'". Ghost-review → todo → scheduler
re-queue → stranded-completed-todo recovery → in-review formed a steady-
state loop that never let the task merge.
moveTaskInternal now treats queued/blockedBy/overlapBlockedBy as todo-only
dispatch state and clears them on every transition into in-review. failed
and awaiting-* statuses are left untouched (already covered by an existing
test, plus a new regression test for the queued case).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The unconditional listTasks() in assertNoDependencyCycle was wasted work
for the common no-dependency write and broke the same-agent duplicate
intake fail-open path: tests that stub listTasks to throw had the cycle
check consume the rejection before _maybeAutoArchiveSameAgentDuplicate's
try/catch could swallow it, propagating the error out of createTask.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The dashboard's corruption banner refresh action was a no-op for clearing
stale corruption flags after the user repaired the DB. Database.
scheduleBackgroundIntegrityCheck runs the integrity check exactly once at
engine boot and then early-returns forever after, so corruptionDetected
was sticky for the life of the process. POST /api/health/refresh just
read the cached flag back.
Add Database.refreshIntegrityCheck() and TaskStore.refreshDatabaseHealth()
which synchronously re-run the integrity check and update the cached
state, and have the route use them. After REINDEX / fn db --vacuum / any
in-place repair, users can now clear the banner without restarting the
engine.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The tasks table description column is NOT NULL, so a task arriving with
description == null/undefined would fail the insert with a constraint
error. Default to "" in getTaskPersistValues, matching the ?? null / ?? 0
treatment of other optional fields.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The merge introduces an engine-activation timestamp as the staleness floor for task age calculations, replacing arbitrary wall-clock thresholds with a runtime-relative anchor. Step 1 adds settings defaults, Steps 2–4 wire the floor helper through project engine, in-process runtime, and task store hy
Fusion-Task-Id: FN-5223
When targetTaskId is passed, the lease attempt must target that task only.
The previous code silently fell back to queue-head selection if the targeted
task was not available — producing a lease for a different task, then
returning it with the wrong taskId. acquireReuseHandoff would then see
lease.taskId !== input.task.id and emit a misleading 'no-lease' diagnostic
that hid the real cause (queue head was occupied by an unrelated task).
The fix: when targetTaskId is set and the lease for that task returns null,
return null immediately instead of falling through to the queue-head SELECT.
Callers (acquireReuseHandoff) already validate the returned taskId and emit
structured 'no-lease' diagnostics including acquiredTaskId so the polluter
is identifiable in audit logs.
Queue-head fallback is preserved for callers that omit targetTaskId
(backward-compatible).
Clears agent logs when a task is soft-deleted, with new regression tests covering the end-to-end behavior and documentation updated in the storage guide. The core logic lives in `store.ts` while `store-upsert.test.ts` is updated to reflect the new expectations.
Fusion-Task-Id: FN-5143
The merge adds a file scope sanitizer to the task store that deduplicates and normalizes path entries, with test coverage in `store-parsing.test.ts`; a small documentation fix accompanies the change in AGENTS.md.
Fusion-Task-Id: FN-5216
Adds a reconcile script to recover leaked soft-deleted tasks, threads delete audit context through all callers, and records soft-delete audit events with archive column tracking across core/engine/cli/dashboard, with reliability backstop tests covering caller alignment.
Fusion-Task-Id: FN-5175
The merge introduces an atomic review handoff seam in the core store (`packages/core/src/store.ts`) and migrates executor and self-healing transitions to use it, replacing the previous multi-step mutable-state handoff with a single transactional operation. Extensive reliability backstops and regress
Fusion-Task-Id: FN-5241
The doc was rewritten to cover "every task-creation path" (with an
explicit enumeration of surfaces) instead of the older "task creation
flows (including ...)" wording, and uses "best-effort and non-blocking"
instead of "Creation is best-effort and non-blocking". Update the
documentation contract test to match the current phrasing.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Fusion-Task-Id: FN-5208
When multiple TaskStore instances watch the same SQLite DB (dashboard +
engine runtime + per-project stores in one dashboard process), every
column move was recorded once per polling instance — inflating
task:moved rows 3x and amplifying failure noise (146k+ moves and 781
task:failed events in 24h against ~165 real done tasks).
Set suppressActivityLogForPollingEmit while checkForChanges fires
re-emit events, and skip the activity-log listeners when it's set. The
originating instance's in-process emit path remains the sole writer.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- Add completion handoff limbo recovery state to task storage and audit events for bounded self-healing retries
- Requeue eligible in-review tasks stuck after "Task marked done by agent" with grace-period, active-task, and merge-blocker safeguards
- Isolate executor run mutation context per task to prevent cross-task runId attribution leaks in scope-leak and completion logs
- Add reliability and executor regression tests covering limbo recovery, run-context isolation, and updated persistence behavior
Fusion-Task-Id: FN-4999
