Merge pull request '到期清單的路徑一律由呼叫端餵進來，並拒跑過舊的清單' (#36) from fix/run-due-rows-path-must-be-passed-in into develop

Reviewed-on: #36

.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "jsc-assist",
-  "version": "0.2.7",
+  "version": "0.2.8",
   "description": "助理：事件收攏、健康巡檢與待辦簿（MONITOR_{HASH} wiki 頁）",
   "skills": "./skills",
   "author": {

.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "jsc-assist",
-  "version": "0.2.7",
+  "version": "0.2.8",
   "description": "助理：事件收攏、健康巡檢與待辦簿（MONITOR_{HASH} wiki 頁）",
   "skills": "./skills",
   "jsc": {

plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "jsc-assist",
-  "version": "0.2.7",
+  "version": "0.2.8",
   "description": "助理：事件收攏、健康巡檢與待辦簿（MONITOR_{HASH} wiki 頁）",
   "skills": "./skills/",
   "jsc": {

skills/assistant/SKILL.md

@@ -346,7 +346,7 @@ That property holds only while nothing fakes a heartbeat. **`write` is called by
 
 One round: read five sources, record the result, then beat. Everything before the heartbeat is read-only except the round's own scratch files. Ask nobody anything.
 
-1. **Collect.** Run `{CURRENT}/jsc-assist/tools/patrol.sh collect --trigger 排程` (use `--trigger 手動` when a person asked for this round). That is the same split step 0 branched on: 排程 is the unattended round that read its root out of the invocation text, 手動 the round somebody asked for. Judge the exit code by the patrol.sh table. Exit 4 stands the round down — report the holder and its age from the printed `lock=busy` line, and stop; write no page and no heartbeat. Exit 5 and 6 stop the round the same way, with the code and the stderr text. Exit 0, 1 and 3 all carry on to step 2. Record `round=`, `lock_broken=`, `hash=`, `page=`, `verdict=`, `failed_sources=`, `warn_sources=`, `pending=`, every `item=` line, and the file paths `latest_file=`, `summary_file=`, `summary_row_file=`, `newpage_file=` and `contents_file=`. Completion condition: the round id, the page name and the five file paths are recorded, or the stand-down or the failure was reported and the round stopped.
+1. **Collect.** Run `{CURRENT}/jsc-assist/tools/patrol.sh collect --trigger 排程` (use `--trigger 手動` when a person asked for this round). That is the same split step 0 branched on: 排程 is the unattended round that read its root out of the invocation text, 手動 the round somebody asked for. Judge the exit code by the patrol.sh table. Exit 4 stands the round down — report the holder and its age from the printed `lock=busy` line, and stop; write no page and no heartbeat. Exit 5 and 6 stop the round the same way, with the code and the stderr text. Exit 0, 1 and 3 all carry on to step 2. Record `round=`, `lock_broken=`, `hash=`, `page=`, `verdict=`, `failed_sources=`, `warn_sources=`, `pending=`, every `item=` line, and the file paths `latest_file=`, `summary_file=`, `summary_row_file=`, `newpage_file=`, `contents_file=` and `due_rows_file=` — that last one is what step 5 has to be given, and an empty value there means the judging step produced no list, so step 5 has nothing to act on and says so rather than falling back to anything. Completion condition: the round id, the page name and the five file paths are recorded, or the stand-down or the failure was reported and the round stopped.
 
    **The status event lines come out of the same call.** `collect` drained the stream and rotated it (see 「The status event stream」 above), so record `events_total=`, `events_bad=`, `events_unpaired=`, `events_running=`, `events_rotated=` and `events_file=` alongside the rest, and read `item=D-11` for whether that source was readable at all. The 執行狀態事件 subsection of `latest_file` already carries the two detail tables — the non-`ok` events and the starts with no matching end — so never rebuild either by hand and never call `report-status.sh` yourself: a second `drain` this round would either return exit 3 or eat events that then reach no page at all.
 
@@ -398,7 +398,7 @@ One round: read five sources, record the result, then beat. Everything before th
 
    Completion condition: `link-check.sh` exited 0 over the block's URL and the script exited 0 with exactly one `## MONITOR_{HASH}` block on the page carrying this round's values, or exit 3 from the upsert or a non-zero `link-check.sh` was reported as an unwritten directory entry and the round carried on, or one of the other non-zero codes — `wiki-url`'s included — was reported after the abort ran.
 
-5. **Run the built-in check items that are due.** Run `{CURRENT}/jsc-assist/tools/run-due.sh run --root {CURRENT}`. This is the one step of the round that changes something outside the round's own files, and it is deliberately narrow: it runs only the entries whose `action` is a command and whose `spec_key` is set, so a reminder, a skill name and anything a person entered by hand are all left alone. Judge the exit code by the run-due.sh table, and keep every `done=`, `failed=`, `held=`, `skip=`, `write_failed=`, `target_ok=` and `target_fail=` line plus the summary counts for the report. **No exit code from this step stops the round.** Exit 1 means an entry's command failed and that entry now carries one more failure — that is a finding, not a broken round; exit 4 means a write-back failed, so the same entry will run again next round, which is worth saying out loud; exit 2, 5 and 6 mean nothing ran, and the round still has a result to record. Completion condition: the exit code and the summary counts are recorded, and step 6 was reached whatever that code was.
+5. **Run the built-in check items that are due.** Run `{CURRENT}/jsc-assist/tools/run-due.sh run --root {CURRENT} --rows {the `due_rows_file=` step 1 printed}`. **That path is not optional and there is no default.** The judging step writes its output into the directory whoever called it chose, so a default would point somewhere else — and it did: the tool shipped with one, and every round read a file a person had left behind by running the judge by hand. That file sat on this machine for 67 hours while each round acted on it, one round even running an entry that had already been removed. Nothing looked wrong, because the stale list had been correct when it was written and its contents happened not to change. Passing the path makes each round say which round's data it is acting on; the tool also refuses a list older than the heartbeat TTL, because a list older than that cannot describe this round. This is the one step of the round that changes something outside the round's own files, and it is deliberately narrow: it runs only the entries whose `action` is a command and whose `spec_key` is set, so a reminder, a skill name and anything a person entered by hand are all left alone. Judge the exit code by the run-due.sh table, and keep every `done=`, `failed=`, `held=`, `skip=`, `write_failed=`, `target_ok=` and `target_fail=` line plus the summary counts for the report. **No exit code from this step stops the round.** Exit 1 means an entry's command failed and that entry now carries one more failure — that is a finding, not a broken round; exit 4 means a write-back failed, so the same entry will run again next round, which is worth saying out loud; exit 2, 5 and 6 mean nothing ran, and the round still has a result to record. Completion condition: the exit code and the summary counts are recorded, and step 6 was reached whatever that code was.
 
 6. **Write the heartbeat.** Run `{CURRENT}/jsc-assist/tools/patrol.sh finish --round {round}`. This is the last step for a reason: it is the only thing that turns a fresh heartbeat into a true statement. Judge the exit code by the patrol.sh table — 2, 4 and 5 all mean the round is recorded but unproven, and each has its own report line there. Completion condition: `finish` exited 0, or the failure was reported as "recorded but no heartbeat" with its code.
 

tools/patrol.sh

@@ -205,6 +205,7 @@ WARN=0
 DUE_STATUS=fail
 DUE_RC=0
 DUE_MD=''
+DUE_ROWS=''
 DUE_NOTE=''
 DUE_TASKS=''
 DUE_EVENTS=''
@@ -912,6 +913,11 @@ due_scan() {
   JSC_HOME="$JSC_HOME" sh "$_due" scan --out "$RD/due" >"$RD/due.out" 2>"$RD/due.err" </dev/null || _rc=$?
   DUE_RC="$_rc"
   DUE_MD=$(sed -n 's/^due_file=//p' "$RD/due.out" 2>/dev/null | head -n1)
+  # 機器可讀的那一份也要轉出去。判到期與執行是兩支腳本，中間靠這個檔案交棒；不轉出去
+  # 呼叫端就只能靠預設路徑猜，而那個預設指向的是上一次有人手動跑 scan 留下的檔案。
+  # 實測踩過：那份舊清單在機器上放了六小時，執行那一支每一輪都對它動手，跑的是一筆已經
+  # 被移除的待辦，而且看起來完全正常——舊清單當時是對的，內容剛好沒變。
+  DUE_ROWS=$(sed -n 's/^rows_file=//p' "$RD/due.out" 2>/dev/null | head -n1)
   DUE_TASKS=$(sed -n 's/^tasks_due=//p' "$RD/due.out" 2>/dev/null | head -n1)
   DUE_EVENTS=$(sed -n 's/^events_new=//p' "$RD/due.out" 2>/dev/null | head -n1)
   case "$_rc" in
@@ -1157,6 +1163,7 @@ case "$CMD" in
     printf 'due_status=%s\n' "$DUE_STATUS"
     printf 'due_rc=%s\n' "$DUE_RC"
     printf 'due_file=%s\n' "$DUE_MD"
+    printf 'due_rows_file=%s\n' "${DUE_ROWS:-}"
     printf 'pending=%s\n' "$PEND_COUNT"
     printf 'events_total=%s\n' "$EV_TOTAL"
     printf 'events_bad=%s\n' "$EV_BAD"

tools/run-due.sh

@@ -95,7 +95,19 @@ case "$JSC_HOME_RESOLVED" in
   /*) ;;
   *) die 6 'JSC_HOME 與 HOME 都解不出絕對路徑，找不到助理狀態目錄。' ;;
 esac
-[ -n "$ROWS" ] || ROWS="$JSC_HOME_RESOLVED/assistant/due/rows.txt"
+# --rows 沒有預設值，一律要指定。
+#
+# 原本有預設，指向助理狀態目錄底下那一份。那個預設是這一支上線之後最嚴重的一個缺陷：
+# 判到期那一支是被巡檢用 --out 叫的，輸出寫進那一輪自己的暫存目錄，跟這個預設不是同一個
+# 位置。於是這一支每一輪讀的都是「上一次有人手動跑 scan 留下的那一份」。實測那份清單在
+# 機器上放了六小時，這一支每一輪都對它動手，還跑了一筆已經被移除的待辦。
+# 而它看起來完全正常——那份舊清單產生的當下是對的，內容剛好沒變。**錯了六小時才顯形。**
+#
+# 所以不留預設。少帶這個選項就回用法錯誤，吵一次總比安靜地對舊資料動手好。呼叫端要拿
+# collect 印的 due_rows_file= 餵進來，那是同一輪產生的那一份。
+if [ -z "$ROWS" ]; then
+  die 6 '沒有帶 --rows。這一支不猜到期清單的位置：判到期那一支的輸出寫在叫它的人指定的目錄裡，猜一個預設就會讀到別人留下的舊檔案，而舊檔案讀起來跟新的一模一樣。請把 collect 印的 due_rows_file= 餵進來。'
+fi
 
 [ -f "$ROWS" ] || die 2 "到期清單讀不到：$ROWS。請先跑 due.sh scan——沒跑過判定，跟「都沒到期」不是同一件事。"
 
@@ -121,6 +133,26 @@ find_tool() { # $1=domain $2=相對路徑
   return 1
 }
 
+# 清單太舊就拒跑。判到期與執行之間隔著呼叫端，那一段有可能斷掉——collect 失敗了而那一輪
+# 照樣往下走，或呼叫端餵進上一輪的路徑。兩種都會讓這一支對著一份不描述現況的清單動手，
+# 而那正是它上線之後六小時裡在做的事。
+# 門檻取心跳的過期門檻：那是這台機器認定「一輪跑完的紀錄還算新鮮」的長度，一份比它還舊的
+# 到期清單本來就不可能是這一輪產生的。讀不到門檻就退回 300 秒，跟心跳那一支的預設一致。
+_ttl=''
+if _hb=$(find_tool hooks hooks/heartbeat.sh 2>/dev/null); then
+  _ttl=$("$_hb" report 2>/dev/null | sed -n 's/.*[[:space:]]ttl=\([0-9]*\).*/\1/p' | head -n1)
+fi
+case "${_ttl:-}" in
+  ''|*[!0-9]*) _ttl=300 ;;
+esac
+_mtime=$(date -r "$ROWS" +%s 2>/dev/null) || _mtime=''
+if [ -n "$_mtime" ]; then
+  _age=$((NOW - _mtime))
+  if [ "$_age" -gt "$_ttl" ]; then
+    die 2 "到期清單是 $_age 秒前產生的，超過門檻 $_ttl 秒，這一支不對它動手：$ROWS。一份比心跳門檻還舊的清單不可能描述這一輪，照著跑會動到已經不存在的待辦。請確認判到期那一步這一輪真的跑成功了，再把它印的路徑餵進來。"
+  fi
+fi
+
 TASKS_SH="$HERE/tasks.sh"
 [ -f "$TASKS_SH" ] || TASKS_SH=$(find_tool assist tools/tasks.sh) \
   || die 2 '找不到 tasks.sh，成敗沒有地方回寫。待辦簿只有一個寫入者，缺了它這一輪不該跑。'