fix: keep inactive loop routes out of task projection - #483

What & why

Fixes #479.

Exclusive Loop routing already settled dominated nodes as route_not_taken, but the generic Task projection independently materialized Tasks and blocking dependency edges for every graph output. In the reported topology, choosing the sentry branch still created a ready create_spec Task on the inactive linear branch. The downstream prepare_worktree Task then depended on that phantom prerequisite, so its already queued run could not be claimed.

This change makes persisted Task ownership follow actual runtime scheduling: a generic node Task is created only when the coordinator plan also queues that node's worker run. Dependencies are emitted only for a Task scheduled by the current plan and only toward predecessor outputs that prove they own a worker run in the same generation. Route history remains complete in Loop generation outputs, while inactive work no longer enters the runnable Task graph.

Root cause

The coordinator built Task artifacts before it built ready node runs. appendCoordinatorTasksForOutputs and appendCoordinatorDependenciesForOutputs therefore had no scheduling boundary and eagerly projected all non-parked generation outputs, including synthetic route_not_taken outputs. The Task claim predicate behaved correctly: it refused to claim prepare_worktree while the projected create_spec dependency remained incomplete.

Implementation

• Build ready node runs before projecting generic Task artifacts in both initial-plan and subsequent-generation paths.
• Treat the plan's queued node runs as the authoritative set of Tasks to create in that coordinator transaction.
• Emit dependency edges only for target Tasks scheduled in the plan.
• Require dependency outputs to carry the canonical current-generation worker run identity; synthetic route skips and carried outputs from another generation cannot become prerequisites.
• Preserve Goal segment run identities through their canonical generation-scoped prefix.
• Remove old assertions that froze eager Task/dependency materialization before the next coordinator had scheduled work.

This is a greenfield hard cut. It does not add compatibility rows, fallback aliases, claim exceptions, or repair logic for old alpha databases.

Regression coverage

The regression belongs to the existing real-SQLite coordinator materialization suite:

TestGlobalDBCompleteCoordinatorAndEnqueueNextShouldCreateNodeTasksDependenciesAndRuns / Should claim a join after an inactive route settles

The test runs the full persisted coordinator sequence for:

select_source -> route_source
  -> analyze_linear -> create_spec -----\
  -> analyze_sentry ---------------------> prepare_worktree

With the sentry/default route selected, it:

1. creates the Loop run in the real GlobalDB store;
2. executes and persists each coordinator plan;
3. settles select_source with risk=sentry;
4. verifies that the selected analyze_sentry worker is queued;
5. settles that worker and persists the queued prepare_worktree worker;
6. calls the real ClaimNextRun for prepare_worktree;
7. requires both inactive Tasks (analyze_linear and create_spec) to be absent;
8. requires the join to have exactly one blocking dependency, analyze_sentry.

Before the production fix, the same test failed at step 6 with task: no claimable run. After the fix, it passed with the race detector enabled.

Existing Loop suites continue to cover route causes, fan-out, gates, retries, reattempt strategies, error routes, and lifecycle settlement. The changed reattempt expectations now assert that no generic Task exists before the successor coordinator actually schedules work.

Real runtime QA

The living scenario LP-exclusive-route-history was reset, walked, and returned to pass. The run used a fresh isolated lab with a dedicated COMPOZY_HOME, HTTP port, UDS path, and tmux socket.

Observed through the built CLI, real daemon, SQLite, UDS, and independent HTTP reads:

• run looprun-4bbdac0da3a2d3e5 settled as done / complete;
• analyze_linear and create_spec remained visible in Loop history as route_not_taken;
• the typed Task catalog contained only the coordinator plus select_source, analyze_sentry, and prepare_worktree;
• prepare_worktree completed and exposed exactly one dependency, analyze_sentry;
• the same run, catalog, and dependency survived a daemon restart;
• calm Task catalogs still excluded Loop records;
• an unknown Loop-run filter returned an empty catalog, while a cross-workspace run read returned 404.
• targeted teardown completed with clean: true, stopped daemon PID 93208, and reported zero survivors.

Durable QA report: docs/qa/reports/2026-08-25-issue-479.md.

How you verified it

• Red-before proof: the new GlobalDB regression failed with task: no claimable run before the production change.
• Focused race regression: passed after the fix.
• go test -race ./internal/loop/...: 1,025 tests passed.
• Canonical GlobalDB coordinator materialization suite: passed.
• make build: passed (CodegenCheck and Go build).
• Isolated CLI/API/runtime QA: passed for LP-exclusive-route-history plus the adjacent headless Task-catalog canary.
• Scoped Go lint for ./internal/loop/... ./internal/store/...: passed with zero issues after the final mutation.
• make gate: inconclusive under machine contention. It passed lint, internal/loop, and internal/store; GlobalDB was killed only by the 11-minute package limit while another worktree's full go test ./... was active. No assertion failed.
• make gate-full: intentionally not run locally at the operator's request; the complete monorepo gate is delegated to this PR's CI.
• Strict QA evidence audit: behavior evidence is complete; release closure remains blocked only on the intentionally delegated full gate (C14).

The competing verification remained active for more than 16 minutes in GlobalDB. Rather than start another broad local package run and reproduce contention, the exact regression was rerun after the final test strengthening and passed with -race in 130.429s. CI is the required broad verification authority for this PR.

Impact

User-visible behavior

Task catalogs no longer expose or schedule inactive-route work, and selected downstream Loop work is no longer blocked by phantom dependencies. Loop status/history keeps the existing route_not_taken explanation.

Compozy Impact Audit

• Native tools: behavior observed by compozy__task_list / compozy__loop_status is corrected through their existing API/core projections. Tool IDs, toolsets, descriptors, input/output schemas, digests, risk flags, capability gates, and availability diagnostics are unchanged.
• Extensibility and hooks: no extension, hook event, capability, registry, bridge SDK, MCP sidecar, or resource contract changes. Loop hook-originated Task records now contain only workers the coordinator actually schedules; existing hook/tool surfaces require no new wiring.
• Workspace data isolation: no new datum or scope. Loop Tasks remain workspace-scoped, preserve the existing workspace_id, and are claimed with the existing workspace criteria. QA independently confirmed a foreign-workspace run read returns 404.
• Official Compozy skill: no text change required. skills/compozy/references/tasks-and-orchestration.md already describes Task catalogs as real work and typed Loop execution records; this fix restores that documented contract without changing a command, flag, tool ID, or workflow.

Web / docs / config lifecycle

• Web: no route, component, hook, cache key, SSE payload, or generated type change. Existing Task and Loop screens consume the corrected persisted projection.
• packages/site: no public documentation change; the documented route history and Task-catalog behavior were already correct.
• config.toml: no key, default, lifecycle class, or settings attachment changed. Existing [loops] and Task orchestration settings remain valid.

Storage and contracts

• No schema or migration change.
• No OpenAPI, HTTP, UDS, CLI, native-tool, or SSE shape change.
• No compatibility path for obsolete alpha state.

Risk and review notes

The main risk is accidentally dropping a legitimate dependency when its prerequisite completed in an earlier coordinator transaction. The implementation avoids using only the current plan's node-run set for prerequisites: it validates the persisted output's canonical worker run identity for the same generation and attempt. Goal nodes use their canonical generation-scoped segment prefix. The real-SQLite regression proves prior selected work remains the only dependency on the newly scheduled join.

The change deliberately does not modify generic claim SQL. Relaxing claim eligibility would hide malformed Task graphs and allow dependent work to run early; the projection is corrected at its ownership boundary instead.

• make gate passes locally (make gate-full delegated to CI by operator request)
• New or changed behavior is covered by a red-before/green-after real-SQLite regression and real runtime QA
• Codex co-wrote this change; the result was independently exercised through focused race tests, a built daemon, CLI, UDS, HTTP, and the living QA tracker

Summary by CodeRabbit

• Bug Fixes

  • Improved workflow planning so control-related tasks are scheduled in the correct order.
  • Prevented tasks from inactive routes or outside the current workflow generation from being created.
  • Ensured shared join steps are created and claimed only for the selected route.
  • Improved dependency handling for goal segments, skipped routes, and selected branches.

• Tests

  • Updated retry and failure-routing coverage to reflect corrected planning behavior.
  • Added integration coverage for route selection and shared join execution.