fix(core): keep BLOCKED tasks under reconciliation, and stop the cache guard no-op'ing (#1032)

CI review on #1079.

The reconciliation sweep selected tasks whose batch result is None or RUNNING.
Once a task's first attempt reported BLOCKED, that entry is neither — and
nothing clears it mid-batch — so the task was excluded from every later sweep.
That silently disabled BOTH the pre-existing blocker-resolved requeue and the
blocked-task GitHub check added two commits ago: the code ran, nothing ever
reached it. A blocked task is precisely the one whose state changes from
outside, whether by a human answering or by the linked issue being closed.
BLOCKED now joins None/RUNNING; COMPLETED and FAILED stay excluded.

Cache runaway guard: clearing only _open_until does nothing once _closed alone
reaches the cap, so past that point the guard fired on every lookup and freed
nothing. Now clears _closed too when it is the half at the cap.

Both pinned by tests, including one asserting a COMPLETED task is still
excluded from sweeps.

Author: frankbria

codeframe/core/conductor.py

@@ -2209,10 +2209,16 @@ def _pass() -> None:
         """One reconciliation sweep. Raises nothing the caller must handle."""
         try:
             # Get currently active task IDs from the batch
+            # BLOCKED belongs here, not just None/RUNNING (#1032). A blocked
+            # task is precisely the one whose state can change from outside —
+            # a human answering the blocker, or closing the linked GitHub
+            # issue. Excluding it meant both the blocker-resolved requeue and
+            # the GitHub check were unreachable the moment a task's first
+            # attempt reported BLOCKED, since nothing clears that entry
+            # mid-batch. COMPLETED and FAILED stay excluded: finished work.
             active_ids = [
                 tid for tid in batch.task_ids
-                if batch.results.get(tid) is None
-                or batch.results.get(tid) == "RUNNING"
+                if batch.results.get(tid) in (None, "RUNNING", "BLOCKED")
             ]
             if not active_ids:
                 return

codeframe/core/reconciliation.py

@@ -176,8 +176,14 @@ def is_closed(self, task) -> bool:
             self._disable(f"GitHub issue lookup failed ({exc})")
             return False
 
+        # Runaway guard. Drop the open half first — it is the cheap one to
+        # rebuild — and only clear the closed set if that alone is at the cap,
+        # otherwise the guard would keep firing as a no-op once _closed filled
+        # it (CI review).
         if len(self._closed) + len(self._open_until) >= _ISSUE_STATE_CACHE_MAX:
-            self._open_until.clear()  # the cheap half to rebuild
+            self._open_until.clear()
+            if len(self._closed) >= _ISSUE_STATE_CACHE_MAX:
+                self._closed.clear()
 
         if str(state).lower() == "closed":
             self._closed.add(key)

tests/core/test_external_completion_honored_1032.py

@@ -346,6 +346,74 @@ def apply_changes(self, result, batch, procs):
         assert batch.results[target] == "COMPLETED"
 
 
+class TestBlockedTasksStayUnderReconciliation:
+    """A task recorded BLOCKED must keep being re-checked.
+
+    ``_pass`` selected tasks whose result is None or RUNNING. Once a task's
+    first attempt returned BLOCKED, that entry is neither — so the task was
+    excluded from every later sweep for the rest of the batch. That silently
+    disabled both the pre-existing blocker-resolved requeue and this branch's
+    GitHub check for blocked tasks: the code ran, but nothing ever reached it.
+    """
+
+    def test_a_blocked_task_is_still_swept(self, workspace, three_tasks, monkeypatch):
+        swept = []
+
+        class StubEngine:
+            def __init__(self, workspace):
+                pass
+
+            def check_all_active(self, ids):
+                from codeframe.core.reconciliation import ReconciliationResult
+
+                swept.append(list(ids))
+                return ReconciliationResult()
+
+            def apply_changes(self, result, batch, procs):
+                pass
+
+        monkeypatch.setattr(
+            "codeframe.core.reconciliation.ReconciliationEngine", StubEngine
+        )
+
+        blocked = three_tasks[0]
+        batch = _make_batch(workspace, three_tasks, {blocked: "BLOCKED"})
+        conductor._start_reconciliation_thread(workspace, batch, interval_seconds=3600)
+
+        assert swept, "no sweep ran"
+        assert blocked in swept[0], (
+            "a BLOCKED task is excluded from reconciliation for the rest of "
+            "the batch, so it can never be unblocked or completed externally"
+        )
+
+    def test_a_completed_task_is_not_swept(self, workspace, three_tasks, monkeypatch):
+        """The exclusion is still right for genuinely finished work."""
+        swept = []
+
+        class StubEngine:
+            def __init__(self, workspace):
+                pass
+
+            def check_all_active(self, ids):
+                from codeframe.core.reconciliation import ReconciliationResult
+
+                swept.append(list(ids))
+                return ReconciliationResult()
+
+            def apply_changes(self, result, batch, procs):
+                pass
+
+        monkeypatch.setattr(
+            "codeframe.core.reconciliation.ReconciliationEngine", StubEngine
+        )
+
+        done = three_tasks[0]
+        batch = _make_batch(workspace, three_tasks, {done: "COMPLETED"})
+        conductor._start_reconciliation_thread(workspace, batch, interval_seconds=3600)
+
+        assert done not in swept[0]
+
+
 class TestEveryWriteSiteUsesTheGuard:
     def test_no_executor_writes_batch_results_directly(self):
         """A guard that four of five call sites bypass guards nothing.