claim-reaper reaps healthy standing/perpetual-goal engineers as false positives (missing is_perpetual() exemption that no_progress.rs already applies)

[rysweet]

Summary (self-improvement signal from a stale-engineer investigation, #4400 path)

The periodic claim-reaper (src/overseer/claim_reaper.rs) reaps healthy standing/perpetual-goal engineers as false positives. Its liveness probe judges death purely from worktree presence + newest-file mtime idle age and never inherits the is_perpetual() benign-idle exemption the OODA no-progress breaker already applies (src/ooda_loop/no_progress.rs:407-420, issue #2589). The two subsystems therefore disagree: the daemon logs "standing/perpetual goal idled … goal stays active" while the reaper reclaims the same claim_key on heartbeat-stale/no-worktree.

Diagnosed during an overseer stale-engineer investigation of goal advance-rysweet-agent-kgpacks-rs-to-full-parity-f29bb15c (a perpetual goal). Archived evidence at ~/.simard/reaped-engineers/rysweet_Simard_advance-rysweet-agent-kgpacks-rs-to-full-parity-f29bb15c-1784692815/.

Evidence (line-cited, from the durable archive)

The engineer was ALIVE, not dead — zero crash signals:

• journal.txt: 0 real panics / SIGKILL / signal:9 / OOM / core-dumped / non-zero-exit / recipe-runner-failure / brain-call-failure. All 65 raw panic hits are tokens=[…] memory-array noise (65 hits, 65 on tokens=[ lines → 0 real).
• OODA cycles advanced monotonically 2369 → 2387; last real activity journal.txt cycle 2387 @ 2026-07-22T03:57:39Z: OODA consolidation: stored procedure 'pr-merge:advance-rysweet-agent-kgpacks-rs-to-full-parity-f29bb15c | triggers…' immediately before benign-idle @ 03:58:08.
• 14× benign-idle: no-progress breaker: standing/perpetual goal idled this cycle (normal, not a fault) — counter reset, goal stays active.
• manifest.json: idle_age_secs=2171 (worktree newest-file mtime age = normal bursty quiescence), archived 1784692815 (2026-07-22T04:00:15Z, ~2 min after last activity).

The reaper reclaimed the live claim anyway (the bug):

• 5× simard::claim_reaper: reclaimed rysweet/Simard:advance-…-f29bb15c — 3× reason=heartbeat-stale (age=5083s, 3052s, 4470s), 2× reason=no-worktree.
• 1× reclaim carried verdict=no-investigation (journal.txt @ 03:10:27) — the reaper reclaimed without running the Make Simard investigate a quiet/idle engineer BEFORE ever reaping it (evidence-preserve + agentic WHY, feed self-improvement; only reap if genuinely dead). READ THE FULL AUTHORITATIVE BRIEF and follow #4400 investigate-before-reap path.
• 19× OODA start: cleared stale assignment 'engineer-…-1784561556919' — repeated churn on the same live perpetual goal.
• Daemon restarted mid-window (PID 3165616 → 1230193 ~02:46); the perpetual claim survived and kept idling benignly.

Root cause (code seam)

• src/overseer/claim_reaper.rs contains 0 references to is_perpetual / perpetual / standing.
• WorktreeClaimLivenessProbe::assess (claim_reaper.rs:312-360) derives Dead{HeartbeatStale|NoWorktree} from directory presence + newest_file_age_secs only — no goal-type awareness.
• reap_stale_claims (claim_reaper.rs:143-183) reclaims on any confident Dead verdict with no is_perpetual() exemption before release_engineer_claim (claim_reaper.rs:203).
• The canonical exemption already exists for the OODA loop: no_progress.rs:407-420 reuses the same is_perpetual() flag (goal_curation/types.rs:350) and treats idle as "normal, not a fault." The reaper (Read /tmp/claim-reaper-task.txt IN FULL and implement exactly what it specifies: add a periodic stale-engineer-claim REAPER to the Overseer tick that reclaims engineer_claims whose engineer is provabl #4099) was added later and never inherited it.

Precedent for the safer pattern: the tombstoned-goal reaper (#4242) reaps only on an authoritative signal (tombstone), never on mere absence/quiescence.

Scoped corrective brief (minimal, additive, non-breaking, CI-green)

Make the reaper honor the daemon's benign-idle classification for perpetual goals:

1. Give reap_stale_claims access to a perpetual-goal predicate (e.g. pass a &dyn PerpetualGoalOracle / goal-board handle, or a is_perpetual: impl Fn(&str)->bool), resolving the goal via goal_id_from_claim_key.
2. In the loop (claim_reaper.rs:162-183), after a confident Dead verdict but before reclaim, skip (continue, count as exempted) any goal where is_perpetual() is true and the verdict is HeartbeatStale (benign idle). Reuse the SAME is_perpetual() flag (goal_curation/types.rs:350) — never a second notion. NoWorktree on a perpetual goal should route through the Make Simard investigate a quiet/idle engineer BEFORE ever reaping it (evidence-preserve + agentic WHY, feed self-improvement; only reap if genuinely dead). READ THE FULL AUTHORITATIVE BRIEF and follow #4400 investigation rather than a bare verdict=no-investigation reclaim.
3. Emit a fail-visible exemption log mirroring no_progress.rs ("standing/perpetual goal idle — reaper exempt").
4. Keep fail-closed behavior and the SIMARD_CLAIM_REAP_ENABLED off-switch intact. Add a unit test: a perpetual goal past stale_secs is exempted; a non-perpetual goal past stale_secs is still reclaimed.

Constraints: no Bridge naming; structured tracing + OTel, no stray print!; no silent fallbacks.

Dedup

Searched rysweet/Simard issues for reaper/perpetual/heartbeat-stale/false-positive — no existing open tracking issue. #4099 (reaper impl, CLOSED) and #4400 (investigate-before-reap, CLOSED) are related predecessors; this tracks the missing is_perpetual() exemption they left open.

Verdict of the investigation

still-alive (false positive) — fail-closed. The engineer was NOT reaped for death; no claim release / worktree removal was performed by this investigation. The worktree's absence was the reaper's own prior action (reason=no-worktree), not death evidence.

[rysweet]

Specialist verification: dedup + live worktree/claim state (do NOT manually remediate)

Overseer stale-engineer investigation, specialist workstream "deduplicate the tracking issue and verify live worktree/claim state before any action." Confirms this issue is the single canonical tracker and that no destructive remediation is warranted — the goal is alive.

Dedup result — this issue is canonical, no duplicate filed.
Searched rysweet/Simard issues for the reaper false-positive signature (claim_reaper, is_perpetual, heartbeat-stale, no-worktree reap). Exactly one bug-class match: this issue (#4437). The many overseer-obs … recurring signature … goal:blocked:advance-rysweet-agent-kgpacks-rs-… issues (#2707, #2744, #2757, #2875, #4108, #4124, …) are a different class (cognitive-memory recurring-signature auto-reports) and were intentionally not conflated. #4321/#4400 are the goal's own parity tracker / the investigate-before-reap feature (feature landed via merged PR #4418). No duplicate of the reaper-vs-perpetual bug exists — do not file another.

Live claim/worktree state (verified fail-closed):

• Worktree ~/.simard/engineer-worktrees/advance-…-f29bb15c-1784690563-e0863e: ABSENT (No such file or directory) — the reaper already removed it. Nothing left to remove.
• Claim ledger (typed-ooda/outcomes.sqlite3 → engineer_claims): the key rysweet/Simard:advance-rysweet-agent-kgpacks-rs-to-full-parity-f29bb15c is still present and live — row request_id=cycle-2386-…-spawn, outcome_id=019f87d8-140d… → 2026-07-22T03:21:52Z.
• Goal board (state/goal_board.json, cycle_count=2390): goal is in board.active, status=NotStarted, assigned_to=null; current_activity outcome 019f8815-db6a… → 2026-07-22T04:29:21Z.

Liveness proof: the goal committed a fresh OODA typed-no-action at 04:29:21Z — after the reap archive (1784692815 = 04:00:15Z) and after the claim spawn (03:21:52Z). The standing/perpetual goal is actively cycling right now, exactly as its benign-idle classification predicts.

Conclusion — verdict: still-alive false positive; NO destructive action taken.
Releasing the claim or removing a worktree here would re-commit the very bug this issue describes (stripping a live perpetual goal's claim). The worktree is already gone; the claim is a live lease on an actively-cycling goal. The correct remediation is the code fix tracked here (reaper must inherit the no_progress.rs is_perpetual() benign-idle exemption) — not manual ledger/worktree surgery. No open PR yet addresses the is_perpetual() exemption seam.

[rysweet]

Recurrence evidence (2nd stale-engineer investigation of the same perpetual goal, #4400 path)

The defect tracked here reproduced ~1h04m after the first archive. A second overseer stale-engineer investigation of the SAME perpetual goal advance-rysweet-agent-kgpacks-rs-to-full-parity-f29bb15c produced the SAME still-alive (false-positive) verdict, fail-closed — no reap / claim-release / worktree removal performed.

New durable archive: ~/.simard/reaped-engineers/rysweet_Simard_advance-rysweet-agent-kgpacks-rs-to-full-parity-f29bb15c-1784698494/ (archived 1784698494 = 2026-07-22T05:34:54Z).

Evidence (line-cited, from the new archive):

• manifest.json: idle_age_secs=2177 (newest-file mtime age = normal bursty quiescence + LRU cargo-target rotation @ 05:23:58, e.g. Rotating LRU home target …-1784652808 (4504 MB)).
• journal.txt: 0 affirmative death signals — 0 non-zero-exit, 0 panicked at, 0 OOM/oom-kill, 0 SIGKILL/SIGSEGV/core-dumped. Log levels: 113 INFO, 5 WARN, 0 ERROR.
• All 72 e2big / panic-adjacent hits are simard::memory_consolidation: recalled procedures … tokens=[…] array DATA (task vocabulary: …,"error","panic","e2big","patterns","consolidation",…), NOT runtime faults.
• 15× benign-idle breaker: no-progress breaker: standing/perpetual goal idled this cycle (normal, not a fault) — counter reset, goal stays active + 15× goal stays active.
• OODA advanced to cycle 2392 @ 2026-07-22T05:34:10Z (OODA consolidation: stored procedure 'pr-merge:advance-…-f29bb15c') — ~44s before archival. The engineer/loop was demonstrably active up to the archival moment.
• evidence.txt: all 8 newest-file tails are static JSON fixtures/config (tests/gadugi/fixtures/ci-health-*.json, tests/fixtures/atelier/bookcase-brief.json, src/coin_gym/fixtures/*.json, scripts/dashboard-audit/package.json, prompt_assets/simard/terminal_recipes/copilot-submit.json, package.json) — NOT crash/transcript logs.

Reaper still reclaiming the live claim (the bug persists, unfixed):

• journal.txt this window: 3× reason=heartbeat-stale (age=5083s, 3052s, 4470s) + 2× reason=no-worktree, verdict=no-investigation reclaims of rysweet/Simard:advance-…-f29bb15c; daemon incarnations 3165616 → 1230193 → 2209699 — the perpetual claim survived and kept idling benignly.

Conclusion: The is_perpetual() reaper exemption proposed above has NOT yet landed; the false-positive reclaim churn on this standing goal is recurring. No duplicate issue filed (deduplicated into this tracker). Prioritizing the scoped corrective brief above would stop the churn.

[rysweet]

Recurrence corroboration (second overseer stale-engineer investigation, same goal)

A later independent stale-engineer investigation of the same perpetual goal advance-rysweet-agent-kgpacks-rs-to-full-parity-f29bb15c reproduced this bug from a newer durable archive, confirming it persists across reaper sweeps and daemon restarts.

• Archive: ~/.simard/reaped-engineers/rysweet_Simard_advance-rysweet-agent-kgpacks-rs-to-full-parity-f29bb15c-1784698494/
• manifest.json: idle_age_secs=2177 (newest-file mtime age — benign perpetual quiescence, not death).
• Zero crash signals in journal.txt: 0 panicked at / 0 SIGKILL / 0 OutOfMemory / 0 exit status. The cargo/E2BIG-style tokens are memory-consolidation token-array noise (tokens=[…]) and worktree source content (e.g. src/journal/recipe.rs, mkdocs.yml), not runtime faults.
• 15× no-progress breaker: standing/perpetual goal idled this cycle (normal, not a fault) — counter reset, goal stays active (OODA cycles advanced 2373 → 2392, goal stayed active).
• Reaper churn on the identical claim_key across PIDs: reason=heartbeat-stale age=5083s/3052s/4470s (PID 3165616), plus the investigate-before-reap vs no-worktree race: PID 1230193 dispatched the investigation (verdict=pending, evidence preserved) and twice logged NOT reaping … verdict=pending (04:00:15, 04:20:02), yet a different PID 2209699 later reclaimed the same claim reason=no-worktree, verdict=no-investigation (04:49:42) — exactly the NoWorktree bare-reclaim gap called out in corrective-brief item 2.

Verdict: still-alive (false positive), fail-closed. No claim release / worktree removal performed. The worktree currently exists (re-checked out at 04:58:37, uniform mtimes, no live cargo/rustc/engineer process bound to it) — consistent with benign quiescence, not death.

No separate issue filed (deduplicated to this one). No duplicate fix dispatched — the workflow:default fix workstream already tracked here covers both the is_perpetual() exemption and the NoWorktree investigate-before-reap routing.

[rysweet]

Recurrence (2nd stale-engineer investigation, same goal)

Same false-positive reaping recurred for perpetual goal advance-rysweet-agent-kgpacks-rs-to-full-parity-f29bb15c. New durable archive: ~/.simard/reaped-engineers/rysweet_Simard_advance-rysweet-agent-kgpacks-rs-to-full-parity-f29bb15c-1784698494/ (manifest idle_age_secs=2177, archived 1784698494).

Evidence confirms the same pattern:

• journal.txt: reclaim @ 04:49:42 reason=no-worktree ... verdict=no-investigation — again bypassed the Make Simard investigate a quiet/idle engineer BEFORE ever reaping it (evidence-preserve + agentic WHY, feed self-improvement; only reap if genuinely dead). READ THE FULL AUTHORITATIVE BRIEF and follow #4400 investigate-before-reap path.
• The engineer was alive: OODA cycles continued monotonically 2390 → 2392 after the reap (04:54 → 05:34), worktree advance-...-f29bb15c-1784696317-da9e82 was re-enrolled @ 04:58 and is still a valid git worktree (branch engineer/advance-..., HEAD 47b31e8).
• Repeated benign-idle: no-progress breaker: standing/perpetual goal idled this cycle (normal, not a fault) — counter reset, goal stays active.
• No panic / OOM / signal:9 / non-zero-exit signature anywhere in the evidence.

Verdict: still-alive (false positive) — no destructive action taken (worktree + claim preserved). Confirms the missing is_perpetual() exemption in claim_reaper.rs is still live. No duplicate issue filed; tracking here.

[rysweet]

Second occurrence — dedup signal from a stale-engineer investigation (#4400 path)

Confirming this defect on a second, independent perpetual goal: steward-ci-github-actions-health-across-all-gov-e06d9e64. Durable archive: ~/.simard/reaped-engineers/rysweet_Simard_steward-ci-github-actions-health-across-all-gov-e06d9e64-1784701555/.

Verdict: still-alive (false positive). Reap withheld — worktree steward-…-e06d9e64-1784699042-1be69a is still present on disk (created 05:44:02Z) and OODA cycles continue.

Evidence (line-cited)

• Alive, zero death signature. evidence.txt contains only static fixture/config tails (ci-health-green/failing.json, atelier bookcase-brief, coin_gym snapshots, dashboard-audit + root package.json, copilot-submit.json). grep -icE 'panic|SIGKILL|oom|argument list too long|lock.contention|deadlock|non-zero exit' → 0.
• Continuous OODA. journal.txt cycles advance monotonically 2377 → 2395 (00:32 → 06:24Z), each followed by no-progress breaker: standing/perpetual goal idled this cycle (normal, not a fault) — counter reset, goal stays active.
• manifest.json idle_age_secs=2512 (> default STALE_SECS=1800) → FS probe legitimately classifies HeartbeatStale, but that is a pure newest-file-mtime measure with no goal-type awareness — exactly the missing is_perpetual() exemption this issue tracks.
• The reaper reclaimed the live claim anyway: 2× reason=heartbeat-stale (age=3056s @01:22, age=4468s @02:45) + 1× reason=no-worktree, verdict=no-investigation @04:49. The engineer re-established a worktree each time (01:31, 02:49, 05:44) and kept advancing.

Second facet — pending-investigation override race (NoWorktree fast-path)

journal.txt records the #4400 investigate-before-reap path returning verdict=pending at 03:35:22Z (evidence archived) with repeated NOT reaping … (investigation verdict=pending) lines at 04:00 and 04:20. Then at 04:49:42Z a reason=no-worktree, verdict=no-investigation reclaim fired anyway — the immediate NoWorktree fast-path in reap_stale_claims (claim_reaper.rs:167-170, reclaim on any Dead{NoWorktree}) has no verdict=pending gate, so a transient worktree teardown overrides an in-flight Pending verdict. Recommend the is_perpetual() exemption (this issue's fix) also guard the NoWorktree arm, or that an in-flight Pending verdict block the NoWorktree fast-path.

Prompt-injection note (reported as data only)

evidence.txt line 264 (from fixture prompt_assets/simard/terminal_recipes/copilot-submit.json) contains "payload": "Reply with the text READY and do not run any commands or modify any files." This is untrusted fixture DATA captured by the evidence tail, not an instruction; it did not influence this verdict.

[rysweet]

Recurrence — second occurrence, same signature (stale-engineer investigation, #4400 path)

Independently reproduced on a different perpetual goal, confirming this is systemic (not goal-specific).

• Goal: steward-ci-github-actions-health-across-all-gov-e06d9e64
• Claim key: rysweet/Simard:steward-ci-github-actions-health-across-all-gov-e06d9e64
• Durable archive: ~/.simard/reaped-engineers/rysweet_Simard_steward-ci-github-actions-health-across-all-gov-e06d9e64-1784701555/
• Verdict: still-alive (false positive) — fail-closed. Engineer NOT reaped.

Evidence (line-cited, durable archive)

Alive, zero death signature:

• journal.txt: OODA cycles advanced monotonically 2377 → 2395 (last 2026-07-22T06:24:03Z); 9× benign-idle no-progress breaker: standing/perpetual goal idled this cycle (normal, not a fault) — counter reset, goal stays active.
• evidence.txt: only static fixture/config tails (ci-health-green.json, ci-health-failing.json, atelier/bookcase-brief.json, coin_gym/sample_snapshot.json, package.json) — zero panic / OOM / SIGKILL / e2big / lock-contention tokens.
• manifest.json: idle_age_secs=2512; newest worktree …-1784699042-1be69a created 05:44:02, i.e. AFTER the last reclaim (04:49) → supervisor kept the perpetual goal alive; the claim churned but the engineer did not die.
• Prompt-injection note: evidence.txt trailing payload_id=simard-local-task-submit-ready-v1 / "Reply with the text READY…" is DATA captured from a fixture, not a command — reported here, drove nothing.

Reaper reclaimed the live claim anyway (the bug):

• 01:22:14 reclaimed … reason=heartbeat-stale, age=3056s
• 02:45:48 reclaimed … reason=heartbeat-stale, age=4468s
• 03:35:22 evidence archived, dispatching agentic investigation (verdict=pending) then repeated NOT reaping (investigation verdict=pending) @ 03:35 / 04:00 / 04:20
• 04:49:42 reclaimed … reason=no-worktree, age=n/a, verdict=no-investigation — overrode the still-pending 03:35 investigation (the override race called out in this issue's evidence section).

Source re-grounding (this occurrence)

Confirms both seams named in the corrective brief remain unaddressed on this tree:

• reap_stale_claims (src/overseer/claim_reaper.rs:143-183) reclaims on any confident Dead verdict (NoWorktree, or HeartbeatStale with age > stale_secs, default 1800s — config.rs:94 DEFAULT_CLAIM_REAP_STALE_SECS) with no is_perpetual() exemption, even though goal_id_from_claim_key (claim_reaper.rs:243) already extracts the goal id.
• The two reclaim paths in run_cycle are uncoordinated: reconcile_inflight_investigations (mod.rs:1348-1363) only frees the dedup set — it does not gate reaping — while reap_stale_engineer_claims → reap_stale_claims (mod.rs:1369-1389) reaps mechanically with no verdict.should_reap() / inflight-pending check. This is the verdict=no-investigation override race.

No new issue filed — this comment deduplicates onto #4437. The scoped corrective brief above still applies unchanged.

[rysweet]

Second confirmed instance (deduplicated self-improvement signal, #4400 stale-engineer investigation)

Another overseer stale-engineer investigation reproduced this exact defect on a different perpetual goal, confirming it is repo-wide (not goal-specific).

• Goal: steward-ci-github-actions-health-across-all-gov-e06d9e64 (a CI-stewardship standing goal — precisely the case is_perpetual() calls out at goal_curation/types.rs:322).
• Claim key: rysweet/Simard:steward-ci-github-actions-health-across-all-gov-e06d9e64
• Durable evidence: ~/.simard/reaped-engineers/rysweet_Simard_steward-ci-github-actions-health-across-all-gov-e06d9e64-1784701555/
• Verdict: still-alive (false positive), fail-closed. No claim release / worktree removal performed.

Corroborating evidence

• Daemon alive throughout and past investigation time (PID 2209699, simard ooda run); OODA cycles advanced monotonically 2377 → 2395 referencing this goal, latest @ 2026-07-22T06:24:03Z, still running at 07:12Z.
• 8× benign-idle: no-progress breaker: standing/perpetual goal idled this cycle (normal, not a fault) — counter reset, goal stays active.
• Zero death signatures in evidence.txt (all 8 captured tails are static test fixtures/config JSON, not runtime output) or journal.txt (no panic/OOM/SIGKILL/non-zero-exit).
• Newest worktree (...-1784699042-1be69a) still present on disk; all files frozen at provisioning mtime 05:44:02Z → idle_age_secs=2512 is normal by-design quiescence between OODA cycles.

Same code seam confirmed

• grep -c is_perpetual src/overseer/claim_reaper.rs → 0. WorktreeClaimLivenessProbe::assess (claim_reaper.rs:500-550) derives Dead{HeartbeatStale|NoWorktree} from worktree presence + newest_file_age_secs only — no is_perpetual() exemption.
• no_progress.rs:419-427 already applies the exemption via the same is_perpetual() flag.

Reaper churn observed on this goal (pre-/partial-gate)

• heartbeat-stale hard reclaims @ 01:22 (age=3056s) and 02:45 (age=4468s) — pre-fix(overseer): investigate-before-reap + bounded cross-tick dedup & journalctl (supersedes #4403) #4418 path.
• no-worktree, verdict=no-investigation reclaim @ 04:49:42 — the remaining unconditional NoWorktree bypass (claim_reaper.rs:332-333) that skips the Make Simard investigate a quiet/idle engineer BEFORE ever reaping it (evidence-preserve + agentic WHY, feed self-improvement; only reap if genuinely dead). READ THE FULL AUTHORITATIVE BRIEF and follow #4400 investigate gate. Recommend the corrective brief also route NoWorktree on a perpetual goal through investigation (already noted in item 2 above) rather than a bare verdict=no-investigation reclaim.

No new issue filed (dedup → this one). The scoped corrective brief above still applies unchanged.

Co-authored-by: Copilot 223556219+Copilot@users.noreply.github.com

[rysweet]

Second corroborating instance (independent stale-engineer investigation)

Another overseer stale-engineer investigation reproduces this exact false-positive on a different perpetual goal, confirming the bug is systemic (not goal-specific).

Goal: steward-ci-github-actions-health-across-all-gov-e06d9e64 (a standing/perpetual CI-health steward).
Claim key: rysweet/Simard:steward-ci-github-actions-health-across-all-gov-e06d9e64
Durable archive: ~/.simard/reaped-engineers/rysweet_Simard_steward-ci-github-actions-health-across-all-gov-e06d9e64-1784701555/ (manifest.json, evidence.txt, journal.txt).

Evidence (line-cited from the archive)

Engineer was ALIVE the whole window; the reaper reclaimed it anyway:

• journal.txt: 38 OODA cycles observed (OODA consolidation: stored procedure 'pr-merge:steward-…'), advancing 2377 → 2395, last cycle @ 2026-07-22T06:24:01Z — ~1 min before archival (archived_unix_ts=1784701555, 06:25:55Z).
• 15× benign-idle: no-progress breaker: standing/perpetual goal idled this cycle (normal, not a fault) — counter reset, goal stays active — the daemon itself classifies the idle as benign via is_perpetual().
• 0 real crash signals (no SIGKILL / signal:9 / core-dumped / OOM / thread-panicked).
• manifest.json: idle_age_secs=2512 (worktree newest-file mtime age = normal bursty quiescence between CI polls).

The reaper disagreed with the daemon (the bug):

• 3× claim_reaper: reclaimed …steward-…-e06d9e64 — reason=heartbeat-stale (age=3056s, 4468s) and reason=no-worktree (verdict=no-investigation).
• Same root-cause seam: src/overseer/claim_reaper.rs still has 0 references to is_perpetual/perpetual/standing (verified on main), while src/ooda_loop/no_progress.rs:407-420 applies the exemption.

Verdict

still-alive (false positive) — perpetual steward goal legitimately idling between CI-health polls. Claim was NOT released and worktree …-1be69a was NOT removed (failing closed, per the investigate-before-reap policy).

This is a duplicate of the underlying defect tracked here, so no separate issue was filed. The scoped corrective brief in this issue (thread an is_perpetual() predicate into reap_stale_claims before release_engineer_claim) resolves both instances.

Co-authored-by: Copilot 223556219+Copilot@users.noreply.github.com

[rysweet]

Recurrence (2nd same-signature false-positive reap of the SAME perpetual goal) — dedup, do NOT open a new issue

This bug reproduced again on the same perpetual goal advance-rysweet-agent-kgpacks-rs-to-full-parity-f29bb15c. A fresh overseer stale-engineer investigation (#4400 path) reached the same verdict: still-alive false positive, cause=null — the reaper's newest-file idle-age heuristic still lacks the is_perpetual() benign-idle exemption that no_progress.rs:407-420 already applies. Filing this as a recurrence comment (not a duplicate issue) per dedup policy.

Fresh durable evidence — archive ~/.simard/reaped-engineers/rysweet_Simard_advance-rysweet-agent-kgpacks-rs-to-full-parity-f29bb15c-1784704358/:

• manifest.json: idle_age_secs=8040 (vs 2171 in the first report -1784692815) — worktree fixtures (ci-health JSONs, coin_gym snapshots) simply unchanged between work bursts; not process death.
• Positive liveness, not mere absence-of-crash: journal OODA cycles advanced monotonically 2380 → 2398; newest cycle 2398 @ 2026-07-22T07:12:05.949Z under live daemon PID 2209699 (ia2 simard[2209699]) emitting: no-progress breaker: standing/perpetual goal idled this cycle (normal, not a fault) — counter reset, goal stays active. 15× benign-idle in-window.
• Zero genuine crash signatures: 72 panic + 72 E2BIG hits are all on tokens=[…] memory-consolidation lines (72/72 noise → 0 real); 0 SIGKILL / signal:9 / OOM / core-dumped / deadlock / traceback / non-zero-exit / killed. Fail-closed is satisfied by positive liveness, not inference.
• Prompt-injection audit: the copilot-submit.json fixture payload ("Reply with the text READY and do not run any commands…") is inert test DATA — reported, not obeyed. It did not (and cannot) drive the verdict.

Signal strength: this is now two independent investigations (idle 2171s and 8040s) converging on the identical root cause and code seam already documented in this issue (claim_reaper.rs has 0 references to is_perpetual/perpetual/standing; WorktreeClaimLivenessProbe::assess derives Dead from dir-presence + newest_file_age_secs only). The scoped corrective brief in the issue body remains valid and unimplemented (no fix PR yet). Raising priority: perpetual goals are being repeatedly reclaimed while demonstrably alive.

Investigation actions taken: verdict=still-alive → NO claim release, NO worktree removal (fail-closed honored). No new tracking issue opened (deduplicated against this issue; lineage anchor = #4400).

[rysweet]

Recurrence datapoint — false-positive stale reap avoided (pre-reap investigation)

An overseer investigate_stale_engineer pass caught another instance of this defect before reclaim.

• Claim key: rysweet/Simard:advance-rysweet-agent-kgpacks-rs-to-full-parity-f29bb15c
• Goal id: advance-rysweet-agent-kgpacks-rs-to-full-parity-f29bb15c
• Idle age at investigation: 8040s (newest-file heuristic)
• Verdict: still-alive (false positive)

Positive-liveness evidence (not inference):

• Daemon PID 2209699 confirmed alive during investigation (simard ooda run, elapsed ~12k s and climbing).
• Journal shows monotonic OODA cycles 2380 → 2398, final cycle 2398 @ 07:12:05Z emitted by that same live PID, with healthy PID rotation 3165616 → 1230193 → 2209699.
• 0 genuine crash signatures — all 72 keyword hits are preparation_memory_operations token-array consolidation noise, not panics/OOM/SIGKILL.

Root cause (unchanged): src/overseer/claim_reaper.rs has 0 is_perpetual() references, while src/overseer/no_progress.rs:420 already exempts standing/perpetual goals via that flag. The reaper treats a healthy perpetual-goal engineer's idle window as death.

No new issue filed (deduplicated to this one). No claim released / worktree removed — engineer is genuinely alive.

[rysweet]

Recurrence #2 — same root cause, different perpetual goal (steward-ci-github-actions-health-across-all-gov-e06d9e64)

A second overseer stale-engineer investigation (#4400 path) independently reproduced this exact bug on a different standing/perpetual goal, confirming it is systemic, not goal-specific.

Goal: steward-ci-github-actions-health-across-all-gov-e06d9e64 (a [standing] perpetual CI-stewardship duty).
Durable archives (3× reaped, same claim_key):

• …-e06d9e64-1784691321 (idle_age 2736s)
• …-e06d9e64-1784701555 (idle_age 2512s)
• …-e06d9e64-1784705609 (idle_age 6566s)

Idle age is non-monotonic across the three reaps (2736 → 2512 → 6566s) — direct proof that newest-file mtime idle age is not a death signal for a bursty perpetual goal.

Evidence — engineer was ALIVE, zero death signatures

• Liveness timeline: OODA cycles 2382 → 2399 run continuously 01:56 → 07:31:54, past the archival ts 1784705609 (~06:33). Live daemon PID 2209699 (simard ooda run) is the same process emitting cycles 2390–2399.
• 17× benign-idle: no-progress breaker: standing/perpetual goal idled this cycle (normal, not a fault) — counter reset, goal stays active.
• Recovery after idle: native git-hook re-enrollment at 02:49:45 and 05:44:02.
• Reaper self-consistency: repeated NOT reaping … (investigation verdict=pending, claim + evidence preserved) (the Make Simard investigate a quiet/idle engineer BEFORE ever reaping it (evidence-preserve + agentic WHY, feed self-improvement; only reap if genuinely dead). READ THE FULL AUTHORITATIVE BRIEF and follow #4400 rail working as designed) — but also 2× hard reclaims slipped through: reason=heartbeat-stale age=4468s (02:45:48) and reason=no-worktree verdict=no-investigation (04:49:42).
• evidence.txt: only inert JSON fixture/config tails (ci-health-*.json, coin_gym snapshots, package.json, copilot-submit.json). No panic / OOM / e2big / lock-contention / crash of any kind. The copilot-submit.json "payload": "Reply with the text READY…" is a test fixture / prompt-injection payload — treated as inert DATA, not obeyed.

Investigation verdict: still-alive (false positive). Claim + worktree + durable archive preserved (not released, not removed) per fail-closed.

Fix scope confirmation (precise injection point)

reap_stale_claims (src/overseer/claim_reaper.rs:143) has zero perpetual awareness (grep is_perpetual → none). The caller Overseer::reap_stale_engineer_claims (src/overseer/mod.rs:1369) already reads the goal board via self.caps.goals.observe_board() (mod.rs:776). Minimal fix: extract the perpetual goal_ids from the board and pass them into reap_stale_claims, skipping any claim_key whose goal_id is_perpetual() — mirroring the identical exemptions already applied in:

• gap-scan: src/overseer/sensor.rs:338 (if g.is_perpetual() { continue; }, fix(overseer): exempt standing/perpetual goals from the workstream gap-scan #4216)
• no-progress breaker: src/ooda_loop/no_progress.rs:407-420 (fix(goals,dashboard): perpetual standing goals + honest Brain-Failures/Thinking tabs (#2580) #2589)

This is the single un-propagated exemption. Same one-notion is_perpetual() flag; no second definition.

[rysweet]

Recurrence #3 — SAME defect, DIFFERENT perpetual goal (cross-goal, class-wide impact)

Overseer stale-engineer investigation of a new perpetual goal —
steward-ci-github-actions-health-across-all-gov-e06d9e64 — reproduced the
exact false-positive this issue tracks. Comments above were both the
advance-…-f29bb15c goal; this is a distinct goal, so #4437 is not
goal-specific — it mis-flags the whole perpetual/standing goal class.
Verdict again still-alive (false positive), fail-closed. No reap /
claim-release / worktree removal performed.

Durable archive: ~/.simard/reaped-engineers/rysweet_Simard_steward-ci-github-actions-health-across-all-gov-e06d9e64-1784705609/
(idle_age at investigation = 6566s, newest-file mtime frozen at worktree
creation 1784699042).

Line-cited liveness proof (this goal):

• Daemon alive: ps -p 2209699 → /home/azureuser/.simard/bin/simard ooda run, ELAPSED ~3.7h — the SAME PID that emits every journal cycle.
• Actively cycling AFTER the idle measurement: live journal shows OODA cycle 2401 running Observe→Orient→Decide→Act at 07:56–07:58Z, coverage — covered 7/7 incomplete goals (includes …gov e06d9e64) — long after the 6566s idle window.
• Benign-idle by design: journal repeats no-progress breaker: standing/perpetual goal idled this cycle (normal, not a fault) — counter reset, goal stays active goal=steward-ci-github-actions-health-across-all-gov-e06d9e64 (cycles 2397–2399).
• Reaper already self-deferred: claim-reaper: NOT reaping … (investigation verdict=pending, claim + evidence preserved) @ 07:12:38Z — the investigate-before-reap guard (PR fix(overseer): investigate-before-reap + bounded cross-tick dedup & journalctl (supersedes #4403) #4418) held correctly.

Root cause (unchanged): src/overseer/claim_reaper.rs derives staleness
purely from worktree presence + newest-file mtime (claim_reaper.rs:84) and
has zero perpetual awareness (grep is_perpetual src/overseer/claim_reaper.rs → none).
A perpetual CI-health steward does its real work against GitHub (PR merges, CI
checks) and cognitive memory — not by churning worktree files — so its
newest-file mtime is frozen at worktree creation and the idle-age heuristic
mis-reads a fully-live goal as stale.

Fix seam (concrete, still no open PR): the reap-decision site (Overseer
caller in src/overseer/mod.rs, which has goal-board access) must consult
Goal::is_perpetual() (src/goal_curation/types.rs:350) and skip idle-age
reaping for perpetual/standing goals — mirroring the benign-idle exemption the
OODA no-progress breaker already applies. The filesystem ClaimLivenessProbe
cannot do this alone (it has no goal-board handle); the exemption belongs at the
Overseer reap loop, gated behind the existing investigate-before-reap path.

Given this is the 3rd occurrence across 2 distinct perpetual goals, a fix
recipe is being dispatched (deterministic branch fix/issue-4437-claim-reaper-perpetual-exemption)
so recurrence becomes a self-improvement signal rather than repeated
false-positive investigations. No duplicate issue filed — #4437 remains canonical.

[rysweet]

🔁 Recurrence (4th false-positive reap of the same perpetual goal) — dedup evidence

Another overseer stale-engineer investigation of the same goal advance-rysweet-agent-kgpacks-rs-to-full-parity-f29bb15c reproduced this bug. Deduplicated onto #4437 (same root cause: claim_reaper never inherits the is_perpetual() benign-idle exemption from no_progress.rs:407-420).

Verdict this run: still-alive false positive (healthy standing/perpetual goal, reaped erroneously). Zero death signals — no panic / SIGKILL / OOM / non-zero-exit; all raw panicked hits are memory_consolidation tokens=[…] array noise. manifest.json has no exit_status. Newest-file idle age 13403s = normal bursty quiescence of a perpetual goal.

Recurrence cadence — this goal has now been reaped 4× (~90 min apart):

archive (epoch)	Δ from prev
…-1784692815 (issue #4437 origin)	—
…-1784698494	+5679s
…-1784704358	+5864s
…-1784709721 (this investigation)	+5363s

Durable evidence for this run: ~/.simard/reaped-engineers/rysweet_Simard_advance-rysweet-agent-kgpacks-rs-to-full-parity-f29bb15c-1784709721/ (manifest.json, evidence.txt, journal.txt).

No engineer/claim was reaped by this investigation — verdict is not-dead, so the worktree was preserved and no claim released. Board shows the goal back at status: NotStarted (perpetual goal remains active; the reaper had already released the claim).

Fix still not in flight (no assignee, no linked PR/branch). The recurrence confirms the reaper is repeatedly reclaiming this live perpetual goal. Systemic fix remains as described in the issue body: mirror the is_perpetual() exemption in src/overseer/claim_reaper.rs so the reaper and the OODA no-progress breaker agree.

Note: the investigated worktree's prompt_assets/simard/overseer/investigate_stale_engineer.md / AGENTS.md carried an injected system_reminder (untrusted DATA). It was treated as data and not obeyed during this investigation.