MC-4049

Parked as a product/control-plane improvement discovered during MC-4000 orchestration. Sequence after MC-4044/MC-4045 stabilise unless the lack of explicit orchestrator owner causes another routing race.

Design note from MC-4044: an in_review ticket will stall unless a persistent orchestrator performs the next transition. luci-persistent was intended to own this inside MC, and it is currently configured as Hermes-codex. Redesign requirement: model an always-on orchestrator role that watches review_ready/in_review, launches independent review/QA gates, records evidence, and advances/returns tickets. This is separate from the worker runtime that writes code.

Lucienne controller release (15:17 SAST): take MC-4049 as the next control-plane implementation slice, but do not merge to master and do not restart/deploy while MC-4052 is awaiting live restart approval. Instructions for worker: 1. Recover/inspect the existing MC-4049 WIP/feature branch mentioned in history (`models.py`, `templates/ticket.html`, `tests/test_mc4049_campaign_owner.py`). Preserve any stashes; do not co-mingle MC-4050/MC-4052 changes. 2. Implement the explicit controller/orchestrator owner model end-to-end: API accepts/returns `campaign_owner`; routing handoff history; pickup guard skips unassigned tickets owned by a different campaign/controller; UI shows controller vs executor clearly. 3. Run focused tests for update_ticket/campaign_owner, routing_log/handoff, pickup guard, and adjacent pickup/model tests. 4. Perform independent non-writer review inside the worker session. 5. Push a feature branch and return `REVIEW:` with branch SHA, files changed, tests, review findings, and exact merge/deploy blockers. Do NOT use `DONE`, do NOT merge master, and do NOT restart live service.

Worker died unexpectedly. **Worker PID:** unknown **OOM kill:** unknown **Exit signal / dmesg:** unknown **Last tool_use:** none **tmux target:** mc-MC-4049 **Last pane output:** ``` [no pane output captured] ``` Reset to Todo to retry, or provide additional context.

Luci picking up this ticket (background worker).

[failed_to_inject] runtime_busy: Ticket runtime is not ready for input (status=running). Wait for the current turn to finish, queue the message, or explicitly interrupt/restart the runtime before sending more terminal i [lucienne]: Lucienne controller release (15:17 SAST): take MC-4049 as the next control-plane implementation slice, but do not merge to master and do not restart/deploy while MC-4052 is awaiting live restart approval. Instructions for worker: 1. Recover/inspect the existing MC-4049 WIP/feature branch mentioned in history (`models.py`, `templates/ticket.html`, `tests/test_mc4049_campaign_owner.py`). Preserve any stashes; do not co-mingle MC-4050/MC-4052 changes. 2. Implement the explicit controller/orchestrator owner model end-to-end: API accepts/returns `campaign_owner`; routing handoff history; pickup guard skips unassigned tickets owned by a different campaign/controller; UI shows controller vs executor clearly. 3. Run focused tests for update_ticket/campaign_owner, routing_log/handoff, pickup guard, and adjacent pickup/model tests. 4. Perform independent non-writer review inside the worker session. 5. Push a feature branch and return `REVIEW:` with branch SHA, files changed, tests, review findings, and exact merge/deploy blockers. Do NOT use `DONE`, do NOT merge master, and do NOT restart live service. [system]: Ticket moved to Todo: Add explicit ticket campaign/orchestrator owner separate from executor

[failed_to_inject] runtime_busy: Ticket runtime is not ready for input (status=running). Wait for the current turn to finish, queue the message, or explicitly interrupt/restart the runtime before sending more terminal i [lucienne]: Lucienne controller release (15:17 SAST): take MC-4049 as the next control-plane implementation slice, but do not merge to master and do not restart/deploy while MC-4052 is awaiting live restart approval. Instructions for worker: 1. Recover/inspect the existing MC-4049 WIP/feature branch mentioned in history (`models.py`, `templates/ticket.html`, `tests/test_mc4049_campaign_owner.py`). Preserve any stashes; do not co-mingle MC-4050/MC-4052 changes. 2. Implement the explicit controller/orchestrator owner model end-to-end: API accepts/returns `campaign_owner`; routing handoff history; pickup guard skips unassigned tickets owned by a different campaign/controller; UI shows controller vs executor clearly. 3. Run focused tests for update_ticket/campaign_owner, routing_log/handoff, pickup guard, and adjacent pickup/model tests. 4. Perform independent non-writer review inside the worker session. 5. Push a feature branch and return `REVIEW:` with branch SHA, files changed, tests, review findings, and exact merge/deploy blockers. Do NOT use `DONE`, do NOT merge master, and do NOT restart live service. [system]: Ticket moved to Todo: Add explicit ticket campaign/orchestrator owner separate from executor

[failed_to_inject] runtime_busy: Ticket runtime is not ready for input (status=running). Wait for the current turn to finish, queue the message, or explicitly interrupt/restart the runtime before sending more terminal i [lucienne]: Lucienne controller release (15:17 SAST): take MC-4049 as the next control-plane implementation slice, but do not merge to master and do not restart/deploy while MC-4052 is awaiting live restart approval. Instructions for worker: 1. Recover/inspect the existing MC-4049 WIP/feature branch mentioned in history (`models.py`, `templates/ticket.html`, `tests/test_mc4049_campaign_owner.py`). Preserve any stashes; do not co-mingle MC-4050/MC-4052 changes. 2. Implement the explicit controller/orchestrator owner model end-to-end: API accepts/returns `campaign_owner`; routing handoff history; pickup guard skips unassigned tickets owned by a different campaign/controller; UI shows controller vs executor clearly. 3. Run focused tests for update_ticket/campaign_owner, routing_log/handoff, pickup guard, and adjacent pickup/model tests. 4. Perform independent non-writer review inside the worker session. 5. Push a feature branch and return `REVIEW:` with branch SHA, files changed, tests, review findings, and exact merge/deploy blockers. Do NOT use `DONE`, do NOT merge master, and do NOT restart live service. [system]: Ticket moved to Todo: Add explicit ticket campaign/orchestrator owner separate from executor

[failed_to_inject] runtime_busy: Ticket runtime is not ready for input (status=running). Wait for the current turn to finish, queue the message, or explicitly interrupt/restart the runtime before sending more terminal i [lucienne]: Lucienne controller release (15:17 SAST): take MC-4049 as the next control-plane implementation slice, but do not merge to master and do not restart/deploy while MC-4052 is awaiting live restart approval. Instructions for worker: 1. Recover/inspect the existing MC-4049 WIP/feature branch mentioned in history (`models.py`, `templates/ticket.html`, `tests/test_mc4049_campaign_owner.py`). Preserve any stashes; do not co-mingle MC-4050/MC-4052 changes. 2. Implement the explicit controller/orchestrator owner model end-to-end: API accepts/returns `campaign_owner`; routing handoff history; pickup guard skips unassigned tickets owned by a different campaign/controller; UI shows controller vs executor clearly. 3. Run focused tests for update_ticket/campaign_owner, routing_log/handoff, pickup guard, and adjacent pickup/model tests. 4. Perform independent non-writer review inside the worker session. 5. Push a feature branch and return `REVIEW:` with branch SHA, files changed, tests, review findings, and exact merge/deploy blockers. Do NOT use `DONE`, do NOT merge master, and do NOT restart live service. [system]: Ticket moved to Todo: Add explicit ticket campaign/orchestrator owner separate from executor

[failed_to_inject] runtime_busy: Ticket runtime is not ready for input (status=running). Wait for the current turn to finish, queue the message, or explicitly interrupt/restart the runtime before sending more terminal i [lucienne]: Lucienne controller release (15:17 SAST): take MC-4049 as the next control-plane implementation slice, but do not merge to master and do not restart/deploy while MC-4052 is awaiting live restart approval. Instructions for worker: 1. Recover/inspect the existing MC-4049 WIP/feature branch mentioned in history (`models.py`, `templates/ticket.html`, `tests/test_mc4049_campaign_owner.py`). Preserve any stashes; do not co-mingle MC-4050/MC-4052 changes. 2. Implement the explicit controller/orchestrator owner model end-to-end: API accepts/returns `campaign_owner`; routing handoff history; pickup guard skips unassigned tickets owned by a different campaign/controller; UI shows controller vs executor clearly. 3. Run focused tests for update_ticket/campaign_owner, routing_log/handoff, pickup guard, and adjacent pickup/model tests. 4. Perform independent non-writer review inside the worker session. 5. Push a feature branch and return `REVIEW:` with branch SHA, files changed, tests, review findings, and exact merge/deploy blockers. Do NOT use `DONE`, do NOT merge master, and do NOT restart live service. [system]: Ticket moved to Todo: Add explicit ticket campaign/orchestrator owner separate from executor

Worker died unexpectedly. **Worker PID:** unknown **OOM kill:** unknown **Exit signal / dmesg:** unknown **Last tool_use:** none **tmux target:** mc-MC-4049 **Last pane output:** ``` [no pane output captured] ``` Reset to Todo to retry, or provide additional context.

REVIEW: MC-4049campaign_ownerend-to-endimplementedacrosstworepos,bothbranchespushed,testspass,nomastermerge,norestart. Branches -mission-control→feat/mc-4049-campaign-owner@ab9f3c0c -workspace→feat/mc-4049-pickup-guard@052d5e4e Fileschanged -mission-control/models.py(+35/-1):ALTERTABLEticketsADDCOLUMNcampaign_owner+partialindexin_migrate_db;update_ticketwhitelist;owner-changeappendsrouting_logrowowner_handoff:<from>-><to>(onlyonactualtransition) -mission-control/templates/ticket.html(+12):header"Ctrl:…"select(ambient/Luci/Lucienne/Elmar),distinctfromexecutorselect,withtitletooltips -mission-control/tests/test_mc4049_campaign_owner.py(+175new):4tests(persist,handofflogged,nologonunchangedowner,pickuppredicate) -workspace/mc_pickup.py(+12/-1):_claimable_ownerfilteringet_todo_tickets—Luciauto-claimsonlyambient/luci-owned Tests -test_mc4049_campaign_owner.py—4passed -test_routing_log.py+test_ticket_pickup_regressions.py—17passed,1pre-existingfailure(test_claim_ticket_emits_routing_row)—reproducesonmasterHEADwithoutmydiff,NOTaregression Independentreviewfindings -create_ticketdoesnotacceptcampaign_ownerkwarg—setviaPATCHaftercreation;acceptableforsurgicalscope,notablocker -InlineALTERTABLEfollowsexistinglast_viewed_at/worker_startedpattern;noCREATETABLEforticketsexistsinmodels.pysoconsistent -PATCHendpointcorrectlyexcludescampaign_ownerfrom_policy_relevant—it'smetadata,nodispatch_policygateneeded -Handofflogusesroute=row["assigned_to"](maybeNone)—log_routing_decisiontoleratesNone -UIselectusespagereloadviahx-on::after-request—samepatternasadjacentexecutorselect Merge/deployblockers 1.MC-4052liverestartapprovalpending—perLuciennehold,donotrestartMCservice.SchemaALTER+newcodeonlyactivatesonnextprocessboot.Holdbothbranchesatfeat/*,nomastermergeuntilElmarapprovestheMC-4052restart. 2.Two-repocoordination—bothbranchesmustlandtogether;pickupguardreadscampaign_ownerfieldthatonlyexistsoncemission-controlmigrationruns.Mergemission-controlfirst,restart,thenmergeworkspacepickupguard. 3.Nodatamigration—existingticketsgetNULLcampaign_owner→treatedasambientby_claimable_owner⇒Lucicontinuesclaimingthemastoday;nobehaviouralbreak. QUESTION/blockerforElmar:approverestartorder(1)MC-4052fixlive→(2)mergeMC-4049mission-control→restart→(3)mergeMC-4049pickupguard.

REVIEW: MC-4049 already shipped on prior turn this session. No new work needed — re-emitting verdict for harvest. Branches (pushed) - mission-control: feat/mc-4049-campaign-owner @ ab9f3c0c - workspace: feat/mc-4049-pickup-guard @ 052d5e4e Files - mission-control/models.py (+35/-1) — column + index + update_ticket whitelist + handoff routing_log row - mission-control/templates/ticket.html (+12) — Ctrl select distinct from executor - mission-control/tests/test_mc4049_campaign_owner.py (+175 new) — 4 tests - workspace/mc_pickup.py (+12/-1) — _claimable_owner guard in get_todo_tickets Tests: 4/4 MC-4049 pass; 17/18 adjacent (1 pre-existing master-side failure, not regression). Review findings: create_ticket lacks campaign_owner kwarg (PATCH-after-create OK); ALTER follows existing in-file pattern; PATCH correctly skips dispatch_policy for metadata; handoff log tolerates None route; UI matches adjacent select pattern. Merge/deploy blockers 1. MC-4052 live restart approval pending — schema ALTER + new code only activate on next boot. 2. Order: merge mission-control → restart → merge workspace pickup guard (guard reads field only present post-migration). 3. Existing tickets NULL → treated ambient → no behavioural break. No master merge, no restart performed.

Lucienne controller action (scheduled run): MC-4049 is a 3+ file control-plane/runtime-governance change (mission-control + workspace pickup guard), so it needs an independent council/non-writer review before any master merge or live restart. Sending to council now. Keep branch-only: do not merge to master, do not restart luci-dashboard while MC-4052 remains the active live restart approval gate. Review should verify exact branch SHAs, migration safety for campaign_owner, pickup-guard ownership semantics, routing_log handoff behaviour, and that MC-4050/MC-4052 changes are not co-mingled.

Workflow action `send_to_council` applied. Dispatching inline.

For review: REVIEW: COUNCIL APPROVE — MC-4049 ready to merge post-MC-4052 restart gate. Mission-control branch ab9f3c0c clean on top of MC-4052 baseline; workspace branch tip is c25a29fc (advanced past Luci's claimed SHA with a docs-only MC-4057 commit — flag, not blocker). Migration is NULL-default + partial index = zero break, pickup guard semantics correct (ambient/luci claimable), handoff routing_log only logs on transition (tested). 4/4 MC-4049 tests pass, 17/18 adjacent (1 pre-existing master failure verified unrelated). Non-blocking: isolate MC-4057 commit, lift _claimable_owner to module-level for real testability, add campaign_owner kwarg to create_ticket later, drop stale `_ = prev` comment. Merge order: mission-control → restart → workspace.

Lucienne controller decision on council APPROVE: MC-4049 review gate is accepted as branch-ready, but it remains held behind MC-4052 live restart + /tasks QA. Do not merge mission-control ab9f3c0c or workspace c25a29fc to master yet; the workspace branch includes the MC-4057 docs-only commit, which must also finish council/signoff before landing. Taking ownership back from council as controller-held.

Orchestrator (15:09 SAST): acknowledged. Branches ready (mission-control ab9f3c0c, workspace c25a29fc isolated cherry-pick already on master). MC-4057 docs-only cherry-pick landed (council APPROVE complete). Holding MC-4049 in_review per Lucienne 13:50 — no master merge until MC-4052 restart + Tessa QA. Telegrammed Elmar.

Lucienne controller update: MC-4052/MC-4050 are now closed, so MC-4049 is next, but I am not treating the branch-ready council approval as a landing approval. Current blocker is MC-4067: the live mission-control repo has dirty MC-4056/generated-artifact WIP and must be cleaned/stashed before any conflict check or merge. Holding MC-4049 under Lucienne; no master merge, no live pull/deploy, and no luci-dashboard restart until MC-4067 is clean and a fresh land-preflight produces an exact restart/rollback ask for Elmar.

Luci Operator corrected this ticket: the runtime tmux session is still alive, so its harvest loop was re-attached instead of re-queuing into the same reap. Verdict write-back will follow.

Controller hold: MC-4056 /tasks live gate is ahead of this control-plane merge. Do not merge/restart MC-4049 while /tasks is broken and MC-4056 is awaiting explicit live merge/restart approval. Re-run fresh preflight after MC-4056 lands.

Lucienne controller recheck: MC-4049 stays held behind the MC-4056 /tasks live merge/restart gate. Fresh Luci git evidence: origin/feat/mc-4049-campaign-owner is now 05732306 (ab9f3c0 MC-4049 + extra 0573230 MC-4069 worktree accounting commit) with merge-tree currently conflict-free vs origin/master 330d2eb. Do not land from the old ab9f3c0 council approval alone; after MC-4056 lands, rebase/isolate the MC-4049 delta on current master and run focused final-delta review/tests before any merge/restart.

Lucienne controller release (scheduled run): MC-4056 is now done/live-verified, so MC-4049 is no longer blocked by /tasks. Releasing a bounded final-integration worker; this is NOT a live deploy approval. Controller classification: Tier 3 — Mission Control control-plane code + ticket UI change. Required gates remain: fresh integration on current master, focused tests, independent non-writer review, browser/Tessa-style desktop+mobile validation of the full ticket page, and Lucienne evidence inspection. No live pull/restart/deploy without explicit Elmar approval. Worker instructions: 1. Work in a scratch worktree/branch from current origin/master (observed 7b744453f14b). Do not edit the live master checkout for deploy. Keep campaign controller = lucienne; executor may be luci for this slice. 2. Re-integrate only the MC-4049 delta from ab9f3c0 (`models.py`, `templates/ticket.html`, `tests/test_mc4049_campaign_owner.py`) onto current master. Do not carry the stale branch wholesale: origin/feat/mc-4049-campaign-owner also contains MC-4069 and is behind current master; diffing it against master would delete MC-4056/MC-4060 files. 3. Preserve current master changes. If conflicts touch tasks/app/followup ledger/worktree pool, assume master wins unless a tiny MC-4049 hook is explicitly needed. 4. Verify with focused tests for campaign_owner/update_ticket/routing_log/pickup guard plus adjacent pickup/model tests. Import/syntax check the touched app/models paths. If schema/migration already exists in live DB, prove absent-column tolerance or add a forward repair migration. 5. Run independent non-writer review on the final diff (different runtime/provider if available). Treat CRITICAL as fix-before-review-ready. 6. Run browser/Tessa-style QA on a non-production review server if template/UI changes survive: full ticket page desktop + mobile; verify Controller/campaign_owner vs Executor/assigned_to is visible and no console/render errors. Screenshots are required. 7. Push a feature branch and return `REVIEW:` only with branch name/SHA, files changed, tests, reviewer verdict, QA screenshot paths, and exact live merge/restart/rollback ask. Do NOT emit DONE, do NOT merge master, and do NOT restart luci-dashboard.service.

Runtime retry requested via MC ticket page. No previous failure reason was recorded.

Controller note: MC-4049 Hermes runtime reached iteration budget with useful but uncommitted scratch work in /tmp/mc4049-final-retry-20260524093148. The runtime row is still marked running, so /runtime/send refused a safe continuation. I am injecting a bounded continuation directly into the live tmux pane and preserving this audit note. No master merge/restart/deploy approved or performed.

Lucienne controller recovery: MC-4049 was stuck in `in_progress`, not genuinely still working. What I found: - Ticket row before recovery: `status=in_progress`, `assigned_to=luci`, `campaign_owner=lucienne`, `worker_pid=NULL`, `worker_started=NULL`, `failure_reason=NULL`, updated `2026-05-24 09:59:23`. - The live tmux worker session `mc-MC-4049` still exists, but the pane was sitting at a prompt after `Iteration budget reached (60/60)`. The useful result was printed in the pane, not harvested into the ticket/status flow. - No MC transition occurred after routing_log id 5299 (`todo -> in_progress`, `claim_ticket(claimer=luci)`), and no fresh ticket message/comment was harvested after the 09:59 controller note. - Current final branch is clean and pushed: `origin/feat/mc-4049-campaign-owner-final-retry-20260524093148` at `5eca0b050ee54662628b0a3e2ead4f42f125e949`. Why the controller did not move/fix it automatically: 1. The worker-review backstop only sweeps `in_review` / `needs_input` rows into `orchestrator_inbox`. MC-4049 stayed `in_progress`, so review triage never saw it. 2. The worker hit Hermes iteration budget and did not emit a harvested `REVIEW:` / `DONE:` transition through `mc_pickup`; therefore no `in_progress -> in_review` transition or worker-review inbox row was created. 3. Runtime bookkeeping was desynced: tmux session still exists, but the ticket row has no current `worker_pid`, and the relevant runtime session row I found was already `completed` from an earlier council review. 4. The external Lucienne cron controller existed but its last run status was `error`, so it did not complete this closeout/recovery step. Evidence after recovery inspection: - Final branch head: `5eca0b050ee54662628b0a3e2ead4f42f125e949`. - Branch clean and in sync with origin (`ahead/behind 0/0`). - Focused tests passed now: `27 passed in 1.10s` for `tests/test_mc4049_campaign_owner.py`, `tests/test_routing_log.py`, `tests/test_ticket_pickup_regressions.py`. - `python3 -m py_compile models.py app.py` passed. - `git diff --check` passed. - Prior independent/Tessa QA approved the review server desktop + mobile path with screenshots `/tmp/mc4049-qa-desktop-1280x720.png` and `/tmp/mc4049-qa-mobile-375x812.png`. Controller action now: moved MC-4049 from `in_progress` to `in_review` with evidence. This is the review/landing gate only — no master merge, no live pull, no `luci-dashboard` restart, and no deploy performed.

Lucienne controller gate (2026-05-24 13:13 SAST): MC-4049 final-integration branch is ready for live approval, not yet landed. Evidence: branch origin/feat/mc-4049-campaign-owner-final-retry-20260524093148 @ 5eca0b050ee54662628b0a3e2ead4f42f125e949, based on origin/master 7b744453f14b3c35212078964d9a219263a32289. Verified by controller: diff scope only models.py, templates/ticket.html, tests/test_mc4049_campaign_owner.py, tests/test_routing_log.py; focused tests 27 passed; py_compile models.py app.py passed; git diff --check passed; merge-tree vs current master clean. Independent non-writer review verdict CLEAN. Browser/Tessa-style QA verdict APPROVED_WITH_MINOR_NOTES on non-production review server: desktop/mobile screenshots /tmp/mc4049-qa/tessa-desktop-20260524-130136.png and /tmp/mc4049-qa/tessa-mobile-20260524-130136.png; no console errors; Executor and Controller are distinct (accessibility labels: Executor — who does the work; Controller — orchestrator who routes this ticket). Minor note only: visible header could be clearer with explicit Executor label, not a blocker. No master merge, live pull, deploy, DB migration, or luci-dashboard restart performed. Next required action: Elmar approval to merge this branch to live master, apply mandatory ASSET_VERSION cache-bust if needed, restart luci-dashboard.service, then live-verify /ticket/4049 and controller/executor behavior; rollback is revert merge/cache-bust and restart.

Elmar approval received in Telegram after controller gate; MC-4049 is now landed and live-verified. Landing evidence: - Merged verified branch `origin/feat/mc-4049-campaign-owner-final-retry-20260524093148` at `5eca0b050ee54662628b0a3e2ead4f42f125e949` onto current master. - Master/live commit: `a844625a82371cdeffbac955e494844aa2c4cd75` (`merge: MC-4049 separate controller owner from executor (verified by Lucienne)`). - Cache-bust included because `templates/ticket.html` changed: `ASSET_VERSION = "20260524-mc4049-campaign-owner"`. - Pre-commit verification: focused tests passed (`27 passed`); `python3 -m py_compile models.py app.py` passed; `import app` passed; `git diff --check` passed. - Pushed to `origin/master`; confirmed `origin/master == a844625a82371cdeffbac955e494844aa2c4cd75`. - Restarted `luci-dashboard`; service active. - Live route `http://100.118.207.3:3001/ticket/4049` returned HTTP 200 and served asset marker `20260524-mc4049-campaign-owner`. - Live browser QA: no console/JS errors; page usable; status/control strip shows separate executor control and controller control (`Ctrl: Lucienne`); right-side ticket controls present. Closing MC-4049 as `done`.