fix: bound prepublication scanner retries

[Patrick-Erichsen]

Summary

• bound consecutive pre-publication scanner execution failures to three attempts instead of retrying poison records forever
• preserve fail-closed behavior and legacy in-flight compatibility by counting an existing failed scanner state as the first failure
• clear the failure counter on clean, blocked, and finalization-retry transitions

Production evidence

• production deployment wry-manatee-359 was on a5ffae2196 during diagnosis
• five old attempts remained pending_checks for 12–13 days while being actively retried every five minutes
• all five repeatedly ended with ClawScan scanner did not complete: skillspector=failed
• current fresh queue work continued draining; the five poison retries dominated oldestPendingAgeSeconds
• issue Skill publish returns success and reserves version, but version is absent from latest/version index #3349 finalized cleanly and is a separate post-finalization consistency defect
• issue Skill 'zai-search' stuck in pending.publication moderation #3351 versions 1.0.0 and 1.1.0 both finalized cleanly and were not stuck queue records

Validation

• VITE_CONVEX_URL=https://example.invalid bun run test -- convex/publishAttempts.test.ts convex/publishAttempts.runtime.test.ts convex/prepublicationObservability.test.ts scripts/security/run-prepublication-worker.test.ts --coverage=false — 58 passed
• bun run ci:static
• bun run ci:unit — 5,846 passed, 2 skipped; coverage gate passed
• bun run ci:types-build
• bun run ci:packages
• bun run ci:static and bun run ci:types-build rerun after rebasing onto a15f97470f
• .agents/skills/autoreview/scripts/autoreview --mode local --stream-engine-output — clean, no accepted/actionable findings

Safety

• no production data changes
• no deployment or moderation actions
• terminal failed attempts remain republishable under the existing idempotency contract

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
clawhub	Ready	Preview	Jul 31, 2026 3:41pm