fix(pipeline): parked pipelines stamped completed_at + spawned steps out of order

[bborn]

What & why

A pipeline created and left in backlog (never executed) misbehaved two ways: every step showed up marked as if completed, and downstream steps spawned real Claude executors — in the main checkout, out of DAG order — despite their [Plan] blocker never running. Root-caused both defects.

Defect A — zombie completed_at (confirmed root cause)

UpdateTaskStatus stamped completed_at = CURRENT_TIMESTAMP for every blocked transition, not just done/archived. Pipeline creation flips each non-root step to blocked (pipeline.go), so all of them were stamped completed_at = created_at — looking finished on the board and feeding false "done" signals to the workflow sweeps that key off completed_at.

blocked covers two cases: a step waiting in a DAG (never started) and a task that ran and is now parked awaiting review. Only the latter has completed a turn. Fix: only stamp completed_at on a blocked transition when started_at != nil. Preserves the board's order-by-completed_at for genuinely-parked blocked tasks.

Defect B — premature spawn (defense-in-depth)

A step ran while its blocker was provably incomplete — a DAG-invariant violation. Every static path (GetQueuedTasks, GetOpenBlockerCount, the sweeps) is individually correct, so this is a race, not a static logic bug; the daemon's stderr wasn't persisted so the exact trigger couldn't be pinned post-hoc.

Rather than guess, this adds a spawn-gate invariant as the last line of defense: processNextTask runs every queued task through admitQueuedTask, which refuses any task with open blockers, reverts it to blocked, and logs loudly. The safety-net sweep re-queues it in order once the blocker really finishes — and the log line captures the anomaly if the underlying race recurs.

Tests

• TestUpdateTaskStatusBlockedTimestamps — DAG-waiting step leaves completed_at nil; review-parked (started) step sets it.
• Updated TestUpdateTaskStatus — a never-started blocked task no longer expects completed_at.
• TestAdmitQueuedTaskRefusesOpenBlocker / TestAdmitQueuedTaskAllowsReadyTask — spawn gate refuses open-blocker tasks, admits ready ones.

Full suite green (18 packages), clean build.

Caveats

• Defect B fix is defense-in-depth, not a root-cause fix for the race. If "Refused to start: N blocker(s) not yet complete" ever appears in a task log, that's the breadcrumb to the real trigger.
• Verification is unit-level at the exact processNextTask seam, not a live end-to-end daemon run.

🤖 Generated with Claude Code