Publish work the executor committed itself, and gate when there is none

On the first live run the executor committed its milestone itself, as
its plan asked. The publisher only published a commit it made, found a
clean tree, reported "no changes to publish", and left the agent in
EXECUTING, where every message is answered "busy".

- publish(): with nothing left to commit, publish anyway when the branch
  has commits origin/<base> lacks; report no changes only when it has
  none.
- push_followup(): same for review fixes, comparing HEAD with what the
  remote branch holds (ls-remote; pushes go by URL, so there is no
  tracking ref).
- Nothing to publish now gates to AWAIT_INPUT, and the reply returns to
  the still-approved milestone plan.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPQ14L3LikyefCMFBqEbKE

nisse-dev/src/nisse_dev/control.py

@@ -743,7 +743,16 @@ class Orchestrator:
             )
             return
         if result.pull_request is None:
-            self._transport.send_message(result.note)
+            # Nothing left EXECUTING behind: the operator decides what next,
+            # and answering returns to the still-approved plan.
+            self._await_input(
+                cause=f"milestone {milestone}: {result.note}",
+                prompt=(
+                    f"milestone {milestone}: {result.note}. Reply to return to "
+                    "the approved plan."
+                ),
+                pending={"kind": "milestone_stopped", "milestone": milestone},
+            )
             return
         self._data["pr"] = {
             "number": result.pull_request.number,

nisse-dev/src/nisse_dev/git.py

@@ -53,6 +53,19 @@ class GitRepo:
     def has_changes(self) -> bool:
         return bool(self._run("status", "--porcelain"))
 
+    def commits_since(self, ref: str) -> int:
+        """How many commits HEAD has that ref lacks. The executor may commit
+        its own work, so a clean tree does not mean nothing to publish."""
+        return int(self._run("rev-list", "--count", f"{ref}..HEAD"))
+
+    def remote_sha(
+        self, remote_url: str, branch: str, *, token: str | None = None
+    ) -> str | None:
+        """What the remote's branch points at, or None if it has no such
+        branch. Pushes go by URL, so there is no tracking ref to read."""
+        out = self._run("ls-remote", remote_url, f"refs/heads/{branch}", secret=token)
+        return out.split()[0] if out else None
+
     # -- mutation ---------------------------------------------------------
 
     def init(self, *, default_branch: str = "main") -> None:

nisse-dev/src/nisse_dev/publish.py

@@ -71,9 +71,12 @@ class MilestonePublisher:
             self._git.checkout_new_branch(branch)
         sha = self._git.commit_all(f"Milestone {milestone}: {project}")
         if sha is None:
-            # Not an error: the executor may have concluded there was nothing
-            # to change. Report it and let the operator decide.
-            return PublishResult(None, "no changes to publish")
+            if self._git.commits_since(f"origin/{self._base_branch}") == 0:
+                # Not an error: the executor may have concluded there was
+                # nothing to change. Report it and let the operator decide.
+                return PublishResult(None, "no changes to publish")
+            # The executor committed its work itself; publish that.
+            sha = self._git.head_sha()
 
         intent_id = self._store.begin_intent(
             OPEN_PR_INTENT,
@@ -113,7 +116,11 @@ class MilestonePublisher:
             self._git.checkout_new_branch(branch)
         sha = self._git.commit_all(message)
         if sha is None:
-            return None
+            # The executor may have committed the fix itself.
+            sha = self._git.head_sha()
+            pushed = self._git.remote_sha(self._remote, branch, token=self._token)
+            if sha == pushed:
+                return None
         self._git.push(self._remote, branch, token=self._token)
         return sha