harnex 0.12.0 → 0.29.0

data/lib/harnex/runtime/session.rb

@@ -39,10 +39,28 @@ module Harnex
     RELIABILITY_FIELDS = %w[
       adapter_close real_disconnections stream_interruptions stalls force_resumes compactions recovered
     ].freeze
-    SUCCESSFUL_TURN_STATUSES = %w[completed success succeeded].freeze
     PROOF_REJECTION_CLASSES = %w[
       completed_no_activity report_missing report_invalid report_rejected
     ].freeze
+    # Closed dispatch-row `outcome.class` vocabulary (#57). Proof classes come
+    # from completion assessment; process classes refine an otherwise unknown
+    # or failed terminal from signals Harnex already holds (exit path, stop
+    # provenance, final input state), never from transcript text.
+    PROCESS_OUTCOME_CLASSES = %w[
+      boot_failure permission_prompt timeout stopped_by_caller process_failed
+    ].freeze
+    # provider_capacity (#82): the turn failed after the provider adapter's
+    # own retries ran out (Pi `auto_retry_end success:false`): capacity or
+    # rate limits, not the work. Structured signal only, never text.
+    OUTCOME_CLASSES = (
+      %w[completed_with_proof completed_with_activity] + PROOF_REJECTION_CLASSES +
+      %w[task_failed provider_capacity] + PROCESS_OUTCOME_CLASSES + %w[unknown]
+    ).freeze
+    # Pi tools whose structured results carry an integer exit code.
+    PI_COMMAND_TOOLS = %w[bash].freeze
+    MAX_PENDING_PI_COMMANDS = 256
+    # Inline cap for a turn's final reply; the full text is in its file.
+    FINAL_MESSAGE_LIMIT = 4000
     class EventCounters
       def initialize
         @counts = {
@@ -95,8 +113,15 @@ module Harnex
                 :output_log_path, :events_log_path, :started_at, :ended_at, :exit_code, :term_signal,
                 :require_artifact_report
 
-    def initialize(adapter:, command:, repo_root:, host:, port: nil, id: DEFAULT_ID, watch: nil, description: nil, meta: nil, artifact_report_path: nil, require_artifact_report: false, inbox_ttl: Inbox::DEFAULT_TTL, auto_stop: false, on_done: nil, launch_cwd: nil, child_cwd: nil, completion_notifier: nil)
+    def initialize(adapter:, command:, repo_root:, host:, port: nil, id: DEFAULT_ID, watch: nil, description: nil, meta: nil, artifact_report_path: nil, require_artifact_report: false, inbox_ttl: Inbox::DEFAULT_TTL, auto_stop: false, on_done: nil, launch_cwd: nil, child_cwd: nil, completion_notifier: nil, max_runtime_s: nil)
       @adapter = adapter
+      @activity = ActivityTracker.new(transport: adapter.transport)
+      @runtime_budget = RuntimeBudget.new(seconds: max_runtime_s) unless max_runtime_s.nil?
+      @runtime_child_ready = false
+      @runtime_enforcement_started = false
+      @runtime_expiry_recorded = false
+      @runtime_enforced_at = nil
+      @stop_request = nil
       @command = command
       @repo_root = repo_root
       @launch_cwd = File.expand_path(launch_cwd.to_s.empty? ? repo_root : launch_cwd)
@@ -133,6 +158,7 @@ module Harnex
       @events_mutex = Mutex.new
       @stop_mutex = Mutex.new
       @auto_stop_mutex = Mutex.new
+      @runtime_mutex = Mutex.new
       @injected_count = 0
       @last_injected_at = nil
       @started_at = Time.now
@@ -141,12 +167,17 @@ module Harnex
       @completion_notification_registered = false
       @completion_notification_sent = false
       @pending_completion_notification = nil
+      @completion_turn = 1
+      @turn_follow_ups_sent = 0
+      @pi_follow_up_pending = 0
+      @turn_final_text = nil
       @completion_notifier = completion_notifier || CompletionNotifier.new(
         repo_root: repo_root,
         id: @id,
         session_id: @session_id,
         receipt_path: @artifact_report_path,
         hook_command: on_done,
+        owner_id: @meta.is_a?(Hash) ? @meta["orchestration_session_id"] : nil,
         started_at: @started_at,
         event_sink: ->(type, payload) { emit_event(type, **payload) }
       )
@@ -158,6 +189,13 @@ module Harnex
       @event_counters = EventCounters.new
       @observed_commands_mutex = Mutex.new
       @observed_commands = []
+      @pi_pending_commands = {}
+      @pi_unobserved_commands = 0
+      # Final gates and the failure flag cover the whole command history; the
+      # retained @observed_commands window is capped at MAX_COMMANDS (#68).
+      @final_gates = Harnex::ArtifactReport.normalize_final_gates(meta.is_a?(Hash) ? meta["final_gates"] : nil)
+      @final_gate_exits = {}
+      @commands_had_failures = false
       @artifact_claims = {}
       @artifact_claims_loaded = false
       @artifact_report_generated = false
@@ -166,7 +204,6 @@ module Harnex
       @git_end = {}
       @usage_summary = {}
       @context_summary = {}
-      @rpc_context_telemetry = nil
       @ended_at = nil
       @exit_reason = nil
       @last_error = nil
@@ -183,6 +220,9 @@ module Harnex
       @pi_last_assistant_stop_reason = nil
       @pi_last_assistant_error = nil
       @pi_last_retry_error = nil
+      @pi_awaiting_run_start = false
+      @pi_idle_stop = false
+      @pi_transport_failed = false
       @auto_stop = !!auto_stop
       @auto_stop_fired = false
       @auto_stop_seen_busy = false
@@ -195,7 +235,6 @@ module Harnex
       @output_buffer.force_encoding(Encoding::BINARY)
       @state_machine = SessionState.new(adapter)
       @inbox = Inbox.new(self, @state_machine, ttl: inbox_ttl)
-      @rate_limits = nil
       @parent_harnex_id = ENV["HARNEX_ID"].to_s.strip
       @parent_harnex_id = nil if @parent_harnex_id.empty?
     end
@@ -224,10 +263,13 @@ module Harnex
       prune_retained_logs
       prepare_output_log
       prepare_events_log
+      start_runtime_budget!
 
       return run_structured if structured_transport?
 
       run_pty
+    ensure
+      @runtime_budget&.cancel
     end
 
     def run_pty
@@ -235,6 +277,8 @@ module Harnex
       spawn_args << { chdir: child_cwd } if child_cwd
       @reader, @writer, @pid = PTY.spawn(*spawn_args)
       @writer.sync = true
+      capture_pty_process_group!
+      runtime_child_started!
       arm_auto_stop_after_initial_context
       emit_started_event
       emit_git_start_event
@@ -243,8 +287,8 @@ module Harnex
       sync_window_size
       @server = ApiServer.new(self)
       @server.start
-      persist_registry
       register_completion_notifier!
+      persist_registry
       append_dispatch_start_record
 
       stdin_state = STDIN.tty? ? STDIN.raw! : nil
@@ -257,10 +301,14 @@ module Harnex
       @term_signal = status.signaled? ? status.termsig : nil
       @exit_code = status.exited? ? status.exitstatus : 128 + status.termsig
       @ended_at = Time.now
+      @runtime_budget&.cancel
+      emit_event("process_exited", code: @exit_code, signal: @term_signal) if @runtime_budget
+      stop_for_runtime_budget! if runtime_budget_stop?
 
       enforce_required_artifact_report!
       normalize_work_acceptance_exit_code!
       normalize_auto_stop_exit_code!
+      normalize_runtime_exit_code!
       drain_auto_stop_threads
       output_thread.join(1)
       finalize_session!
@@ -298,9 +346,15 @@ module Harnex
         output_log_path: output_log_path,
         events_log_path: events_log_path,
         artifact_report_path: artifact_report_path,
-        artifact_claims_path: artifact_claims_path
+        artifact_claims_path: artifact_claims_path,
+        auto_stop: @auto_stop
       }
       payload.merge!(log_activity_snapshot)
+      payload[:activity] = @activity.snapshot
+      running = pi_running_commands
+      payload[:running_commands] = running unless running.empty?
+      payload[:stop] = @stop_request&.to_h
+      payload[:runtime_budget] = runtime_budget_snapshot
       payload[:description] = description if description
 
       if watch
@@ -374,14 +428,24 @@ module Harnex
       inject_sequence([{ text: text, newline: newline }])
     end
 
-    def inject_stop(turn_id: nil, interrupt: true)
+    def inject_stop(turn_id: nil, interrupt: true, reason: "manual", origin: "api")
+      StopRequest.validate!(reason: reason, origin: origin)
       unless structured_transport?
         raise "session is not running" unless pid && Harnex.alive_pid?(pid)
       end
 
-      return { ok: true, signal: "already_requested" } if stop_requested!
+      return { ok: true, signal: "already_requested" } if stop_requested!(reason: reason, origin: origin)
+
+      if runtime_budget_stop?
+        @state_machine.force_busy!
+        signal_rpc_done! unless @pid
+        return { ok: true, signal: "terminate_sent" }
+      end
 
       if structured_transport?
+        # There is nothing to abort after Pi's accepted settlement. In
+        # particular, do not race an abort RPC/write against the TERM below.
+        interrupt = false if adapter.transport == :stdio_jsonl_rpc && @pi_idle_stop
         if adapter.respond_to?(:terminate_subprocess)
           Thread.new do
             begin
@@ -416,11 +480,13 @@ module Harnex
       { ok: true, signal: "exit_sequence_sent" }
     end
 
-    def inject_via_adapter(text:, submit:, enter_only:, force: false)
+    def inject_via_adapter(text:, submit:, enter_only:, force: false, follow_up: false)
       if structured_transport?
-        return inject_via_structured(text: text, submit: submit, enter_only: enter_only, force: force)
+        return inject_via_structured(text: text, submit: submit, enter_only: enter_only, force: force,
+                                     follow_up: follow_up)
       end
 
+      after_seq = current_event_seq
       snapshot = adapter.wait_for_sendable(method(:screen_snapshot), submit: submit, enter_only: enter_only, force: force)
       payload = adapter.build_send_payload(
         text: text,
@@ -440,38 +506,85 @@ module Harnex
       result.merge(
         cli: adapter.key,
         input_state: payload[:input_state],
-        force: payload[:force]
+        force: payload[:force],
+        after_seq: after_seq
       )
         .tap { emit_send_event(text, force: payload[:force]) }
     end
 
-    def inject_via_structured(text:, submit:, enter_only:, force: false)
-      payload = adapter.build_send_payload(
-        text: text,
-        submit: submit,
-        enter_only: enter_only,
-        screen_text: nil,
-        force: force
-      )
+    # #79: a structured adapter that can queue a message into the running turn
+    # (Pi's followUp) takes it at once instead of waiting in the inbox TTL.
+    def accepts_follow_up?
+      structured_transport? && adapter.respond_to?(:follow_up_supported?) && adapter.follow_up_supported? &&
+        @state_machine.state == :busy && !@stop_requested && !@session_finalized
+    end
+
+    # The newest events-log seq. Terminal events of a turn injected after this
+    # point always carry a larger seq (`wait --after-seq`, #81).
+    def current_event_seq
+      @events_mutex.synchronize { @events_log_seq }
+    end
+
+    def inject_via_structured(text:, submit:, enter_only:, force: false, follow_up: false)
+      if @runtime_budget&.expired?
+        stop_for_runtime_budget!
+        raise ArgumentError, "session runtime budget is exhausted"
+      end
+      payload_options = { text: text, submit: submit, enter_only: enter_only, screen_text: nil, force: force }
+      payload_options[:follow_up] = true if follow_up
+      payload = adapter.build_send_payload(**payload_options)
       dispatch = payload.fetch(:dispatch).dup
       dispatch[:model] = meta_hash["model"] if meta_hash["model"] && !dispatch.key?(:model)
       dispatch[:effort] = meta_hash["effort"] if meta_hash["effort"] && !dispatch.key?(:effort)
+      queued_into_run = dispatch[:streaming_behavior] == "followUp"
+      dispatch_options = dispatch
 
       turn_id = nil
+      after_seq = nil
       @inject_mutex.synchronize do
+        @completion_transition_lock.synchronize do
+          raise "session is stopping or disconnected" if @stop_requested || @session_finalized || @pi_transport_failed
+
+          after_seq = current_event_seq
+          # The inbox checked "busy" without this lock; a run that settled
+          # since then is done, so this is a new prompt, not a follow-up.
+          if queued_into_run && @state_machine.state != :busy
+            queued_into_run = false
+            dispatch_options = dispatch.reject { |key, _| key == :streaming_behavior }
+          end
+          # Count the follow-up for the turn it joins before releasing the
+          # lock, so a settlement during the RPC cannot misattribute it.
+          @turn_follow_ups_sent += 1 if queued_into_run
+          # A follow-up joins the running turn: Pi delivers it before
+          # agent_settled, so that settlement already covers it and nothing
+          # is reset here. If Pi has in fact gone idle it starts a new run,
+          # whose agent_start begins the next turn.
+          unless queued_into_run
+            # Reserve work before the blocking RPC. Steering an active run does
+            # not reset its clocks, but a new prompt cannot reuse old proof.
+            @activity.start_turn
+            begin_pi_run!
+            @pi_awaiting_run_start = true
+          end
+        end
         begin
-          turn_id = adapter.dispatch(**dispatch)
+          turn_id = adapter.dispatch(**dispatch_options)
         rescue StandardError => e
-          mark_task_failed(status: "dispatch_error", error: e.message)
+          @completion_transition_lock.synchronize do
+            mark_task_failed(status: "dispatch_error", error: e.message) unless @session_finalized || @stop_requested
+          end
           raise
         end
-        @state_machine.force_busy!
-        @injected_count += 1
-        @last_injected_at = Time.now
-        refresh_registry
+        @completion_transition_lock.synchronize do
+          unless @session_finalized
+            @injected_count += 1
+            @last_injected_at = Time.now
+            refresh_registry
+          end
+        end
       end
 
-      emit_send_event(dispatch.fetch(:prompt, text), force: payload[:force])
+      emit_send_event(dispatch_options.fetch(:prompt, text), force: payload[:force])
       {
         ok: true,
         cli: adapter.key,
@@ -480,7 +593,9 @@ module Harnex
         newline: false,
         input_state: payload[:input_state],
         force: payload[:force],
-        turn_id: turn_id
+        turn_id: turn_id,
+        after_seq: after_seq,
+        delivery: queued_into_run ? "follow_up" : "prompt"
       }
     end
 
@@ -508,29 +623,43 @@ module Harnex
     end
 
     def structured_transport?
-      %i[stdio_jsonrpc stdio_jsonl_rpc].include?(adapter.transport)
+      adapter.transport == :stdio_jsonl_rpc
     end
 
     def run_structured
       adapter.on_notification { |msg| handle_structured_notification(msg) }
       adapter.on_disconnect { |err| handle_structured_disconnect(err) }
+      if adapter.respond_to?(:on_spawn)
+        adapter.on_spawn do |child_pid|
+          @pid = child_pid
+          runtime_child_started!
+        end
+      end
 
       adapter.start_rpc(env: child_env, cwd: child_cwd || repo_root)
       @pid = adapter.pid
-      @state_machine.force_prompt!
+      runtime_child_started!
+      @state_machine.force_prompt! unless @stop_requested
       emit_started_event
       emit_git_start_event
 
       install_signal_handlers
       @server = ApiServer.new(self)
       @server.start
-      persist_registry
       register_completion_notifier!
+      persist_registry
       append_dispatch_start_record
 
       watch_thread = start_watch_thread
       @inbox.start
-      dispatch_initial_prompt
+      begin
+        dispatch_initial_prompt
+      rescue StandardError
+        raise unless @runtime_budget&.expired?
+
+        stop_for_runtime_budget!
+        raise unless runtime_budget_stop?
+      end
 
       if @pid
         begin
@@ -556,14 +685,39 @@ module Harnex
         @exit_code = 0
       end
       @ended_at = Time.now
+      @runtime_budget&.cancel
 
-      enforce_required_artifact_report!
-      normalize_work_acceptance_exit_code!
-      normalize_auto_stop_exit_code!
+      @completion_transition_lock.synchronize do
+        # Keep raw process evidence separate from logical work/cleanup status.
+        if adapter.transport == :stdio_jsonl_rpc || @runtime_budget
+          emit_event("process_exited", code: @exit_code, signal: @term_signal)
+        end
+        stop_for_runtime_budget! if runtime_budget_stop?
+        normalize_pi_stop_exit_code! if adapter.transport == :stdio_jsonl_rpc
+        normalize_runtime_exit_code!
+        enforce_required_artifact_report!
+        normalize_work_acceptance_exit_code!
+        normalize_auto_stop_exit_code!
+        normalize_runtime_exit_code!
+      end
       drain_auto_stop_threads
       finalize_session!
       watch_thread&.kill
       @exit_code
+    rescue StandardError
+      raise unless runtime_budget_stop?
+
+      # The owned child may expire while initialize/handshake is blocked,
+      # before normal registration. Preserve a typed terminal record and wake.
+      @ended_at ||= Time.now
+      @runtime_budget&.cancel
+      stop_for_runtime_budget!
+      normalize_runtime_exit_code!
+      emit_started_event
+      append_dispatch_start_record
+      register_completion_notifier! unless @completion_notification_registered
+      drain_auto_stop_threads
+      @exit_code
     ensure
       finalize_session!
       @inbox.stop
@@ -589,92 +743,7 @@ module Harnex
     end
 
     def handle_structured_notification(message)
-      case adapter.transport
-      when :stdio_jsonrpc
-        handle_rpc_notification(message)
-      when :stdio_jsonl_rpc
-        handle_jsonl_notification(message)
-      end
-    end
-
-    def handle_rpc_notification(message)
-      method = message["method"]
-      params = message["params"] || {}
-
-      case method
-      when "thread/started"
-        @rpc_thread_id = params.dig("thread", "id")
-      when "turn/started"
-        @turn_started_seen = true
-        @state_machine.force_busy!
-        emit_event("turn_started", turnId: params.dig("turn", "id"))
-      when "turn/completed"
-        @state_machine.force_prompt!
-        turn = params["turn"] || {}
-        status = turn["status"]
-        turn_id = turn["id"] || params["turnId"]
-        payload = { turnId: turn_id }
-        payload[:status] = status if status
-        payload[:tokenUsage] = params["tokenUsage"] if params["tokenUsage"].is_a?(Hash)
-        if successful_turn_status?(status)
-          record_successful_completion(payload)
-        else
-          mark_task_failed(
-            turn_id: turn_id,
-            status: status,
-            error: extract_turn_error_message(turn),
-            codex_error_info: extract_turn_error_info(turn)
-          )
-        end
-        schedule_auto_stop("turn_completed", interrupt: false)
-      when "item/completed"
-        emit_event("item_completed", item: params["item"])
-        @event_counters.record_item(params["item"])
-        record_observed_command(params["item"])
-        text = render_item_text(params["item"])
-        record_synthesized(text) if text
-      when "thread/compacted"
-        emit_event("compaction", **params)
-      when "thread/tokenUsage/updated"
-        # Schema: ThreadTokenUsageUpdatedNotification carries
-        # `tokenUsage: { last, total, modelContextWindow? }` where each
-        # breakdown has camelCase {input,output,cachedInput,reasoningOutput,total}Tokens.
-        # Snapshot cumulative `total` for usage and aggregate `last` separately
-        # as conservative active-context pressure.
-        if params["tokenUsage"].is_a?(Hash)
-          @token_usage = params["tokenUsage"]
-          record_rpc_context_sample(@token_usage)
-        end
-      when "thread/status/changed"
-        # State machine reflects RPC state; no event needed.
-        nil
-      when "account/rateLimits/updated"
-        @rate_limits = params
-      when "error"
-        message = extract_error_notification_message(params)
-        @last_error = message unless message.to_s.empty?
-        @state_machine.force_busy!
-        emit_event(
-          "error",
-          source: "error_notification",
-          message: message,
-          codex_error_info: extract_error_notification_info(params),
-          will_retry: params["willRetry"],
-          threadId: params["threadId"],
-          turnId: params["turnId"]
-        )
-        emit_event("throttle_429", source: "error_notification", message: message) if throttle_429?(message, params)
-        signal_rpc_done! if params["turnId"].to_s.empty?
-      end
-    rescue StandardError => e
-      warn("harnex: rpc notification handler error: #{e.message}")
-    end
-
-    def successful_turn_status?(status)
-      text = status.to_s
-      return true if text.empty?
-
-      SUCCESSFUL_TURN_STATUSES.include?(text)
+      handle_jsonl_notification(message) if adapter.transport == :stdio_jsonl_rpc
     end
 
     def record_successful_completion(payload)
@@ -682,6 +751,12 @@ module Harnex
     end
 
     def record_successful_completion_locked(payload)
+      return false if @stop_requested || @session_finalized
+      if @runtime_budget&.expired?
+        stop_for_runtime_budget!
+        return false
+      end
+      @activity.settle
       assessment = completion_gate_required? ? assess_completion_proof : { accepted: true }
       unless assessment[:accepted]
         mark_task_failed(
@@ -717,16 +792,17 @@ module Harnex
       event_payload[:outcome_class] = @completion_outcome_class if @completion_outcome_class
       event_payload[:artifact_report_status] = @completion_report_status if @completion_report_status
       event_payload[:artifact_report_path] = artifact_report_path
+      event_payload[:turn] = @completion_turn
+      event_payload[:follow_ups] = follow_ups_summary if follow_ups_summary
+      event_payload.merge!(final_message_fields).merge!(turn_git_fields)
       emit_event("task_complete", **event_payload)
       publish_completion_notification("task_complete")
       true
     end
 
+    # Pi turns are accepted as settled unless the caller demands a receipt.
     def completion_gate_required?
-      return true if require_artifact_report
-      return false unless adapter.transport == :stdio_jsonrpc
-
-      @auto_stop || (adapter.respond_to?(:initial_prompt) && !adapter.initial_prompt.to_s.empty?)
+      require_artifact_report
     end
 
     def assess_completion_proof
@@ -764,7 +840,7 @@ module Harnex
     def git_activity_observed?(snapshot = nil)
       return false if @git_start[:sha].to_s.empty?
 
-      snapshot ||= Harnex.git_capture_end(repo_root, @git_start)
+      snapshot ||= Harnex.git_capture_end(git_observation_root, @git_start)
       snapshot[:commits].to_i.positive? || Array(snapshot[:changed_paths]).any? ||
         (!snapshot[:sha].to_s.empty? && snapshot[:sha].to_s != @git_start[:sha].to_s)
     end
@@ -788,8 +864,9 @@ module Harnex
       @completion_transition_lock.synchronize { mark_task_failed_locked(**attributes) }
     end
 
-    def mark_task_failed_locked(turn_id: nil, status: nil, error: nil, codex_error_info: nil, outcome_class: nil, artifact_report_status: nil, diagnostics: nil, publish: true)
+    def mark_task_failed_locked(turn_id: nil, status: nil, error: nil, outcome_class: nil, artifact_report_status: nil, diagnostics: nil, publish: true)
       @last_completed_at = nil if outcome_class
+      @activity.settle
       @last_failed_at = Time.now
       @last_failed_status = status.to_s.empty? ? "failed" : status.to_s
       @last_error = error.to_s unless error.to_s.empty?
@@ -798,12 +875,15 @@ module Harnex
       @completion_diagnostics = Array(diagnostics).first(Harnex::ArtifactReport::MAX_DIAGNOSTICS) if diagnostics
 
       payload = { status: @last_failed_status }
+      payload[:stop] = @stop_request.to_h if @stop_request
       payload[:turnId] = turn_id if turn_id
       payload[:message] = error unless error.to_s.empty?
-      payload[:codex_error_info] = codex_error_info if codex_error_info
       payload[:outcome_class] = outcome_class if outcome_class
       payload[:artifact_report_status] = artifact_report_status if artifact_report_status
       payload[:diagnostics] = @completion_diagnostics unless @completion_diagnostics.empty?
+      payload[:turn] = @completion_turn
+      payload[:follow_ups] = follow_ups_summary if follow_ups_summary
+      payload.merge!(final_message_fields).merge!(turn_git_fields)
       emit_event("task_failed", **payload)
       if publish
         enforce_required_artifact_report!
@@ -812,50 +892,29 @@ module Harnex
       end
     end
 
-    def extract_error_notification_message(params)
-      error = params["error"]
-      if error.is_a?(Hash)
-        error["message"] || error.dig("error", "message") || params["message"]
-      else
-        params["message"]
-      end
-    end
-
-    def extract_error_notification_info(params)
-      error = params["error"]
-      error.is_a?(Hash) ? error["codexErrorInfo"] : nil
-    end
-
-    def throttle_429?(message, params)
-      return true if message.to_s.match?(/\b429\b|rate limit/i)
-
-      error = params["error"]
-      error.is_a?(Hash) && error.values.any? { |value| value.to_s.match?(/\b429\b|rate limit/i) }
-    end
-
-    def extract_turn_error_message(turn)
-      error = turn["error"]
-      return error["message"] if error.is_a?(Hash)
-      return error if error.is_a?(String)
-
-      nil
-    end
+    def handle_jsonl_notification(message)
+      @completion_transition_lock.synchronize do
+        # Stop owns the terminal decision. Late abort/settled/start callbacks
+        # cannot resurrect interrupted work or invalidate settled idle cleanup.
+        return if @stop_requested || @session_finalized || @pi_transport_failed
 
-    def extract_turn_error_info(turn)
-      error = turn["error"]
-      error.is_a?(Hash) ? error["codexErrorInfo"] : nil
+        handle_jsonl_notification_locked(message)
+      end
     end
 
-    def handle_jsonl_notification(message)
+    def handle_jsonl_notification_locked(message)
       event_type = message["type"].to_s
+      return if event_type == "agent_settled" && @pi_awaiting_run_start
 
+      @activity.observe_pi(message)
       case event_type
       when "agent_start"
-        reset_pi_run_outcome!
-        @state_machine.force_busy!
+        begin_pi_run!
+        @pi_awaiting_run_start = false
       when "turn_start"
+        begin_pi_run!
+        @pi_awaiting_run_start = false
         @turn_started_seen = true
-        @state_machine.force_busy!
         emit_event("turn_started")
       when "agent_end"
         capture_pi_agent_end(message)
@@ -863,6 +922,8 @@ module Harnex
         emit_event("agent_end", will_retry: message["willRetry"] == true)
         adapter.request_session_stats_async if adapter.respond_to?(:request_session_stats_async)
       when "agent_settled"
+        return if @pi_awaiting_run_start
+
         @state_machine.force_prompt!
         emit_event("agent_settled", stop_reason: @pi_last_assistant_stop_reason)
         settle_pi_task!
@@ -891,11 +952,17 @@ module Harnex
           record_synthesized(text) if text
         end
       when "tool_execution_start"
-        @event_counters.record_item({ "type" => "dynamicToolCall" })
+        if pi_command_tool?(message)
+          @event_counters.record_item({ "type" => "commandExecution" })
+          start_pi_command(message)
+        else
+          @event_counters.record_item({ "type" => "dynamicToolCall" })
+        end
         record_synthesized(
           "tool: #{message["toolName"] || "tool"}#{message["args"] ? " #{summarize(message["args"])}" : ""}"
         )
       when "tool_execution_end"
+        finish_pi_command(message) if pi_command_tool?(message)
         tool_name = message["toolName"] || "tool"
         status = message["isError"] ? "error" : "ok"
         record_synthesized("tool-result: #{tool_name} (#{status})")
@@ -909,7 +976,10 @@ module Harnex
           error_message: message["errorMessage"]
         )
       when "queue_update"
-        nil
+        # Counts only: the queue holds message text. A follow-up still
+        # pending when the run settles never reached the model.
+        @pi_follow_up_pending = Array(message["followUp"]).length
+        emit_event("queue_update", follow_up: @pi_follow_up_pending, steering: Array(message["steering"]).length)
       when "auto_retry_start", "auto_retry_end"
         payload = message.reject { |k, _| k == "type" }
         @pi_last_retry_error = message["finalError"].to_s if event_type == "auto_retry_end" && message["success"] == false
@@ -950,12 +1020,15 @@ module Harnex
     end
 
     def handle_structured_disconnect(error)
-      handle_rpc_disconnect(error)
+      @completion_transition_lock.synchronize { handle_rpc_disconnect(error) }
     end
 
     def handle_rpc_disconnect(error)
+      return if @session_finalized
+
       msg = error.is_a?(Hash) ? error["message"] : error&.message
-      if normal_auto_stop_disconnect?(msg)
+      expected_cleanup = error.nil? && (@stop_requested || runtime_budget_stop?) && !@pi_transport_failed
+      if expected_cleanup
         signal_rpc_done!
         return
       end
@@ -965,6 +1038,14 @@ module Harnex
       end
       @last_error = msg.to_s unless msg.to_s.empty?
       @state_machine.force_busy!
+      return if @pi_transport_failed
+
+      @pi_transport_failed = true
+      @pi_idle_stop = false
+      mark_task_failed(
+        status: "disconnected", error: msg,
+        outcome_class: "task_failed", artifact_report_status: "rejected"
+      )
       emit_event("disconnected", source: "transport", message: msg) rescue nil
       if adapter.respond_to?(:terminate_subprocess)
         Thread.new do
@@ -976,11 +1057,12 @@ module Harnex
       signal_rpc_done!
     end
 
-    def normal_auto_stop_disconnect?(message)
-      message.to_s.empty? && @auto_stop_fired && (task_complete? || task_failed?)
-    end
-
     def dispatch_initial_prompt
+      if @runtime_budget&.expired?
+        stop_for_runtime_budget!
+        return
+      end
+      return if @stop_requested
       return unless adapter.respond_to?(:initial_prompt)
 
       prompt = adapter.initial_prompt
@@ -989,48 +1071,88 @@ module Harnex
       inject_via_structured(text: prompt, submit: true, enter_only: false, force: false)
     end
 
-    def render_item_text(item)
-      return nil unless item.is_a?(Hash)
+    # Exact-string gate matching against harness-observed exits; the last
+    # run of a gate decides it. Caller holds @observed_commands_mutex.
+    def note_command_exit_locked(command, exit_code)
+      @commands_had_failures = true unless exit_code.zero?
+      @final_gates.each do |gate|
+        @final_gate_exits[gate] = exit_code if Harnex::ArtifactReport.final_gate_matches?(gate, command)
+      end
+    end
 
-      case item["type"]
-      when "agentMessage"
-        item["text"]
-      when "mcpToolCall", "dynamicToolCall"
-        name = item["tool"] || "tool"
-        args = item["arguments"]
-        "tool: #{name}#{args ? " #{summarize(args)}" : ""}"
-      when "commandExecution"
-        "command: #{item["command"]}"
-      else
-        item["text"]
+    def final_gates_snapshot
+      @observed_commands_mutex.synchronize do
+        @final_gates.map { |gate| { "cmd" => gate, "exit_code" => @final_gate_exits[gate] } }
       end
     end
 
-    def record_observed_command(item)
-      return unless item.is_a?(Hash) && item["type"] == "commandExecution"
+    def commands_had_failures?
+      @observed_commands_mutex.synchronize { @commands_had_failures }
+    end
+
+    def pi_command_tool?(message)
+      PI_COMMAND_TOOLS.include?(message["toolName"].to_s)
+    end
+
+    # Pi bash calls become proof only from structured evidence: command text
+    # from the start event's args and an integer exit from the end event's
+    # result.structuredContent, correlated by toolCallId. Aborts, timeouts,
+    # extension-replaced results, and older Pi releases carry no structured
+    # exit; those calls are counted as unobserved, never inferred from prose.
+    # Shell commands Pi is running right now (bounded), so a stall report can
+    # say whether the worker waits on a long command or on the model.
+    def pi_running_commands
+      @observed_commands_mutex.synchronize do
+        @pi_pending_commands.values.compact.last(3).map { |command| command[0, 160] }
+      end
+    rescue StandardError
+      []
+    end
 
-      command = item["command"]
-      command = Shellwords.join(command.map(&:to_s)) if command.is_a?(Array)
-      command = command.to_s
-      exit_code = item["exitCode"]
-      exit_code = item["exit_code"] if exit_code.nil?
-      exit_code = Integer(exit_code)
-      return if command.empty?
+    def start_pi_command(message)
+      call_id = message["toolCallId"].to_s
+      args = message["args"]
+      command = args["command"] if args.is_a?(Hash)
+      command = command.is_a?(String) && !command.strip.empty? ? Harnex::ArtifactReport.bounded_string(command) : nil
+      @observed_commands_mutex.synchronize do
+        if call_id.empty?
+          @pi_unobserved_commands += 1
+          next
+        end
+        if @pi_pending_commands.key?(call_id)
+          @pi_pending_commands.delete(call_id)
+          @pi_unobserved_commands += 1
+        elsif @pi_pending_commands.length >= MAX_PENDING_PI_COMMANDS
+          @pi_pending_commands.shift
+          @pi_unobserved_commands += 1
+        end
+        @pi_pending_commands[call_id] = command
+      end
+    end
 
-      duration = item["duration_s"]
-      duration = item["durationMs"].to_f / 1000.0 if duration.nil? && item["durationMs"]
-      observed = {
-        "cmd" => command,
-        "exit_code" => exit_code,
-        "status" => item["status"],
-        "duration_s" => duration
-      }.compact
+    def finish_pi_command(message)
+      call_id = message["toolCallId"].to_s
+      result = message["result"]
+      structured = result["structuredContent"] if result.is_a?(Hash)
+      exit_code = structured["exit_code"] if structured.is_a?(Hash)
+      duration_ms = message["durationMs"]
+      duration = duration_ms / 1000.0 if duration_ms.is_a?(Numeric) && duration_ms.finite? && duration_ms >= 0
       @observed_commands_mutex.synchronize do
-        @observed_commands << observed
+        command = @pi_pending_commands.delete(call_id) unless call_id.empty?
+        unless command && exit_code.is_a?(Integer)
+          @pi_unobserved_commands += 1
+          next
+        end
+
+        @observed_commands << {
+          "cmd" => command,
+          "exit_code" => exit_code,
+          "status" => message["isError"] == true ? "failed" : "completed",
+          "duration_s" => duration
+        }.compact
         @observed_commands = @observed_commands.last(Harnex::ArtifactReport::MAX_COMMANDS)
+        note_command_exit_locked(command, exit_code)
       end
-    rescue ArgumentError, TypeError
-      nil
     end
 
     def summarize(value)
@@ -1040,6 +1162,24 @@ module Harnex
       ""
     end
 
+    def begin_pi_run!
+      begin_notification_turn!
+      @activity.start_turn
+      reset_work_outcome!
+      reset_pi_run_outcome!
+      @state_machine.force_busy!
+    end
+
+    def reset_work_outcome!
+      @last_completed_at = nil
+      @last_failed_at = nil
+      @last_failed_status = nil
+      @completion_outcome_class = nil
+      @completion_report_status = nil
+      @completion_diagnostics = []
+      @last_error = nil
+    end
+
     def reset_pi_run_outcome!
       @pi_last_assistant_stop_reason = nil
       @pi_last_assistant_error = nil
@@ -1056,6 +1196,9 @@ module Harnex
     def capture_pi_assistant_message(message)
       return unless message.is_a?(Hash) && message["role"] == "assistant"
 
+      text = pi_extract_message_text(message).to_s
+      @turn_final_text = text unless text.strip.empty?
+
       reason = message["stopReason"].to_s
       @pi_last_assistant_stop_reason = reason unless reason.empty?
       error = message["errorMessage"].to_s
@@ -1063,7 +1206,7 @@ module Harnex
     end
 
     def settle_pi_task!
-      return if @stop_requested && !task_complete? && !task_failed?
+      return if @stop_requested || @pi_transport_failed
 
       reason = @pi_last_assistant_stop_reason
       case reason
@@ -1072,7 +1215,8 @@ module Harnex
       when "error", "aborted", "length"
         error = @pi_last_assistant_error || @pi_last_retry_error
         error = "Pi agent settled with stopReason=#{reason}" if error.to_s.empty?
-        mark_task_failed(status: reason, error: error)
+        capacity = reason == "error" && !@pi_last_retry_error.to_s.empty?
+        mark_task_failed(status: reason, error: error, outcome_class: capacity ? "provider_capacity" : nil)
       when nil, ""
         mark_task_failed(
           status: "missing_final_message",
@@ -1217,6 +1361,9 @@ module Harnex
         @completion_notification_registered = true
         deliver_completion_notification(@pending_completion_notification) if @pending_completion_notification
       end
+    rescue CompletionNotifier::RegistrationError
+      # A named primary must have a durable monitor handoff before any prompt.
+      raise
     rescue StandardError => e
       warn("harnex: completion marker cleanup failed (#{e.class})")
       emit_event("completion_notification_error", component: "cleanup", error_class: e.class.name)
@@ -1236,6 +1383,23 @@ module Harnex
       false
     end
 
+    # #81: work that starts after this turn's result was published is the
+    # next turn, so its own result is published (and reaches the owner) too.
+    def begin_notification_turn!
+      turn = @completion_notification_mutex.synchronize do
+        next nil unless @completion_notification_sent
+
+        @completion_notification_sent = false
+        @turn_follow_ups_sent = 0
+        @turn_final_text = nil
+        @completion_turn += 1
+      end
+      return unless turn
+
+      emit_event("work_turn", turn: turn)
+      @completion_notifier.turn_started(turn) if @completion_notifier.respond_to?(:turn_started)
+    end
+
     def deliver_completion_notification(snapshot)
       @completion_notification_sent = true
       @pending_completion_notification = nil
@@ -1247,10 +1411,59 @@ module Harnex
       {
         outcome: outcome, work_state: outcome == "completed" ? "completed" : "failed",
         outcome_class: @completion_outcome_class, artifact_report_status: @completion_report_status,
-        end_sha: summary_string(@git_end[:sha]), terminal_signal: terminal_signal
+        end_sha: summary_string(@git_end[:sha]), terminal_signal: terminal_signal,
+        turn: @completion_turn, follow_ups: follow_ups_summary,
+        final_message: final_message_fields[:final_message],
+        final_message_path: final_message_fields[:final_message_path],
+        turn_details: (@last_turn_git_fields || {}).slice(:turn_commits, :model)
       }
     end
 
+    # The lane's head and commit count since dispatch start, refreshed at the
+    # turn's end so a result names the commit it produced.
+    def turn_git_fields
+      snapshot = refresh_git_end_snapshot
+      return {} if snapshot.nil? || snapshot[:sha].to_s.empty?
+
+      commits = snapshot[:commits]
+      turn_commits = commits && (commits - @commits_at_last_result.to_i)
+      @commits_at_last_result = commits if commits
+      fields = { end_sha: snapshot[:sha], commits: commits, turn_commits: turn_commits }.compact
+      model = adapter.respond_to?(:current_model) ? adapter.current_model.to_s : ""
+      fields[:model] = model unless model.empty?
+      @last_turn_git_fields = fields
+    rescue StandardError
+      {}
+    end
+
+    # #85: the worker's last reply this turn, so a supervisor gets the answer
+    # with the result instead of reading the transcript. Written once per
+    # turn; the inline copy is bounded.
+    def final_message_fields
+      text = @turn_final_text.to_s.strip
+      return {} if text.empty?
+
+      @final_message_written ||= {}
+      path = Harnex.final_message_path(repo_root, id, @completion_turn)
+      unless @final_message_written[@completion_turn] == text
+        File.write(path, text + "\n")
+        @final_message_written[@completion_turn] = text
+      end
+      fields = { final_message: text[0, FINAL_MESSAGE_LIMIT], final_message_path: path }
+      fields[:final_message_truncated] = true if text.length > FINAL_MESSAGE_LIMIT
+      fields
+    rescue StandardError
+      { final_message: text[0, FINAL_MESSAGE_LIMIT] }
+    end
+
+    # Follow-ups sent into this turn and how many Pi still held when it
+    # settled (0 means every one reached the model).
+    def follow_ups_summary
+      return nil unless @turn_follow_ups_sent.positive?
+
+      { sent: @turn_follow_ups_sent, pending: @pi_follow_up_pending }
+    end
+
     def completion_notification_outcome(terminal_signal)
       signal = terminal_signal.to_s
       return "error" if %w[dispatch_error finalization].include?(signal)
@@ -1311,7 +1524,9 @@ module Harnex
         artifact_report_status: @completion_report_status,
         started_at: @started_at.iso8601,
         exited_at: Time.now.iso8601,
-        injected_count: @injected_count
+        injected_count: @injected_count,
+        stop: @stop_request&.to_h,
+        runtime_budget: runtime_budget_snapshot
       }
       payload[:signal] = @term_signal if @term_signal
       Harnex.write_registry(exit_path, payload)
@@ -1451,6 +1666,9 @@ module Harnex
     end
 
     def emit_started_event
+      return if @started_event_emitted
+
+      @started_event_emitted = true
       payload = { pid: @pid }
       payload[:meta] = meta if meta
       emit_event("started", **payload)
@@ -1462,16 +1680,49 @@ module Harnex
 
     def emit_git_start_event
       @git_start = Harnex.git_capture_start(
-        repo_root,
+        git_observation_root,
         exclude_paths: git_observation_excluded_paths
       )
       return if @git_start.empty?
 
-      emit_event("git", phase: "start", sha: @git_start[:sha], branch: @git_start[:branch])
+      payload = { phase: "start", sha: @git_start[:sha], branch: @git_start[:branch] }
+      payload[:git_root] = git_observation_root if git_lane?
+      emit_event("git", **payload)
+    end
+
+    # #80: a lane launched with --cwd <worktree> --root <checkout> commits in
+    # its own repository. Git is observed there (SHAs, branch, activity,
+    # receipt); --root still decides where telemetry rows land, and its head
+    # is kept as root_commit_sha.
+    def git_observation_root
+      return @git_observation_root if defined?(@git_observation_root)
+
+      root_top = canonical_git_toplevel(repo_root)
+      lane_top = child_cwd && canonical_git_toplevel(child_cwd)
+      @git_observation_root = lane_top && lane_top != root_top ? lane_top : repo_root
+    end
+
+    def git_lane?
+      git_observation_root != repo_root
+    end
+
+    def canonical_git_toplevel(path)
+      top = DispatchHistory.git_toplevel(path.to_s)
+      top && File.realpath(top)
+    rescue StandardError
+      nil
+    end
+
+    def root_commit_sha
+      return nil unless git_lane?
+
+      @root_commit_sha ||= Harnex.git_output(repo_root, "rev-parse", "HEAD")
+    rescue StandardError
+      nil
     end
 
     def git_observation_excluded_paths
-      git_root = DispatchHistory.find_git_root(repo_root)
+      git_root = DispatchHistory.find_git_root(git_observation_root)
       return [] unless git_root
 
       root = File.expand_path(git_root)
@@ -1488,7 +1739,8 @@ module Harnex
       @context_summary = normalized_context_summary(summary)
       emit_event("usage", **@usage_summary)
 
-      @git_end = Harnex.git_capture_end(repo_root, @git_start)
+      @git_end = Harnex.git_capture_end(git_observation_root, @git_start)
+      root_commit_sha
       return if @git_end.empty?
 
       emit_event(
@@ -1531,10 +1783,14 @@ module Harnex
     end
 
     def finalize_session!
-      return if @session_finalized
-      return unless @events_log
+      @runtime_budget&.cancel
+      @completion_transition_lock.synchronize do
+        return if @session_finalized
+        return unless @events_log
 
-      @session_finalized = true
+        @session_finalized = true
+        @activity.settle
+      end
       @ended_at ||= Time.now
       begin
         emit_session_end_telemetry
@@ -1556,12 +1812,123 @@ module Harnex
       emit_exit_event
     end
 
-    def stop_requested!
-      @stop_mutex.synchronize do
-        return true if @stop_requested
+    def stop_requested!(reason: "manual", origin: "api")
+      @completion_transition_lock.synchronize do
+        @stop_mutex.synchronize do
+          return true if @stop_requested || @session_finalized
+
+          work_state = task_failed? ? "failed" : (task_complete? ? "completed" : "running")
+          @stop_request = StopRequest.new(
+            reason: reason, origin: origin, work_state: work_state,
+            runtime_limit_s: reason == "runtime_budget" ? @runtime_budget&.snapshot&.fetch(:limit_s) : nil
+          )
+          @stop_requested = true
+          emit_event("stop_requested", **@stop_request.to_h)
+          if adapter.transport == :stdio_jsonl_rpc
+            @pi_idle_stop = task_complete? && !@pi_transport_failed &&
+              !@pi_awaiting_run_start && @state_machine.to_s == "prompt" &&
+              (adapter.state == :prompt || runtime_budget_stop?)
+            unless @pi_idle_stop || task_failed?
+              mark_task_failed(
+                status: runtime_budget_stop? ? "runtime_budget" : "interrupted",
+                error: runtime_budget_stop? ? "worker runtime budget expired" : "Pi stopped before accepted settlement"
+              )
+            end
+          elsif runtime_budget_stop? && !task_complete? && !task_failed?
+            mark_task_failed(status: "runtime_budget", error: "worker runtime budget expired")
+          end
+          false
+        end
+      end
+    end
+
+    def start_runtime_budget!
+      @runtime_budget&.start { schedule_runtime_stop }
+    end
+
+    def runtime_child_started!
+      @runtime_child_ready = true
+      schedule_runtime_stop if @runtime_budget&.expired?
+    end
+
+    def schedule_runtime_stop
+      return unless @runtime_child_ready
+
+      # This lock never encloses RPC, receipt, output or event I/O. Physical
+      # enforcement must not wait for the logical completion/stop locks, and
+      # an earlier advisory stop must not disarm the fixed safety deadline.
+      @runtime_mutex.synchronize do
+        return if @session_finalized
+        return if @runtime_enforcement_started && @runtime_enforced_pid == @pid
+
+        @runtime_enforcement_started = true
+        @runtime_enforced_pid = @pid
+        @runtime_enforced_at ||= Time.now.utc.iso8601(3)
+      end
+      terminate_runtime_child_async
+      track_auto_stop_thread(Thread.new { stop_for_runtime_budget! })
+    end
+
+    def stop_for_runtime_budget!
+      @runtime_budget&.check!
+      @completion_transition_lock.synchronize do
+        return if @session_finalized
+
+        stop_requested!(reason: "runtime_budget", origin: "runtime")
+        unless task_complete? || task_failed?
+          mark_task_failed(status: "runtime_budget", error: "worker runtime budget expired")
+        end
+        unless @runtime_expiry_recorded
+          @runtime_expiry_recorded = true
+          emit_event("runtime_budget_expired", **runtime_budget_snapshot)
+        end
+        signal_rpc_done! unless @pid
+      end
+    end
+
+    def runtime_budget_stop?
+      @runtime_enforcement_started
+    end
+
+    def runtime_budget_snapshot
+      @runtime_budget&.snapshot&.merge(enforced: !!@runtime_enforcement_started, enforced_at: @runtime_enforced_at)
+    end
+
+    def capture_pty_process_group!
+      @owned_pty_group = @pid if Process.getpgid(@pid) == @pid
+    rescue Errno::ESRCH
+      nil
+    end
+
+    def terminate_runtime_child_async
+      thread = Thread.new do
+        if adapter.respond_to?(:terminate_subprocess)
+          adapter.terminate_subprocess
+        elsif (child_pid = @pid)
+          target = @owned_pty_group ? -@owned_pty_group : child_pid
+          Process.kill("TERM", target)
+          sleep Adapters::Pi::STOP_TERM_GRACE_SECONDS
+          Process.kill("KILL", target) if Harnex.alive_pid?(target)
+        end
+      rescue Errno::ESRCH
+        nil
+      rescue StandardError => e
+        warn("harnex: runtime termination failed (#{e.class})")
+      end
+      track_auto_stop_thread(thread)
+    end
+
+    def normalize_runtime_exit_code!
+      return unless runtime_budget_stop?
 
-        @stop_requested = true
-        false
+      if task_complete? && !task_failed? && @stop_request.to_h[:work_state] == "completed"
+        if @exit_code == 0 || (@exit_code == 143 && [nil, 15].include?(@term_signal))
+          @exit_code = 0
+          @term_signal = nil
+        end
+      else
+        @exit_code = 124
+        @term_signal = nil
       end
     end
 
@@ -1601,7 +1968,7 @@ module Harnex
 
       thread = Thread.new do
         begin
-          inject_stop(turn_id: turn_id, interrupt: interrupt)
+          inject_stop(turn_id: turn_id, interrupt: interrupt, reason: "completion", origin: "auto_stop")
         rescue StandardError => e
           warn("harnex: auto-stop failed after #{reason}: #{e.message}")
         end
@@ -1614,8 +1981,6 @@ module Harnex
     end
 
     def drain_auto_stop_threads
-      return unless @auto_stop
-
       threads = @auto_stop_mutex.synchronize { @auto_stop_threads.dup }
       return if threads.empty?
 
@@ -1633,7 +1998,7 @@ module Harnex
       timed_out.each(&:kill)
       @exit_code = 1 if @exit_code.nil? || @exit_code.zero?
       @term_signal = nil if @exit_code == 1
-      emit_event("auto_stop_teardown_timeout", grace_seconds: grace_seconds, threads: timed_out.size)
+      emit_event(@auto_stop ? "auto_stop_teardown_timeout" : "stop_teardown_timeout", grace_seconds: grace_seconds, threads: timed_out.size)
     end
 
     def auto_stop_teardown_grace_seconds
@@ -1697,7 +2062,11 @@ module Harnex
         turn: receipt_turn_payload(successful),
         usage: build_summary_usage,
         claims: @artifact_claims,
-        command_observation: command_observation_status
+        command_observation: command_observation_status,
+        commands_unobserved: unobserved_command_count,
+        stop: @stop_request&.to_h,
+        final_gates: final_gates_snapshot,
+        commands_had_failures: commands_had_failures?
       )
       @artifact_report_generated = true
       @artifact_report_write_error = nil
@@ -1707,7 +2076,7 @@ module Harnex
     def refresh_git_end_snapshot
       return @git_end = {} if @git_start[:sha].to_s.empty?
 
-      snapshot = Harnex.git_capture_end(repo_root, @git_start)
+      snapshot = Harnex.git_capture_end(git_observation_root, @git_start)
       @git_end = snapshot unless snapshot.empty?
       @git_end
     end
@@ -1737,7 +2106,21 @@ module Harnex
     end
 
     def command_observation_status
-      adapter.transport == :stdio_jsonrpc ? "observed" : "unsupported"
+      case adapter.transport
+      when :stdio_jsonl_rpc
+        if unobserved_command_count.zero?
+          "observed"
+        else
+          observed_commands_snapshot.empty? ? "unsupported" : "partial"
+        end
+      else "unsupported"
+      end
+    end
+
+    # Pi command-tool calls that ended without structured exit evidence, plus
+    # any still in flight when the receipt is written.
+    def unobserved_command_count
+      @observed_commands_mutex.synchronize { @pi_unobserved_commands + @pi_pending_commands.length }
     end
 
     def receipt_successful?
@@ -1821,7 +2204,26 @@ module Harnex
       @term_signal = nil if @exit_code == 1
     end
 
+    def normalize_pi_stop_exit_code!
+      if @pi_idle_stop && task_complete? && !@pi_transport_failed
+        # Pi may handle TERM itself and call process.exit(143), in which case
+        # wait reports a normal exit with no signal. The idle-stop latch, not
+        # exit 143 alone, is the authority to preserve the settled proof.
+        if @exit_code == 0 || (@exit_code == 143 && [nil, 15].include?(@term_signal))
+          @exit_code = 0
+          @term_signal = nil
+        else
+          mark_task_failed(status: "process_exit", error: "Pi idle cleanup exited unexpectedly")
+        end
+      end
+      if task_failed?
+        @exit_code = 1 if @exit_code.nil? || @exit_code.zero? || @term_signal
+        @term_signal = nil if @exit_code == 1
+      end
+    end
+
     def normalize_auto_stop_exit_code!
+      return normalize_pi_stop_exit_code! if adapter.transport == :stdio_jsonl_rpc
       return unless @auto_stop
       return unless @auto_stop_fired
 
@@ -1851,6 +2253,7 @@ module Harnex
     end
 
     def boot_failure_exit?
+      return false if @stop_requested
       return false unless structured_transport?
       return false if @turn_started_seen
 
@@ -1876,7 +2279,10 @@ module Harnex
         attribution: attribution,
         outcome: outcome,
         attempt: build_summary_attempt,
-        reliability: build_summary_reliability
+        reliability: build_summary_reliability,
+        activity: @activity.snapshot,
+        stop: @stop_request&.to_h,
+        runtime_budget: runtime_budget_snapshot
       }
       queue = build_summary_queue
       record[:queue] = queue if queue
@@ -1912,6 +2318,8 @@ module Harnex
         issue: passthrough["issue"],
         plan: passthrough["plan"],
         task_brief: passthrough["task_brief"],
+        context_file: passthrough["context_file"],
+        context_sha256: passthrough["context_sha256"],
         repo: repo_root,
         branch: @git_start[:branch],
         start_sha: @git_start[:sha],
@@ -2073,8 +2481,12 @@ module Harnex
 
     def build_summary_outcome(artifact_payload)
       receipt_outcome = artifact_payload&.dig("outcome") || {}
-      outcome_class, report_status = summary_proof_classification
-      proof_failure = %w[completed_no_activity report_missing report_invalid report_rejected task_failed].include?(outcome_class)
+      base_class, report_status = summary_proof_classification
+      outcome_class = refine_terminal_outcome_class(base_class)
+      # Status/source derive from the proof verdict, not the refined label.
+      proof_failure = %w[
+        completed_no_activity report_missing report_invalid report_rejected task_failed provider_capacity
+      ].include?(base_class)
       harness_receipt = artifact_payload&.dig("receipt", "author") == "harnex"
       status = receipt_outcome["status"]
       status = nil if status == "accepted" && proof_failure
@@ -2122,6 +2534,36 @@ module Harnex
       ["unknown", @completion_report_status]
     end
 
+    # Only an unknown or failed terminal is refined; completions and proof
+    # verdicts stand. A stop or deadline outranks task_failed only when the
+    # work was still running at the stop: a failure that preceded the stop
+    # is the real cause. Anything unrecognized stays unknown.
+    def refine_terminal_outcome_class(base)
+      base = "unknown" unless OUTCOME_CLASSES.include?(base)
+      # Finalization always writes a receipt, so a process that ended without
+      # any completion signal reaches here as report_rejected. That is
+      # Harnex's own record of an unsuccessful process, not a verdict on
+      # finished work: classify the process instead.
+      base = "unknown" if base == "report_rejected" && receipt_rejection_without_completion?
+      return base unless %w[unknown task_failed].include?(base)
+
+      stop = @stop_request&.to_h || {}
+      stopped_while_running = stop[:work_state] == "running"
+      return "timeout" if stop[:reason] == "runtime_budget" && stopped_while_running
+      return "timeout" if @exit_code == 124 && base == "unknown"
+      return "stopped_by_caller" if stop[:reason] == "manual" && stopped_while_running
+      return base if base == "task_failed"
+      return "boot_failure" if @exit_reason == "boot_failure"
+      return "permission_prompt" if @state_machine&.state == :blocked
+      return "process_failed" if @exit_reason == "failure"
+
+      "unknown"
+    end
+
+    def receipt_rejection_without_completion?
+      @completion_outcome_class.nil? && !task_complete? && !task_failed?
+    end
+
     def build_summary_attempt
       {
         "run_id" => id,
@@ -2218,8 +2660,7 @@ module Harnex
 
       records = {}
       duplicates = {}
-      File.foreach(path) do |line|
-        record = JSON.parse(line)
+      DispatchHistory.each_record(path) do |record|
         next unless DispatchHistory.end_record?(record)
 
         dispatch_id = summary_string(record["id"])
@@ -2231,8 +2672,6 @@ module Harnex
         elsif !duplicates.key?(dispatch_id)
           records[dispatch_id] = record
         end
-      rescue JSON::ParserError
-        next
       end
       records
     rescue StandardError
@@ -2341,7 +2780,8 @@ module Harnex
         turn_count: @injected_count,
         tool_calls: summary_tool_calls(counters),
         commands_executed: counters[:commands_executed],
-        rate_limits: @rate_limits,
+        # No adapter reports provider rate-limit payloads; kept for the schema.
+        rate_limits: nil,
         output_lines: output_measurements[:lines],
         output_bytes: output_measurements[:bytes],
         event_records: @events_log_seq,
@@ -2394,7 +2834,6 @@ module Harnex
 
     def summary_agent_session_id
       @usage_summary[:agent_session_id] ||
-        @rpc_thread_id ||
         (adapter.thread_id if adapter.respond_to?(:thread_id))
     end
 
@@ -2409,28 +2848,7 @@ module Harnex
     end
 
     def summary_service_tier
-      summary_string(meta_hash["service_tier"]) || service_tier_from_command
-    end
-
-    def service_tier_from_command
-      command.each_with_index do |arg, index|
-        text = arg.to_s
-        if text == "-c" || text == "--config"
-          parsed = parse_service_tier_config(command[index + 1])
-          return parsed if parsed
-        end
-        parsed = parse_service_tier_config(text)
-        return parsed if parsed
-      end
-      nil
-    end
-
-    def parse_service_tier_config(value)
-      text = value.to_s
-      match = text.match(/(?:\A|=)service_tier=\\?"?([^"\s]+)\\?"?/)
-      return nil unless match
-
-      summary_string(match[1])
+      summary_string(meta_hash["service_tier"])
     end
 
     def legacy_summary_event_counters
@@ -2493,6 +2911,9 @@ module Harnex
     end
 
     def append_dispatch_start_record
+      return if @dispatch_start_recorded
+
+      @dispatch_start_recorded = true
       DispatchHistory.append(dispatch_history_path, DispatchHistory.build_start_record(self))
     rescue StandardError => e
       warn("harnex: failed to write dispatch start record: #{e.message}")
@@ -2530,49 +2951,16 @@ module Harnex
       end
     end
 
-    # Structured adapters emit usage directly (JSON-RPC token snapshots,
-    # Pi RPC stats). PTY adapters parse transcript tails when supported.
+    # Pi RPC reports usage directly (session stats); PTY adapters parse
+    # transcript tails when supported.
     def collect_session_summary
-      if adapter.transport == :stdio_jsonrpc
-        summary_from_token_usage
-      elsif adapter.respond_to?(:collect_session_summary)
+      if adapter.respond_to?(:collect_session_summary)
         adapter.collect_session_summary
       else
         adapter.parse_session_summary(transcript_tail)
       end
     end
 
-    def summary_from_token_usage
-      summary = {}
-      if @token_usage.is_a?(Hash) && @token_usage["total"].is_a?(Hash)
-        total = @token_usage["total"]
-        summary.merge!(
-          input_tokens: total["inputTokens"],
-          output_tokens: total["outputTokens"],
-          reasoning_tokens: total["reasoningOutputTokens"],
-          cached_tokens: total["cachedInputTokens"],
-          total_tokens: total["totalTokens"]
-        )
-      end
-      summary[:context] = @rpc_context_telemetry.snapshot if @rpc_context_telemetry
-      summary
-    end
-
-    def record_rpc_context_sample(token_usage)
-      return unless adapter.context_telemetry_supported?
-
-      @rpc_context_telemetry ||= ContextTelemetry.new(
-        status: "estimated",
-        source: adapter.context_telemetry_source
-      )
-      last = token_usage["last"]
-      last = {} unless last.is_a?(Hash)
-      @rpc_context_telemetry.record(
-        tokens: last["totalTokens"],
-        window_tokens: token_usage["modelContextWindow"]
-      )
-    end
-
     def transcript_tail
       return "" unless File.file?(output_log_path)
 
@@ -2595,7 +2983,9 @@ module Harnex
         event = {
           schema_version: 1,
           seq: @events_log_seq,
-          ts: Time.now.utc.iso8601,
+          # Millisecond precision lets teardown races be measured from the
+          # events log (#36/#37); readers parse it with Time.iso8601.
+          ts: Time.now.utc.iso8601(3),
           id: id,
           type: type
         }.merge(payload)