@aiwg/cli 2026.10.3 → 2026.10.5

package/dist/src/mcp/tools/worker-invoke.mjs

@@ -1,7 +1,7 @@
 /**
  * AIWG MCP Worker-Invoke Bridge (#2892)
  *
- * MCP-only conductor: resolve and invoke a worker (run/status/cancel)
+ * MCP-only conductor: resolve and invoke a worker (run/status/cancel/reconcile_stopped/reset_recovery_scope)
  * WITHOUT any Mission/MC session, daemon, admission store, or activation
  * marker. Reuses, rather than reimplements, the existing Tier 0 primitives:
  *
@@ -157,6 +157,7 @@
  * @issues #2892, #2896 (review reference, not reused as-is)
  */
 
+import { signalChild } from '../../process/signal-child.mjs';
 import { z } from 'zod';
 import { createHash, randomUUID } from 'node:crypto';
 import {
@@ -450,8 +451,26 @@ export function createInvocationRegistry({
   const entries = new Map();
   const seenRequestIds = new Map(); // request_id -> { invocationId, recordedAt }
 
+  // Pin one bounded breaker owner for this registry's lifetime. Replacing
+  // it could accumulate protected entries across independently capped owners
+  // and orphan the original reconciliation mapping.
+  let recoveryOwner;
+  function bindRecoveryOwner(breaker) {
+    if (!breaker) return;
+    if (recoveryOwner && recoveryOwner !== breaker) {
+      throw new Error('Invocation registry already has a recovery breaker owner; reuse that owner and reconcile_stopped for unresolved reservations');
+    }
+    recoveryOwner = breaker;
+  }
+  // Unresolved entries and their replay identities survive ordinary pruning.
+  // Their aggregate bound is the single owner's reservation cap.
+  function hasUnresolvedStopMarker(entry) {
+    return typeof entry.recoveryBreaker?.hasUnresolvedStop === 'function'
+      && entry.recoveryBreaker.hasUnresolvedStop(entry.invocationId);
+  }
   function terminalEntries() {
-    return [...entries.values()].filter(entry => entry.terminalAt !== null).sort((a, b) => a.terminalAt - b.terminalAt);
+    return [...entries.values()].filter(entry => entry.terminalAt !== null && !hasUnresolvedStopMarker(entry))
+      .sort((a, b) => a.terminalAt - b.terminalAt);
   }
   function pruneSeenRequestIds() {
     const cutoff = now() - ttlMs;
@@ -489,6 +508,8 @@ export function createInvocationRegistry({
   return {
     prune,
     liveCount,
+    bindRecoveryOwner,
+    get recoveryOwner() { return recoveryOwner; },
     get size() { return entries.size; },
     /** Test/diagnostic only — not consulted by any admission decision. */
     get seenCount() { return seenRequestIds.size; },
@@ -499,6 +520,7 @@ export function createInvocationRegistry({
       return seenRequestIds.get(requestId)?.invocationId ?? null;
     },
     create(partial) {
+      bindRecoveryOwner(partial.recoveryBreaker);
       prune();
       const invocationId = partial.invocationId ?? randomUUID();
       const entry = { invocationId, terminalAt: null, createdAt: now(), ...partial, invocationId };
@@ -510,12 +532,14 @@ export function createInvocationRegistry({
     update(invocationId, patch) {
       const entry = entries.get(invocationId);
       if (!entry) return undefined;
+      bindRecoveryOwner(patch.recoveryBreaker);
       Object.assign(entry, patch);
       return entry;
     },
     markTerminal(invocationId, patch = {}) {
       const entry = entries.get(invocationId);
       if (!entry) return undefined;
+      bindRecoveryOwner(patch.recoveryBreaker);
       if (entry.terminalAt === null) entry.terminalAt = now();
       Object.assign(entry, patch);
       // An entry becomes eligible for over-capacity eviction the moment it
@@ -559,6 +583,13 @@ async function loadAiwgConfigModule() {
  * AIWG_ROOT-absolute path is the robust way in rather than a relative
  * specifier (whose depth from this file differs between `src/mcp/tools/`
  * and `dist/src/mcp/tools/`). */
+// #2915 final (step 3): the former `resolveRunRecovery` + per-site
+// `canLaunch`/`noteLaunched`/`recordDirectWorkerOutcome` triple is replaced
+// by `run()`'s own single `admitDirectWorker`/`settleDirectWorker` pair
+// (session-launcher.mjs), which `defaultLaunchShellWorker` below BORROWS
+// rather than re-resolving — deleting the duplicate gate that previously
+// rejected its own already-admitted canary (#2915 final review, finding 4).
+
 async function loadRalphExternal(relativeFromToolsRoot) {
   const absolute = path.join(findOwnPackageRoot(), 'tools/ralph-external', relativeFromToolsRoot);
   return import(pathToFileURL(absolute).href);
@@ -604,7 +635,45 @@ function describeGateFailures(failures) {
   return `worker dispatch gate blocked: ${failures.map(f => `${f.signal} (${f.reason})`).join('; ')}`;
 }
 
+// Audited observer; refresh the historical baseline graph after rebase.
+const waitForUnitTerminationBaseline = waitForUnitTermination;
+export { waitForUnitTerminationBaseline as __testOnlyWaitForUnitTerminationBaseline };
+
+// Recovery-disabled dispatch uses the audited preparation path and direct
+// gate/isolation primitives, without entering the current planner's admission.
+// The historical baseline pin/fixture graph must be refreshed after rebase.
+async function defaultLaunchShellWorkerBaseline(invocation, { memoryMaxGb = DEFAULT_MCP_WORKER_MEMORY_MAX_GB, ...options }) {
+  const loadBaselineLaunch = async relative => {
+    if (relative !== 'session-launcher.mjs') return loadRalphExternal(relative);
+    const { checkWorkerDispatch, launchIsolatedWorker } = await loadRalphExternal('lib/worker-isolation.mjs');
+    return {
+      planDirectWorkerLaunch: ({ invocation, live, readers, thresholdOverlay, ...launchOptions }) => {
+        // Shared preparation must provide the conductor-framed params file;
+        // never send the raw brief or launch without it for brief-json.
+        if (invocation?.stdin === 'brief-json' && launchOptions.stdinPath === undefined) {
+          throw new Error('brief-json stdin requires an explicit conductor-framed params file (stdinPath)');
+        }
+        const cwd = invocation?.cwd;
+        const gate = checkWorkerDispatch({ config: launchOptions.config, live, readers, thresholdOverlay,
+          paths: typeof cwd === 'string' && cwd ? [cwd] : undefined });
+        if (!gate.ok) return { launched: false, blocked: true, failures: gate.failures ?? [],
+          diagnostic: describeGateFailures(gate.failures) };
+        return launchIsolatedWorker({
+          command: invocation?.argv?.[0], args: invocation?.argv?.slice(1) ?? [], cwd,
+          stdoutPath: invocation?.stdoutPath, stderrPath: invocation?.stderrPath, envNames: invocation?.envNames,
+          ...launchOptions, gate,
+        });
+      },
+    };
+  };
+  return launchPreparedShellWorker(invocation, { ...options, memoryMaxGb },
+    { loadRalphExternal: loadBaselineLaunch, readBoundedFile, importImpl, describeGateFailures });
+}
+
 async function defaultLaunchShellWorker(invocation, { memoryMaxGb = DEFAULT_MCP_WORKER_MEMORY_MAX_GB, ...options }) {
+  if (options.admission === undefined) {
+    return defaultLaunchShellWorkerBaseline(invocation, { ...options, memoryMaxGb });
+  }
   return launchPreparedShellWorker(invocation, { ...options, memoryMaxGb },
     { loadRalphExternal, readBoundedFile, importImpl, describeGateFailures });
 }
@@ -636,12 +705,22 @@ async function defaultLaunchShellWorker(invocation, { memoryMaxGb = DEFAULT_MCP_
  * already resource-confined, already running with exactly its allowlisted
  * environment.
  */
+const MCP_TRANSPORT_MAX_BUFFER_BYTES = MAX_MCP_FRAME_BYTES;
+
 export class ChildProcessTransport {
-  constructor(child, { terminate = () => child.kill('SIGKILL') } = {}) {
+  constructor(child, { terminate = () => signalChild(child, 'SIGKILL'),
+    deadlineAtMs = null, now = () => Date.now(), isCancelled } = {}) {
     this._child = child;
     this._terminate = terminate;
     this._failure = undefined;
     this._closed = false;
+    this._deadlineAtMs = deadlineAtMs;
+    this._now = now;
+    // #2915 round 8 review 8 (C3): optional cancellation predicate, checked
+    // at the write boundary alongside the deadline — `undefined` whenever
+    // this call is not gated, matching origin/main's own unbounded
+    // transport exactly (see `send()` below).
+    this._isCancelled = typeof isCancelled === 'function' ? isCancelled : undefined;
     this.onmessage = undefined;
     this.onerror = undefined;
     this.onclose = undefined;
@@ -781,6 +860,23 @@ export class ChildProcessTransport {
       this.lastRequestId = message.id;
     }
     const { serializeMessage } = await import('@modelcontextprotocol/sdk/shared/stdio.js');
+    // #2915 round 8 (D5): the write boundary — AFTER the dynamic import's
+    // own `await` (review 7 finding 4: "checking before an SDK call can
+    // precede the actual send by an await... a request can cross its
+    // deadline during that gap"). Stop/cancel cleanup traffic
+    // (`notifications/cancelled`) is exempt — it must always be allowed to
+    // reach the worker, deadline or not.
+    const isStopTraffic = message && typeof message === 'object' && message.method === 'notifications/cancelled';
+    if (this._deadlineAtMs !== null && !isStopTraffic && this._now() >= this._deadlineAtMs) {
+      throw Object.assign(new Error('worker MCP transport deadline exceeded before write'), { code: -32001 });
+    }
+    // #2915 round 8 review 8 (C3): cancellation at the write boundary,
+    // exempting stop/cleanup traffic for the same reason as the deadline
+    // check above — a `notifications/cancelled` notification must always be
+    // allowed to reach the worker, cancelled or not.
+    if (!isStopTraffic && this._isCancelled?.()) {
+      throw Object.assign(new Error('worker MCP transport refused: cancelled before write'), { code: -32800 });
+    }
     return new Promise((resolve, reject) => {
       if (!this._child.stdin) { reject(new Error('worker MCP process has no stdin')); return; }
       const json = serializeMessage(message);
@@ -795,11 +891,11 @@ export class ChildProcessTransport {
     try { child.stdin?.end(); } catch { /* already gone */ }
     await Promise.race([closed, new Promise(resolve => setTimeout(resolve, 2000).unref?.())]);
     if (child.exitCode === null && child.signalCode === null) {
-      try { child.kill('SIGTERM'); } catch { /* already gone */ }
+      try { signalChild(child, 'SIGTERM'); } catch { /* already gone */ }
       await Promise.race([closed, new Promise(resolve => setTimeout(resolve, 2000).unref?.())]);
     }
     if (child.exitCode === null && child.signalCode === null) {
-      try { child.kill('SIGKILL'); } catch { /* already gone */ }
+      try { signalChild(child, 'SIGKILL'); } catch { /* already gone */ }
     }
     this._buffer = undefined;
   }
@@ -817,7 +913,43 @@ export class ChildProcessTransport {
  * registry-declared `server.cwd` (none of today's callers set one) still
  * wins when present, matching the pre-existing precedence for the actual
  * spawn directory. */
-async function defaultLaunchMcpWorkerProcess(server, { allowDegraded, config, name, cwd, memoryMaxGb = DEFAULT_MCP_WORKER_MEMORY_MAX_GB, live, readers, thresholdOverlay }) {
+/** #2915 round 8 (D6): the MCP-native counterpart of
+ * `defaultLaunchShellWorkerBaseline` — see its doc comment for why this
+ * bypasses the CURRENT `planDirectWorkerLaunch` entirely rather than
+ * omitting `admission` and letting that function's own standalone
+ * admission branch run (review 7 finding 13's second bullet, which names
+ * this exact function: "MCP native path, M:941... omitting the disabled
+ * admission loses CLI identity before the flat planner. It performs a new
+ * admission; at 128 occupied reservations, disabled work returns blocked
+ * where baseline launches"). */
+async function defaultLaunchMcpWorkerProcessBaseline(server, { allowDegraded, config, name, cwd, memoryMaxGb = DEFAULT_MCP_WORKER_MEMORY_MAX_GB, live, readers, thresholdOverlay }) {
+  if (server?.type !== 'stdio') {
+    return { launched: false, blocked: true, diagnostic: 'Only stdio MCP worker servers are qualified for direct handoff' };
+  }
+  const { checkWorkerDispatch, launchIsolatedWorker } = await loadRalphExternal('lib/worker-isolation.mjs');
+  const envNames = Object.keys(server.env ?? {});
+  const resolvedCwd = server.cwd ?? cwd;
+  const gate = checkWorkerDispatch({ config, live, readers, thresholdOverlay, paths: typeof resolvedCwd === 'string' && resolvedCwd ? [resolvedCwd] : undefined });
+  if (!gate.ok) return { launched: false, blocked: true, failures: gate.failures ?? [], diagnostic: describeGateFailures(gate.failures) };
+  const launch = await launchIsolatedWorker({
+    name, memoryMaxGb, command: server.command ?? '', args: server.args ?? [], cwd: resolvedCwd,
+    envNames, env: server.env ?? {}, gate, config, allowDegraded, attached: true,
+    // See `defaultLaunchMcpWorkerProcess`: an MCP stdio server needs a live,
+    // writable stdin to receive JSON-RPC requests.
+    stdin: 'open',
+  });
+  if (!launch.launched && launch.diagnostic === undefined) {
+    return { ...launch, diagnostic: describeGateFailures(launch.failures) };
+  }
+  return launch;
+}
+
+async function defaultLaunchMcpWorkerProcess(server, { allowDegraded, config, name, cwd, memoryMaxGb = DEFAULT_MCP_WORKER_MEMORY_MAX_GB, live, readers, thresholdOverlay, admission, invocation, invocationId, dispatchGuard }) {
+  // #2915 round 8 (D6): see `defaultLaunchShellWorker`'s identical guard —
+  // `admission` is only ever present when this attempt is actually gated.
+  if (admission === undefined) {
+    return defaultLaunchMcpWorkerProcessBaseline(server, { allowDegraded, config, name, cwd, memoryMaxGb, live, readers, thresholdOverlay });
+  }
   if (server?.type !== 'stdio') {
     return { launched: false, blocked: true, diagnostic: 'Only stdio MCP worker servers are qualified for direct handoff' };
   }
@@ -829,6 +961,27 @@ async function defaultLaunchMcpWorkerProcess(server, { allowDegraded, config, na
     // See `defaultLaunchShellWorker`: test-only dispatch-gate passthroughs,
     // always undefined for production registrations.
     live, readers, thresholdOverlay,
+    // #2915 review 4 (finding 2): BORROW the caller's own already-admitted
+    // reservation — never a second, independent planner admission for the
+    // native-MCP launch path (the exact "one reservation-aware admission"
+    // requirement `defaultLaunchShellWorker` already honored).
+    //
+    // #2915 round 8 review 8 (C6): the borrowed admission's dispatch
+    // identity must be derived from THIS call's own trusted, resolved
+    // `invocation`/`invocationId` — never the borrowed wrapper's own copies.
+    // `planDirectWorkerLaunch`'s own top-level parameter destructuring
+    // derives `stdinPath`/`stdoutPath`/`stderrPath`/`command`/`args`/`cwd`
+    // AS DEFAULTS from a full `invocation` object when a caller omits them
+    // — correct for the shell launch path, but `WorkerResolvedInvocation`
+    // (src/serve/worker-invocation.ts) sets `stdoutPath`/`stderrPath`
+    // unconditionally for EVERY transport, so passing the full object here
+    // would leak them in and collide with `attached: true` (which forbids
+    // stdio file redirection entirely). Pass only the minimal shape
+    // `selectionDigestFor` actually reads (`{ selected }`) so the digest
+    // still matches the original admission's own selection without
+    // resurrecting any shell-specific field this attached launch never
+    // uses.
+    admission, invocation: invocation ? { selected: invocation.selected } : invocation, invocationId, dispatchGuard,
     // #2895's `attached` mode defaults `stdin: 'closed'` (stdio[0] 'ignore') —
     // correct for its own verification-runner callers, which only read a
     // worker's output. An MCP stdio server needs a live, writable stdin to
@@ -847,6 +1000,8 @@ const mcpServerQueues = new Map(); // serverRef -> { promise: Promise<void>, dep
 /** Test-only observability into the module-level queue map's size — never
  * consulted by any admission/launch decision. */
 export function __testOnlyMcpServerQueueCount() { return mcpServerQueues.size; }
+export { ChildProcessTransport as __testOnlyChildProcessTransport, MCP_TRANSPORT_MAX_BUFFER_BYTES as __testOnlyMcpTransportMaxBufferBytes };
+export { defaultCallMcpWorker as __testOnlyDefaultCallMcpWorker };
 
 /** #2892 D2: bounded per-serverRef serialization queue. Refuses outright
  * (never silently queues unboundedly) once `MAX_MCP_SERVER_QUEUE_DEPTH`
@@ -910,7 +1065,8 @@ function canonicalSchemaDigest(schema) {
   return `sha256:${createHash('sha256').update(JSON.stringify(canonical(schema))).digest('hex')}`;
 }
 
-async function defaultCallMcpWorker(mcpBinding, server, options = {}) {
+// Audited native MCP lifecycle, without recovery admission.
+async function defaultCallMcpWorkerBaseline(mcpBinding, server, options = {}) {
   const {
     sessionIsolation, mcpRegistry, allowDegraded = false, config, name = 'mcp-worker', registerControl,
     memoryMaxGb, mcpSchemas, qualifiedServerDigest, cwd,
@@ -942,7 +1098,7 @@ async function defaultCallMcpWorker(mcpBinding, server, options = {}) {
     const client = new Client({ name: 'aiwg-mcp-worker-invoke', version: '1.0.0' }, { capabilities: {} });
     // B2: gate + launch the MCP worker SERVER process through the same
     // pipeline a shell worker uses — never a bare SDK StdioClientTransport.
-    const launch = await defaultLaunchMcpWorkerProcess(server, { allowDegraded, config, name, cwd, live, readers, thresholdOverlay, ...(memoryMaxGb !== undefined ? { memoryMaxGb } : {}) });
+    const launch = await defaultLaunchMcpWorkerProcessBaseline(server, { allowDegraded, config, name, cwd, live, readers, thresholdOverlay, ...(memoryMaxGb !== undefined ? { memoryMaxGb } : {}) });
     if (!launch.launched) {
       return { outcome: 'blocked', diagnostic: launch.diagnostic ?? 'worker MCP process launch was refused' };
     }
@@ -967,7 +1123,7 @@ async function defaultCallMcpWorker(mcpBinding, server, options = {}) {
           await client.notification({ method: 'notifications/cancelled', params: { requestId: transport.lastRequestId, reason: 'operator-cancel' } });
           return true;
         } catch {
-          try { child.kill('SIGTERM'); return true; } catch { return false; }
+          try { return signalChild(child, 'SIGTERM'); } catch { return false; }
         }
       },
     };
@@ -1037,6 +1193,304 @@ async function defaultCallMcpWorker(mcpBinding, server, options = {}) {
   return sessionIsolation === 'per-call' ? run() : withServerQueue(mcpBinding.serverRef, run);
 }
 
+
+/** #2915 round 8 (D6): the GATED implementation — reached only through the
+ * router below when `options.admission` is present (never omitted-but-falsy;
+ * `run()`'s own `continueGated` always supplies a truthily-gated admission).
+ * No branch here needs to re-check `admission.gated`; by construction it is
+ * always true for the duration of this function. */
+async function defaultCallMcpWorkerGated(mcpBinding, server, options = {}) {
+  const {
+    sessionIsolation, mcpRegistry, allowDegraded = false, config, name = 'mcp-worker', registerControl,
+    memoryMaxGb, mcpSchemas, qualifiedServerDigest, cwd, admission, invocation, invocationId,
+    // #2915 round 8 (D5): the ONE absolute deadline `run()` computed once,
+    // unchanged. Never re-derived here from `mcpBinding.timeoutSeconds` or
+    // `admission.token.mintedAtMs` (that double-subtracted preparation
+    // time — round 8 critique, D5/review 7 finding 4's last bullet).
+    deadlineAtMs = null,
+    // #2915 round 8 review 8 (C3): optional cancellation predicate, checked
+    // alongside every deadline check below (connect/listTools/callTool) and
+    // forwarded into `ChildProcessTransport` for the write boundary. Also
+    // folded into the `dispatchGuard` passed to the launch itself so
+    // cancellation during pre-spawn preparation prevents the spawn too.
+    isCancelled,
+    dispatchGuard,
+    observeStop,
+    // See `defaultLaunchShellWorker`: test-only dispatch-gate passthroughs,
+    // always undefined for production registrations.
+    live, readers, thresholdOverlay,
+  } = options;
+  const run = async () => {
+    try {
+      // D2/F5: recheck the server's own registry qualification immediately
+      // before THIS launch — a serialized/per-instance queue may have held
+      // this call for a while before its turn came up. Checking `enabled`
+      // alone is not requalification: an operator can edit a registry entry's
+      // command/args/env while leaving `enabled: true`, and the ORIGINAL
+      // (admission-time) `server` object passed into this function would
+      // still be the one that gets launched below unless the FRESH
+      // definition is also compared against what was qualified.
+      if (mcpRegistry) {
+        const requalified = await mcpRegistry.get(mcpBinding.serverRef);
+        if (!requalified || requalified.enabled === false) {
+          return { outcome: 'blocked', diagnostic: 'worker MCP server is no longer registered/enabled', dispatchState: 'never-began' };
+        }
+        if (qualifiedServerDigest && serverDefinitionDigest(requalified) !== qualifiedServerDigest) {
+          return { outcome: 'blocked', diagnostic: 'worker MCP server definition changed since qualification; resolve again', dispatchState: 'never-began' };
+        }
+      }
+      // #2915 review 5 ("a second worker over unresolved execution") /
+      // round 8 (D5): a serialized/per-instance queue (D2, below) may have
+      // held this call long enough that the admitted attempt's deadline —
+      // the ONE absolute `deadlineAtMs` `run()` computed once, which
+      // already folds in the canary's own bounded window (min(task
+      // deadline, admission+300s)) when applicable — has since passed. For
+      // a canary, the breaker's own sweep reopens the scope and installs a
+      // blocking marker the moment anything next calls `admit()`/`settle()`
+      // on it (possibly a sibling request), regardless of whether THIS
+      // queued call ever actually launches. Revalidate immediately before
+      // launch, matching the registry-qualification recheck just above:
+      // an expired admission must never launch. Falls back to the
+      // canary-only `admission.token.deadlineMs` check when no caller
+      // supplies `deadlineAtMs` (back-compat for any caller that does
+      // not thread it through) — review 7 finding 4: "an ordinary request
+      // queued beyond its 900-second budget still spawned and completed"
+      // is exactly the plain (non-canary) task-deadline case this widens
+      // to cover.
+      const nowForExpiry = admission.breaker?.nowMs?.() ?? Date.now();
+      const admissionExpired = deadlineAtMs !== null
+        ? nowForExpiry >= deadlineAtMs
+        : !!(admission.token && nowForExpiry > admission.token.deadlineMs);
+      if (admissionExpired) {
+        return { outcome: 'blocked', diagnostic: 'worker admission expired while queued; recovery scope may have reopened', dispatchState: 'never-began' };
+      }
+      // #2915 round 8 review 8 (C3): cancellation requested while this call
+      // was queued (or during the checks above) must prevent the spawn too,
+      // exactly like an expired deadline — never dispatch after the operator
+      // already asked to stop.
+      if (typeof isCancelled === 'function' && isCancelled()) {
+        return { outcome: 'blocked', diagnostic: 'worker dispatch refused: cancelled before process start', dispatchState: 'never-began' };
+      }
+    } catch (error) {
+      // #2915 review 6 (finding 2, "leaked capacity"): a thrown pre-spawn
+      // requalification/expiry check — nothing has been dispatched yet — must
+      // settle the same way an ordinary blocked requalification does, never
+      // propagate as an exception. `continueGated`'s own caller sets
+      // `spawnAttempted` BEFORE invoking this function (it cannot know in
+      // advance whether a real spawn is about to happen), so letting this
+      // throw escape would be treated as genuinely post-spawn uncertainty
+      // and leak the registry's run-slot forever — the exact gap a
+      // native-MCP requalification error (`mcpRegistry.get` throwing rather
+      // than returning falsy/disabled) left open.
+      return { outcome: 'blocked', diagnostic: `worker MCP pre-spawn requalification failed: ${error?.message ?? String(error)}`, dispatchState: 'never-began' };
+    }
+    let stopOverflowWorker;
+    let client;
+    try {
+      // Resolve fallible dependencies and construct the client before spawning.
+      ({ stopOverflowWorker } = await loadRalphExternal('lib/worker-overflow.mjs'));
+      const { Client } = await import('@modelcontextprotocol/sdk/client/index.js');
+      client = new Client({ name: 'aiwg-mcp-worker-invoke', version: '1.0.0' }, { capabilities: {} });
+      // Async setup may consume the remaining admitted canary budget.
+      if (admission?.gated && admission.token
+        && (admission.breaker?.nowMs?.() ?? Date.now()) > admission.token.deadlineMs) {
+        return { outcome: 'blocked', diagnostic: 'worker admission expired while queued; recovery scope may have reopened' };
+      }
+    } catch (error) {
+      return { outcome: 'blocked', diagnostic: `worker MCP pre-spawn setup failed: ${error?.message ?? String(error)}`, dispatchState: 'never-began' };
+    }
+    // B2: gate + launch the MCP worker SERVER process through the same
+    // pipeline a shell worker uses — never a bare SDK StdioClientTransport.
+    const launch = await defaultLaunchMcpWorkerProcess(server, { allowDegraded, config, name, cwd, live, readers, thresholdOverlay, admission, invocation, invocationId, dispatchGuard, ...(memoryMaxGb !== undefined ? { memoryMaxGb } : {}) });
+    if (!launch.launched) {
+      // #2915 round 8 review 8 (C2): a failed/timed-out `systemd-run`
+      // submission does not prove nothing dispatched — carry `launch`'s own
+      // `dispatchState: 'submission-uncertain'` forward so the caller's stop
+      // evidence resolution never treats this as a proven zero-dispatch
+      // refusal. Every other `!launched` case (gate blocked, dispatch-commit
+      // hook abort, degraded-without-allowDegraded) is a proven pre-spawn
+      // refusal: `never-began`.
+      return { outcome: 'blocked', diagnostic: launch.diagnostic ?? 'worker MCP process launch was refused',
+        dispatchState: launch.dispatchState === 'submission-uncertain' ? 'submission-uncertain' : 'never-began',
+        isolationMode: launch.mode ?? null, unitName: launch.unit ?? null, child: launch.child ?? null };
+    }
+    const child = launch.child;
+    // #2915 round 8 review 8 (C2): from here on a real process-start call
+    // happened — every outcome below (including a post-connect 'blocked'
+    // schema-drift refusal) carries this evidence forward so settlement
+    // never manufactures a confirmed stop from an outcome label alone.
+    const isolationEvidence = { dispatchState: 'dispatched', isolationMode: launch.mode ?? null, unitName: launch.unit ?? null, child: child ?? null };
+    // #2915 review 6 (finding 3, "one absolute deadline") / round 8 (D5):
+    // `deadlineAtMs` is the ONE fixed absolute wall-clock deadline `run()`
+    // computed once at admission — never re-derived here. `nowMsFn` is
+    // needed before constructing the transport below, so it moves up from
+    // its former position just before the `connect()` call.
+    const nowMsFn = () => admission.breaker?.nowMs?.() ?? Date.now();
+    const absoluteDeadlineMs = deadlineAtMs;
+    // #2915 review 6 (finding 6b, "changed disabled behavior"): the 10 MiB
+    // unterminated-frame transport bound AND the deadline write-boundary
+    // check (D5) are both enforced unconditionally here — this function is
+    // reached only when gated (see `ChildProcessTransport`'s own doc
+    // comment).
+    const transport = new ChildProcessTransport(child, { terminate: () => stopOverflowWorker(launch),
+      deadlineAtMs: absoluteDeadlineMs, now: nowMsFn, isCancelled });
+    let disconnected = false;
+    let retainOverflowControl = false;
+    transport.onclose = () => { disconnected = true; };
+    const control = {
+      stop: async () => {
+        if (transport._failure) {
+          // The connection is closed after overflow. Reuse the owned launch's
+          // stop authority, including its termination proof, on explicit cancel.
+          await transport._termination;
+          return stopOverflowWorker(launch);
+        }
+        try {
+          // F2: the ACTUAL in-flight JSON-RPC request id (captured at the
+          // transport layer — see `ChildProcessTransport.send`), never the
+          // caller's own opaque `mcpBinding.requestId`, which the worker has
+          // no way to relate to anything it is actually processing.
+          await client.notification({ method: 'notifications/cancelled', params: { requestId: transport.lastRequestId, reason: 'operator-cancel' } });
+          return true;
+        } catch {
+          try { return signalChild(child, 'SIGTERM'); } catch { return false; }
+        }
+      },
+    };
+    // #2915 review 6 (finding 3, "one absolute deadline"): derive EVERY
+    // stage's timeout (connect/initialize, list, call) from ONE fixed
+    // absolute wall-clock deadline, recomputed fresh immediately before
+    // each stage from the time ACTUALLY remaining — never a per-stage
+    // default (the SDK's own 60s `DEFAULT_REQUEST_TIMEOUT_MSEC`) and never a
+    // budget computed once before a serialized/per-instance queue wait that
+    // can itself consume most of it. Reproduced: a native request queued
+    // 250s into a 300s canary window still received a fresh 300-SECOND SDK
+    // call timeout with only 50s actually remaining, while connect/list each
+    // separately spent up to another 60s on top of that — vastly overrunning
+    // the breaker's own canary window.
+    //
+    // #2915 round 8 (D5): `remaining <= 0` REFUSES outright (client-side)
+    // rather than merely passing `timeout: 0` through to the SDK and
+    // trusting its own timer delivery — review 7 finding 4: "at exactly the
+    // canary deadline, connect/list/call all received timeout 0, sent
+    // requests, and completed successfully."
+    // #2915 round 8 review 8 (C3): checked alongside every deadline check
+    // below — cancellation requested while a request is in flight (or
+    // between stages) must prevent the NEXT request, never retroactively
+    // the one already sent.
+    const cancelledNow = () => typeof isCancelled === 'function' && isCancelled();
+    try {
+      registerControl?.(control);
+      if (absoluteDeadlineMs !== null && nowMsFn() >= absoluteDeadlineMs) throw Object.assign(new Error('worker MCP deadline already passed before connect'), { code: -32001 });
+      if (cancelledNow()) throw Object.assign(new Error('worker MCP call cancelled before connect'), { code: -32800 });
+      if (absoluteDeadlineMs !== null) {
+        await client.connect(transport, { timeout: Math.max(0, absoluteDeadlineMs - nowMsFn()) });
+      } else {
+        await client.connect(transport);
+      }
+      // M3: refuse before any brief is sent if the live tool schema has
+      // drifted from what was qualified. Compared CANONICALLY (sorted
+      // keys) on both sides, not via the raw `#2887 mcpToolSchemaDigest`
+      // pin directly — the SDK's own `listTools()` round-trips the wire
+      // JSON through its zod validators, which can legitimately reorder
+      // object keys without changing meaning; a byte-exact digest of the
+      // POST-validation object against a PRE-validation pin would false-
+      // positive on every call. `mcpSchemas` (the #2887 installation-
+      // owner-trusted schema objects, not a client-supplied digest) is the
+      // comparison's source of truth here.
+      if (absoluteDeadlineMs !== null && nowMsFn() >= absoluteDeadlineMs) {
+        throw Object.assign(new Error('worker MCP deadline already passed before listTools'), { code: -32001 });
+      }
+      if (cancelledNow()) throw Object.assign(new Error('worker MCP call cancelled before listTools'), { code: -32800 });
+      const listed = absoluteDeadlineMs !== null
+        ? await client.listTools(undefined, { timeout: Math.max(0, absoluteDeadlineMs - nowMsFn()) })
+        : await client.listTools();
+      const tool = listed?.tools?.find(t => t.name === mcpBinding.tool);
+      if (!tool) {
+        return { outcome: 'blocked', diagnostic: 'qualified MCP tool is no longer advertised by the server', ...isolationEvidence };
+      }
+      // F3 (fix-2892-r2): digest the RAW wire response (plain `JSON.parse`,
+      // retained by the transport — see `ChildProcessTransport`'s doc
+      // comment), never `tool.inputSchema`/`tool.outputSchema` from the
+      // zod-validated `listed` object above — zod's own `z.record()`
+      // reconstruction of `properties` silently drops a member literally
+      // named `__proto__`, so two schemas differing only in that member
+      // would otherwise digest identically and the brief would still be
+      // sent. A raw response this transport cannot account for at all
+      // (should be unreachable — `listed` only resolved because SOME
+      // response arrived) fails closed rather than falling back to the
+      // lossy object.
+      const rawToolsList = transport._rawResponses.get(transport.lastRequestId);
+      const rawTool = rawToolsList?.result?.tools?.find(t => t && t.name === mcpBinding.tool);
+      if (!rawTool) {
+        return { outcome: 'blocked', diagnostic: 'worker MCP tool schema could not be verified against the raw wire response', ...isolationEvidence };
+      }
+      if (mcpSchemas?.input && canonicalSchemaDigest(rawTool.inputSchema) !== canonicalSchemaDigest(mcpSchemas.input)) {
+        return { outcome: 'blocked', diagnostic: 'worker MCP tool input schema digest drifted from the qualified pin', ...isolationEvidence };
+      }
+      if (mcpSchemas?.output) {
+        // A qualified descriptor that requires an output schema is never
+        // satisfied by a worker that stopped advertising one at all —
+        // missing is drift, not "nothing to compare".
+        if (!rawTool.outputSchema) {
+          return { outcome: 'blocked', diagnostic: 'worker MCP tool no longer advertises an output schema the qualified descriptor requires', ...isolationEvidence };
+        }
+        if (canonicalSchemaDigest(rawTool.outputSchema) !== canonicalSchemaDigest(mcpSchemas.output)) {
+          return { outcome: 'blocked', diagnostic: 'worker MCP tool output schema digest drifted from the qualified pin', ...isolationEvidence };
+        }
+      }
+      if (absoluteDeadlineMs !== null && nowMsFn() >= absoluteDeadlineMs) {
+        throw Object.assign(new Error('worker MCP deadline already passed before callTool'), { code: -32001 });
+      }
+      if (cancelledNow()) throw Object.assign(new Error('worker MCP call cancelled before callTool'), { code: -32800 });
+      const callTimeoutMs = absoluteDeadlineMs !== null
+        ? Math.max(0, absoluteDeadlineMs - nowMsFn())
+        : mcpBinding.timeoutSeconds * 1000;
+      const response = await client.callTool({ name: mcpBinding.tool, arguments: mcpBinding.arguments }, undefined, { timeout: callTimeoutMs });
+      // #2915 round 8 (D5): "a response arriving after deadlineAt is a
+      // timeout regardless of SDK timer delivery" — review 7 finding 4: "a
+      // response arriving after the deadline could still return completed."
+      if (absoluteDeadlineMs !== null && nowMsFn() >= absoluteDeadlineMs) {
+        return { outcome: 'timeout', error: new Error('worker MCP response arrived after the deadline'), ...isolationEvidence };
+      }
+      return { outcome: 'responded', response, ...isolationEvidence };
+    } catch (error) {
+      const isTimeout = error?.code === -32001 || /timeout/i.test(String(error?.message ?? ''));
+      const isCancelledError = error?.code === -32800;
+      try { await client.notification({ method: 'notifications/cancelled', params: { requestId: transport.lastRequestId, reason: isTimeout ? 'timeout' : isCancelledError ? 'cancelled' : 'error' } }); } catch { /* delivery only, never stop proof */ }
+      const termination = transport._failure ? await transport._termination : await stopOverflowWorker(launch);
+      retainOverflowControl = !!transport._failure && termination?.termination !== 'confirmed';
+      return { outcome: disconnected ? 'disconnected' : isTimeout ? 'timeout' : 'error', error: transport._failure ?? error,
+        ...isolationEvidence,
+        ...(transport._failure ? { termination: termination?.termination ?? 'uncertain',
+          diagnostic: [transport._failure.code, termination?.diagnostic].filter(Boolean).join('; ') } : {}) };
+    } finally {
+      try { if (!retainOverflowControl) registerControl?.(null); }
+      finally {
+        try {
+          const stopping = client.close();
+          observeStop?.(stopping, isolationEvidence);
+          await stopping;
+        } catch { /* already closed */ }
+      }
+    }
+  };
+  return sessionIsolation === 'per-call' ? run() : withServerQueue(mcpBinding.serverRef, run);
+}
+
+/** #2915 round 8 (D6): thin router, mirroring
+ * `defaultLaunchShellWorker`/`defaultLaunchMcpWorkerProcess`'s identical
+ * pattern — `options.admission` is only ever present when this call is
+ * actually gated (`continueGated` always supplies one; `continueBaseline`
+ * never includes the key at all). Absent routes to the literal baseline
+ * reimplementation; present routes to the gated implementation. */
+async function defaultCallMcpWorker(mcpBinding, server, options = {}) {
+  if (options.admission === undefined) {
+    return defaultCallMcpWorkerBaseline(mcpBinding, server, options);
+  }
+  return defaultCallMcpWorkerGated(mcpBinding, server, options);
+}
+
 // ===========================================================================
 // Health hook extension point (documented, no dependency on #2896 code).
 // ===========================================================================
@@ -1079,8 +1533,12 @@ function publicStatus(entry, healthHook) {
 // ===========================================================================
 
 const inputSchema = z.object({
-  operation: z.enum(['run', 'status', 'cancel']),
+  // #2915 round 8 (D4): `reconcile_stopped` is an explicit operator-
+  // authorized reconciliation operation on this SAME handler (never a
+  // mailbox file, never a new breaker) — see `reconcileStopped` below.
+  operation: z.enum(['run', 'status', 'cancel', 'reconcile_stopped', 'reset_recovery_scope']),
   invocation_id: z.string().uuid().optional(),
+  scope_id: z.string().min(1).max(512).optional(),
   request_id: z.string().min(1).max(128).regex(/^[a-zA-Z0-9_.:-]+$/).optional(),
   role: z.enum(['efficiency', 'coding', 'reasoning']).optional(),
   task: z.string().min(1).max(256).optional(),
@@ -1089,6 +1547,13 @@ const inputSchema = z.object({
   workdir: z.string().min(1).optional(),
   final_output: z.string().min(1).optional(),
   transport: z.enum(['shell', 'mcp']).default('shell'),
+  // #2915 step 4 (retry linkage): conductor-declared predecessor invocation
+  // id. Accepted and shape-validated here; `run()` below refuses explicitly
+  // rather than silently ignoring it (no server-owned capture-root
+  // configuration exists yet for the MCP shell-launch path — see
+  // session-launcher.mjs `verifyRetryPredecessor`, which the CLI entry
+  // point already uses). Omission is unrelated work, as always.
+  retry_of: z.string().uuid().optional(),
 }).strict();
 
 /**
@@ -1122,7 +1587,14 @@ export async function registerWorkerInvokeToolset(server, options = {}) {
   const loadWorkerInputsImpl = options.loadWorkerInputs ?? defaultLoadWorkerInputs;
   const launchShellWorkerImpl = options.launchShellWorker ?? defaultLaunchShellWorker;
   const callMcpWorkerImpl = options.callMcpWorker ?? defaultCallMcpWorker;
-  const waitForUnitImpl = options.waitForUnitTermination ?? waitForUnitTermination;
+  // Both continuations use the audited observer and hardened stop controls.
+  const waitForUnitTerminationOverride = options.waitForUnitTermination;
+  // #2915 review 5 ("a second worker over unresolved execution"): the
+  // degraded-isolation shell wait path below shares the launcher's own
+  // bounded SIGTERM-then-SIGKILL escalation (`terminateChildWithGrace`)
+  // rather than sending an unobserved SIGTERM alone.
+  const terminateChildImpl = options.terminateChildWithGrace
+    ?? (async child => (await loadRalphExternal('session-launcher.mjs')).terminateChildWithGrace(child));
   const mcpWorkerMemoryMaxGb = options.mcpWorkerMemoryMaxGb; // undefined -> defaultLaunchMcpWorkerProcess's own fallback
   // Test-only: `planDirectWorkerLaunch`'s own dispatch-gate passthroughs
   // (`checkWorkerDispatch({ live, readers, thresholdOverlay })`), forwarded
@@ -1151,7 +1623,40 @@ export async function registerWorkerInvokeToolset(server, options = {}) {
     return { role: input.role, task: input.task, group: input.group, brief, workdir, final_output: finalOutput, transport: input.transport };
   }
 
+  /**
+   * #2915 round 8 (D5, review 7 finding 9): "MCP discards the settlement
+   * promise and its diagnostic." `runInner` is the full implementation
+   * (unchanged below); `captureSettlementPromise`, when called, hands this
+   * run's ONE cached ledger-settlement promise (`settleDirectWorker`'s own
+   * return value, see `settleRecovery` below) up to `run()`'s thin wrapper,
+   * which awaits it at this function's one true return boundary and folds
+   * any refund-failure diagnostic it carries into the result — instead of
+   * letting that promise, and whatever it resolves to, simply vanish.
+   */
   async function run(input) {
+    let settlementPromise = null;
+    const transitions = [];
+    let result = await runInner(input, promise => { settlementPromise = promise; }, event => {
+      transitions.push(event.summary);
+      (options.onRecoveryTransition ?? (event => console.error(event.summary)))(event);
+    });
+    if (settlementPromise) {
+      let diagnostic = null;
+      try { diagnostic = await settlementPromise; } catch { /* never fail a run on diagnostic retrieval */ }
+      if (diagnostic && result?.invocationId) {
+        const current = registry.get(result.invocationId);
+        if (current) {
+          result = registry.update(result.invocationId, { diagnostics: [...(current.diagnostics ?? []), diagnostic] });
+        }
+      }
+    }
+    if (transitions.length && result?.invocationId) {
+      result = registry.update(result.invocationId, { diagnostics: [...(result.diagnostics ?? []), ...transitions] });
+    }
+    return result;
+  }
+
+  async function runInner(input, captureSettlementPromise, onTransition) {
     // M1: request_id is required, and admission (capacity + replay check +
     // reservation) is entirely synchronous — no `await` between the checks
     // and `registry.create()` — so no concurrent `run()` call can observe a
@@ -1160,13 +1665,23 @@ export async function registerWorkerInvokeToolset(server, options = {}) {
     if (!input.role || !input.task || !input.group || !input.brief || !input.workdir || !input.final_output) {
       throw new Error('Incomplete worker invocation');
     }
+    // #2915 step 4: `retry_of` has no server-owned capture-root
+    // configuration to verify a predecessor against on this bridge yet
+    // (see the schema comment above) — refuse explicitly, before any
+    // capacity is reserved, rather than silently accepting and ignoring a
+    // conductor's retry declaration. Predates round 8 and applies
+    // unconditionally (not a gating concern): `retry_of` support is simply
+    // not implemented on this bridge yet, for gated or not-gated callers
+    // alike, so origin/main's own schema (which has no `retry_of` field at
+    // all) never had an equivalent case to diverge from.
+    if (input.retry_of !== undefined) throw new Error('retry_of is not yet supported on the MCP worker-invoke bridge (OG_RETRY_UNSUPPORTED_MCP)');
     if (!registry.canStart()) throw new Error('Worker invocation capacity is reserved; no live run slot is available');
     const existing = registry.claimRequestId(input.request_id);
     if (existing) throw new Error('Worker request_id was already used; mint a fresh request_id instead of replaying');
     const entry = registry.create({ requestId: input.request_id, transport: input.transport, status: 'running', termination: 'running' });
     let request;
     let outputReservation;
-    let mayHaveLaunched = false;
+    const execution = { mayHaveLaunched: false };
     let reservationCleanup;
     const cleanupReservation = () => reservationCleanup ??= (async () => {
       if (!outputReservation) return;
@@ -1181,7 +1696,7 @@ export async function registerWorkerInvokeToolset(server, options = {}) {
       }
     })();
     const markTerminal = async update => {
-      if (!mayHaveLaunched) await cleanupReservation();
+      if (!execution.mayHaveLaunched) await cleanupReservation();
       return registry.markTerminal(entry.invocationId, update);
     };
     try {
@@ -1195,6 +1710,9 @@ export async function registerWorkerInvokeToolset(server, options = {}) {
       registry.markTerminal(entry.invocationId, { status: 'blocked', termination: 'confirmed', diagnostics: [error.message] });
       throw error;
     }
+
+    // Shared pre-dispatch preparation owns capacity and output cleanup.
+    let prefix;
     try {
       try {
         outputReservation = await reserveFinalOutput(request.final_output);
@@ -1208,7 +1726,138 @@ export async function registerWorkerInvokeToolset(server, options = {}) {
       if (plan.invocation?.readiness !== 'launchable') {
         return markTerminal({ status: 'blocked', termination: 'confirmed', diagnostics: plan.diagnostics ?? [] });
       }
-      const invocation = plan.invocation;
+      prefix = { root, snapshot, drivers, invocation: plan.invocation };
+    } catch (error) {
+      return markTerminal({ status: 'blocked', termination: 'confirmed', diagnostics: [error.message] });
+    }
+    const { root, snapshot, drivers, invocation } = prefix;
+
+    // =========================================================================
+    // #2915 round 8 (D6): ONE decision, immediately after the prefix, from
+    // the launcher's own pure eligibility predicate,
+    // `directRecoveryEligibility` (session-launcher.mjs) — the SAME
+    // function `launchOneWorker`'s own not-gated/gated split and
+    // `admitDirectWorker` itself both call, so this decision cannot drift
+    // out of sync with either (round 8 critique, D6; the decision is
+    // structurally one function, not three matching conditions). It
+    // consults, in order, the global switch, the per-CLI switch,
+    // `canVerifyAttempt`, and an explicit breaker override, and reserves
+    // nothing — every ineligible answer returns `{ gated: false }` before
+    // ever touching the breaker or the ledger. The only check made BEFORE
+    // even importing the recovery module is the global switch
+    // (`config.parallelism.worker_dispatch`) — matching the SAME field
+    // `session-launcher.mjs`'s own call sites resolve as `gate.enabled`
+    // (`checkWorkerDispatch`) — so a globally disabled deployment never
+    // imports the recovery module at all (#2915 review 4 finding 7),
+    // exactly like origin/main never having this feature.
+    // =========================================================================
+    const dispatchGateEnabled = !!snapshot.config?.parallelism?.worker_dispatch;
+    let admission;
+    let recoveryModule;
+    let admissionGuard;
+    if (!dispatchGateEnabled) {
+      admission = { gated: false };
+    } else {
+      try {
+        recoveryModule = await loadRalphExternal('session-launcher.mjs');
+        const eligibility = recoveryModule.directRecoveryEligibility({
+          gateEnabled: dispatchGateEnabled, config: snapshot.config, invocation, drivers, scopedBreaker: options.scopedBreaker,
+        });
+        if (!eligibility.gated) {
+          // Not eligible (per-CLI switch, `canVerifyAttempt`, or an
+          // explicit breaker override) — nothing was reserved; `admission`
+          // is exactly the predicate's own `{ gated: false, reason? }`.
+          admission = eligibility;
+        } else {
+          // #2915 review 4 (finding 8): consult the same per-task-chain
+          // allowance ledger the launcher path uses, keyed off the SAME
+          // stable digest and the SAME resolved `invocation.limits.
+          // maxAttempts` -- no new configuration, just the existing
+          // ceiling already resolved above by `resolveWorkerInvocation`.
+          // MCP has no server-owned capture root to persist a
+          // cross-process ledger file under, so `captureRoot` is
+          // intentionally omitted: the ledger falls back to this
+          // process's own in-memory map (see `reserveDirectWorkerAllowance`
+          // in session-launcher.mjs). That still enforces the allowance
+          // correctly WITHIN this server process -- including across
+          // concurrent sibling retries, which serialize on the same
+          // in-process reservation check -- but it is explicitly NOT
+          // cross-process-safe: a second MCP server process, or a restart
+          // of this one, starts the count over for the same task chain.
+          const breaker = options.scopedBreaker ?? recoveryModule.getDirectRecoveryBreaker();
+          registry.bindRecoveryOwner(breaker);
+          const startedAtMs = breaker.nowMs();
+          admissionGuard = {
+            nowMs: () => breaker.nowMs(),
+            deadlineAtMs: startedAtMs + Math.min(invocation.health?.hardTimeoutSeconds ?? Infinity,
+              invocation.limits.wallSeconds, invocation.transport === 'mcp' ? invocation.mcp.timeoutSeconds : Infinity) * 1000,
+            isCancelled: () => !!registry.get(entry.invocationId)?.cancelRequested,
+          };
+          const taskChainDigest = await recoveryModule.stableTaskChainDigest(request, invocation.briefDigest ?? null);
+          admission = await recoveryModule.admitDirectWorker({
+            gateEnabled: dispatchGateEnabled, config: snapshot.config,
+            invocation, invocationId: entry.invocationId, drivers, scopedBreaker: breaker, dispatchGuard: admissionGuard,
+            taskChainDigest, maxAttempts: invocation.limits?.maxAttempts, onTransition,
+          });
+        }
+      } catch (error) {
+        // #2915 P0 (fail closed, no leaked slot): this admission call runs
+        // AFTER `registry.create()` already reserved this run's capacity/
+        // identity slot. Any exception here (bad breaker state, a thrown
+        // import, a malformed gate result) must refuse the launch the same
+        // way an ordinary recovery-scope refusal does — `markTerminal`,
+        // freeing the reservation. A pre-spawn breaker error is not an
+        // uncertain worker outcome: no worker ever ran.
+        return markTerminal({ status: 'blocked', termination: 'confirmed',
+          diagnostics: [`recovery admission failed closed: ${error?.message ?? String(error)}`] });
+      }
+    }
+    if (admission.refused) {
+      // #2915 review 4 (finding 8): a ledger-exhaustion refusal has no
+      // covering scope (`blockedBy` is empty) -- fall back to the
+      // refusal's own code/reason so the diagnostic is never an empty
+      // "recovery scope open: " for that case.
+      const blockedBy = admission.refused.blockedBy?.length ? admission.refused.blockedBy.join(', ')
+        : (admission.refused.code ?? admission.refused.reason ?? 'unknown');
+      // #2915 round 8 (D4, C4): a `blocking-markers:<N>` component names
+      // genuinely unresolved execution occupying reservation slots (never
+      // mere backoff) — point at the exact reachable reconciliation route
+      // for it, this tool's own `reconcile_stopped` operation, rather than
+      // leaving the operator to go looking for one.
+      const markerNote = admission.refused.blockedBy?.some(b => b.startsWith('blocking-markers:'))
+        ? "; unresolved reservations can be reconciled via this tool's 'reconcile_stopped' operation (see 'status' with no invocation_id for the pending list)"
+        : '';
+      return markTerminal({ status: 'blocked', termination: 'confirmed',
+        diagnostics: [`recovery scope open: ${blockedBy}${markerNote}${admission.refused.reason ? `; ${admission.refused.reason}` : ''}`] });
+    }
+    // #2915 round 8 (D4): track which breaker instance actually owns this
+    // invocation's reservation (when gated) — the `reconcile_stopped`
+    // operation and the no-id `status` listing both need to reach the
+    // SAME breaker a later `admitDirectWorker` call used, not a fresh
+    // default. Internal bookkeeping only — never surfaced by `publicStatus`.
+    if (admission.breaker) {
+      try {
+        registry.update(entry.invocationId, { recoveryBreaker: admission.breaker });
+      } catch (error) {
+        const diagnostic = await recoveryModule.settleDirectWorker(admission, { kind: 'uncertain', confirmedStop: true });
+        return markTerminal({ status: 'blocked', termination: 'confirmed',
+          diagnostics: [error.message, diagnostic].filter(Boolean) });
+      }
+    }
+
+    // Share reservation ownership; recovery accounting belongs only to the gated continuation.
+    const ctx = { entry, request, root, snapshot, drivers, invocation, execution, cleanupReservation, markTerminal };
+    if (admission.gated) {
+      return continueGated(ctx, { admission, recoveryModule, captureSettlementPromise, admissionGuard });
+    }
+    return continueBaseline(ctx);
+  }
+
+  // Recovery-disabled execution follows current main's audited lifecycle.
+  // Only recovery admission/accounting is omitted; stop and cleanup stay active.
+  async function continueBaseline(ctx) {
+    const { entry, request, root, snapshot, drivers, invocation, execution, cleanupReservation, markTerminal } = ctx;
+    try {
       // F4 (fix-2892-r2, formerly part of M5): per operator decision, the
       // MCP path REQUIRES the structured WorkerDirectBrief — a probe showed
       // a plaintext brief (or a JSON brief swapped to plaintext between
@@ -1247,20 +1896,20 @@ export async function registerWorkerInvokeToolset(server, options = {}) {
       let observation;
       let rawOutput;
       if (invocation.transport === 'shell') {
-        mayHaveLaunched = true;
+        execution.mayHaveLaunched = true;
         const launch = await launchShellWorkerImpl(invocation, { allowDegraded, config: snapshot.config,
           name: `mcp-${entry.invocationId.slice(0, 8)}`, memoryMaxGb: options.shellWorkerMemoryMaxGb,
           driver: drivers[invocation.selected.cli], servedRoot: root, stdinRuntimeRoot: options.stdinRuntimeRoot, ...gateInputs });
         registry.update(entry.invocationId, { isolationMode: launch.mode ?? null });
         if (!launch.launched && !launch.launchAttempted) {
-          mayHaveLaunched = false;
+          execution.mayHaveLaunched = false;
           return markTerminal({ status: 'blocked', termination: 'confirmed', diagnostics: [launch.diagnostic ?? 'worker launch was refused'] });
         }
         // M2: a live stop handle for the duration of this call, so an
         // explicit `cancel` can actually stop the isolated unit / kill the
         // child, not just record that cancellation was requested.
         const control = buildShellStopControl(launch, {
-          waitForUnit: waitForUnitImpl,
+          waitForUnit: (waitForUnitTerminationOverride ?? waitForUnitTerminationBaseline),
           stopUnit: options.stopWorkerUnit,
           killUnit: options.killWorkerUnit,
           graceMs: options.shellStopGraceMs ?? (invocation.health?.terminateGraceSeconds ?? 1) * 1000,
@@ -1269,7 +1918,7 @@ export async function registerWorkerInvokeToolset(server, options = {}) {
             await Promise.resolve().then(() => launch.cleanup?.()).catch(() => {});
             const live = registry.get(entry.invocationId);
             if (live?.terminalAt !== null) return;
-            if (live.status === 'uncertain') {
+            if (live.status === 'uncertain' || live.status === 'blocked') {
               registry.markTerminal(entry.invocationId, { control: null, termination: 'confirmed',
                 status: live.cancelRequested ? 'cancelled' : 'failed' });
             } else registry.update(entry.invocationId, { control: null, termination: 'confirmed' });
@@ -1292,7 +1941,7 @@ export async function registerWorkerInvokeToolset(server, options = {}) {
           console.error('[worker-invoke] stdin cleanup failed after confirmed termination');
         });
         if (!launch.launched) {
-          mayHaveLaunched = false;
+          execution.mayHaveLaunched = false;
           return markTerminal({ control: null, status: 'failed', termination: 'confirmed',
             diagnostics: [launch.diagnostic ?? 'worker launch failed; termination confirmed'] });
         }
@@ -1312,7 +1961,7 @@ export async function registerWorkerInvokeToolset(server, options = {}) {
         // admission, so a queued launch can detect a registry edit that
         // happened while it was waiting (see `serverDefinitionDigest`).
         const qualifiedServerDigest = serverDefinitionDigest(mcpServer);
-        mayHaveLaunched = true;
+        execution.mayHaveLaunched = true;
         const result = await callMcpWorkerImpl(invocation.mcp, mcpServer, {
           sessionIsolation: invocation.mcp.sessionIsolation, mcpRegistry, allowDegraded, config: snapshot.config,
           // #2892 (CI fix): the resolved invocation's own worktree
@@ -1381,8 +2030,8 @@ export async function registerWorkerInvokeToolset(server, options = {}) {
         result: assembled?.result ?? { claims },
       });
     } catch (error) {
-      if (error.workerNotLaunched) mayHaveLaunched = false;
-      if (!mayHaveLaunched) {
+      if (error.workerNotLaunched) execution.mayHaveLaunched = false;
+      if (!execution.mayHaveLaunched) {
         return markTerminal({ status: 'blocked', termination: 'confirmed', diagnostics: [error.message] });
       }
       if (registry.get(entry.invocationId)?.termination === 'confirmed') {
@@ -1395,6 +2044,598 @@ export async function registerWorkerInvokeToolset(server, options = {}) {
     }
   }
 
+  /**
+   * #2915 round 8 (D6): the GATED continuation — reached only when the
+   * decision point in `runInner` already admitted (or is borrowing) a
+   * breaker reservation. `admission.gated` is therefore always true for the
+   * duration of this function; no branch here needs to re-check it (the
+   * previous worker's scattered `admission?.gated` conditionals are gone by
+   * construction, not by review).
+   */
+  async function continueGated(ctx, { admission, recoveryModule, captureSettlementPromise, admissionGuard }) {
+    const { entry, request, root, snapshot, drivers, invocation, execution, cleanupReservation, markTerminal } = ctx;
+    // #2915 final: `recoverySettled`/`spawnAttempted` are function-scoped
+    // (not inside the try block below) so the catch-all at the end of this
+    // function can also settle this run's admission (#2915 final review,
+    // finding 2: a thrown error reaching that catch previously left the
+    // reservation live with zero capacity recovered — the exact "slot leak"
+    // the final review named).
+    let recoverySettled = false;
+    // #2915 review 5 (finding 2b, "leaked capacity"): distinguishes PROVEN
+    // pre-spawn exceptions (nothing ever ran -- the registry run-slot must
+    // be released) from post-spawn uncertainty (a worker process/call
+    // genuinely started and may still be running -- the slot correctly
+    // stays live per M2). Set true only once a shell launch or MCP call is
+    // confirmed to have actually started (past every "never launched"/
+    // "blocked" refusal below), never merely attempted.
+    let spawnAttempted = false;
+    let isolationEvidence = null;
+    let settlementPromise;
+    let settlementStarted;
+    let cancelFollowUp;
+    let neverExecutedStop = false;
+    const settlementReady = new Promise(resolve => { settlementStarted = resolve; });
+    const resolveEvidence = evidence => neverExecutedStop && evidence?.isolationMode === 'systemd-unit'
+      && evidence.unitName === isolationEvidence?.unitName
+      ? Promise.resolve({ stop: 'confirmed', confirmedStop: true }) : recoveryModule.resolveStopEvidence({
+      ...evidence, getStatus: options.isolationStatus, stopUnit: options.stopUnit,
+      terminateChild: terminateChildImpl,
+    });
+    const reconcileEvidence = async evidence => {
+      await settlementReady;
+      await settlementPromise;
+      if (!admission.breaker?.hasUnresolvedStop?.(entry.invocationId)) return true;
+      const resolved = await resolveEvidence({ ...evidence, stopFirst: false });
+      if (resolved.confirmedStop) {
+        cancelFollowUp?.();
+        const reconciled = admission.breaker?.reconcileStopEvidence?.({ invocationId: entry.invocationId, confirmedStop: true });
+        if ((reconciled?.released ?? 0) > 0) registry.markTerminal(entry.invocationId, {});
+      }
+      return resolved.confirmedStop;
+    };
+    // The outward result and execution protection have independent lifetimes.
+    // Retain pending escalation and a fixed, bounded sequence of unit observations.
+    const observeStop = (stopping, evidence) => {
+      Promise.resolve(stopping).then(() => reconcileEvidence(evidence)).catch(() => {});
+    };
+    let followUpScheduled = false;
+    const observeLater = evidence => {
+      if (followUpScheduled || evidence?.isolationMode !== 'systemd-unit' || !evidence.unitName) return;
+      followUpScheduled = true;
+      cancelFollowUp = recoveryModule.observeLateStopEvidence(() => reconcileEvidence(evidence));
+    };
+    const settleRecovery = (outcome) => {
+      if (recoverySettled) return;
+      recoverySettled = true;
+      try {
+        // #2915 round 8 (D5, review 7 finding 9): `settleDirectWorker`
+        // RETURNS a promise (resolving to a bounded refund-failure
+        // diagnostic string, or `null`) — capture it instead of discarding
+        // it, so `run()`'s wrapper above can await it and surface the
+        // diagnostic in the result.
+        settlementPromise = recoveryModule.settleDirectWorker(admission, {
+          ...outcome, callerAborted: !!registry.get(entry.invocationId)?.cancelRequested,
+        });
+        captureSettlementPromise?.(settlementPromise);
+      } catch { /* recovery accounting must never fail a run */ }
+      settlementStarted();
+      if (!outcome.confirmedStop) observeLater(isolationEvidence);
+    };
+    let recoveryDeadlineAtMs = 0;
+    const settleObservedFailure = async (result, failureHint = '') => {
+      await recoveryModule.observeLauncherRecoveryOutcome({ invocation, result, failureHint,
+        installation: drivers[invocation.selected.cli]?.qualification?.installation, breaker: admission.breaker,
+        timeoutMs: () => Math.min(10_000, recoveryDeadlineAtMs - admission.breaker.nowMs()),
+        beforeRequest: async () => !registry.get(entry.invocationId)?.cancelRequested,
+        onDispatch: () => recoveryModule.chargeDirectWorkerDiagnostic(admission, {
+          deadlineAtMs: recoveryDeadlineAtMs, nowMs: admission.breaker.nowMs,
+          isCancelled: () => !!registry.get(entry.invocationId)?.cancelRequested }) });
+      settleRecovery({ ...recoveryModule.classifyAttemptForSettlement(invocation, result, admission),
+        confirmedStop: result.confirmedStop });
+    };
+    try {
+      // #2915 round 8 review 8 (C3): ONE absolute wall-clock deadline for
+      // this attempt, computed HERE — at the very top of this function,
+      // BEFORE any brief preparation — as the minimum of the task/health
+      // budget, the transport (mcp per-call) budget when this is an
+      // mcp-transport attempt, and the canary's own bounded window when
+      // this admission is the breaker's canary, on the admission's own
+      // monotonic clock. Passed down UNCHANGED from here on; NEVER
+      // re-derived from an already-shortened duration. Computing this AFTER
+      // brief preparation (the former position, right before the
+      // transport-specific branches below) let preparation time elapse for
+      // free: reproduced spending 60s in post-admission brief
+      // validation/digest computation while a 30s native MCP call still
+      // spawned and completed, because the deadline was derived from a
+      // fresh `deadlineClockNow()` reading taken only after that
+      // preparation finished (round 8 review 8, C3; review 7 finding 4's
+      // last bullet).
+      const taskDeadlineMs = Math.min(invocation.health?.hardTimeoutSeconds ?? invocation.limits.wallSeconds, invocation.limits.wallSeconds) * 1000;
+      const deadlineClockNow = () => admission.breaker?.nowMs?.() ?? Date.now();
+      const deadlineCandidatesMs = [admissionGuard?.deadlineAtMs ?? ((admission.startedAtMs ?? deadlineClockNow()) + taskDeadlineMs)];
+      if (invocation.transport === 'mcp') deadlineCandidatesMs.push((admission.startedAtMs ?? deadlineClockNow()) + invocation.mcp.timeoutSeconds * 1000);
+      if (admission.token?.canaryKeys?.length > 0) deadlineCandidatesMs.push(admission.token.deadlineMs);
+      const deadlineAtMs = Math.min(...deadlineCandidatesMs);
+      recoveryDeadlineAtMs = deadlineAtMs;
+      // #2915 round 8 review 8 (C3): cancellation predicate, read from the
+      // registry's own live `cancelRequested` flag — set by `cancel()`
+      // (M2) at any point during this run's lifetime, including before any
+      // launch/control handle exists. Folded into `dispatchGuard` below so
+      // the leaf dispatch-commit hook (D2) refuses to spawn a cancelled
+      // attempt, and threaded into the native-MCP per-request/write-boundary
+      // checks so cancellation during pre-spawn preparation prevents the
+      // spawn and any request (round 8 review 8, C3).
+      const isCancelled = () => !!registry.get(entry.invocationId)?.cancelRequested;
+      // #2915 round 8 review 8 (C3): passed to both launch paths so the D2
+      // leaf hook re-checks deadline/cancellation immediately before the
+      // real process-start call, after every preparation step has run.
+      const dispatchGuard = { deadlineAtMs, nowMs: deadlineClockNow, isCancelled };
+      // F4 (fix-2892-r2, formerly part of M5): per operator decision, the
+      // MCP path REQUIRES the structured WorkerDirectBrief — a probe showed
+      // a plaintext brief (or a JSON brief swapped to plaintext between
+      // launch and result assembly) was accepted, bypassing digest
+      // verification entirely and completing anyway, because
+      // `tryAssembleDirectResult` below treats a non-JSON brief as "nothing
+      // to assemble against" and best-effort no-ops rather than refusing.
+      // Fixed: for `mcp` transport ONLY, validate — AT ADMISSION, BEFORE any
+      // launch — that the brief parses as a WorkerDirectBrief (#2890/#2879
+      // codec), and pin ITS digest ourselves (never relying on whatever
+      // `invocation.briefDigest` #2887's own resolver may or may not have
+      // set for this transport). A non-structured or schema-invalid brief
+      // refuses before any worker ever runs.
+      let mcpBriefDigest;
+      if (invocation.transport === 'mcp') {
+        let briefBytes;
+        try {
+          briefBytes = await readBoundedFile(request.brief, 262144, root);
+        } catch {
+          // #2915 review 4 (finding 2): this pre-spawn refusal happens
+          // AFTER admission (above) but was never settling it — a leaked
+          // reservation on every unreadable MCP brief.
+          //
+          // #2915 review 6 (finding 4, "stop evidence on every settlement"):
+          // zero workers were ever dispatched for this reservation — settle
+          // with `confirmedStop: true` so a canary whose own deadline has
+          // already passed (e.g. an expired queued request) releases its
+          // reservation outright instead of leaving a permanent blocking
+          // marker behind for an attempt that never ran at all.
+          settleRecovery({ kind: 'uncertain', confirmedStop: true });
+          return markTerminal({ status: 'blocked', termination: 'confirmed', diagnostics: ['OG_BRIEF_UNREADABLE'] });
+        }
+        try {
+          const { assertValidWorkerPayload } = await loadMissionProtocol();
+          assertValidWorkerPayload('workerDirectBrief', JSON.parse(briefBytes.toString('utf8')));
+        } catch (error) {
+          // Fixed-vocabulary diagnostic only — NEVER the raw JSON.parse/
+          // validator message, exactly like M5's own `parseWorkerFinal`
+          // diagnostic below. A duplicate-key/planted-marker probe showed
+          // this exact kind of path can otherwise reflect attacker/worker-
+          // controlled input text straight back out to the caller.
+          //
+          // #2915 review 6 (finding 4): zero workers dispatched — same
+          // proven-never-dispatched settlement as above.
+          settleRecovery({ kind: 'uncertain', confirmedStop: true });
+          return markTerminal({ status: 'blocked', termination: 'confirmed', diagnostics: [typeof error?.code === 'string' ? error.code : 'OG_BRIEF_NOT_STRUCTURED'] });
+        }
+        mcpBriefDigest = `sha256:${createHash('sha256').update(briefBytes).digest('hex')}`;
+      }
+      let observation;
+      let rawOutput;
+      // #2915 review 5 ("a second worker over unresolved execution"): a
+      // SEPARATE fact from `kind` threaded into every `settleRecovery` call
+      // below — whether THIS attempt's own descendant tree is launcher-
+      // confirmed stopped, so a settlement arriving against an already-
+      // canary-deadline-expired reservation can resolve that reservation's
+      // blocking marker (see `ScopedFailureBreaker.settle()`). Stays false
+      // for native MCP (response completion is not stop proof).
+      let confirmedStop = false;
+      if (invocation.transport === 'shell') {
+        // #2915 round 8 (D2, replaces the former `await debitRecovery()`
+        // call here): the ledger debit now happens INSIDE the dispatch-
+        // commit hook `planDirectWorkerLaunch`'s borrowed-admission branch
+        // constructs (session-launcher.mjs), invoked by `launchIsolatedWorker`
+        // itself immediately before the real process-start call — never
+        // here, before the dispatch resource gate inside `launchShellWorkerImpl`
+        // has even run. This closes the "MCP debits before queue/resource
+        // refusals" gap (#2915 round 8 critique, D2): a resource-gate
+        // refusal below now spends nothing.
+        //
+        // #2915 round 8 (D5): checked before spawn. A deadline already
+        // passed before this bridge even attempted to spawn is a proven
+        // zero-dispatch refusal, exactly like any other pre-spawn gate
+        // refusal.
+        //
+        // #2915 round 8 review 8 (C3): cancellation itself is deliberately
+        // NOT re-checked here (unlike the deadline) -- the authoritative
+        // "prevent the spawn" enforcement for cancellation lives in
+        // `dispatchGuard` below, re-checked inside the LEAF dispatch-commit
+        // hook (D2) after every real preparation step the actual launch
+        // performs. Adding a second, earlier check at this bridge level,
+        // ahead of even invoking `launchShellWorkerImpl`, would race an
+        // operator cancel arriving while an in-flight (but not yet
+        // resolved) launch call is still legitimately starting, and
+        // mis-refuse a launch that was already under way.
+        if (deadlineClockNow() >= deadlineAtMs) {
+          settleRecovery({ kind: 'uncertain', confirmedStop: true });
+          return markTerminal({ status: 'blocked', termination: 'confirmed', diagnostics: ['worker dispatch deadline already passed before spawn'] });
+        }
+        // `spawnAttempted` is still set BEFORE calling, not after inspecting
+        // the result -- `launchShellWorkerImpl` itself may already have side
+        // effects (dispatch gate sampling, resource checks, or a genuine
+        // spawn) before it returns or throws, so a throw from WITHIN it can
+        // never be proven to be pre-spawn. From here on, any exception
+        // reaching the outer catch-all is post-spawn uncertainty.
+        spawnAttempted = true;
+        execution.mayHaveLaunched = true;
+        const launch = await launchShellWorkerImpl(invocation, { allowDegraded, config: snapshot.config,
+          name: `mcp-${entry.invocationId.slice(0, 8)}`, memoryMaxGb: options.shellWorkerMemoryMaxGb,
+          driver: drivers[invocation.selected.cli], servedRoot: root, stdinRuntimeRoot: options.stdinRuntimeRoot, admission, invocationId: entry.invocationId, dispatchGuard, ...gateInputs });
+        let failureHint = Buffer.alloc(0);
+        const observeHint = chunk => {
+          if (failureHint.length < 8192) failureHint = Buffer.concat([failureHint, Buffer.from(chunk).subarray(0, 8192 - failureHint.length)]);
+        };
+        launch.child?.stderr?.on('data', observeHint);
+        isolationEvidence = { isolationMode: launch.mode ?? null, unitName: launch.unit ?? null, child: launch.child ?? null,
+          dispatchState: launch.dispatchState === 'submission-uncertain' ? 'submission-uncertain' : (launch.launched || launch.launchAttempted) ? 'dispatched' : 'never-began' };
+        registry.update(entry.invocationId, { isolationMode: launch.mode ?? null });
+        if (!launch.launched && !launch.launchAttempted && launch.dispatchState !== 'submission-uncertain') {
+          execution.mayHaveLaunched = false;
+          settleRecovery({ kind: 'uncertain', confirmedStop: true });
+          return markTerminal({ status: 'blocked', termination: 'confirmed', diagnostics: [launch.diagnostic ?? 'worker launch was refused'] });
+        }
+        // M2: a live stop handle for the duration of this call, so an
+        // explicit `cancel` can actually stop the isolated unit / kill the
+        // child, not just record that cancellation was requested.
+        // #2915 review 4 (finding 3) / round 8 (D5): clipped to the ONE
+        // absolute `deadlineAtMs` computed above (which already folds in the
+        // admitted canary's own 300s window) — never re-derived from
+        // `taskDeadlineMs` independently of it, and always measured as
+        // "remaining from right now" so time already spent launching is
+        // never double-counted.
+        let deadlineMs = Math.max(0, deadlineAtMs - deadlineClockNow());
+        const control = buildShellStopControl(launch, {
+          waitForUnit: (unit, budgetMs, observerOptions) => (waitForUnitTerminationOverride ?? waitForUnitTermination)(unit,
+            budgetMs, { ...observerOptions, clock: deadlineClockNow }),
+          nowMs: deadlineClockNow,
+          stopUnit: options.stopWorkerUnit ?? options.stopUnit,
+          killUnit: options.killWorkerUnit,
+          graceMs: options.shellStopGraceMs ?? (invocation.health?.terminateGraceSeconds ?? 1) * 1000,
+          onConfirmed: async outcome => {
+            // The shell observer proved an accepted stop plus a fresh inactive
+            // unit that never exec'd; ExecMainCode alone cannot retain it.
+            neverExecutedStop = outcome.neverExecuted === true;
+            const stopEvidence = await resolveEvidence({ ...isolationEvidence, stopFirst: false });
+            confirmedStop = stopEvidence.confirmedStop;
+            observeStop(Promise.resolve(), isolationEvidence);
+            if (!launch.launched) await cleanupReservation();
+            await Promise.resolve().then(() => launch.cleanup?.()).catch(() => {});
+            const live = registry.get(entry.invocationId);
+            if (live?.terminalAt !== null) return;
+            if (live.status === 'uncertain' || live.status === 'blocked') {
+              registry.markTerminal(entry.invocationId, { control: null, termination: 'confirmed',
+                status: live.cancelRequested ? 'cancelled' : 'failed' });
+            } else registry.update(entry.invocationId, { control: null, termination: 'confirmed' });
+          },
+        });
+        if (registry.get(entry.invocationId)?.termination !== 'confirmed') {
+          registry.update(entry.invocationId, { control });
+        }
+        // Honor a cancel that arrived while the launcher was still pending.
+        if (registry.get(entry.invocationId)?.cancelRequested) await control.stop();
+        let outcome = launch.launched ? await control.wait(deadlineMs, { deadlineAtMs, nowMs: deadlineClockNow }) : await control.stopAndConfirm();
+        // Preserve the control's timeout latch and refuse a late clean outcome.
+        if (outcome.termination === 'confirmed' && !outcome.timedOut && deadlineClockNow() >= deadlineAtMs) {
+          outcome = { ...outcome, timedOut: true };
+        }
+        const stopEvidence = await resolveEvidence({ ...isolationEvidence, stopFirst: false });
+        confirmedStop = stopEvidence.confirmedStop;
+        // #2915 review 6 (finding 1, "false recovery after timeout"): a
+        // forced stop at the attempt's own deadline is never treated as a
+        // candidate success, regardless of the exit code the forced stop
+        // happened to observe (a systemd unit whose main process had
+        // already legitimately exited 0 right before the stop escalation
+        // fired reports exactly that exit code even though the attempt
+        // itself was never allowed to run to its own completion). Preserved
+        // independently of `outcome.exitCode`/`outcome.termination` through
+        // to the candidate-success gate below (`strictlyCompleted`).
+        observation = { transport: 'shell', status: outcome.termination === 'confirmed' && outcome.exitCode === 0 && !outcome.timedOut ? 'completed' : 'failed', termination: outcome.termination, exitCode: outcome.exitCode, timedOut: !!outcome.timedOut };
+        // #2915 final (evidence contract): the attempt-level fact is derived
+        // from this bridge's own launcher-observed wait status — never a
+        // worker claim — independent of `termination`/`descendants` above.
+        // `termination === 'confirmed'` here already reflects THIS bridge's
+        // own trusted observation (systemd-unit query, or this process's own
+        // `child.close` event).
+        //
+        // #2915 review 5 (finding 1a, "false recovery"): a definite BAD exit
+        // is trustworthy failure evidence regardless of what happens
+        // downstream, so it settles immediately. A confirmed CLEAN exit
+        // (`exitCode === 0`) is only a CANDIDATE success -- settlement is
+        // deferred past strict final-claims validation, brief-evidence
+        // matching and the cancellation check below (common code, shared
+        // with the MCP branch), so a worker that exits 0 but never produces
+        // a valid, matching, uncancelled completed claim can never close a
+        // scope through this path. Uncertain termination never implicates
+        // anything either way.
+        launch.child?.stderr?.removeListener('data', observeHint);
+        if (outcome.termination !== 'confirmed') {
+          settleRecovery({ kind: 'uncertain', confirmedStop });
+          // M2: stays LIVE — capacity is held until a stop is proven or the
+          // conductor disposes of it explicitly, never freed on a mere
+          // unconfirmed-termination timeout.
+          return (confirmedStop ? registry.markTerminal : registry.update)(entry.invocationId, {
+            status: launch.launched ? 'uncertain' : 'blocked', termination: confirmedStop ? 'confirmed' : 'uncertain',
+            diagnostics: ['worker termination could not be confirmed before the deadline'],
+          });
+        }
+        if (outcome.exitCode !== 0) {
+          if (!failureHint.length && invocation.stderrPath) {
+            try { failureHint = await readBoundedFile(invocation.stderrPath, 8192, root); } catch { /* no usable hint */ }
+          }
+          await settleObservedFailure({ ...outcome, invocationId: entry.invocationId, attemptOutcome: 'failed',
+            cancelled: !!registry.get(entry.invocationId)?.cancelRequested, confirmedStop }, failureHint.toString('utf8'));
+        }
+        await Promise.resolve().then(() => launch.cleanup?.()).catch(() => {
+          console.error('[worker-invoke] stdin cleanup failed after confirmed termination');
+        });
+        if (!launch.launched) {
+          settleRecovery({ kind: 'uncertain', confirmedStop });
+          execution.mayHaveLaunched = false;
+          return markTerminal({ control: null, status: 'failed', termination: 'confirmed',
+            diagnostics: [launch.diagnostic ?? 'worker launch failed; termination confirmed'] });
+        }
+        if (outcome.timedOut || outcome.stopped) {
+          settleRecovery({ kind: registry.get(entry.invocationId)?.cancelRequested ? 'uncertain' : 'failed', confirmedStop });
+          return registry.markTerminal(entry.invocationId, { control: null, termination: 'confirmed',
+            status: registry.get(entry.invocationId)?.cancelRequested ? 'cancelled' : 'failed',
+            diagnostics: [outcome.timedOut ? 'worker deadline exceeded; termination confirmed' : 'worker stopped; termination confirmed'] });
+        }
+        try { rawOutput = await readBoundedFile(invocation.finalPath, invocation.maxOutputBytes, root); } catch {
+          // #2915 review 5 (finding 1a): a confirmed clean exit that never
+          // produced a readable final output is not a success -- settle
+          // failed now rather than leaving it candidate-success forever
+          // (the bad-exit branch above already settled; this is a no-op
+          // there).
+          settleRecovery({ kind: 'failed', confirmedStop });
+          return registry.markTerminal(entry.invocationId, { status: 'failed', termination: 'confirmed', diagnostics: ['worker final output was not written'] });
+        }
+      } else {
+        const { mcpRegistry, qualification } = drivers[invocation.selected.cli];
+        const mcpServer = await mcpRegistry.get(invocation.mcp.serverRef);
+        if (!mcpServer) {
+          // #2915 review 4 (finding 2): another pre-spawn refusal after
+          // admission that was never settling it.
+          //
+          // #2915 review 6 (finding 4): proven zero dispatch.
+          settleRecovery({ kind: 'uncertain', confirmedStop: true });
+          return markTerminal({ status: 'blocked', termination: 'confirmed', diagnostics: ['worker MCP server is not registered'] });
+        }
+        // F5: pin the qualified server's definition digest NOW, at
+        // admission, so a queued launch can detect a registry edit that
+        // happened while it was waiting (see `serverDefinitionDigest`).
+        const qualifiedServerDigest = serverDefinitionDigest(mcpServer);
+        // #2915 review 5 ("a second worker over unresolved execution") /
+        // round 8 (D5): clipped to the ONE absolute `deadlineAtMs` computed
+        // above — never re-derived independently of it (that re-derivation,
+        // against `admission.token.deadlineMs` alone, used to miss the
+        // plain task-deadline case entirely and was also the source of the
+        // "subtracts preparation time twice" defect once `defaultCallMcpWorker`
+        // added its OWN mint-time-relative re-derivation on top — round 8
+        // critique, D5/review 7 finding 4's last bullet). This clip exists
+        // for callers that only ever see `mcpBinding.timeoutSeconds` (every
+        // existing injected `callMcpWorker` test double, and the ACTUAL
+        // enforcement inside `defaultCallMcpWorker` uses the separately
+        // threaded `deadlineAtMs` below, never re-adding onto
+        // `admission.token.mintedAtMs`.
+        let mcpBinding = invocation.mcp;
+        const remainingSeconds = Math.max(0, (deadlineAtMs - deadlineClockNow()) / 1000);
+        if (remainingSeconds < mcpBinding.timeoutSeconds) mcpBinding = { ...mcpBinding, timeoutSeconds: remainingSeconds };
+        // #2915 round 8 (D2, replaces the former `await debitRecovery()`
+        // call here): same reasoning as the shell path above — the ledger
+        // debit now happens inside the dispatch-commit hook, deep inside
+        // `defaultLaunchMcpWorkerProcess` -> `planDirectWorkerLaunch` ->
+        // `launchIsolatedWorker`, immediately before the real MCP worker
+        // SERVER process actually starts.
+        //
+        // `spawnAttempted` is still set BEFORE calling, not after
+        // inspecting `result.outcome` -- `callMcpWorkerImpl` itself may
+        // already have launched a real MCP server process and sent bytes
+        // before it returns or throws (#2892 F2's own "thrown MCP transport
+        // error stays LIVE" case is exactly this), so a throw from WITHIN
+        // it can never be proven to be pre-spawn.
+        spawnAttempted = true;
+        execution.mayHaveLaunched = true;
+        const result = await callMcpWorkerImpl(mcpBinding, mcpServer, {
+          sessionIsolation: invocation.mcp.sessionIsolation, mcpRegistry, allowDegraded, config: snapshot.config,
+          // #2915 round 8 (D5): the ONE absolute deadline for this call,
+          // computed once above.
+          deadlineAtMs,
+          // #2892 (CI fix): the resolved invocation's own worktree
+          // (`invocation.cwd`, #2887's `request.workdir`) — without it the
+          // dispatch gate's free-disk sample has no filesystem to read and
+          // fails closed on every host, never reaching isolation at all.
+          // See `defaultLaunchMcpWorkerProcess`'s doc comment.
+          cwd: invocation.cwd,
+          name: `mcp-${entry.invocationId.slice(0, 8)}`, memoryMaxGb: mcpWorkerMemoryMaxGb, mcpSchemas: qualification?.mcpSchemas,
+          qualifiedServerDigest, registerControl: control => registry.update(entry.invocationId, { control }),
+          // #2915 review 4 (finding 2): the SAME top-level admission this
+          // run() already holds, borrowed through to the native-MCP launch
+          // path — never a second, independent planner reservation. See
+          // `defaultLaunchMcpWorkerProcess`.
+          admission,
+          // #2915 round 8 review 8 (C6/C3): independently resolved dispatch
+          // identity (never derived from the borrowed admission wrapper) and
+          // the one dispatch-commit deadline/cancellation guard, threaded
+          // all the way to the leaf hook.
+          invocation, invocationId: entry.invocationId, dispatchGuard, isCancelled, observeStop,
+          ...gateInputs,
+        });
+        isolationEvidence = { isolationMode: result.isolationMode ?? null, unitName: result.unitName ?? null,
+          child: result.child ?? null, dispatchState: result.dispatchState ?? 'dispatched' };
+        if (result.outcome === 'blocked') {
+          // Never launched (dispatch gate or queue refusal): settle with no
+          // failure evidence.
+          //
+          // #2915 round 8 review 8 (C2): a `blocked` outcome does NOT always
+          // mean proven zero dispatch -- a schema-drift refusal (or any
+          // other post-connect `blocked` return) happens AFTER a real MCP
+          // worker server process was spawned and connected to
+          // (`result.dispatchState === 'dispatched'`). Resolve REAL stop
+          // evidence for that case through the shared `resolveStopEvidence`
+          // (a server that ignores close/TERM/KILL must never be reported
+          // confirmed-stopped) rather than hardcoding `confirmedStop: true`
+          // for every `blocked` label (review 8, C section finding 2: "an
+          // MCP blocked result AFTER a process was spawned is dispatched").
+          // Every pre-spawn `blocked` path inside `callMcpWorkerImpl`
+          // (registry requalification, admission-expiry, a thrown
+          // pre-launch exception, or a proven pre-spawn launch refusal)
+          // carries `dispatchState: 'never-began'` (or `'submission-
+          // uncertain'` for a failed/timed-out systemd-run submission) and
+          // is handled accordingly — ALWAYS proven zero dispatch only for
+          // `'never-began'`.
+          let blockedConfirmedStop;
+          if (result.dispatchState === 'dispatched' || result.dispatchState === 'submission-uncertain') {
+            const evidence = await resolveEvidence(isolationEvidence);
+            blockedConfirmedStop = evidence.confirmedStop;
+          } else {
+            blockedConfirmedStop = true;
+            execution.mayHaveLaunched = false;
+          }
+          settleRecovery({ kind: 'uncertain', confirmedStop: blockedConfirmedStop });
+          return blockedConfirmedStop ? markTerminal({
+            status: 'blocked', termination: 'confirmed',
+            diagnostics: [result.diagnostic ?? 'worker MCP launch was refused'],
+          }) : registry.update(entry.invocationId, {
+            status: 'blocked', termination: blockedConfirmedStop ? 'confirmed' : 'uncertain',
+            diagnostics: [result.diagnostic ?? 'worker MCP launch was refused'],
+          });
+        }
+        confirmedStop = (await resolveEvidence({ ...isolationEvidence, stopFirst: false })).confirmedStop;
+        if (result.outcome !== 'responded') {
+          // Overflow holds capacity and stop control until termination is proven.
+          if (result.diagnostic?.includes('OG_WORKER_MCP_FRAME_TOO_LARGE')) {
+            settleRecovery({ kind: 'uncertain', confirmedStop });
+            // An explicit cancel can have confirmed termination while this run
+            // was awaiting its initial overflow evidence.
+            if (entry.terminalAt !== null) return entry;
+            const patch = { status: result.termination === 'confirmed' ? 'failed' : 'uncertain',
+              termination: result.termination ?? 'uncertain', diagnostics: [result.diagnostic] };
+            return result.termination === 'confirmed'
+              ? registry.markTerminal(entry.invocationId, { ...patch, control: null })
+              : registry.update(entry.invocationId, patch);
+          }
+          // M2: stays LIVE for the same reason as the shell timeout path above.
+          settleRecovery({ kind: 'uncertain', confirmedStop });
+          return (confirmedStop ? registry.markTerminal : registry.update)(entry.invocationId, {
+            status: 'uncertain', termination: confirmedStop ? 'confirmed' : 'uncertain',
+            diagnostics: [`worker ${result.outcome}; cancellation delivered`],
+          });
+        }
+        rawOutput = result.response;
+        observation = { transport: 'mcp', status: result.response.isError ? 'failed' : 'completed', termination: 'confirmed', exitCode: result.response.isError ? 1 : null, isError: !!result.response.isError };
+        // #2915 final (evidence contract): a transport-correlated response
+        // that is not `isError` is a CANDIDATE successful attempt even
+        // though `exitCode` is legitimately `null` for MCP (#2915 final
+        // review, finding 4: "successful responses produce exitCode:null...
+        // recorded one invocation failure and left the shared canary
+        // active" — the former exitCode-based classification treated every
+        // successful MCP response as a failure). Descendant-stop evidence is
+        // a separate, independent fact this bridge never claims here.
+        //
+        // #2915 review 5 (finding 1a): an `isError` response IS trustworthy
+        // failure evidence and settles immediately, exactly like a
+        // confirmed bad exit above. A non-error response is only a
+        // CANDIDATE -- settlement is deferred to the common code below,
+        // past strict final-claims validation, brief-evidence matching and
+        // the cancellation check, so a transport-correlated response alone
+        // can never close a scope.
+        if (result.response.isError) {
+          await settleObservedFailure({ invocationId: entry.invocationId, attemptOutcome: 'failed',
+            termination: 'confirmed', exitCode: 1, confirmedStop,
+            cancelled: !!registry.get(entry.invocationId)?.cancelRequested }, JSON.stringify(result.response).slice(0, 8192));
+          return registry.markTerminal(entry.invocationId, { status: 'failed', termination: 'confirmed', diagnostics: ['worker reported isError'] });
+        }
+      }
+      const { ProviderAdapter } = await loadRalphExternal('lib/provider-adapter.mjs');
+      let claims;
+      try {
+        claims = await new (class extends ProviderAdapter {})().parseWorkerFinal(rawOutput, {
+          format: invocation.transport === 'shell' ? 'jsonl' : 'mcp', observation, maxOutputBytes: invocation.maxOutputBytes,
+        });
+      } catch (error) {
+        // #2915 review 5 (finding 1a): the strict parse itself rejected the
+        // claims -- the candidate success from above is settled failed
+        // here, never left to default to an earlier premature success.
+        //
+        // #2915 review 6 (finding 4, "stop evidence on every settlement"):
+        // thread the shell path's own launcher-confirmed termination fact
+        // (`confirmedStop`) through here too — a late systemd completion
+        // with confirmed termination but invalid claims must not retain a
+        // permanent blocking marker merely because this rejection path
+        // omitted it. Stays `false` for native MCP (unaffected).
+        settleRecovery({ kind: 'failed', confirmedStop });
+        // M5: bounded, fixed-vocabulary diagnostic only — never the raw
+        // parser error message, which can echo attacker/worker-controlled
+        // input text back out (a duplicate-key probe reflected a planted
+        // marker through this exact path before the fix).
+        return registry.markTerminal(entry.invocationId, { status: 'failed', termination: 'confirmed', diagnostics: [typeof error?.code === 'string' ? error.code : 'OG_WORKER_FINAL_INVALID'] });
+      }
+      const assembled = await tryAssembleDirectResult({ request, invocation, observation, claims, root,
+        briefDigest: mcpBriefDigest, requireStructuredBrief: invocation.transport === 'mcp' });
+      if (assembled?.conflict) {
+        // #2915 review 5 (finding 1a): the brief changed between launch and
+        // result assembly -- a candidate success settles failed here, never
+        // silently assembled (or recorded recovered) against a different
+        // brief than the one the worker was actually launched against.
+        //
+        // #2915 review 6 (finding 4): same `confirmedStop` threading as the
+        // parse-failure path above.
+        settleRecovery({ kind: 'failed', confirmedStop });
+        return registry.markTerminal(entry.invocationId, { status: 'failed', termination: 'confirmed', diagnostics: ['OG_BRIEF_EVIDENCE_CONFLICT'] });
+      }
+      // M2: a cancel requested at ANY point during this run's lifetime —
+      // even before a live `control` handle existed to deliver it to — means
+      // this result is never trusted as `completed`, regardless of what the
+      // worker itself claims.
+      const liveEntry = registry.get(entry.invocationId);
+      const cancelled = !!liveEntry?.cancelRequested;
+      // #2915 review 6 (finding 1, "false recovery after timeout"): a
+      // timed-out attempt (the shell path's own forced-stop-at-deadline
+      // observation, see `observation.timedOut` above) is never treated as
+      // strictly completed, regardless of what a worker claim says or what
+      // exit code the forced stop happened to observe.
+      const strictlyCompleted = claims.status === 'completed' && !observation?.timedOut;
+      // #2915 review 5 (finding 1a): this is the ONE place a candidate
+      // success (deferred above) is finally settled -- only after strict
+      // completed claims, matching brief evidence (no conflict, checked
+      // above) and the cancellation check all agree. A cancelled run never
+      // settles 'succeeded' even with valid claims (the operator asked to
+      // stop it); an invalid/non-completed claim settles 'failed', exactly
+      // like every other claim-rejection path above.
+      settleRecovery({ kind: cancelled ? 'uncertain' : strictlyCompleted ? 'succeeded' : 'failed', confirmedStop });
+      return registry.markTerminal(entry.invocationId, {
+        status: cancelled ? 'cancelled' : (strictlyCompleted ? 'completed' : 'failed'),
+        termination: 'confirmed',
+        result: assembled?.result ?? { claims },
+      });
+    } catch (error) {
+      // Registry status and an error label do not establish descendant stop.
+      if (error.workerNotLaunched) execution.mayHaveLaunched = false;
+      const neverDispatched = !spawnAttempted || !!error.workerNotLaunched;
+      const confirmedStop = neverDispatched || (await resolveEvidence({ ...isolationEvidence, stopFirst: false })).confirmedStop;
+      settleRecovery({ kind: 'uncertain', confirmedStop });
+      if (neverDispatched) {
+        return markTerminal({ status: 'blocked', termination: 'confirmed', diagnostics: [error.message] });
+      }
+      if (confirmedStop) {
+        return registry.markTerminal(entry.invocationId, { control: null,
+          status: registry.get(entry.invocationId)?.cancelRequested ? 'cancelled' : 'failed',
+          termination: 'confirmed', diagnostics: [error.message] });
+      }
+      // Keep capacity and stop control while execution remains unresolved.
+      return registry.update(entry.invocationId, { status: 'uncertain', termination: 'uncertain', diagnostics: [error.message] });
+    }
+  }
+
   async function tryAssembleDirectResult({ request, invocation, observation, claims, root, briefDigest, requireStructuredBrief }) {
     // M5 (and F4 for mcp): `briefDigest` (fix-2892-r2) is THIS run's own
     // admission-time pin for the `mcp` transport — computed and validated
@@ -1453,11 +2694,85 @@ export async function registerWorkerInvokeToolset(server, options = {}) {
   }
 
   async function status(input) {
+    if (!input.invocation_id) {
+      // #2915 round 8 (D4): ordinary status, read-only, no id — lists every
+      // invocation this server currently tracks as a `dispatched` reservation
+      // with `stop: 'unresolved'`, across every distinct breaker instance
+      // any tracked invocation's gated admission used. Never mutates
+      // anything (`listUnresolvedStops` is a pure read accessor on the
+      // breaker); this is the "reachable for every long-lived owner" route
+      // C4 requires, surfaced here rather than printed-only.
+      const breakers = new Set(registry.recoveryOwner ? [registry.recoveryOwner] : []);
+      for (const entry of registry.values()) if (entry.recoveryBreaker) breakers.add(entry.recoveryBreaker);
+      const unresolvedReservations = [];
+      for (const breaker of breakers) {
+        if (typeof breaker.listUnresolvedStops === 'function') unresolvedReservations.push(...breaker.listUnresolvedStops());
+      }
+      const interventionScopes = [...breakers].flatMap(breaker => (breaker.snapshot?.().scopes ?? [])
+        .filter(scope => scope.state === 'operator-intervention')
+        .map(scope => ({ scopeId: scope.scopeKey, reason: scope.operatorReason,
+          resetInstruction: { operation: 'reset_recovery_scope', scope_id: scope.scopeKey } })));
+      return { unresolvedReservations, interventionScopes };
+    }
     const entry = registry.get(input.invocation_id);
     if (!entry) throw new Error('Unknown invocation_id');
     return publicStatus(entry, healthHook);
   }
 
+  /**
+   * #2915 round 8 (D4, "reconciliation route"): the explicit operator-
+   * authorized reconciliation operation on this SAME `worker-invoke`
+   * status/cancel handler — it already runs inside the owning server and
+   * closes over its registry. Accepted ONLY for an invocation whose stored
+   * reservation is `dispatched` with `stop: 'unresolved'` (verified via
+   * `ScopedFailureBreaker.hasUnresolvedStop`, a pure read accessor — never
+   * inferred from this registry's own, separately-maintained status
+   * fields). Applied to THAT invocation's actual breaker (`entry.
+   * recoveryBreaker`, pinned at admission — never a fresh default breaker).
+   * Idempotent: a second call finds nothing left to reconcile and reports
+   * why, rather than throwing or re-applying anything. No mailbox files;
+   * nothing is written anywhere other than the breaker's own in-memory
+   * reservation table.
+   */
+  async function reconcileStopped(input) {
+    if (!input.invocation_id) throw new Error('reconcile_stopped requires invocation_id');
+    const entry = registry.get(input.invocation_id);
+    if (!entry) throw new Error('Unknown invocation_id');
+    const breaker = entry.recoveryBreaker ?? null;
+    const base = publicStatus(entry, healthHook);
+    if (!breaker || typeof breaker.hasUnresolvedStop !== 'function') {
+      return { ...base, reconciled: false, reconcileReason: 'this invocation has no tracked gated reservation to reconcile' };
+    }
+    if (!breaker.hasUnresolvedStop(entry.invocationId)) {
+      return { ...base, reconciled: false, reconcileReason: 'no dispatched reservation with unresolved stop evidence exists for this invocation (already reconciled, never dispatched, or already confirmed stopped)' };
+    }
+    const result = breaker.reconcileStopEvidence({ invocationId: entry.invocationId, confirmedStop: true });
+    const applied = (result?.released ?? 0) > 0;
+    // #2915 round 8 review 8 (C7): applying a confirmed stop must ALSO
+    // finalize this invocation's registry capacity -- a dispatched
+    // reservation with unresolved stop kept this entry's run-slot
+    // effectively pinned (the registry's own `hasUnresolvedStopMarker`
+    // exemption, above, retains it past the ordinary terminal sweep for
+    // exactly this reason). `markTerminal({})` sets `terminalAt` without
+    // touching `status` -- a truthful terminal state that never invents
+    // task success for an attempt whose own outcome this bridge still
+    // never confirmed. Idempotent: a no-op if the entry was already
+    // terminal.
+    if (applied) registry.markTerminal(entry.invocationId, {});
+    return {
+      ...publicStatus(entry, healthHook),
+      reconciled: applied,
+      ...(applied ? {} : { reconcileReason: 'reservation was already reconciled or no longer exists' }),
+    };
+  }
+
+  async function resetRecoveryScope(input) {
+    if (!input.scope_id) throw new Error('reset_recovery_scope requires scope_id');
+    const breaker = registry.recoveryOwner;
+    if (!breaker) throw new Error('No recovery breaker owner is bound to this registry');
+    return { scopeId: input.scope_id, ...breaker.reset(input.scope_id) };
+  }
+
   async function cancel(input) {
     const entry = registry.get(input.invocation_id);
     if (!entry) throw new Error('Unknown invocation_id');
@@ -1487,13 +2802,15 @@ export async function registerWorkerInvokeToolset(server, options = {}) {
 
   server.registerTool('worker-invoke', {
     title: 'Invoke or Observe a Direct-Handoff Worker',
-    description: 'Run, check, or cancel a qualified worker without any Mission/MC session — same policy/brief/claims path as the shell direct-handoff tier. Degraded isolation is a server-side operator setting only; there is no client-facing switch. Cancel delivery is not stop confirmation.',
+    description: "Run, check, cancel, or reconcile stop evidence for a qualified worker without any Mission/MC session — same policy/brief/claims path as the shell direct-handoff tier. Degraded isolation is a server-side operator setting only; there is no client-facing switch. Cancel delivery is not stop confirmation. 'status' with no invocation_id lists invocations still awaiting stop-evidence reconciliation; 'reconcile_stopped' applies that reconciliation for one invocation_id once the operator has independently established its worker actually stopped. 'status' also lists interventionScopes with their reason and reset instruction; 'reset_recovery_scope' requires scope_id and resets only that owning scope after all active or unresolved executions stop, preserving cumulative allowance.",
     inputSchema,
     annotations: { readOnlyHint: false, destructiveHint: true, openWorldHint: false },
   }, async input => {
     try {
       if (input.operation === 'run') return mcpJson(publicStatus(await run(input), healthHook));
       if (input.operation === 'status') return mcpJson(await status(input));
+      if (input.operation === 'reset_recovery_scope') return mcpJson(await resetRecoveryScope(input));
+      if (input.operation === 'reconcile_stopped') return mcpJson(await reconcileStopped(input));
       return mcpJson(await cancel(input));
     } catch (error) {
       return mcpError(`worker-invoke: ${error.message}`);