@aiwg/cli 2026.10.6 → 2026.10.7

package/tools/agents/providers/codex.mjs

@@ -1,3 +1,4 @@
+import { importImpl } from '../../_resolve-impl.mjs';
 /**
  * OpenAI Codex Provider
  *
@@ -68,6 +69,8 @@ import {
   resolveAiwgRoot
 } from './base.mjs';
 
+import { writeContextFileSync } from './context-write.mjs';
+
 function resolveCodexHelperRoot(srcRoot) {
   const resolved = resolveAiwgRoot(srcRoot);
   if (resolved) return resolved;
@@ -403,7 +406,7 @@ export function aggregateToAgentsMd(agentFiles, destPath, opts) {
   }
   const out = `${lines.join('\n')}\n`;
   if (opts.dryRun) console.log(`[dry-run] write ${destPath}`);
-  else fs.writeFileSync(destPath, out, 'utf8');
+  else writeContextFileSync(destPath, out, 'utf8');
 
 }
 

package/tools/agents/providers/context-write.mjs

@@ -0,0 +1,28 @@
+/**
+ * Context-file writes for deployment providers (#3037).
+ *
+ * The journaled writer lives in compiled TypeScript. In source-resolution
+ * mode (AIWG_RESOLVE_IMPL_FROM=src without a TS loader) it cannot load, and
+ * read-only consumers of provider modules (for example the remotes topology
+ * block) must still import cleanly. Writes then fail closed with the original
+ * load error, so nothing ever writes context files without the safety layer.
+ */
+import { importImpl } from '../../_resolve-impl.mjs';
+
+// Mirrors CONTEXT_STAGE_ENV in src/smiths/context-pipeline/context-file-safety.ts.
+export const CONTEXT_STAGE_ENV = 'AIWG_CONTEXT_STAGE_LOG';
+
+let loadError = null;
+let writer = null;
+try {
+  writer = await importImpl(import.meta.url, 'smiths/context-pipeline/context-file-safety.js');
+} catch (error) {
+  loadError = error;
+}
+
+export function writeContextFileSync(file, content, encoding) {
+  if (!writer) {
+    throw new Error(`Context-file safety layer is unavailable; refusing to write ${file}`, { cause: loadError });
+  }
+  return writer.writeContextFileSync(file, content, encoding);
+}

package/tools/agents/providers/copilot.mjs

@@ -1,3 +1,4 @@
+import { importImpl } from '../../_resolve-impl.mjs';
 /**
  * GitHub Copilot Provider
  *
@@ -54,6 +55,8 @@ import {
   deploySoulCompanions,
   loadRuntimeModelCatalog
 } from './base.mjs';
+
+import { writeContextFileSync } from './context-write.mjs';
 const modelCatalog = loadRuntimeModelCatalog(staticModelCatalog);
 
 // ============================================================================
@@ -477,14 +480,14 @@ export function createCopilotInstructions(target, srcRoot, dryRun) {
     if (dryRun) {
       console.log(`[dry-run] Would update existing copilot-instructions.md with AIWG section`);
     } else {
-      fs.writeFileSync(destPath, combined, 'utf8');
+      writeContextFileSync(destPath, combined, 'utf8');
       console.log('Updated copilot-instructions.md with AIWG SDLC framework section');
     }
   } else {
     if (dryRun) {
       console.log(`[dry-run] Would create copilot-instructions.md from template`);
     } else {
-      fs.writeFileSync(destPath, template, 'utf8');
+      writeContextFileSync(destPath, template, 'utf8');
       console.log('Created copilot-instructions.md from template');
     }
   }

package/tools/agents/providers/hermes.mjs

@@ -1,3 +1,4 @@
+import { importImpl } from '../../_resolve-impl.mjs';
 /**
  * Hermes Agent Provider
  *
@@ -41,6 +42,8 @@ import {
   stripPlatformsFromContent,
 } from './base.mjs';
 
+import { writeContextFileSync } from './context-write.mjs';
+
 // ============================================================================
 // Hermes home resolution (HERMES_HOME) — #2119
 // ============================================================================
@@ -355,7 +358,7 @@ MCP is optional; \`mcp_aiwg_rule_show\` exposes the same rule catalog.
   if (dryRun) {
     console.log(`[dry-run] Would write AGENTS.md (${output.length} chars, ${Math.round(output.length / 4)} tokens estimated)`);
   } else {
-    fs.writeFileSync(destPath, output, 'utf8');
+    writeContextFileSync(destPath, output, 'utf8');
     const charCount = output.length;
     const tokenEstimate = Math.round(charCount / 4);
     let budgetNote;
@@ -397,7 +400,7 @@ when the full AIWG project context is needed.
   if (dryRun) {
     console.log(`[dry-run] Would write .hermes.md (${body.length} chars)`);
   } else {
-    fs.writeFileSync(destPath, mergeHermesContext(destPath, body, 'routing'), 'utf8');
+    writeContextFileSync(destPath, mergeHermesContext(destPath, body, 'routing'), 'utf8');
     console.log(`  Created .hermes.md (${body.length} chars)`);
   }
   return 1;

package/tools/agents/providers/omp.mjs

@@ -5,6 +5,8 @@ import { createHash } from 'node:crypto';
 import YAML from 'yaml';
 import { importImpl } from '../../_resolve-impl.mjs';
 import { withRuleDeployment, collectFrameworkArtifacts, getAddonFiles, isKernelSkill, listMdFiles, listSkillDirs, normalizeDeploymentMode, resolveAiwgRoot } from './base.mjs';
+
+import { writeContextFileSync } from './context-write.mjs';
 export const name = 'omp';
 export const aliases = ['oh-my-pi'];
 export const paths = { agents: '.omp/agents', commands: '.omp/prompts', skills: '.agents/skills', rules: '.omp/rules' };
@@ -168,7 +170,7 @@ export function createAgentsMd(target, srcRoot, dryRun = false) {
   const content = current.includes(start) && current.includes(end) ? current.slice(0, current.indexOf(start)) + block + current.slice(current.indexOf(end) + end.length) : `${current}${current ? '\n\n' : ''}${block}\n`;
   if (!dryRun) {
     fs.mkdirSync(path.dirname(dest), { recursive: true });
-    if (content !== current) fs.writeFileSync(dest, content);
+    if (content !== current) writeContextFileSync(dest, content);
     const receiptPath = path.join(path.dirname(dest), '.aiwg-manifest.json');
     // Block ownership must never claim the operator's complete context file.
     receipt.managed['AGENTS.md'] = { blockHash: `sha256:${hash(block)}`, source: 'omp-bootstrap', provider: 'omp', transformation: 'managed-block' };

package/tools/agents/providers/rule-delivery.mjs

@@ -19,6 +19,7 @@ const { loadRulePinConfigs, installedRuleCapabilities, resolveRulePins } = await
 const { guardRulesInlineBudget } = await importImpl(import.meta.url, 'rules/inline-budget.mjs');
 const { userConfigFile } = await importImpl(import.meta.url, 'config/user-config-dir.mjs');
 const { resolveProjectAiwgDir } = await importImpl(import.meta.url, 'config/project-artifacts-runtime.mjs');
+import { writeContextFileSync, CONTEXT_STAGE_ENV } from './context-write.mjs';
 const PREPARATION_HOOK = Symbol.for('aiwg.provider-preparation-hook.v1');
 
 export function installRuleDeploymentPreparationHook(hook) {
@@ -190,14 +191,17 @@ export async function prepareRuleDelivery(opts) {
       const key = `${anchor}\0${entry.path}`;
       if (!entryPaths.has(key)) entryPaths.set(key, path.resolve(anchor, entry.path));
       const resolvedPath = entryPaths.get(key);
-      return { ...entry, path: opts.mapInputPath ? opts.mapInputPath(resolvedPath) : resolvedPath };
+      // Canonical IDs hash the indexed package-relative path. Keep it through
+      // resolution; the selected target is anchored to root below.
+      return { ...entry, path: entry.path.startsWith('agentic/code/') ? entry.path
+        : opts.mapInputPath ? opts.mapInputPath(resolvedPath) : resolvedPath };
     });
     let rebuilt = false;
     const cacheDir = process.env.AIWG_RULE_BINDING_INDEX_CACHE;
     const cacheFile = cacheDir && path.join(cacheDir, `${contentHash(opts.logicalInputPath ? opts.logicalInputPath(root) : root)}.json`);
     const buildSourceEntries = async (refresh = false) => {
       if (!refresh && cacheFile) {
-        try { return JSON.parse(fs.readFileSync(cacheFile, 'utf8')).map(entry => ({ ...entry, path: opts.mapInputPath ? opts.mapInputPath(entry.path) : entry.path })); }
+        try { return JSON.parse(fs.readFileSync(cacheFile, 'utf8')).map(entry => ({ ...entry, path: path.isAbsolute(entry.path) && opts.mapInputPath ? opts.mapInputPath(entry.path) : entry.path })); }
         catch (error) {
           if (error.code !== 'ENOENT' && !(error instanceof SyntaxError)) throw error;
         }
@@ -206,7 +210,8 @@ export async function prepareRuleDelivery(opts) {
       const sourceEntries = await collectRuleBindingEntries(root,
         root === opts.srcRoot && !fs.existsSync(path.join(root, 'agentic')) ? '.' : 'agentic/code');
       rebuilt = true;
-      const entries = sourceEntries.map(entry => ({ ...entry, path: path.resolve(root, entry.path) }));
+      const entries = sourceEntries.map(entry => ({ ...entry, path: entry.path.startsWith('agentic/code/')
+        ? entry.path : path.resolve(root, entry.path) }));
       if (cacheFile) {
         fs.mkdirSync(cacheDir, { recursive: true });
         // Workers may publish the same immutable source snapshot concurrently.
@@ -324,7 +329,7 @@ function block(content, body) {
 
 function putStartup(file, body) {
   const content = fs.existsSync(file) ? read(file) : '<!-- aiwg-managed -->\n';
-  put(file, block(content, body));
+  writeContextFileSync(file, block(content, body));
 }
 
 /** Tagged rules bypass legacy aggregate writers. Untagged projections retain their tier policy. */
@@ -337,7 +342,7 @@ function projectRules(opts, provider) {
     const content = read(file);
     const clean = content.replace(/(<!-- AIWG:hermes-context:start -->)([\s\S]*?)(<!-- AIWG:hermes-context:end -->)/g,
       (_, start, body, end) => start + body.replace(/^### Rule: [\s\S]*?(?=^#{1,3} |(?![\s\S]))/gm, '') + end);
-    if (clean !== content) put(file, clean);
+    if (clean !== content) writeContextFileSync(file, clean);
   }
   const nativePaths = ['claude', 'cursor'].includes(provider.name);
   const rulesDir = path.isAbsolute(provider.paths.rules || '') ? provider.paths.rules : path.join(opts.target, provider.paths.rules || `.${provider.name}/rules`);
@@ -487,14 +492,14 @@ function projectRules(opts, provider) {
         if (!fs.existsSync(file)) continue;
         const content = read(file);
         const clean = block(content, '');
-        if (clean !== content) put(file, clean);
+        if (clean !== content) writeContextFileSync(file, clean);
       }
       return;
     }
     if (inlineStartup[provider.name]) {
       // Retire the B1 indirect startup block when migrating to the actual loader.
       const former = path.join(opts.target, 'AIWG.md');
-      if (fs.existsSync(former)) put(former, block(read(former), ''));
+      if (fs.existsSync(former)) writeContextFileSync(former, block(read(former), ''));
       putStartup(path.join(opts.target, inlineStartup[provider.name]), body);
     } else if (provider.name === 'hermes') {
       const dest = path.join(opts.target, 'AGENTS.md');
@@ -916,12 +921,12 @@ function expectedAnchorPaths(paths) {
 /** Adopt a detached worker plan into the coordinator's process-local lease. */
 export function adoptRuleDeploymentPlan(detached, { scratch, target, inputPool, cleanup }) {
   const invalid = () => { throw new Error('Invalid transferred rule deployment plan'); };
-  if (!exactObjectKeys(detached, ['version', 'lease', 'temp', 'target', 'stage', 'rootNames', 'workspaceDirs', 'preimages', 'poolSeal', 'anchors', 'snapshotRoot', 'corpusRoot', 'sourceMappings', 'staged', 'report', 'mappings']) ||
+  if (!exactObjectKeys(detached, ['version', 'lease', 'temp', 'target', 'stage', 'rootNames', 'workspaceDirs', 'preimages', 'poolSeal', 'anchors', 'snapshotRoot', 'corpusRoot', 'sourceMappings', 'staged', 'report', 'mappings', 'contextWrites']) ||
       detached.version !== 1 || typeof detached.lease !== 'string' || !(detached.poolSeal === null || typeof detached.poolSeal === 'string') ||
       !detached.report || typeof detached.report !== 'object' || Array.isArray(detached.report) || typeof scratch !== 'string' || typeof target !== 'string' || typeof cleanup !== 'function') invalid();
   const root = path.resolve(scratch), expectedTarget = path.resolve(target);
   if (path.resolve(detached.temp || '') !== root || path.resolve(detached.stage || '') !== path.join(root, 'project') || path.resolve(detached.target || '') !== expectedTarget) invalid();
-  if (!Array.isArray(detached.staged) || !Array.isArray(detached.mappings) || !Array.isArray(detached.rootNames) || !Array.isArray(detached.preimages) ||
+  if (!Array.isArray(detached.contextWrites) || detached.contextWrites.some(file => typeof file !== 'string' || !within(root, file)) || !Array.isArray(detached.staged) || !Array.isArray(detached.mappings) || !Array.isArray(detached.rootNames) || !Array.isArray(detached.preimages) ||
       !Array.isArray(detached.workspaceDirs) || !Array.isArray(detached.anchors) || !Array.isArray(detached.sourceMappings) ||
       typeof detached.snapshotRoot !== 'string' || !path.isAbsolute(detached.snapshotRoot) || typeof detached.corpusRoot !== 'string' || !path.isAbsolute(detached.corpusRoot)) invalid();
   if (detached.rootNames.some(name => !safeRelative(expectedTarget, name))) invalid();
@@ -1011,6 +1016,10 @@ export async function prepareRuleDeployment(original, provider, deploy) {
   const removeTemp = () => { removeStage(); if (pool) releaseInputPool(pool); };
   const lease = randomUUID();
   stagedCleanups.set(lease, { temp, cleanup: removeTemp, detach: () => { if (pool) releaseInputPool(pool); }, pool, seal: null, transferable });
+  const priorContextStage = process.env[CONTEXT_STAGE_ENV];
+  const contextStageLog = path.join(temp, 'context-writes.jsonl');
+  fs.writeFileSync(contextStageLog, '');
+  process.env[CONTEXT_STAGE_ENV] = contextStageLog;
   const mappings = [];
   const preimages = [...initialPreimages];
   let retained = false;
@@ -1338,7 +1347,8 @@ export async function prepareRuleDeployment(original, provider, deploy) {
       }
     };
     collectDirs(path.join(stage, '.aiwg'), '.aiwg');
-    const plan = { version: 1, lease, temp, target, stage, rootNames, workspaceDirs, preimages, poolSeal: pool?.inventorySeal || null,
+    const contextWrites = [...new Set(fs.readFileSync(contextStageLog, 'utf8').split('\n').filter(Boolean).map(line => JSON.parse(line)))];
+    const plan = { version: 1, lease, temp, target, stage, contextWrites, rootNames, workspaceDirs, preimages, poolSeal: pool?.inventorySeal || null,
       anchors: captureAnchors([target, ...mappings.map(mapping => mapping.from), ...workspaceDirs.map(dir => path.join(target, dir))]),
       snapshotRoot, corpusRoot, sourceMappings, staged: snapshotPreimages([stage, ...mappings.map(mapping => mapping.to)]), report: guarded.report,
       mappings: mappings.map(({ from, to, before }) => ({ from, to, before: [...before] })) };
@@ -1346,6 +1356,7 @@ export async function prepareRuleDeployment(original, provider, deploy) {
     retained = true;
     return plan;
   } finally {
+    if (priorContextStage === undefined) delete process.env[CONTEXT_STAGE_ENV]; else process.env[CONTEXT_STAGE_ENV] = priorContextStage;
     Object.assign(provider.paths, originals);
     if (priorAiwgRoot === undefined) delete process.env.AIWG_ROOT; else process.env.AIWG_ROOT = priorAiwgRoot;
     if (priorRegistry === undefined) delete process.env.AIWG_USER_REGISTRY_PATH; else process.env.AIWG_USER_REGISTRY_PATH = priorRegistry;
@@ -1418,10 +1429,16 @@ export function commitRuleDeploymentPlan(plan) {
           output = Buffer.from(`${JSON.stringify(receipt, null, 2)}\n`);
         }
         fs.mkdirSync(path.dirname(path.join(from, rel)), { recursive: true });
-        fs.writeFileSync(path.join(from, rel), output);
+        if (plan.contextWrites.includes(file)) writeContextFileSync(path.join(from, rel), output);
+        else fs.writeFileSync(path.join(from, rel), output);
       }
     }
-    for (const name of rootNames) if (fs.existsSync(path.join(stage, name))) put(path.join(target, name), normalize(read(path.join(stage, name))));
+    for (const name of rootNames) if (fs.existsSync(path.join(stage, name))) {
+      const output = normalize(read(path.join(stage, name)));
+      if (output === read(path.join(target, name))) continue;
+      const write = plan.contextWrites.includes(path.join(stage, name)) ? writeContextFileSync : put;
+      write(path.join(target, name), output);
+    }
     return plan.report;
   } finally {
     disposeRuleDeploymentPlan(plan);

package/tools/agents/providers/warp.mjs

@@ -1,3 +1,4 @@
+import { importImpl } from '../../_resolve-impl.mjs';
 /**
  * Warp Terminal Provider
  *
@@ -48,6 +49,8 @@ import {
   collectFrameworkArtifacts
 } from './base.mjs';
 
+import { writeContextFileSync } from './context-write.mjs';
+
 // ============================================================================
 // Provider Configuration
 // ============================================================================
@@ -206,7 +209,7 @@ export async function deployWarp(targetDir, srcRoot, opts) {
   // Preserve operator sections even for a forced artifact refresh.
   const output = mergeWarpMd(existing, content, false);
   ensureDir(targetDir, opts.dryRun);
-  if (!opts.dryRun) fs.writeFileSync(dest, output);
+  if (!opts.dryRun) writeContextFileSync(dest, output);
 
 }
 

package/tools/agents/providers/windsurf.mjs

@@ -1,3 +1,4 @@
+import { importImpl } from '../../_resolve-impl.mjs';
 /**
  * Devin Desktop Provider (Windsurf compatibility adapter)
  *
@@ -55,6 +56,8 @@ import {
   deploySoulCompanions
 } from './base.mjs';
 
+import { writeContextFileSync } from './context-write.mjs';
+
 // ============================================================================
 // Provider Configuration
 // ============================================================================
@@ -285,7 +288,7 @@ export function generateAgentsMd(files, destPath, opts) {
   if (dryRun) {
     console.log(`[dry-run] Would write AGENTS.md with ${agents.length} agents`);
   } else {
-    fs.writeFileSync(destPath, output, 'utf8');
+    writeContextFileSync(destPath, output, 'utf8');
     console.log(`Created AGENTS.md with ${agents.length} agents at ${path.relative(process.cwd(), destPath)}`);
   }
 
@@ -409,7 +412,7 @@ export function generateWindsurfRules(srcRoot, target, opts) {
     console.log(`[dry-run] Would write .windsurf/rules/aiwg-orchestration.md (trigger: always_on)`);
   } else {
     ensureDir(rulesDir);
-    fs.writeFileSync(orchestrationPath, output, 'utf8');
+    writeContextFileSync(orchestrationPath, output, 'utf8');
     console.log(`Created .windsurf/rules/aiwg-orchestration.md (trigger: always_on)`);
   }
 
@@ -430,7 +433,7 @@ export function generateWindsurfRules(srcRoot, target, opts) {
   if (dryRun) {
     console.log(`[dry-run] Would write .windsurfrules (deprecated stub)`);
   } else {
-    fs.writeFileSync(stubPath, stubLines.join('\n'), 'utf8');
+    writeContextFileSync(stubPath, stubLines.join('\n'), 'utf8');
     console.log(`Created .windsurfrules (deprecated stub → .windsurf/rules/aiwg-orchestration.md)`);
   }
 }

package/tools/ralph-external/lib/consecutive-failure-circuit-breaker.mjs

@@ -308,6 +308,9 @@ const HOST_CODES = new Set(['RESOURCE', 'NOT_FOUND', 'SANDBOX']);
 const PROVIDER_CODES = new Set(['NETWORK']);
 const INSTALLATION_CODES = new Set(['AUTH']);
 const MODEL_CODES = new Set(['MODEL']);
+const STATUS_REASON_CODES = new Set(['NOT_FOUND', 'SPAWN_REFUSED', 'RATE_LIMIT', 'RESOURCE', 'SANDBOX',
+  'NETWORK', 'AUTH', 'MODEL', 'UNKNOWN']);
+export const RECOVERY_STATUS_LIMIT = 32;
 
 export const scopeKeyFor = Object.freeze({
   invocation: (id) => `invocation:${id ?? 'unknown'}`,
@@ -511,6 +514,7 @@ export class ScopedFailureBreaker extends EventEmitter {
     this._scopes = new Map();
     this._outstanding = new Map();
     this._hostFailureFacts = [];
+    this._transitions = [];
     this._canarySeq = 0;
     this._observedInvocations = new Set();
     this.canariesObserved = 0;
@@ -1022,6 +1026,10 @@ export class ScopedFailureBreaker extends EventEmitter {
     const from = rec.status;
     if (from === to) return;
     rec.status = to;
+    if (rec.scopeKey.length <= 256) this._transitions.push({ scopeKey: rec.scopeKey, scope: rec.scope, from, to,
+      reasons: [...rec.evidence.keys()].filter(code => STATUS_REASON_CODES.has(code)).slice(0, 8),
+      atMs: this.nowMs(), nextEligibleAtMs: to === 'closed' ? null : rec.nextProbeAtMs });
+    if (this._transitions.length > RECOVERY_STATUS_LIMIT) this._transitions.shift();
     this.emit('transition', { scopeKey: rec.scopeKey, from, to, action,
       distinctFailures: new Set(rec.failures.map(failure => failure.invocationId)).size, reasons: [...rec.evidence.keys()],
       nextEligibleAtMs: rec.nextProbeAtMs, resetAtMs: rec.resetAtMs,
@@ -1454,6 +1462,23 @@ export class ScopedFailureBreaker extends EventEmitter {
     };
   }
 
+  /** Pure status projection: never sweep reservations, probe, or advance state. */
+  recoveryStatus() {
+    const recentKeys = [...new Set(this._transitions.map(event => event.scopeKey).reverse())];
+    const active = [...this._scopes.values()].filter(rec => rec.status !== 'closed');
+    const keys = [...new Set([...active.map(rec => rec.scopeKey), ...recentKeys])];
+    const scopes = keys.filter(key => key.length <= 256).slice(0, RECOVERY_STATUS_LIMIT).map(scopeKey => {
+      const rec = this._scopes.get(scopeKey);
+      const last = this._transitions.findLast(event => event.scopeKey === scopeKey);
+      return { scopeKey, scope: rec?.scope ?? last.scope, state: rec?.status ?? last.to,
+        reasons: rec ? [...rec.evidence.keys()].filter(code => STATUS_REASON_CODES.has(code)).slice(0, 8) : [...last.reasons],
+        nextEligibleAtMs: !rec || rec.status === 'closed' ? null : rec.nextProbeAtMs,
+        canaryInFlight: rec?.activeCanary != null };
+    });
+    return { observedAtMs: this.nowMs(), scopes, omittedScopeCount: Math.max(0, keys.length - scopes.length),
+      transitions: this._transitions.map(event => ({ ...event, reasons: [...event.reasons] })) };
+  }
+
   /** Correlate launcher-observed host faults across resolved inference backends.
    * Replay the first fault once corroborated, preserving the three-distinct
    * threshold even when the first backend alone could not establish scope.
@@ -1550,6 +1575,7 @@ export class ScopedFailureBreaker extends EventEmitter {
 
   destroy() {
     this._hostFailureFacts = [];
+    this._transitions = [];
     for (const rec of this._scopes.values()) rec.breaker.destroy();
     this._scopes.clear();
     this._outstanding.clear();

package/tools/ralph-external/lib/launcher-recovery-evidence.mjs

@@ -3,6 +3,7 @@ import { runRecoveryProbe } from './recovery-probe.mjs';
 /** Recovery evidence observed outside worker output by the launch owner. */
 const observations = new WeakMap();
 const failureHints = new WeakMap();
+const assessed = new WeakSet();
 
 export function recordLauncherRecoveryHint(result, reasonCode) {
   failureHints.set(result, reasonCode);
@@ -23,9 +24,10 @@ export function launcherRecoveryEvidence(result) {
  */
 export async function observeLauncherRecoveryOutcome({ invocation, result, installation, breaker,
   failureHint = '', beforeRequest, onDispatch, fetchImpl = globalThis.fetch, wallNowMs = Date.now, timeoutMs = 10_000 } = {}) {
-  if (!result || result.attemptOutcome !== 'failed' || result.cancelled) return;
+  if (!result || result.attemptOutcome !== 'failed' || result.cancelled || assessed.has(result)) return;
   const backend = invocation?.selected?.inferenceProvider;
   if (HOST_ERRORS.has(result.errorCode) || HOST_RESULTS.has(result.nativeResult)) {
+    assessed.add(result);
     const corroboratedBackends = breaker?.observeHostFailure({ invocationId: result.invocationId,
       inferenceProvider: backend, reasonCode: 'RESOURCE' }) ?? [];
     if (corroboratedBackends.length >= 2) observations.set(result, {
@@ -43,6 +45,10 @@ export async function observeLauncherRecoveryOutcome({ invocation, result, insta
     if (!await beforeRequest()) return;
     const requestTimeoutMs = remaining();
     if (!Number.isFinite(requestTimeoutMs) || requestTimeoutMs <= 0) return;
+    // One diagnostic request per attempt, including unsuccessful diagnostics.
+    // Re-reading a result cannot consume allowance or create fresh evidence.
+    if (assessed.has(result)) return;
+    assessed.add(result);
     const observed = await runRecoveryProbe({ driver: { qualification: { installation } }, invocation: invocation ?? { transport: 'shell' },
       timeoutMs: Math.min(10_000, requestTimeoutMs), maxOutputBytes: 65_536, onDispatch, fetchImpl, wallNowMs });
     if (observed.reason === 'probe-rate-limited') {

package/tools/ralph-external/lib/recovery-probe.mjs

@@ -1,6 +1,8 @@
+import { RecoveryPolicy } from './consecutive-failure-circuit-breaker.mjs';
+
 /** A recovery probe is a conductor-owned request, never an uncontained worker. */
 export async function runRecoveryProbe({ driver, invocation, timeoutMs = 10_000, maxOutputBytes = 65_536,
-  onDispatch, fetchImpl = globalThis.fetch, wallNowMs = Date.now }) {
+  onDispatch, fetchImpl = globalThis.fetch, wallNowMs = Date.now, nowMs = () => performance.now() }) {
   if (!Number.isFinite(timeoutMs) || timeoutMs <= 0 || timeoutMs > 10_000
     || !Number.isSafeInteger(maxOutputBytes) || maxOutputBytes < 1 || maxOutputBytes > 65_536) {
     throw new RangeError('Recovery probe exceeds the 10s/64KiB bounds');
@@ -19,6 +21,7 @@ export async function runRecoveryProbe({ driver, invocation, timeoutMs = 10_000,
     return failed('probe-endpoint-unavailable', { operatorIntervention: true });
   }
   const controller = new AbortController();
+  const deadlineMs = nowMs() + timeoutMs;
   const timer = setTimeout(() => controller.abort(), Math.max(1, Math.floor(timeoutMs)));
   let aborted;
   const timeout = new Promise((_, reject) => {
@@ -30,14 +33,19 @@ export async function runRecoveryProbe({ driver, invocation, timeoutMs = 10_000,
   timeout.catch(() => {});
   try {
     await onDispatch?.();
+    if (nowMs() >= deadlineMs) controller.abort();
     if (controller.signal.aborted) return failed('probe-timeout');
     try {
       // HEAD has no task, credentials, inference body or worker filesystem.
       // A successful endpoint check permits only one subsequent task canary.
       const response = await Promise.race([fetchImpl(endpoint, { method: 'HEAD', redirect: 'error', signal: controller.signal }), timeout]);
       let headerBytes = 16 + Buffer.byteLength(response.statusText ?? '');
-      for (const [name, value] of response.headers) headerBytes += Buffer.byteLength(name) + Buffer.byteLength(value) + 4;
       try {
+        if (nowMs() >= deadlineMs) { controller.abort(); return failed('probe-timeout'); }
+        for (const [name, value] of response.headers) {
+          headerBytes += Buffer.byteLength(name) + Buffer.byteLength(value) + 4;
+          if (headerBytes > maxOutputBytes) return failed('probe-output-limit');
+        }
         if (headerBytes > maxOutputBytes) return failed('probe-output-limit');
         if (response.body) return failed('probe-body-unexpected');
         const success = response.status >= 200 && response.status <= 299;
@@ -45,7 +53,8 @@ export async function runRecoveryProbe({ driver, invocation, timeoutMs = 10_000,
         if (response.status === 429) {
           const after = response.headers.get('retry-after');
           const seconds = after != null && /^\d+(?:\.\d+)?$/.test(after.trim()) ? Number(after) : null;
-          const date = seconds === null && after ? Date.parse(after) : NaN;
+          const date = seconds === null && /^[A-Z][a-z]{2}, \d{2} [A-Z][a-z]{2} \d{4} \d{2}:\d{2}:\d{2} GMT$/.test(after ?? '')
+            ? Date.parse(after) : NaN;
           const reset = response.headers.get('x-ratelimit-reset');
           const resetEpoch = reset != null && /^\d+(?:\.\d+)?$/.test(reset.trim()) ? Number(reset) * 1000 : NaN;
           const resetDelay = response.headers.get('ratelimit-reset');
@@ -53,7 +62,8 @@ export async function runRecoveryProbe({ driver, invocation, timeoutMs = 10_000,
             Number.isFinite(resetEpoch) ? (resetEpoch - wallNowMs()) / 1000 : null,
             resetDelay != null && /^\d+(?:\.\d+)?$/.test(resetDelay.trim()) ? Number(resetDelay) : null]
             .filter(value => Number.isFinite(value) && value >= 0);
-          return failed('probe-rate-limited', { retryAfterSeconds: delays.length ? Math.max(...delays) : null });
+          return failed('probe-rate-limited', { retryAfterSeconds: delays.length
+            ? Math.min(RecoveryPolicy.maxRetryAfterSeconds, Math.max(...delays)) : null });
         }
         return failed('probe-failed', { status: response.status });
       } finally {

package/tools/ralph-external/process-monitor.mjs

@@ -15,7 +15,7 @@ import { hostname } from 'node:os';
 import { join, dirname } from 'path';
 import { constants } from 'node:fs';
 import { open, opendir, rename, unlink } from 'node:fs/promises';
-import { randomUUID } from 'node:crypto';
+import { createHash, randomUUID } from 'node:crypto';
 import path from 'node:path';
 import { createWorkerHealthObserver } from './lib/worker-health.mjs';
 
@@ -38,6 +38,9 @@ import { createWorkerHealthObserver } from './lib/worker-health.mjs';
 // error, a thrown assertion, ...) and silently report every live-process
 // health query as unavailable instead of surfacing the actual failure.
 let boundedExecFileSync = null;
+let projectRecoveryStatus = null;
+let mergeRecoveryStatuses = null;
+let projectStartupCorrection = null;
 let processHealthUnavailableReason = null;
 let importImpl;
 try {
@@ -58,6 +61,11 @@ if (importImpl) {
     if (!['AIWG_IMPLEMENTATION_MISSING', 'AIWG_PACKAGE_ROOT_MISSING'].includes(error?.code)) throw error;
     processHealthUnavailableReason = `bounded-child-process helper unavailable: implementation missing: ${error.message}`;
   }
+  try {
+    ({ projectRecoveryStatus, mergeRecoveryStatuses, projectStartupCorrection } = await importImpl(import.meta.url, 'mission-protocol/worker-status.js'));
+  } catch (error) {
+    if (!['AIWG_IMPLEMENTATION_MISSING', 'AIWG_PACKAGE_ROOT_MISSING'].includes(error?.code)) throw error;
+  }
 }
 
 /** Side-effect-free Linux sample. Unknown identity never grants signal authority. */
@@ -848,8 +856,10 @@ export async function sampleWorkerStatus(options, memory = new Map()) {
   const monotonicNow = options.monotonicNow ?? monotonicMs;
   const began = monotonicNow();
   const report = { version: 1, sampledAt, scope: 'direct-conductor', observerCoverage: 'unobserved',
-    workers: [], breakers: [], nextCheckAt: null, complete: true, findings: [], exitCode: 0 };
+    workers: [], breakers: [], recovery: { source: 'unavailable', observedAt: null, observedAtMs: null,
+      scopes: [], transitions: [], omittedScopeCount: 0, truncated: false }, nextCheckAt: null, complete: true, findings: [], exitCode: 0 };
   let root;
+  const recoveryOwners = new Map();
   try {
     root = await openStatusDirectory(options.runDir ?? options.runsRoot);
     const listing = options.runDir ? { entries: [{ name: null }], complete: true }
@@ -870,6 +880,11 @@ export async function sampleWorkerStatus(options, memory = new Map()) {
           process: await statusRecord(directory, 'process.json', true), health: await statusRecord(directory, 'health.json'),
           exit: await statusRecord(directory, 'exit.json'), scratch: await statusRecord(directory, 'last-observed.json') };
         const ownerRecord = await statusRecord(directory, '.status-observer');
+        const supervisor = records.process.supervisor;
+        const ownerHost = safeLabel(supervisor?.host), ownerBoot = safeLabel(supervisor?.bootId), ownerStart = safeLabel(supervisor?.startTicks);
+        const launcherOwnerRecorded = records.process.origin === 'launcher'
+          && supervisor?.uid === process.getuid() && Number.isSafeInteger(supervisor.pid) && supervisor.pid > 0
+          && ownerHost && ownerBoot && ownerStart;
         const expected = records.process.worker;
         // classifyWorkerStatus() also ignores an unverified worker for this
         // comparison; skip the resample too so this never samples an
@@ -884,6 +899,22 @@ export async function sampleWorkerStatus(options, memory = new Map()) {
           ? (options.sampleIdentity ?? sampleWorkerIdentity)(ownerIdentity.pid) : null;
         const row = classifyWorkerStatus(records, { now, monotonicNow: sampleTime, bootId, actual, counters,
           previous: memory.get(key), ownerRecord, actualObserver });
+        if (projectRecoveryStatus && launcherOwnerRecorded && records.process.recovery) {
+          const recovery = projectRecoveryStatus(records.process.recovery, 'recorded');
+          const ownerKey = JSON.stringify([ownerHost, ownerBoot, supervisor.pid, ownerStart]);
+          const previous = recoveryOwners.get(ownerKey);
+          if (recovery.observedAt && (!previous || Date.parse(recovery.observedAt) > Date.parse(previous.observedAt)
+            || recovery.observedAt === previous.observedAt && recovery.transitions.length >= previous.transitions.length)) {
+            const digest = createHash('sha256').update(ownerKey).digest('hex').slice(0, 12);
+            const owner = `${supervisor.pid}@${ownerHost.slice(0, 80)}:${ownerStart.slice(0, 32)}:${digest}`;
+            for (const scope of recovery.scopes) scope.owner = owner;
+            for (const transition of recovery.transitions) transition.owner = owner;
+            recoveryOwners.set(ownerKey, recovery);
+            report.recovery = mergeRecoveryStatuses([...recoveryOwners.values()]);
+          }
+        }
+        const correction = launcherOwnerRecorded && projectStartupCorrection?.(records.process.startupCorrection);
+        if (correction) row.startupCorrection = correction;
         report.findings.push(...row.findings.map(finding => `${row.invocationId}: ${finding}`));
         if (row.observerOwnership === 'unavailable') report.findings.push('OBSERVER_OWNER_UNAVAILABLE: reconcile reservation before observing');
         memory.set(key, { cpuTicks: actual?.cpuTicks ?? null, counters, health: row.health });
@@ -975,12 +1006,19 @@ export function createStatusObservationOwner() {
 export function formatWorkerStatus(report) {
   const label = value => value == null ? '?' : String(value);
   const seconds = value => value == null ? '?' : `${Math.round(value * 1000) / 1000}s`;
+  const recovery = report.recovery;
+  const recoveryLines = !recovery || recovery.source === 'unavailable'
+    ? ['Recovery scope status unavailable: no recorded recovery owner observation']
+    : [`Recovery scopes (${recovery.source}) observed=${label(recovery.observedAt)} omitted=${recovery.omittedScopeCount} truncated=${recovery.truncated}`,
+      ...recovery.scopes.map(scope => `  ${scope.scopeKey} state=${scope.state} reasons=${scope.reasons.join(',') || 'UNKNOWN'} next eligible=${label(scope.nextEligibleAt ?? scope.nextEligibleAtMs)} canary in flight=${scope.canaryInFlight}${scope.owner ? ` owner=${scope.owner}` : ''}`),
+      ...recovery.transitions.map(transition => `  ${transition.scopeKey}: ${transition.from} -> ${transition.to} at=${label(transition.at ?? transition.atMs)} reasons=${transition.reasons.join(',') || 'UNKNOWN'} next eligible=${label(transition.nextEligibleAt ?? transition.nextEligibleAtMs)}${transition.owner ? ` owner=${transition.owner}` : ''}`)];
   return [`Workers (${report.scope}) coverage=${report.observerCoverage} complete=${report.complete} breakers=${report.breakers.length} (no shared Tier 0 breaker authority)`,
     'invocation | member | state | coverage | age | last progress | remaining | cause | next action',
     ...report.workers.map(row => row.error ? `? | ? | unreadable | ? | ? | ? | ? | ${row.error.code} | ${row.nextAction}`
       : `${row.invocationId} | ${label(row.member)} | ${row.health.state} | ${row.health.coverage} | ${seconds(row.elapsedSeconds)} | ${seconds(row.ages.progressSeconds)} | ${seconds(row.remainingSeconds)} | ${row.health.reasonCode} | ${row.nextAction}\n`
-        + `  thresholds=${JSON.stringify(row.thresholds)} termination=${row.termination} verification=${label(row.verification)} observer-gap=${row.health.maxCheckGapSeconds}s`),
-    ...report.findings, `next check=${label(report.nextCheckAt)}`].join('\n');
+        + `  thresholds=${JSON.stringify(row.thresholds)} termination=${row.termination} verification=${label(row.verification)} observer-gap=${row.health.maxCheckGapSeconds}s`
+        + (row.startupCorrection ? `\n  startup correction=${row.startupCorrection.action} state=${row.startupCorrection.state} reason=${row.startupCorrection.reasonCode} stop=${label(row.startupCorrection.stopCode)}` : '')),
+    ...recoveryLines, ...report.findings, `next check=${label(report.nextCheckAt)}`].join('\n');
 }
 
 /** One bounded foreground loop. Timeout only stops watching, never the worker. */