@andorra-labs/code 0.0.0-stage → 0.1.5

package/dist/src/graph-runner.js

@@ -0,0 +1,1356 @@
+import { permissionMode } from './permissions.js';
+import { DecisionManager } from './decision/DecisionManager.js';
+import { randomUUID } from 'node:crypto';
+import { TodoStore } from './todos.js';
+import { WidgetStore } from './widgets.js';
+import { isDeepStrictEqual } from 'node:util';
+import { validateGraph, nodeOutcomes, maxNodeVisitsOf } from './graphs.js';
+import { executeModifiedAgent, matchesOutput } from './agent-modifiers.js';
+import { executeAgentNode } from './agent-execution.js';
+import { resolveLimits, stopReasonSentence, withinToolBudget, generateWithUsage } from './runtime.js';
+import { bindUserWaits, createRuntimeBudget } from './deadline.js';
+import { capabilityTools } from './capabilities.js';
+import { canonicalToolName } from './tool-names.js';
+import { ArtifactStore } from './artifacts.js';
+import { resolveValue, validateValue, nodeOutputSchema } from './handoffs.js';
+import { memorySearchTool } from './memory/tools/memorySearchTool.js';
+import { resolveEfficiency } from './efficiency.js';
+import { collectWorkspaceFacts } from './workspace-facts.js';
+import { MemoryManager } from './memory/MemoryManager.js';
+import { loadConfig, resolveMemoryConfig } from './config.js';
+import { elapsedMs, monotonicNow } from './duration.js';
+import { dashboardAdapter } from './dashboard.js';
+import { createRunTelemetry, mergeRunTelemetry, recordAttempt, recordTestCommand, recordToolFailure, recordToolUse } from './telemetry/capture.js';
+import { isTestCommandLine } from './telemetry/classify.js';
+/**
+ * Fold one node's telemetry and failure classification into the run.
+ *
+ * A graph run loses the structured provider-failure marker unless it is copied here, which would
+ * report every provider outage as `infrastructure`. The same is true of the context-overflow
+ * classification: copying it keeps an over-window input out of the provider-failure rate.
+ */
+function absorbTelemetry(result, outcome) {
+    if (outcome.telemetry)
+        mergeRunTelemetry(result.telemetry, outcome.telemetry);
+    if (outcome.providerRequestFailed)
+        result.providerRequestFailed = true;
+    if (outcome.providerOverflow)
+        result.providerOverflow = true;
+}
+const freeze = (value) => {
+    for (const child of Object.values(value))
+        if (child && typeof child === 'object')
+            freeze(child);
+    Object.freeze(value);
+};
+/**
+ * Tool calls still available to one node when the run ceiling is optional.
+ * Unlimited stays undefined; subtracting from an absent ceiling would produce NaN
+ * and hand every downstream branch a meaningless budget.
+ * @param maxToolCalls - run ceiling, or undefined for unlimited.
+ * @param used - tool calls the run has already consumed.
+ * @returns the remaining allowance, or undefined for unlimited.
+ */
+function remainingToolBudget(maxToolCalls, used) {
+    return maxToolCalls === undefined ? undefined : maxToolCalls - used;
+}
+/**
+ * Split the remaining run allowance across concurrent branches.
+ * @param maxToolCalls - run ceiling, or undefined for unlimited.
+ * @param used - tool calls the run has already consumed.
+ * @param branches - number of branches sharing the remaining allowance.
+ * @returns each branch's share, or undefined when the run is unlimited.
+ */
+function shareToolBudget(maxToolCalls, used, branches) {
+    const remaining = remainingToolBudget(maxToolCalls, used);
+    return remaining === undefined ? undefined : Math.floor(remaining / branches);
+}
+const equal = isDeepStrictEqual;
+function mergeInputs(target, incoming, nodeId) {
+    for (const [key, value] of Object.entries(incoming)) {
+        if (Object.hasOwn(target, key) && !equal(target[key], value))
+            throw new Error(`Node ${nodeId}: conflicting input "${key}" from incoming routes. Rename the mappings or use matching values.`);
+        target[key] = value;
+    }
+}
+/** Graph stages route validated completions only. Internal delegation remains inside executeAgentNode. */
+export async function runGraph(graph, options) {
+    if (!options.memory || !options.decisionManager) {
+        const config = await loadConfig();
+        options = { ...options, decisionManager: options.decisionManager ?? new DecisionManager({ config: config.decisions, onEvent: options.onEvent }), memory: options.memory ?? await MemoryManager.create({
+                config: resolveMemoryConfig(config), workspace: options.context.workspace, onEvent: options.onEvent, getPermissions: () => permissionMode(options.context),
+            }) };
+    }
+    options.memory.setPermissionsReader(() => permissionMode(options.context));
+    const pinned = validateGraph(graph);
+    freeze(pinned);
+    const limits = resolveLimits(options.limits);
+    for (const [name, value] of Object.entries(limits)) {
+        if (value === undefined)
+            continue;
+        if (!Number.isSafeInteger(value) || value < (name === 'maxCompletionRepairs' || name === 'maxToolCalls' ? 0 : 1))
+            throw new Error(`Invalid limit: ${name}`);
+    }
+    // Only an explicit graph ceiling can tighten the run allowance; when neither is set
+    // the run is unbounded and stays undefined rather than becoming a fabricated number.
+    for (const key of ['maxToolCalls', 'wallTimeMs']) {
+        const pinnedLimit = pinned.limits?.[key];
+        if (pinnedLimit === undefined)
+            continue;
+        limits[key] = limits[key] === undefined ? pinnedLimit : Math.min(limits[key], pinnedLimit);
+    }
+    const runInput = { ...options.runInput, task: options.task };
+    const runState = structuredClone(options.runState ?? {});
+    if (pinned.inputSchema)
+        validateValue(pinned.inputSchema, runInput, 'Run inputs');
+    if (pinned.stateSchema)
+        validateValue(pinned.stateSchema, runState, 'Run state');
+    // The model identity this run would execute a node with, mirroring the runtime's own resolution
+    // (`node.provider ?? run provider`, and the model the node declares or the resolved provider's
+    // configured one). A per-provider model the runtime resolves later is unknowable here, so only
+    // the identities this build can prove are compared.
+    const nodeIdentity = (nodeId) => {
+        const node = pinned.nodes[nodeId];
+        const provider = node?.provider ?? options.provider;
+        if (node?.model !== undefined)
+            return { provider, model: node.model };
+        if (node?.provider === undefined)
+            return { provider, model: options.model };
+        try {
+            return { provider, model: options.resolveProvider?.(node.provider)?.model };
+        }
+        catch {
+            return { provider };
+        }
+    };
+    // Only an agent node runs a model, so only its start line names one: an action or routing node
+    // has no model identity, and claiming the run's inherited one would tell a surface reading the
+    // rail that the node ran on a model it never called.
+    const startIdentity = (nodeId, routed) => routed ?? (pinned.nodes[nodeId]?.type === 'agent' ? nodeIdentity(nodeId) : {});
+    // A checkpoint's conversation is the NODE's own transcript — system prompt, tool definitions,
+    // continuation counters — and the runtime installs it as the resumed visit's history without
+    // checking who wrote it (unlike a predecessor handoff, which is gated on the same identity).
+    // Handing it to a node the graph or profile now resolves to another provider/model would give
+    // the new model instructions and counters from a different one: restart that visit fresh.
+    // `undefined` on either side of a comparison means unknowable, not different.
+    const sameIdentity = (candidate, identity) => {
+        if (!candidate)
+            return false;
+        if (candidate.provider !== undefined && candidate.provider !== identity.provider)
+            return false;
+        return candidate.model === undefined || identity.model === undefined || candidate.model === identity.model;
+    };
+    const continuableByThisRun = (nodeId, checkpoint) => {
+        if (checkpoint.provider === undefined && checkpoint.model === undefined)
+            return true;
+        const identity = nodeIdentity(nodeId);
+        // The conversation's own pair matching the configured one is the unchanged rule. Adaptive
+        // routing adds a second way: the checkpoint carries the baseline it was routed FROM, and a
+        // baseline this run still computes proves the routed pair was this configuration's own
+        // decision — so the conversation may continue on the model that actually ran. A baseline
+        // that no longer matches (the graph or provider configuration changed) keeps the old rule
+        // and the visit restarts fresh.
+        if (sameIdentity(checkpoint, identity))
+            return true;
+        return sameIdentity(checkpoint.routedFrom, identity);
+    };
+    // The pair a continuable checkpoint's conversation ran on when it is NOT the configured one:
+    // the routed pair this run's own routing decision produced. The re-entered visit is pinned to
+    // it (see the seeding below), so the transcript continues on the model that wrote it.
+    const routedContinuation = (nodeId, checkpoint) => {
+        if (checkpoint.provider === undefined || checkpoint.model === undefined)
+            return undefined;
+        const identity = nodeIdentity(nodeId);
+        if (sameIdentity(checkpoint, identity))
+            return undefined;
+        if (!sameIdentity(checkpoint.routedFrom, identity))
+            return undefined;
+        return { provider: checkpoint.provider, model: checkpoint.model };
+    };
+    if (options.resumeFrom) {
+        // The journal replay can prove the stopped attempt already ran its whole graph with nothing
+        // left to continue: an empty frontier alongside nodes or visits the journal proves (visits
+        // included, because a node removed from the edited graph keeps its visit count but can never
+        // re-enter), no completed End whose bare re-entry would finalize the attempt instead, and no
+        // checkpoint still owning a conversation to re-enter. Seeding that position would leave only
+        // the entry queue: every completed node run again, its tool effects and token spend paid a
+        // second time. That is not continuing an invocation, so the refusal lands here — before the
+        // budget timer, the user-wait binding, and telemetry open — and nothing opened needs
+        // unwinding. The follow-up the user sends carries the finished work as session context.
+        // The exemption mirrors the seeding below exactly: a checkpoint the seeding would install
+        // (its node in the graph, no recorded completion — an interrupted frontier is impossible
+        // with a pending array this code has already proven empty — and the provider/model stamp
+        // this run may continue) means the journal's empty frontier only says the node's start line
+        // never reached it: the attempt is recoverable, not finished. And an End completed on one
+        // branch cannot finalize while a join another branch owes still sits unresolved — the
+        // re-entry would throw after `run.started`, so the request is refused instead.
+        const stopped = options.resumeFrom.progress;
+        const provenWork = Object.keys(stopped.nodeResults).length > 0 || Object.values(stopped.visits).some(count => count > 0);
+        const unresolvedJoins = (stopped.waitingJoins ?? []).some(join => pinned.nodes[join.nodeId] !== undefined && !Object.hasOwn(stopped.nodeResults, join.nodeId));
+        const canFinalizeThroughEnd = !unresolvedJoins && Object.values(pinned.nodes).some(node => node.type === 'end' && stopped.nodeResults[node.id] !== undefined);
+        const recoverableCheckpoint = (options.resumeFrom.checkpoints ?? []).some(checkpoint => pinned.nodes[checkpoint.nodeId] !== undefined && !Object.hasOwn(stopped.nodeResults, checkpoint.nodeId) && continuableByThisRun(checkpoint.nodeId, checkpoint));
+        if (stopped.pending.length === 0 && provenWork && !canFinalizeThroughEnd && !recoverableCheckpoint) {
+            throw new Error('Cannot resume: the stopped attempt had already run every step its journal records, so there is nothing left to continue. Send a follow-up message instead of resuming.');
+        }
+    }
+    const budget = createRuntimeBudget(options.context.signal, limits.wallTimeMs, options.context.runControl);
+    const signal = budget.signal;
+    const confirmedClarifications = [];
+    let approvalQueue = Promise.resolve();
+    // Bind before queueing: the queue must serialize the budget-aware `approve`, or a wait
+    // that only enters the queue would still be charged to the run's clock.
+    const awaiting = bindUserWaits(options.context, budget, signal);
+    const askUser = awaiting.askUser;
+    const context = {
+        ...awaiting,
+        toolState: awaiting.toolState ?? { fileReads: new Map() },
+        approve: (...args) => {
+            const pending = approvalQueue.then(() => { args[2].throwIfAborted(); return awaiting.approve(...args); });
+            approvalQueue = pending.catch(() => { });
+            return pending;
+        },
+        ...(askUser ? { askUser: async (...args) => {
+                const answer = await askUser(...args);
+                if (typeof answer === 'string' && answer.trim())
+                    confirmedClarifications.push({ question: args[0], answer });
+                return answer;
+            } } : {}),
+    };
+    const result = {
+        id: options.runId ?? randomUUID(), graph: pinned, provider: options.provider, model: options.model,
+        status: 'exhausted', usage: { inputTokens: 0, outputTokens: 0, requests: 0 }, toolCalls: 0, nodeResults: {},
+        limits: { ...limits }, telemetry: createRunTelemetry(),
+    };
+    const todoStore = options.todoStore ?? new TodoStore();
+    // Widgets belong to the run, not to a branch: every node and every parallel copy updates the
+    // same values, exactly as they all keep the one plan.
+    const widgetStore = options.widgetStore ?? new WidgetStore(pinned.widgets);
+    // A resumed run's plan is seeded into the store where it is read, but announced only after
+    // `graph.started`: the browser activity sink clears its checklist on that event, so publishing
+    // earlier would have the resume erase the very plan it carried.
+    let seededPlan;
+    const artifactStore = options.artifactStore ?? new ArtifactStore(result.id);
+    options.codeIntel?.beginRun(result.id);
+    const emit = async (type, data = {}) => {
+        const event = { type, time: new Date().toISOString(), data: { runId: result.id, ...(typeof data.nodeId === 'string' ? { nodeName: pinned.nodes[data.nodeId]?.name, nodeType: pinned.nodes[data.nodeId]?.type } : {}), ...data } };
+        options.commandMemory?.observe(event);
+        await options.onEvent?.(event);
+    };
+    // Skill activation is run-wide and independent of conversation reuse or provider identity.
+    // Journal replay restores it before any resumed frontier node starts.
+    const activeSkills = new Set(options.resumeFrom?.progress.activeSkills ?? []);
+    const queue = [{ nodeId: pinned.entry, generation: 0, path: [], inputs: {}, predecessors: {} }];
+    const visits = new Map();
+    const executed = new Set();
+    let nextGeneration = 0;
+    const pendingJoins = new Map();
+    let currentNode = pinned.entry;
+    let lastCompletion;
+    if (options.resumeFrom) {
+        // Rehydrate the scheduler from the journal replay of a stopped attempt. The frontier is
+        // assembled first and only installed when the journal proved something worth continuing.
+        // Every frontier entry carries the mapped inputs and predecessors its activation had —
+        // replay proves those queued but unfinished, and re-entering one with empty inputs would
+        // fail the node's own schema checks for work its predecessor already paid for. A captured
+        // checkpoint re-enters its node's conversation too (the same continuation the pause/resume
+        // control uses), one per unfinished branch. With nothing proven, nothing is seeded at all —
+        // running the task from entry is the safe restart, and an empty seeded frontier would only
+        // trip `maxNodeVisits`.
+        const { progress, checkpoints: captured } = options.resumeFrom;
+        // Draw fresh generation numbers from where the stopped attempt left them: the executed set
+        // below is seeded with the journal's generation-keyed entries, so a resumed revisit must draw
+        // a number that has never run rather than reissue one the journal already used.
+        nextGeneration = Math.max(nextGeneration, progress.generation ?? 0);
+        const resumable = [];
+        // The seeded activation of every `(generation, node)` identity the frontier carried: a cycle can
+        // hold the same node at two generations, and a checkpoint, a predecessor handoff, or a second
+        // activation of that node must address the one its own visit belongs to.
+        const byIdentity = new Map();
+        const generationsPerNode = new Map();
+        // The seeded re-entry of each node — the one unfinished visit it can have — for the legacy
+        // checkpoint shape that carries no visit stamp to look itself up by.
+        const reentryByNode = new Map();
+        const seededByNode = new Map();
+        const reentry = new Set();
+        const droppedNodes = new Set();
+        for (const activation of progress.pending) {
+            const node = pinned.nodes[activation.nodeId];
+            if (!node) {
+                // The graph was edited between the stop and this resume. The activation cannot be seeded,
+                // and a frontier that vanishes silently would restart the whole task from the entry —
+                // rerunning nodes `progress.nodeResults` already proves completed (and their tool effects
+                // with them). Refuse below when nothing else is left to continue.
+                droppedNodes.add(activation.nodeId);
+                continue;
+            }
+            if (activation.interrupted && node.type === 'action') {
+                // The stopped attempt was inside the shell command when it died: the journal cannot show
+                // how far the command got, and re-running it could duplicate effects that already fully
+                // or partially applied. An action node is the one node type whose work the replay cannot
+                // safely put back on the executable frontier, so the whole resume is refused and the
+                // workspace stays as the crash left it, for a human to inspect and re-start fresh.
+                throw new Error(`Cannot resume into the "${node.name}" action: the stopped attempt died while its shell command was running, and replaying it could repeat its effects. Check what the command already changed, then start a new run.`);
+            }
+            // The replay carried the generation and path this activation had at the stop: seeding them
+            // is what lets a resumed cycle classify its outgoing back-edge as a revisit instead of an
+            // already-executed suppression, and lets a later-generation activation avoid colliding with
+            // the generation-zero executed set.
+            // The parallel-group identity rides along: a branch-mode source that dispatched these
+            // successors before dying had them on the prefetch path sharing its tool-budget slice, and
+            // seeding them groupless would run the first branch on the FULL remaining allowance and
+            // starve the rest of the group.
+            const seeded = { nodeId: activation.nodeId, generation: activation.generation ?? 0, path: activation.path ?? [], inputs: structuredClone(activation.inputs), ...(activation.source ? { source: structuredClone(activation.source) } : {}), ...(activation.sourceGeneration === undefined ? {} : { sourceGeneration: activation.sourceGeneration }), predecessors: structuredClone(activation.predecessors),
+                ...(activation.parallelGroup === undefined ? {} : { parallelGroup: activation.parallelGroup, ...(activation.concurrency === undefined ? {} : { concurrency: activation.concurrency }) }) };
+            if (activation.interrupted) {
+                reentry.add(activation.nodeId);
+                reentryByNode.set(activation.nodeId, seeded);
+            }
+            byIdentity.set(`${seeded.generation}:${seeded.nodeId}`, seeded);
+            seededByNode.set(seeded.nodeId, seeded);
+            const seen = generationsPerNode.get(seeded.nodeId) ?? new Set();
+            seen.add(seeded.generation);
+            generationsPerNode.set(seeded.nodeId, seen);
+            resumable.push(seeded);
+        }
+        // The frontier nodes the journal shows as unfinished re-entries, used below to tell a
+        // completed node apart from a node that completed an earlier visit and was interrupted during
+        // a later one.
+        const interruptedFrontier = new Set(progress.pending.filter(entry => entry.interrupted).map(entry => entry.nodeId));
+        for (const checkpoint of captured ?? []) {
+            // Parallel branches each checkpoint their own conversation, and each unfinished one gets
+            // it back. A checkpoint naming a node the current graph no longer has (the graph was
+            // edited since), or one whose node already completed, cannot re-enter anything — except a
+            // node that completed an earlier visit and was interrupted on a later one: the completion
+            // describes the earlier pass, while the checkpoint holds the unfinished revisit's own
+            // conversation, which is exactly what resume must not throw away.
+            if ((Object.hasOwn(progress.nodeResults, checkpoint.nodeId) && !interruptedFrontier.has(checkpoint.nodeId)) || !pinned.nodes[checkpoint.nodeId])
+                continue;
+            // The stamped visit is the only activation this conversation can continue, so the file is
+            // addressed by the identity it carries. A stamp naming a visit this resume did not seed
+            // belongs to a visit that already ended (or to a generation the node ran at before): attaching
+            // it to whatever activation the node happens to hold instead would continue a finished
+            // conversation as if it were the unfinished one, with counters that disagree with the graph
+            // being replayed. A file from before the stamp carries no visit identity at all, so it goes to
+            // the node's unfinished visit — the only conversation an unstamped file can belong to — and
+            // otherwise to the activation the node was seeded with.
+            const stamped = checkpoint.generation === undefined ? undefined : byIdentity.get(`${checkpoint.generation}:${checkpoint.nodeId}`);
+            if (checkpoint.generation !== undefined && stamped === undefined && generationsPerNode.has(checkpoint.nodeId))
+                continue;
+            const seeded = stamped
+                ?? (checkpoint.generation === undefined ? reentryByNode.get(checkpoint.nodeId) ?? seededByNode.get(checkpoint.nodeId) : undefined)
+                ?? { nodeId: checkpoint.nodeId, generation: checkpoint.generation ?? 0, path: [], inputs: {}, predecessors: {} };
+            if (!continuableByThisRun(checkpoint.nodeId, checkpoint))
+                continue;
+            // A checkpoint older than the node's newest journaled effectful tool boundary does not cover
+            // that call: the resumed visit would re-enter the conversation from before it and can issue
+            // the same mutation again (the observation the tool produced is nowhere in the conversation).
+            // Effect-free calls — reads, run-scoped metadata, an unanswered ask_user — keep no boundary,
+            // so a crash between a checkpoint and one of those re-enters safely. The same reasoning that
+            // refuses an interrupted action node refuses this re-entry — the workspace is left as the
+            // crash left it for a human to inspect.
+            const toolEvent = progress.lastEffectfulToolEvent?.[checkpoint.nodeId];
+            if (toolEvent !== undefined && Date.parse(checkpoint.savedAt) < Date.parse(toolEvent)) {
+                throw new Error(`Cannot resume the "${pinned.nodes[checkpoint.nodeId]?.name ?? checkpoint.nodeId}" node: the stopped attempt ran a tool call after the conversation this checkpoint saved, so re-entering it could repeat an effect the checkpoint does not cover. Check what the call changed, then start a new run.`);
+            }
+            // A routed checkpoint re-enters its visit on the pair that wrote the conversation, so the
+            // restored transcript continues on the model that produced it. The pair is resolved here,
+            // before anything is seeded: an unresolvable target becomes a clean refusal instead of a
+            // mid-run failure after `run.started`, and dropping the checkpoint instead would restart
+            // the node fresh and repeat the mutations the conversation's transcript already observed.
+            const routed = routedContinuation(checkpoint.nodeId, checkpoint);
+            if (routed) {
+                const routedResolved = await (options.resolveModel
+                    ? options.resolveModel(routed.provider, routed.model, context.signal).catch(() => undefined)
+                    : routed.provider === options.provider
+                        ? { model: routed.model, adapter: options.adapter }
+                        : options.resolveProvider?.(routed.provider));
+                if (!routedResolved) {
+                    throw new Error(`Cannot resume the "${pinned.nodes[checkpoint.nodeId]?.name ?? checkpoint.nodeId}" node: its conversation ran on ${routed.provider}/${routed.model}, which this configuration no longer resolves. Restore that provider, or start a new run.`);
+                }
+                seeded.routedModel = routed;
+            }
+            seeded.continuation = { messages: checkpoint.messages, state: checkpoint.state, revision: checkpoint.revision };
+            if (!byIdentity.has(`${seeded.generation}:${seeded.nodeId}`)) {
+                // A checkpoint whose node never reached the journal (the process died before the start
+                // line appended) still owns the conversation: re-enter it ahead of the rest.
+                resumable.unshift(seeded);
+                byIdentity.set(`${seeded.generation}:${seeded.nodeId}`, seeded);
+                reentry.add(checkpoint.nodeId);
+            }
+            reentry.add(checkpoint.nodeId);
+        }
+        // Nothing left to continue although the journal proved queued work: the graph no longer carries
+        // the nodes that work named. Seeding nothing would run `queue`'s entry activation and redo
+        // every node already completed, so the resume is refused instead.
+        if (resumable.length === 0 && droppedNodes.size > 0) {
+            const missing = [...droppedNodes].map(nodeId => `"${nodeId}"`).join(', ');
+            throw new Error(`Cannot resume: the graph no longer contains the node${droppedNodes.size > 1 ? 's' : ''} ${missing} the stopped attempt still had queued. Restore the graph as it was, or start a new run.`);
+        }
+        // The live scheduler hands a routed successor the completing predecessor's model transcript
+        // (unless the predecessor asked for isolation), and a stop between the edge being journaled and
+        // the successor starting loses that handoff: the checkpoint loop above only re-attaches
+        // conversations to unfinished nodes, and a completed source's checkpoint would otherwise be
+        // discarded with it. Rebuild the handoff from the completed predecessor's durable checkpoint —
+        // its provider/model stamp is what the runtime's continue-in-place gate requires.
+        const checkpointsPerNode = new Map();
+        for (const checkpoint of captured ?? []) {
+            const list = checkpointsPerNode.get(checkpoint.nodeId) ?? [];
+            list.push(checkpoint);
+            checkpointsPerNode.set(checkpoint.nodeId, list);
+        }
+        for (const seeded of resumable) {
+            if (seeded.continuation !== undefined || seeded.conversation !== undefined)
+                continue;
+            if (pinned.nodes[seeded.nodeId]?.type !== 'agent')
+                continue;
+            for (const sourceId of Object.keys(seeded.predecessors)) {
+                const sourceNode = pinned.nodes[sourceId];
+                if (!sourceNode || sourceNode.type !== 'agent' || sourceNode.contextPolicy?.conversation === 'isolate')
+                    continue;
+                // ... and only when the file still holds the conversation of the visit that routed this
+                // activation. A cyclic source can complete again after routing it — its checkpoint file is
+                // replaced per visit and now carries that later transcript — and handing the later
+                // conversation to this successor would give it context that did not exist when its edge was
+                // routed. The generation stamp is what tells the visits apart, so a file stamped for another
+                // visit hands off nothing at all: the successor keeps the completion as its input and
+                // starts its own conversation.
+                const checkpoint = (checkpointsPerNode.get(sourceId) ?? []).find(candidate => (candidate.generation ?? 0) === (seeded.sourceGeneration ?? 0));
+                if (!checkpoint || typeof checkpoint.provider !== 'string' || typeof checkpoint.model !== 'string' || checkpoint.messages.length === 0)
+                    continue;
+                seeded.conversation = { provider: checkpoint.provider, model: checkpoint.model, messages: structuredClone(checkpoint.messages), ...(checkpoint.state.toolOutputArchive ? { toolOutputArchive: checkpoint.state.toolOutputArchive } : {}) };
+            }
+        }
+        for (const waitingJoin of progress.waitingJoins ?? []) {
+            // Partial arrivals of an all-mode join go back into the scheduler's waiting state, not the
+            // queue: the join must not run on the completed branches alone while the branches that never
+            // completed still have their work to do. It fires when the resumed completions bring the
+            // arrival for every remaining member edge, exactly as an uninterrupted run would.
+            if (!pinned.nodes[waitingJoin.nodeId] || Object.hasOwn(progress.nodeResults, waitingJoin.nodeId))
+                continue;
+            const targetKey = `${waitingJoin.generation}:${waitingJoin.nodeId}`;
+            const held = pendingJoins.get(targetKey) ?? new Map();
+            for (const [sourceId, member] of Object.entries(waitingJoin.members)) {
+                const edgeIndex = pinned.edges.findIndex(edge => edge.target === waitingJoin.nodeId && edge.source === sourceId
+                    && (edge.outcome ?? 'completed') === (member.completion.outcome ?? 'completed'));
+                if (edgeIndex < 0 || held.has(edgeIndex))
+                    continue;
+                held.set(edgeIndex, { nodeId: waitingJoin.nodeId, generation: waitingJoin.generation, path: [...waitingJoin.path],
+                    inputs: structuredClone(member.inputs), source: structuredClone(member.completion), predecessors: { [sourceId]: structuredClone(member.completion) } });
+            }
+            if (held.size > 0)
+                pendingJoins.set(targetKey, held);
+        }
+        if (resumable.length === 0) {
+            // The journal can prove a whole finished graph whose final record never landed: every
+            // node completed, End among them, and no unfired arrival left to seed. Replaying nothing
+            // would restart from the entry node and re-run every completed mutation the journal
+            // already proved done. Re-enter End alone instead: its pass performs no work, the seeded
+            // completions stand, and the scheduler finalizes on the completion that routed into End.
+            // (A proven-done frontier with NO completed End never reaches here — the refusal above
+            // rejects that shape before any of the run's resources are opened.)
+            // A graph may hold several End nodes — pick the one the journal proves completed; the
+            // first End in object order may belong to a branch that never ran.
+            const endNode = Object.values(pinned.nodes).find(node => node.type === 'end' && progress.nodeResults[node.id])
+                ?? Object.values(pinned.nodes).find(node => node.type === 'end');
+            const endResult = endNode ? progress.nodeResults[endNode.id] : undefined;
+            if (endNode && endResult) {
+                for (const [nodeId, completion] of Object.entries(progress.nodeResults))
+                    result.nodeResults[nodeId] = structuredClone(completion);
+                for (const [nodeId, count] of Object.entries(progress.visits))
+                    visits.set(nodeId, count);
+                // End's journaled visit belongs to the stopped attempt; entering it here completes that
+                // pass, it is not a second visit.
+                visits.set(endNode.id, 0);
+                if (progress.toolCalls !== undefined)
+                    result.toolCalls = progress.toolCalls;
+                for (const edge of pinned.edges) {
+                    if (edge.target !== endNode.id)
+                        continue;
+                    const source = progress.nodeResults[edge.source];
+                    if (source && (edge.outcome ?? 'completed') === (source.outcome ?? 'completed')) {
+                        lastCompletion = structuredClone(source);
+                        break;
+                    }
+                }
+                queue.length = 0;
+                queue.push({ nodeId: endNode.id, generation: 0, path: [], inputs: {}, predecessors: {} });
+                currentNode = endNode.id;
+                // The seeded plan is seeded here too, exactly as the resumable path below does, and announced
+                // once `graph.started` has passed: a client builds its checklist from the event, and this
+                // attempt has nothing else to report — but a sink that clears its checklist on the start
+                // event would swallow a plan announced before it.
+                if (progress.todos?.length) {
+                    todoStore.update(progress.todos);
+                    seededPlan = todoStore.snapshot();
+                }
+                if (progress.widgets)
+                    widgetStore.restore(progress.widgets);
+            }
+        }
+        if (resumable.length > 0) {
+            for (const [nodeId, completion] of Object.entries(progress.nodeResults)) {
+                result.nodeResults[nodeId] = structuredClone(completion);
+            }
+            // Key the executed set the way the stopped attempt keyed it — every `(generation, node)` the
+            // journal proves, not only each node's latest generation: a cycle can complete one node at two
+            // generations while older-generation work is still queued, and seeding only the later key lets
+            // the delayed earlier-generation activation run again, repeating effects the stopped attempt
+            // already paid for. A caller that carries only the per-node map (an older reader, or a test
+            // fixture) keeps its last-generation keys.
+            const executedKeys = progress.executed ?? Object.keys(progress.nodeResults).map(nodeId => `${progress.generations?.[nodeId] ?? 0}:${nodeId}`);
+            for (const key of executedKeys)
+                executed.add(key);
+            for (const [nodeId, count] of Object.entries(progress.visits))
+                visits.set(nodeId, count);
+            // The stopped attempt's tool spend carries over: a run capped at N calls had spent some (or
+            // all) of the graph-level allowance before the crash, and the resumed scheduler must budget
+            // from what is left, not hand the allowance out again.
+            if (progress.toolCalls !== undefined)
+                result.toolCalls = progress.toolCalls;
+            // Re-entry completes the stopped attempt's unfinished pass rather than costing a new visit:
+            // the node that started there already spent the visit its journal recorded, so that spend
+            // is given back or the re-entry would trip `maxNodeVisits` before it could finish.
+            for (const nodeId of reentry) {
+                const spent = visits.get(nodeId) ?? 0;
+                if (spent > 0)
+                    visits.set(nodeId, spent - 1);
+            }
+            queue.length = 0;
+            queue.push(...resumable);
+            currentNode = resumable[0].nodeId;
+            // A run resumed straight into End: an uninterrupted run finalizes on the completion of the
+            // node that routed into End, but nothing runs between the seed and End's own completion to
+            // set `lastCompletion`. Seed it from the routing source the replay carried.
+            const endSeed = resumable.find(item => pinned.nodes[item.nodeId]?.type === 'end' && item.source !== undefined);
+            if (endSeed?.source)
+                lastCompletion = structuredClone(endSeed.source);
+            // The stopped attempt's plan comes back with the position it was written for, and it is
+            // announced rather than only seeded: the runtime reads the snapshot out of the todo store on
+            // its own, but every client's checklist is built from the event, and a continuation that stayed
+            // silent until the model happened to update the plan would look like the plan was lost. The
+            // announcement waits for after `graph.started` — see `seededPlan`.
+            if (progress.todos?.length) {
+                todoStore.update(progress.todos);
+                seededPlan = todoStore.snapshot();
+            }
+            if (progress.widgets)
+                widgetStore.restore(progress.widgets);
+        }
+    }
+    const liveUsage = { inputTokens: 0, outputTokens: 0, requests: 0 };
+    // Per-node token accounting, kept separate from `liveUsage` (which is run-cumulative): the
+    // timeline's node chips show each node's own input/output tokens and decode-window throughput.
+    // A node that runs twice (a cycle) accumulates across visits, which is what the chip shows.
+    const nodeUsageTotals = new Map();
+    // Cache splits stay sparse through every graph aggregation: a node or provider
+    // that reports no cache traffic never materializes explicit zeros downstream.
+    const addUsage = (target, delta) => {
+        target.inputTokens += delta.inputTokens;
+        target.outputTokens += delta.outputTokens;
+        target.requests += delta.requests;
+        const read = (target.cacheRead ?? 0) + (delta.cacheRead ?? 0);
+        if (read > 0)
+            target.cacheRead = read;
+        const write = (target.cacheWrite ?? 0) + (delta.cacheWrite ?? 0);
+        if (write > 0)
+            target.cacheWrite = write;
+        if (delta.decodeMs !== undefined)
+            target.decodeMs = (target.decodeMs ?? 0) + delta.decodeMs;
+    };
+    // The measured aggregation for the chips' aggregates only: the decode windows of a node's
+    // requests sum — the throughput divides the covered tokens by this total, so prefill and tool
+    // gaps never enter the figure — and the numerator records how many tokens those windows
+    // actually generated. Sparse like the cache splits: a request that measured no window covers
+    // nothing, and its tokens stay out of the numerator the way its time stays out of the
+    // denominator. The field never reaches the plain `Usage` of the run record — only the chips
+    // pair a numerator with a denominator, and only these two aggregates are read by the stamp.
+    const addMeasuredUsage = (target, delta) => {
+        addUsage(target, delta);
+        if (delta.decodeMs !== undefined)
+            target.measuredOutputTokens = (target.measuredOutputTokens ?? 0) + delta.outputTokens;
+    };
+    const prefetched = new Map();
+    const prefetchedStarted = new Set();
+    // Branches whose completion was already announced when their invocation returned: the queue's
+    // later pass must not announce them a second time.
+    const prefetchedCompleted = new Set();
+    const accounted = new Set();
+    const checkpoints = new Map();
+    const conversations = new WeakMap();
+    let lastAgentActivation;
+    let controlEvents = Promise.resolve();
+    const unsubscribeControl = context.runControl?.onChange(paused => {
+        controlEvents = controlEvents.then(() => emit(paused ? 'graph.paused' : 'graph.resumed', { nodeId: currentNode }));
+        void controlEvents.catch(() => { });
+    });
+    // Read-only graph work can be retried after its interrupted request settles. Never
+    // use this helper for mutations or memory persistence, which may partially apply.
+    const readWhileRunning = async (operation) => {
+        for (;;) {
+            await context.runControl?.wait(signal);
+            const operationSignal = context.runControl ? AbortSignal.any([signal, context.runControl.signal]) : signal;
+            try {
+                operationSignal.throwIfAborted();
+                const value = await operation(operationSignal);
+                if (operationSignal.aborted && !signal.aborted)
+                    continue;
+                return value;
+            }
+            catch (error) {
+                if (!operationSignal.aborted || signal.aborted)
+                    throw error;
+            }
+        }
+    };
+    try {
+        await options.memory?.beginRun(result.id);
+        for (const skillId of options.inheritedSkills ?? []) {
+            if (activeSkills.has(skillId))
+                continue;
+            activeSkills.add(skillId);
+            await emit('graph.skill.activated', { skillId });
+        }
+        const efficiency = resolveEfficiency(options.efficiency);
+        const providers = new Map([[options.provider, { model: options.model, adapter: options.adapter }]]);
+        for (const node of Object.values(pinned.nodes)) {
+            const references = [node.provider, node.retry?.fallback?.provider, node.subagents?.provider, ...(node.subagents?.roles ?? []).map(role => role.provider)];
+            for (const provider of references) {
+                if (!provider || providers.has(provider))
+                    continue;
+                const resolved = options.resolveProvider?.(provider);
+                if (!resolved && options.resolveModel)
+                    continue;
+                if (!resolved?.adapter || typeof resolved.adapter.generate !== 'function')
+                    throw new Error(`Provider is not available: ${provider}`);
+                providers.set(provider, { ...resolved });
+            }
+        }
+        /**
+         * @param steerSource - the steering callback this invocation may poll, or undefined to
+         *   run without steering. Steering is a single destructive queue, so handing the same
+         *   callback to concurrent branches turns delivery into a race: whichever branch polls
+         *   first consumes the message and the others never see it. Parallel groups therefore
+         *   pass a wrapper that admits one branch at a time.
+         *
+         *   Passed explicitly at every call site rather than defaulted: a default would apply
+         *   when `undefined` is passed, so "no steering" would silently become "use the shared
+         *   source" and every branch would race again.
+         */
+        const invoke = async (activation, maxToolCalls, wallTimeMs, concurrencyBudget, steerSource, continuation) => {
+            const nodeId = activation.nodeId;
+            const node = pinned.nodes[nodeId];
+            // A seeded activation carries its own continuation (the re-entered node's captured
+            // conversation); the explicit argument keeps the pause/resume control path unchanged.
+            continuation = continuation ?? activation.continuation;
+            const narrow = (run, remaining) => remaining === undefined ? run : run === undefined ? remaining : Math.min(run, remaining);
+            maxToolCalls = narrow(maxToolCalls, continuation?.state.remainingToolCalls);
+            wallTimeMs = narrow(wallTimeMs, continuation?.state.remainingWallTimeMs);
+            if (wallTimeMs !== undefined && wallTimeMs <= 0)
+                return { id: result.id, graph: pinned, provider: result.provider, model: result.model, status: 'exhausted', reason: 'wallTimeMs', toolCalls: 0, usage: { inputTokens: 0, outputTokens: 0, requests: 0 } };
+            const branchTodos = new TodoStore();
+            const snapshot = todoStore.snapshot();
+            if (activation.parallelGroup && snapshot.length)
+                branchTodos.update(snapshot);
+            const visibility = node.contextPolicy?.predecessors ?? 'none';
+            const predecessorOutputs = visibility === 'none' ? undefined : structuredClone(visibility === 'all' ? result.nodeResults : activation.predecessors);
+            const runMemory = options.memory?.activeFor(result.id) ? options.memory : undefined;
+            const memoryTask = typeof activation.inputs.taskInstruction === 'string' && activation.inputs.taskInstruction.trim()
+                ? activation.inputs.taskInstruction.trim() : options.task;
+            const memoryEligible = !!runMemory && runMemory.automaticRetrieval && node.agentRole !== 'orchestrator';
+            const decisionManager = options.decisionNodeOptIn && node.jevEnabled !== true
+                ? new DecisionManager({ config: { mode: 'off', provider: 'none' } }) : options.decisionManager;
+            // An empty workspace has no repository history to recall: under context selection the
+            // baseline retrieval is skipped on that fact alone, and the node learns the same facts.
+            // The facts are recollected per activation: an implementation node can create the very
+            // files a later node needs to retrieve, and a run-started snapshot would keep gating that
+            // retrieval on the empty workspace the run began in.
+            const facts = efficiency.contextSelection || efficiency.catalogSelection
+                ? await collectWorkspaceFacts(context.workspace, { signal: context.signal }) : undefined;
+            const retrievalGated = efficiency.contextSelection && facts?.empty === true;
+            // Disabled preflight cannot replace baseline memory retrieval.
+            const baselineMemoryRetrieval = !decisionManager?.active || options.efficiency?.jevPreflight === false;
+            if (retrievalGated && baselineMemoryRetrieval && runMemory && node.agentRole !== 'orchestrator') {
+                await emit('efficiency.context.retrieval_skipped', { nodeId, reason: 'empty_workspace', source: 'memory' });
+            }
+            const memory = baselineMemoryRetrieval && runMemory && node.agentRole !== 'orchestrator' && !retrievalGated
+                ? await readWhileRunning(operationSignal => runMemory.retrieve({ task: memoryTask, nodeId, runId: result.id, signal: operationSignal }))
+                : undefined;
+            const invocationTools = runMemory ? [...options.tools, memorySearchTool(runMemory, result.id)] : options.tools;
+            const invocationTask = [options.task, memory?.block, options.commandMemory?.context()].filter(Boolean).join('\n\n');
+            const instrument = (provider, resolved) => ({
+                ...resolved, adapter: dashboardAdapter(resolved.adapter, provider, event => options.onEvent?.(event), { runId: result.id, nodeId, nodeName: node.name, nodeType: node.type }),
+            });
+            let completedConversation;
+            // A routed continuation runs on the pair its conversation was written with: the visit is
+            // pinned (its routing already served it), so re-deciding could move the model out from
+            // under the restored transcript mid-visit. Routing decides again on the visit's next
+            // fresh activation, exactly as it would for any new node entry. The override rides the
+            // node, so both executor paths resolve the routed pair through their normal machinery.
+            const routedNode = activation.routedModel ? { ...node, provider: activation.routedModel.provider, model: activation.routedModel.model } : node;
+            const outcome = await (continuation && !continuation.state.copies ? executeAgentNode : executeModifiedAgent)(routedNode, {
+                ...options,
+                ...(activation.routedModel ? { modelPinned: true } : {}),
+                adapter: instrument(options.provider, { model: options.model, adapter: options.adapter }).adapter,
+                ...(options.resolveModel ? { resolveModel: async (provider, model, signal) => instrument(provider, await options.resolveModel(provider, model, signal)) } : {}),
+                // A live replacement enters through getLiveModel rather than resolveModel. Keep the
+                // same per-node request boundaries and duration events after the switch.
+                ...(options.getLiveModel ? { getLiveModel: async (id, provider, model, signal) => {
+                        const live = await options.getLiveModel(id, provider, model, signal);
+                        return live ? { ...instrument(live.provider, live), provider: live.provider } : undefined;
+                    } } : {}),
+                task: invocationTask,
+                inheritedSkills: node.contextPolicy?.skillInheritance === 'none' ? [] : [...activeSkills],
+                instructions: node.contextPolicy?.skillInheritance === 'none' ? options.instructions
+                    : [options.instructions, options.skillInvocationInstruction].filter(Boolean).join('\n\n'),
+                onSkillActivated: async (skillId) => {
+                    if (activeSkills.has(skillId))
+                        return;
+                    activeSkills.add(skillId);
+                    await emit('graph.skill.activated', { nodeId, skillId });
+                },
+                ...(continuation ? { resumeMessages: continuation.messages, resumeState: continuation.state, resumeDirectionRevision: continuation.revision } : {}),
+                previousConversation: !continuation && node.contextPolicy?.conversation !== 'isolate' && node.contextPolicy?.skillInheritance !== 'none' ? activation.conversation : undefined,
+                onConversationCheckpoint: async (messages, state, conversation) => {
+                    if (context.runControl)
+                        checkpoints.set(nodeId, { messages, state, revision: state.directionRevision });
+                    completedConversation = conversation;
+                    // Published per node so the caller can persist the run's furthest conversation: unlike the
+                    // in-memory `checkpoints` map, which only fills while a pause control exists, durability
+                    // has to hold for every run, including one that is killed with no control ever armed. The
+                    // generation stamp tells a later resume which visit this conversation belongs to. The
+                    // identity stamp names the model the handed-off conversation ran on: continuing a
+                    // conversation requires the same provider and model, so a resume that restores this
+                    // transcript to a pending successor must know what it was built against.
+                    // The write is awaited: the checkpoint is the conversation a resume re-enters the node
+                    // with, so a run that advanced past a mutating tool call while its checkpoint was still
+                    // queued could be killed with that conversation unwritten — and the resume would re-enter
+                    // the node from its opening task and repeat the work it had already done.
+                    const identity = nodeIdentity(nodeId);
+                    await options.onNodeCheckpoint?.(nodeId, messages, state, {
+                        generation: activation.generation,
+                        ...(conversation ? { provider: conversation.provider, model: conversation.model } : {}),
+                        // The baseline this run had configured for the node: a resume whose recomputed
+                        // baseline still matches knows the conversation's own pair (if it differs) was this
+                        // configuration's routing decision, and continues the visit on it instead of
+                        // restarting the node from its opening task.
+                        routedFrom: { provider: identity.provider, ...(identity.model === undefined ? {} : { model: identity.model }) },
+                    });
+                    await options.onConversationCheckpoint?.(messages, state, conversation);
+                },
+                decisionManager,
+                ...(facts ? { workspaceFacts: facts } : {}),
+                decisionPreflight: { task: memoryTask, memory: memoryEligible, memoryAvailable: !!runMemory },
+                tools: invocationTools,
+                memory: runMemory,
+                concurrencyBudget, context, artifactStore,
+                todoStore: activation.parallelGroup ? branchTodos : todoStore,
+                widgetStore,
+                ...(activation.parallelGroup ? { onTodosUpdated: undefined } : {}), graph: pinned, runId: result.id, nodeId,
+                resolveProvider: id => { const resolved = providers.get(id); if (!resolved)
+                    throw new Error(`Provider is not available: ${id}`); return instrument(id, resolved); },
+                mappedInputs: activation.inputs, predecessorOutputs,
+                getSteeringMessages: steerSource,
+                limits: { ...limits, maxToolCalls, wallTimeMs },
+                onUsage: (usage, origin) => {
+                    addMeasuredUsage(liveUsage, usage);
+                    const total = nodeUsageTotals.get(nodeId) ?? { inputTokens: 0, outputTokens: 0, requests: 0 };
+                    addMeasuredUsage(total, usage);
+                    nodeUsageTotals.set(nodeId, total);
+                    options.onUsage?.(usage, origin);
+                },
+                onEvent: async (event) => {
+                    // The agent's own events name the invocation but never the run; every graph event
+                    // carries one. Seeding it here too is what lets the desktop key each node chip's
+                    // figures by run, so a second task in the same session that reuses a node id
+                    // cannot repaint the first task's chips with its spend.
+                    event = { ...event, data: { runId: result.id, ...event.data, nodeName: node.name, nodeType: node.type } };
+                    // `graphUsage` stays the run-cumulative reading it always was — the plain `Usage`,
+                    // without the chips' internal measured-token pairing; `nodeUsage` is the same event's
+                    // per-node figure for the chip — this activation's node so far, pairing included.
+                    if (event.type === 'agent.model.completed') {
+                        const { measuredOutputTokens: _chipsOnly, ...runUsage } = liveUsage;
+                        event = { ...event, data: { ...event.data, graphUsage: runUsage,
+                                nodeUsage: { ...(nodeUsageTotals.get(nodeId) ?? { inputTokens: 0, outputTokens: 0, requests: 0 }) } } };
+                    }
+                    if (activation.parallelGroup && event.type === 'graph.todos.updated')
+                        event = { ...event, type: 'agent.modifier.todos.updated' };
+                    options.commandMemory?.observe(event);
+                    await options.onEvent?.(event);
+                },
+            });
+            if (outcome.status === 'succeeded' && completedConversation)
+                conversations.set(activation, completedConversation);
+            else
+                conversations.delete(activation);
+            return outcome;
+        };
+        await emit('graph.started', { graph: pinned });
+        // The resumed run's plan is published here, not at the seed: the browser activity sink clears its
+        // checklist on `graph.started`, so an earlier announcement would be erased by the event that
+        // announces the very run carrying it. The store already holds it, so nothing reading the store in
+        // between sees a gap — only the event stream had to wait for the reset.
+        if (seededPlan !== undefined)
+            await emit('graph.todos.updated', { todos: seededPlan });
+        // Widgets are announced on every run that defines them, resumed or not: the definitions
+        // themselves are part of what the user watches, so the panel appears with empty values the
+        // moment the run starts rather than waiting for the first update.
+        if (widgetStore.definitionsList().length)
+            await emit('graph.widgets.updated', { widgets: widgetStore.snapshot() });
+        if (options.memory) {
+            try {
+                const health = await options.memory.health(result.id);
+                await emit('memory.health', { status: health.status, ...(health.detail ? { detail: health.detail } : {}) });
+            }
+            catch (error) {
+                await emit('memory.health', { status: 'unavailable', detail: error instanceof Error ? error.message : 'memory health check failed' });
+            }
+        }
+        while (queue.length) {
+            signal.throwIfAborted();
+            await context.runControl?.wait(signal);
+            await controlEvents;
+            if (queue[0].parallelGroup && !prefetched.has(queue[0])) {
+                const group = queue.filter(item => item.parallelGroup === queue[0].parallelGroup);
+                const maxToolCalls = shareToolBudget(limits.maxToolCalls, result.toolCalls, group.length);
+                // A zero share is a valid budget: a branch that needs no tool still returns a
+                // completion, and the runtime rejects any tool call it cannot afford. Only an
+                // already-exhausted allowance stops the group.
+                const remaining = remainingToolBudget(limits.maxToolCalls, result.toolCalls);
+                if (remaining !== undefined && remaining < 0) {
+                    result.reason = 'maxToolCalls';
+                    break;
+                }
+                const exhausted = group.find(item => (visits.get(item.nodeId) ?? 0) + 1 > maxNodeVisitsOf(pinned));
+                if (exhausted) {
+                    currentNode = exhausted.nodeId;
+                    result.reason = `maxNodeVisits:${exhausted.nodeId}`;
+                    break;
+                }
+                for (const item of group) {
+                    currentNode = item.nodeId;
+                    const node = pinned.nodes[item.nodeId];
+                    const count = (visits.get(item.nodeId) ?? 0) + 1;
+                    const mapped = {};
+                    for (const [key, expression] of Object.entries(node.inputs ?? {}))
+                        mapped[key] = resolveValue(expression, { source: item.source, run: { input: runInput, state: runState, loop: { iteration: count } } });
+                    mergeInputs(item.inputs, mapped, item.nodeId);
+                    if (node.inputSchema)
+                        validateValue(node.inputSchema, item.inputs, `Node ${item.nodeId} inputs`);
+                }
+                // One branch at a time owns the queue, and ownership transfers as branches come and go.
+                // Pinning it to a fixed branch would starve every later branch of a serial group: with
+                // maxConcurrent 1 the first branch finishes and the next runs with steering disabled,
+                // so a steer submitted then would stay queued and could reach no one.
+                const activeBranches = [];
+                const steeringFor = (item) => {
+                    const source = options.getSteeringMessages;
+                    if (!source)
+                        return undefined;
+                    return signal => (activeBranches[0] === item ? source(signal) : Promise.resolve([]));
+                };
+                const workers = Math.min(group.length, group[0].concurrency ?? 1, pinned.limits?.maxConcurrency ?? 32);
+                const concurrencyPerBranch = Math.max(1, Math.floor((pinned.limits?.maxConcurrency ?? 32) / workers));
+                let index = 0;
+                const failures = [];
+                await Promise.all(Array.from({ length: workers }, async () => {
+                    while (index < group.length && !signal.aborted && !failures.length) {
+                        const item = group[index++];
+                        // Registered before the first await so leadership follows the deterministic
+                        // start order rather than async scheduling.
+                        activeBranches.push(item);
+                        try {
+                            await emit('graph.node.started', { nodeId: item.nodeId, visit: (visits.get(item.nodeId) ?? 0) + 1, generation: item.generation, path: [...item.path], ...startIdentity(item.nodeId, item.routedModel) });
+                            prefetchedStarted.add(item);
+                            // Agent executions count their own attempts in the agent runtime; every other node
+                            // type executes only here, and the ADR counts attempts across all nodes.
+                            if (pinned.nodes[item.nodeId]?.type !== 'agent')
+                                recordAttempt(result.telemetry, (visits.get(item.nodeId) ?? 0) > 0);
+                            const outcome = await invoke(item, maxToolCalls, budget.remainingMs(), concurrencyPerBranch, steeringFor(item));
+                            prefetched.set(item, outcome);
+                            // A branch that finished while a sibling still runs answers for itself now. Waiting
+                            // for the whole Promise.all would report its completion only when the slowest sibling
+                            // returned, leaving every surface that reads liveness off this event — the TUI's
+                            // active set, the desktop rail, run progress — calling a done branch working for the
+                            // sibling's full duration. The queue's later pass skips the second announcement. An
+                            // outcome the sequential path would reject (unknown, or missing on an agent) is left
+                            // unannounced so the failure still surfaces from the same place it does today, and a
+                            // completion the queue's own output-schema validation will reject is left unannounced
+                            // too (checked below): the event is persisted in the journal, and a replay would read
+                            // a completion that validation refuses as authoritative, letting a resumed attempt
+                            // skip the invalid branch entirely. Validating here keeps the journal honest; a
+                            // violation falls through to the queue pass, which raises it at its deterministic
+                            // point and never announces the completion either.
+                            const branch = pinned.nodes[item.nodeId];
+                            if (branch?.type === 'agent' && outcome.status === 'succeeded' && outcome.completion) {
+                                const completion = outcome.completion;
+                                completion.outcome ??= 'completed';
+                                if (nodeOutcomes({ ...branch, modifiers: undefined }).includes(completion.outcome)) {
+                                    let validated = true;
+                                    const schema = nodeOutputSchema(branch);
+                                    if (schema) {
+                                        try {
+                                            validateValue(schema, completion.output, `Node ${item.nodeId} output`);
+                                        }
+                                        catch {
+                                            validated = false;
+                                        }
+                                    }
+                                    if (validated) {
+                                        await emit('graph.node.completed', {
+                                            nodeId: item.nodeId,
+                                            completion: branch.modifiers?.condition
+                                                ? { ...completion, outcome: matchesOutput(completion, branch.modifiers.condition) ? 'true' : 'false' }
+                                                : completion,
+                                        });
+                                        prefetchedCompleted.add(item);
+                                    }
+                                }
+                            }
+                        }
+                        catch (error) {
+                            failures.push(error);
+                        }
+                        finally {
+                            const at = activeBranches.indexOf(item);
+                            if (at >= 0)
+                                activeBranches.splice(at, 1);
+                        }
+                    }
+                }));
+                const failedActivation = group.find(item => { const outcome = prefetched.get(item); return outcome && outcome.status !== 'succeeded'; });
+                const failed = failedActivation && prefetched.get(failedActivation);
+                for (const item of group) {
+                    const outcome = prefetched.get(item);
+                    if (!outcome)
+                        continue;
+                    result.toolCalls += outcome.toolCalls;
+                    addUsage(result.usage, outcome.usage);
+                    absorbTelemetry(result, outcome);
+                    accounted.add(item);
+                }
+                if (failed || failures.length || signal.aborted) {
+                    if (failures.length)
+                        throw failures[0];
+                    signal.throwIfAborted();
+                    currentNode = failedActivation.nodeId;
+                    result.provider = failed.provider;
+                    result.model = failed.model;
+                    result.status = failed.status;
+                    result.reason = failed.reason ?? failed.status;
+                    // Report the failing branch's effective bounds, which a node limit can tighten.
+                    if (failed.limits)
+                        result.limits = failed.limits;
+                    break;
+                }
+            }
+            const activation = queue.shift();
+            const nodeId = currentNode = activation.nodeId;
+            const node = pinned.nodes[nodeId];
+            const count = (visits.get(nodeId) ?? 0) + 1;
+            if (count > maxNodeVisitsOf(pinned)) {
+                result.reason = `maxNodeVisits:${nodeId}`;
+                break;
+            }
+            visits.set(nodeId, count);
+            // See the parallel path: an agent counts its own attempts, and every other node type is
+            // counted here so `attempts` reflects the run's real node executions.
+            if (node.type !== 'agent')
+                recordAttempt(result.telemetry, count > 1);
+            executed.add(`${activation.generation}:${nodeId}`);
+            // The remaining budget comes from the run's own clock, so time a node spent waiting on
+            // the user is not charged to the nodes that follow it.
+            const wallTimeMs = budget.remainingMs();
+            if (wallTimeMs !== undefined && wallTimeMs <= 0) {
+                result.reason = 'wallTimeMs';
+                break;
+            }
+            const scope = { source: activation.source, run: { input: runInput, state: runState, loop: { iteration: count } } };
+            const configuredInputs = {};
+            for (const [key, expression] of Object.entries(node.inputs ?? {}))
+                configuredInputs[key] = resolveValue(expression, scope);
+            mergeInputs(activation.inputs, configuredInputs, nodeId);
+            if (node.inputSchema)
+                validateValue(node.inputSchema, activation.inputs, `Node ${nodeId} inputs`);
+            let completion = { summary: node.name, tests: [], outcome: 'completed', output: {} };
+            // The activation's generation and trail are journalled with the start line: they exist in
+            // memory only, and a resume that re-enters this visit journals no routing for it, so a replay
+            // has nothing else to reconstruct them from. A second crash would otherwise read the re-entry
+            // as a generation-zero, ancestry-free activation — rejecting the checkpoint this visit wrote
+            // and losing the revisit its outgoing back-edge owes.
+            if (!prefetchedStarted.has(activation))
+                await emit('graph.node.started', { nodeId, visit: count, generation: activation.generation, path: [...activation.path], ...startIdentity(nodeId, activation.routedModel) });
+            if (node.type === 'agent') {
+                const maxToolCalls = remainingToolBudget(limits.maxToolCalls, result.toolCalls);
+                // Only an already-overspent allowance stops the node: a zero remainder is a valid
+                // budget, since a node that needs no tool still returns a completion.
+                if (!prefetched.has(activation) && maxToolCalls !== undefined && maxToolCalls < 0) {
+                    result.reason = 'maxToolCalls';
+                    break;
+                }
+                // A node outside a parallel group runs alone, so it polls the shared source directly.
+                const outcome = prefetched.get(activation) ?? await invoke(activation, maxToolCalls, wallTimeMs, pinned.limits?.maxConcurrency ?? 32, options.getSteeringMessages);
+                prefetched.delete(activation);
+                result.provider = outcome.provider;
+                result.model = outcome.model;
+                if (!accounted.has(activation)) {
+                    result.toolCalls += outcome.toolCalls;
+                    addUsage(result.usage, outcome.usage);
+                    // A prefetched parallel outcome was merged, telemetry included, when its group settled;
+                    // absorbing it again would double the run's attempts, tokens and tool counts.
+                    absorbTelemetry(result, outcome);
+                }
+                if (outcome.status !== 'succeeded') {
+                    // Cancellation is judged from the session signal: the run signal may be fused with
+                    // this run's own clock, and a deadline must never be reported as a cancellation.
+                    const cancelled = (options.context.userSignal ?? options.context.signal).aborted;
+                    result.status = cancelled ? 'cancelled' : budget.expired() ? 'exhausted' : outcome.status;
+                    result.reason = cancelled ? 'cancelled' : budget.expired() ? 'wallTimeMs' : outcome.reason ?? outcome.status;
+                    // Report the node's effective bounds, which a node limit can tighten.
+                    if (outcome.limits)
+                        result.limits = outcome.limits;
+                    break;
+                }
+                if (!outcome.completion)
+                    throw new Error(`Agent ${nodeId} returned no validated completion.`);
+                lastAgentActivation = activation;
+                completion = outcome.completion;
+                completion.outcome ??= 'completed';
+                if (!nodeOutcomes({ ...node, modifiers: undefined }).includes(completion.outcome))
+                    throw new Error(`Agent ${nodeId} returned unknown outcome "${completion.outcome}".`);
+                if (node.modifiers?.condition)
+                    completion = { ...completion, outcome: matchesOutput(completion, node.modifiers.condition) ? 'true' : 'false' };
+                result.completion = completion;
+            }
+            if (node.type === 'condition') {
+                const source = result.nodeResults[node.condition.source];
+                if (!source)
+                    throw new Error(`Condition ${nodeId}: source ${node.condition.source} has not completed. Route its result before the condition.`);
+                const value = node.condition.path.split('.').filter(Boolean).reduce((value, key) => value && typeof value === 'object' && Object.hasOwn(value, key) ? value[key] : undefined, source.output ?? source);
+                completion.outcome = equal(value, node.condition.equals) ? 'true' : 'false';
+            }
+            else if (node.type === 'loop') {
+                completion.outcome = count <= node.loop.maxIterations ? 'body' : 'done';
+                completion.output = { iteration: count };
+            }
+            else if (node.type === 'approval') {
+                await emit('approval.requested', { nodeId, name: node.name });
+                // The approval prompt is a human wait, so it gets the session signal: the run's
+                // wall clock must not answer for the user.
+                let approved = false;
+                for (;;) {
+                    await context.runControl?.wait(signal);
+                    const promptSignal = context.runControl ? AbortSignal.any([context.userSignal ?? signal, context.runControl.signal]) : context.userSignal ?? signal;
+                    try {
+                        const answer = (context.runControl?.yolo ?? context.yolo) || (context.approvalMode !== 'headless' && await context.approve('graph.approval', { nodeId, name: node.name, inputs: activation.inputs }, promptSignal));
+                        if (answer === 'policy-changed')
+                            continue;
+                        approved = answer;
+                        if (promptSignal.aborted && !signal.aborted)
+                            continue;
+                        break;
+                    }
+                    catch (error) {
+                        if (!promptSignal.aborted || signal.aborted)
+                            throw error;
+                    }
+                }
+                signal.throwIfAborted();
+                completion.outcome = approved ? 'approved' : 'rejected';
+                await emit(approved ? 'approval.approved' : 'approval.denied', { nodeId, name: node.name });
+            }
+            else if (node.type === 'action') {
+                // This node consumes one call below, so being already at the ceiling is a stop.
+                if (!withinToolBudget(result.toolCalls + 1, limits.maxToolCalls)) {
+                    result.reason = 'maxToolCalls';
+                    break;
+                }
+                const shellName = canonicalToolName('shell');
+                const tool = capabilityTools(node, options.tools).find(tool => canonicalToolName(tool.name) === shellName);
+                if (!tool)
+                    throw new Error(`Action ${nodeId}: ${shellName} is unavailable under this node capability policy. Explicitly allow shell, filesystem and Git writes and the shell tool, or remove this action.`);
+                result.toolCalls++;
+                // The action path runs the shell outside the hardened runtime, so it records its own
+                // capture entry: otherwise an action-only graph reports no tool call or per-tool row.
+                if (result.telemetry)
+                    recordToolUse(result.telemetry, shellName, false);
+                const toolCallId = randomUUID();
+                const actionSignal = context.runControl ? AbortSignal.any([signal, context.runControl.signal]) : signal;
+                await emit('node.tool.started', { nodeId, name: shellName, toolCallId, arguments: { command: node.action.command } });
+                let output;
+                let durationMs;
+                const startedAt = monotonicNow();
+                // The shell's approval prompt is a human wait inside `execute`, and the action node has no
+                // hardened-runtime wrapper to subtract it: measured here the same way, so the terminal
+                // `durationMs` — and the ToolCallClock reading it accepts — never charge the deciding.
+                let userWaitMs = 0;
+                let waitSince;
+                const closeUserWait = () => {
+                    if (waitSince !== undefined) {
+                        userWaitMs += monotonicNow() - waitSince;
+                        waitSince = undefined;
+                    }
+                    return userWaitMs;
+                };
+                let interrupted = false;
+                try {
+                    actionSignal.throwIfAborted();
+                    output = await tool.execute({ command: node.action.command }, { ...context, signal: actionSignal, userSignal: actionSignal, onApprovalEvent: (type, data) => {
+                            if (type === 'node.tool.approval.requested')
+                                waitSince ??= monotonicNow();
+                            else if (type === 'node.tool.approval.decided')
+                                closeUserWait();
+                            return emit(type, { ...data, nodeId, toolCallId });
+                        } });
+                    const workedMs = elapsedMs(startedAt);
+                    const waitedMs = closeUserWait();
+                    durationMs = workedMs === undefined ? undefined : Math.max(0, workedMs - waitedMs);
+                }
+                catch (error) {
+                    // A pause that aborts the approval mid-prompt leaves the open wait unbilled too.
+                    const workedMs = elapsedMs(startedAt);
+                    const waitedMs = closeUserWait();
+                    durationMs = workedMs === undefined ? undefined : Math.max(0, workedMs - waitedMs);
+                    await emit('node.tool.failed', { nodeId, name: shellName, toolCallId, durationMs, output: `Tool error: ${error instanceof Error ? error.message : String(error)}` });
+                    if (!actionSignal.aborted || signal.aborted) {
+                        // A real shell failure: the call was counted above, and this records the failure. A
+                        // suite that ran and failed is still test evidence, so it is recorded before the throw.
+                        if (result.telemetry) {
+                            recordToolFailure(result.telemetry, shellName);
+                            if (isTestCommandLine(node.action.command))
+                                recordTestCommand(result.telemetry);
+                        }
+                        throw error;
+                    }
+                    interrupted = true;
+                    output = `Interrupted by user; effects may be partial. Not replayed. ${error instanceof Error ? error.message : String(error)}`;
+                    completion.summary = `${node.name} was interrupted; its effects may be partial and were not replayed.`;
+                    await context.runControl?.wait(signal);
+                }
+                finally {
+                    options.codeIntel?.notePotentialMutation(context.workspace, '(graph action shell)');
+                }
+                completion.output = { result: output };
+                // A command the user stopped did not run to completion, so it is not test evidence even if
+                // its name looks like a test command; the same rule the hardened runtime applies.
+                if (!interrupted && result.telemetry && isTestCommandLine(node.action.command))
+                    recordTestCommand(result.telemetry);
+                if (!interrupted)
+                    await emit('node.tool.completed', { nodeId, name: shellName, toolCallId, durationMs, output });
+            }
+            else if (node.type === 'parallel' || node.type === 'join')
+                completion.output = activation.inputs;
+            if (nodeOutputSchema(node))
+                validateValue(nodeOutputSchema(node), completion.output, `Node ${nodeId} output`);
+            signal.throwIfAborted();
+            result.nodeResults[nodeId] = completion;
+            if (node.type !== 'end')
+                lastCompletion = completion;
+            // A prefetched branch already announced its completion when its invocation returned; the
+            // queue reaching it is bookkeeping, not a second completion.
+            if (!prefetchedCompleted.has(activation))
+                await emit('graph.node.completed', { nodeId, completion });
+            const next = [];
+            for (const [edgeIndex, edge] of pinned.edges.entries()) {
+                if (edge.source !== nodeId || (edge.outcome ?? 'completed') !== completion.outcome)
+                    continue;
+                const target = pinned.nodes[edge.target];
+                let path = [...activation.path, nodeId];
+                const isRevisit = path.includes(edge.target);
+                const generation = isRevisit ? ++nextGeneration : activation.generation;
+                if (isRevisit)
+                    path = [];
+                const targetKey = `${generation}:${edge.target}`;
+                const queued = queue.find(item => item.nodeId === edge.target && item.generation === generation) ?? next.find(item => item.nodeId === edge.target && item.generation === generation);
+                if (queued && !Object.hasOwn(queued.predecessors, nodeId))
+                    delete queued.conversation;
+                if (executed.has(targetKey) || queued)
+                    continue;
+                const inputs = {};
+                for (const [key, expression] of Object.entries(edge.inputMapping ?? {}))
+                    inputs[key] = resolveValue(expression, { source: completion, run: { input: runInput, state: runState, loop: { iteration: count } } });
+                const incoming = { ...(node.modifiers?.parallel?.mode === 'branches' ? { parallelGroup: `${nodeId}:${activation.generation}:${count}`, concurrency: node.modifiers.parallel.maxConcurrent } : {}), nodeId: edge.target, generation, path, inputs, source: completion, predecessors: { [nodeId]: completion } };
+                if (node.type === 'agent' && target.type === 'agent' && node.contextPolicy?.conversation !== 'isolate')
+                    incoming.conversation = conversations.get(activation);
+                if (target.type === 'join' && target.join?.mode !== 'any' && !edge.bootstrap) {
+                    const pending = pendingJoins.get(targetKey) ?? new Map();
+                    pending.set(edgeIndex, incoming);
+                    pendingJoins.set(targetKey, pending);
+                    const dependencies = pinned.edges.map((candidate, index) => candidate.target === edge.target && !candidate.bootstrap ? index : -1).filter(index => index >= 0);
+                    if (!dependencies.every(index => pending.has(index)))
+                        continue;
+                    const members = [...pending.values()];
+                    // Journal every branch's own activation, not one event for whichever branch completed
+                    // last: recovery rebuilds a queued join from the journal, and a single final event would
+                    // replay the join holding only the last branch's result — the merged inputs and
+                    // predecessors the in-memory activation carried would exist nowhere a resume can read.
+                    for (const member of members) {
+                        const memberSource = Object.keys(member.predecessors)[0];
+                        await emit('graph.edge.activated', { source: memberSource, target: edge.target, outcome: member.predecessors[memberSource].outcome });
+                    }
+                    for (const item of pending.values()) {
+                        mergeInputs(incoming.inputs, item.inputs, edge.target);
+                        Object.assign(incoming.predecessors, item.predecessors);
+                    }
+                    incoming.path = [...new Set([...pending.values()].flatMap(item => item.path))];
+                    pendingJoins.delete(targetKey);
+                    next.push(incoming);
+                    continue;
+                }
+                next.push(incoming);
+                await emit('graph.edge.activated', { source: nodeId, target: edge.target, outcome: completion.outcome });
+            }
+            if (activation.parallelGroup) {
+                const pendingSiblings = queue.filter(item => item.parallelGroup === activation.parallelGroup).length;
+                queue.splice(pendingSiblings, 0, ...next);
+            }
+            else
+                queue.unshift(...next);
+        }
+        if (!result.reason && result.status === 'exhausted') {
+            if (pendingJoins.size)
+                throw new Error(`Join ${[...pendingJoins.keys()].join(', ')} cannot receive all required branches. Connect routes that can complete together or change Join to any.`);
+            signal.throwIfAborted();
+            result.status = 'succeeded';
+            result.completion = lastCompletion ?? result.nodeResults[currentNode];
+            let finalizationRevision = lastAgentActivation ? checkpoints.get(lastAgentActivation.nodeId)?.revision ?? context.runControl?.revision ?? 0 : context.runControl?.revision ?? 0;
+            for (;;) {
+                await context.runControl?.wait(signal);
+                await controlEvents;
+                if (context.runControl && context.runControl.revision > finalizationRevision) {
+                    const directions = context.runControl.messagesSince(finalizationRevision);
+                    finalizationRevision = context.runControl.revision;
+                    const checkpoint = lastAgentActivation && checkpoints.get(lastAgentActivation.nodeId);
+                    if (lastAgentActivation && checkpoint) {
+                        // Routing is complete. Resume the last node's checkpointed conversation
+                        // (or each indexed copy) without replaying completed graph actions.
+                        await emit('graph.finalization.resumed', { nodeId: lastAgentActivation.nodeId });
+                        const continuation = await invoke(lastAgentActivation, remainingToolBudget(limits.maxToolCalls, result.toolCalls), budget.remainingMs(), pinned.limits?.maxConcurrency ?? 32, options.getSteeringMessages, checkpoint);
+                        result.toolCalls += continuation.toolCalls;
+                        addUsage(result.usage, continuation.usage);
+                        absorbTelemetry(result, continuation);
+                        result.provider = continuation.provider;
+                        result.model = continuation.model;
+                        if (continuation.status !== 'succeeded' || !continuation.completion) {
+                            result.status = continuation.status;
+                            result.reason = continuation.reason ?? continuation.status;
+                            break;
+                        }
+                        const condition = pinned.nodes[lastAgentActivation.nodeId].modifiers?.condition;
+                        const completion = condition
+                            ? { ...continuation.completion, outcome: matchesOutput(continuation.completion, condition) ? 'true' : 'false' }
+                            : continuation.completion;
+                        result.completion = completion;
+                        result.nodeResults[lastAgentActivation.nodeId] = completion;
+                        finalizationRevision = checkpoints.get(lastAgentActivation.nodeId)?.revision ?? finalizationRevision;
+                    }
+                    else {
+                        // Fixed graphs have no model conversation that could act on new prose.
+                        // Acknowledge explicitly rather than silently discarding accepted input.
+                        await emit('agent.message', { text: `Direction received after fixed graph actions finished: ${directions.join('\n')}\nThis graph has no resumable agent; completed actions were not replayed.` });
+                    }
+                }
+                // Memory distillation no longer gates on token headroom: the cumulative ceiling
+                // was removed, and distillation is bounded by its own adapter request instead.
+                if (options.memory?.activeFor(result.id)) {
+                    const nodeOutputs = Object.fromEntries(Object.entries(result.nodeResults ?? {}).map(([id, item]) => [id, item.output]));
+                    const orchestratorOutputs = Object.entries(pinned.nodes).filter(([, node]) => node.agentRole === 'orchestrator').map(([id]) => result.nodeResults?.[id]?.output);
+                    const agentCompletions = Object.entries(result.nodeResults ?? {}).filter(([id]) => pinned.nodes[id]?.type === 'agent').map(([id, item]) => ({ id, item }));
+                    const completionSummary = agentCompletions.map(({ id, item }) => `${pinned.nodes[id].name}: ${item.summary}`).join('\n').slice(0, 8000) || result.completion?.summary;
+                    const tests = [...new Set(agentCompletions.flatMap(({ item }) => item.tests ?? []))].slice(0, 50);
+                    let distillAdapter = providers.get(result.provider)?.adapter;
+                    let distillModel = result.model;
+                    let distillProviderType = providers.get(result.provider)?.providerType;
+                    let distillBaseUrl = providers.get(result.provider)?.baseUrl;
+                    if (!distillAdapter && options.resolveModel) {
+                        try {
+                            const resolved = await readWhileRunning(operationSignal => options.resolveModel(result.provider, result.model, operationSignal));
+                            distillAdapter = resolved.adapter;
+                            distillModel = result.model || resolved.model;
+                            distillProviderType = resolved.providerType;
+                            distillBaseUrl = resolved.baseUrl;
+                        }
+                        catch (error) {
+                            if (signal.aborted)
+                                throw error;
+                            await emit('memory.error', { operation: 'distill-model-resolution', detail: error instanceof Error ? error.message : 'model resolution failed' });
+                        }
+                    }
+                    // A resumed direction invalidates the old completion before any new
+                    // persistence attempt, including pauses during model metadata resolution.
+                    if (context.runControl && context.runControl.revision > finalizationRevision)
+                        continue;
+                    // Capture the operation generation before starting graph-owned finalization.
+                    // MemoryManager may swallow abort and return partial persisted IDs, so the
+                    // checkpoint below is mandatory even when distillation resolves successfully.
+                    const distillSignal = context.runControl ? AbortSignal.any([signal, context.runControl.signal]) : signal;
+                    try {
+                        await options.memory.distillRun({
+                            task: options.task, status: result.status, outcome: result.completion?.outcome,
+                            completionSummary, tests, nodeOutputs, orchestratorOutputs, confirmedClarifications,
+                            // The distillation is a billed model request like any node's, so it goes through the
+                            // same instrumented generation path: without that it reported its tokens in the run
+                            // totals while contributing no model tuple, and a run whose only model call was the
+                            // distillation published no model at all. Its own `onUsage` is therefore not supplied
+                            // here — `generateWithUsage` is the single accounting path for this request.
+                            adapter: distillAdapter ? dashboardAdapter({
+                                generate: request => generateWithUsage({
+                                    ...options,
+                                    telemetryIdentity: {
+                                        role: 'other',
+                                        ...(distillProviderType === undefined ? {} : { providerType: distillProviderType }),
+                                        ...(distillBaseUrl === undefined ? {} : { baseUrl: distillBaseUrl }),
+                                    },
+                                    // `generateWithUsage` has already added this delta to `result.usage`; adding it
+                                    // again here would double the run totals against the tuple and the provider.
+                                    onUsage: (usage, origin) => options.onUsage?.(usage, origin),
+                                }, result, request),
+                            }, result.provider, event => options.onEvent?.(event), { runId: result.id, operation: 'memory.distillation' }) : undefined,
+                            model: distillModel, signal: distillSignal, runId: result.id,
+                        });
+                    }
+                    catch (error) {
+                        if (!distillSignal.aborted || signal.aborted)
+                            throw error;
+                    }
+                    signal.throwIfAborted();
+                }
+                await context.runControl?.wait(signal);
+                await controlEvents;
+                if (context.runControl && context.runControl.revision > finalizationRevision)
+                    continue;
+                break;
+            }
+            if (result.status === 'succeeded')
+                await emit('graph.completed', { node: currentNode, nodeId: currentNode, usage: { ...result.usage }, toolCalls: result.toolCalls });
+        }
+    }
+    catch (error) {
+        // Cancellation is judged from the session signal; every other abort that reached the run
+        // signal is a deadline.
+        const cancelled = (options.context.userSignal ?? options.context.signal).aborted;
+        const deadline = budget.expired() || signal.aborted;
+        result.status = cancelled ? 'cancelled' : deadline ? 'exhausted' : 'infrastructure_error';
+        result.reason = cancelled ? 'cancelled' : deadline ? 'wallTimeMs' : error instanceof Error ? error.message : 'Graph runtime failure';
+    }
+    // Cleanup must be unconditional: both the stop event and the Code Intelligence handoff await
+    // sinks that can reject, and a rejection would otherwise skip disposal and leave the run's
+    // timer retained until its original deadline.
+    try {
+        await options.commandMemory?.flush(options.context.userSignal ?? options.context.signal);
+        if (result.status !== 'succeeded') {
+            delete result.completion;
+            // The event carries the raw code for a machine and the finished sentence for a person, so a
+            // client that reads only the journal shows the same words as the command line.
+            await emit('graph.stopped', { nodeId: currentNode, status: result.status, reason: result.reason, reasonText: stopReasonSentence(result.reason, result.limits), usage: { ...result.usage }, toolCalls: result.toolCalls });
+        }
+        result.todos = todoStore.snapshot();
+        if (widgetStore.definitionsList().length)
+            result.widgets = widgetStore.snapshot();
+        await options.codeIntel?.endRun({ status: result.status, usage: result.usage, toolCalls: result.toolCalls });
+        return result;
+    }
+    finally {
+        unsubscribeControl?.();
+        budget.dispose();
+    }
+}