@aragon-agent/cli 0.6.21 → 0.6.22

package/README.md

@@ -1148,15 +1148,34 @@ than a fact: the file list is derived from `write_file` / `edit_file`, so a
 write made through `bash` is invisible to it.
 
 **The dispatch supervisor.** A time ceiling on a subagent is an inspection
-trigger, not a death sentence — as long as the fast tier is enabled. Two soft
-timers per child (event silence and a wall clock) hand a bounded snapshot to the
-fast model, which decides: keep waiting, steer a nudge in, rebuild the child
-with an amended brief, or abandon it with a recorded reason. The budgets are
-structural, not settings — 4 inspections and 1 replacement per child per
-dispatch, after which the child runs under its own hard ceilings and the
-supervisor goes quiet. Every applied decision is recorded in the report's
-Supervisor section; `/team overseer off` (or no fast tier) restores the
-pre-supervisor regime exactly.
+trigger, not a death sentence. Every dispatch gets its own supervisor on the
+fast model: a per-child silence window for suspected stalls, plus a periodic
+cadence check over the WHOLE roster — one bounded call that carries every live
+subagent and returns one decision per child: keep waiting, steer a nudge in,
+rebuild the child with an amended brief, or abandon it with a recorded reason.
+The cadence grows geometrically (5 min base, ×1.6, capped at 15 min), so a
+healthy slow subagent is checked logarithmically in its run time rather than
+every five minutes forever. The budgets are structural, not settings — 12
+looks, 3 nudges, 1 replacement and 1 abandon per child per dispatch. When the
+look budget is spent the supervisor says so once (`quiet` in the report) and
+stops waking that child; failed inspection calls cost a look but never an
+action. Every applied decision is recorded in the report's Supervisor section
+with the supervisor's own fast-tier spend, and replace/abandon also surface as
+a transcript notice while the dispatch runs.
+
+**No kill by default.** While `team.overseer` is on (the default),
+`team.subagentTimeoutMs` never aborts anything — a positive value is only the
+supervisor's first cadence check. If the fast tier is missing (no key,
+`/fast off`), a due check degrades to an announced *unassisted wait*: the
+children keep running, the report notes how many checks ran degraded, and
+nothing is killed. A subagent still ends on the user's Esc, the explicit
+`team.dispatchTimeoutMs` / `team.maxTurnsPerSubagent` ceilings, its own idle
+watchdog (lengthened 4× while supervised), or the supervisor's own
+replace/abandon verdict. One boundary to know: a session with NO fast wiring
+at all and `team.overseer: true` runs children with no wall clock whatsoever
+— they finish, or die on their own un-lengthened watchdog. `/team overseer
+off` is the escape hatch back to the legacy regime where
+`team.subagentTimeoutMs` is a hard abort again.
 
 **Talking to each other.** Subagents get two extra tools, `team_send` and
 `team_wait`. Messages are delivered by attaching them to the recipient's next
@@ -2001,10 +2020,11 @@ env / `.env` → CLI flags**.
 | `team.enabled` | `true` | Master switch for team subagents. `false` means the `task` tool is never registered — `/team on` in such a session saves the setting for next launch and says so, rather than advertising a tool that is not there. |
 | `team.maxSubagents` | `5` | Subagents per dispatch, clamped to `[1, 10]`. The 10 is the hard ceiling and is enforced twice — on the config value and again on what the model asks for — so hand-editing this file cannot raise it. |
 | `team.maxConcurrent` | `3` | Subagents in flight at once, clamped to `[1, 10]` and capped at `maxSubagents`. A separate knob because provider rate limits are a different constraint from context economics. |
-| `team.subagentTimeoutMs` | `0` | One subagent's wall clock, clamped to `[0, 1800000]`. With the supervisor off it is a hard abort; with it on (the default) a positive value is the **first wall-clock inspection** — the supervisor looks and decides instead of killing. `0` (the default) = no ceiling — a wedged subagent still dies on its own idle watchdog, exactly like the lead. |
+| `team.subagentTimeoutMs` | `0` | One subagent's wall clock, clamped to `[0, 1800000]`. With `team.overseer: false` it is a hard abort (the legacy regime). With the supervisor on (the default) it **never aborts anything** — a positive value is only a compatibility source for the supervisor's first cadence check. `0` (the default) = use `team.overseerIntervalMs` / the structural 5 min instead. |
 | `team.dispatchTimeoutMs` | `0` | The whole dispatch's wall clock (and the `task` tool timeout), clamped to `[0, 3600000]`. `0` (the default) = no ceiling; only Esc ends a dispatch early. |
 | `team.maxTurnsPerSubagent` | `0` | Runaway-loop cap, clamped to `[0, 100]`. `0` (the default) = no cap, matching the lead. A subagent stopped at a positive cap is reported as `stopped: turn cap reached`, with whatever it had produced. |
-| `team.overseer` | `true` | The dispatch supervisor: time ceilings on subagents become inspection triggers for a fast-tier supervisor that decides wait / nudge / replace / abandon instead of aborting. Needs the fast tier (`fast.enabled`); with the tier off or this `false`, children run under the legacy hard ceilings exactly. `/team overseer on\|off` flips it live, and it is read per dispatch. |
+| `team.overseer` | `true` | The dispatch supervisor: one per dispatch on the fast model, ticking on a geometric cadence over every live subagent and deciding wait / nudge / replace / abandon. With the fast tier missing a tick degrades to an announced unassisted wait — never a kill; with this `false`, children run under the legacy hard ceilings exactly. `/team overseer on\|off` flips it live, and it is read per dispatch. |
+| `team.overseerIntervalMs` | `0` | Supervisor cadence base, clamped to `[0, 3600000]`. `0` (the default) = the structural 300 s; a positive `team.subagentTimeoutMs` is honoured first when this is `0` (compat). Later checks grow ×1.6, clamped to `[60 s, 900 s]`; any nudge/replace/abandon resets that child's cadence to the base. Only meaningful while `team.overseer` is true. |
 | `todo.enabled` | `true` | Master switch for todo planning. `false` means the `todo_write` tool is never registered — `/todo on` in such a session saves the setting for next launch and says so, rather than advertising a tool that is not there. |
 | `todo.panel` | `true` | Render the right-hand rail. Independent of `todo.enabled` on purpose: a screen-reader user wants the planning discipline without the column, and the system prompt varies one sentence accordingly. |
 | `todo.followThrough` | `"notify"` | What happens when a run ends with steps left. `notify` says so and stops; `auto` continues the plan after a 3-second grace window, bounded by two structural limits (one fruitless attempt, 25 continuations per plan) that are deliberately **not** settings; `off` is silent. An unrecognized value falls back to `notify`. |
@@ -2015,7 +2035,7 @@ env / `.env` → CLI flags**.
 | `retry.multiplier` | `2` | Growth factor, clamped to `[1, 5]`. The one **float** key in this section: `2.5` is a legitimate factor and is stored as typed. |
 | `retry.jitter` | `true` | Equal jitter (`d/2 + rand·d/2`), which de-correlates concurrent subagents hitting the same 429 while keeping the announced countdown within a factor of two of the truth. Full jitter can fire 40 ms after announcing 30 s, which reads as a bug. |
 | `retry.respectRetryAfter` | `true` | Honour `Retry-After` (and the provider rate-limit reset headers) as a **floor**, never a replacement — a `Retry-After: 1` on the ninth retry does not undo eight retries of backoff. A stated wait above 60 s is surfaced immediately instead of waited out. |
-| `retry.maxElapsedMs` | `240000` | Wall-clock budget from the first failure, clamped to `[10000, 1800000]`. When `team.subagentTimeoutMs` is positive, keep this below it: an equal budget means a subagent is killed at the same instant its ladder ends, and the user is then told "subagent timed out" for what was a provider outage. |
+| `retry.maxElapsedMs` | `240000` | Wall-clock budget from the first failure, clamped to `[10000, 1800000]`. Under the legacy regime (`team.overseer: false`) with `team.subagentTimeoutMs` positive, keep this below it: an equal budget means a subagent is killed at the same instant its ladder ends, and the user is then told "subagent timed out" for what was a provider outage. |
 | `retry.onPartialStream` | `true` | Allow a restart after content has already streamed to the transcript. The view is rewound and the discarded tool cards removed; engine history is provably clean at that point, because it is only written on a completed turn. `false` refuses the whole path. |
 | `skills.enabled` | `true` | Master switch for the skill system. |
 | `skills.requireApproval` | `true` | Require a human to approve `skill_install` / `skill_create`. |

package/dist/agent/controller.js

@@ -519,6 +519,19 @@ export class AgentController {
                         // Every child runs the lead's own model, so the lead's cost table
                         // is the one honest price for the dispatch total.
                         modelCost: () => this.getModelInfo().cost,
+                        // The FAST table for the supervisor's own spend line
+                        // (subagent-overseer-v2 D-7 / R-P1-2). Reuses the tier
+                        // resolution and the unknown-pricing predicate the fast
+                        // reviewer already uses: undefined prices as `pricing
+                        // unknown`, never as $0.00 (C-11 / RV-4).
+                        fastModelCost: () => {
+                            const tier = this.fast?.getTier();
+                            if (!tier || !tier.ok)
+                                return undefined;
+                            return this.isPricedModel(tier.ref)
+                                ? this.getModelInfoFor(tier.ref).cost
+                                : undefined;
+                        },
                         withPausedWatchdog: (fn) => this.withPausedWatchdog(fn),
                     }),
                 ]

package/dist/commands/builtins.js

@@ -294,7 +294,8 @@ const COMMANDS = [
                     ? `\nRunning: ${snapshot.runs.map((r) => `${r.label} (${r.phase})`).join(', ')}`
                     : '';
                 ctx.notify('info', `Team mode: ${state}. Max subagents: ${cfg.maxSubagents}, ` +
-                    `concurrent: ${cfg.maxConcurrent}, supervisor: ${cfg.overseer ? 'on' : 'off'} (needs the fast tier).${roster}`);
+                    `concurrent: ${cfg.maxConcurrent}, supervisor: ${cfg.overseer ? 'on' : 'off'}` +
+                    `${cfg.overseer ? ' (never kills; checks the fast tier each tick)' : ' (legacy hard timeouts)'}.${roster}`);
                 return;
             }
             if (verb === 'on' || verb === 'off') {

package/dist/config/cli-commands.d.ts

@@ -20,7 +20,7 @@ export declare const LOG_CONFIG_SET_KEYS: readonly ["log.level", "log.toFile", "
  * switch falls through every case, writes nothing, and still prints
  * `Set team.enabled = false`.
  */
-export declare const TEAM_CONFIG_SET_KEYS: readonly ["team.enabled", "team.maxSubagents", "team.maxConcurrent", "team.subagentTimeoutMs", "team.dispatchTimeoutMs", "team.maxTurnsPerSubagent", "team.overseer"];
+export declare const TEAM_CONFIG_SET_KEYS: readonly ["team.enabled", "team.maxSubagents", "team.maxConcurrent", "team.subagentTimeoutMs", "team.dispatchTimeoutMs", "team.maxTurnsPerSubagent", "team.overseer", "team.overseerIntervalMs"];
 /**
  * Config keys under `retry.` that `aragon config set` accepts
  * (llm-api-retry-backoff §8.2).

package/dist/config/cli-commands.js

@@ -44,6 +44,7 @@ export const TEAM_CONFIG_SET_KEYS = [
     'team.dispatchTimeoutMs',
     'team.maxTurnsPerSubagent',
     'team.overseer',
+    'team.overseerIntervalMs',
 ];
 /**
  * Config keys under `retry.` that `aragon config set` accepts
@@ -202,6 +203,8 @@ export function applyTeamConfigSet(key, value) {
             return patch(clampOne('maxTurnsPerSubagent'));
         case 'team.overseer':
             return patch({ overseer: isTrue(value) });
+        case 'team.overseerIntervalMs':
+            return patch(clampOne('overseerIntervalMs'));
         default:
             return null;
     }

package/dist/config/schema.d.ts

@@ -309,10 +309,11 @@ export interface TeamConfig {
      * the lead, whose only in-run ceiling is the event-silence idle watchdog
      * a child already keeps. A wedged child still dies on its OWN watchdog.
        *
-       * WITH `team.overseer` ON (the default) this is the FIRST wall-clock
-       * INSPECTION point, not a hard abort: the supervisor looks and decides
-       * (wait / nudge / replace / abandon), so a slow-but-healthy child is no
-       * longer killed at an arbitrary wall clock.
+       * WITH `team.overseer` ON (the default) this NEVER aborts anything
+       * (subagent-overseer-v2 D-4): a positive value is only a COMPATIBILITY
+       * SOURCE for the supervisor's first cadence check, honouring users who
+       * already treated it as a trigger point. The only hard abort left is
+       * the legacy regime (`team.overseer: false`).
      */
     subagentTimeoutMs: number;
     /**
@@ -329,17 +330,32 @@ export interface TeamConfig {
      */
     maxTurnsPerSubagent: number;
     /**
-     * The dispatch supervisor (team-overseer): time ceilings on children
-     * become inspection triggers for a fast-tier supervisor that decides
-     * wait / nudge / replace / abandon, instead of aborts. Default TRUE.
+     * The dispatch supervisor (team-overseer / subagent-overseer-v2): time
+     * ceilings on children become inspection triggers for a fast-tier
+     * supervisor that decides wait / nudge / replace / abandon, instead of
+     * aborts. Default TRUE.
      *
-     * READ PER DISPATCH. With the supervisor off (or no fast tier), children
-     * run exactly the pre-feature regime: `subagentTimeoutMs` is a hard abort
-     * and silence is the child's own watchdog. With it ON,
-     * `subagentTimeoutMs > 0` is the FIRST wall-clock inspection point, not
-     * a death sentence.
+     * READ PER DISPATCH. The supervisor ticks on a cadence ladder over every
+     * live child, and NO timeout is a death sentence while this is on: with
+     * the fast tier missing a tick degrades to an announced unassisted wait,
+     * never a kill. With this FALSE, children run exactly the pre-feature
+     * legacy regime: `subagentTimeoutMs` is a hard abort and silence is the
+     * child's own watchdog.
      */
     overseer: boolean;
+    /**
+     * Supervisor cadence BASE, in milliseconds (subagent-overseer-v2 D-8).
+     * `0` (the default) = the structural default
+     * (`TEAM_LIMITS.overseerDefaultCheckMs`, 300 s).
+     *
+     * EFFECTIVE FIRST CHECK, derived read-only and never written back:
+     * `overseerIntervalMs > 0` wins; otherwise a positive
+     * `subagentTimeoutMs` is honoured (users who already treated it as a
+     * trigger point); otherwise the structural default. Later checks grow
+     * by `overseerCadenceRatio` (1.6), clamped to [60 s, 900 s]. Only
+     * meaningful while `team.overseer` is true.
+     */
+    overseerIntervalMs: number;
 }
 /**
  * The requirement's ceiling on the fan-out (R-g).

package/dist/config/schema.js

@@ -455,6 +455,8 @@ export const DEFAULT_TEAM_CONFIG = {
     // The dispatch supervisor, default ON (team-overseer): ceilings become
     // inspections; the fast-tier supervisor decides what to do.
     overseer: true,
+    // 0 = the structural cadence default (300 s). See the field docstring.
+    overseerIntervalMs: 0,
 };
 const SUBAGENTS_RANGE = { min: 1, max: HARD_MAX_SUBAGENTS };
 const CONCURRENT_RANGE = { min: 1, max: HARD_MAX_SUBAGENTS };
@@ -463,6 +465,7 @@ const CONCURRENT_RANGE = { min: 1, max: HARD_MAX_SUBAGENTS };
 // ("my setting won't stick"), the exact trap `scrollResumeMs` records above.
 const SUBAGENT_TIMEOUT_RANGE = { min: 0, max: 1_800_000 };
 const DISPATCH_TIMEOUT_RANGE = { min: 0, max: 3_600_000 };
+const OVERSEER_INTERVAL_RANGE = { min: 0, max: 3_600_000 };
 const TURNS_RANGE = { min: 0, max: 100 };
 /**
  * THE single gate for every team-config read AND write, mirroring
@@ -486,6 +489,7 @@ export function clampTeamConfig(raw) {
         dispatchTimeoutMs: clampIntAllowingZero(src.dispatchTimeoutMs, DEFAULT_TEAM_CONFIG.dispatchTimeoutMs, DISPATCH_TIMEOUT_RANGE),
         maxTurnsPerSubagent: clampIntAllowingZero(src.maxTurnsPerSubagent, DEFAULT_TEAM_CONFIG.maxTurnsPerSubagent, TURNS_RANGE),
         overseer: bool(src.overseer, DEFAULT_TEAM_CONFIG.overseer),
+        overseerIntervalMs: clampIntAllowingZero(src.overseerIntervalMs, DEFAULT_TEAM_CONFIG.overseerIntervalMs, OVERSEER_INTERVAL_RANGE),
     };
 }
 export const DEFAULT_TODO_CONFIG = {

package/dist/team/limits.d.ts

@@ -102,11 +102,12 @@ export declare const TEAM_LIMITS: {
     readonly maxColdStartRetries: 1;
     readonly retryBackoffMs: 2000;
     /**
-     * Wall-clock budget of everything one inspection may carry. The digest holds
-     * run facts, the supervisor's own memory and the tail of the child's live
-     * history; unbounded, one look at a child that read five big files would
-     * make the "cheap" supervision call cost more than the child (the argument
-     * FAST_LIMITS.digestMaxChars makes, one level up).
+     * Wall-clock budget of everything one SINGLE inspection may carry (the
+     * silence-triggered path). The digest holds run facts, the supervisor's own
+     * memory and the tail of the child's live history; unbounded, one look at a
+     * child that read five big files would make the "cheap" supervision call
+     * cost more than the child (the argument FAST_LIMITS.digestMaxChars makes,
+     * one level up).
      */
     readonly overseerDigestBytes: 8000;
     /** Clamp on a `nudge` guidance text. Advice, not a second brief. */
@@ -114,11 +115,48 @@ export declare const TEAM_LIMITS: {
     /** Clamp on the decision `reason` recorded in the report. */
     readonly overseerReasonChars: 200;
     /**
-     * Inspections PER CHILD per dispatch. An indecisive supervisor must stop
-     * burning fast-tier calls; past the budget the child simply runs under its
-     * hard ceilings and the supervisor goes quiet.
+     * Per-child slice of a BATCH digest (D-3 / R-P2-5). 6.7x tighter than the
+     * single-inspection budget above: a batch carries up to ten children in one
+     * call, and memory plus the history tail are the first to give way (the
+     * facts-first assembly order already puts them last).
      */
-    readonly overseerMaxInspectionsPerChild: 4;
+    readonly overseerPerChildDigestBytes: 1200;
+    /** Whole-batch digest ceiling (D-3): 10 children x 1 200 B fits exactly. */
+    readonly overseerBatchDigestBytes: 12000;
+    /**
+     * Output budget of ONE batch inspection (R-P0-1). The single-inspection path
+     * keeps `FAST_LIMITS.reviewOutputTokens` (512); a batch must return up to
+     * ten decision objects, and 512 tokens cannot physically hold ten x
+     * (reason <= 200 + guidance <= 1200). A truncated batch reply fails
+     * "first `[` to last `]`" parsing and degrades to all-wait - exactly the
+     * failure this separate, larger budget exists to prevent.
+     */
+    readonly overseerBatchOutputTokens: 2048;
+    /** Tighter `reason` clamp inside the batch protocol (R-P0-1). */
+    readonly overseerBatchReasonChars: 80;
+    /** Tighter `guidance` clamp inside the batch protocol (R-P0-1). */
+    readonly overseerBatchGuidanceChars: 400;
+    /**
+     * LOOKS per child per dispatch (D-5). A look is cost, not mutation: every
+     * inspection of a child - silence-triggered, cadence tick or post-mortem -
+     * spends one, including a call that failed softly. Twelve with the cadence
+     * ladder covers hours of healthy slow work; past the budget the supervisor
+     * says so once (`trigger: 'quiet'`) and stops waking that child up.
+     */
+    readonly overseerMaxLooksPerChild: 12;
+    /**
+     * LOOKS per dispatch, the fool-proof total (R-P1-6):
+     * hardMaxSubagents x overseerMaxLooksPerChild = 120. A mathematical upper
+     * bound, not a tuning knob - the per-child budget always binds first; this
+     * one exists so a bug cannot loop calls forever. When it trips, the whole
+     * MonitorLoop stops with one aggregate notice.
+     */
+    readonly overseerMaxLooksPerDispatch: number;
+    /**
+     * NUDGES per child per dispatch (D-5). Advice is cheap but not free: a
+     * supervisor that steers the same child forever is one that never decided.
+     */
+    readonly overseerMaxNudgesPerChild: 3;
     /**
      * Rebuilds PER CHILD per dispatch. One: a replacement that also stalls dies
      * on its own watchdog rather than ping-ponging fresh children at a task the
@@ -126,13 +164,25 @@ export declare const TEAM_LIMITS: {
      */
     readonly overseerMaxReplacementsPerChild: 1;
     /**
-     * First wall-clock check when `team.subagentTimeoutMs === 0` (the shipped
-     * default): the supervisor still looks even when no ceiling was configured.
+     * Abandons PER CHILD per dispatch (D-5). One, so a supervisor that has
+     * already given up on a brief cannot keep re-killing bodies of it.
+     */
+    readonly overseerMaxAbandonsPerChild: 1;
+    /**
+     * Cadence ladder growth factor (D-2). Each no-action inspection schedules
+     * the next `previous * ratio` out, so a healthy slow child is looked at
+     * logarithmically in its run time rather than every five minutes.
+     */
+    readonly overseerCadenceRatio: 1.6;
+    /**
+     * First cadence check when neither `team.overseerIntervalMs` nor
+     * `team.subagentTimeoutMs` names one (the shipped defaults): the supervisor
+     * still looks even when no ceiling was configured.
      */
     readonly overseerDefaultCheckMs: 300000;
-    /** Clamp on the model-chosen `nextCheckMs`, lower bound. */
+    /** Clamp on a ladder step / model-chosen `nextCheckMs`, lower bound. */
     readonly overseerNextCheckMinMs: 60000;
-    /** Clamp on the model-chosen `nextCheckMs`, upper bound. */
+    /** Clamp on a ladder step / model-chosen `nextCheckMs`, upper bound. */
     readonly overseerNextCheckMaxMs: 900000;
     /**
      * A child's OWN idle watchdog, multiplied by this while the supervisor is
@@ -142,6 +192,16 @@ export declare const TEAM_LIMITS: {
      */
     readonly overseerWatchdogFactor: 4;
 };
+/**
+ * The pseudo-label the runtime's AGGREGATE supervisor notices travel under
+ * (subagent-overseer-v2 D-5 / R-P1-6): the dispatch-total look-budget notice
+ * is one fact about the whole roster, not a row any child owns. RESERVED at
+ * normalization (`normalizeSubagentSpecs` seeds `dedupeLabel` with it), so a
+ * spec asking for the bare label `team` is handed `team-2` instead - the
+ * report ledger and the exec stream can then never attribute an aggregate
+ * notice to a real child, or swallow that child's own quiet note.
+ */
+export declare const TEAM_AGGREGATE_LABEL = "team";
 /**
  * The two comm tools, which are POLICY-EXEMPT inside a child (§3.11).
  *

package/dist/team/limits.js

@@ -24,13 +24,20 @@
  * is 72 000 bytes, so a character-denominated cap would let the executor chop
  * the report mid-section and take the failure count with it.
  */
+/**
+ * The two factors of the dispatch-total look budget (R-P1-6), hoisted only so
+ * `TEAM_LIMITS.overseerMaxLooksPerDispatch` can state their product without a
+ * second copy of either number. Not for export: the authority is TEAM_LIMITS.
+ */
+const HARD_MAX_SUBAGENTS = 10;
+const OVERSEER_MAX_LOOKS_PER_CHILD = 12;
 export const TEAM_LIMITS = {
     /**
      * The requirement's ceiling (R-g). Enforced in `clampTeamConfig` AND in
      * `normalizeSubagentSpecs`, so neither a hand-edited file nor a model asking
      * for thirty can exceed it.
      */
-    hardMaxSubagents: 10,
+    hardMaxSubagents: HARD_MAX_SUBAGENTS,
     // --- Spec normalization (§3.3.1) ---
     /** `SubagentSpec.description`, clamped (never rejected). */
     descriptionChars: 60,
@@ -106,13 +113,14 @@ export const TEAM_LIMITS = {
      *  nothing a re-dispatch by the lead would not buy better. */
     maxColdStartRetries: 1,
     retryBackoffMs: 2_000,
-    // --- The dispatch supervisor (team-overseer) ---
+    // --- The dispatch supervisor (team-overseer / subagent-overseer-v2) ---
     /**
-     * Wall-clock budget of everything one inspection may carry. The digest holds
-     * run facts, the supervisor's own memory and the tail of the child's live
-     * history; unbounded, one look at a child that read five big files would
-     * make the "cheap" supervision call cost more than the child (the argument
-     * FAST_LIMITS.digestMaxChars makes, one level up).
+     * Wall-clock budget of everything one SINGLE inspection may carry (the
+     * silence-triggered path). The digest holds run facts, the supervisor's own
+     * memory and the tail of the child's live history; unbounded, one look at a
+     * child that read five big files would make the "cheap" supervision call
+     * cost more than the child (the argument FAST_LIMITS.digestMaxChars makes,
+     * one level up).
      */
     overseerDigestBytes: 8_000,
     /** Clamp on a `nudge` guidance text. Advice, not a second brief. */
@@ -120,11 +128,48 @@ export const TEAM_LIMITS = {
     /** Clamp on the decision `reason` recorded in the report. */
     overseerReasonChars: 200,
     /**
-     * Inspections PER CHILD per dispatch. An indecisive supervisor must stop
-     * burning fast-tier calls; past the budget the child simply runs under its
-     * hard ceilings and the supervisor goes quiet.
+     * Per-child slice of a BATCH digest (D-3 / R-P2-5). 6.7x tighter than the
+     * single-inspection budget above: a batch carries up to ten children in one
+     * call, and memory plus the history tail are the first to give way (the
+     * facts-first assembly order already puts them last).
+     */
+    overseerPerChildDigestBytes: 1_200,
+    /** Whole-batch digest ceiling (D-3): 10 children x 1 200 B fits exactly. */
+    overseerBatchDigestBytes: 12_000,
+    /**
+     * Output budget of ONE batch inspection (R-P0-1). The single-inspection path
+     * keeps `FAST_LIMITS.reviewOutputTokens` (512); a batch must return up to
+     * ten decision objects, and 512 tokens cannot physically hold ten x
+     * (reason <= 200 + guidance <= 1200). A truncated batch reply fails
+     * "first `[` to last `]`" parsing and degrades to all-wait - exactly the
+     * failure this separate, larger budget exists to prevent.
+     */
+    overseerBatchOutputTokens: 2_048,
+    /** Tighter `reason` clamp inside the batch protocol (R-P0-1). */
+    overseerBatchReasonChars: 80,
+    /** Tighter `guidance` clamp inside the batch protocol (R-P0-1). */
+    overseerBatchGuidanceChars: 400,
+    /**
+     * LOOKS per child per dispatch (D-5). A look is cost, not mutation: every
+     * inspection of a child - silence-triggered, cadence tick or post-mortem -
+     * spends one, including a call that failed softly. Twelve with the cadence
+     * ladder covers hours of healthy slow work; past the budget the supervisor
+     * says so once (`trigger: 'quiet'`) and stops waking that child up.
+     */
+    overseerMaxLooksPerChild: 12,
+    /**
+     * LOOKS per dispatch, the fool-proof total (R-P1-6):
+     * hardMaxSubagents x overseerMaxLooksPerChild = 120. A mathematical upper
+     * bound, not a tuning knob - the per-child budget always binds first; this
+     * one exists so a bug cannot loop calls forever. When it trips, the whole
+     * MonitorLoop stops with one aggregate notice.
      */
-    overseerMaxInspectionsPerChild: 4,
+    overseerMaxLooksPerDispatch: HARD_MAX_SUBAGENTS * OVERSEER_MAX_LOOKS_PER_CHILD,
+    /**
+     * NUDGES per child per dispatch (D-5). Advice is cheap but not free: a
+     * supervisor that steers the same child forever is one that never decided.
+     */
+    overseerMaxNudgesPerChild: 3,
     /**
      * Rebuilds PER CHILD per dispatch. One: a replacement that also stalls dies
      * on its own watchdog rather than ping-ponging fresh children at a task the
@@ -132,13 +177,25 @@ export const TEAM_LIMITS = {
      */
     overseerMaxReplacementsPerChild: 1,
     /**
-     * First wall-clock check when `team.subagentTimeoutMs === 0` (the shipped
-     * default): the supervisor still looks even when no ceiling was configured.
+     * Abandons PER CHILD per dispatch (D-5). One, so a supervisor that has
+     * already given up on a brief cannot keep re-killing bodies of it.
+     */
+    overseerMaxAbandonsPerChild: 1,
+    /**
+     * Cadence ladder growth factor (D-2). Each no-action inspection schedules
+     * the next `previous * ratio` out, so a healthy slow child is looked at
+     * logarithmically in its run time rather than every five minutes.
+     */
+    overseerCadenceRatio: 1.6,
+    /**
+     * First cadence check when neither `team.overseerIntervalMs` nor
+     * `team.subagentTimeoutMs` names one (the shipped defaults): the supervisor
+     * still looks even when no ceiling was configured.
      */
     overseerDefaultCheckMs: 300_000,
-    /** Clamp on the model-chosen `nextCheckMs`, lower bound. */
+    /** Clamp on a ladder step / model-chosen `nextCheckMs`, lower bound. */
     overseerNextCheckMinMs: 60_000,
-    /** Clamp on the model-chosen `nextCheckMs`, upper bound. */
+    /** Clamp on a ladder step / model-chosen `nextCheckMs`, upper bound. */
     overseerNextCheckMaxMs: 900_000,
     /**
      * A child's OWN idle watchdog, multiplied by this while the supervisor is
@@ -148,6 +205,16 @@ export const TEAM_LIMITS = {
      */
     overseerWatchdogFactor: 4,
 };
+/**
+ * The pseudo-label the runtime's AGGREGATE supervisor notices travel under
+ * (subagent-overseer-v2 D-5 / R-P1-6): the dispatch-total look-budget notice
+ * is one fact about the whole roster, not a row any child owns. RESERVED at
+ * normalization (`normalizeSubagentSpecs` seeds `dedupeLabel` with it), so a
+ * spec asking for the bare label `team` is handed `team-2` instead - the
+ * report ledger and the exec stream can then never attribute an aggregate
+ * notice to a real child, or swallow that child's own quiet note.
+ */
+export const TEAM_AGGREGATE_LABEL = 'team';
 /**
  * The two comm tools, which are POLICY-EXEMPT inside a child (§3.11).
  *

package/dist/team/normalize.js

@@ -24,7 +24,7 @@
  * honest reading of a stale key is silence, not a report line about a
  * capability that no longer exists.
  */
-import { TEAM_LIMITS } from './limits.js';
+import { TEAM_AGGREGATE_LABEL, TEAM_LIMITS } from './limits.js';
 function asString(value) {
     return typeof value === 'string' ? value : '';
 }
@@ -88,7 +88,12 @@ export function normalizeSubagentSpecs(raw, max) {
         return { specs: [], requested: 0 };
     const requested = raw.length;
     const kept = [];
-    const taken = new Set();
+    // SEEDED WITH THE RESERVED AGGREGATE LABEL (subagent-overseer-v2 D-5 /
+    // R-P1-6): the runtime's dispatch-total supervisor notices travel under
+    // `TEAM_AGGREGATE_LABEL`, so no child may wear that slug - `dedupeLabel`
+    // hands a spec asking for it the suffixed form instead, the same namespace
+    // fix it already applies to any other collision.
+    const taken = new Set([TEAM_AGGREGATE_LABEL]);
     for (let i = 0; i < raw.length; i += 1) {
         const item = raw[i];
         if (!item || typeof item !== 'object')