@ashlr/hub 2.2.0 → 3.0.0

package/dist/core/run/orchestrator.js

@@ -67,8 +67,19 @@ import { withToolEnv } from '../env-bridge.js';
 import { buildEngineCommand, engineInstalled, spawnEngine } from './engines.js';
 import { nullSink } from './streaming.js';
 import { withRetry } from './retry.js';
-import { verifyTask } from './verify.js';
+import { verifyTaskStructured } from './verify.js';
 import { withHeal, defaultHealPolicy } from './self-heal.js';
+import { PLANNER_ROLE, SYNTHESIZER_ROLE } from './prompts/roles.js';
+import { systemPromptFor } from './prompts/index.js';
+import { resolveModelProfile, adaptivePromptsEnabled } from './model-profile.js';
+// M42: executable, sandboxed engineering tool surface.
+import { buildEngineerToolSpecs, buildNativeToolSpecsWithFn, } from '../mcp-native-engineer.js';
+import { listNativeTools } from '../mcp-native.js';
+import { selectInboxStore } from '../seams/inbox.js';
+import { scrubSecrets } from '../knowledge/index.js';
+// NOTE: sandbox/worktree.js is imported DYNAMICALLY inside runGoal (matching the
+// swarm runner) so its absence degrades gracefully at runtime instead of
+// becoming a hard load-time dependency (H4 simulates the module being absent).
 // ---------------------------------------------------------------------------
 // Constants / defaults
 // ---------------------------------------------------------------------------
@@ -340,25 +351,12 @@ async function routeTask(taskGoal, cfg, opts, fallbackClient) {
 // ---------------------------------------------------------------------------
 // Planning
 // ---------------------------------------------------------------------------
-/** Prompt template for decomposing a goal into a task DAG. */
-const PLANNING_SYSTEM = `You are a task planner. Decompose the user's goal into 1-6 subtasks that together accomplish it.
-Respond ONLY with a JSON array. Each element must have:
-  "id": string (unique short slug, e.g. "t1", "t2"),
-  "goal": string (clear sub-goal for this task),
-  "deps": string[] (ids of tasks that must complete before this one; empty for root tasks)
-
-Rules:
-- deps must reference earlier ids only (no cycles).
-- Keep tasks focused and independently executable.
-- Use a minimal number of tasks (don't over-decompose).
-
-Example:
-[
-  {"id":"t1","goal":"Research the topic","deps":[]},
-  {"id":"t2","goal":"Summarize findings","deps":["t1"]}
-]
-
-Return ONLY the JSON array — no prose, no markdown fences.`;
+/**
+ * Prompt template for decomposing a goal into a task DAG.
+ * M41: single-sourced from prompts/roles.PLANNER_ROLE (verbatim) so the legacy
+ * (flag-off) and adaptive (flag-on) paths share identical planner text.
+ */
+const PLANNING_SYSTEM = PLANNER_ROLE;
 /**
  * Parse a RunTask[] from model output, tolerating prose wrapped around JSON.
  * Returns null if no valid JSON array of tasks is found.
@@ -457,11 +455,19 @@ function hasCycle(tasks) {
  *   When non-empty, injects "Relevant project memory:" context so the planner
  *   benefits from cross-project knowledge. Kept bounded upstream (GENOME_INJECT_CHAR_CAP).
  */
-export async function planGoal(goal, client, onUsage, memoryContext) {
-    // Prepend memory block when present (bounded by caller)
-    const systemContent = memoryContext && memoryContext.length > 0
-        ? `${memoryContext}\n\n${PLANNING_SYSTEM}`
-        : PLANNING_SYSTEM;
+export async function planGoal(goal, client, onUsage, memoryContext, adaptive) {
+    // M41: adaptive path budgets the memory block via the prompt suite; the legacy
+    // path keeps the original prepend behavior byte-for-byte.
+    const systemContent = adaptive
+        ? systemPromptFor({
+            role: 'planner',
+            useTools: false,
+            profile: resolveModelProfile(client.model),
+            memory: memoryContext,
+        })
+        : memoryContext && memoryContext.length > 0
+            ? `${memoryContext}\n\n${PLANNING_SYSTEM}`
+            : PLANNING_SYSTEM;
     const messages = [
         { role: 'system', content: systemContent },
         { role: 'user', content: goal },
@@ -490,8 +496,8 @@ export async function planGoal(goal, client, onUsage, memoryContext) {
 // ---------------------------------------------------------------------------
 // Synthesis
 // ---------------------------------------------------------------------------
-const SYNTHESIS_SYSTEM = `You are a helpful assistant. The user asked a goal and several subtasks were executed to answer it.
-Combine the results into a single, coherent final answer. Be concise and accurate.`;
+// M41: single-sourced from prompts/roles.SYNTHESIZER_ROLE (verbatim).
+const SYNTHESIS_SYSTEM = SYNTHESIZER_ROLE;
 /**
  * Synthesize a final answer from completed task results.
  * Returns a best-effort string even if the model call fails.
@@ -625,7 +631,7 @@ async function checkGovernance(cfg, overBudgetFlag) {
  */
 function isBinaryInstalled(name) {
     try {
-        execFileSync('which', [name], { stdio: 'ignore' });
+        execFileSync(process.platform === 'win32' ? 'where' : 'which', [name], { stdio: 'ignore' });
         return true;
     }
     catch {
@@ -644,7 +650,19 @@ function emit(sink, event) {
     }
 }
 /** Known engine ids (typed subset). */
-const KNOWN_ENGINE_IDS = new Set(['builtin', 'ashlrcode', 'aw', 'claude']);
+const KNOWN_ENGINE_IDS = new Set(['builtin', 'ashlrcode', 'aw', 'claude', 'codex']);
+/**
+ * M45: whether an external engine should run SANDBOXED (worktree + diff→inbox)
+ * instead of raw on the live tree. True only when cfg.foundry opts in; default
+ * (absent) keeps the raw delegation path → today's behavior unchanged.
+ */
+function foundryWantsSandbox(cfg, engine) {
+    if (engine === 'builtin')
+        return false;
+    if (!cfg.foundry)
+        return false;
+    return cfg.foundry.sandboxExternal ?? true;
+}
 // ---------------------------------------------------------------------------
 // Main: runGoal
 // ---------------------------------------------------------------------------
@@ -765,6 +783,28 @@ export async function runGoal(goal, cfg, opts) {
             else {
                 process.stderr.write(`[ashlr run] delegating to engine "${engine}" (${goal.slice(0, 60)}…)\n`);
                 emit(sink, { kind: 'log', text: `delegating to engine "${engine}"` });
+                // M45: sandboxed-external path — run the agent CLI confined to a throwaway
+                // worktree and capture its diff as a PENDING proposal. Gated by
+                // opts.sandboxEngine or cfg.foundry; when neither is set the raw delegation
+                // below runs unchanged (today's behavior). No raw fallback here: defeating
+                // the sandbox would break the no-outward guarantee for autonomous runs.
+                if (opts.sandboxEngine === true || foundryWantsSandbox(cfg, engineId)) {
+                    const { runEngineSandboxed } = await import('./sandboxed-engine.js');
+                    const r = await runEngineSandboxed(engineId, goal, cfg, {
+                        sourceRepo: cwd,
+                        model: modelEnv,
+                        budget: opts.budget,
+                        propose: true,
+                    });
+                    emit(sink, {
+                        kind: r.state.status === 'done' ? 'task-done' : 'log',
+                        text: r.proposalId
+                            ? `engine "${engine}" → inbox proposal ${r.proposalId}`
+                            : `engine "${engine}" ${r.state.status}`,
+                    });
+                    saveRun(r.state);
+                    return r.state;
+                }
                 const id = generateRunId();
                 const now = new Date().toISOString();
                 const delegatedState = {
@@ -906,468 +946,633 @@ export async function runGoal(goal, cfg, opts) {
         saveRun(state);
     }
     // -- Tool wiring (optional) --------------------------------------------------
-    // When opts.tools !== false, attempt to connect to the MCP gateway as a client.
-    // On any failure, continue tool-free with a warning.
+    // Default: spec-only gateway tools (exactly today's behavior). With
+    // opts.engineer, the hub loop gets an EXECUTABLE, sandboxed surface: native
+    // tools (with fn) + downstream specs + engineering tools (read/glob/grep +
+    // sandboxed write/edit, and with allowBash also bash). All writes/exec are
+    // confined to a throwaway git worktree; the captured diff is routed to the
+    // approval inbox at the end — nothing reaches the live tree unapproved.
     let tools;
+    let activeSandbox = null;
+    let sandboxModule = null;
+    let engCtx;
     if (opts.tools !== false && client.supportsTools) {
-        try {
-            tools = await loadGatewayTools(cfg);
+        if (opts.engineer === true) {
+            const sourceRepo = opts.cwd && path.isAbsolute(opts.cwd) && fs.existsSync(opts.cwd)
+                ? opts.cwd
+                : process.cwd();
+            try {
+                sandboxModule = await import('../sandbox/worktree.js');
+                activeSandbox = sandboxModule.createSandbox(sourceRepo);
+                engCtx = {
+                    workspaceRoot: activeSandbox.worktreePath,
+                    sourceRepo,
+                    allowWrite: true,
+                    allowExec: opts.allowBash === true,
+                };
+                const gateway = await loadGatewayTools(cfg).catch(() => []);
+                const nativeNames = new Set(listNativeTools().map((t) => t.name));
+                const downstreamOnly = gateway.filter((t) => !nativeNames.has(t.function?.name ?? ''));
+                tools = [
+                    ...buildNativeToolSpecsWithFn(),
+                    ...downstreamOnly,
+                    ...buildEngineerToolSpecs(engCtx),
+                ];
+                process.stderr.write(`[ashlr run] --engineer: sandboxed tools active in ${activeSandbox.worktreePath}` +
+                    `${engCtx.allowExec ? ' (bash enabled)' : ''}\n`);
+            }
+            catch (err) {
+                const msg = err instanceof Error ? err.message : String(err);
+                process.stderr.write(`[ashlr run] --engineer unavailable (${msg}) — enroll the repo (ashlr enroll) ` +
+                    `and clear the kill switch; continuing with read-only gateway tools\n`);
+                activeSandbox = null;
+                sandboxModule = null;
+                engCtx = undefined;
+                try {
+                    tools = await loadGatewayTools(cfg);
+                }
+                catch {
+                    tools = undefined;
+                }
+            }
         }
-        catch (err) {
-            const msg = err instanceof Error ? err.message : String(err);
-            process.stderr.write(`[ashlr run] tool gateway unavailable (${msg}) — continuing tool-free\n`);
-            tools = undefined;
+        else {
+            try {
+                tools = await loadGatewayTools(cfg);
+            }
+            catch (err) {
+                const msg = err instanceof Error ? err.message : String(err);
+                process.stderr.write(`[ashlr run] tool gateway unavailable (${msg}) — continuing tool-free\n`);
+                tools = undefined;
+            }
         }
     }
-    // -- M16/M7: Genome memory injection (best-effort, bounded, local-only) ------
-    // M16: prefer a synthesized playbook over raw recall when playbookOnRun is on.
-    // Falls back to the existing raw-recall block on any playbook failure.
-    // Skipped when: noMemory is set, cfg disables injection, or this is a resume
-    // with existing tasks (context was already embedded in those task goals).
-    let memoryContext = '';
-    const injectOnRun = cfg.genome?.injectOnRun ?? true;
-    if (!noMemory && injectOnRun && state.tasks.length === 0) {
-        // Only attempt playbook injection when genome is explicitly configured and
-        // playbookOnRun is not disabled. When cfg.genome is absent there is nothing
-        // to recall, and the playbook module makes local Ollama fetch calls even on
-        // an empty recall — which would interfere with scripted fetch mocks in tests
-        // and add unnecessary latency in unconfigured environments.
-        const playbookOnRun = cfg.genome != null && cfg.genome.playbookOnRun !== false;
-        let playbookInjected = false;
-        if (playbookOnRun) {
-            try {
-                // Dynamic import: tolerates the module being absent (pre-M16 build).
-                // eslint-disable-next-line @typescript-eslint/no-explicit-any
-                const pbMod = await import('../genome/playbook.js');
-                if (typeof pbMod.buildPlaybook === 'function' &&
-                    typeof pbMod.playbookText === 'function') {
-                    const playbook = await pbMod.buildPlaybook(goal, cfg);
-                    const pbText = pbMod.playbookText(playbook, GENOME_INJECT_CHAR_CAP);
-                    if (pbText && pbText.length > 0) {
-                        memoryContext = pbText;
-                        playbookInjected = true;
-                        process.stderr.write(`[ashlr run] genome: injecting ${memoryContext.length} chars of playbook context\n`);
-                    }
+    // M42: capture the sandbox diff into the approval inbox + tear down. Idempotent
+    // and best-effort — never throws, called on every runGoal exit path.
+    const finalizeEngineer = () => {
+        if (!activeSandbox || !sandboxModule)
+            return;
+        const sb = activeSandbox;
+        const wt = sandboxModule;
+        activeSandbox = null;
+        try {
+            const diff = wt.sandboxDiff(sb);
+            if (diff.files > 0 && diff.patch.trim().length > 0) {
+                try {
+                    const proposal = selectInboxStore(cfg).create({
+                        repo: sb.sourceRepo,
+                        origin: 'agent',
+                        kind: 'patch',
+                        title: `engineer run: ${goal.slice(0, 80)}`,
+                        summary: `Sandboxed --engineer run produced ${diff.files} file(s) ` +
+                            `(+${diff.insertions}/-${diff.deletions}). Review before applying.`,
+                        diff: scrubSecrets(diff.patch),
+                        sandboxId: sb.id,
+                    });
+                    process.stderr.write(`[ashlr run] engineer diff → inbox proposal ${proposal.id} ` +
+                        `(${diff.files} files); review with 'ashlr inbox'\n`);
+                }
+                catch (err) {
+                    process.stderr.write(`[ashlr run] could not file engineer proposal: ${String(err)}\n`);
                 }
             }
+        }
+        catch {
+            // diff capture best-effort
+        }
+        finally {
+            try {
+                wt.removeSandbox(sb);
+            }
             catch {
-                // Playbook module absent or failed — fall through to raw recall below.
+                // removal is idempotent
             }
         }
-        if (!playbookInjected) {
-            // M7 fallback: raw recall injection.
-            memoryContext = await buildMemoryBlock(goal, cfg);
-            if (memoryContext.length > 0) {
-                process.stderr.write(`[ashlr run] genome: injecting ${memoryContext.length} chars of memory context\n`);
+    };
+    // M42: guarantee sandbox teardown + diff capture on EVERY exit path, including
+    // a throw from planning/synthesis. finalizeEngineer is idempotent and a no-op
+    // when no sandbox is active, so this is safe for non-engineer runs too.
+    try {
+        // M41: resolve once — gates adaptive prompts for planning AND every task.
+        const adaptivePrompts = adaptivePromptsEnabled(cfg);
+        // -- M16/M7: Genome memory injection (best-effort, bounded, local-only) ------
+        // M16: prefer a synthesized playbook over raw recall when playbookOnRun is on.
+        // Falls back to the existing raw-recall block on any playbook failure.
+        // Skipped when: noMemory is set, cfg disables injection, or this is a resume
+        // with existing tasks (context was already embedded in those task goals).
+        let memoryContext = '';
+        const injectOnRun = cfg.genome?.injectOnRun ?? true;
+        if (!noMemory && injectOnRun && state.tasks.length === 0) {
+            // Only attempt playbook injection when genome is explicitly configured and
+            // playbookOnRun is not disabled. When cfg.genome is absent there is nothing
+            // to recall, and the playbook module makes local Ollama fetch calls even on
+            // an empty recall — which would interfere with scripted fetch mocks in tests
+            // and add unnecessary latency in unconfigured environments.
+            const playbookOnRun = cfg.genome != null && cfg.genome.playbookOnRun !== false;
+            let playbookInjected = false;
+            if (playbookOnRun) {
+                try {
+                    // Dynamic import: tolerates the module being absent (pre-M16 build).
+                    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+                    const pbMod = await import('../genome/playbook.js');
+                    if (typeof pbMod.buildPlaybook === 'function' &&
+                        typeof pbMod.playbookText === 'function') {
+                        const playbook = await pbMod.buildPlaybook(goal, cfg);
+                        const pbText = pbMod.playbookText(playbook, GENOME_INJECT_CHAR_CAP);
+                        if (pbText && pbText.length > 0) {
+                            memoryContext = pbText;
+                            playbookInjected = true;
+                            process.stderr.write(`[ashlr run] genome: injecting ${memoryContext.length} chars of playbook context\n`);
+                        }
+                    }
+                }
+                catch {
+                    // Playbook module absent or failed — fall through to raw recall below.
+                }
             }
-        }
-    }
-    // -- Plan (unless resuming with existing tasks) ------------------------------
-    if (state.tasks.length === 0) {
-        const planStep = {
-            ts: new Date().toISOString(),
-            taskId: '__plan__',
-            kind: 'plan',
-            summary: `Planning: decomposing goal into tasks`,
-        };
-        state.steps.push(planStep);
-        state.updatedAt = planStep.ts;
-        saveRun(state);
-        let planTokensIn = 0;
-        let planTokensOut = 0;
-        const tasks = await planGoal(goal, client, (u) => {
-            planTokensIn = u.tokensIn;
-            planTokensOut = u.tokensOut;
-        }, memoryContext || undefined);
-        state.tasks = tasks;
-        // Charge the planning call to the run budget so usage/cost stay accurate.
-        // (Previously the planning tokens were silently discarded.)
-        // Accumulate incrementally (price ONLY the planning tokens at the planner's
-        // provider) so this is consistent with the per-step accumulation below and
-        // never re-prices later task tokens at the planner's provider.
-        state.usage.tokensIn += planTokensIn;
-        state.usage.tokensOut += planTokensOut;
-        state.usage.steps += 1;
-        state.usage.estCostUsd += estCostUsd(client.id, planTokensIn, planTokensOut);
-        state.updatedAt = new Date().toISOString();
-        const planDoneStep = {
-            ts: state.updatedAt,
-            taskId: '__plan__',
-            kind: 'plan',
-            summary: `Planned ${tasks.length} task(s): ${tasks.map((t) => t.id).join(', ')}`,
-            usage: { tokensIn: planTokensIn, tokensOut: planTokensOut, steps: 1, estCostUsd: 0 },
-        };
-        state.steps.push(planDoneStep);
-        cliOnStep?.(planDoneStep, state.tasks);
-        saveRun(state);
-    }
-    // -- DAG execution loop ------------------------------------------------------
-    let aborted = false;
-    while (!allTerminal(state.tasks) && !aborted) {
-        // Check global budget before picking next batch
-        if (overBudget(state.usage, budget)) {
-            aborted = true;
-            break;
-        }
-        const ready = readyTasks(state.tasks);
-        if (ready.length === 0) {
-            // No ready tasks but not all terminal — means some tasks have deps on
-            // failed/skipped tasks. Mark them skipped.
-            const pendingBlocked = state.tasks.filter((t) => t.status === 'pending');
-            if (pendingBlocked.length > 0) {
-                for (const t of pendingBlocked) {
-                    t.status = 'skipped';
-                    t.error = 'Dependency failed or was skipped';
+            if (!playbookInjected) {
+                // M7 fallback: raw recall injection.
+                memoryContext = await buildMemoryBlock(goal, cfg);
+                if (memoryContext.length > 0) {
+                    process.stderr.write(`[ashlr run] genome: injecting ${memoryContext.length} chars of memory context\n`);
                 }
-                state.updatedAt = new Date().toISOString();
-                saveRun(state);
             }
-            break;
         }
-        // Run up to `parallel` tasks concurrently
-        const batch = ready.slice(0, parallel);
-        // Mark them running before spawning
-        for (const task of batch) {
-            task.status = 'running';
+        // -- Plan (unless resuming with existing tasks) ------------------------------
+        if (state.tasks.length === 0) {
+            const planStep = {
+                ts: new Date().toISOString(),
+                taskId: '__plan__',
+                kind: 'plan',
+                summary: `Planning: decomposing goal into tasks`,
+            };
+            state.steps.push(planStep);
+            state.updatedAt = planStep.ts;
+            saveRun(state);
+            let planTokensIn = 0;
+            let planTokensOut = 0;
+            const tasks = await planGoal(goal, client, (u) => {
+                planTokensIn = u.tokensIn;
+                planTokensOut = u.tokensOut;
+            }, memoryContext || undefined, adaptivePrompts);
+            state.tasks = tasks;
+            // Charge the planning call to the run budget so usage/cost stay accurate.
+            // (Previously the planning tokens were silently discarded.)
+            // Accumulate incrementally (price ONLY the planning tokens at the planner's
+            // provider) so this is consistent with the per-step accumulation below and
+            // never re-prices later task tokens at the planner's provider.
+            state.usage.tokensIn += planTokensIn;
+            state.usage.tokensOut += planTokensOut;
+            state.usage.steps += 1;
+            state.usage.estCostUsd += estCostUsd(client.id, planTokensIn, planTokensOut);
+            state.updatedAt = new Date().toISOString();
+            const planDoneStep = {
+                ts: state.updatedAt,
+                taskId: '__plan__',
+                kind: 'plan',
+                summary: `Planned ${tasks.length} task(s): ${tasks.map((t) => t.id).join(', ')}`,
+                usage: { tokensIn: planTokensIn, tokensOut: planTokensOut, steps: 1, estCostUsd: 0 },
+            };
+            state.steps.push(planDoneStep);
+            cliOnStep?.(planDoneStep, state.tasks);
+            saveRun(state);
         }
-        state.updatedAt = new Date().toISOString();
-        saveRun(state);
-        // Run the batch in parallel; each task must not crash the whole run
-        await Promise.all(batch.map(async (task) => {
-            try {
-                // M11: emit task-start event.
-                emit(sink, { kind: 'task-start', taskId: task.id, text: task.goal });
-                // M15: Choose route for this task (local-first; cloud only when
-                // allowCloud + escalation reason + key present). Best-effort — falls
-                // back to the run-level client when router is unavailable.
-                const { client: taskClient, decision: taskDecision } = await routeTask(task.goal, cfg, { allowCloud, attempt: 1, lastReason: 'none' }, client);
-                emit(sink, {
-                    kind: 'log',
-                    taskId: task.id,
-                    text: `route: ${taskDecision.provider}/${taskDecision.model} [${taskDecision.tier}] — ${taskDecision.reason}`,
-                });
-                // Build per-task onStep callback (single-writer invariant preserved).
-                // M15: cost attribution uses the provider that actually served EACH step.
-                // We ACCUMULATE cost incrementally (+= this step's tokens priced at this
-                // step's provider) rather than recomputing estCostUsd over the cumulative
-                // run-wide totals at the current provider. Recomputing-from-cumulative is
-                // wrong for mixed local+cloud runs: it would re-price an earlier local
-                // task's tokens at a later cloud escalation's rates (over-charging), or
-                // re-price an earlier cloud task's tokens at $0 when a later step is local
-                // (erasing real spend). Incremental accumulation keeps local steps at $0
-                // regardless of any later cloud escalation, and prices cloud escalations
-                // on only the tokens they served.
-                const makeTaskOnStep = (providerForCost) => (step) => {
-                    state.steps.push(step);
-                    // SINGLE-WRITER INVARIANT: orchestrator is the only mutator of state.usage.
-                    if (step.usage) {
-                        state.usage.tokensIn += step.usage.tokensIn;
-                        state.usage.tokensOut += step.usage.tokensOut;
-                        state.usage.steps += step.usage.steps;
-                        state.usage.estCostUsd += estCostUsd(providerForCost, step.usage.tokensIn, step.usage.tokensOut);
+        // -- DAG execution loop ------------------------------------------------------
+        let aborted = false;
+        while (!allTerminal(state.tasks) && !aborted) {
+            // Check global budget before picking next batch
+            if (overBudget(state.usage, budget)) {
+                aborted = true;
+                break;
+            }
+            const ready = readyTasks(state.tasks);
+            if (ready.length === 0) {
+                // No ready tasks but not all terminal — means some tasks have deps on
+                // failed/skipped tasks. Mark them skipped.
+                const pendingBlocked = state.tasks.filter((t) => t.status === 'pending');
+                if (pendingBlocked.length > 0) {
+                    for (const t of pendingBlocked) {
+                        t.status = 'skipped';
+                        t.error = 'Dependency failed or was skipped';
                     }
                     state.updatedAt = new Date().toISOString();
-                    cliOnStep?.(step, state.tasks);
                     saveRun(state);
-                };
-                let taskOnStep = makeTaskOnStep(taskDecision.provider);
-                // M11: Retry policy — bounded, budget-aware.
-                // We retry on transient/tool failures only; hard budget stops are not retryable.
-                const RETRY_POLICY = { maxAttempts: 2, baseDelayMs: 500 };
-                const isRetryable = (err) => {
-                    // Don't retry if budget is already exhausted.
-                    if (overBudget(state.usage, budget))
+                }
+                break;
+            }
+            // Run up to `parallel` tasks concurrently
+            const batch = ready.slice(0, parallel);
+            // Mark them running before spawning
+            for (const task of batch) {
+                task.status = 'running';
+            }
+            state.updatedAt = new Date().toISOString();
+            saveRun(state);
+            // Run the batch in parallel; each task must not crash the whole run
+            await Promise.all(batch.map(async (task) => {
+                try {
+                    // M11: emit task-start event.
+                    emit(sink, { kind: 'task-start', taskId: task.id, text: task.goal });
+                    // M15: Choose route for this task (local-first; cloud only when
+                    // allowCloud + escalation reason + key present). Best-effort — falls
+                    // back to the run-level client when router is unavailable.
+                    const { client: taskClient, decision: taskDecision } = await routeTask(task.goal, cfg, { allowCloud, attempt: 1, lastReason: 'none' }, client);
+                    emit(sink, {
+                        kind: 'log',
+                        taskId: task.id,
+                        text: `route: ${taskDecision.provider}/${taskDecision.model} [${taskDecision.tier}] — ${taskDecision.reason}`,
+                    });
+                    // Build per-task onStep callback (single-writer invariant preserved).
+                    // M15: cost attribution uses the provider that actually served EACH step.
+                    // We ACCUMULATE cost incrementally (+= this step's tokens priced at this
+                    // step's provider) rather than recomputing estCostUsd over the cumulative
+                    // run-wide totals at the current provider. Recomputing-from-cumulative is
+                    // wrong for mixed local+cloud runs: it would re-price an earlier local
+                    // task's tokens at a later cloud escalation's rates (over-charging), or
+                    // re-price an earlier cloud task's tokens at $0 when a later step is local
+                    // (erasing real spend). Incremental accumulation keeps local steps at $0
+                    // regardless of any later cloud escalation, and prices cloud escalations
+                    // on only the tokens they served.
+                    const makeTaskOnStep = (providerForCost) => (step) => {
+                        state.steps.push(step);
+                        // SINGLE-WRITER INVARIANT: orchestrator is the only mutator of state.usage.
+                        if (step.usage) {
+                            state.usage.tokensIn += step.usage.tokensIn;
+                            state.usage.tokensOut += step.usage.tokensOut;
+                            state.usage.steps += step.usage.steps;
+                            state.usage.estCostUsd += estCostUsd(providerForCost, step.usage.tokensIn, step.usage.tokensOut);
+                        }
+                        state.updatedAt = new Date().toISOString();
+                        cliOnStep?.(step, state.tasks);
+                        saveRun(state);
+                    };
+                    let taskOnStep = makeTaskOnStep(taskDecision.provider);
+                    // M11: Retry policy — bounded, budget-aware.
+                    // We retry on transient/tool failures only; hard budget stops are not retryable.
+                    const RETRY_POLICY = { maxAttempts: 2, baseDelayMs: 500 };
+                    const isRetryable = (err) => {
+                        // Don't retry if budget is already exhausted.
+                        if (overBudget(state.usage, budget))
+                            return false;
+                        // Retry on network/transient errors (not on deterministic task failures).
+                        if (err instanceof Error) {
+                            const msg = err.message.toLowerCase();
+                            return (msg.includes('network') ||
+                                msg.includes('timeout') ||
+                                msg.includes('econnrefused') ||
+                                msg.includes('fetch') ||
+                                msg.includes('socket'));
+                        }
                         return false;
-                    // Retry on network/transient errors (not on deterministic task failures).
-                    if (err instanceof Error) {
-                        const msg = err.message.toLowerCase();
-                        return (msg.includes('network') ||
-                            msg.includes('timeout') ||
-                            msg.includes('econnrefused') ||
-                            msg.includes('fetch') ||
-                            msg.includes('socket'));
-                    }
-                    return false;
-                };
-                await withRetry(async (attempt) => {
-                    if (attempt > 1) {
-                        emit(sink, {
-                            kind: 'retry',
-                            taskId: task.id,
-                            text: `attempt ${attempt} of ${RETRY_POLICY.maxAttempts}`,
-                        });
-                        // Reset task state for re-run on retry.
-                        task.status = 'running';
-                        task.result = undefined;
-                        task.error = undefined;
-                    }
-                    // M20: bounded self-heal for OOM/rate-limit on model calls.
-                    // Opt-out: ASHLR_NO_HEAL skips the wrapper entirely.
-                    const noHeal = process.env['ASHLR_NO_HEAL'] === '1';
-                    const runWithHeal = async (healAttempt) => {
-                        // On heal attempt > 1 with a 'model-downgrade' event the client
-                        // was already logged via onHeal; chooseRoute will pick a smaller
-                        // model on the next routeTask call if the outer attempt increments,
-                        // so we just re-run with the current client here (the heal retry
-                        // is bounded by policy.maxRestarts and stays fully local).
-                        if (healAttempt > 1) {
-                            // Re-route to a smaller local model for the downgrade attempt.
-                            // Best-effort: fall back to existing taskClient on any error.
-                            try {
-                                const { client: smallerClient } = await routeTask(task.goal, cfg, { allowCloud: false, attempt: healAttempt, lastReason: 'none' }, taskClient);
-                                task.status = 'running';
-                                task.result = undefined;
-                                task.error = undefined;
-                                await runTask(task, smallerClient, {
-                                    tools,
-                                    budget,
-                                    usage: state.usage,
-                                    sink,
-                                    onStep: makeTaskOnStep(smallerClient.id),
-                                });
-                                return;
+                    };
+                    await withRetry(async (attempt) => {
+                        if (attempt > 1) {
+                            emit(sink, {
+                                kind: 'retry',
+                                taskId: task.id,
+                                text: `attempt ${attempt} of ${RETRY_POLICY.maxAttempts}`,
+                            });
+                            // Reset task state for re-run on retry.
+                            task.status = 'running';
+                            task.result = undefined;
+                            task.error = undefined;
+                        }
+                        // M20: bounded self-heal for OOM/rate-limit on model calls.
+                        // Opt-out: ASHLR_NO_HEAL skips the wrapper entirely.
+                        const noHeal = process.env['ASHLR_NO_HEAL'] === '1';
+                        const runWithHeal = async (healAttempt) => {
+                            // On heal attempt > 1 with a 'model-downgrade' event the client
+                            // was already logged via onHeal; chooseRoute will pick a smaller
+                            // model on the next routeTask call if the outer attempt increments,
+                            // so we just re-run with the current client here (the heal retry
+                            // is bounded by policy.maxRestarts and stays fully local).
+                            if (healAttempt > 1) {
+                                // Re-route to a smaller local model for the downgrade attempt.
+                                // Best-effort: fall back to existing taskClient on any error.
+                                try {
+                                    const { client: smallerClient } = await routeTask(task.goal, cfg, { allowCloud: false, attempt: healAttempt, lastReason: 'none' }, taskClient);
+                                    task.status = 'running';
+                                    task.result = undefined;
+                                    task.error = undefined;
+                                    await runTask(task, smallerClient, {
+                                        tools,
+                                        budget,
+                                        usage: state.usage,
+                                        sink,
+                                        adaptivePrompts,
+                                        onStep: makeTaskOnStep(smallerClient.id),
+                                    });
+                                    return;
+                                }
+                                catch {
+                                    // Fall through to original client below.
+                                }
                             }
-                            catch {
-                                // Fall through to original client below.
+                            await runTask(task, taskClient, {
+                                tools,
+                                budget,
+                                usage: state.usage,
+                                sink,
+                                adaptivePrompts,
+                                onStep: taskOnStep,
+                            });
+                        };
+                        if (noHeal) {
+                            await runTask(task, taskClient, {
+                                tools,
+                                budget,
+                                usage: state.usage,
+                                sink,
+                                adaptivePrompts,
+                                onStep: taskOnStep,
+                            });
+                        }
+                        else {
+                            const healPolicy = defaultHealPolicy();
+                            await withHeal(runWithHeal, healPolicy, (event) => {
+                                emit(sink, {
+                                    kind: 'log',
+                                    taskId: task.id,
+                                    text: `[self-heal] ${event.kind} attempt ${event.attempt}: ${event.detail}`,
+                                });
+                                process.stderr.write(`[ashlr run] self-heal(${event.kind}) task ${task.id} attempt ${event.attempt}: ${event.detail}\n`);
+                            }, allowCloud).catch((healErr) => {
+                                // withHeal exhausted — re-throw so the outer withRetry sees it.
+                                throw healErr;
+                            });
+                        }
+                        // If runTask set status to failed, surface as a throw so withRetry
+                        // can decide whether to retry (only on retryable errors).
+                        if (task.status === 'failed') {
+                            const errMsg = task.error ?? 'task failed';
+                            // Only transient errors get retried; model/parsing errors do not.
+                            // We check if the error looks retryable before throwing.
+                            if (isRetryable(new Error(errMsg))) {
+                                throw new Error(errMsg);
                             }
+                            // Non-retryable failure: don't throw (withRetry would still catch
+                            // and re-throw since isRetryable returns false). Fall through.
                         }
-                        await runTask(task, taskClient, {
-                            tools,
-                            budget,
-                            usage: state.usage,
-                            sink,
-                            onStep: taskOnStep,
-                        });
-                    };
-                    if (noHeal) {
-                        await runTask(task, taskClient, {
-                            tools,
-                            budget,
-                            usage: state.usage,
-                            sink,
-                            onStep: taskOnStep,
-                        });
-                    }
-                    else {
-                        const healPolicy = defaultHealPolicy();
-                        await withHeal(runWithHeal, healPolicy, (event) => {
+                    }, RETRY_POLICY, isRetryable).catch((err) => {
+                        // withRetry exhausted all attempts or got a non-retryable error.
+                        // task.status is already 'failed' (set by runTask); just ensure error is set.
+                        if (task.status !== 'failed') {
+                            task.status = 'failed';
+                            task.error = err instanceof Error ? err.message : String(err);
+                        }
+                    });
+                    // M15: On task failure, attempt ONE escalated routed retry.
+                    // Escalation is gated by: allowCloud AND escalate.onFailure AND !overBudget.
+                    // chooseRoute enforces the additional cloud-key check; if it returns a
+                    // local route again (key absent, allowCloud false, etc.) we just stay local.
+                    if (task.status === 'failed' &&
+                        allowCloud &&
+                        (cfg.models.escalate?.onFailure ?? false) &&
+                        !overBudget(state.usage, budget)) {
+                        const { client: escalatedClient, decision: escalatedDecision } = await routeTask(task.goal, cfg, { allowCloud, attempt: 2, lastReason: 'task-failed' }, client);
+                        // Only actually escalate if chooseRoute returned a DIFFERENT (cloud)
+                        // route AND buildRoutedClient was able to construct a client for that
+                        // cloud provider. If the cloud client could not be built (key absent,
+                        // cloud completions unimplemented), buildRoutedClient falls back to a
+                        // LOCAL client whose .id is the local provider — in that case we must
+                        // NOT print "escalating to cloud" or charge cloud rates. Cost is
+                        // attributed by the ACTUAL client.id, never the intended provider.
+                        const cloudEscalated = escalatedDecision.tier === 'cloud' &&
+                            escalatedClient.id === escalatedDecision.provider;
+                        if (cloudEscalated) {
                             emit(sink, {
-                                kind: 'log',
+                                kind: 'retry',
                                 taskId: task.id,
-                                text: `[self-heal] ${event.kind} attempt ${event.attempt}: ${event.detail}`,
+                                text: `escalating to cloud: ${escalatedDecision.provider}/${escalatedDecision.model} — ${escalatedDecision.reason}`,
+                            });
+                            task.status = 'running';
+                            task.result = undefined;
+                            task.error = undefined;
+                            // Attribute cost to the ACTUAL serving client (cloud here).
+                            taskOnStep = makeTaskOnStep(escalatedClient.id);
+                            await runTask(task, escalatedClient, {
+                                tools,
+                                budget,
+                                usage: state.usage,
+                                sink,
+                                adaptivePrompts,
+                                onStep: taskOnStep,
+                            }).catch((err) => {
+                                if (task.status !== 'failed') {
+                                    task.status = 'failed';
+                                    task.error = err instanceof Error ? err.message : String(err);
+                                }
                             });
-                            process.stderr.write(`[ashlr run] self-heal(${event.kind}) task ${task.id} attempt ${event.attempt}: ${event.detail}\n`);
-                        }, allowCloud).catch((healErr) => {
-                            // withHeal exhausted — re-throw so the outer withRetry sees it.
-                            throw healErr;
-                        });
-                    }
-                    // If runTask set status to failed, surface as a throw so withRetry
-                    // can decide whether to retry (only on retryable errors).
-                    if (task.status === 'failed') {
-                        const errMsg = task.error ?? 'task failed';
-                        // Only transient errors get retried; model/parsing errors do not.
-                        // We check if the error looks retryable before throwing.
-                        if (isRetryable(new Error(errMsg))) {
-                            throw new Error(errMsg);
                         }
-                        // Non-retryable failure: don't throw (withRetry would still catch
-                        // and re-throw since isRetryable returns false). Fall through.
+                        // If escalation could not reach cloud (still local / cloud client
+                        // unbuildable), leave task.status as 'failed' — no further action,
+                        // no misleading cloud event, no cloud cost.
                     }
-                }, RETRY_POLICY, isRetryable).catch((err) => {
-                    // withRetry exhausted all attempts or got a non-retryable error.
-                    // task.status is already 'failed' (set by runTask); just ensure error is set.
-                    if (task.status !== 'failed') {
-                        task.status = 'failed';
-                        task.error = err instanceof Error ? err.message : String(err);
-                    }
-                });
-                // M15: On task failure, attempt ONE escalated routed retry.
-                // Escalation is gated by: allowCloud AND escalate.onFailure AND !overBudget.
-                // chooseRoute enforces the additional cloud-key check; if it returns a
-                // local route again (key absent, allowCloud false, etc.) we just stay local.
-                if (task.status === 'failed' &&
-                    allowCloud &&
-                    (cfg.models.escalate?.onFailure ?? false) &&
-                    !overBudget(state.usage, budget)) {
-                    const { client: escalatedClient, decision: escalatedDecision } = await routeTask(task.goal, cfg, { allowCloud, attempt: 2, lastReason: 'task-failed' }, client);
-                    // Only actually escalate if chooseRoute returned a DIFFERENT (cloud)
-                    // route AND buildRoutedClient was able to construct a client for that
-                    // cloud provider. If the cloud client could not be built (key absent,
-                    // cloud completions unimplemented), buildRoutedClient falls back to a
-                    // LOCAL client whose .id is the local provider — in that case we must
-                    // NOT print "escalating to cloud" or charge cloud rates. Cost is
-                    // attributed by the ACTUAL client.id, never the intended provider.
-                    const cloudEscalated = escalatedDecision.tier === 'cloud' &&
-                        escalatedClient.id === escalatedDecision.provider;
-                    if (cloudEscalated) {
-                        emit(sink, {
-                            kind: 'retry',
-                            taskId: task.id,
-                            text: `escalating to cloud: ${escalatedDecision.provider}/${escalatedDecision.model} — ${escalatedDecision.reason}`,
-                        });
-                        task.status = 'running';
-                        task.result = undefined;
-                        task.error = undefined;
-                        // Attribute cost to the ACTUAL serving client (cloud here).
-                        taskOnStep = makeTaskOnStep(escalatedClient.id);
-                        await runTask(task, escalatedClient, {
-                            tools,
-                            budget,
-                            usage: state.usage,
-                            sink,
-                            onStep: taskOnStep,
-                        }).catch((err) => {
-                            if (task.status !== 'failed') {
-                                task.status = 'failed';
-                                task.error = err instanceof Error ? err.message : String(err);
-                            }
-                        });
-                    }
-                    // If escalation could not reach cloud (still local / cloud client
-                    // unbuildable), leave task.status as 'failed' — no further action,
-                    // no misleading cloud event, no cloud cost.
-                }
-                // M11: Verify completed tasks; one retry on !ok if budget allows.
-                // Skip verify entirely once the run is over budget: a budget abort can
-                // leave a task 'done' with a result annotated by an abort/needs-attention
-                // marker, which the heuristic's error-sentinel check would flag as a
-                // benign false-positive "verify fail". Skipping keeps the abort path
-                // clean (no confusing verify line) and avoids any model call past the
-                // ceiling. (Real verification still runs on every in-budget completion.)
-                if (task.status === 'done' && !overBudget(state.usage, budget)) {
-                    const verdict = await verifyTask(task, taskClient, budget, state.usage, {
-                        model: verifyModel,
-                    });
-                    emit(sink, {
-                        kind: 'verify',
-                        taskId: task.id,
-                        text: verdict.reason,
-                        data: verdict,
-                    });
-                    if (!verdict.ok) {
-                        if (!overBudget(state.usage, budget)) {
-                            // M15: verify-failed escalation path — attempt ONE routed retry.
-                            // If allowCloud + escalate.onFailure + key present, chooseRoute
-                            // may return a cloud route; otherwise stays local.
-                            const { client: verifyRetryClient, decision: verifyRetryDecision } = await routeTask(task.goal, cfg, { allowCloud, attempt: 2, lastReason: 'verify-failed' }, taskClient);
-                            // Only treat this as a cloud escalation if the cloud client was
-                            // actually built (decision is cloud AND the returned client's id
-                            // matches the routed cloud provider). Otherwise buildRoutedClient
-                            // fell back to local — keep the event + cost attribution local.
-                            const escalatingToCloud = verifyRetryDecision.tier === 'cloud' &&
-                                verifyRetryClient.id === verifyRetryDecision.provider;
-                            // One verification-driven retry: re-run the task.
+                    // M11/M43: structured verify + bounded verify→repair loop. Skip once
+                    // over budget (a budget abort can annotate a 'done' result the
+                    // heuristic would flag as a false-positive fail).
+                    if (task.status === 'done' && !overBudget(state.usage, budget)) {
+                        const maxRepairs = Math.max(0, opts.maxRepairs ?? (engCtx?.allowExec ? 2 : 1)); // flag-off parity: plain run = 1 retry; engineer runs get up to 2 bounded repairs
+                        // Single source for the verify options (avoids drift between the
+                        // initial verify and the in-loop re-verify).
+                        const verifyOpts = {
+                            model: verifyModel,
+                            workspaceRoot: engCtx?.workspaceRoot,
+                            allowExec: engCtx?.allowExec ?? false,
+                            cfg,
+                        };
+                        let verifyClient = taskClient;
+                        let verdict = await verifyTaskStructured(task, verifyClient, budget, state.usage, verifyOpts);
+                        emit(sink, { kind: 'verify', taskId: task.id, text: verdict.reason, data: verdict });
+                        let repair = 0;
+                        while (!verdict.ok && repair < maxRepairs && !overBudget(state.usage, budget)) {
+                            repair++;
+                            // M15: verify-failed escalation — may return a cloud route when
+                            // allowCloud + escalate.onFailure + key present; otherwise local.
+                            const { client: retryClient, decision: retryDecision } = await routeTask(task.goal, cfg, { allowCloud, attempt: repair + 1, lastReason: 'verify-failed' }, taskClient);
+                            const escalatingToCloud = retryDecision.tier === 'cloud' && retryClient.id === retryDecision.provider;
+                            verifyClient = retryClient;
                             emit(sink, {
                                 kind: 'retry',
                                 taskId: task.id,
                                 text: escalatingToCloud
-                                    ? `verify failed (${verdict.reason}) — escalating to cloud retry: ${verifyRetryDecision.provider}`
-                                    : `verify failed (${verdict.reason}) — retrying once`,
+                                    ? `verify failed (${verdict.reason}) — cloud repair ${repair}/${maxRepairs}: ${retryDecision.provider}`
+                                    : `verify failed (${verdict.reason}) — repair ${repair}/${maxRepairs}`,
                             });
+                            // Feed the concrete failure back to the same task (shared id keeps
+                            // persistence/onStep stable; the canonical goal stays in state).
+                            const repairGoal = `${task.goal}\n\n[VERIFY FAILED — repair ${repair}/${maxRepairs}]\n` +
+                                (verdict.command ? `Command: ${verdict.command}\n` : '') +
+                                (verdict.failure ? `Output:\n${verdict.failure}` : verdict.reason);
+                            const repairTask = { ...task, goal: repairGoal };
                             task.status = 'running';
                             task.result = undefined;
                             task.error = undefined;
-                            // Attribute cost to the ACTUAL serving client (never the intended
-                            // provider) so a local fallback stays $0.
-                            const verifyRetryOnStep = makeTaskOnStep(verifyRetryClient.id);
-                            await runTask(task, verifyRetryClient, {
+                            await runTask(repairTask, retryClient, {
                                 tools,
                                 budget,
                                 usage: state.usage,
                                 sink,
-                                onStep: verifyRetryOnStep,
+                                adaptivePrompts,
+                                onStep: makeTaskOnStep(retryClient.id),
                             });
-                            // Re-verify after the retry (best-effort; don't loop).
-                            // Cast through string: TS narrowed to 'running' after the assignment above,
-                            // but runTask mutates task.status in place so it may be 'done' now.
-                            if (task.status === 'done') {
-                                const verdict2 = await verifyTask(task, verifyRetryClient, budget, state.usage, {
-                                    model: verifyModel,
-                                });
-                                emit(sink, {
-                                    kind: 'verify',
-                                    taskId: task.id,
-                                    text: verdict2.reason,
-                                    data: verdict2,
-                                });
-                                if (!verdict2.ok) {
-                                    // Still failing: annotate result but keep status 'done'.
-                                    task.result = `[needs-attention: ${verdict2.reason}]\n${task.result ?? ''}`;
-                                }
-                            }
+                            // Copy the execution outcome back onto the canonical task.
+                            task.status = repairTask.status;
+                            task.result = repairTask.result;
+                            task.error = repairTask.error;
+                            task.usage = repairTask.usage;
+                            if (task.status !== 'done')
+                                break;
+                            verdict = await verifyTaskStructured(task, verifyClient, budget, state.usage, verifyOpts);
+                            emit(sink, { kind: 'verify', taskId: task.id, text: verdict.reason, data: verdict });
                         }
-                        else {
-                            // Budget exhausted: annotate but keep status 'done'.
+                        if (!verdict.ok && task.status === 'done') {
+                            // Still failing (or budget exhausted): annotate but keep 'done'.
                             task.result = `[needs-attention: ${verdict.reason}]\n${task.result ?? ''}`;
                         }
                     }
+                    // M15: latency-threshold escalation (cfg.models.escalate?.latencyMs).
+                    // Latency is tracked by checking whether the task took longer than
+                    // the configured threshold. We use task.usage.steps as a proxy:
+                    // if the task completed but the run-level elapsed since task-start
+                    // is not directly available here, we record the threshold check as
+                    // informational only — the latency escalation path is a stub that
+                    // emits a log event when cfg.models.escalate.latencyMs is set and
+                    // the task usage steps are unusually high (>= TASK_STEP_CAP / 2).
+                    // Full wall-clock latency tracking can be wired in a follow-up.
+                    if (task.status === 'done' &&
+                        allowCloud &&
+                        cfg.models.escalate?.latencyMs !== undefined &&
+                        (task.usage?.steps ?? 0) >= 10 // heuristic: many steps → slow task
+                    ) {
+                        emit(sink, {
+                            kind: 'log',
+                            taskId: task.id,
+                            text: `[M15] task completed with ${task.usage?.steps ?? 0} steps; latency threshold ${cfg.models.escalate.latencyMs}ms configured (cloud escalation on latency available when re-running with --allow-cloud)`,
+                        });
+                    }
+                    // M11: emit task-done (or failed) event.
+                    if (task.status === 'done') {
+                        emit(sink, { kind: 'task-done', taskId: task.id, text: task.goal });
+                    }
+                    else {
+                        emit(sink, {
+                            kind: 'log',
+                            taskId: task.id,
+                            text: `task ${task.id} ${task.status}: ${task.error ?? ''}`,
+                        });
+                    }
                 }
-                // M15: latency-threshold escalation (cfg.models.escalate?.latencyMs).
-                // Latency is tracked by checking whether the task took longer than
-                // the configured threshold. We use task.usage.steps as a proxy:
-                // if the task completed but the run-level elapsed since task-start
-                // is not directly available here, we record the threshold check as
-                // informational only — the latency escalation path is a stub that
-                // emits a log event when cfg.models.escalate.latencyMs is set and
-                // the task usage steps are unusually high (>= TASK_STEP_CAP / 2).
-                // Full wall-clock latency tracking can be wired in a follow-up.
-                if (task.status === 'done' &&
-                    allowCloud &&
-                    cfg.models.escalate?.latencyMs !== undefined &&
-                    (task.usage?.steps ?? 0) >= 10 // heuristic: many steps → slow task
-                ) {
-                    emit(sink, {
-                        kind: 'log',
-                        taskId: task.id,
-                        text: `[M15] task completed with ${task.usage?.steps ?? 0} steps; latency threshold ${cfg.models.escalate.latencyMs}ms configured (cloud escalation on latency available when re-running with --allow-cloud)`,
-                    });
-                }
-                // M11: emit task-done (or failed) event.
-                if (task.status === 'done') {
-                    emit(sink, { kind: 'task-done', taskId: task.id, text: task.goal });
+                catch (err) {
+                    // Defensive: runTask should handle its own errors, but catch any leak
+                    const msg = err instanceof Error ? err.message : String(err);
+                    task.status = 'failed';
+                    task.error = `Unexpected orchestrator error: ${msg}`;
+                    process.stderr.write(`[ashlr run] task ${task.id} crashed unexpectedly: ${msg}\n`);
                 }
-                else {
-                    emit(sink, {
-                        kind: 'log',
-                        taskId: task.id,
-                        text: `task ${task.id} ${task.status}: ${task.error ?? ''}`,
-                    });
+            }));
+            state.updatedAt = new Date().toISOString();
+            saveRun(state);
+            // Check budget after batch completes
+            if (overBudget(state.usage, budget)) {
+                aborted = true;
+                break;
+            }
+        }
+        // -- Abort: mark remaining pending/running tasks as aborted ------------------
+        if (aborted) {
+            for (const task of state.tasks) {
+                if (task.status === 'pending' || task.status === 'running') {
+                    task.status = 'failed';
+                    task.error = ABORT_TASK_ERROR;
                 }
             }
-            catch (err) {
-                // Defensive: runTask should handle its own errors, but catch any leak
-                const msg = err instanceof Error ? err.message : String(err);
-                task.status = 'failed';
-                task.error = `Unexpected orchestrator error: ${msg}`;
-                process.stderr.write(`[ashlr run] task ${task.id} crashed unexpectedly: ${msg}\n`);
+            state.status = 'aborted';
+            state.updatedAt = new Date().toISOString();
+            saveRun(state);
+            // M19: Emit telemetry (best-effort, opt-in). Awaited so the local sink is
+            // flushed before the process exits; bounded + fully caught, never throws.
+            await fireEmitRun(state, cfg);
+            // M16: Auto-capture on abort path (fire-and-forget).
+            const noCaptureAbort = opts.noCapture === true;
+            if (!noCaptureAbort) {
+                void (async () => {
+                    try {
+                        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+                        const capMod = await import('../genome/capture.js');
+                        if (typeof capMod.captureFromRun === 'function') {
+                            capMod.captureFromRun(state, cfg);
+                        }
+                    }
+                    catch {
+                        // Never surface capture errors to the caller.
+                    }
+                })();
             }
-        }));
-        state.updatedAt = new Date().toISOString();
+            return state;
+        }
+        // -- Synthesize final answer -------------------------------------------------
+        const synthStep = {
+            ts: new Date().toISOString(),
+            taskId: '__synthesize__',
+            kind: 'synthesize',
+            summary: 'Synthesizing final answer from task results',
+        };
+        state.steps.push(synthStep);
+        state.updatedAt = synthStep.ts;
         saveRun(state);
-        // Check budget after batch completes
+        // Budget guard for synthesis: if the run already hit the ceiling, do NOT
+        // spend another model call. Fall back to concatenating the completed task
+        // results so maxTokens stays a hard ceiling at the synthesis boundary too.
+        let synthResult;
+        let synthUsage;
         if (overBudget(state.usage, budget)) {
-            aborted = true;
-            break;
+            const doneTasks = state.tasks.filter((t) => t.status === 'done' && t.result);
+            synthResult =
+                doneTasks.length > 0
+                    ? doneTasks.map((t) => `[${t.id}] ${t.result ?? ''}`).join('\n')
+                    : 'No tasks completed successfully — no result to synthesize.';
+            synthUsage = { tokensIn: 0, tokensOut: 0 };
+            process.stderr.write(`[ashlr run] budget reached — skipping model synthesis, using concatenated task results\n`);
         }
-    }
-    // -- Abort: mark remaining pending/running tasks as aborted ------------------
-    if (aborted) {
-        for (const task of state.tasks) {
-            if (task.status === 'pending' || task.status === 'running') {
-                task.status = 'failed';
-                task.error = ABORT_TASK_ERROR;
-            }
+        else {
+            const synth = await synthesize(goal, state.tasks, client);
+            synthResult = synth.content;
+            synthUsage = synth.usage;
         }
-        state.status = 'aborted';
+        state.usage.tokensIn += synthUsage.tokensIn;
+        state.usage.tokensOut += synthUsage.tokensOut;
+        state.usage.steps += 1;
+        // Accumulate incrementally (price ONLY the synthesis tokens at the synthesis
+        // provider). Recomputing from cumulative totals at client.id here would CLOBBER
+        // the per-step mixed-provider cost already accumulated by the task loop —
+        // re-pricing earlier cloud-escalation tokens at the local run-level provider
+        // (erasing real spend) or vice-versa.
+        state.usage.estCostUsd += estCostUsd(client.id, synthUsage.tokensIn, synthUsage.tokensOut);
+        const synthDoneStep = {
+            ts: new Date().toISOString(),
+            taskId: '__synthesize__',
+            kind: 'synthesize',
+            summary: 'Synthesis complete',
+            usage: { tokensIn: synthUsage.tokensIn, tokensOut: synthUsage.tokensOut, steps: 1, estCostUsd: 0 },
+        };
+        state.steps.push(synthDoneStep);
+        cliOnStep?.(synthDoneStep, state.tasks);
+        state.result = synthResult;
+        // Determine final status
+        const failedCount = state.tasks.filter((t) => t.status === 'failed').length;
+        state.status = failedCount === state.tasks.length ? 'failed' : 'done';
         state.updatedAt = new Date().toISOString();
         saveRun(state);
-        // M19: Emit telemetry (best-effort, opt-in). Awaited so the local sink is
-        // flushed before the process exits; bounded + fully caught, never throws.
+        // -- M19: Emit telemetry (best-effort, opt-in) ------------------------------
+        // Awaited so the local sink is flushed before the process exits; bounded +
+        // fully caught, never throws.
         await fireEmitRun(state, cfg);
-        // M16: Auto-capture on abort path (fire-and-forget).
-        const noCaptureAbort = opts.noCapture === true;
-        if (!noCaptureAbort) {
+        // -- M16: Auto-capture (fire-and-forget, never throws, never blocks) ---------
+        // Read noCapture via extended property (same pattern as noMemory above).
+        const noCapture = opts.noCapture === true;
+        if (!noCapture) {
+            // Wrap in void + try to guarantee fire-and-forget with zero blocking.
             void (async () => {
                 try {
                     // eslint-disable-next-line @typescript-eslint/no-explicit-any
@@ -1383,82 +1588,9 @@ export async function runGoal(goal, cfg, opts) {
         }
         return state;
     }
-    // -- Synthesize final answer -------------------------------------------------
-    const synthStep = {
-        ts: new Date().toISOString(),
-        taskId: '__synthesize__',
-        kind: 'synthesize',
-        summary: 'Synthesizing final answer from task results',
-    };
-    state.steps.push(synthStep);
-    state.updatedAt = synthStep.ts;
-    saveRun(state);
-    // Budget guard for synthesis: if the run already hit the ceiling, do NOT
-    // spend another model call. Fall back to concatenating the completed task
-    // results so maxTokens stays a hard ceiling at the synthesis boundary too.
-    let synthResult;
-    let synthUsage;
-    if (overBudget(state.usage, budget)) {
-        const doneTasks = state.tasks.filter((t) => t.status === 'done' && t.result);
-        synthResult =
-            doneTasks.length > 0
-                ? doneTasks.map((t) => `[${t.id}] ${t.result ?? ''}`).join('\n')
-                : 'No tasks completed successfully — no result to synthesize.';
-        synthUsage = { tokensIn: 0, tokensOut: 0 };
-        process.stderr.write(`[ashlr run] budget reached — skipping model synthesis, using concatenated task results\n`);
-    }
-    else {
-        const synth = await synthesize(goal, state.tasks, client);
-        synthResult = synth.content;
-        synthUsage = synth.usage;
-    }
-    state.usage.tokensIn += synthUsage.tokensIn;
-    state.usage.tokensOut += synthUsage.tokensOut;
-    state.usage.steps += 1;
-    // Accumulate incrementally (price ONLY the synthesis tokens at the synthesis
-    // provider). Recomputing from cumulative totals at client.id here would CLOBBER
-    // the per-step mixed-provider cost already accumulated by the task loop —
-    // re-pricing earlier cloud-escalation tokens at the local run-level provider
-    // (erasing real spend) or vice-versa.
-    state.usage.estCostUsd += estCostUsd(client.id, synthUsage.tokensIn, synthUsage.tokensOut);
-    const synthDoneStep = {
-        ts: new Date().toISOString(),
-        taskId: '__synthesize__',
-        kind: 'synthesize',
-        summary: 'Synthesis complete',
-        usage: { tokensIn: synthUsage.tokensIn, tokensOut: synthUsage.tokensOut, steps: 1, estCostUsd: 0 },
-    };
-    state.steps.push(synthDoneStep);
-    cliOnStep?.(synthDoneStep, state.tasks);
-    state.result = synthResult;
-    // Determine final status
-    const failedCount = state.tasks.filter((t) => t.status === 'failed').length;
-    state.status = failedCount === state.tasks.length ? 'failed' : 'done';
-    state.updatedAt = new Date().toISOString();
-    saveRun(state);
-    // -- M19: Emit telemetry (best-effort, opt-in) ------------------------------
-    // Awaited so the local sink is flushed before the process exits; bounded +
-    // fully caught, never throws.
-    await fireEmitRun(state, cfg);
-    // -- M16: Auto-capture (fire-and-forget, never throws, never blocks) ---------
-    // Read noCapture via extended property (same pattern as noMemory above).
-    const noCapture = opts.noCapture === true;
-    if (!noCapture) {
-        // Wrap in void + try to guarantee fire-and-forget with zero blocking.
-        void (async () => {
-            try {
-                // eslint-disable-next-line @typescript-eslint/no-explicit-any
-                const capMod = await import('../genome/capture.js');
-                if (typeof capMod.captureFromRun === 'function') {
-                    capMod.captureFromRun(state, cfg);
-                }
-            }
-            catch {
-                // Never surface capture errors to the caller.
-            }
-        })();
+    finally {
+        finalizeEngineer();
     }
-    return state;
 }
 // ---------------------------------------------------------------------------
 // Gateway tool loading (optional)