@ashlr/hub 3.2.6 → 3.3.0

package/dist/core/daemon/loop.js

@@ -45,14 +45,14 @@ import { loadQueuedAutonomyItems } from '../portfolio/queued-autonomy.js';
 import { acquireDaemonLock, accountDaemonSpendGuard, armDaemonSpendGuard, clearDaemonSpendGuard, DAEMON_SPEND_GUARD_ITEM_CAPACITY, daemonStatePath, loadDaemonState, loadDaemonStateStrict, readDaemonLockOwner, readDaemonSpendGuard, releaseDaemonLock, resetDayIfNeeded, saveDaemonStateResult, upgradeLegacyDaemonSpendGuard, } from './state.js';
 import { acquireLocalStoreLock, releaseLocalStoreLock, } from '../fleet/local-store-lock.js';
 import { readDaemonActivity, writeDaemonActivity, } from './activity.js';
-import { consumeDaemonActivationPermit, isDaemonActivationCapability, } from './activation-permit.js';
+import { consumeDaemonActivationPermit, daemonActivationScopeGranted, isDaemonActivationCapability, } from './activation-permit.js';
 import { nullSink } from '../run/streaming.js';
 import { createOuterAttemptIdentity } from '../fleet/attempt-identity.js';
 import { runSwarm } from '../swarm/runner.js';
 import { runGoal } from '../run/orchestrator.js';
 import { scopeFromWorkItem } from '../run/delegation-scope.js';
 import { generatedRepairCandidateAllowed, generatedRepairExecutionBackendAllowed, inspectGeneratedRepairRouteFeasibility, routeBackend, } from '../fleet/router.js';
-import { withinLimit, recordUse } from '../fleet/quota.js';
+import { recordUse, reserveFleetQuotaUse, reserveFleetQuotaUses, withinLimit, } from '../fleet/quota.js';
 import { engineTierOf } from '../run/sandboxed-engine.js';
 import { resolveEngineSpec } from '../run/engine-registry.js';
 import { subscriptionAllows, isSubscriptionEngine } from '../fleet/subscription-usage.js'; // M80
@@ -93,7 +93,7 @@ import { observeShadowSkills } from '../fleet/skill-shadow-observer.js';
 import { selectWorkQueueCoordinator } from '../seams/work-queue-coordinator.js';
 // M220: verdict-feedback sweep — feed judge rejections back to the ledger so
 // re-clogging items (e.g. "CI is failing") are suppressed for the cooldown window.
-import { GENERATED_REPAIR_DISPATCH_BLOCKED_COOLDOWN_MS, latestWorkedEventForKeys, recordOutcome as recordWorkedOutcome, sweepJudgedProposals, workedEventIsCooling, } from '../fleet/worked-ledger.js';
+import { DEFAULT_MAX_REJECTION_ATTEMPTS, GENERATED_REPAIR_DISPATCH_BLOCKED_COOLDOWN_MS, latestWorkedEventForKeys, recordOutcome as recordWorkedOutcome, rejectionAttemptCount, sweepJudgedProposals, workedEventIsCooling, } from '../fleet/worked-ledger.js';
 import { blockingPendingProposalsForBacklog, pendingProposalItemKeysForBacklog, workItemCoverageKey, } from '../fleet/proposal-matching.js';
 import { loadConfig } from '../config.js';
 import { hostname as osHostname } from 'node:os';
@@ -727,6 +727,13 @@ function generatedRepairShouldSkip(workedEvents, policy) {
     const latest = latestWorkedEventForKeys(workedEvents, policy.itemIds);
     if (!latest)
         return false;
+    // Attempt cap: cooldown alone only delays a retry — after enough windows
+    // elapse the same rejected item comes back forever. Once it has racked up
+    // DEFAULT_MAX_REJECTION_ATTEMPTS real judge rejections, park it instead of
+    // continuing to re-dispatch (see workItemAttemptCapExceeded/summarizeSelectionBlockers
+    // for the operator-visible counter).
+    if (workItemAttemptCapExceeded(workedEvents, policy))
+        return true;
     const override = policy.outcomeCooldownMs?.[latest.outcome];
     if (override !== undefined) {
         const eventMs = Date.parse(latest.ts);
@@ -734,6 +741,16 @@ function generatedRepairShouldSkip(workedEvents, policy) {
     }
     return workedEventIsCooling(latest, policy.cooldownMs);
 }
+/**
+ * True once a work item has racked up DEFAULT_MAX_REJECTION_ATTEMPTS real
+ * judge rejections (judged-review/judged-noise/judged-decline). Distinct
+ * from the time-based cooldown: cooldown expires and the item comes back;
+ * an exceeded attempt cap parks the item for good (until something resets
+ * its worked-event history, e.g. the item is meaningfully re-authored).
+ */
+function workItemAttemptCapExceeded(workedEvents, policy) {
+    return rejectionAttemptCount(workedEvents, policy.itemIds) >= DEFAULT_MAX_REJECTION_ATTEMPTS;
+}
 const RESOURCE_SNAPSHOT_MAX_AGE_MS = 30_000;
 const GENERATED_REPAIR_EMPTY_FAST_COOLDOWN_MS = 30 * 60 * 1000;
 const MAX_GENERATED_REPAIR_DECISION_EVENTS = 20;
@@ -779,6 +796,26 @@ const LOCAL_ONLY_BACKENDS = new Set(['builtin', 'local-coder', 'ashlrcode', 'aw'
 const DRAIN_MODE_TAG_PREFIX = 'drain:';
 const MAX_DRAIN_SELECTED_IDS = 12;
 const MAX_DIAGNOSTIC_RESLICE_DRAIN_LIMIT = 50;
+/**
+ * M470: the exact authority the pre-M470 boolean capability check conveyed.
+ *
+ * Declared here rather than imported from activation-permit.js on purpose:
+ * several suites mock that module wholesale, and importing a *value* from it
+ * would throw at module load under those mocks. The explicit type annotation
+ * still makes tsc fail if `DaemonActivationGrantScope` ever gains a key, so
+ * this cannot silently drift into granting more than it should.
+ */
+const LEGACY_PROPOSAL_ONLY_SCOPE = Object.freeze({
+    once: true,
+    resident: false,
+    residentStanding: false,
+    conductor: false,
+    automerge: false,
+    repair: false,
+    deploy: false,
+    install: false,
+    proposalOnly: true,
+});
 /** Schedule advisory post-state work only after a durable resident tick returns. */
 export function scheduleResolutionObserverAfterTick(tickResult, opts, schedule = scheduleResolutionObserverChild, killIsOn = killSwitchOn) {
     if (opts.dryRun || opts.once || tickResult.reason === 'state-persistence-failed' ||
@@ -1573,7 +1610,8 @@ function recordQueueSelectionAgentAction(fields) {
         action: 'daemon:selection',
         summary: `${lane}: claimed ${fields.claimedItems.length}/${fields.selectedItems.length} ` +
             `from ${fields.eligibleItems}/${fields.backlogItems} eligible; ` +
-            `cooldown ${fields.cooldownBlocked}, pending ${fields.pendingBlocked}, route ${fields.routeBlocked}`,
+            `cooldown ${fields.cooldownBlocked}, pending ${fields.pendingBlocked}, route ${fields.routeBlocked}` +
+            (fields.attemptCapBlocked > 0 ? `, attempt-cap-parked ${fields.attemptCapBlocked}` : ''),
         reason: fields.dryRun ? 'dry-run' : fields.claimedItems.length > 0 ? 'selected' : 'no-claim',
         ...(first?.repo ? { repo: first.repo } : {}),
         ...(first?.id ? { itemId: boundedText(first.id, 120) } : {}),
@@ -1593,6 +1631,7 @@ function recordQueueSelectionAgentAction(fields) {
             cooldownBlocked: fields.cooldownBlocked,
             routeBlocked: fields.routeBlocked,
             fastRepairCooldown: fields.fastRepairCooldown,
+            attemptCapBlocked: fields.attemptCapBlocked,
             rawSelectCount: fields.rawSelectCount,
             selectCount: fields.selectCount,
             selected: fields.selectedItems.length,
@@ -1820,6 +1859,10 @@ function noProposalProductionReason(production) {
     return boundedText(productionReason(production), 160);
 }
 function noProposalOutcomeFromReason(reason) {
+    if (/\bquota-reservation-refused\b/i.test(reason))
+        return 'gate-blocked';
+    if (/\b(provider-dispatch|candidate configuration refused)\b/i.test(reason))
+        return 'gate-blocked';
     if (/\bempty[- ]diff\b/i.test(reason))
         return 'empty-diff';
     if (/\b(trivial-proposal|trivial|completeness-gate|gate-blocked|gate)\b/i.test(reason))
@@ -1855,6 +1898,24 @@ function bestOfNCandidateProduction(candidate, authority) {
         ...(metadata?.diffFiles !== undefined ? { diffFiles: metadata.diffFiles } : {}),
         ...(metadata?.diffLines !== undefined ? { diffLines: metadata.diffLines } : {}),
     };
+    if (candidate.quotaReservation && !candidate.quotaReservation.launchAuthorized) {
+        return {
+            production: {
+                outcome: 'gate-blocked',
+                reason: `quota reservation refused: ${candidate.quotaReservation.kind}`,
+                ...diff,
+            },
+        };
+    }
+    if (candidate.providerDispatchAttempted === false && candidate.error) {
+        return {
+            production: {
+                outcome: noProposalOutcomeFromReason(candidate.error),
+                reason: candidate.error,
+                ...diff,
+            },
+        };
+    }
     switch (candidate.proposalDisposition?.kind) {
         case 'verification-rejected':
             return {
@@ -1992,6 +2053,8 @@ function bestOfNAuthoritativeNoWinnerProduction(result, n, runId, costUsd, autho
         }
         if (error &&
             error !== 'cancelled' &&
+            candidate.providerDispatchAttempted !== false &&
+            candidate.quotaReservation?.launchAuthorized !== false &&
             !candidateErrorDuplicatesProposalOutcome(error, candidate.proposalOutcome)) {
             addAuthority({ outcome: 'engine-failed', reason: error }, `error:${error}`);
         }
@@ -2817,7 +2880,21 @@ function claimCooldownPolicyForSelectionItem(item, baseCooldownMs, repairRecover
  */
 export async function tick(cfg, opts) {
     const now = new Date().toISOString();
-    const activationAccepted = !opts.dryRun && isDaemonActivationCapability(opts.activationCapability);
+    // A pre-verified scope (resident path) is accepted WITHOUT consuming, since
+    // runDaemon already consumed the capability once on entry. Otherwise fall back
+    // to consuming the capability here, which is the one-shot path.
+    const preVerifiedScope = !opts.dryRun ? opts.activationScope : undefined;
+    const consumedCapability = !opts.dryRun && preVerifiedScope === undefined
+        ? isDaemonActivationCapability(opts.activationCapability)
+        : false;
+    // When the capability check passes but no scope object is readable (a caller
+    // or test that supplies only the claim), fall back to the legacy proposal-only
+    // scope — the exact authority the pre-M470 boolean check conveyed. Never widen.
+    const activationScope = preVerifiedScope
+        ?? (consumedCapability
+            ? (opts.activationCapability?.scope ?? LEGACY_PROPOSAL_ONLY_SCOPE)
+            : undefined);
+    const activationAccepted = !opts.dryRun && activationScope !== undefined;
     if (!opts.dryRun && !activationAccepted) {
         persistAudit({
             action: 'daemon:activation-refused',
@@ -2834,7 +2911,52 @@ export async function tick(cfg, opts) {
             reason: 'activation-refused',
         };
     }
-    const proposalOnlyActivation = activationAccepted && opts.activationCapability !== undefined;
+    // A standing `residentStanding` grant is NOT single-use, unlike the
+    // one-shot WeakMap capability that forces `preVerifiedScope` to be trusted
+    // for the run's whole lifetime (see the TickOptions.activationScope doc).
+    // That means it CAN be safely re-checked on every tick with no consumption
+    // side effect — so a resident daemon that started off a standing grant
+    // gets a real "stop the next tick" guarantee from `ashlr activation
+    // revoke --grant <id>`, not just "blocks the next `daemon start`." This is
+    // strictly stronger than what the one-shot capability path can offer; it
+    // cannot interrupt a tick already in flight.
+    if (!opts.dryRun && preVerifiedScope?.residentStanding === true) {
+        const stillGranted = daemonActivationScopeGranted('residentStanding');
+        if (!stillGranted.granted) {
+            persistAudit({
+                action: 'daemon:activation-refused',
+                repo: null,
+                sandboxId: null,
+                summary: `live tick refused: resident standing grant no longer authorized: ${stillGranted.reason}`,
+                result: 'refused',
+            });
+            return {
+                ts: now,
+                itemsConsidered: 0,
+                proposalsCreated: 0,
+                spentUsd: 0,
+                reason: 'activation-refused',
+            };
+        }
+    }
+    // M470: proposal-only is derived from the GRANTED scope rather than from "an
+    // activation exists at all" — the previous form forced every authorized tick
+    // to proposal-only, so an automerge/repair/deploy grant could never take
+    // effect.
+    //
+    // The `grantedScope` distinction matters: the pre-M470 condition was
+    // `opts.activationCapability !== undefined`, i.e. it keyed off a real permit
+    // object being supplied, NOT off the boolean claim. Callers that pass only a
+    // claim (and the legacy fallback above) must keep the old
+    // `proposalOnlyActivation === false` behavior, otherwise
+    // runAncillaryMaintenance — which early-returns on proposal-only — silently
+    // stops running self-heal, invent, and drain.
+    const grantedScope = preVerifiedScope ?? opts.activationCapability?.scope;
+    const proposalOnlyActivation = activationAccepted &&
+        grantedScope !== undefined &&
+        !grantedScope.automerge &&
+        !grantedScope.repair &&
+        !grantedScope.deploy;
     let ownershipLost = false;
     const stillOwnsTick = () => {
         if (!opts.ownerLock)
@@ -3410,6 +3532,42 @@ export async function tick(cfg, opts) {
                 console.warn('[ashlr] daemon:tick outcomeWatcher failed:', err?.message ?? err);
             }
         }
+        // M505: Learning-loop sweeps. Each of these was previously unreachable in a
+        // live tick — rejection learning sat behind `autoMerge.enabled`, post-merge
+        // credit was a stubbed `false`, and reflection was a manual CLI command — so
+        // the fleet observed every run and learned from none of them.
+        if (!stopRequested() && liveCfg.foundry?.['selfImprove'] !== false) {
+            try {
+                const { sweepRejectionLearning } = await import('../fleet/self-improve.js');
+                sweepRejectionLearning(liveCfg);
+            }
+            catch (err) {
+                console.warn('[ashlr] daemon:tick sweepRejectionLearning failed:', err?.message ?? err);
+            }
+        }
+        // Credit is released only by the M505 protocol's own fail-closed checks
+        // (authenticated merge witness, 14-day quiet window, no adverse observation
+        // on the exact event, healthy ledger read). This call only drives the sweep.
+        if (!stopRequested()) {
+            try {
+                const { sweepPostMergeCreditReleases } = await import('../fleet/post-merge-credit.js');
+                sweepPostMergeCreditReleases();
+            }
+            catch (err) {
+                console.warn('[ashlr] daemon:tick sweepPostMergeCreditReleases failed:', err?.message ?? err);
+            }
+        }
+        // Low cadence, matching the counterfactual-replay pattern above: reflection
+        // persists a snapshot and distills playbooks, and does not need every tick.
+        if (!stopRequested() && state.ticks.length % 20 === 0) {
+            try {
+                const { runReflectionCycle } = await import('../learn/reflect.js');
+                await runReflectionCycle(liveCfg);
+            }
+            catch (err) {
+                console.warn('[ashlr] daemon:tick runReflectionCycle failed:', err?.message ?? err);
+            }
+        }
         // M189: Regression sentinel — detect regressions introduced by auto-merge and bisect/revert.
         const regressionSentinel = liveCfg.foundry?.regressionSentinel;
         if (!stopRequested() &&
@@ -4194,11 +4352,19 @@ export async function tick(cfg, opts) {
         let cooldownBlocked = 0;
         let routeBlocked = 0;
         let fastRepairCooldown = 0;
+        let attemptCapBlocked = 0;
         for (const item of items) {
             const pending = pendingItemKeys.has(workItemCoverageKey(item));
             const itemPolicy = claimCooldownPolicies.get(item.id);
             const itemCooldownMs = cooldownMsForSelectionItem(selectionWorkedEvents, itemPolicy);
             const cooling = generatedRepairShouldSkip(selectionWorkedEvents, itemPolicy);
+            // Attempt-cap-parked items are already folded into `cooling` (they
+            // must never be dispatched), but they get their own counter so an
+            // operator can tell "will retry after cooldown" apart from "parked
+            // for good — rejected too many times" instead of it being silently
+            // indistinguishable in the tick summary.
+            if (cooling && workItemAttemptCapExceeded(selectionWorkedEvents, itemPolicy))
+                attemptCapBlocked++;
             if (pending)
                 pendingBlocked++;
             if (cooling)
@@ -4214,7 +4380,7 @@ export async function tick(cfg, opts) {
                 fastRepairCooldown++;
             }
         }
-        return { eligibleItems, pendingBlocked, cooldownBlocked, routeBlocked, fastRepairCooldown };
+        return { eligibleItems, pendingBlocked, cooldownBlocked, routeBlocked, fastRepairCooldown, attemptCapBlocked };
     };
     const selectRoundRobinCandidates = (items, count) => {
         // Group selectable items by repo (score-sorted within each group by buildBacklog).
@@ -4414,6 +4580,7 @@ export async function tick(cfg, opts) {
         cooldownBlocked: selectionBlockers.cooldownBlocked,
         routeBlocked: selectionBlockers.routeBlocked,
         fastRepairCooldown: selectionBlockers.fastRepairCooldown,
+        attemptCapBlocked: selectionBlockers.attemptCapBlocked,
         rawSelectCount: selectionTelemetryRawSelectCount,
         selectCount: selectionTelemetrySelectCount,
         selectedItems: selected,
@@ -4755,6 +4922,33 @@ export async function tick(cfg, opts) {
                 skipReason: 'queue-lease-lost',
             }),
         });
+        const quotaRefusalOutcome = (item, attemptId, backend, quota) => {
+            const evidence = [
+                typeof quota.used === 'number' ? `used=${quota.used}` : null,
+                typeof quota.limit === 'number' ? `limit=${quota.limit}` : null,
+                quota.reservationConsumed === true ? 'reservation-consumed=true' : null,
+            ].filter((value) => value !== null).join(', ');
+            const detail = evidence ? `${quota.kind} (${evidence})` : quota.kind;
+            return {
+                item,
+                spentUsd: 0,
+                dispatched: false,
+                dispatch: dispatchTrace(item, {
+                    backend,
+                    tier: engineTierOf(backend, routingCfg),
+                    assignedBy: 'quota-reservation',
+                    reason: `provider dispatch refused by durable quota authority: ${detail}`,
+                    dispatched: false,
+                    runId: attemptId,
+                    trajectoryId: `run:${attemptId}`,
+                    skipReason: `quota-${quota.kind}`,
+                    production: {
+                        outcome: 'gate-blocked',
+                        reason: `quota reservation refused: ${detail}`,
+                    },
+                }),
+            };
+        };
         const tasks = workedSet.map((item, _taskIdx) => {
             const attemptId = attemptIds.get(item.id);
             const leaseController = leaseAbortControllers.get(item.id);
@@ -5520,6 +5714,8 @@ export async function tick(cfg, opts) {
                                 }
                             }
                             let bonBillable = null;
+                            let bonLaunchMarked = false;
+                            let bonDispatchStarted = false;
                             let runState;
                             if (fanOut) {
                                 // Route through runBestOfN; use its winner's underlying runState.
@@ -5531,16 +5727,6 @@ export async function tick(cfg, opts) {
                                     if (!stillOwnsTick())
                                         throw new Error('daemon lock ownership lost before best-of-n launch');
                                     beginQueueExecution();
-                                    recordUse(backend);
-                                    recordDispatchStartAgentAction(item, {
-                                        ts: new Date().toISOString(), machineId, runId: attemptId, backend: backend,
-                                        tier: backendTier, model: selectedModel, assignedBy, reason: assignmentReason, mode: 'best-of-n',
-                                    });
-                                    if (!stillOwnsTick())
-                                        throw new Error('daemon lock ownership lost before best-of-n producer start');
-                                    if (!markGeneratedRepairExecutionLaunched(item)) {
-                                        throw new Error('generated repair launch reservation could not be persisted');
-                                    }
                                     return runBestOfN(item, routingCfg, {
                                         n: bestOfN, engine: backend, model: selectedModel,
                                         budget: itemBudget,
@@ -5549,13 +5735,40 @@ export async function tick(cfg, opts) {
                                         workItemId: item.id, workItemGenerationId, workSource: item.source,
                                         delegationScope, attemptId, shadowSkillCards, shadowSkillSelectedAt,
                                         signal: dispatchSignal,
+                                        reserveQuotaUses: (requests) => reserveFleetQuotaUses(requests, routingCfg),
+                                        providerDispatchStillAuthorized: () => stillOwnsTick() && !stopRequested() && !dispatchSignal.aborted,
+                                        beforeCandidateProviderDispatch: () => {
+                                            if (!stillOwnsTick() || stopRequested() || dispatchSignal.aborted)
+                                                return false;
+                                            if (!bonLaunchMarked) {
+                                                if (!markGeneratedRepairExecutionLaunched(item))
+                                                    return false;
+                                                bonLaunchMarked = true;
+                                            }
+                                            return stillOwnsTick() && !stopRequested() && !dispatchSignal.aborted;
+                                        },
+                                        onProviderDispatchStarted: (candidateBackend) => {
+                                            if (!bonDispatchStarted) {
+                                                recordDispatchStartAgentAction(item, {
+                                                    ts: new Date().toISOString(), machineId, runId: attemptId, backend: backend,
+                                                    tier: backendTier, model: selectedModel, assignedBy,
+                                                    reason: assignmentReason, mode: 'best-of-n',
+                                                });
+                                                bonDispatchStarted = true;
+                                            }
+                                            recordUse(candidateBackend);
+                                        },
                                     });
                                 });
                                 if (!launch.authorized)
                                     return authorityUnavailableOutcome(item, attemptId);
-                                dispatched = true;
-                                backendDispatch[backend] = (backendDispatch[backend] ?? 0) + 1;
                                 const bonResult = await launch.value;
+                                const attemptedCandidates = bonResult.candidates.filter((candidate) => candidate.providerDispatchAttempted === true);
+                                dispatched = attemptedCandidates.length > 0;
+                                for (const candidate of attemptedCandidates) {
+                                    const candidateBackend = candidate.engine ?? backend;
+                                    backendDispatch[candidateBackend] = (backendDispatch[candidateBackend] ?? 0) + 1;
+                                }
                                 bonBillable = bonResult.critique.billableCostUsd ?? 0;
                                 if (!stillOwnsTick()) {
                                     swarmSpent = bonBillable;
@@ -5563,14 +5776,14 @@ export async function tick(cfg, opts) {
                                     return {
                                         item,
                                         spentUsd: swarmSpent,
-                                        dispatched: true,
+                                        dispatched,
                                         dispatch: dispatchTrace(item, {
                                             backend,
                                             tier: backendTier,
                                             model: selectedModel,
                                             assignedBy,
                                             reason: assignmentReason,
-                                            dispatched: true,
+                                            dispatched,
                                             spentUsd: swarmSpent,
                                             runId: attemptId,
                                             trajectoryId: `run:${attemptId}`,
@@ -5594,6 +5807,10 @@ export async function tick(cfg, opts) {
                                         : shadowOnly
                                             ? bestOfNShadowOnlyProduction(bestOfN)
                                             : bestOfNNoWinnerProduction(bestOfN));
+                                    const quotaRefusal = bonResult.candidates.find((candidate) => candidate.quotaReservation && !candidate.quotaReservation.launchAuthorized)?.quotaReservation;
+                                    if (!dispatched && quotaRefusal?.launchAuthorized === false) {
+                                        return quotaRefusalOutcome(item, attemptId, quotaRefusal.backend ?? backend, quotaRefusal);
+                                    }
                                     audit({
                                         action: 'daemon:no-proposal',
                                         repo: item.repo,
@@ -5604,14 +5821,14 @@ export async function tick(cfg, opts) {
                                     return {
                                         item,
                                         spentUsd: swarmSpent,
-                                        dispatched: true,
+                                        dispatched,
                                         dispatch: dispatchTrace(item, {
                                             backend,
                                             tier: backendTier,
                                             model: selectedModel,
                                             assignedBy,
                                             reason: `${assignmentReason}; best-of-${bestOfN}: all candidates empty`,
-                                            dispatched: true,
+                                            dispatched,
                                             spentUsd: swarmSpent,
                                             runId: attemptId,
                                             trajectoryId: `run:${attemptId}`,
@@ -5633,7 +5850,10 @@ export async function tick(cfg, opts) {
                                     if (!stillOwnsTick())
                                         throw new Error('daemon lock ownership lost before direct launch');
                                     beginQueueExecution();
-                                    recordUse(backend);
+                                    const quota = reserveFleetQuotaUse(backend, routingCfg, attemptId);
+                                    if (!quota.launchAuthorized) {
+                                        return { kind: 'quota-refused', quota };
+                                    }
                                     recordDispatchStartAgentAction(item, {
                                         ts: new Date().toISOString(), machineId, runId: attemptId, backend: backend,
                                         tier: backendTier, model: selectedModel, assignedBy, reason: assignmentReason, mode: 'single',
@@ -5643,19 +5863,24 @@ export async function tick(cfg, opts) {
                                     if (!markGeneratedRepairExecutionLaunched(item)) {
                                         throw new Error('generated repair launch reservation could not be persisted');
                                     }
-                                    return runGoal(goal, dispatchCfg, {
+                                    const run = runGoal(goal, dispatchCfg, {
                                         engine: backend, sandboxEngine: true, requireSandbox: true, cwd: item.repo,
                                         budget: itemBudget, tools: true, noMemory: false, runId: attemptId,
                                         ...(selectedModel ? { model: selectedModel } : {}),
                                         workItemId: item.id, workItemGenerationId, workSource: item.source, delegationScope,
                                         signal: dispatchSignal,
                                     });
+                                    recordUse(backend);
+                                    return { kind: 'started', run };
                                 });
                                 if (!launch.authorized)
                                     return authorityUnavailableOutcome(item, attemptId);
+                                if (launch.value.kind === 'quota-refused') {
+                                    return quotaRefusalOutcome(item, attemptId, backend, launch.value.quota);
+                                }
                                 dispatched = true;
                                 backendDispatch[backend] = (backendDispatch[backend] ?? 0) + 1;
-                                runState = await launch.value;
+                                runState = await launch.value.run;
                                 if (!stillOwnsTick()) {
                                     swarmSpent = isSubscriptionEngine(backend ?? 'builtin') ? 0 : (runState.usage?.estCostUsd ?? 0);
                                     tickSpent += swarmSpent;
@@ -7036,6 +7261,20 @@ export async function runDaemon(cfg, opts) {
     process.env['ASHLR_IN_DAEMON'] = '1';
     const activationCfg = activation.configSnapshot ?? cfg;
     const dcfg = resolveCfg(activationCfg);
+    // M470: verify the capability EXACTLY ONCE, here, and carry the resulting
+    // scope into every tick. isDaemonActivationCapability() consumes on first
+    // call, so verifying per-tick would authorize only the first resident tick
+    // and refuse all subsequent ones. Entering the loop is the authorized act;
+    // each tick then reads the scope as plain data.
+    //
+    // `activation.scope` is the standing-`residentStanding`-grant path
+    // (consumeDaemonActivationPermit tried it first): no WeakMap capability
+    // exists for it at all, since standing grants aren't single-use — tick()
+    // re-checks it live every cycle instead (see its `residentStanding` guard).
+    const runActivationScope = activation.scope
+        ?? (!opts.dryRun && activation.capability && isDaemonActivationCapability(activation.capability)
+            ? activation.capability.scope
+            : undefined);
     // -------------------------------------------------------------------------
     // Mark daemon as running.
     // -------------------------------------------------------------------------
@@ -7144,10 +7383,18 @@ export async function runDaemon(cfg, opts) {
         sandboxId: null,
         summary: `daemon started: once=${opts.once}, dryRun=${opts.dryRun}, budget=$${dcfg.dailyBudgetUsd}, ` +
             `intervalMs=${dcfg.intervalMs}${opts.drain ? `, drain=${opts.drain}` : ''}` +
-            `${opts.drainLimit ? `, drainLimit=${opts.drainLimit}` : ''}`,
+            `${opts.drainLimit ? `, drainLimit=${opts.drainLimit}` : ''}` +
+            `${activation.grantId ? `, activatedByStandingGrant=${activation.grantId}` : ''}`,
         result: 'ok',
     });
-    if (!opts.dryRun && !activation.capability) {
+    // `!activation.scope` preserves this exactly as it behaved before the
+    // standing-grant path existed: a live (non-dry-run) authorized start always
+    // has EITHER `activation.capability` (one-shot path) OR `activation.scope`
+    // (standing-grant path) set, so this was — and remains — unreachable on any
+    // real authorized run. Written this way rather than changed so the
+    // standing-grant path doesn't silently start exercising a branch nothing
+    // has exercised live before.
+    if (!opts.dryRun && !activation.capability && !activation.scope) {
         reconcilePreparedGeneratedRepairReservations();
     }
     // -------------------------------------------------------------------------
@@ -7242,7 +7489,7 @@ export async function runDaemon(cfg, opts) {
                 transitionActivity('tick');
                 const tickResult = await tick(liveCfg, {
                     dryRun: opts.dryRun,
-                    ...(activation.capability ? { activationCapability: activation.capability } : {}),
+                    ...(runActivationScope ? { activationScope: runActivationScope } : {}),
                     ...(opts.drain ? { drain: opts.drain } : {}),
                     ...(opts.drainLimit ? { drainLimit: opts.drainLimit } : {}),
                     signal: shutdown.signal,
@@ -7295,6 +7542,10 @@ export async function runDaemon(cfg, opts) {
                 transitionActivity('tick');
                 const tickResult = await tick(liveCfg, {
                     dryRun: opts.dryRun,
+                    // M470: the resident loop previously passed NO activation at all, so
+                    // every live resident tick was refused. It now carries the scope
+                    // verified once at runDaemon entry.
+                    ...(runActivationScope ? { activationScope: runActivationScope } : {}),
                     ...(opts.drain ? { drain: opts.drain } : {}),
                     ...(opts.drainLimit ? { drainLimit: opts.drainLimit } : {}),
                     signal: shutdown.signal,
@@ -7590,6 +7841,20 @@ export function buildItemGoal(item) {
         '(e.g. a platform-gated or intentionally-skipped test, an issue requiring ' +
         'product decisions, or already done), make NO changes and stop — ' +
         'do not force an edit.');
+    // M507: completion contract — derived from real inbox data showing the two
+    // most common ways an otherwise-reasonable run still gets rejected: (1) the
+    // engine "fixes" a narrow task by deleting/regenerating an entire file (seen
+    // repeatedly on dependency bumps that wiped package.json instead of editing
+    // one version string — judged 'harmful' every time), and (2) a run hits its
+    // budget mid-task and files a half-finished '[partial]' diff that fails
+    // verification and is auto-drained after retries. Neither failure mode is
+    // fixed by a more lenient judge — both are avoidable at generation time.
+    parts.push('Do not delete, regenerate, or wholesale-rewrite a file to make this change — ' +
+        'edit only what the task requires. A diff that removes unrelated dependencies, ' +
+        'scripts, or content is treated as destructive and rejected outright, even when ' +
+        'the stated intent was minor. If you cannot produce a complete diff that passes ' +
+        'this repo’s tests, typecheck, and lint within the available budget, produce NO ' +
+        'diff and stop — a filed partial/unverified change is worse than no proposal.');
     return parts.join('\n\n');
 }
 //# sourceMappingURL=loop.js.map