@bongos/core 1.19.876 → 1.19.877

package/modules/hall-ui/public/gate.js

@@ -254,7 +254,7 @@
     const el = document.getElementById('fence-state');
     el.innerHTML = `
       <div class="ov-foot" style="display:flex;align-items:center;gap:12px;flex-wrap:wrap;">
-        <strong>${on ? 'Running' : 'Stopped'}</strong>
+        <span class="fact-pill ${on ? 'fact-pill--ok' : 'fact-pill--warn'}">${on ? 'Allowed to work' : 'Stopped'}</span>
         <span>${on ? 'The runner may claim and work allowlisted goals.' : escapeHtml(fence.paused_reason || 'The runner is doing nothing.')}</span>
         <button type="button" id="fence-toggle" class="btn">${on ? 'Stop the runner' : 'Start the runner'}</button>
       </div>`;
@@ -317,6 +317,54 @@
     }
   }
 
+  // The runner's liveness (task 1003905). Rendered ABOVE the switch on purpose:
+  // "is it running at all" is the first question, and an owner who has just
+  // flipped the switch on wants to see the machine notice.
+  //
+  // The verdict is the SERVER's — modules/autonomy/runner-health.js decides what
+  // dead means and the route attaches it — so this page and any future alert
+  // cannot drift into two definitions of the same word.
+  // This page's OWN class vocabulary (style.css `.fact-pill--{ok,warn,danger}`),
+  // the same one renderRow spends for a PR's verdict. The first cut reached for
+  // inline `--color-text-*` tokens from a different design system: they do not
+  // exist here, resolved to inherited grey, and drew a dead runner in exactly the
+  // same colour as a healthy one. Named classes cannot fail that way silently —
+  // a missing class is visible in the stylesheet, a missing var is not.
+  const HEALTH_CLASS = { alive: 'fact-pill--ok', late: 'fact-pill--warn', dead: 'fact-pill--danger', never_seen: 'fact-pill--info' };
+
+  async function loadRunners() {
+    const el = document.getElementById('fence-runner');
+    if (!el) return;
+    let resp;
+    try {
+      resp = await fetchJson('/autonomy/runners');
+    } catch (err) {
+      if (err && err.kind === '401') return;
+      el.innerHTML = emptyStateHtml('Could not read the runner\u2019s check-ins just now.');
+      return;
+    }
+    const runners = resp.runners || [];
+    if (!runners.length) {
+      // never_seen, and the server said so rather than this page guessing. Not an
+      // alarm: nobody has set the host up yet.
+      el.innerHTML = `<p class="ov-foot">${escapeHtml(resp.none ? resp.none.detail : 'No runner has ever checked in.')}</p>`;
+      return;
+    }
+    el.innerHTML = runners.map((r) => {
+      const h = r.health || {};
+      const cls = HEALTH_CLASS[h.state] || 'fact-pill--info';
+      // NOT the word "running": the switch below already uses it for a different
+      // thing (allowed to work), and the two lines sit one above the other. A
+      // reader should never have to work out which sense is meant.
+      const label = { dead: 'Not checking in', late: 'Quiet', alive: 'Checking in' }[h.state] || 'Unknown';
+      return `<p class="ov-foot" style="display:flex;align-items:baseline;gap:10px;flex-wrap:wrap;">
+        <span class="fact-pill ${cls}">${escapeHtml(label)}</span>
+        <span>${escapeHtml(h.detail || '')}</span>
+        <span class="ov-fact">last check-in ${escapeHtml(h.age || 'unknown')} ago</span>
+      </p>`;
+    }).join('');
+  }
+
   async function loadFence() {
     let fence;
     try {
@@ -356,7 +404,8 @@
     document.getElementById('gate-body').hidden = false;
     if (rank === 'archon') {
       document.getElementById('fence-panel').hidden = false;
-      await loadFence();
+      // Independent reads, so one round trip rather than two.
+      await Promise.all([loadRunners(), loadFence()]);
     }
     await load();
   }

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.876",
+  "version": "1.19.877",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.876",
+      "version": "1.19.877",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.876",
+  "version": "1.19.877",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/autobongos-run.js

@@ -6,8 +6,9 @@
 // one worker → record. No model anywhere in this file; every branch it takes is
 // a branch a person can read.
 //
-//   node scripts/gds/autobongos-run.js                           # every allowlisted goal
-//   node scripts/gds/autobongos-run.js --goal 1000119            # narrow to one of them
+//   node scripts/gds/autobongos-run.js --forever                 # the daemon shape
+//   node scripts/gds/autobongos-run.js                           # one task, then exit
+//   node scripts/gds/autobongos-run.js --goal 1000119            # narrow to one goal
 //   node scripts/gds/autobongos-run.js --max-tasks 5
 //   node scripts/gds/autobongos-run.js --dry-run                 # pick only, claim nothing
 //
@@ -22,13 +23,19 @@
 //     1003903), called at step 6. A worker's `shipped` is a CLAIM — recorded here
 //     as `claims_shipped` so nothing can mistake it for a fact — and the ledger
 //     read is what turns it into one, or into a released claim and a blocker.
-//   · BACKOFF and never-terminally-stopping is task 1003904. This exits after
-//     its budget; it does not yet decide when to come back.
+//   · IT NEVER TERMINALLY STOPS (task 1003904, ADR 0307 §5). `--forever` runs the
+//     cadence state machine in modules/autonomy/cadence.js: three straight
+//     failures drop to `probing` — no new work, a growing wait, then exactly one
+//     task — and one success returns it to full speed. Nothing exits the loop,
+//     not even the kill switch, because a machine nobody is watching must not be
+//     able to look idle while it is dead. On boot it reconciles every claim a
+//     previous run left behind.
 
 const { execFile, spawn } = require('node:child_process');
 const fs = require('node:fs');
 const path = require('node:path');
 const crypto = require('node:crypto');
+const os = require('node:os');
 
 const seq = require('./sequence.js');
 const gauge = require('./autonomy-gauge.js');
@@ -42,11 +49,12 @@ const fence = require('../../modules/autonomy/fence.js');
 // where it would not be inside modules/ — which is exactly why fence.js takes the
 // hits as an argument instead of matching them itself.
 const { matchProtected } = require('../../src/bongos/permission-path-check');
+const cadence = require('../../modules/autonomy/cadence.js');
 
 const REPO_ROOT = path.resolve(__dirname, '..', '..');
 
 function readArgv(argv) {
-  const out = { goals: [], maxTasks: 1, dryRun: false, json: false, model: DEFAULT_MODEL, timeoutMs: DEFAULT_WORKER_TIMEOUT_MS };
+  const out = { goals: [], maxTasks: 1, dryRun: false, json: false, forever: false, maxLoops: Infinity, model: DEFAULT_MODEL, timeoutMs: DEFAULT_WORKER_TIMEOUT_MS };
   for (let i = 0; i < argv.length; i++) {
     const a = argv[i];
     if (a === '--goal') { out.goals.push(Number(argv[++i])); continue; }
@@ -56,6 +64,12 @@ function readArgv(argv) {
     if (a === '--timeout-min') { out.timeoutMs = Number(argv[++i]) * 60_000; continue; }
     if (a === '--dry-run') { out.dryRun = true; continue; }
     if (a === '--json') { out.json = true; continue; }
+    // --forever is the DAEMON shape: never returns, decides its own speed.
+    if (a === '--forever') { out.forever = true; continue; }
+    // --max-loops bounds the forever loop. It exists so a test (and an operator
+    // trying the thing out) can run the machine to completion; production passes
+    // it never, and Infinity is the honest default.
+    if (a === '--max-loops') { out.maxLoops = Number(argv[++i]); continue; }
   }
   if (!out.goals.length && process.env.AUTOBONGOS_GOALS) {
     out.goals = String(process.env.AUTOBONGOS_GOALS).split(',').map((g) => Number(g.trim())).filter(Boolean);
@@ -111,6 +125,12 @@ async function pickTask(goals, deps = {}) {
   }
   const claimableIds = await seq.fetchClaimableIds(api);
 
+  // The skipped lists from EVERY goal are kept, not just the last one. An empty
+  // queue and a queue where every task halts both yield no task, and telling them
+  // apart is the whole of `unworkable_queue` (task 1003904): calling the second
+  // one "idle" is how a goal full of blocked work sits for a week with the runner
+  // reporting itself perfectly healthy.
+  const allSkipped = [];
   for (const goalId of goals) {
     let byId;
     try { byId = await seq.fetchGoalTasks(api, goalId, seq.GOAL_PAGE); }
@@ -120,8 +140,9 @@ async function pickTask(goals, deps = {}) {
     const { order } = seq.topoOrder(candidates);
     const { next, skipped } = seq.pickNext(order, { rank, claimableIds });
     if (next) return { task: next, goalId, skipped };
+    for (const sk of skipped) allSkipped.push({ ...sk, goal_id: goalId });
   }
-  return { none: true };
+  return { none: true, skipped: allSkipped };
 }
 
 // WORKER_ENV_ALLOW — what a worker is allowed to inherit (grader finding, task
@@ -277,7 +298,14 @@ async function iteration(opts, deps = {}) {
   // for. gate.goals is already the intersection.
   const picked = await pick(gate.goals, deps.pickDeps || {});
   if (picked.error) return log({ event: 'pick_failed', reason: picked.error });
-  if (picked.none) return log({ event: 'nothing_claimable', goals: opts.goals });
+  if (picked.none) {
+    return log({
+      event: 'nothing_claimable', goals: gate.goals,
+      // Carried so the cadence can tell an EMPTY queue from one where every task
+      // halts — the reasons are the matrix's own codes, safe to print.
+      skipped: (picked.skipped || []).map((sk) => ({ id: sk.id, goal_id: sk.goal_id, reasons: (sk.reasons || []).map((r) => r.code) })),
+    });
+  }
   const task = picked.task;
 
   // 2b. The per-TASK half of the fence. sequence.js's halt matrix already refuses
@@ -364,19 +392,343 @@ async function iteration(opts, deps = {}) {
   return log(row);
 }
 
+// ---------------------------------------------------------------------------
+// Boot recovery, and the forever loop (task 1003904, ADR 0307 §5)
+// ---------------------------------------------------------------------------
+
+// reconcileLeftoverClaims — the FIRST thing a run does.
+//
+// "A silently locked task is the worst outcome this loop can produce" is the
+// task's own wording, and cutting power mid-task is exactly how it happens: the
+// claim is held by a session that no longer exists anywhere, and nothing times it
+// out. So before taking any new work, every claim a previous run left behind is
+// read back from the ledger and resolved.
+//
+// The reconciliation is autobongos-verify.js, unchanged (task 1003903). That file
+// already answers "did this actually ship, and if not what do I do about it" for
+// a worker that just exited; a worker that exited three days ago in a power cut
+// is the same question with a longer gap. Writing a second, subtly different
+// answer here is how two code paths end up disagreeing about what `confirmed`
+// means.
+//
+// ONLY TREES THE RUNNER ITSELF MADE, matched against the EXACT shape
+// worktreeName() produces — not a loose prefix.
+//
+// FOUND THE HARD WAY, twice. `autobongos-` as a prefix reads as "ours", and it is
+// not: a person naming a worktree `autobongos-resume-1003904-d29f25` while
+// working on this very feature matched it, and reconciliation released their live
+// claim out from under them. A human at a keyboard picks readable names; the
+// runner picks `autobongos-<task id>-<6 hex>` and nothing else. Matching the
+// generator's own shape is the difference between "probably ours" and "ours".
+//
+// Derived FROM worktreeName so the two cannot drift: change the name format and
+// this regex is what stops the next reconciliation from quietly matching nothing.
+const CLAIM_PREFIX = 'autobongos-';
+const RUNNER_TREE_RE = /^autobongos-\d+-[0-9a-f]{6}$/;
+const isRunnerTree = (name) => RUNNER_TREE_RE.test(String(name || ''));
+
+// ── the heartbeat, and why reconciliation needs one ──────────────────────────
+//
+// FOUND BY RUNNING IT. The first live run of reconcileLeftoverClaims released a
+// claim that was very much alive — the one held by the session writing this code.
+// It was right by its own rules (an `autobongos-` tree, a task sitting at
+// `active`), and that is the problem: THE LEDGER CANNOT TELL A LIVE RUN FROM A
+// DEAD ONE. Both look like a held claim. A reconciler that guesses wrong in one
+// direction leaves a task locked forever; in the other it yanks a claim out from
+// under a worker mid-build and strands whatever it had committed.
+//
+// So the runner says, on disk, that it is alive. A heartbeat file carries the pid
+// and a timestamp; reconciliation refuses to touch anything while one is FRESH
+// and its pid still exists. Both halves are needed — a stale file from a power
+// cut must not veto recovery forever, and a fresh file whose process is gone is
+// just litter. This is also what stops two runners on one machine from fighting
+// over each other's claims.
+const HEARTBEAT_STALE_MS = 10 * 60 * 1000;
+
+function heartbeatPath() {
+  if (process.env.AUTOBONGOS_HEARTBEAT_FILE) return process.env.AUTOBONGOS_HEARTBEAT_FILE;
+  try { return require('../../src/instance-config.js').configPath('autobongos-heartbeat.json'); }
+  catch (_) { return path.join(REPO_ROOT, '.autobongos-heartbeat.json'); }
+}
+
+// Best-effort in both directions: a runner that cannot write its heartbeat must
+// still run (it only loses the guard), and one that cannot read it must assume
+// nothing is alive — the file's absence is the common case, on every first boot.
+//
+// DO NOT point AUTOBONGOS_HEARTBEAT_FILE UNDER /proc TO TEST THE FAILURE PATH (task
+// 1004052). The mkdirSync below is recursive, and on Linux a recursive mkdir under
+// /proc never returns — measured 10s+ with no result, where the same call throws
+// EACCES instantly under /sys or /, and the NON-recursive form throws ENOENT instantly
+// under /proc itself. macOS has no /proc, so it fails fast there. A test that used it
+// was green on every developer machine and hung the Ubuntu CI runner for 90s with no
+// output, reddening `unit` on main and blocking every PR. Use a regular FILE as the
+// parent directory instead: mkdir under it is ENOTDIR immediately, everywhere, and it
+// does not depend on the caller's permissions.
+function writeHeartbeat(now = Date.now()) {
+  try {
+    const p = heartbeatPath();
+    fs.mkdirSync(path.dirname(p), { recursive: true });
+    fs.writeFileSync(p, JSON.stringify({ pid: process.pid, at: now }));
+    return true;
+  } catch (_) { return false; }
+}
+
+// postHeartbeat — tell the SERVER we are alive (task 1003905).
+//
+// The file above guards against two runners on this machine; this is the half an
+// owner can see from a web page in another country. Both matter and neither
+// replaces the other: a file is unreadable on exactly the day the machine is off.
+//
+// FAILS SILENTLY, ON PURPOSE. A runner that cannot check in must keep working —
+// letting the watching mechanism take down the thing it watches is a strictly
+// worse outcome than a gap in the log. The gap reports itself anyway: the hall
+// reads the AGE of the last check-in, so a failed post shows up as silence, which
+// is the signal.
+const RUNNER_STARTED_AT = new Date().toISOString();
+
+async function postHeartbeat(fields = {}, deps = {}) {
+  try {
+    const api = deps.api || await (require('./cli-lib').cliClient)();
+    await api.autonomy.postAutonomyHeartbeat({
+      body: {
+        host: os.hostname(),
+        pid: process.pid,
+        started_at: RUNNER_STARTED_AT,
+        ...fields,
+      },
+    });
+    return true;
+  } catch (_) { return false; }
+}
+
+function readHeartbeat() {
+  try { return JSON.parse(fs.readFileSync(heartbeatPath(), 'utf8')); }
+  catch (_) { return null; }
+}
+
+// pidAlive — `kill(pid, 0)` signals nothing and throws ESRCH when the process is
+// gone. EPERM means it exists and belongs to someone else, which still counts as
+// alive: the question is "is something running", not "is it mine".
+function pidAlive(pid) {
+  if (!Number.isInteger(pid) || pid <= 0) return false;
+  try { process.kill(pid, 0); return true; }
+  catch (e) { return e && e.code === 'EPERM'; }
+}
+
+// anotherRunnerIsAlive — the veto. Fresh file AND a live pid AND not us.
+function anotherRunnerIsAlive({ now = Date.now(), hb = readHeartbeat() } = {}) {
+  if (!hb || !Number.isFinite(Number(hb.at))) return false;
+  if (Number(hb.pid) === process.pid) return false;         // our own beat
+  if (now - Number(hb.at) > HEARTBEAT_STALE_MS) return false;  // a power cut leaves a stale file
+  return pidAlive(Number(hb.pid));
+}
+
+async function reconcileLeftoverClaims(deps = {}) {
+  const api = deps.api || await (require('./cli-lib').cliClient)();
+  const log = deps.record || record;
+  const verify = deps.verifyShip || verifyShip;
+  const runCmd = deps.run || run;
+  const isAlive = deps.anotherRunnerIsAlive || anotherRunnerIsAlive;
+
+  // Refuse outright while another runner is beating. Releasing a claim a live
+  // worker is building against strands whatever it has committed — the same harm
+  // as leaving one locked, pointed the other way.
+  if (isAlive()) return log({ event: 'boot_reconcile', ok: true, skipped: 'another runner is alive', leftover: null });
+
+  let claims = [];
+  try {
+    const me = await api.me.getMe();
+    if (!me || !me.ok) return log({ event: 'boot_reconcile', ok: false, reason: `GET /me → ${me ? me.status : 'no response'}` });
+    claims = (me.data.active_claims || []).filter((c) => isRunnerTree(c.worktree_name));
+  } catch (e) {
+    // Unreadable is NOT "nothing to reconcile". Say so and let the cadence treat
+    // it as a failure, rather than starting work on top of an unknown lock.
+    return log({ event: 'boot_reconcile', ok: false, reason: e && e.message ? e.message : String(e) });
+  }
+
+  if (!claims.length) return log({ event: 'boot_reconcile', ok: true, leftover: 0 });
+
+  const resolved = [];
+  for (const c of claims) {
+    const wtPath = path.join(REPO_ROOT, '.claude', 'worktrees', c.worktree_name);
+    const out = await verify(
+      { taskId: c.task_id, taskTitle: c.title, worker: { outcome: 'interrupted', reason: 'a previous run did not finish this claim' } },
+      {
+        api,
+        // The tree may be gone — a power cut leaves the claim, not necessarily the
+        // checkout. verifyShip only uses cwd for the artifact probe, which degrades
+        // to `checked: false` rather than failing, so a missing path is survivable.
+        cwd: fs.existsSync(wtPath) ? wtPath : REPO_ROOT,
+        release: (id, reason) => runCmd(process.execPath,
+          [path.join(REPO_ROOT, 'scripts', 'gds', 'release.js'), String(id), '--reason', reason],
+          { cwd: fs.existsSync(wtPath) ? wtPath : REPO_ROOT }),
+      },
+    );
+    resolved.push({ task_id: String(c.task_id), worktree: c.worktree_name, shape: out.shape, released: !!out.released, blocker_id: out.blocker?.blockerId ?? null });
+  }
+  return log({ event: 'boot_reconcile', ok: true, leftover: claims.length, resolved });
+}
+
+// pollSignals — the cheap facts whose change makes waiting pointless.
+//
+// Three reads, all small, all failing SILENTLY to null. A failed probe is not a
+// signal: treating it as one would turn an unreachable instance into a busy loop
+// hammering it, which is the exact opposite of backing off.
+async function pollSignals(deps = {}) {
+  const api = deps.api || await (require('./cli-lib').cliClient)();
+  let head = null; let fenceUpdatedAt = null; let claimableCount = null;
+  try {
+    const r = await runFetchHead(deps);
+    if (r) head = r;
+  } catch (_) { /* null */ }
+  try {
+    const f = await api.autonomy.getAutonomyFence();
+    if (f && f.ok) fenceUpdatedAt = f.data.updated_at || null;
+  } catch (_) { /* null */ }
+  try {
+    const ids = await seq.fetchClaimableIds(api);
+    if (ids) claimableCount = ids.size;
+  } catch (_) { /* null */ }
+  return cadence.signalFingerprint({ head, fenceUpdatedAt, claimableCount });
+}
+
+// The head of origin/main, or null. `git ls-remote` rather than `fetch`: it moves
+// no refs and writes nothing, so polling it every few minutes cannot interfere
+// with a worker building in a tree beside it.
+async function runFetchHead(deps = {}) {
+  const runCmd = deps.run || run;
+  const r = await runCmd('git', ['ls-remote', 'origin', 'refs/heads/main']);
+  if (!r.ok) return null;
+  const m = /^([0-9a-f]{40})/.exec(String(r.stdout).trim());
+  return m ? m[1] : null;
+}
+
+// waitOrJump — sleep, but wake early if the world moved.
+//
+// Polls at most every `pollEveryS`, so a thirty-minute backoff costs six cheap
+// probes rather than a spin. `sleep` is injected so a test can drive an hour of
+// wall clock in a millisecond.
+async function waitOrJump(waitS, deps = {}, cfg = {}) {
+  if (!(waitS > 0)) return { waited: 0, jumped: false };
+  const pollEveryS = cfg.pollEveryS ?? 60;
+  const sleep = deps.sleep || ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const poll = deps.pollSignals || pollSignals;
+
+  const before = await poll(deps);
+  let waited = 0;
+  while (waited < waitS) {
+    const chunk = Math.min(pollEveryS, waitS - waited);
+    await sleep(chunk * 1000);
+    waited += chunk;
+    // Beat DURING the wait. A thirty-minute backoff is the runner working exactly
+    // as designed, and it must not be indistinguishable from a machine that fell
+    // over at the start of it.
+    if (deps.beat) { try { await deps.beat({ last_event: 'waiting' }); } catch (_) { /* never break a wait */ } }
+    if (waited >= waitS) break;
+    const now = await poll(deps);
+    if (cadence.shouldJumpWait(before, now)) return { waited, jumped: true, signal: now };
+  }
+  return { waited, jumped: false };
+}
+
+// forever — the loop that has no terminal stop (task 1003904, ADR 0307 §5).
+//
+// It is a `while (true)` on purpose and the exceptions are the interesting part:
+// NOTHING in here returns. Not an unreachable instance, not an expired token, not
+// the kill switch. The only exits are a signal from the operating system and
+// `--max-loops`, which exists so a test can run the machine to completion.
+//
+// What varies is the SPEED, and the speed is decided entirely by
+// modules/autonomy/cadence.js from the row the last iteration recorded. This
+// function holds no policy — it turns a `waitS` into a wait and a `takeWork` into
+// an iteration, so the rules stay somewhere a test can reach without a clock.
+async function forever(opts, deps = {}) {
+  const log = deps.record || record;
+  const iterate = deps.iteration || iteration;
+  const reconcile = deps.reconcileLeftoverClaims || reconcileLeftoverClaims;
+  const wait = deps.waitOrJump || waitOrJump;
+  const emit = deps.emit || ((row) => {
+    if (opts.json) console.log(JSON.stringify(row));
+    else console.log(`${row.event}${row.task_id ? ` task ${row.task_id}` : ''}${row.outcome ? ` → ${row.outcome}` : ''}${row.reason ? `: ${row.reason}` : ''}`);
+  });
+
+  // Claim the machine BEFORE reconciling: a second runner starting a moment later
+  // must see this one alive rather than deciding its claims are litter.
+  // Both halves of "I am alive": the local file (which stops a second runner
+  // treating this one's claims as litter) and the server row (which is the only
+  // one an owner can see from anywhere else).
+  const beatFile = deps.writeHeartbeat || writeHeartbeat;
+  const beatServer = deps.postHeartbeat || postHeartbeat;
+  // WRAPPED AT THE CALL SITE, not just inside postHeartbeat. The guarantee is
+  // "reporting that I am alive can never be what kills me", and that has to hold
+  // for whatever beat implementation is in play — a future one, an injected one —
+  // not only for the well-behaved default. Letting the watching mechanism take
+  // down the thing it watches is strictly worse than a gap in the log, and the gap
+  // reports itself anyway: the hall reads the AGE of the last check-in, so a
+  // failed beat shows up as silence, which is the signal.
+  const beat = async (fields) => {
+    try { beatFile(); } catch (_) { /* a runner that cannot write its file still runs */ }
+    try { await beatServer(fields, deps); } catch (_) { /* and one that cannot reach the instance still runs */ }
+  };
+  await beat({ last_event: 'boot' });
+
+  // BEFORE ANY WORK. A claim left locked by a previous run is the worst thing
+  // this loop produces, and taking new work on top of one compounds it.
+  emit(await reconcile(deps));
+
+  let state = { ...cadence.START };
+  const maxLoops = Number.isFinite(Number(opts.maxLoops)) ? Number(opts.maxLoops) : Infinity;
+
+  for (let loop = 0; loop < maxLoops; loop++) {
+    // Every loop, so a crash leaves a heartbeat that goes stale on its own — the
+    // runner never has to notice it is dying for its death to become visible.
+    await beat({ mode: state.mode, consecutive_failures: state.consecutiveFailures, last_event: 'loop' });
+    // In `probing` the runner takes exactly ONE task and only after its wait, so
+    // a broken window costs a handful of cheap requests rather than a night of
+    // failing spawns. `maxTasks` still bounds a full-speed burst.
+    const budget = state.mode === 'probing' ? 1 : opts.maxTasks;
+    let row = null;
+
+    for (let i = 0; i < budget; i++) {
+      row = await iterate(opts, deps);
+      emit(row);
+      // Carry the task id so the hall can tell "quiet because it is building
+      // task 1234" from "quiet because it is dead". A worker may hold the loop for
+      // ninety minutes, and without this every honest hour of work looks like a
+      // corpse.
+      await beat({ mode: state.mode, last_event: row.event, working_task_id: Number(row.task_id) || undefined });
+      const seen = cadence.classifyEvent(row);
+      state = cadence.nextCadence(state, seen, opts.cadence);
+      log({ event: 'cadence', mode: state.mode, consecutive_failures: state.consecutiveFailures, wait_s: state.waitS, class: seen.class, why: state.why });
+      // A burst continues only while work is actually landing. Anything else ends
+      // the burst and hands the decision to the cadence, which is the only thing
+      // allowed to say how long to wait.
+      if (seen.class !== 'progress') break;
+    }
+
+    const { waited, jumped } = await wait(state.waitS, { ...deps, beat }, opts.cadence);
+    if (jumped) log({ event: 'cadence', mode: state.mode, jumped: true, waited_s: waited, why: 'a new signal arrived — main moved, the fence changed, or the queue did' });
+  }
+  return 0;
+}
+
 async function main(argv) {
   const opts = readArgv(argv);
   // No "name a goal" refusal here any more. It used to be the only allowlist, and
   // it lived on the machine being fenced; the database owns that now, and an empty
   // `--goal` means "every allowlisted goal" rather than "anything claimable". The
   // refusal did not disappear — it moved somewhere the runner host cannot edit.
+  if (opts.forever) return forever(opts);
+
+  // The one-shot path, kept for an operator running a single task by hand. It
+  // still reconciles first: a leftover claim is a leftover claim whoever is
+  // watching.
+  const boot = await reconcileLeftoverClaims();
+  if (opts.json) console.log(JSON.stringify(boot));
   for (let i = 0; i < opts.maxTasks; i++) {
     const row = await iteration(opts);
     if (opts.json) console.log(JSON.stringify(row));
     else console.log(`${row.event}${row.task_id ? ` task ${row.task_id}` : ''}${row.outcome ? ` → ${row.outcome}` : ''}${row.reason ? `: ${row.reason}` : ''}`);
-    // Anything that is not a completed piece of work ends this run — including
-    // `verify_halt`, which is the ledger being unreadable. Deciding when to come
-    // back is task 1003904's job, not this one's.
     if (row.event !== 'worked') break;
   }
   return 0;
@@ -389,4 +741,9 @@ if (require.main === module) {
   });
 }
 
-module.exports = { readArgv, pickTask, iteration, record, logPath, spawnWorker, workerEnv, WORKER_ENV_ALLOW, worktreeName, readFence };
+module.exports = {
+  readArgv, pickTask, iteration, record, logPath, spawnWorker, workerEnv, WORKER_ENV_ALLOW,
+  worktreeName, readFence, reconcileLeftoverClaims, pollSignals, waitOrJump, forever, CLAIM_PREFIX,
+  heartbeatPath, writeHeartbeat, readHeartbeat, pidAlive, anotherRunnerIsAlive, HEARTBEAT_STALE_MS,
+  isRunnerTree, RUNNER_TREE_RE, postHeartbeat, RUNNER_STARTED_AT,
+};

package/scripts/gds/autobongos-service.cmd

@@ -0,0 +1,38 @@
+@echo off
+REM scripts/gds/autobongos-service.cmd -- what the scheduled task actually runs
+REM (task 1003905). A .cmd, not a direct node invocation, for three reasons the
+REM scheduler cannot do itself.
+REM
+REM 1. THE CHECKOUT IS BROUGHT CURRENT FIRST. A runner pinned to whatever was on
+REM    disk the day it was installed drifts silently, and the first symptom is
+REM    workers building against a stale fence. `git fetch` + `reset --hard` on the
+REM    MAIN checkout only -- worker trees are separate worktrees and are never
+REM    touched here.
+REM 2. OUTPUT IS APPENDED TO ONE FILE the owner can read remotely. The scheduler
+REM    keeps only an exit code, which cannot answer "what was it doing".
+REM 3. A NON-ZERO EXIT IS RETURNED so the scheduler's restart rule can see it.
+REM
+REM The runner itself never exits on failure (task 1003904) -- it backs off and
+REM probes -- so reaching the end of this file at all means something the inner
+REM loop could not survive.
+
+setlocal
+set "REPO=%~dp0..\.."
+set "LOGDIR=%LOCALAPPDATA%\cloudbongos"
+set "LOG=%LOGDIR%\autobongos.log"
+if not exist "%LOGDIR%" mkdir "%LOGDIR%"
+
+cd /d "%REPO%" || exit /b 1
+
+echo. >> "%LOG%"
+echo ==== autobongos starting %DATE% %TIME% ==== >> "%LOG%"
+
+REM Best effort: a fetch that fails must not stop the runner from starting on the
+REM code it already has. Being a commit behind beats not running at all.
+git fetch --quiet origin main >> "%LOG%" 2>&1
+git reset --quiet --hard origin/main >> "%LOG%" 2>&1
+
+node scripts\gds\autobongos-run.js --forever --json >> "%LOG%" 2>&1
+set EXITCODE=%ERRORLEVEL%
+echo ==== autobongos exited %EXITCODE% at %DATE% %TIME% ==== >> "%LOG%"
+exit /b %EXITCODE%