@bridge_gpt/mcp-server 0.2.65 → 0.2.67

package/build/executor/job-runner.js

@@ -17,7 +17,7 @@
 import { rm, readdir, lstat, unlink } from "node:fs/promises";
 import os from "node:os";
 import { runHeartbeatLoop } from "./heartbeat.js";
-import { isExecutorNamedError, toExecutorFailure, RebaseNotVerified, secretFreeErrorMessage, MissingVerdictArtifact, PreSpawnVerification, RequiredMcpRegistration, McpSurfaceMismatch, WorkerStartupFatal, WORKER_STARTUP_FATAL_MESSAGE, formatMcpSurfaceMismatch, ClaudeNotAuthenticated, CLAUDE_NOT_AUTHENTICATED_MESSAGE, ExecutorAdapterUnavailable, ExecutorNamedError, WorktreeBusy, StaleArtifactCleanupFailed, CiFixContext, WORKTREE_BUSY_MESSAGE, WorkerEnvFilePresent, WORKER_ENV_FILE_PRESENT_MESSAGE, } from "./job-errors.js";
+import { isExecutorNamedError, toExecutorFailure, RebaseNotVerified, secretFreeErrorMessage, MissingVerdictArtifact, PreSpawnVerification, RequiredMcpRegistration, McpSurfaceMismatch, WorkerStartupFatal, WORKER_STARTUP_FATAL_MESSAGE, WorkerEndedWithPendingBackgroundWork, WORKER_ENDED_WITH_PENDING_BACKGROUND_WORK_MESSAGE, formatMcpSurfaceMismatch, ClaudeNotAuthenticated, CLAUDE_NOT_AUTHENTICATED_MESSAGE, ExecutorAdapterUnavailable, ExecutorNamedError, WorktreeBusy, StaleArtifactCleanupFailed, CiFixContext, WORKTREE_BUSY_MESSAGE, WorkerEnvFilePresent, WORKER_ENV_FILE_PRESENT_MESSAGE, } from "./job-errors.js";
 import { buildConductorMergeAccessForExecutorJob, buildDefaultMergeLocalDeps, runExecutorMergeJob, MERGE_RETRYABLE, MERGE_FAILED, } from "./merge-job.js";
 import { createProductionCiRerunDeps, runCiRerunJob, } from "./ci-rerun-job.js";
 import { createObservationState } from "./observation.js";
@@ -26,13 +26,13 @@ import { resolveExecutorAgentAdapter } from "../agent-launchers/executor-adapter
 import { redactAdapterDiagnostic } from "../agent-launchers/executor-adapter.js";
 import { resolveExecutorAgentId } from "./agent-identity.js";
 import { closeStdinBounded, createProcessTerminationController, runProcessWithTimeout, writeStdinBounded, } from "./process.js";
-import { buildNotLaunchedEnvelope, claimRequiresCompletionEvidence, SUPPORTED_COMPLETION_RUNTIME, COMPLETION_CONTRACT_MARKER_VALUES, isCoveredJobType, MAX_EVENT_BYTES, runtimeMatchesSupported, successRefusalReason, verificationVerdictFromFacts, } from "./completion-contract.js";
+import { buildNotLaunchedEnvelope, claimRequiresCompletionEvidence, COMPLETION_CONTRACT_MARKER_VALUES, isCoveredJobType, MAX_EVENT_BYTES, runtimeMatchesSupported, successRefusalReason, verificationVerdictFromFacts, } from "./completion-contract.js";
 import { COMPLETION_CAUSE_ERROR_KINDS, EOF_DRAIN_BOUND_MS, finalizationFacts, finalizationObligations, planCompletionAllowance, readCompletionBinding, readDeclaredChecks, readOptionalWatchers, readRequiredVerification, } from "./completion-supervision.js";
 import { compareFinalArtifact, createRequiredVerificationRunner, createSupervisedCommandLauncher, observeFinalArtifact, OWNERSHIP_POLL_MS, preCheckArtifactState, toCompletionCheckFact, } from "./required-verification.js";
 import { createClosureSupervisor, createRequiredWorkLedger } from "./required-work-ledger.js";
 import { buildCleanupVerdict, CLEANUP_RESIDUALS_NOT_COVERED, createDefaultOwnershipRecordFs, createDescendantTracker, createMacProcessInspector, createOwnershipToken, hostIdentityDigest, ownershipTokenDigest, removeOwnershipRecord, runOwnedProcessSweep, withOwnershipTag, writeOwnershipRecord, } from "./process-containment.js";
 import { resolveCompletionEvidenceCapability } from "../agent-launchers/executor-adapter.js";
-import { prepareResumeSpawn, prepareRetainedContinuationWorktree, readContinuationBinding, } from "./resume-pre-spawn.js";
+import { autoCheckpointDirtyState, PRIOR_ATTEMPT_WIP_COMMIT_MESSAGE, prepareResumeSpawn, prepareRetainedContinuationWorktree, readContinuationBinding, verifyContinuationHeadLineage, } from "./resume-pre-spawn.js";
 import { ciFixContextError, readCiFixDispatchContext, renderPromptSpecPrompt, } from "./prompt-spec.js";
 import { defaultResolveBinPath } from "../start-tickets-conductor.js";
 /** The packaged bin basename of the deterministic worker guard (BAPI-1020). */
@@ -42,7 +42,7 @@ import { sendTerminalMutationWithRetry } from "./terminal-mutation.js";
 import { removeStaleVerdictArtifacts } from "./stale-artifacts.js";
 import { stripWorkerEnvFiles } from "./env-file-guard.js";
 import { isVerdictJobType, readVerdictArtifact } from "./verdict-artifact.js";
-import { createWorkerLogTee, closeWorkerLogTee, distinctWorkerLogSessionIds, formatWorkerLogSessionInvariantWarning, teeAsyncIterable, } from "./worker-log.js";
+import { createWorkerLogClaimId, createWorkerLogTee, closeWorkerLogTee, distinctWorkerLogSessionIds, formatWorkerLogSessionInvariantWarning, teeAsyncIterable, } from "./worker-log.js";
 import { acquireExecutorWorktreeLock, } from "./worktree-lock.js";
 import { resolveExecutorStateDir, activateJobLog, deactivateJobLog, registerExecutorJobLog, markExecutorJobLogFinished, } from "./job-log-registry.js";
 import { executorViewerTabsEnabled, openExecutorViewerTab } from "./viewer-tabs.js";
@@ -56,8 +56,10 @@ import { FOCUSED_REBASE_JOB_TYPE, focusedRebaseContextError, hasFocusedRebaseCon
 import { ensureExecutorWorktree, finalizeRetainedExecutorWorktree, } from "./worktree.js";
 import { buildPrBaseContractLaunchInstruction } from "../pr-base-contract.js";
 import { CI_FIX_JOB_TYPE, resolveExecutorPrompt, resolveWorkerPermissionPosture, } from "./worker-command.js";
+import { CORRECTION_INTENT_CAPABILITY, isRemainingWork, validateCorrectionIntent, } from "./correction-dispatch.js";
 import { collectGitTelemetry, collectRemoteTrackingSha, createMcpSurfaceObserver, evaluatePreSpawnGitVerification, formatWorkerRateLimitAdvisory, normalizeMcpServerNames, } from "./observation.js";
 import { TERMINAL_CAPACITY_PROTOCOL_VERSIONS, TERMINAL_CAPACITY_RUNTIME_CONTRACTS, TERMINAL_CAPACITY_RUNTIMES, } from "./types.js";
+import { probeInstalledCorrectionHook } from "./preflight.js";
 import { isRecognizedServerName, MCP_SERVER_NAME } from "../mcp-identity.js";
 /**
  * Bound on the pre-spawn git tracked-file lookup (BAPI-1104, R81).
@@ -174,6 +176,9 @@ function buildJobLogRegistryDeps(deps) {
         env: deps.env,
         tmpdir: () => os.tmpdir(),
         platform: deps.platform,
+        // BAPI-1330: atomic temp-file + rename replacement when the host has it.
+        ...(deps.rename ? { rename: deps.rename } : {}),
+        errorLog: deps.errorLog,
     };
 }
 /**
@@ -535,6 +540,46 @@ function createNoopProcess(deps, durationMs, message) {
         },
     };
 }
+/**
+ * Bounded newline assembly of worker stdout into whole lines for a
+ * {@link RequiredWorkLedger} (BAPI-1301 covered path, BAPI-1364 legacy
+ * observation). A line that outgrows the event bound is handed over once (the
+ * ledger marks it `stream_oversize`) and the rest of it is discarded up to its
+ * newline. `onLine` runs after each completed line is ingested.
+ */
+function createLedgerLineFeeder(ledger, onLine) {
+    let lineBuffer = "";
+    let discardingOversize = false;
+    return {
+        feed: (chunk) => {
+            lineBuffer += chunk;
+            let newline;
+            while ((newline = lineBuffer.indexOf("\n")) >= 0) {
+                const line = lineBuffer.slice(0, newline);
+                lineBuffer = lineBuffer.slice(newline + 1);
+                if (discardingOversize) {
+                    discardingOversize = false;
+                    continue;
+                }
+                ledger.ingestLine(line);
+                onLine?.();
+            }
+            if (!discardingOversize && lineBuffer.length > MAX_EVENT_BYTES) {
+                ledger.ingestLine(lineBuffer);
+                lineBuffer = "";
+                discardingOversize = true;
+            }
+            else if (discardingOversize) {
+                lineBuffer = "";
+            }
+        },
+        flush: () => {
+            if (!discardingOversize && lineBuffer.length > 0)
+                ledger.ingestLine(lineBuffer);
+            lineBuffer = "";
+        },
+    };
+}
 /**
  * Run the process and heartbeat loop concurrently; return the process outcome.
  *
@@ -564,7 +609,10 @@ async function superviseProcess(params) {
         ...(params.terminationController
             ? { terminationController: params.terminationController }
             : {}),
-        onStdout: (chunk) => params.observation.recordStdout(chunk),
+        onStdout: (chunk) => {
+            params.observation.recordStdout(chunk);
+            params.onStdoutObserved?.(chunk);
+        },
         ...(mcpSurface
             ? {
                 onStdoutTerminationCheck: (chunk) => {
@@ -651,6 +699,23 @@ async function sendTerminalMutationWithAuthReport(params, job, control) {
  * `/executor/jobs`. Integration actions are NOT ordinary executor jobs.
  */
 export async function runIntegrationCorrectionSpawn(job, httpClient, options, deps, driver, seams = {}, control) {
+    const validated = validateCorrectionIntent(job.payload?.correction_intent, {
+        repo_name: job.repo_name,
+        epic_run_id: job.epic_run_id ?? null,
+        ticket_key: job.ticket_key ?? null,
+        expected_branch: job.expected_branch,
+        expected_head_sha: job.expected_head_sha,
+    });
+    if (!validated.ok || validated.intent.kind !== "integration_correction" ||
+        (validated.ok && validated.intent.context_ref.action_id !==
+            job.payload?.integration_action_id)) {
+        const reason = validated.ok ? "correction_contract_invalid" : validated.code;
+        await httpClient.fail(job, {
+            error_kind: "ContractError.CorrectionLegacy",
+            error_message: reason, classification: "crashed",
+        });
+        return { status: "failed", reason };
+    }
     const { ownership, observation } = createJobRunState(options, deps);
     return runSpawnJob(job, httpClient, options, deps, ownership, observation, seams, control, driver);
 }
@@ -695,7 +760,11 @@ control) {
     // any /fail that has no envelope gets the truthful "not launched" envelope and
     // keeps its own error kind; reports that already carry one are untouched.
     if (claimIsCovered(job)) {
-        httpClient = withNotLaunchedEnvelopeFallback(httpClient, job);
+        httpClient = withNotLaunchedEnvelopeFallback(httpClient, job, {
+            jobTimeRuntime: () => jobTimeCompletionRuntimes.get(ownership) ?? null,
+            preflightRuntime: _report?.completionEvidenceQualified === true ? (_report.completionRuntime ?? null) : null,
+            agentId: resolveExecutorAgentId(options.agentId),
+        });
     }
     // `merge` is a deterministic executor action: dispatched BEFORE any worktree
     // ensure/recreate or worker-spawn logic — it ensures no worktree and spawns no
@@ -1175,7 +1244,20 @@ async function superviseDriverPhase(params) {
         collectTelemetry: params.collectTelemetry,
         control: params.control,
     });
-    await Promise.race([flow.settled, params.deps.sleep(DRIVER_PHASE_SETTLE_MAX_MS)]);
+    let settleTimer;
+    try {
+        await Promise.race([
+            flow.settled,
+            new Promise((resolve) => {
+                settleTimer = params.deps.setTimer(resolve, DRIVER_PHASE_SETTLE_MAX_MS);
+            }),
+        ]);
+    }
+    finally {
+        // A normal phase must not leave its four-minute bound alive after it settles.
+        if (settleTimer !== undefined)
+            params.deps.clearTimer(settleTimer);
+    }
     if (procResult.serverStopRequested)
         return { kind: "server_stop" };
     if (params.ownership.abandoned)
@@ -1323,10 +1405,56 @@ async function ensureJobWorktree(job, options, deps, seams, policy) {
     }
 }
 async function prepareSpawn(job, httpClient, options, deps, seams) {
+    // A continuation passes no local head here (`head === undefined`): its retained
+    // worktree was already proven by `prepareRetainedContinuationWorktree` →
+    // `verifyContinuationHeadLineage`, which refuses before spawn unless HEAD
+    // descends from `continuation.bound_head_sha` — the same head as
+    // `correction_intent.head_sha`, including one the server derived for a first
+    // attempt with no bound ticket head (BAPI-1344). The spawn source is always
+    // that retained worktree, never an origin checkout.
+    const refuseCorrectionDrift = async (branch, head) => {
+        if (!isRemainingWork(job.job_type, job.payload))
+            return null;
+        const intent = job.payload?.correction_intent;
+        if (branch === intent.branch && (head === undefined || head === intent.head_sha))
+            return null;
+        const reason = "correction_context_missing";
+        await httpClient.fail(job, {
+            error_kind: "ContractError.CorrectionLegacy",
+            error_message: reason,
+            classification: "crashed",
+        });
+        return { ok: false, result: { status: "failed", reason } };
+    };
+    if (isRemainingWork(job.job_type, job.payload)) {
+        const intent = validateCorrectionIntent(job.payload?.correction_intent, {
+            repo_name: job.repo_name,
+            epic_run_id: job.epic_run_id ?? null,
+            ticket_key: job.ticket_key ?? null,
+            expected_branch: job.expected_branch,
+            expected_head_sha: job.expected_head_sha,
+        });
+        const reason = !intent.ok
+            ? intent.code
+            : !job.required_capabilities?.includes(CORRECTION_INTENT_CAPABILITY)
+                ? "correction_contract_invalid"
+                : null;
+        if (reason !== null) {
+            await httpClient.fail(job, {
+                error_kind: "ContractError.CorrectionLegacy",
+                error_message: reason,
+                classification: "crashed",
+            });
+            return { ok: false, result: { status: "failed", reason } };
+        }
+    }
     if (job.job_type === "resume") {
         const prepareResume = seams.prepareResumeSpawn ?? prepareResumeSpawn;
         try {
             const prepared = await prepareResume(job, options, buildResumeSeams(deps, options));
+            const drift = await refuseCorrectionDrift(prepared.branch);
+            if (drift)
+                return drift;
             return {
                 ok: true,
                 worktreePath: prepared.worktreePath,
@@ -1386,6 +1514,9 @@ async function prepareSpawn(job, httpClient, options, deps, seams) {
             await httpClient.fail(job, jobWorktreeFailure(wt));
             return { ok: false, result: { status: "failed", reason: "worktree_create_failed" } };
         }
+        const drift = await refuseCorrectionDrift(wt.branch, readContinuationBinding(job) ? undefined : wt.expectedHeadSha);
+        if (drift)
+            return drift;
         return {
             ok: true,
             worktreePath: wt.worktreePath,
@@ -1461,11 +1592,18 @@ async function prepareSpawn(job, httpClient, options, deps, seams) {
         // validated against a closed set — never inferred locally, and never taken
         // from worker output (R14 rules 3 and 4).
         staleBranchClassification: resolveStaleBranchClassification(job.payload),
+        // BAPI-1367: the server-minted (and client-normalized) prior head. Only an
+        // `implement` retry acts on it; `ensureExecutorWorktree` re-checks that.
+        // Spread only when present so an ordinary job keeps its exact legacy policy.
+        ...(job.prior_attempt_head_sha ? { priorAttemptHeadSha: job.prior_attempt_head_sha } : {}),
     });
     if (!wt.ok) {
         await httpClient.fail(job, jobWorktreeFailure(wt));
         return { ok: false, result: { status: "failed", reason: "worktree_create_failed" } };
     }
+    const drift = await refuseCorrectionDrift(wt.branch, readContinuationBinding(job) ? undefined : wt.expectedHeadSha);
+    if (drift)
+        return drift;
     // Explicit/synthesized prompt wins verbatim, preserving existing behavior.
     // BAPI-1311: for a focused rebase that explicit prompt IS the validated
     // server-rendered prompt (`validateFocusedRebaseContext` required it).
@@ -1476,6 +1614,7 @@ async function prepareSpawn(job, httpClient, options, deps, seams) {
             branch: wt.branch,
             prompt: explicit.prompt,
             expectedHeadSha: wt.expectedHeadSha,
+            ...(wt.priorWork ? { priorWork: wt.priorWork } : {}),
             ...(focusedRebase ? { focusedRebase } : {}),
         };
     }
@@ -1498,6 +1637,7 @@ async function prepareSpawn(job, httpClient, options, deps, seams) {
             branch: wt.branch,
             prompt: rendered,
             expectedHeadSha: wt.expectedHeadSha,
+            ...(wt.priorWork ? { priorWork: wt.priorWork } : {}),
         };
     }
     catch (err) {
@@ -1512,6 +1652,93 @@ async function prepareSpawn(job, httpClient, options, deps, seams) {
         return { ok: false, result: { status: "failed", reason: "prompt_contract" } };
     }
 }
+/** The first twelve characters of a SHA — safe, supporting evidence only. */
+function shortSha(sha) {
+    return sha.slice(0, 12);
+}
+/**
+ * BAPI-1367 — the continuation wording prepended to a retried `implement` prompt.
+ *
+ * States the work state first (this is prior-attempt work, not a fresh start),
+ * says whether uncommitted files survived as a WIP checkpoint or were unavailable
+ * because the worktree was recreated from the pushed branch, and leaves the
+ * resolved prompt untouched after it. Short SHAs are the only identifiers used.
+ */
+export function buildPriorAttemptContinuationNotice(params) {
+    const { branch, priorWork, checkpointed, ticketKey } = params;
+    const recreated = priorWork.kind === "recreated_from_pushed_branch";
+    const command = ticketKey ? `/implement-ticket ${ticketKey} --auto` : "/implement-ticket";
+    const files = recreated
+        ? "Prior uncommitted files were unavailable on this host: the worktree was recreated from the pushed branch, so only committed work is present."
+        : checkpointed
+            ? "Prior uncommitted files were saved as a WIP checkpoint commit so nothing was lost."
+            : "The retained worktree was clean, so no WIP checkpoint was needed.";
+    return (`CONTINUATION: this is a retry. An earlier attempt of this job left work on branch '${branch}' ` +
+        `(its recorded head was ${shortSha(priorWork.priorHeadSha)}). You are continuing that prior-attempt ` +
+        `work, not starting ${command} from base: read the branch's existing commits first, keep what is ` +
+        `correct, and finish only what is missing. ${files} The original instructions follow unchanged.\n\n`);
+}
+/**
+ * BAPI-1367 — finish a prior-attempt resume UNDER THE WORKTREE LOCK.
+ *
+ * Order is the contract: prove the retained HEAD descends from the recorded prior
+ * head, WIP-checkpoint dirty files (a checkpoint commits onto whatever HEAD is, so
+ * lineage must be proven first), then finalize — which pins `expectedHeadSha` to
+ * the POST-checkpoint head and provisions command assets. No destructive Git
+ * command is ever issued. Diagnostics carry the job id, attempt number, and short
+ * SHAs only — never the prompt or a full hash.
+ */
+async function resumePriorAttemptUnderLock(params) {
+    const { job, prep, options, deps, worktreePath, branch } = params;
+    const priorWork = prep.priorWork;
+    const resumeSeams = buildResumeSeams(deps, options);
+    try {
+        await verifyContinuationHeadLineage(worktreePath, priorWork.priorHeadSha, resumeSeams);
+        const checkpoint = await autoCheckpointDirtyState(worktreePath, resumeSeams, PRIOR_ATTEMPT_WIP_COMMIT_MESSAGE);
+        const finalized = await finalizeRetainedExecutorWorktree(worktreePath, branch, deps);
+        if (!finalized.ok) {
+            return {
+                ok: false,
+                failure: {
+                    error_kind: "WorktreeError",
+                    error_message: finalized.error,
+                    classification: "crashed",
+                },
+            };
+        }
+        const notice = buildPriorAttemptContinuationNotice({
+            branch,
+            priorWork,
+            checkpointed: checkpoint.committed,
+            ticketKey: job.ticket_key,
+        });
+        deps.errorLog(`[executor] job ${job.id}: attempt ${job.attempt_count} resuming prior-attempt work ` +
+            `(prior head ${shortSha(priorWork.priorHeadSha)}, resumed at ${shortSha(finalized.expectedHeadSha)}` +
+            `${checkpoint.committed ? ", dirty files checkpointed" : ""})`);
+        if (priorWork.kind === "recreated_from_pushed_branch") {
+            deps.errorLog(`[executor] job ${job.id}: attempt ${job.attempt_count} worktree recreated from the pushed ` +
+                `branch; prior uncommitted files were unavailable (prior head ${shortSha(priorWork.priorHeadSha)})`);
+        }
+        return {
+            ok: true,
+            prep: {
+                ...prep,
+                prompt: `${notice}${prep.prompt}`,
+                expectedHeadSha: finalized.expectedHeadSha,
+            },
+        };
+    }
+    catch (err) {
+        const failure = isExecutorNamedError(err)
+            ? toExecutorFailure(err)
+            : {
+                error_kind: "WorktreeError",
+                error_message: secretFreeErrorMessage(err),
+                classification: "crashed",
+            };
+        return { ok: false, failure };
+    }
+}
 /**
  * BAPI-1296 — verify a prepared `ci_fix` checkout against its dispatched CI
  * context and render the focused prompt, UNDER THE WORKTREE LOCK.
@@ -1724,6 +1951,34 @@ async function runSpawnJob(job, httpClient, options, deps, ownership, observatio
  * adds no second worktree entry and no second worker launcher.
  */
 driver) {
+    // A server-owned read precedes every worktree reset/cut and worker launch.
+    // Only this boundary can authorize a no-charge pre-work wait; a later plan
+    // retrieval failure is ordinary bounded worker failure.
+    if (job.epic_run_id && (httpClient.scopeReadiness ||
+        job.required_capabilities?.includes("scope_wait.v1"))) {
+        if (!httpClient.scopeReadiness) {
+            await httpClient.fail(job, {
+                error_kind: "ContractError.ScopeReadiness",
+                error_message: "Required pre-work scope protocol is unavailable.",
+                classification: "crashed",
+            });
+            return { status: "failed", reason: "scope_readiness_unsupported" };
+        }
+        try {
+            const readiness = await httpClient.scopeReadiness(job);
+            if (readiness.decision !== "ready") {
+                return { status: "failed", reason: `scope_${readiness.decision}` };
+            }
+        }
+        catch {
+            await httpClient.fail(job, {
+                error_kind: "ScopeReadinessUnavailable",
+                error_message: "Server scope readiness could not be confirmed.",
+                classification: "crashed",
+            });
+            return { status: "failed", reason: "scope_readiness_unavailable" };
+        }
+    }
     // --- Per-job base branch (BAPI-586) ----------------------------------
     // Resolve the effective logical base BEFORE any side effect: the persisted
     // run base (`payload.base_branch`) is authoritative, falling back to the
@@ -1824,11 +2079,12 @@ driver) {
     // --- Worktree mutual exclusion (FAIL-CLOSED, BAPI-793) ----------------
     // The FIRST thing that happens once a canonical worktree path exists, and
     // ahead of every executor-owned write to it: the deny layer, MCP
-    // provisioning, the `worker.log` truncation, the viewer tab, and the spawn
-    // itself all live inside the lock. `worker.log` in particular is created with
-    // an empty write, so a refused contender that got as far as the tee would
-    // erase the running worker's forensic log without ever spawning — which is
-    // why refusal returns from HERE rather than anywhere downstream.
+    // provisioning, the attempt log allocation, the viewer tab, and the spawn
+    // itself all live inside the lock. Before BAPI-1330 the shared `worker.log`
+    // was created with a truncating write, so a refused contender that got as far
+    // as the tee could erase the running worker's forensic log; per-attempt logs
+    // are now created exclusively, and refusal still returns from HERE rather
+    // than anywhere downstream.
     //
     // Known residual window, stated rather than papered over: `prepareSpawn`
     // above already ran `ensureWorktree`, which hard-resets and cleans the tree.
@@ -1869,6 +2125,20 @@ driver) {
         // a refused ci_fix leaves the worktree exactly as preparation left it. The
         // verified, rendered prompt replaces preparation's empty placeholder.
         let readyPrep = prep;
+        // --- Prior-attempt resume (BAPI-1367) --------------------------------
+        // Inside the lock, and BEFORE artifact cleanup and every executor-owned write:
+        // prove the retained head's lineage, WIP-checkpoint any dirty files, and only
+        // then pin the pre-spawn expectation to the POST-checkpoint head. Pinning
+        // earlier (to base or to the lineage anchor) would make the BAPI-731
+        // assertion refuse the very checkpoint this step just made.
+        if (prep.priorWork) {
+            const resumed = await resumePriorAttemptUnderLock({ job, prep, options, deps, worktreePath, branch });
+            if (!resumed.ok) {
+                await httpClient.fail(job, resumed.failure);
+                return { status: "failed", reason: "prior_attempt_resume_failed" };
+            }
+            readyPrep = resumed.prep;
+        }
         if (prep.ciFix) {
             const rendered = await renderVerifiedCiFixPrompt({
                 job,
@@ -2114,6 +2384,12 @@ async function runPreparedSpawn(params) {
     // safety margin but must not kill a job. Refusing to CLAIM on unenforced deny
     // remains a separate, fatal preflight concern.
     const denyCapability = adapter.denyEnforcement;
+    const correctionWork = isRemainingWork(job.job_type, job.payload);
+    let correctionDenyInstalled = false;
+    const correctionHookBinPath = denyCapability?.supported === true
+        ? (seams.resolveWorkerGuardBinPath ??
+            (() => defaultResolveBinPath(WORKER_GUARD_BIN_FILENAME)))()
+        : "";
     if (denyCapability?.supported === true) {
         const deny = await denyCapability.value.provisionWorktreeDenyLayer({
             worktreePath,
@@ -2125,8 +2401,8 @@ async function runPreparedSpawn(params) {
             // "is this push destination mine?" by comparing against it, so a value the
             // payload could influence would let a job nominate its own safe branch.
             workerBranch: branch,
-            workerGuardHookBinPath: (seams.resolveWorkerGuardBinPath ??
-                (() => defaultResolveBinPath(WORKER_GUARD_BIN_FILENAME)))(),
+            ...(correctionWork ? { correctionIntentVersion: 1 } : {}),
+            workerGuardHookBinPath: correctionHookBinPath,
         });
         // Log on WARNING PRESENCE, not on `!ok` (BAPI-815/R2). The git-exclude
         // hygiene step can degrade without failing the deny layer — present-but-
@@ -2138,6 +2414,40 @@ async function runPreparedSpawn(params) {
         // fail-OPEN and the job continues to the spawn boundary.
         if (deny.warning)
             deps.errorLog(deny.warning);
+        correctionDenyInstalled = deny.ok;
+    }
+    if (correctionWork && !correctionDenyInstalled) {
+        await httpClient.fail(job, {
+            error_kind: "ContractError.CorrectionLegacy",
+            error_message: "correction_contract_invalid",
+            classification: "crashed",
+        });
+        return { status: "failed", reason: "correction_hook_unavailable" };
+    }
+    if (correctionWork) {
+        let hookQualified = false;
+        try {
+            if (seams.verifyInstalledCorrectionHook) {
+                hookQualified = await seams.verifyInstalledCorrectionHook(worktreePath, correctionHookBinPath);
+            }
+            else {
+                const settings = await deps.readFile(`${worktreePath}/.claude/settings.local.json`);
+                hookQualified = settings.includes(correctionHookBinPath) &&
+                    settings.includes("--correction-intent-version 1") &&
+                    probeInstalledCorrectionHook(worktreePath, correctionHookBinPath);
+            }
+        }
+        catch {
+            hookQualified = false;
+        }
+        if (!hookQualified) {
+            await httpClient.fail(job, {
+                error_kind: "ContractError.CorrectionLegacy",
+                error_message: "correction_contract_invalid",
+                classification: "crashed",
+            });
+            return { status: "failed", reason: "correction_hook_unverified" };
+        }
     }
     // --- MCP registration + trust pre-approval (fail-open, BAPI-724) -----
     // Unconditional for every job type that reaches this shared spawn path
@@ -2187,28 +2497,45 @@ async function runPreparedSpawn(params) {
     }
     const mcpContract = registration.contract;
     // --- Worker log tee + watch registry + viewer tab (BAPI-535 §8) ------
+    // BAPI-1330: ONE attempt identity — the server's job id and attempt number
+    // plus a claim id minted here — names this attempt's log file, its registry
+    // entry, and its active-log key. It is allocated BEFORE the tee exists, the
+    // file is created exclusively, and every terminal branch below finishes and
+    // deactivates exactly this identity, so no later claim of the same job (a
+    // retry, a reclaim, a reused worktree) can overwrite or be confused with it.
     const registryDeps = buildJobLogRegistryDeps(deps);
     const markFinished = seams.markExecutorJobLogFinished ?? markExecutorJobLogFinished;
     const createTee = seams.createWorkerLogTee ?? createWorkerLogTee;
-    let tee = null;
+    let logClaimId = null;
     try {
-        tee = await createTee(worktreePath, {
-            mkdir: deps.mkdir,
-            writeFile: deps.writeFile,
-            appendFile: deps.appendFile,
-            platform: deps.platform,
-            // BAPI-1021 (AC-6): the archive seams. All optional on `ExecutorDeps`
-            // already, so this is source-compatible with every existing deps
-            // builder — archival simply does not run when either is absent.
-            rename: deps.rename,
-            stat: deps.stat,
-            now: deps.now,
-            errorLog: deps.errorLog,
-        });
+        logClaimId = (seams.createWorkerLogClaimId ?? createWorkerLogClaimId)();
     }
     catch {
-        tee = null;
+        logClaimId = null;
     }
+    let tee = null;
+    if (logClaimId !== null) {
+        try {
+            tee = await createTee(worktreePath, {
+                mkdir: deps.mkdir,
+                writeFile: deps.writeFile,
+                appendFile: deps.appendFile,
+                writeFileExclusive: deps.writeFileExclusive,
+                stat: deps.stat,
+                platform: deps.platform,
+                errorLog: deps.errorLog,
+            }, { jobId: job.id, attempt: job.attempt_count, claimId: logClaimId });
+        }
+        catch {
+            tee = null;
+        }
+    }
+    if (tee === null) {
+        // A logging failure never changes the worker's disposition; it only means
+        // this attempt has no transcript, which is said once, without detail.
+        deps.errorLog(`worker log unavailable for job ${job.id} (allocation_failed); the attempt continues.`);
+    }
+    const teeClaimId = tee?.identity.claimId;
     // BAPI-828 — idempotent worker-log closure, defined the moment a tee could
     // exist. Every terminal branch below calls this instead of `closeWorkerLogTee`
     // directly, and `runSpawnJob`'s `finally` calls it once more as a backstop for
@@ -2221,8 +2548,10 @@ async function runPreparedSpawn(params) {
             return;
         workerLogClosed = true;
         // Deactivate FIRST: once the tee is closing, an append from the suspend
-        // diagnostic would be writing to a log nobody is reading any more.
-        deactivateJobLog(job.id);
+        // diagnostic would be writing to a log nobody is reading any more. Only
+        // THIS attempt's entry is removed (BAPI-1330).
+        if (teeClaimId !== undefined)
+            deactivateJobLog(job.id, teeClaimId);
         await closeWorkerLogTee(tee);
     };
     lifecycle.closeWorkerLog = closeWorkerLog;
@@ -2233,7 +2562,9 @@ async function runPreparedSpawn(params) {
         // visibility nicety for a separate `executor watch` process), and chaining
         // the active marker to it would mean a failed registry write silently
         // disables suspend annotation for a worker whose tee is perfectly healthy.
-        activateJobLog(job.id, tee.logPath);
+        // BAPI-1330: an attempt whose file could not be allocated is never active.
+        if (tee.available)
+            activateJobLog(job.id, tee.logPath, tee.identity.claimId);
         const registerLog = seams.registerExecutorJobLog ?? registerExecutorJobLog;
         try {
             await registerLog({
@@ -2244,12 +2575,17 @@ async function runPreparedSpawn(params) {
                 worktree_path: worktreePath,
                 log_path: tee.logPath,
                 started_at: nowIso(deps),
+                attempt: tee.identity.attempt,
+                claim_id: tee.identity.claimId,
+                availability: tee.available ? "available" : "unavailable",
+                ...(tee.unavailableReason ? { unavailable_reason: tee.unavailableReason } : {}),
             }, registryDeps);
         }
         catch {
             /* registry is a visibility nicety — never fail the job */
+            deps.errorLog(`executor job-log registry: could not record job ${job.id}'s attempt log (non-fatal)`);
         }
-        if (executorViewerTabsEnabled(deps.platform, deps.env)) {
+        if (tee.available && executorViewerTabsEnabled(deps.platform, deps.env)) {
             const openViewer = seams.openExecutorViewerTab ?? openExecutorViewerTab;
             try {
                 const viewer = await openViewer({
@@ -2273,11 +2609,21 @@ async function runPreparedSpawn(params) {
     const finalizeRegistry = async () => {
         if (!tee)
             return;
+        const finishing = tee;
         try {
-            await markFinished(job.id, nowIso(deps), registryDeps);
+            // BAPI-1330: stamps only THIS attempt's entry, and records a transcript
+            // that became incomplete mid-run as unavailable rather than leaving a
+            // reader to trust it.
+            await markFinished(job.id, finishing.identity.claimId, nowIso(deps), registryDeps, finishing.available
+                ? {}
+                : {
+                    availability: "unavailable",
+                    ...(finishing.unavailableReason ? { unavailable_reason: finishing.unavailableReason } : {}),
+                });
         }
         catch {
             /* non-fatal */
+            deps.errorLog(`executor job-log registry: could not finish job ${job.id}'s attempt log (non-fatal)`);
         }
     };
     // --- Spawn -----------------------------------------------------------
@@ -2337,6 +2683,7 @@ async function runPreparedSpawn(params) {
             // denies every `git push` the worker attempts — the worker has no remote
             // write authority at all.
             ...(driver?.omitWorkerBranch ? {} : { workerBranch: branch }),
+            ...(correctionWork ? { correctionIntentVersion: 1 } : {}),
             ...(driverStep ? { declaredTouchedFiles: driverStep.declaredTouchedFiles } : {}),
             parentEnv: deps.env,
         });
@@ -2488,6 +2835,9 @@ async function runPreparedSpawn(params) {
             })
             : null;
         const runtime = probed ?? unrecognizedRuntime(adapter);
+        // Carry the probe identity into any later not-launched report for this job.
+        if (probed !== null)
+            jobTimeCompletionRuntimes.set(ownership, probed);
         const refuse = async (reason, message) => {
             await closeWorkerLog();
             await finalizeRegistry();
@@ -2536,6 +2886,17 @@ async function runPreparedSpawn(params) {
             stripEnvFiles: stripWorktreeEnvFiles,
         });
     }
+    // BAPI-1364: an observe-only ledger for a legacy run of a covered job type. It
+    // never enters `runCoveredAttempt()` and never enables the completion contract;
+    // it only lets a clean exit be checked for required background work still live.
+    const legacyLedger = isCoveredJobType(job.job_type)
+        ? createRequiredWorkLedger({
+            binding: readCompletionBinding(job, null).binding,
+            lifecycleSupported: true,
+            optionalWatchers: readOptionalWatchers(job.payload),
+        })
+        : null;
+    const legacyLineFeeder = legacyLedger ? createLedgerLineFeeder(legacyLedger) : null;
     let proc;
     try {
         proc = spawnWorker({ env: spawnShape.env });
@@ -2600,12 +2961,15 @@ async function runPreparedSpawn(params) {
         collectTelemetry,
         collectRemoteMarker,
         mcpSurface,
+        ...(legacyLineFeeder ? { onStdoutObserved: legacyLineFeeder.feed } : {}),
         // The SAME controller the registry holds, so an executor shutdown, a timeout,
         // and an MCP containment refusal all converge on one `SIGTERM` and one grace
         // timer for this child (BAPI-828).
         terminationController,
         control,
     });
+    // Flush a trailing partial stdout line so the observe-only ledger sees it.
+    legacyLineFeeder?.flush();
     // --- Adapter lifecycle (EXPLICIT, BAPI-781) ---------------------------
     // Consumed rather than assumed. Claude declares `{ kind: "none" }` and so
     // nothing runs here — which is correct, because BAPI-790 deleted the per-job
@@ -2835,6 +3199,32 @@ async function runPreparedSpawn(params) {
             await finalizeRegistry();
             return terminalToRunResult(terminal, "completed");
         }
+        // BAPI-1364: a legacy worker that ended its (headless) session while the
+        // structured stream still showed a required background command with no
+        // terminal notification can never receive that command's result. Report it
+        // before generic success, the ci_fix artifact merge, or finalization can hide
+        // it. Only the fixed kind and message are sent: no event text, command, path,
+        // or output. A matching terminal task_notification leaves nothing pending.
+        if (legacyLedger?.observeLiveRequiredWork() === "live_required_work") {
+            deps.errorLog(`[executor] job ${job.id}: worker exited cleanly with required background work still live`);
+            await finalizeRegistry();
+            const terminal = await sendTerminalMutationWithAuthReport({
+                kind: "fail",
+                send: () => httpClient.fail(job, {
+                    error_kind: WorkerEndedWithPendingBackgroundWork,
+                    error_message: WORKER_ENDED_WITH_PENDING_BACKGROUND_WORK_MESSAGE,
+                    classification: "crashed",
+                    ...observedExitCode(procResult.exitCode),
+                    ...commitResidue(git),
+                    telemetry: observation.snapshot(),
+                }),
+                deps,
+                options,
+                ownership,
+                log: deps.log,
+            }, job, control);
+            return terminalToRunResult(terminal, "failed");
+        }
         // Non-verdict spawn jobs (`implement`, `resume`, and the recovery jobs
         // `remediate`/`ci_fix`/`rebase`) use the generic success-result construction;
         // the verdict-artifact path above stays limited to verdict jobs like
@@ -2902,6 +3292,9 @@ async function runPreparedSpawn(params) {
                 kind: "fail",
                 send: () => httpClient.fail(job, {
                     ...finalization.failure,
+                    // BAPI-1330: the process's observed exit rides beside the
+                    // finalization failure; it is never rewritten to look like a crash.
+                    ...observedExitCode(procResult.exitCode),
                     ...commitResidue(git),
                     telemetry: observation.snapshot(),
                 }),
@@ -3016,6 +3409,7 @@ async function runPreparedSpawn(params) {
                 ? CLAUDE_NOT_AUTHENTICATED_MESSAGE
                 : `worker exited (${procResult.classification}, exit_code=${procResult.exitCode})`,
             classification: toWireClassification(procResult.classification),
+            ...observedExitCode(procResult.exitCode),
             ...commitResidue(git),
             telemetry: observation.snapshot(),
             ...(capacityEvidence !== undefined ? { capacity_evidence: capacityEvidence } : {}),
@@ -3037,6 +3431,16 @@ const INITIAL_PROMPT_WRITE_BOUND_MS = 30_000;
 /** Bound on closing the held stdin once the closure rule fires. */
 const STDIN_CLOSE_BOUND_MS = 5_000;
 const SUPPORTED_COMPLETION_MARKER = COMPLETION_CONTRACT_MARKER_VALUES[0];
+/**
+ * BAPI-1330 — the worker's observed exit code as a `/fail` field. Omitted (never
+ * null, never invented) when the process ended without a usable code, e.g. on a
+ * signal. Only ever read from the process result, never from worker output.
+ */
+function observedExitCode(exitCode) {
+    return typeof exitCode === "number" && Number.isInteger(exitCode) && exitCode >= 0
+        ? { exit_code: exitCode }
+        : {};
+}
 /**
  * Whether this claim runs under the covered completion contract.
  *
@@ -3048,22 +3452,25 @@ const SUPPORTED_COMPLETION_MARKER = COMPLETION_CONTRACT_MARKER_VALUES[0];
 function claimIsCovered(job) {
     return claimRequiresCompletionEvidence(job.required_capabilities);
 }
-/**
- * Wrap the client so a covered claim's /fail without an envelope carries the
- * "not launched" envelope (BAPI-1301). Every other call passes straight through.
- */
-function withNotLaunchedEnvelopeFallback(httpClient, job) {
+/** Exported for the covered-job runtime tests; not part of the executor's public surface. */
+export function withNotLaunchedEnvelopeFallback(httpClient, job, runtimeSources) {
     const wrapped = Object.create(httpClient);
     wrapped.fail = (claimed, failure) => {
         if (failure.completion_evidence !== undefined)
             return httpClient.fail(claimed, failure);
         const { binding } = readCompletionBinding(job, typeof job.expected_head_sha === "string" ? job.expected_head_sha : null);
         const unlaunched = unlaunchedVerification(readRequiredVerification(job.payload));
+        // The runtime actually probed, never the measured baseline: the job-time probe
+        // when it ran, then the qualified preflight runtime, then an unrecognized one.
+        // A runtime that does not satisfy the predicate makes the report a truthful
+        // refusal, so the server accepts it and still never reads it as success.
+        const runtime = runtimeSources.jobTimeRuntime() ?? runtimeSources.preflightRuntime ?? unrecognizedRuntimeForAgent(runtimeSources.agentId);
         const envelope = buildNotLaunchedEnvelope({
             binding,
-            runtime: { ...SUPPORTED_COMPLETION_RUNTIME },
+            runtime: { ...runtime },
             verification: unlaunched.verification,
             residuals: CLEANUP_RESIDUALS_NOT_COVERED,
+            unsupportedRuntime: !runtimeMatchesSupported(runtime),
             ...(unlaunched.facts ? { verificationFacts: unlaunched.facts } : {}),
         });
         return httpClient.fail(claimed, {
@@ -3074,6 +3481,12 @@ function withNotLaunchedEnvelopeFallback(httpClient, job) {
     };
     return wrapped;
 }
+/**
+ * The covered-job runtime probe's identity per job, recorded before launch so a
+ * later not-launched report stamps what was actually probed (BAPI-1386). Keyed by
+ * the job's ownership state, which both the wrapper and the spawn path share.
+ */
+const jobTimeCompletionRuntimes = new WeakMap();
 /**
  * The verification a covered report carries when no declared check ran
  * (BAPI-1302): before launch, after a worker failure, or on a stop.
@@ -3120,8 +3533,11 @@ function declaredOrderFacts(checks, runFacts) {
 }
 /** An identity that cannot match the supported runtime, for truthful refusal envelopes. */
 function unrecognizedRuntime(adapter) {
+    return unrecognizedRuntimeForAgent(adapter.identity.agentId);
+}
+function unrecognizedRuntimeForAgent(agentId) {
     return {
-        adapter: adapter.identity.agentId,
+        adapter: agentId,
         cli_version: "unrecognized",
         platform: "unrecognized",
         event_schema: "unrecognized",
@@ -3361,33 +3777,9 @@ async function runCoveredAttempt(params) {
         buildNudge: params.nudge,
         deadlineAtMs: plan.holdDeadlineAtMs,
     });
-    // The authoritative consumer: whole lines into the ledger, bounded. A line
-    // that outgrows the event bound is handed over once (the ledger marks it
-    // `stream_oversize`) and the rest of it is discarded up to its newline.
-    let lineBuffer = "";
-    let discardingOversize = false;
-    const authoritativeStdout = (chunk) => {
-        lineBuffer += chunk;
-        let newline;
-        while ((newline = lineBuffer.indexOf("\n")) >= 0) {
-            const line = lineBuffer.slice(0, newline);
-            lineBuffer = lineBuffer.slice(newline + 1);
-            if (discardingOversize) {
-                discardingOversize = false;
-                continue;
-            }
-            ledger.ingestLine(line);
-            supervisor.onActivity();
-        }
-        if (!discardingOversize && lineBuffer.length > MAX_EVENT_BYTES) {
-            ledger.ingestLine(lineBuffer);
-            lineBuffer = "";
-            discardingOversize = true;
-        }
-        else if (discardingOversize) {
-            lineBuffer = "";
-        }
-    };
+    // The authoritative consumer: whole lines into the ledger, bounded.
+    const lineFeeder = createLedgerLineFeeder(ledger, () => supervisor.onActivity());
+    const authoritativeStdout = lineFeeder.feed;
     const runPromise = runProcessWithTimeout(supervisedProc, Math.max(1, Math.ceil(plan.workerWindowMs / 1000)), deps, {
         termGraceMs: jobOptions.termGraceMs,
         terminationController,
@@ -3419,8 +3811,7 @@ async function runCoveredAttempt(params) {
     if (sampleTimer !== undefined)
         deps.clearTimer(sampleTimer);
     supervisor.dispose();
-    if (!discardingOversize && lineBuffer.length > 0)
-        ledger.ingestLine(lineBuffer);
+    lineFeeder.flush();
     ledger.recordStreamEnd(procResult.authoritativeStreamError || procResult.exitUnconfirmed
         ? "stream_error"
         : (procResult.stdoutEnd ?? "eof"));
@@ -3604,6 +3995,7 @@ async function runCoveredAttempt(params) {
                 ? CLAUDE_NOT_AUTHENTICATED_MESSAGE
                 : `worker exited (${procResult.classification}, exit_code=${procResult.exitCode})`,
             classification: toWireClassification(procResult.classification),
+            ...observedExitCode(procResult.exitCode),
         }, envelope, capacityEvidence !== undefined ? { capacity_evidence: capacityEvidence } : {}));
     }
     // --- Phase 3: independent declared checks (BAPI-1302, D4c) ---------------------
@@ -3734,6 +4126,9 @@ async function runCoveredAttempt(params) {
         runCommand: deps.runCommand,
         headSha: git.last_commit_sha,
         expectedBaseBranch: effectiveBaseBranch,
+        // BAPI-1330: this host only runs claims the SERVER stamped as covered, so
+        // the existence-only legacy fallback is refused here.
+        coveredAttempt: true,
     });
     const facts = finalizationFacts(finalization.ok ? { ok: true } : { ok: false, errorKind: finalization.failure.error_kind });
     const envelope = envelopeWith({
@@ -3775,19 +4170,35 @@ async function runCoveredAttempt(params) {
     // Not a success. A completion cause (required work, cleanup, verification,
     // permission) outranks the finalization kind; with none, finalization keeps
     // its existing error kind and recovery lane.
+    //
+    // BAPI-1330: every branch below is reached only after the worker exited
+    // cleanly. A completion refusal reports that observed process fact —
+    // `clean_exit` and the real exit code — beside the refusal (the server decides
+    // it from the envelope's completion cause, never the classification). A
+    // finalization failure adds the exit code to its own kind and classification.
+    const observedExit = {
+        classification: toWireClassification(procResult.classification),
+        ...observedExitCode(procResult.exitCode),
+    };
     const cause = envelope.cause;
     if (cause) {
         return finish(await failWith({
             error_kind: COMPLETION_CAUSE_ERROR_KINDS[cause],
             error_message: `covered attempt did not prove completion (${successRefusalReason(envelope) ?? cause})`,
-            classification: "crashed",
+            ...observedExit,
         }, envelope));
     }
-    if (!finalization.ok)
-        return finish(await failWith(finalization.failure, envelope));
+    if (!finalization.ok) {
+        // The finalization failure keeps its OWN classification, exactly as the
+        // legacy path does: the kinds that mean "the process ended cleanly"
+        // (`PrNotAttached`, `PublicationUnverified`) already say `clean_exit`, and
+        // the rest keep the classification their existing recovery routing reads.
+        // Only the observed exit code is added.
+        return finish(await failWith({ ...finalization.failure, ...observedExitCode(procResult.exitCode) }, envelope));
+    }
     return finish(await failWith({
         error_kind: COMPLETION_CAUSE_ERROR_KINDS.required_work_incomplete,
         error_message: `covered attempt did not prove completion (${successRefusalReason(envelope) ?? "unknown"})`,
-        classification: "crashed",
+        ...observedExit,
     }, envelope));
 }