@bridge_gpt/mcp-server 0.2.66 → 0.2.68

package/build/executor/process.js

@@ -11,17 +11,19 @@ export const DEFAULT_TERM_GRACE_MS = 10_000;
  */
 export function createProcessTerminationController(proc, deps, termGraceMs = DEFAULT_TERM_GRACE_MS) {
     let requested = false;
+    let cause = null;
     let escalated = false;
     let disposed = false;
     let graceTimer;
     const killListeners = [];
     return {
-        requestTermination() {
+        requestTermination(endCause = "executor_abort") {
             // A disposed controller belongs to a settled child: signalling it would
             // either hit nothing or, worse, a recycled pid.
             if (requested || disposed)
                 return;
             requested = true;
+            cause = endCause;
             proc.kill("SIGTERM");
             graceTimer = deps.setTimer(() => {
                 graceTimer = undefined;
@@ -42,6 +44,9 @@ export function createProcessTerminationController(proc, deps, termGraceMs = DEF
         isTerminationRequested() {
             return requested;
         },
+        endCause() {
+            return cause;
+        },
         dispose() {
             if (disposed)
                 return;
@@ -125,7 +130,7 @@ export async function runProcessWithTimeout(proc, timeoutSeconds, deps, options
     // shutdown, timeout, and MCP containment converge on a single `SIGTERM` and a
     // single grace timer rather than racing three of each.
     const controller = options.terminationController ?? createProcessTerminationController(proc, deps, termGraceMs);
-    const terminate = () => controller.requestTermination();
+    const terminate = (cause) => controller.requestTermination(cause);
     // BAPI-1301 (D4a): the authoritative consumer, when supplied. `drainClosed`
     // flips once the bounded post-exit drain gives up, so a chunk arriving after
     // the verdict was taken can never mutate the ledger behind the caller's back.
@@ -160,18 +165,16 @@ export async function runProcessWithTimeout(proc, timeoutSeconds, deps, options
         stdoutExcerpt = appendBounded(stdoutExcerpt, chunk, limit);
         if (options.onStdoutTerminationCheck?.(chunk) === true && !terminationRequested) {
             terminationRequested = true;
-            terminate();
+            terminate("executor_abort");
         }
     });
     const pumpStderr = pump(proc.stderr, (chunk) => {
         stderrExcerpt = appendBounded(stderrExcerpt, chunk, limit);
     });
-    let timedOut = false;
     const timeoutTimer = deps.setTimer(() => {
-        timedOut = true;
         // Same escalation the assertion uses; the guard inside makes a timeout that
         // races an already-requested termination a no-op rather than a double signal.
-        terminate();
+        terminate("job_timeout");
     }, timeoutSeconds * 1000);
     // BAPI-1301 (D4a): bounded waits, only when a drain deadline was supplied.
     // Every timer created here is cleared before returning.
@@ -226,9 +229,13 @@ export async function runProcessWithTimeout(proc, timeoutSeconds, deps, options
             deps.clearTimer(handle);
     }
     let classification;
-    if (timedOut) {
+    const endCause = controller.endCause?.() ?? null;
+    if (endCause === "job_timeout") {
         classification = "timeout";
     }
+    else if (endCause !== null) {
+        classification = "killed";
+    }
     else if (exitCode === 0) {
         classification = "clean_exit";
     }
@@ -241,6 +248,7 @@ export async function runProcessWithTimeout(proc, timeoutSeconds, deps, options
         signal,
         stdoutExcerpt,
         stderrExcerpt,
+        endCause: endCause ?? "worker_exit",
         ...(terminationRequested ? { terminationRequested: true } : {}),
         // BAPI-1301 fields appear only for callers that opted in, so every legacy
         // result keeps its exact shape.

package/build/executor/prompt-spec.js

@@ -1,3 +1,4 @@
+import { renderWorkerVerificationGuidance } from "./worker-verification-guidance.js";
 /**
  * Executor-side structured prompt-spec renderer (BAPI-550, TDD §6/§7).
  *
@@ -18,6 +19,35 @@
  * or reasons.
  */
 import { CiFixContext, ExecutorNamedError } from "./job-errors.js";
+import { EPIC_WORKAROUNDS_DIR, epicWorkaroundRecordPath } from "../epic-workarounds-path.js";
+/**
+ * BAPI-1399 — the workaround contract for a PR-producing Epic Implementer worker.
+ *
+ * A requirement the worker cannot meet unattended (a missing credential, an
+ * external setting, or access) is either MINOR — the ticket's essential
+ * behavior still works without it — or CORE. A minor gap gets a guarded
+ * workaround and a committed record at `.bridge/epic-workarounds/<TICKET>.md`;
+ * while that folder exists on the epic head the integration pull request stays
+ * in draft. A core gap is never worked around: the worker leaves the required
+ * work unfinished, which parks the ticket as `required_work_incomplete` through
+ * the unchanged completion contract.
+ *
+ * The worker decides from the ticket and the code alone; no supervisor scan
+ * result is injected here. Kept SINGLE-LINE and free of `;`, quotes, and
+ * apostrophes, like `buildPrBaseContractLaunchInstruction`, because it travels
+ * in the same launch prompt.
+ */
+export function buildEpicWorkaroundWorkerInstruction(ticketKey) {
+    const record = (ticketKey ? epicWorkaroundRecordPath(ticketKey) : null) ?? `${EPIC_WORKAROUNDS_DIR}<TICKET>.md`;
+    return ("Workaround contract: if a requirement of this ticket cannot be met unattended, such as a missing " +
+        "credential, external setting, or access, decide whether it is minor or core. It is minor only when " +
+        "the essential behavior of the ticket still works without it. For a minor gap, deliver a guarded " +
+        "workaround: guard exactly the deferred behavior (for example, check for a missing setting and skip " +
+        "only that feature), keep the core path working, and write " + record + " naming the requirement, " +
+        "the guarded substitute you delivered, and the step a human must still take. Commit that record on " +
+        "this ticket branch with git add -f " + record + ". For a core gap, never write a workaround or a " +
+        "record: leave the required work unfinished so the run parks this ticket for a human.");
+}
 /** Stable named-error kind used for every prompt-spec contract failure. */
 const PROMPT_CONTRACT_ERROR = "ContractError.Prompt";
 /** The prompt-spec version this renderer understands. */
@@ -647,5 +677,7 @@ export async function renderPromptSpecPrompt(job, context) {
     const values = await buildPromptSpecPlaceholderValues(job, spec, context);
     const systemPrompt = buildPromptSpecSystemPrompt(spec, values);
     const userPrompt = buildPromptSpecUserPrompt(spec, values);
-    return `${systemPrompt}\n\n${userPrompt}`;
+    return `${systemPrompt}\n\n${userPrompt}` +
+        (!context.deferComparisonGuidance && ["implement", "resume", "ci_fix"].includes(job.job_type)
+            ? "\n\n" + renderWorkerVerificationGuidance(context.comparisonSha) : "");
 }

package/build/executor/recently-failed-tests-file.js

@@ -0,0 +1,71 @@
+/** Atomic resolver refresh. Caller retains the exclusive worktree lock. */
+import path from "node:path";
+import { constants } from "node:fs";
+import { lstat, mkdir, open, realpath, rename, unlink } from "node:fs/promises";
+import { randomUUID } from "node:crypto";
+import { parseRecentlyFailedTests, RECENTLY_FAILED_TESTS_PATH } from "./likely-tests.js";
+export function validatedRecentFailures(value) {
+    if (value === undefined)
+        return { version: 1, tests: [], truncated: false };
+    const parsed = parseRecentlyFailedTests(value);
+    if (!parsed.available || parsed.skipped || JSON.stringify(value).length > 16 * 1024 ||
+        value.tests.length > 20)
+        throw new Error("recent_failure_schema_invalid");
+    return parsed.value;
+}
+export async function writeRecentlyFailedTestsFile(worktree, value) {
+    const selection = validatedRecentFailures(value);
+    const root = await realpath(worktree);
+    const directory = path.join(root, ".conductor");
+    try {
+        await mkdir(directory);
+    }
+    catch (error) {
+        if (error.code !== "EEXIST")
+            throw new Error("recent_failure_directory_unavailable");
+    }
+    const directoryStat = await lstat(directory);
+    if (!directoryStat.isDirectory() || directoryStat.isSymbolicLink() || await realpath(directory) !== directory)
+        throw new Error("recent_failure_directory_unsafe");
+    const destination = path.join(root, RECENTLY_FAILED_TESTS_PATH);
+    const safeDestination = async () => {
+        if (await realpath(directory) !== directory || !(await lstat(directory)).isDirectory() ||
+            (await lstat(directory)).isSymbolicLink())
+            throw new Error("recent_failure_directory_changed");
+        try {
+            const stat = await lstat(destination);
+            if (!stat.isFile() || stat.isSymbolicLink())
+                throw new Error("recent_failure_destination_unsafe");
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
+        }
+    };
+    await safeDestination();
+    const temporary = path.join(directory, `.recent-failures-${randomUUID()}.tmp`);
+    let created = false;
+    try {
+        const handle = await open(temporary, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);
+        created = true;
+        try {
+            await handle.writeFile(JSON.stringify(selection) + "\n", "utf8");
+            await handle.sync();
+        }
+        finally {
+            await handle.close();
+        }
+        if (await realpath(temporary) !== temporary || !(await lstat(temporary)).isFile())
+            throw new Error("recent_failure_temporary_unsafe");
+        await safeDestination();
+        const current = await lstat(directory);
+        if (current.ino !== directoryStat.ino || current.dev !== directoryStat.dev)
+            throw new Error("recent_failure_directory_changed");
+        await rename(temporary, destination);
+        created = false;
+    }
+    finally {
+        if (created && await realpath(directory).catch(() => "") === directory)
+            await unlink(temporary).catch(() => { });
+    }
+}

package/build/executor/reconcile-overlap-job.js

@@ -1,3 +1,4 @@
+import { guardedFastForwardPush, PUSH_AUTH_FAILURE_RE } from "./guarded-fast-forward-push.js";
 /**
  * The `reconcile_overlap` executor job (BAPI-1152).
  *
@@ -71,7 +72,6 @@ const CONFLICT_REPORT_DIR = ".conductor/";
 const CONDUCTOR_ARTIFACT_DIR = ".conductor/";
 /** Command bounds. */
 const GIT_TIMEOUT_MS = 120_000;
-const PUSH_TIMEOUT_MS = 180_000;
 const COMMAND_OUTPUT_TAIL_CHARS = 4_000;
 /** Left in the job budget when the wrapper waits for provider checks. */
 const CI_WAIT_MARGIN_MS = 90_000;
@@ -91,8 +91,6 @@ const WRAPPER_STAGE_EXCLUDES = [
     ":(exclude).claude/settings.local.json",
 ];
 const SHA_RE = /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/;
-const PUSH_AUTH_FAILURE_RE = /authentication failed|could not read username|permission denied|terminal prompts disabled|invalid username or password|returned error: 403|requested url returned error: 401/i;
-const PUSH_LEASE_FAILURE_RE = /stale info|\[rejected\]|non-fast-forward|fetch first/i;
 class PayloadError extends Error {
 }
 function asRecord(value, field) {
@@ -339,9 +337,13 @@ export function createReconcileOverlapDriver(job, payload, seams) {
     const git = async (ctx, args, timeoutMs = GIT_TIMEOUT_MS, env) => {
         if (ctx.signal?.aborted)
             throw new ReconcileOverlapAborted("reconciliation phase aborted");
+        const remaining = "remainingMs" in ctx ? ctx.remainingMs() : timeoutMs;
+        if (remaining <= 0)
+            throw new ReconcileOverlapAborted("reconciliation deadline expired");
         return seams.runCommand("git", args, {
             cwd: ctx.worktreePath,
-            timeoutMs,
+            timeoutMs: Math.min(timeoutMs, remaining),
+            signal: ctx.signal,
             ...(env ? { env } : {}),
         });
     };
@@ -374,8 +376,12 @@ export function createReconcileOverlapDriver(job, payload, seams) {
         result: envelope(extra),
         ...(lastCommitSha ? { lastCommitSha } : {}),
     });
+    let preserveHead = false;
+    let cleanupHead = payload.childHead;
     /** Reset to the recorded child head. Never throws. */
     const resetToChildHead = async (ctx) => {
+        if (preserveHead)
+            return;
         try {
             const mergeHead = await seams.runCommand("git", ["rev-parse", "-q", "--verify", "MERGE_HEAD"], {
                 cwd: ctx.worktreePath,
@@ -384,7 +390,7 @@ export function createReconcileOverlapDriver(job, payload, seams) {
             if (mergeHead.exitCode === 0) {
                 await seams.runCommand("git", ["merge", "--abort"], { cwd: ctx.worktreePath, timeoutMs: GIT_TIMEOUT_MS });
             }
-            await seams.runCommand("git", ["reset", "--hard", payload.childHead], {
+            await seams.runCommand("git", ["reset", "--hard", cleanupHead], {
                 cwd: ctx.worktreePath,
                 timeoutMs: GIT_TIMEOUT_MS,
             });
@@ -595,35 +601,33 @@ export function createReconcileOverlapDriver(job, payload, seams) {
             }
             return complete({ observed_epic_head: heads.epic });
         }
-        // (2) The ONE push: a fast-forward of the child branch, leased on the
-        // recorded child head. Never plain --force, never a lease-less lease.
-        const destination = `refs/heads/${payload.expectedBranch}`;
-        const push = await git(ctx, [
-            "push",
-            "--no-verify",
-            "--porcelain",
-            `--force-with-lease=${destination}:${payload.childHead}`,
-            "origin",
-            `HEAD:${destination}`,
-        ], PUSH_TIMEOUT_MS, { ...seams.env, GIT_TERMINAL_PROMPT: "0" });
-        if (push.exitCode !== 0) {
-            const text = `${push.stdout}\n${push.stderr}`;
-            if (PUSH_AUTH_FAILURE_RE.test(text)) {
+        const push = await guardedFastForwardPush({
+            branch: payload.expectedBranch, expectedOriginSha: payload.childHead,
+            candidateSha: candidate, trustedExcludedShas: [payload.requiredEpicSha],
+            worktreePath: ctx.worktreePath, runCommand: seams.runCommand, env: seams.env,
+            remainingMs: ctx.remainingMs, signal: ctx.signal, mayMutate: () => !ctx.signal.aborted,
+        });
+        if (push.status !== "published") {
+            if (push.reason === "auth_failed") {
                 await resetToChildHead(ctx);
                 return fail(ReconcileOverlapPushUnauthorized, "pushed", "the executor's git credential helper refused the push");
             }
-            if (PUSH_LEASE_FAILURE_RE.test(text)) {
+            if (push.reason === "lease_rejected") {
                 const reread = await readRemoteHeads(ctx);
                 await resetToChildHead(ctx);
-                if (reread.ok && reread.child !== null && reread.child !== payload.childHead) {
+                if (reread.ok && reread.child !== null && reread.child !== payload.childHead)
                     return complete({ observed_child_head: reread.child });
-                }
             }
-            else {
+            else if (push.reason !== "timeout" && !ctx.signal.aborted) {
                 await resetToChildHead(ctx);
             }
+            else {
+                preserveHead = true;
+            }
             return fail(ReconcileOverlapPushRejected, "pushed", "the remote refused the guarded push");
         }
+        preserveHead = true;
+        ctx.recordPublication?.(push);
         // (3) Finalization runs ONCE, after the wrapper's push, against the pushed
         // head: origin must carry it and the PR must be attached at it.
         const finalize = seams.finalize ?? validateWorkerFinalization;
@@ -633,6 +637,7 @@ export function createReconcileOverlapDriver(job, payload, seams) {
             worktreePath: ctx.worktreePath,
             result: {},
             runCommand: seams.runCommand,
+            callTimeoutMs: () => Math.min(GIT_TIMEOUT_MS, ctx.remainingMs()),
             headSha: candidate,
             expectedBaseBranch: ctx.effectiveBaseBranch,
             originResolveAttempts: FINALIZATION_ATTEMPTS,
@@ -658,6 +663,16 @@ export function createReconcileOverlapDriver(job, payload, seams) {
             if (ctx.branch !== payload.expectedBranch) {
                 return finish(fail(ReconcileOverlapBranchMismatch, "validated", "the prepared worktree is not on the job's expected branch"));
             }
+            if (ctx.preparationPublication) {
+                preserveHead = true;
+                const heads = await readRemoteHeads(ctx);
+                if (!heads.ok)
+                    return finish(heads.outcome);
+                if (heads.child === null)
+                    return finish(fail(ReconcileOverlapPushRejected, "validated", "the child branch no longer exists on origin"));
+                cleanupHead = heads.child;
+                return finish(complete({ observed_child_head: heads.child }));
+            }
             // Fetch the exact server-supplied inputs. The job never infers a head.
             await git(ctx, ["fetch", "--no-tags", "origin", payload.epicBranch], GIT_TIMEOUT_MS, {
                 ...seams.env,
@@ -831,6 +846,9 @@ export function createReconcileOverlapDriver(job, payload, seams) {
             return pushFlow(ctx);
         },
         async abandon(ctx) {
+            // Wrapper-created merges are not retained worker progress until their
+            // verification/publication gate succeeds. Published or ambiguous pushes,
+            // including preparation publication, already set preserveHead above.
             await resetToChildHead(ctx);
         },
     };

package/build/executor/required-verification.js

@@ -236,7 +236,7 @@ export function createSupervisedCommandLauncher(input) {
         let cancelled = false;
         const onAbort = () => {
             cancelled = true;
-            controller.requestTermination();
+            controller.requestTermination("executor_abort");
         };
         request.signal.addEventListener("abort", onAbort, { once: true });
         try {

package/build/executor/required-work-ledger.js

@@ -875,8 +875,38 @@ export function createRequiredWorkLedger(init) {
             if (!liveOptional.includes(tid))
                 liveOptional.push(tid);
         const readyToClose = resultsSeen > 0 && latestIsResult && !turnOpen && liveRequired.length === 0 && snap.required.length === 0;
-        return { readyToClose, liveRequired, liveOptional, activitySeq, latestIsResult };
+        const bashBgIds = [];
+        let onlyBashBg = true;
+        for (const o of obligations.values()) {
+            if (!isLive(o) || !o.required)
+                continue;
+            if (o.kind === "bash_bg")
+                bashBgIds.push(o.taskId ?? o.toolUseId);
+            else
+                onlyBashBg = false;
+        }
+        for (const tid of snap.required) {
+            const o = findByTaskId(tid);
+            if (!o || o.kind !== "bash_bg")
+                onlyBashBg = false;
+            else if (!bashBgIds.includes(o.taskId ?? o.toolUseId))
+                bashBgIds.push(o.taskId ?? o.toolUseId);
+        }
+        return {
+            readyToClose,
+            liveRequired,
+            liveOptional,
+            activitySeq,
+            latestIsResult,
+            turnOpen,
+            finalResultNoOpenTurn: resultsSeen > 0 && latestIsResult && !turnOpen,
+            liveRequiredBashBg: onlyBashBg ? bashBgIds : [],
+        };
     };
+    // One predicate for "a required task is still pending", shared by the envelope
+    // and the observe-only query so the two cannot drift apart.
+    const hasPendingRequiredWork = () => effectiveTasks().some(({ o, state }) => o.required && state === "pending");
+    const observeLiveRequiredWork = () => hasPendingRequiredWork() ? "live_required_work" : null;
     const buildEnvelope = (facts) => {
         const reasons = new Set(insufficient);
         if (!lifecycleSupported || !runtimeMatchesSupported(facts.runtime))
@@ -897,7 +927,7 @@ export function createRequiredWorkLedger(init) {
             reasons.add("forced_kill_no_cli_teardown");
         const effective = effectiveTasks();
         // R6: a required task with no terminal after the stream ended is missing evidence.
-        if (effective.some(({ o, state }) => o.required && state === "pending"))
+        if (hasPendingRequiredWork())
             reasons.add("live_required_work");
         // R6b: a stale snapshot, or a snapshot-only task nothing ever explained.
         const snap = liveSnapshotIds();
@@ -993,11 +1023,19 @@ export function createRequiredWorkLedger(init) {
         recordDeclarationRefused: () => {
             insufficient.add("declaration_refused");
         },
+        observeLiveRequiredWork,
         buildEnvelope,
     };
 }
 /** The measured settle window after the closure rule first holds (BAPI-1292 C6an-hold2). */
 export const CLOSURE_DEBOUNCE_MS = 1500;
+/**
+ * The absolute post-result window (BAPI-1395). Once a final result is in, no
+ * turn is open, and the only live required work is the worker's own background
+ * Bash, stdin is closed at most this long after the window opens — whatever the
+ * worker does meanwhile. Normal early closure is unchanged.
+ */
+export const COMPLETION_WINDOW_MS = 30 * 60 * 1000;
 /**
  * Hold stdin open until the closure rule holds for a full debounce window, then
  * close it exactly once.
@@ -1012,6 +1050,13 @@ export const CLOSURE_DEBOUNCE_MS = 1500;
  * optional watchers are live. It is never sent while required work is live and
  * never asks for a broad stop — cancelling required work is not the executor's
  * call.
+ *
+ * The completion window (BAPI-1395): when the final result is in and only
+ * required `bash_bg` work is live, one fixed end `min(opened + window, deadline)`
+ * is set. A new worker turn cancels it; background activity does not. The one
+ * nudge (shared with the optional-watcher nudge, so a job gets at most one)
+ * asks the worker to stop only its own tasks that are merely waiting. Closing
+ * at the end resolves nothing: the live tasks stay unresolved in the ledger.
  */
 export function createClosureSupervisor(opts) {
     const { ledger, deps } = opts;
@@ -1024,6 +1069,14 @@ export function createClosureSupervisor(opts) {
     let debounceTimer = null;
     let armedSeq = -1;
     let pending = Promise.resolve();
+    const windowMs = opts.windowMs ?? COMPLETION_WINDOW_MS;
+    let windowOpened = false;
+    let windowTimer = null;
+    const clearWindow = () => {
+        if (windowTimer !== null)
+            deps.clearTimer(windowTimer);
+        windowTimer = null;
+    };
     const clearDebounce = () => {
         if (debounceTimer !== null)
             deps.clearTimer(debounceTimer);
@@ -1036,6 +1089,7 @@ export function createClosureSupervisor(opts) {
         closed = true;
         closedReason = reason;
         clearDebounce();
+        clearWindow();
         if (deadlineTimer !== null)
             deps.clearTimer(deadlineTimer);
         deadlineTimer = null;
@@ -1049,6 +1103,48 @@ export function createClosureSupervisor(opts) {
                 // then reports `stdout_not_read_to_eof`, never success.
             }
         });
+        if (reason === "window") {
+            try {
+                opts.onWindowExpiry?.();
+            }
+            catch {
+                /* the caller's termination scheduling must never break closure */
+            }
+        }
+    };
+    const sendNudge = (line, onUndelivered) => {
+        nudged = true;
+        nudgeAwaitingReply = true;
+        pending = pending.then(async () => {
+            let ok = false;
+            try {
+                ok = (await opts.writeMessage(line)).ok;
+            }
+            catch {
+                ok = false;
+            }
+            if (!ok && !closed && !disposed)
+                onUndelivered();
+        });
+    };
+    const openWindow = (bashBgIds) => {
+        windowOpened = true;
+        const now = deps.now();
+        const windowEnd = Math.min(now + windowMs, opts.deadlineAtMs);
+        // The deadline timer already closes at `deadlineAtMs`; a second timer there
+        // would only race it, so the window schedules its own close only when it
+        // ends strictly earlier.
+        if (windowEnd < opts.deadlineAtMs) {
+            windowTimer = deps.setTimer(() => {
+                windowTimer = null;
+                close("window");
+            }, Math.max(0, windowEnd - now));
+        }
+        if (!nudged && opts.buildWindowNudge) {
+            sendNudge(opts.buildWindowNudge([...bashBgIds]), () => {
+                nudgeAwaitingReply = false;
+            });
+        }
     };
     let deadlineTimer = deps.setTimer(() => {
         deadlineTimer = null;
@@ -1060,30 +1156,26 @@ export function createClosureSupervisor(opts) {
         const s = ledger.closureState();
         if (armedSeq !== s.activitySeq)
             clearDebounce();
+        if (s.turnOpen && windowOpened) {
+            clearWindow();
+            windowOpened = false;
+        }
         if (!s.latestIsResult) {
             // The nudge was answered (or other activity began): the next result decides again.
             nudgeAwaitingReply = false;
             return;
         }
+        if (!windowOpened && s.finalResultNoOpenTurn && s.liveRequiredBashBg.length > 0) {
+            openWindow(s.liveRequiredBashBg);
+            return;
+        }
         if (!s.readyToClose)
             return;
         if (!nudged && s.liveOptional.length > 0) {
-            nudged = true;
-            nudgeAwaitingReply = true;
-            const line = opts.buildNudge([...s.liveOptional]);
-            pending = pending.then(async () => {
-                let ok = false;
-                try {
-                    ok = (await opts.writeMessage(line)).ok;
-                }
-                catch {
-                    ok = false;
-                }
-                // An undelivered nudge will never be answered: fall back to the rule.
-                if (!ok && !closed && !disposed) {
-                    nudgeAwaitingReply = false;
-                    onActivity();
-                }
+            // An undelivered nudge will never be answered: fall back to the rule.
+            sendNudge(opts.buildNudge([...s.liveOptional]), () => {
+                nudgeAwaitingReply = false;
+                onActivity();
             });
             return;
         }
@@ -1112,6 +1204,7 @@ export function createClosureSupervisor(opts) {
         settled: () => pending,
         dispose: () => {
             clearDebounce();
+            clearWindow();
             if (deadlineTimer !== null)
                 deps.clearTimer(deadlineTimer);
             deadlineTimer = null;

package/build/executor/resume-pre-spawn.js

@@ -149,6 +149,8 @@ export function fillResumePromptPlaceholders(template, gitLog, gitDiff) {
 // ---------------------------------------------------------------------------
 /** The deterministic WIP checkpoint message for a continuation. */
 export const CONTINUATION_WIP_COMMIT_MESSAGE = "wip: auto-checkpoint before continuation";
+/** BAPI-1367: the WIP checkpoint message when a retry resumes its prior attempt's work. */
+export const PRIOR_ATTEMPT_WIP_COMMIT_MESSAGE = "wip: auto-checkpoint before retry resume";
 const FULL_SHA = /^[0-9a-f]{40}$/;
 /** Read the continuation binding from a claimed job's payload (pure). */
 export function readContinuationBinding(job) {

package/build/executor/retirement.js

@@ -0,0 +1,69 @@
+/** Process-local, pure retirement bookkeeping for a single-run executor. */
+export const SUSPEND_GAP_SLACK_MS = 60_000;
+export function initialRetirementState() {
+    return { unreachableMs: 0, idleMs: 0, definitiveReason: null, definitiveReads: 0, definitiveMs: 0, failedCallEvidence: false };
+}
+/** Bounds prevent accidental years-long values and unsafe number conversions. */
+export function parseRetirementSetting(raw, defaultValue, maximum) {
+    if (raw === undefined)
+        return { value: defaultValue, warning: false };
+    if (!/^(0|[1-9][0-9]*)$/.test(raw))
+        return { value: defaultValue, warning: true };
+    const value = Number(raw);
+    return Number.isSafeInteger(value) && value <= maximum
+        ? { value, warning: false }
+        : { value: defaultValue, warning: true };
+}
+export function transitionRetirement(prior, cycle, config) {
+    const state = { ...prior };
+    const elapsed = cycle.sleep.completed && cycle.sleep.elapsedMs >= 0 &&
+        cycle.sleep.elapsedMs <= 3 * config.pollIntervalMs + SUSPEND_GAP_SLACK_MS
+        ? cycle.sleep.elapsedMs : 0;
+    const success = cycle.successfulServerCall || cycle.claimedJob || cycle.claimedAction || cycle.scopedRead === "ok";
+    const failure = cycle.failedServerCall || ["network", "timeout", "server", "malformed", "unexpected"].includes(cycle.scopedRead);
+    if (success) {
+        state.unreachableMs = 0;
+        state.failedCallEvidence = false;
+    }
+    else if (failure) {
+        state.failedCallEvidence = true;
+    }
+    if (cycle.claimedJob || cycle.claimedAction || cycle.activeCount > 0)
+        state.idleMs = 0;
+    else if ((cycle.claimOutcome === "none" || cycle.claimOutcome === "preflight-refused") && elapsed > 0)
+        state.idleMs += elapsed;
+    if (cycle.activeCount === 0 && !success && state.failedCallEvidence)
+        state.unreachableMs += elapsed;
+    if (cycle.scopedRead === "not-found" || cycle.scopedRead === "unauthorized") {
+        if (state.definitiveReason === cycle.scopedRead) {
+            state.definitiveReads += 1;
+            state.definitiveMs += elapsed;
+        }
+        else {
+            state.definitiveReason = cycle.scopedRead;
+            state.definitiveReads = 1;
+            state.definitiveMs = 0;
+        }
+    }
+    else if (cycle.scopedRead === "ok" || cycle.scopedRead === "unavailable" || cycle.scopedRead === "network" || cycle.scopedRead === "timeout" || cycle.scopedRead === "server" || cycle.scopedRead === "malformed" || cycle.scopedRead === "unexpected") {
+        state.definitiveReason = null;
+        state.definitiveReads = 0;
+        state.definitiveMs = 0;
+    }
+    else if (state.definitiveReason !== null) {
+        state.definitiveMs += elapsed;
+    }
+    let decision = { kind: "continue" };
+    if (cycle.activeCount === 0) {
+        if (state.definitiveReason !== null && state.definitiveReads >= 3 && state.definitiveMs >= 5 * 60_000) {
+            decision = { kind: "retire", reason: state.definitiveReason === "not-found" ? "run_not_found" : "run_unauthorized", awakeMinutes: Math.floor(state.definitiveMs / 60_000) };
+        }
+        else if (config.unreachableMinutes > 0 && state.unreachableMs >= config.unreachableMinutes * 60_000) {
+            decision = { kind: "retire", reason: "server_unreachable", awakeMinutes: Math.floor(state.unreachableMs / 60_000) };
+        }
+        else if (config.idleHours > 0 && state.idleMs >= config.idleHours * 3_600_000) {
+            decision = { kind: "retire", reason: "idle", awakeMinutes: Math.floor(state.idleMs / 60_000) };
+        }
+    }
+    return { state, decision };
+}