@bridge_gpt/mcp-server 0.2.69 → 0.2.70

package/build/drive-epic.js

@@ -1,3 +1,6 @@
+import { ticketReviewSummary } from "./ticket-review-summary.js";
+import { parseConductorReadinessResponse } from "./conductor/bridge-api-client.js";
+import { READINESS_PRE_CREATE_CODES, READINESS_PREREQUISITE_BY_ID, READINESS_LEGACY_IDS } from "./readiness-prerequisites.generated.js";
 /**
  * `drive-epic` — the one universal conductor entry point (BAPI-887).
  *
@@ -53,32 +56,49 @@
  * ratcheted down, and a tool would be useless in a bare-chat session anyway,
  * where the model has no tool call to make.
  */
-import { readdir, readFile } from "node:fs/promises";
+import { access as fsAccess, readdir, readFile, stat as fsStat } from "node:fs/promises";
+import { constants as fsConstants } from "node:fs";
 import path, { dirname, join } from "node:path";
-import { CONDUCTOR_DEFAULT_BASE_URL, ConductorBridgeApiError, resolveEpicLaunchBridgeApiAccess, fetchConductorReadiness, fetchEpicRunState, gateProfileWaivesCiWorkflow, safeDiagnosticMessage, } from "./conductor/bridge-api-client.js";
+import { ConductorBridgeApiError, resolveEpicLaunchBridgeApiAccess, fetchConductorReadiness, fetchRepositoryUsageAdvisory, REPOSITORY_USAGE_ADVISORY_UNAVAILABLE, formatSchemaIncompatibleRefusal, isSchemaIncompatibleError, SCHEMA_INCOMPATIBLE_REPAIR_ROUTE, fetchEpicRunState, isProviderRepositoryIdentity, safeDiagnosticMessage, classifyChildMergeStatus as classifyChildMergeStatusClient, recordSkippedChildren as recordSkippedChildrenClient, } from "./conductor/bridge-api-client.js";
+import { CHILD_MERGE_STATUS_BATCH_SIZE, buildAlreadyDoneEntries, classifyPlanChildren, selectSkips, } from "./conductor/merged-child-check.js";
+import { trimDonePlanNodes } from "./conductor/plan-trim.js";
+import { withPlanPath } from "./conductor/temporary-plan.js";
+import { ESCALATION_REACHABILITY_CHECK_ID, buildEscalationReachabilityCheck, } from "./escalation-reachability.js";
 import { EPIC_LAUNCH_PROFILE_NAME_PATTERN, epicLaunchPolicyDigest, pinEpicLaunchPolicy, renderEpicLaunchCommand, resolveEpicLaunchSelection, shellQuote, } from "./epic-launch-profile.js";
 import { validateHttpBaseUrl, describeBaseUrlRejection } from "./base-url.js";
 import { BRING_UP_REFUSAL_MESSAGES, BRING_UP_RUNBOOK, firstBringUpRefusal, } from "./conductor/bring-up-facts.js";
-import { repositoryWorkflowRemedy } from "./conductor/repository-workflow-remedy.js";
-import { policyDeclaresNotifyWebhook, policyNotifyDestinationsConflict, notifyDestinationsConflictMessage, effectivePolicyFacts, readSetupEpicPolicyFile, runSetupEpicWorkflow, } from "./setup-epic.js";
+import { V2_READINESS_REQUIREMENTS, buildLaunchReadinessChecks, firstLaunchEvidenceBlocker, formatLaunchReadinessSummary, projectReadinessRowBlocking, unattendedPostureCheck, } from "./v2-readiness-requirements.js";
+import { classifyLocalGhPreflight, probeLocalMergeCapability, } from "./conductor/local-merge.js";
+import { nodeGithubMergeCredentialReadDeps, resolveMergeCredentialAtAction, } from "./conductor/stored-merge-credential.js";
+import { resolveWorktreeSettingsExclude, } from "./executor/permissions.js";
+import { collectWorkerDatabaseDoctorSection, WORKER_DATABASE_DOCTOR_TIMEOUT_MS, } from "./conductor/doctor.js";
+import { buildEpicBranchBehindBaseLaunchRow, buildHostPowerLaunchRow, buildSelfHostedRunnerLaunchRow, buildUsageResetAfterRunLaunchRow, buildWorkerDbRoleLaunchRow, hostPowerFactFromReport, workerDatabaseReadinessChecks, } from "./conductor/readiness-sections.js";
+import { createWorkflowSource, inspectEpicBranchBehindBase, inspectRequiredSelfHostedRunners, } from "./conductor/launch-need-probes.js";
+import { createWorkerDatabaseDoctorInspector } from "./conductor/worker-database-doctor-inspector.js";
+import { policyDeclaresNotifyWebhook, policyNotifyDestinationsConflict, notifyDestinationsConflictMessage, effectivePolicyFacts, readSetupEpicPolicyFile, readCanonicalParseTruth as readSetupCanonicalParseTruth, runSetupEpicWorkflow, } from "./setup-epic.js";
 import { EPIC_KEY_PATTERN } from "./drive-epic-key.js";
 import { flushProcessStdout, writeJsonDocument } from "./conductor/json-output.js";
+import { BRIDGE_LAUNCHER_ENV } from "./bridge-permissions.js";
+import { checkPlaneBuildFreshness, PLANE_BUILD_FIX_REMEDIATION } from "./plane/build-freshness.js";
 import { discoverEpicPlan, } from "./plan-discovery.js";
 import { formatPlaneDiagnostic, launchPlaneControlPlane, requestPlaneScopedLanes, runDefaultPlanePreflight, runPlaneCli, } from "./plane/cli.js";
 import { PLANE_PORT_PROBE_TIMEOUT_MS, describePlanePortOccupant, } from "./plane/preflight.js";
-import { createPlaneFsDeps, probeAutomationHealth, probeTcpPort, resolveHostname, } from "./plane/defaults.js";
+import { createPlaneExecFile, createPlaneFsDeps, probeAutomationHealth, probeTcpPort, resolveHostname, } from "./plane/defaults.js";
 import { readPlaneManifest } from "./plane/manifest.js";
+import { cleanupTerminalRunPlane, createTerminalRunCleanupDeps, terminalRunCleanupStderrLine, } from "./plane/terminal-run-cleanup.js";
+import { checkPlaneFreshness, inspectHostSleep, PLANE_DATABASE_HEAD_ID, PLANE_DATABASE_HEAD_REMEDY, PLANE_FRESHNESS_UNVERIFIED_REMEDY, PLANE_HOST_SLEEP_ID, PLANE_SLEEP_REMEDY, formatBoundPlaneStaleRemedy, PLANE_SNAPSHOT_FRESHNESS_ID, PLANE_SNAPSHOT_STALE_REMEDY, } from "./plane/plane-freshness.js";
 import { baseUrlNamesPlaneEndpoint, planeEndpointForTarget } from "./plane/endpoint.js";
 import { resolvePlaneServerEndpoint, } from "./plane/member-roster.js";
 import { resolveMemberInstanceId } from "./plane/supervisor.js";
-import { PLANE_SERVER_PORT_ENV_VAR, } from "./plane/types.js";
 import { validateBranchName } from "./base-ref.js";
 import { createDefaultRunExecutorLaunchDeps, ensureRunExecutor as ensureRunExecutorDefault, prepareRunExecutor as prepareRunExecutorDefault, } from "./executor-launch.js";
 import { isTerminalEpicRunStatus } from "./epic-run-status.js";
 // BAPI-806: mcp-identity.ts is the SOLE source of the package-name literal, so
 // the printed invocation interpolates it rather than repeating it.
 import { MCP_PACKAGE_NAME } from "./mcp-identity.js";
-import { PRINTED_CHECK_NAME_INSTRUCTION, PRINTED_CONDUCTOR_INSTALL_COMMAND, PRINTED_DOCTOR_COMMAND, } from "./printed-remedy-commands.js";
+import { getDriveEpicAdvancedUsage, getDriveEpicUsage } from "./drive-epic-help.js";
+export { getDriveEpicUsage };
+import { CONSUMER_GUIDE_POINTER, PRINTED_CHECK_NAME_INSTRUCTION, PRINTED_CONDUCTOR_INSTALL_COMMAND, PRINTED_DOCTOR_COMMAND, } from "./printed-remedy-commands.js";
 /** The conductor paths. Derived types below come from this constant. */
 export const DRIVE_EPIC_CONDUCTORS = ["v2"];
 /**
@@ -89,135 +109,12 @@ export const DRIVE_EPIC_CONDUCTORS = ["v2"];
  * one named constant rather than branching scattered through the routing logic.
  */
 export const DRIVE_EPIC_PREFERRED_CONDUCTOR = "v2";
-/**
- * The v2 readiness predicate, as a list so a failure can name what is missing.
- *
- * These are the facts v2 actually needs to drive an epic: a stored supervisor
- * posture, a reconciler that is ticking, a provisioned and live executor, and
- * complete GitHub App credentials. Each is read from the SERVER's report and
- * never re-derived locally — two implementations of one classification drift,
- * and a CLI that disagreed with the server about whether v2 can run would be
- * worse than no check at all.
- */
-export const V2_READINESS_REQUIREMENTS = [
-    {
-        id: "supervisor_setup",
-        describe: "supervisor setup stored for this repository",
-        satisfied: (r) => r.supervisor.setup_present,
-    },
-    {
-        id: "supervisor_config",
-        describe: "supervisor configuration stored for this repository",
-        satisfied: (r) => r.supervisor.config_present,
-    },
-    {
-        id: "github_credentials",
-        describe: "GitHub App credentials that resolve completely",
-        satisfied: (r) => r.github.credentials_complete,
-    },
-    {
-        id: "reconciler_live",
-        describe: "a reconciler that is ticking and not stale",
-        // BAPI-1279 — launch liveness is a DEPLOYMENT fact. The `bring_up` block
-        // reads the reconciler's process heartbeat deployment-wide, so a repository
-        // that has never run an epic still reads live when the worker is healthy.
-        // The repository-scoped `reconciler` section ("is this repository's work
-        // moving?", from `epic_runs.last_tick_at`) is only the fallback for a server
-        // too old to report `bring_up`.
-        satisfied: (r) => r.bring_up
-            ? r.bring_up.heartbeat_readable && r.bring_up.worker_present &&
-                r.bring_up.single_transition_authority
-            : r.reconciler.liveness_readable && !r.reconciler.stale,
-    },
-    {
-        id: "executor_live",
-        describe: "an executor provisioned and reporting ready",
-        // BAPI-1279 — diagnostic only. drive-epic starts (or, for a durable profile,
-        // verifies) the run's executor itself once the run exists.
-        advisoryOnly: true,
-        satisfied: (r) => r.executor.liveness_readable && r.executor.ready === true,
-    },
-    // BAPI-1102 — the three unattended prerequisites, in the order `setup-epic`
-    // refuses them, so readiness and the refusal name the same first blocker.
-    //
-    // Each reads the SERVER's `unattended` block and re-derives nothing. A server
-    // that does not report the block (older than BAPI-1102) leaves every one of
-    // them UNSATISFIED: "could not be read" is not "holds", and these authorize an
-    // unattended merge.
-    //
-    // The FIRST of them therefore carries the older-server remedy too, because it
-    // is the one an unreported block always blocks on, and telling that operator
-    // to set a consent flag would send them to fix something that may already be
-    // set — the server simply never said (BAPI-1102 review).
-    {
-        id: "unattended_consent",
-        describe: "repository consent to unattended Epic Implementer runs",
-        unattendedOnly: true,
-        // No fixed `remedy`: this requirement's action always depends on WHY.
-        remedyFor: (r) => r.unattended === null || r.unattended === undefined
-            ? "This Bridge API deploy does not report a repository's unattended " +
-                "prerequisites at all, so none of them could be confirmed. Upgrade the " +
-                "deploy, or pass --attended."
-            : "Unattended runs are off for this repository. Turn on 'Allow unattended " +
-                "Epic Implementer runs' on the repository's Setup page in the Bridge " +
-                "admin panel, or pass --attended. If it is already on, contact Bridge support.",
-        satisfied: (r) => r.unattended?.conductor_allowed === true,
-    },
-    {
-        id: "unattended_notify_default",
-        describe: "an escalation channel (a verified notify webhook or the account email)",
-        unattendedOnly: true,
-        remedy: "Supply a --policy-file declaring notify.webhook_url, or add an email address " +
-            "to the account so escalation alerts can be emailed, or pass --attended. " +
-            "notify.local_sink does not satisfy this.",
-        // BAPI-1274 — the account's email address is an escalation channel when no
-        // webhook is declared; the server reports its presence, never the address.
-        satisfied: (r) => r.unattended?.notify_webhook_default_declared === true ||
-            r.unattended?.escalation_email_available === true,
-    },
-    {
-        id: "repository_readiness",
-        describe: "confirmed review and epic-implementer-ci workflows on the default branch",
-        unattendedOnly: true,
-        // BAPI-1359 (Miss 38): the remedy names the SPECIFIC missing item, from the
-        // same shared formatter the readiness row and the setup-epic refusal use. The
-        // fixed install-command sentence that stood here could never clear a missing
-        // migration-guard job — no install step creates one — so it is gone from this
-        // refusal.
-        //
-        // BAPI-1390: the server decides which files are required (the review file
-        // only for a `verdict_protocol` run; the CI lane file only for a repository
-        // with no STORED gate profile and no `no_ci_gate`), and `satisfied` reads that
-        // decision as given. The remedy waives the CI file the same way, so a stored
-        // profile is never told to add a file it does not need. Gate-profile WARNINGS
-        // (epic-branch rows) are not requirements and are never read here.
-        remedyFor: (r) => repositoryWorkflowRemedy(gateProfileWaivesCiWorkflow(r) ? { ...r, conductor_ci_workflow: null } : r),
-        satisfied: (r) => r.unattended?.repository_readiness_confirmed === true,
-    },
-    // BAPI-1135 — merge-execution eligibility is deliberately NOT a requirement here.
-    //
-    // It was one, and it made `drive-epic` refuse EVERY repository the moment it
-    // shipped. The requirement could only be keyed on repository facts, because
-    // this layer keeps the composed run policy opaque to itself — and no
-    // repository carries the merge workflow until epic child 4 lands it. So both
-    // states resolved the same way: an upgraded server reported
-    // `merge_workflow_present: false` (`not_eligible`), an older one reported no
-    // block at all (`could_not_verify`), and either made `selectConductor` return
-    // `not_ready` and `classifyV2Readiness` return `operator_blocked` — for
-    // `--attended`, `--into-base` and `local`-mode runs alike, with a remedy
-    // naming a flag that does not exist yet.
-    //
-    // That is exactly the failure `selectConductor`'s own docstring warns about,
-    // and it contradicts the compatibility guarantee the rest of this slice keeps:
-    // nothing changes for a run that does not declare `github_actions`.
-    //
-    // Eligibility is still enforced, at the three layers that can actually see the
-    // declared mode: `setup-epic`'s pre-create refusal (which reads the composed
-    // policy), the approval route's server-side gate, and — authoritatively — the
-    // before-merge preflight. Readiness still REPORTS the facts as diagnostic
-    // rows, which inform without blocking. Reinstating a requirement here belongs
-    // with child 4, once a repository can actually satisfy it.
-];
+// BAPI-1452: `V2_READINESS_REQUIREMENTS` moved to `./v2-readiness-requirements.ts`
+// with an explicit governed row-ID list on every requirement, so readiness rows
+// derive `blocking` from requirement applicability alone. It is re-exported
+// here for existing consumers; classification and conductor selection stay in
+// this module.
+export { V2_READINESS_REQUIREMENTS };
 /**
  * The readiness facts a `plane up` can actually repair (BAPI-1054).
  *
@@ -237,7 +134,9 @@ export const V2_READINESS_REQUIREMENTS = [
  * running plane behind and change nothing — which is the precise failure the
  * classification exists to prevent.
  */
-export const V2_RUNTIME_READINESS_IDS = ["reconciler_live"];
+export const V2_RUNTIME_READINESS_IDS = ["server.worker-present"];
+/** BAPI-1452 — the credential capability row id, for naming its refusal. */
+const MERGE_CREDENTIAL_ROW = "conductor.merge-credential-capability";
 /**
  * Classify the SERVER's readiness report into the composition's three cases.
  *
@@ -250,13 +149,22 @@ export const V2_RUNTIME_READINESS_IDS = ["reconciler_live"];
  * three competing actions has to work out which to do first, and the order here
  * already encodes that (setup, then config, then credentials).
  */
-export function classifyV2Readiness(readiness, options = {}) {
+export function classifyV2Readiness(readiness, options = {}, 
+/**
+ * BAPI-1452 — the value-free launch evidence (credential probe verdict and
+ * worktree-preparation result) collected locally before run creation. A
+ * separate input rather than a new option, so the server report and the
+ * local evidence stay visibly distinct. Absent: no evidence was collected,
+ * and the classification is exactly the pre-BAPI-1452 one. The unattended
+ * posture is never read from here — only from the server report.
+ */
+launchEvidence) {
     for (const diagnostic of readiness.diagnostics ?? []) {
         if (diagnostic.severity === null || diagnostic.applicability === null) {
             return {
                 kind: "operator_blocked",
                 id: "diagnostic-metadata-unknown",
-                describe: "declared diagnostic severity and applicability",
+                describe: "Additional readiness diagnostics",
                 remedy: "Upgrade or repair the readiness producer, then retry the selected target.",
             };
         }
@@ -264,7 +172,7 @@ export function classifyV2Readiness(readiness, options = {}) {
             return {
                 kind: "operator_blocked",
                 id: "mandatory-diagnostic-unverified",
-                describe: `mandatory diagnostic ${diagnostic.id}`,
+                describe: "Additional readiness diagnostics",
                 remedy: "Resolve the mandatory diagnostic at the selected Bridge API target and retry.",
             };
         }
@@ -287,7 +195,7 @@ export function classifyV2Readiness(readiness, options = {}) {
     const deferred = options.approvedStoredPolicy ||
         options.effectivePolicy?.escalationChannel === "configured webhook" ||
         (options.effectivePolicy === undefined && options.hasPolicyFile)
-        ? V2_READINESS_REQUIREMENTS.filter((req) => req.id !== "unattended_notify_default")
+        ? V2_READINESS_REQUIREMENTS.filter((req) => req.id !== "server.unattended-notify-default")
         : V2_READINESS_REQUIREMENTS;
     // `--into-base` is the second opt-out, and it is structural rather than
     // declared: it selects the branch-silent composition, whose policy carries no
@@ -303,6 +211,30 @@ export function classifyV2Readiness(readiness, options = {}) {
         ? gating.filter((req) => req.unattendedOnly !== true)
         : gating;
     const unmet = applicable.filter((req) => !req.satisfied(readiness));
+    // BAPI-1452 — launch evidence. Only a PROVEN gap (missing or invalid
+    // credential, proven no access, proven worktree impossibility) refuses;
+    // unverified evidence is a warning and never a pass. Server-fact blockers
+    // keep priority, so a disabled posture is still named first.
+    const launchChecks = launchEvidence !== undefined && !optedOut
+        ? buildLaunchReadinessChecks(readiness, {
+            attended: options.attended,
+            intoBase: options.intoBase,
+            launchEvidence,
+        })
+        : [];
+    const launchBlocker = firstLaunchEvidenceBlocker(launchChecks);
+    const serverBlocker = unmet.find((req) => !(V2_RUNTIME_READINESS_IDS.includes(req.id) || V2_RUNTIME_READINESS_IDS.some(id => READINESS_LEGACY_IDS[id] === req.id)));
+    if (launchBlocker !== null && serverBlocker === undefined) {
+        return {
+            kind: "operator_blocked",
+            id: launchBlocker.id.slice(launchBlocker.id.indexOf(".") + 1),
+            describe: launchBlocker.id === MERGE_CREDENTIAL_ROW
+                ? "a merge credential that has push and can read pull requests"
+                : "an executor clone whose shared git exclude can be prepared",
+            remedy: `${launchBlocker.detail ?? launchBlocker.label}. ${launchBlocker.remediation}`,
+        };
+    }
+    const launchWarnings = launchChecks.filter((check) => check.status === "warn");
     if (unmet.length === 0) {
         // Older deployments have no bring-up block; their existing reconciler
         // liveness predicate remains the available evidence. For deployments that
@@ -323,13 +255,16 @@ export function classifyV2Readiness(readiness, options = {}) {
                 remedy: "Resolve the missing or duplicate reconciler process before launch.",
             };
         }
-        return { kind: "green" };
+        return launchWarnings.length > 0 ? { kind: "green", warnings: launchWarnings } : { kind: "green" };
+    }
+    if (readiness.is_production && (serverBlocker?.id === 'server.worker-present' || unmet.some(req => req.id === 'server.worker-present'))) {
+        return { kind: 'operator_blocked', id: 'service-availability', describe: 'Service availability', remedy: 'Retry readiness before launching.' };
     }
-    const blocker = unmet.find((req) => !V2_RUNTIME_READINESS_IDS.includes(req.id));
+    const blocker = serverBlocker;
     if (blocker) {
         return {
             kind: "operator_blocked",
-            id: blocker.id,
+            id: { "server.indexed-workflows": READINESS_PRE_CREATE_CODES.INDEXED_WORKFLOWS_NOT_MET, "server.unattended-notify-default": READINESS_PRE_CREATE_CODES.ESCALATION_CHANNEL_NOT_MET, "server.test-command": READINESS_PRE_CREATE_CODES.TEST_COMMAND_NOT_MET }[blocker.id] ?? blocker.id,
             describe: blocker.describe,
             ...(() => {
                 const remedy = blocker.remedyFor?.(readiness) ?? blocker.remedy;
@@ -339,157 +274,14 @@ export function classifyV2Readiness(readiness, options = {}) {
     }
     return { kind: "runtime_only", unmetIds: unmet.map((req) => req.id) };
 }
-export function getDriveEpicUsage() {
-    return [
-        "Usage: mcp-server drive-epic [options] <EPIC>",
-        "",
-        "Drives one epic with the conductor this project can actually run. Reads",
-        "conductor readiness from Bridge API and routes to exactly one path — it",
-        "never asks you to choose.",
-        "",
-        "Arguments:",
-        "  <EPIC>                 Jira epic key, matches [A-Z]+-[0-9]+ (e.g. BAPI-885)",
-        "",
-        "Branch strategy (v2): a plan with two or more nodes defaults to a dedicated",
-        "epic/<KEY> branch — child PRs target it, one draft integration PR targets the",
-        "repository base branch. Both flags below only override that default; the",
-        "strategy itself is decided by the bootstrap this command delegates to, never",
-        "here.",
-        "",
-        "Posture (v2, BAPI-1102): a run that selects an epic branch is created",
-        "UNATTENDED by default — it authorizes automatic merge into the epic branch, and",
-        "the server stamps its CI gate at first approval. The INTEGRATION PR into the",
-        "repository base branch stays human-gated. Pass --attended to opt out. An",
-        "unattended run has three repository prerequisites (consent, which is ON by",
-        "default and switched on the Bridge admin panel's Setup page; an escalation",
-        "channel, either a verified notify webhook or the account's email address; and",
-        "confirmed review and CI workflows on the default branch) that readiness lists",
-        "with their state and that are refused BY NAME before any run is created.",
-        "",
-        "Every run gets an executor (BAPI-1279): with --plan-file, once the run is",
-        "created drive-epic starts a RUN-SCOPED EXECUTOR for it in the background, from",
-        "this checkout's Git top level. It claims only that run's jobs, logs to",
-        ".bridge/executors/<run>.log, and exits on its own when the run is done or",
-        "abandoned. Re-running for the same live run starts no second one. A durable",
-        "launch profile starts none: it requires a fresh --repo-wide executor instead.",
-        "Checks that need no run happen FIRST, so a refusal before the run is created",
-        "creates nothing; an executor that fails to start after it leaves the run intact",
-        "and prints the log path and the exact command to start it by hand.",
-        "",
-        "Reconciler liveness is read from the deployment's heartbeat. Against a target",
-        "that is not this machine's plane (production, say), drive-epic never touches a",
-        "local plane: a target with no live reconciler is refused by name.",
-        "",
-        "One command (BAPI-1054, reordered by BAPI-1102): with --plan-file, drive-epic",
-        "starts the conductor runtime for you against the local plane endpoint, when",
-        "readiness is missing ONLY the reconciler. It brings up the CONTROL PLANE first",
-        "(server and reconciler), creates and approves the run, then starts executor lanes",
-        "SCOPED to that run, and starts the dead-man observer last — one invocation, no",
-        "manual `plane up` first. A report missing supervisor setup,",
-        "supervisor configuration, GitHub App credentials, or an unattended prerequisite",
-        "is NOT started: those are operator-owned, and drive-epic exits with that one",
-        "named reason instead.",
-        "",
-        "The plane port (BAPI-1153): with --plan-file and BAPI_BASE_URL naming the",
-        `local plane endpoint (127.0.0.1, port ${PLANE_SERVER_PORT_ENV_VAR} or the default),`,
-        "drive-epic handles the port one of three ways, and never asks you to choose:",
-        "  - cold start: nothing listens there — it brings the plane up, then creates",
-        "    the run;",
-        "  - attach: this repository's own healthy plane is there — it creates the run",
-        "    against that plane and starts NO second server or reconciler;",
-        "  - refusal: anything else holds the port (another listener, a manifest for a",
-        "    different repository, an unreadable manifest, a plane that cannot take a",
-        "    run) — one named reason, and nothing is started.",
-        "One epic per plane — for its LANES: a plane's lanes serve the one run it is",
-        "bound to. A second run attaches to the same plane's reconciler and gets its own",
-        "run-scoped executor instead. A plane whose bound run cannot be read is refused",
-        "as plane-already-bound. Concurrent planes on one database are not supported.",
-        "Executor lanes and run-scoped executors are always scoped to the one run with",
-        "--epic-run-id, on every path.",
-        "",
-        "Finding the plan (BAPI-1285): without --plan-file, drive-epic searches",
-        "{docs_dir}/epic-plans/*/epic-plan.meta.json for a file naming this epic",
-        "({\"epic_key\": \"<KEY>\"}), where docs_dir is BAPI_DOCS_DIR or docs/tmp",
-        "resolved against the Git top level. Exactly one match with a sibling",
-        "epic-plan.dag.json is used as if you had passed --plan-file, and its path is",
-        "printed before anything is created. It never guesses: no match, two or more",
-        "matches, or an unusable meta file stops with the paths it found and creates",
-        "nothing. It never matches by folder name, child ticket key, or manifest. A",
-        "supplied --plan-file always wins, and discovery does not run. The meta file is",
-        "written by `emit-epic-implementer-bundle finalize`; a plan finalized before",
-        "that has none, so pass its DAG with --plan-file.",
-        "",
-        "A live run with no plan: when the epic already has a live run and no plan was",
-        "supplied or found, drive-epic does not create anything. It makes sure that run",
-        "has an executor (reusing a live one, never starting a second) and reports it. A",
-        "durable launch profile starts none and relies on its host's confirmed repo-wide",
-        "executor; a plane already bound to the run needs none. An epic with several active runs, or",
-        "a run that cannot be read, is refused by name.",
-        "",
-        "Preconditions are validated, never repaired: the current directory must be a Git",
-        "work tree inside the target repository, because the run's executor starts there.",
-        "No worktree is created for you and no replacement port is chosen for you — each",
-        "failure names the fix. Fix it and rerun.",
-        "",
-        "Options:",
-        "  --plan-file <path>     Plan DAG sidecar. Optional: without it, drive-epic finds",
-        "                         the plan by epic key (see above). A supplied path always",
-        "                         wins, and when the v2 path is selected drive-epic runs",
-        "                         the bootstrap directly with it.",
-        "  --repo <name>          Repo name (default: BAPI_REPO_NAME or .bridge/config)",
-        "  --feature-branch <name>  Override the derived epic/<KEY> name. Forwarded",
-        "                         verbatim, never interpreted here.",
-        "  --into-base            OPT OUT of the epic-branch default: children target the",
-        "                         repository base branch (the pre-BAPI-1009 behavior).",
-        "                         Contradictory with --feature-branch; passing both is a",
-        "                         parse error.",
-        "  --attended             OPT OUT of the unattended default. Forwarded verbatim to",
-        "                         the bootstrap, which owns what it composes; drive-epic",
-        "                         reads it only to skip the unattended prerequisites.",
-        "",
-        "Policy (forwarded verbatim; drive-epic interprets none of it):",
-        "  --policy-file <path>   JSON file holding the COMPLETE run policy.",
-        "  --review-policy <src>  PER-RUN review policy source.",
-        "  --replace-policy       Authorize replacing a LIVE run's stored policy.",
-        "",
-        "Launch target (BAPI-1260) — decided BEFORE any authenticated request:",
-        "  --launch-profile <name>  Select the host-local launch profile guided setup",
-        "                         approved (`install conductor --launch-profile <name>`):",
-        "                         target, repository, mode, runtime, and policy and",
-        "                         credential references. Useful for a local or other",
-        "                         non-production server and for durable hosts.",
-        "  --base-url <url>       Explicit Bridge API target. With a profile it must",
-        "                         agree with it — an override never rebinds a profile.",
-        "BAPI_EPIC_LAUNCH_PROFILE selects a host-local launch profile for epic",
-        "launches. --launch-profile takes precedence. For an environment-selected",
-        "profile, BAPI_BASE_URL remains the general CLI endpoint and does not",
-        "conflict with the epic launch target; --base-url still must agree.",
-        "Without either, BAPI_BASE_URL is used. With none of the three, drive-epic",
-        `targets production (${CONDUCTOR_DEFAULT_BASE_URL}) and uses the`,
-        "stored bapi:<repo> key when one is available. A stored key approved for a",
-        "different endpoint is never sent; an unapproved key is sent only to",
-        "production.",
-        "",
-        "Preview (BAPI-1285):",
-        "  --dry-run              Read-only launch preview. Resolves the target, reads",
-        "                         readiness and the epic's live run, discovers the plan,",
-        "                         and runs the bootstrap's own dry-run validation. It",
-        "                         reports what a real run WOULD do (create, attach,",
-        "                         refuse, or stop) and never creates a run, cuts a",
-        "                         branch, starts a plane, requests a lane, or starts or",
-        "                         signals an executor. Exit 0 for create or attach, 1 for",
-        "                         refuse or stop.",
-        "  --json                 With --dry-run only: print exactly one JSON document on",
-        "                         stdout and nothing else. Alone, it is a parse error.",
-        "",
-        "  -h, --help             Show this help",
-    ].join("\n");
-}
 /**
  * Parse argv. Rejects malformed input BEFORE any side effect — no readiness
  * read, no credential resolution, no delegation.
  */
 export function parseDriveEpicArgs(argv) {
+    if (argv.includes("--help-advanced")) {
+        return { status: "help", usage: getDriveEpicAdvancedUsage() };
+    }
     if (argv.includes("-h") || argv.includes("--help")) {
         return { status: "help", usage: getDriveEpicUsage() };
     }
@@ -528,8 +320,46 @@ export function parseDriveEpicArgs(argv) {
     // BAPI-1285 preview flags. Valueless; `--json` is meaningless without `--dry-run`.
     let dryRun = false;
     let json = false;
+    let all = false;
+    let allowStalePlane = false;
+    // BAPI-1496 — verification hand-off pass-throughs. Captured, never interpreted:
+    // setup-epic owns the vocabulary, the pairing rules, and the policy keys.
+    let verificationHandoff;
+    const verificationHandoffExceptions = [];
+    // BAPI-1510 — drive-only already-merged child controls. Never reach setup argv.
+    const keepChildren = [];
+    const skipChildren = [];
+    let noMergedCheck = false;
     for (let i = 0; i < argv.length; i++) {
         const arg = argv[i];
+        if (arg === "--all") {
+            all = true;
+            continue;
+        }
+        if (arg === "--no-merged-check") {
+            noMergedCheck = true;
+            continue;
+        }
+        if (arg === "--keep-child" || arg === "--skip-child") {
+            const value = argv[i + 1];
+            if (value === undefined || value.startsWith("-")) {
+                return { status: "error", message: `${arg} requires a ticket key.` };
+            }
+            if (!EPIC_KEY_PATTERN.test(value)) {
+                return { status: "error", message: `${arg} requires a ticket key like PROJ-123, got '${value}'.` };
+            }
+            (arg === "--keep-child" ? keepChildren : skipChildren).push(value);
+            i++;
+            continue;
+        }
+        const childEq = arg.match(/^(--keep-child|--skip-child)=(.*)$/);
+        if (childEq) {
+            if (!EPIC_KEY_PATTERN.test(childEq[2])) {
+                return { status: "error", message: `${childEq[1]} requires a ticket key like PROJ-123, got '${childEq[2]}'.` };
+            }
+            (childEq[1] === "--keep-child" ? keepChildren : skipChildren).push(childEq[2]);
+            continue;
+        }
         if (arg === "--dry-run") {
             dryRun = true;
             continue;
@@ -542,6 +372,11 @@ export function parseDriveEpicArgs(argv) {
             intoBase = true;
             continue;
         }
+        // BAPI-1476 — valueless, invocation-only, and never forwarded to setup-epic.
+        if (arg === "--allow-stale-plane") {
+            allowStalePlane = true;
+            continue;
+        }
         // BAPI-1102 — valueless, forwarded verbatim, and interpreted here for
         // exactly one thing: making the unattended readiness prerequisites
         // inapplicable. drive-epic reads no policy.
@@ -553,6 +388,29 @@ export function parseDriveEpicArgs(argv) {
             replacePolicy = true;
             continue;
         }
+        if (arg === "--verification-handoff" || arg === "--verification-handoff-exception") {
+            const value = argv[i + 1];
+            if (value === undefined || value.startsWith("-")) {
+                return { status: "error", message: `${arg} requires a value.` };
+            }
+            if (arg === "--verification-handoff")
+                verificationHandoff = value;
+            else
+                verificationHandoffExceptions.push(value);
+            i++;
+            continue;
+        }
+        const handoffEq = arg.match(/^(--verification-handoff|--verification-handoff-exception)=(.*)$/);
+        if (handoffEq) {
+            if (handoffEq[2].trim().length === 0) {
+                return { status: "error", message: `${handoffEq[1]} requires a value.` };
+            }
+            if (handoffEq[1] === "--verification-handoff")
+                verificationHandoff = handoffEq[2];
+            else
+                verificationHandoffExceptions.push(handoffEq[2]);
+            continue;
+        }
         if (arg === "--plan-file" ||
             arg === "--repo" ||
             arg === "--feature-branch" ||
@@ -628,6 +486,22 @@ export function parseDriveEpicArgs(argv) {
                 "form of the read-only launch preview, and a real launch has no JSON output.",
         };
     }
+    // BAPI-1510 — contradictory child intent is refused before any file read or launch.
+    const overlap = keepChildren.filter((key) => skipChildren.includes(key));
+    if (overlap.length > 0) {
+        return {
+            status: "error",
+            message: `${overlap[0]} is named by both --keep-child and --skip-child. ` +
+                "Keep it (run it) or skip it, not both.",
+        };
+    }
+    if (noMergedCheck && skipChildren.length > 0) {
+        return {
+            status: "error",
+            message: "--no-merged-check turns off the already-merged check, but --skip-child needs " +
+                "that check to confirm the child is merged. Remove one of them.",
+        };
+    }
     // BAPI-1009: refused HERE — before access resolution, before the readiness
     // request, and before any delegation — with the same corrective wording
     // setup-epic uses, so the two entry points explain one mistake one way.
@@ -670,7 +544,7 @@ export function parseDriveEpicArgs(argv) {
     }
     const epicKey = positionals[0];
     if (!EPIC_KEY_PATTERN.test(epicKey)) {
-        return { status: "error", message: `Malformed epic key '${epicKey}'. Expected e.g. BAPI-885.` };
+        return { status: "error", message: `Malformed epic key '${epicKey}'. Expected e.g. PROJ-885.` };
     }
     const options = {
         epicKey,
@@ -685,8 +559,15 @@ export function parseDriveEpicArgs(argv) {
         ...(replacePolicy ? { replacePolicy: true } : {}),
         ...(launchProfile ? { launchProfile } : {}),
         ...(baseUrl ? { baseUrl } : {}),
+        ...(all ? { all: true } : {}),
         ...(dryRun ? { dryRun: true } : {}),
         ...(json ? { json: true } : {}),
+        ...(allowStalePlane ? { allowStalePlane: true } : {}),
+        ...(verificationHandoff !== undefined ? { verificationHandoff } : {}),
+        ...(verificationHandoffExceptions.length > 0 ? { verificationHandoffExceptions } : {}),
+        ...(keepChildren.length > 0 ? { keepChildren: [...new Set(keepChildren)] } : {}),
+        ...(skipChildren.length > 0 ? { skipChildren: [...new Set(skipChildren)] } : {}),
+        ...(noMergedCheck ? { noMergedCheck: true } : {}),
     };
     return { status: "ok", options };
 }
@@ -718,7 +599,7 @@ export function selectConductor(readiness) {
         return {
             kind: "selected",
             conductor: DRIVE_EPIC_PREFERRED_CONDUCTOR,
-            reason: "conductor readiness is green",
+            reason: "Epic Implementer readiness is green",
         };
     }
     return {
@@ -739,7 +620,7 @@ export function selectConductor(readiness) {
  * no quoting to get wrong.
  */
 export function buildSetupEpicArgv(options) {
-    const { epicKey, planFile, repo, featureBranch, intoBase, attended, policyFile, reviewPolicy, replacePolicy, launchProfile, baseUrl, } = options;
+    const { epicKey, planFile, repo, featureBranch, intoBase, attended, policyFile, reviewPolicy, replacePolicy, launchProfile, baseUrl, verificationHandoff, verificationHandoffExceptions, } = options;
     return [
         "--epic-key",
         epicKey,
@@ -760,17 +641,26 @@ export function buildSetupEpicArgv(options) {
         // the adopted BAPI_BASE_URL instead.
         ...(launchProfile ? ["--launch-profile", launchProfile] : []),
         ...(baseUrl ? ["--base-url", baseUrl] : []),
+        // BAPI-1496 — the owner's verification hand-off choice, verbatim and only
+        // when supplied, so every pre-existing argv stays byte-identical.
+        ...(verificationHandoff !== undefined ? ["--verification-handoff", verificationHandoff] : []),
+        ...(verificationHandoffExceptions ?? []).flatMap((entry) => ["--verification-handoff-exception", entry]),
     ];
 }
 /**
  * Render the no-plan stop: what discovery found, how to make a plan, and how to
  * re-run with one.
  *
- * Precondition: the caller has already ruled out delegation, a not-ready result,
- * AND a live run. This runs only after plan discovery came back empty or
+ * Normal precondition: the caller has already ruled out delegation, a not-ready
+ * result, AND a live run. This runs only after plan discovery came back empty or
  * ambiguous (BAPI-1285), so it never claims "nothing derives a plan from an epic
  * key" — something does, and it names exactly what it found.
  *
+ * The `plane_not_running` presentation is the exception to that precondition:
+ * the local plane refused connections, so readiness was never read and whether a
+ * run for this epic is already live is UNCHECKED. It says so, and tells the
+ * operator how to attach.
+ *
  * It offers two ways to re-run and only one of them is a runnable `drive-epic`
  * command: `/drive-epic-run` is a session slash command, not a second conductor.
  */
@@ -787,7 +677,20 @@ launch = { profile: null },
  * BAPI-1285 — what discovery found. Absent reads as "no metadata named this
  * epic", with the searched directory left as its placeholder.
  */
-discovery) {
+discovery, presentation = "default") {
+    // BAPI-1496 — an owner's explicit verification hand-off choice survives the
+    // re-run command verbatim. Nothing is derived: no flag, no flag added.
+    const handoffSuffix = [
+        ...(launch.options?.verificationHandoff !== undefined
+            ? ["--verification-handoff", launch.options.verificationHandoff]
+            : []),
+        ...(launch.options?.verificationHandoffExceptions ?? []).flatMap((entry) => [
+            "--verification-handoff-exception",
+            entry,
+        ]),
+    ]
+        .map((part) => ` ${shellQuote(part)}`)
+        .join("");
     const invocation = launch.profile !== null
         ? renderEpicLaunchCommand(launch.profile, {
             epicKey,
@@ -796,8 +699,8 @@ discovery) {
             ...(launch.options?.attended ? { attended: true } : {}),
             ...(launch.options?.intoBase ? { intoBase: true } : {}),
             ...(launch.options?.featureBranch ? { featureBranch: launch.options.featureBranch } : {}),
-        }).replace(`${shellQuote("<path>")}`, "<path>")
-        : `npx -y ${MCP_PACKAGE_NAME} drive-epic ${epicKey} --plan-file <path>`;
+        }).replace(`${shellQuote("<path>")}`, "<path>") + handoffSuffix
+        : `npx -y ${MCP_PACKAGE_NAME} drive-epic ${epicKey} --plan-file <path>${handoffSuffix}`;
     const plansDir = discovery?.epic_plans_dir ?? "{docs_dir}/epic-plans";
     const outcome = discovery?.status === "plan_ambiguous"
         ? [
@@ -809,7 +712,7 @@ discovery) {
     const skipped = discovery !== undefined && discovery.skipped.length > 0
         ? [
             "",
-            "These metadata files could not be used, so they were not counted:",
+            "These plan metadata files were missing or could not be used, so they were not counted:",
             ...discovery.skipped.map((entry) => `  - ${entry.path} (${entry.reason})`),
         ]
         : [];
@@ -817,7 +720,9 @@ discovery) {
         conductor: "v2",
         invocation,
         lines: [
-            `${epicKey}: ${selection.reason}, but no plan was supplied and none could be selected.`,
+            presentation === "plane_not_running"
+                ? `${epicKey}: readiness could not be checked because the local plane is not running and no usable plan could be selected.`
+                : `${epicKey}: ${selection.reason}, but no plan was supplied and none could be selected.`,
             "",
             ...outcome,
             ...skipped,
@@ -832,19 +737,42 @@ discovery) {
             "",
             `  1. To make one, run /plan-epic ${epicKey} in an interactive session. It writes the`,
             "     sidecar to {docs_dir}/epic-plans/{epic_slug}/epic-plan.dag.json.",
-            "     If the epic's tickets already exist, run emit-epic-implementer-bundle",
-            "     finalize instead — it resolves the placeholder keys in an existing",
-            "     sidecar, attaches touched_files, and writes epic-plan.meta.json so the",
-            "     plan is found next time.",
+            "     For an existing /plan-epic sidecar that has the required bundle inputs and",
+            "     whose tickets already exist, run emit-epic-implementer-bundle finalize",
+            "     instead — it resolves the placeholder keys, attaches touched_files, and",
+            "     writes epic-plan.meta.json so the plan is found next time.",
+            "     A folder produced by /define-tickets holds a DAG but no metadata file. Use it",
+            "     directly with --plan-file <that folder's epic-plan.dag.json>.",
             "",
             `  2. Re-run with the plan, in a session: /drive-epic-run ${epicKey} <plan path>`,
             `     or from a shell: ${invocation}`,
             "",
             `That shell command bootstraps the run for you; ${SETUP_EPIC_SUBCOMMAND} is not`,
             "something you invoke directly.",
+            ...(presentation === "plane_not_running"
+                ? ["", PLANE_DOWN_LIVE_RUN_CAVEAT]
+                : []),
         ],
     };
 }
+/** Appended to the plane-not-running handoff: live-run existence was not checked. */
+const PLANE_DOWN_LIVE_RUN_CAVEAT = "If a run for this epic is already live, bring its plane up and preview again to attach.";
+/** Placeholder selection for the plane-down stop: readiness was never read. */
+const PLANE_DOWN_SELECTION = {
+    kind: "selected",
+    conductor: DRIVE_EPIC_PREFERRED_CONDUCTOR,
+    reason: "readiness was not checked",
+};
+/**
+ * The one text both the preview and a real launch print for the guarded
+ * plane-down no-plan stop, so the preview is a verbatim part of the real output.
+ */
+function planeDownNoPlanStopText(epicKey, launch, discovery) {
+    const text = renderConductorHandoff(PLANE_DOWN_SELECTION, epicKey, launch, discovery, "plane_not_running")
+        .lines.join("\n");
+    assertSingleConductorInvocation(text);
+    return text;
+}
 /**
  * Tokens that identify a conductor path in user-facing output. Used by the
  * output guard and by its test — one list, so a new spelling cannot be added to
@@ -864,7 +792,7 @@ const SETUP_EPIC_SUBCOMMAND = CONDUCTOR_INVOCATION_TOKENS[0];
 export function assertSingleConductorInvocation(text) {
     const named = CONDUCTOR_INVOCATION_TOKENS.filter((token) => text.includes(token));
     if (named.length > 1) {
-        throw new Error(`drive-epic emitted more than one conductor invocation (${named.join(", ")}). ` +
+        throw new Error(`drive-epic emitted more than one launch path (${named.join(", ")}). ` +
             "Exactly one path may ever be presented.");
     }
     // BAPI-1260 — the entry point itself, too. A rendered handoff now carries a
@@ -1120,6 +1048,9 @@ function createDefaultPlanDiscoveryFs() {
 export async function readLiveEpicRunByKey(access, epicKey, fetchImpl = globalThis.fetch) {
     try {
         const state = await fetchEpicRunState(access, epicKey, fetchImpl);
+        // The same response's engine-reported channel facts; read here so attach,
+        // preview and setup never re-derive a channel from the redacted policy.
+        const notificationSink = state?.notification_sink;
         const run = state
             ?.epic_run;
         if (typeof run?.epic_run_id !== "string" ||
@@ -1131,8 +1062,9 @@ export async function readLiveEpicRunByKey(access, epicKey, fetchImpl = globalTh
             kind: "live",
             epicRunId: run.epic_run_id,
             status: run.status,
+            ticketReview: ticketReviewSummary(run.ticket_review),
             ...(run.policy_json !== undefined
-                ? { effectivePolicy: effectivePolicyFacts(run.policy_json, "stored") }
+                ? { effectivePolicy: effectivePolicyFacts(run.policy_json, "stored", notificationSink) }
                 : {}),
         };
     }
@@ -1191,6 +1123,25 @@ export function createDefaultDriveEpicDeps() {
         cwd: () => process.cwd(),
         resolvePlaneEndpoint: () => resolvePlaneServerEndpoint(process.env),
         probePlanePort: (host, port) => probeTcpPort(host, port, PLANE_PORT_PROBE_TIMEOUT_MS),
+        checkExecutorBuildFreshness: (repoRoot) => checkPlaneBuildFreshness(repoRoot, { fs: createPlaneFsDeps() }),
+        collectPlaneFreshness: ({ repoRoot, ownsManifest, expectedPlaneId }) => checkPlaneFreshness(repoRoot, {
+            execFile: createPlaneExecFile(),
+            fileExists: (filePath) => fsStat(filePath).then((entry) => entry.isFile(), () => false),
+            platform: process.platform,
+            readPlaneManifest: (root) => readPlaneManifest(root, createPlaneFsDeps()),
+        }, repoRoot, { ownsManifest, ...(expectedPlaneId !== undefined ? { expectedPlaneId } : {}) }),
+        inspectHostSleep: (repoRoot) => inspectHostSleep(repoRoot, { execFile: createPlaneExecFile(), platform: process.platform }),
+        inspectRequiredRunners: ({ repoRoot, providerRepository, gateProfile }) => inspectRequiredSelfHostedRunners({
+            repoRoot,
+            providerRepository,
+            gateProfile,
+            execFile: createPlaneExecFile(),
+            workflows: createWorkflowSource(),
+        }),
+        inspectEpicBranchBehind: ({ repoRoot, branch, baseBranch }) => inspectEpicBranchBehindBase({ repoRoot, branch, baseBranch, execFile: createPlaneExecFile() }),
+        fetchUsageAdvisory: (access) => fetchRepositoryUsageAdvisory(access),
+        inspectWorkerDatabase: createWorkerDatabaseDoctorInspector({ env: process.env, cwd: process.cwd() }),
+        cleanupTerminalRunPlane: (input) => cleanupTerminalRunPlane(input, createTerminalRunCleanupDeps(process.env)),
         readRunState: async (access, epicRunId) => {
             const state = await fetchEpicRunState(access, epicRunId, globalThis.fetch);
             const run = state.epic_run;
@@ -1242,8 +1193,28 @@ export function createDefaultDriveEpicDeps() {
         // preview must not call.
         inspectRunExecutorPrecondition: async (cwd) => {
             const result = await prepareRunExecutorDefault(cwd, createDefaultRunExecutorLaunchDeps());
-            return result.ok ? { ok: true } : { ok: false, message: result.message };
+            // BAPI-1452: the Git top level rides along so the dry run can inspect the
+            // same clone a real launch would, without ever preparing it.
+            return result.ok
+                ? { ok: true, repoRoot: result.prepared.repoRoot }
+                : { ok: false, message: result.message };
         },
+        probeLaunchMergeCredential: (args) => probeLocalMergeCapability(args),
+        // BAPI-1461: the local executor this launch starts runs in the person's own
+        // session, so its credential may come from the repository's stored entry.
+        resolveLaunchMergeCredential: ({ kind, repository }) => resolveMergeCredentialAtAction(process.env, kind, {
+            allowStoredEntry: true,
+            providerRepository: repository,
+            storeDeps: nodeGithubMergeCredentialReadDeps(process.env),
+        }),
+        launchReadinessLog: (message) => console.error(message),
+        // Read-only filesystem boundary: `readFile`, `stat`, and a W_OK `access`
+        // check. Nothing here can create or write the exclude.
+        inspectWorktreeExclude: (repoRoot) => resolveWorktreeSettingsExclude(repoRoot, {
+            readFile: (filePath) => readFile(filePath, "utf8"),
+            stat: async (filePath) => ({ mode: (await fsStat(filePath)).mode }),
+            accessWritable: (target) => fsAccess(target, fsConstants.W_OK),
+        }),
         prepareRunExecutor: (cwd) => prepareRunExecutorDefault(cwd, createDefaultRunExecutorLaunchDeps()),
         ensureRunExecutor: (args) => ensureRunExecutorDefault(args, createDefaultRunExecutorLaunchDeps()),
         // stdout is safe here: `drive-epic` is dispatched BEFORE MCP server
@@ -1292,7 +1263,7 @@ export async function runDriveEpicCli(argv, overrides = {}) {
         // child processes' BAPI_BASE_URL.
         const accessResult = await deps.resolveAccess(repo, undefined, launch);
         if (!accessResult.ok) {
-            return escalate(deps, epicKey, `conductor readiness could not be read: ${accessResult.error}`);
+            return escalate(deps, epicKey, `Epic Implementer readiness could not be read: ${accessResult.error}`);
         }
         const launchProfile = accessResult.profile ?? null;
         deps.adoptLaunchTarget?.(accessResult.access.baseUrl);
@@ -1310,6 +1281,8 @@ export async function runDriveEpicCli(argv, overrides = {}) {
             access: accessResult.access,
             profile: launchProfile,
             targetSource: accessResult.targetSource ?? "default",
+            freshness: createPlaneFreshnessCache(),
+            launchCredential: {},
         };
         // BAPI-1285 — with no `--plan-file`, look for the plan BEFORE readiness. A
         // discovered plan must count as a supplied one for the BAPI-1153 cold-start
@@ -1320,11 +1293,16 @@ export async function runDriveEpicCli(argv, overrides = {}) {
         // escalates exactly as before, and the live-run read stays after readiness.
         let discovered = null;
         let docsRootUnresolved = false;
+        // BAPI-1532 — whether the effective plan was FOUND rather than supplied. A
+        // discovered plan is a convenience, not approved input: it may still be used to
+        // create a run, but a live run is attached to first and the plan stays unused.
+        let planWasDiscovered = false;
         if (planFile === undefined) {
             const docs = await deps.resolveDocsDir();
             if (docs.ok) {
                 discovered = await discoverEpicPlan(epicKey, docs.docsDir, deps.discoveryFs);
                 if (discovered.status === "found") {
+                    planWasDiscovered = true;
                     ctx = { ...ctx, options: { ...ctx.options, planFile: discovered.path } };
                 }
             }
@@ -1348,6 +1326,10 @@ export async function runDriveEpicCli(argv, overrides = {}) {
             readiness = await deps.readReadiness(accessResult.access);
         }
         catch (err) {
+            // BAPI-1455 — a proven-incompatible local schema is a terminal refusal,
+            // not an unknown: the server read the catalog and named what is missing.
+            if (isSchemaIncompatibleError(err))
+                return refuse(deps, formatSchemaIncompatibleRefusal(epicKey, err));
             // BAPI-1153 — the cold-start case. With a plan file, a readiness read that
             // failed at the TRANSPORT against the plane's own endpoint, on a port that
             // actively refuses connections, is not "unknown": it is "no server yet".
@@ -1376,9 +1358,33 @@ export async function runDriveEpicCli(argv, overrides = {}) {
                     }
                 }
             }
-            return escalate(deps, epicKey, `conductor readiness could not be read: ${safeDiagnosticMessage(err, "readiness request failed")}`);
+            // The narrow no-plan stop: a local, non-durable plane that refuses
+            // connections, with no usable plan supplied or discovered. Readiness was
+            // never read, so this is the existing stop outcome — not a new refusal.
+            // Nothing is started or created.
+            if (ctx.options.planFile === undefined &&
+                planeTarget &&
+                err instanceof ConductorBridgeApiError &&
+                err.kind === "network" &&
+                launchProfile?.executionMode !== "durable" &&
+                discovered !== null &&
+                (discovered.status === "plan_not_found" || discovered.status === "plan_ambiguous")) {
+                const endpoint = planeEndpointForBaseUrl(deps, accessResult.access.baseUrl);
+                if (endpoint !== null) {
+                    const probe = await deps.probePlanePort(endpoint.host, endpoint.port).catch(() => ({ kind: "error" }));
+                    if (probe.kind === "refused") {
+                        deps.errorLog(planeDownNoPlanStopText(epicKey, { profile: launchProfile, options: parsed.options }, discovered));
+                        return 1;
+                    }
+                }
+            }
+            return escalate(deps, epicKey, `Epic Implementer readiness could not be read: ${safeDiagnosticMessage(err, "readiness request failed")}`);
         }
-        if (ctx.options.planFile !== undefined) {
+        // BAPI-1532 — an EXPLICIT plan selects its setup now. A discovered plan does
+        // not: plan selection, approval, and the create-time escalation-channel checks
+        // run only on the create path, after the live-run read below, so attaching to a
+        // live run never depends on them.
+        if (ctx.options.planFile !== undefined && !planWasDiscovered) {
             const prepared = await prepareSetupSelection(ctx);
             if (!prepared.ok) {
                 return refuse(deps, [
@@ -1417,8 +1423,24 @@ export async function runDriveEpicCli(argv, overrides = {}) {
             if (live.kind === "unknown")
                 return refuse(deps, liveRunUnknownRefusal(epicKey, live.reason).lines);
             if (discovered.status === "found") {
-                // The plan was folded into `ctx.options` before readiness; from here it is
-                // indistinguishable from a supplied `--plan-file`.
+                if (live.kind === "live") {
+                    // BAPI-1532 — attach FIRST. The discovered plan is dropped from the
+                    // effective options, so nothing below can treat it as approved input,
+                    // and the local file is left untouched.
+                    const { planFile: _unusedDiscoveredPlan, ...attachOptions } = ctx.options;
+                    return await attachToLiveRun({ ...ctx, options: attachOptions }, readiness, live, discovered.path);
+                }
+                // The create path: setup selection runs now. The plan was folded into
+                // `ctx.options` before readiness; from here it is indistinguishable from
+                // a supplied `--plan-file`.
+                const prepared = await prepareSetupSelection(ctx);
+                if (!prepared.ok) {
+                    return refuse(deps, [
+                        `${epicKey}: REFUSED (${prepared.reasonId}) — the selected run or policy could not be verified.`,
+                        "Nothing was created or started.",
+                    ]);
+                }
+                ctx = { ...ctx, handoff: prepared.handoff };
                 await announceFoundPlan();
             }
             else if (live.kind === "live") {
@@ -1461,10 +1483,33 @@ export async function runDriveEpicCli(argv, overrides = {}) {
                 // Otherwise — no plane here, or one owned by a sibling worktree — the
                 // run gets a run-scoped executor. The preflight runs only when a
                 // manifest says there is a plane in this checkout to attach to.
+                // BAPI-1496: a plane bound to a finished run is torn down BEFORE it can
+                // be attached to. Once it is gone, nothing serves this endpoint, so the
+                // launch cold-starts a fresh plane rather than creating against the
+                // stopped API or trusting the readiness read from it.
+                const cleaned = await cleanUpTerminalRunPlane(ctx, deps.cwd());
+                if (cleaned?.kind === "completed") {
+                    const endpoint = planeEndpointForBaseUrl(deps, ctx.access.baseUrl);
+                    const probe = endpoint
+                        ? await deps.probePlanePort(endpoint.host, endpoint.port).catch(() => ({ kind: "error" }))
+                        : null;
+                    if (probe?.kind === "refused")
+                        return await coldStartPlane(ctx);
+                }
                 const attachable = await findAttachablePlane(ctx);
                 if (attachable !== null) {
                     return await attachToPlane(ctx, attachable, readiness);
                 }
+                // BAPI-1476: no manifest in this checkout belongs to the plane serving the
+                // endpoint (a sibling worktree's, or none), so the snapshot is unverified
+                // here; the database check still runs. Decided before setup-epic.
+                const staleSibling = await planeFreshnessCreateGuard(ctx, {
+                    repoRoot: deps.cwd(),
+                    ownsManifest: false,
+                });
+                if (staleSibling !== null)
+                    return staleSibling;
+                await surfaceWorkerDatabaseAdvisory(ctx);
                 return await createRunWithRunExecutor(ctx, readiness);
             }
             // Operator-blocked: ONE named reason, and nothing is started. `plane up`
@@ -1472,8 +1517,7 @@ export async function runDriveEpicCli(argv, overrides = {}) {
             // so bringing it up would leave a running plane behind and change nothing.
             if (classification.kind === "operator_blocked") {
                 const refusal = [
-                    `${epicKey}: the engine path still needs ${classification.describe} ` +
-                        `(${classification.id}).`,
+                    `${epicKey}: the engine path still needs ${classification.describe}.`,
                     "",
                     "This is not something starting the runtime can fix, so nothing was started.",
                     // The requirement's OWN remedy when it has one. Telling an operator to
@@ -1497,6 +1541,8 @@ export async function runDriveEpicCli(argv, overrides = {}) {
             }
             // Runtime-only: this invocation composes bring-up with run creation.
             const repoRoot = deps.cwd();
+            // BAPI-1496: a plane bound to a finished run is torn down before preflight.
+            await cleanUpTerminalRunPlane(ctx, repoRoot);
             const preflight = await deps.runPlanePreflight(repoRoot);
             // BAPI-1153 — ATTACH. A port serving this repository's own live, healthy
             // plane is not a blocker when the Bridge API this command talks to IS that
@@ -1517,7 +1563,7 @@ export async function runDriveEpicCli(argv, overrides = {}) {
             });
             if (precondition) {
                 const lines = [
-                    `${epicKey}: cannot start the conductor runtime — ${precondition.check} failed.`,
+                    `${epicKey}: cannot start the Epic Implementer runtime — ${precondition.check} failed.`,
                     formatPlaneDiagnostic(precondition),
                 ];
                 // BAPI-1153: an occupied port names WHICH kind of occupant it is and its
@@ -1548,7 +1594,7 @@ export async function runDriveEpicCli(argv, overrides = {}) {
             // The new order is the only one that can work: the server has to be up
             // before a run can be created, and the run has to exist before a lane can
             // be scoped to it.
-            deps.log(`${epicKey}: the conductor runtime is not live; starting its control plane before creating the run.`);
+            deps.log(`${epicKey}: the Epic Implementer runtime is not live; starting its control plane before creating the run.`);
             // The SAME preflight result is handed to the launch, so the port that was
             // probed is the port that gets launched and the two cannot disagree.
             const controlPlane = await deps.launchControlPlane({ preflight, executors: 1 });
@@ -1562,6 +1608,12 @@ export async function runDriveEpicCli(argv, overrides = {}) {
             // the detached runtime is its own process-group leader and outlives us by
             // design, which is what "the plane is left running" means.
             void controlPlane.lifetime.catch(() => undefined);
+            // BAPI-1476: the plane this invocation just started, checked before any
+            // setup or run-create. A refusal leaves the plane running and says so.
+            const staleLaunched = await planeFreshnessCreateGuard(ctx, { repoRoot, ownsManifest: true, planeId: controlPlane.planeId }, LAUNCHED_PLANE_LEFT_RUNNING);
+            if (staleLaunched !== null)
+                return staleLaunched;
+            await surfaceWorkerDatabaseAdvisory(ctx);
             // Readiness is NOT re-read as a gate here. A successful bring-up IS the
             // runtime fact: the launch already waited for this plane's own reconciler
             // heartbeat. (`reconciler_live` now reads the deployment heartbeat, but the
@@ -1573,7 +1625,7 @@ export async function runDriveEpicCli(argv, overrides = {}) {
                 repoRoot,
                 planeId: controlPlane.planeId,
                 awaitPlaneReady: controlPlane.awaitPlaneReady,
-            });
+            }, readiness);
         }
         // No plan file, and readiness is not green: v2 is not ready and there is no
         // second conductor to offer. Report it as a not-ready refusal on stderr with
@@ -1583,8 +1635,9 @@ export async function runDriveEpicCli(argv, overrides = {}) {
                 `${epicKey}: ${selection.reason}.`,
                 "",
                 "The v2 engine is not ready to drive this epic, and there is no alternative",
-                "conductor to fall back to. Resolve conductor readiness (`install-bridge",
-                "conductor`, then `doctor`) and run drive-epic again.",
+                "engine to fall back to. Resolve Epic Implementer readiness (`install conductor`,",
+                "then `doctor`) and run drive-epic again.",
+                `See ${CONSUMER_GUIDE_POINTER}.`,
             ].join("\n");
             assertSingleConductorInvocation(refusal);
             deps.errorLog(refusal);
@@ -1633,7 +1686,7 @@ async function surfaceContainmentAdvisory(deps, planFile) {
  * A constant so the preview's `readiness.remedy` is the very line the real
  * refusal prints, not a second copy that can drift.
  */
-const ESCALATE_REMEDY = "Restore Bridge API access and run drive-epic again, or ask an operator to resolve conductor readiness.";
+const ESCALATE_REMEDY = "Restore Bridge API access and run drive-epic again, or ask an operator to resolve Epic Implementer readiness.";
 /** The reason id the preview reports for an unknown readiness read. */
 const READINESS_UNKNOWN_REASON_ID = "readiness-unknown";
 /**
@@ -1642,8 +1695,9 @@ const READINESS_UNKNOWN_REASON_ID = "readiness-unknown";
  * the preview cannot disagree.
  */
 function operatorBlockedRemedy(classification) {
-    return (classification.remedy ??
-        `Resolve it with \`${PRINTED_CONDUCTOR_INSTALL_COMMAND}\` (${PRINTED_CHECK_NAME_INSTRUCTION}), then run drive-epic again.`);
+    const remedy = classification.remedy ??
+        `Resolve it with \`${PRINTED_CONDUCTOR_INSTALL_COMMAND}\` (${PRINTED_CHECK_NAME_INSTRUCTION}), then run drive-epic again.`;
+    return `${remedy} See ${CONSUMER_GUIDE_POINTER}.`;
 }
 /**
  * The escalation branch. Prints NO conductor invocation at all — naming a
@@ -1652,10 +1706,10 @@ function operatorBlockedRemedy(classification) {
  */
 function escalate(deps, epicKey, reason) {
     const lines = [
-        `Cannot determine which conductor owns ${epicKey}: ${reason}`,
+        `Cannot determine which engine owns ${epicKey}: ${reason}`,
         "",
         "This is not a not-ready result — it is an unknown one, and starting the wrong",
-        "conductor on an epic wedges it permanently.",
+        "engine on an epic wedges it permanently.",
         ESCALATE_REMEDY,
     ];
     const text = lines.join("\n");
@@ -1664,6 +1718,10 @@ function escalate(deps, epicKey, reason) {
     return 1;
 }
 /** Resolve policy intent once for the setup delegation, after a fresh run read. */
+/** Narrow an effective-policy channel label to the closed identity set. */
+function channelIdentityOf(label) {
+    return label === "configured webhook" || label === "account email" ? label : "unavailable";
+}
 async function prepareSetupSelection(ctx, coldStart = false) {
     const live = coldStart ? { kind: "none" } : await ctx.deps.readLiveEpicRun(ctx.access, ctx.epicKey);
     if (live.kind === "conflict")
@@ -1701,12 +1759,157 @@ async function prepareSetupSelection(ctx, coldStart = false) {
         policy,
         escalationChannel: pinnedPolicy
             ? policyDeclaresNotifyWebhook(pinnedPolicy) ? "configured webhook" : "account email"
-            : live.kind === "live" ? "unavailable" : "account email",
+            : live.kind === "live" ? channelIdentityOf(live.effectivePolicy?.escalation_channel) : "account email",
     });
     if (pinnedPolicy)
         pinEpicLaunchPolicy(selection, pinnedPolicy);
     return { ok: true, handoff: { selection, access: ctx.access, profile: ctx.profile } };
 }
+// ---------------------------------------------------------------------------
+// BAPI-1510 — already-merged child detection
+// ---------------------------------------------------------------------------
+/** The refusal reason shared by the preview and a real create when nothing is left to run. */
+export const EPIC_ALREADY_COMPLETE_REASON_ID = "epic-already-complete";
+const EPIC_ALREADY_COMPLETE_REMEDY = "Every child in this plan is already merged and on the indexed commit, so there is nothing to run. " +
+    "If you still want a child to run, pass --keep-child <KEY> for it.";
+/** The fixed text a failed explicit skip is refused with. */
+function skipRefusalRemedy(refusals) {
+    const keys = (reason) => refusals.filter((r) => r.reason === reason).map((r) => r.ticketKey);
+    const parts = [];
+    const notInPlan = keys("not_in_plan");
+    if (notInPlan.length > 0)
+        parts.push(`${notInPlan.join(", ")} not in this plan`);
+    const unavailable = keys("check_unavailable");
+    if (unavailable.length > 0) {
+        parts.push(`${unavailable.join(", ")} could not be confirmed because the already-merged check could not run`);
+    }
+    const weak = keys("not_skippable");
+    if (weak.length > 0) {
+        parts.push(`${weak.join(", ")} not currently shown as merged on the indexed commit`);
+    }
+    return (`--skip-child was refused: ${parts.join("; ")}. ` +
+        "Remove the flag for those children (they will run), or fix the cause and try again.");
+}
+/** Parse a plan sidecar into its DAG and child keys, or `null` when it is not usable for the check. */
+async function readPlanChildren(deps, planPath) {
+    try {
+        const parsed = JSON.parse(await deps.readPlanDag(planPath));
+        if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed))
+            return null;
+        const nodes = parsed.nodes;
+        if (!Array.isArray(nodes))
+            return null;
+        const keys = [];
+        for (const node of nodes) {
+            const key = node?.ticket_key;
+            if (typeof key !== "string" || !EPIC_KEY_PATTERN.test(key))
+                return null;
+            keys.push(key);
+        }
+        if (new Set(keys).size !== keys.length)
+            return null;
+        return { plan: parsed, keys };
+    }
+    catch {
+        return null;
+    }
+}
+function notChecked(reason, base = {}) {
+    return {
+        state: { status: "not_checked", reason, children: [] },
+        childKeys: [],
+        plan: null,
+        cutCommitSha: null,
+        skipKeys: new Set(),
+        confirmedKeys: new Set(),
+        refusals: [],
+        ...base,
+    };
+}
+/**
+ * Classify the plan's children against the canonical indexed commit and decide the
+ * skip set. Read-only; every failure degrades to "not checked, keep every child",
+ * except that an explicit `--skip-child` it cannot support becomes a refusal.
+ * Detection that is turned off (`--no-merged-check`) never reads anything.
+ */
+async function evaluateMergedChildren(ctx, planPath) {
+    const { deps, options, access, epicKey } = ctx;
+    if (options.noMergedCheck === true)
+        return notChecked("disabled");
+    const children = await readPlanChildren(deps, planPath);
+    if (children === null)
+        return notChecked("no_plan");
+    const base = { childKeys: children.keys, plan: children.plan };
+    const skipChildren = options.skipChildren ?? [];
+    const keepChildren = options.keepChildren ?? [];
+    const failed = (reason, cutCommitSha) => ({
+        ...notChecked(reason, base),
+        cutCommitSha,
+        refusals: selectSkips({ planKeys: children.keys, results: null, keepChildren, skipChildren }).refusals,
+    });
+    let cutCommitSha;
+    try {
+        const truth = await (deps.readCanonicalParseTruth
+            ? deps.readCanonicalParseTruth(access)
+            : readSetupCanonicalParseTruth(access, globalThis.fetch));
+        if (!truth.ok)
+            return failed("cut_commit_unavailable", null);
+        cutCommitSha = truth.cutCommitSha;
+    }
+    catch {
+        return failed("cut_commit_unavailable", null);
+    }
+    const classify = deps.classifyChildMergeStatus
+        ? (request) => deps.classifyChildMergeStatus(access, request)
+        : (request) => classifyChildMergeStatusClient(access, request);
+    const checked = await classifyPlanChildren(classify, epicKey, children.keys, cutCommitSha);
+    if (!checked.ok)
+        return failed("check_failed", cutCommitSha);
+    const selection = selectSkips({
+        planKeys: children.keys,
+        results: checked.results,
+        keepChildren,
+        skipChildren,
+    });
+    return {
+        state: { status: "checked", children: buildAlreadyDoneEntries(checked.results, selection.skipKeys) },
+        childKeys: children.keys,
+        plan: children.plan,
+        cutCommitSha,
+        skipKeys: selection.skipKeys,
+        confirmedKeys: selection.confirmedKeys,
+        refusals: selection.refusals,
+    };
+}
+/** The PR number for a skipped child, only when it is a valid positive integer. */
+function skippedChildPr(state, key) {
+    const entry = state.children.find((child) => child.ticket_key === key);
+    return entry !== undefined && entry.pr_number !== null && Number.isSafeInteger(entry.pr_number) && entry.pr_number > 0
+        ? entry.pr_number
+        : null;
+}
+/** Post-create audit recording: best effort, one plain warning, never changes the outcome. */
+async function recordSkippedChildrenBestEffort(ctx, epicRunId, skipped) {
+    const { deps, access } = ctx;
+    const children = skipped.map((s) => ({ ticketKey: s.key, operatorConfirmed: s.confirmed }));
+    let allRecorded = true;
+    try {
+        for (let i = 0; i < children.length; i += CHILD_MERGE_STATUS_BATCH_SIZE) {
+            const batch = children.slice(i, i + CHILD_MERGE_STATUS_BATCH_SIZE);
+            const response = deps.recordSkippedChildren
+                ? await deps.recordSkippedChildren(access, epicRunId, batch)
+                : await recordSkippedChildrenClient(access, epicRunId, batch);
+            if (response.results.some((r) => r.outcome === "refused"))
+                allRecorded = false;
+        }
+    }
+    catch {
+        allRecorded = false;
+    }
+    if (!allRecorded) {
+        deps.errorLog("The run was created, but the skipped-child record could not be saved.");
+    }
+}
 async function runSelectedSetupEpic(ctx) {
     const prepared = ctx.handoff
         ? { ok: true, handoff: ctx.handoff }
@@ -1715,7 +1918,61 @@ async function runSelectedSetupEpic(ctx) {
         ctx.deps.errorLog(`${ctx.epicKey}: REFUSED (${prepared.reasonId}) — the selected run or policy could not be verified.`);
         return { exitCode: 1 };
     }
-    const result = await ctx.deps.runSetupEpic(buildSetupEpicArgv(ctx.options), prepared.handoff);
+    const { deps, options, epicKey } = ctx;
+    // BAPI-1510 — fresh classification immediately before setup. Preview verdicts are
+    // never consumed: each create starts from the ORIGINAL plan and re-checks.
+    const planPath = options.planFile;
+    if (planPath === undefined || options.noMergedCheck === true) {
+        return await deps.runSetupEpic(buildSetupEpicArgv(options), prepared.handoff);
+    }
+    const evaluation = await evaluateMergedChildren(ctx, planPath);
+    if (evaluation.refusals.length > 0) {
+        deps.errorLog(`${epicKey}: REFUSED (skip-child-refused) — ${skipRefusalRemedy(evaluation.refusals)}`);
+        deps.errorLog("No run was created.");
+        return { exitCode: 1 };
+    }
+    if (evaluation.state.status === "not_checked") {
+        if (evaluation.state.reason === "cut_commit_unavailable" || evaluation.state.reason === "check_failed") {
+            deps.errorLog(`${epicKey}: could not check for already-merged children; every child stays in the plan.`);
+        }
+        return await deps.runSetupEpic(buildSetupEpicArgv(options), prepared.handoff);
+    }
+    if (evaluation.skipKeys.size === 0 || evaluation.plan === null || evaluation.cutCommitSha === null) {
+        return await deps.runSetupEpic(buildSetupEpicArgv(options), prepared.handoff);
+    }
+    if (evaluation.skipKeys.size >= evaluation.childKeys.length) {
+        deps.errorLog(`${epicKey}: REFUSED (${EPIC_ALREADY_COMPLETE_REASON_ID}) — ${EPIC_ALREADY_COMPLETE_REMEDY}`);
+        deps.errorLog("No run was created.");
+        return { exitCode: 1 };
+    }
+    const skipped = evaluation.childKeys
+        .filter((key) => evaluation.skipKeys.has(key))
+        .map((key) => ({ key, confirmed: evaluation.confirmedKeys.has(key) }));
+    for (const { key, confirmed } of skipped) {
+        const pr = skippedChildPr(evaluation.state, key);
+        deps.log(`${epicKey}: ${confirmed ? "skipping (confirmed by you)" : "skipping already-merged child"} ${key}` +
+            `${pr !== null ? ` (#${pr})` : ""}`);
+    }
+    const trimmed = trimDonePlanNodes(evaluation.plan, evaluation.skipKeys);
+    const withPath = deps.withPlanPath ?? withPlanPath;
+    const result = await withPath({
+        originalPath: planPath,
+        trimmedJson: JSON.stringify(trimmed, null, 2),
+        skipped: true,
+        warn: (message) => deps.errorLog(message),
+    }, (trimmedPath) => deps.runSetupEpic(buildSetupEpicArgv({ ...options, planFile: trimmedPath }), {
+        ...prepared.handoff,
+        expectedCutCommitSha: evaluation.cutCommitSha,
+        attachOnlyOnReuse: true,
+    }));
+    if (result.reusedExistingRun === true) {
+        // Reuse or race adoption: the trimmed plan was never applied and nothing is recorded.
+        deps.log(`${epicKey}: an existing run was found; the already-merged check was not applied and existing runs are unchanged.`);
+        return result;
+    }
+    if (result.epicRunId !== undefined && result.runCreated === true && result.planStored === true) {
+        await recordSkippedChildrenBestEffort(ctx, result.epicRunId, skipped);
+    }
     return result;
 }
 /** Emit one refusal, guarded so it can never name a second conductor. */
@@ -1725,6 +1982,200 @@ function refuse(deps, lines) {
     deps.errorLog(text);
     return 1;
 }
+/** The launch evidence rows exist only for an unattended launch. */
+function isUnattendedLaunch(options) {
+    return options.attended !== true && options.intoBase !== true;
+}
+/** The launch row ids a launch can be refused on, without their namespace. */
+const LAUNCH_REFUSAL_IDS = ["merge-credential-capability", "worktree-preparation", ...Object.values(READINESS_PRE_CREATE_CODES)];
+/**
+ * The credential evidence. Probes ONLY a locally owned executor's credential in
+ * `local` / `machine_token` mode, against the server's explicit `owner/name`;
+ * never the launcher's unrelated credential for an external executor, and never
+ * anything for `github_actions`. Every gap is a value-free warning reason.
+ */
+async function collectCredentialEvidence(deps, readiness, topology, box) {
+    const mode = readiness.resolved_merge_execution_mode;
+    if (mode === undefined)
+        return { kind: "unverified", reason: "server_fields_missing" };
+    if (mode === null)
+        return { kind: "unverified", reason: "mode_unresolved" };
+    if (mode === "github_actions")
+        return { kind: "github_actions" };
+    if (topology.kind === "plane_lane")
+        return { kind: "unverified", reason: "external_executor_plane", mode };
+    if (topology.kind === "durable_profile") {
+        return { kind: "unverified", reason: "external_executor_durable", mode };
+    }
+    const repository = readiness.provider_repository;
+    if (repository === undefined)
+        return { kind: "unverified", reason: "server_fields_missing", mode };
+    if (!isProviderRepositoryIdentity(repository)) {
+        return { kind: "unverified", reason: "repository_unresolved", mode };
+    }
+    if (deps.probeLaunchMergeCredential === undefined) {
+        return { kind: "unverified", reason: "probe_unavailable", mode };
+    }
+    // BAPI-1461: resolve once, with the stored-entry fallback, and probe exactly
+    // the credential the executor will be handed — never a second env lookup.
+    const resolved = await resolveLaunchCredentialOnce(deps, mode, repository, box);
+    let verdict;
+    try {
+        verdict = classifyLocalGhPreflight(await deps.probeLaunchMergeCredential({
+            kind: mode,
+            repository,
+            // A store-sourced credential is handed over explicitly; an env one is the
+            // same value the probe resolves itself, so its call is unchanged.
+            ...(resolved !== undefined && resolved.fromStore
+                ? { resolved: { credential: resolved.credential, invalid: resolved.invalid } }
+                : {}),
+        }));
+    }
+    catch {
+        // Nothing from the thrown value is kept: an unexpected probe failure is
+        // simply unavailable evidence.
+        return { kind: "unverified", reason: "probe_unavailable", mode };
+    }
+    switch (verdict) {
+        case "passed":
+            return { kind: "verified", mode, repository };
+        case "credential_missing":
+            return { kind: "credential_missing", mode };
+        case "credential_invalid":
+            return { kind: "credential_invalid", mode };
+        case "no_access":
+            return { kind: "no_access", mode, repository };
+        case "gh_unavailable":
+            return { kind: "unverified", reason: "gh_unavailable", mode };
+        case "probe_unavailable":
+            return { kind: "unverified", reason: "probe_unavailable", mode };
+    }
+}
+/**
+ * BAPI-1461 — resolve the launch's merge credential once and remember it in the
+ * launch's box. `undefined` means no resolver was supplied (or it failed), so the
+ * probe falls back to its own environment lookup and nothing is handed over.
+ */
+async function resolveLaunchCredentialOnce(deps, kind, repository, box) {
+    if (deps.resolveLaunchMergeCredential === undefined)
+        return undefined;
+    let resolution;
+    try {
+        resolution = await deps.resolveLaunchMergeCredential({ kind, repository });
+    }
+    catch {
+        return undefined;
+    }
+    const credential = resolution.status === "resolved" ? resolution.credential : null;
+    if (box !== undefined)
+        box.resolved = credential;
+    return {
+        credential,
+        invalid: resolution.status === "invalid",
+        fromStore: (resolution.status === "resolved" || resolution.status === "invalid") && resolution.source === "store",
+    };
+}
+/**
+ * BAPI-1461 — the credential to hand a run-scoped executor: the one this launch
+ * already resolved, or (on the live-run attach path, which runs no launch gate)
+ * a fresh resolution for a locally owned, `local`-mode executor. Only the local
+ * kind is ever handed over; nothing for machine-user or GitHub Actions mode.
+ */
+async function launchCredentialForExecutor(ctx, readiness) {
+    const box = ctx.launchCredential;
+    if (box !== undefined && box.resolved !== undefined) {
+        return box.resolved?.kind === "local" ? box.resolved : null;
+    }
+    if (readiness.resolved_merge_execution_mode !== "local")
+        return null;
+    const repository = readiness.provider_repository;
+    if (typeof repository !== "string" || !isProviderRepositoryIdentity(repository))
+        return null;
+    const resolved = await resolveLaunchCredentialOnce(ctx.deps, "local", repository, box);
+    return resolved?.credential ?? null;
+}
+/**
+ * The worktree evidence, from Child 1's NON-WRITING resolver against the clone
+ * the executor will own. Blocks only when the exclude is proven neither present
+ * nor writable; anything the resolver cannot establish is a warning. The
+ * absolute exclude path never leaves this function.
+ */
+async function collectWorktreeEvidence(deps, topology) {
+    if (topology.kind === "plane_lane")
+        return { kind: "unverified", reason: "external_executor_plane" };
+    if (topology.kind === "durable_profile")
+        return { kind: "unverified", reason: "external_executor_durable" };
+    if (topology.repoRoot === null || deps.inspectWorktreeExclude === undefined) {
+        return { kind: "unverified", reason: "inspection_unavailable" };
+    }
+    let resolution;
+    try {
+        resolution = await deps.inspectWorktreeExclude(topology.repoRoot);
+    }
+    catch {
+        return { kind: "unverified", reason: "inspection_unavailable" };
+    }
+    if (resolution.kind !== "resolved")
+        return { kind: "unverified", reason: "inspection_unavailable" };
+    if (resolution.present || resolution.writable)
+        return { kind: "ready", present: resolution.present };
+    return { kind: "blocked" };
+}
+/** Collect both halves of the launch evidence. */
+async function collectLaunchEvidence(deps, readiness, topology, box) {
+    return {
+        credential: await collectCredentialEvidence(deps, readiness, topology, box),
+        worktree: await collectWorktreeEvidence(deps, topology),
+    };
+}
+/**
+ * The launch capability gate (BAPI-1452). Runs after readiness and executor
+ * topology are resolved and BEFORE the run is created, dispatched, or given an
+ * executor. Prints the compact launch summary, then refuses (exit 1) only on a
+ * proven blocker; `null` means continue.
+ *
+ * Attended and `--into-base` launches skip it: the unattended requirements do
+ * not apply there, so there is nothing for the evidence to refuse.
+ */
+async function launchCapabilityGate(ctx, readiness, topology, outcome = "Nothing was created or started.") {
+    const { deps, epicKey, options } = ctx;
+    if (!isUnattendedLaunch(options))
+        return null;
+    const evidence = await collectLaunchEvidence(deps, readiness, topology, ctx.launchCredential);
+    (deps.launchReadinessLog ?? deps.errorLog)(formatLaunchReadinessSummary(buildLaunchReadinessChecks(readiness, { launchEvidence: evidence }), { all: ctx.options.all, isProduction: readiness.is_production, prerequisites: readiness.prerequisites }).join("\n"));
+    const classification = classifyV2Readiness(readiness, { attended: false, intoBase: false, effectivePolicy: ctx.handoff?.selection }, evidence);
+    if (classification.kind !== "operator_blocked" || !LAUNCH_REFUSAL_IDS.includes(classification.id)) {
+        return null;
+    }
+    return refuse(deps, [
+        `${epicKey}: REFUSED (${classification.id}) — the launch still needs ${classification.describe}.`,
+        operatorBlockedRemedy(classification),
+        outcome,
+    ]);
+}
+/**
+ * The launch rows a preview reports, and the refusal they imply (BAPI-1452).
+ * Uses the SAME evidence collection and classification as a real launch; the
+ * worktree check reads the clone the read-only inspection names and never
+ * prepares or writes it.
+ */
+async function previewLaunchCapability(ctx, readiness, topology) {
+    const { deps, options } = ctx;
+    const context = { attended: options.attended === true, intoBase: options.intoBase === true };
+    if (!isUnattendedLaunch(options)) {
+        return { checks: buildLaunchReadinessChecks(readiness, context), refusal: null };
+    }
+    const evidence = await collectLaunchEvidence(deps, readiness, topology);
+    const checks = buildLaunchReadinessChecks(readiness, { ...context, launchEvidence: evidence });
+    const classification = classifyV2Readiness(readiness, { ...context, effectivePolicy: ctx.handoff?.selection }, evidence);
+    if (classification.kind === "operator_blocked" && LAUNCH_REFUSAL_IDS.includes(classification.id)) {
+        return {
+            checks,
+            refusal: { reasonId: classification.id, remedy: operatorBlockedRemedy(classification) },
+        };
+    }
+    return { checks, refusal: null };
+}
 function durableActorAdmissionDenied(readiness) {
     const evidence = readiness.admission_evidence;
     return evidence?.schema_version === 1 &&
@@ -1743,7 +2194,7 @@ function planeEndpointForBaseUrl(deps, baseUrl) {
 /** What to tell the operator about a plane THIS invocation started and left up. */
 const LAUNCHED_PLANE_LEFT_RUNNING = [
     "",
-    "The conductor CONTROL PLANE was started by this invocation and is STILL RUNNING.",
+    "The Epic Implementer CONTROL PLANE was started by this invocation and is STILL RUNNING.",
     "No run was created and no executor lane was spawned. Inspect it with `plane status`,",
     "and wind it down with `plane down` once the item above is fixed.",
 ];
@@ -1782,10 +2233,430 @@ async function checkPlaneAdmission(ctx, readiness, manifest) {
         `${ctx.epicKey}: REFUSED (plane-reconciler-unconfirmed) — the plane's own reconciler could ` +
             `not be confirmed as the live transition authority (its heartbeat reads: ${state}).`,
         "Another reconciler may be standing in for this plane — often a reparented worker.py from an",
-        `earlier plane. Check \`ps aux | grep worker.py\` (${BRING_UP_RUNBOOK} §6), stop any`,
+        `earlier plane. Check \`ps aux | grep worker.py\` (see ${BRING_UP_RUNBOOK}), stop any`,
         "survivor, and run drive-epic again.",
     ];
 }
+// ---------------------------------------------------------------------------
+// BAPI-1476 — local-plane freshness: one evidence collection, one policy
+// ---------------------------------------------------------------------------
+//
+// `plane/plane-freshness.ts` OBSERVES. This section DECIDES, and the decision
+// differs by mode: a launch that would CREATE a run refuses on a confirmed stale
+// snapshot or database head; a launch that only ATTACHES to a run that already
+// exists never stops mid-run on freshness — it warns. `--allow-stale-plane`
+// downgrades the creation refusals for one invocation and nothing else.
+/** Refusal names for a confirmed freshness problem. Unique to this check. */
+export const DRIVE_EPIC_FRESHNESS_REFUSALS = [
+    /** The plane's pinned snapshot is behind `origin/main`. */
+    "plane-snapshot-stale",
+    /** The database revision set differs from the repository migration head. */
+    "plane-database-head-mismatch",
+];
+function createPlaneFreshnessCache() {
+    return { observations: new Map() };
+}
+/**
+ * Collect snapshot and database evidence ONCE per (checkout, ownership) for this
+ * invocation. `null` when nothing applies: a non-plane target gets no reads at
+ * all, so a production launch's output is byte-for-byte unchanged.
+ */
+async function collectFreshnessObservations(ctx, own) {
+    const { deps } = ctx;
+    if (planeEndpointForBaseUrl(deps, ctx.access.baseUrl) === null)
+        return null;
+    const collect = deps.collectPlaneFreshness;
+    if (collect === undefined)
+        return null;
+    const cache = ctx.freshness ?? createPlaneFreshnessCache();
+    const key = `${own.repoRoot}\u0000${own.ownsManifest ? own.planeId ?? "" : "-"}`;
+    let pending = cache.observations.get(key);
+    if (pending === undefined) {
+        pending = collect({
+            repoRoot: own.repoRoot,
+            ownsManifest: own.ownsManifest,
+            ...(own.planeId !== undefined ? { expectedPlaneId: own.planeId } : {}),
+        }).catch(() => null);
+        cache.observations.set(key, pending);
+    }
+    return pending;
+}
+async function collectHostSleep(ctx, repoRoot) {
+    const { deps } = ctx;
+    if (planeEndpointForBaseUrl(deps, ctx.access.baseUrl) === null)
+        return null;
+    const inspect = deps.inspectHostSleep;
+    if (inspect === undefined)
+        return null;
+    const cache = ctx.freshness ?? createPlaneFreshnessCache();
+    cache.sleep ??= inspect(repoRoot).catch(() => null);
+    return cache.sleep;
+}
+/**
+ * BAPI-1496 — the bound run a stale-snapshot remedy should name, or `undefined`
+ * for an unbound plane. Read only when the plane is this checkout's own, bound,
+ * local, and its snapshot is confirmed stale, so the common path issues no
+ * request. A failed read is an UNKNOWN status, never assumed terminal.
+ */
+async function boundRunForStaleRemedy(ctx, own, reports) {
+    if (!own.ownsManifest || own.epicRunId === undefined || reports === null)
+        return undefined;
+    // The bound remedy is shown only on a confirmed stale refusal, so only that reads.
+    if (freshnessVerdictOf(reports.snapshot).verdict !== "refuse")
+        return undefined;
+    if (planeEndpointForBaseUrl(ctx.deps, ctx.access.baseUrl) === null)
+        return undefined;
+    const state = await ctx.deps.readRunState(ctx.access, own.epicRunId).catch(() => null);
+    return { epicRunId: own.epicRunId, status: state?.status ?? null };
+}
+function freshnessVerdictOf(report) {
+    const outcome = report.outcomes[0];
+    const detail = outcome?.detail ?? "";
+    switch (outcome?.status) {
+        case "pass":
+            return { verdict: "pass", detail };
+        case "fail":
+            return { verdict: "refuse", detail };
+        case "skip":
+            return { verdict: "skip", detail };
+        default:
+            return { verdict: "unverified", detail };
+    }
+}
+/**
+ * Project the observations into launch rows and the creation blockers.
+ *
+ * Row `status` stays in the existing four-state vocabulary (`fail` for a
+ * confirmed refusal, `warn` for unverified evidence); the verdict word — `pass`,
+ * `refuse`, `unverified` — leads the row's detail so human and JSON output carry
+ * the same meaning.
+ */
+function assessPlaneFreshness(reports, sleep, mode, allowStalePlane, 
+/**
+ * BAPI-1496 — the stale plane's bound run and its read-only server status.
+ * Present only for a plane bound to a run; it selects the ownership-specific
+ * remedy, which never advises `plane down` for a run that is not finished.
+ * Absent keeps `PLANE_SNAPSHOT_STALE_REMEDY` byte for byte.
+ */
+boundRun) {
+    const rows = [];
+    const blockers = [];
+    let overridden = false;
+    const flagNote = allowStalePlane ? "; overridden for this invocation by --allow-stale-plane" : "";
+    const project = (id, label, report, refusal) => {
+        const { verdict, detail } = freshnessVerdictOf(report);
+        if (verdict === "pass") {
+            rows.push({ id, label, status: "pass", blocking: false, detail: `pass — ${detail}` });
+        }
+        else if (verdict === "unverified") {
+            rows.push({
+                id,
+                label,
+                status: "warn",
+                blocking: false,
+                detail: `unverified — ${detail}`,
+                remedy: PLANE_FRESHNESS_UNVERIFIED_REMEDY,
+            });
+        }
+        else if (verdict === "refuse" && mode === "attach") {
+            // Warning-only: an existing run is never stopped for freshness.
+            rows.push({
+                id,
+                label,
+                status: "warn",
+                blocking: false,
+                detail: `refuse (warning only; attachment proceeds) — ${detail}${flagNote}`,
+                remedy: refusal.remedy,
+            });
+        }
+        else if (verdict === "refuse" && allowStalePlane) {
+            overridden = true;
+            rows.push({
+                id,
+                label,
+                status: "fail",
+                blocking: false,
+                detail: `refuse (overridden for this invocation) — ${detail}`,
+                remedy: refusal.remedy,
+            });
+        }
+        else if (verdict === "refuse") {
+            blockers.push(refusal);
+            rows.push({
+                id,
+                label,
+                status: "fail",
+                blocking: true,
+                detail: `refuse — ${detail}`,
+                remedy: refusal.remedy,
+            });
+        }
+    };
+    if (reports !== null) {
+        project(PLANE_SNAPSHOT_FRESHNESS_ID, "Plane snapshot freshness", reports.snapshot, {
+            reasonId: "plane-snapshot-stale",
+            remedy: boundRun !== undefined ? formatBoundPlaneStaleRemedy(boundRun) : PLANE_SNAPSHOT_STALE_REMEDY,
+        });
+        project(PLANE_DATABASE_HEAD_ID, "Plane database head", reports.database, {
+            reasonId: "plane-database-head-mismatch",
+            remedy: PLANE_DATABASE_HEAD_REMEDY,
+        });
+    }
+    if (sleep !== null) {
+        const { verdict, detail } = freshnessVerdictOf(sleep);
+        if (verdict === "skip") {
+            rows.push({ id: PLANE_HOST_SLEEP_ID, label: "Host sleep", status: "skip", blocking: false, detail: `not applicable — ${detail}` });
+        }
+        else if (verdict === "unverified") {
+            rows.push({
+                id: PLANE_HOST_SLEEP_ID,
+                label: "Host sleep",
+                status: "warn",
+                blocking: false,
+                detail: `unverified — ${detail}`,
+                remedy: PLANE_FRESHNESS_UNVERIFIED_REMEDY,
+            });
+        }
+        else if (hostPowerFactFromReport(sleep).state === "present") {
+            // BAPI-1506: a battery or lid advisory is a warning with its remedy, not
+            // a pass. It still never blocks.
+            rows.push({
+                id: PLANE_HOST_SLEEP_ID,
+                label: "Host sleep",
+                status: "warn",
+                blocking: false,
+                detail: `present — ${detail}`,
+                remedy: PLANE_SLEEP_REMEDY,
+            });
+        }
+        else {
+            // Readable evidence never blocks setup. "pass" means exactly that.
+            rows.push({ id: PLANE_HOST_SLEEP_ID, label: "Host sleep", status: "pass", blocking: false, detail: `pass — ${detail}` });
+        }
+    }
+    return { rows, blockers, overridden };
+}
+/** Rows worth printing on a real launch: everything except a plain pass. */
+function adverseFreshnessRows(rows) {
+    return rows.filter((row) => row.status !== "pass");
+}
+/** The blockers as one named refusal; both remedies are kept, in fixed order. */
+function freshnessRefusalOf(blockers) {
+    const first = blockers[0];
+    if (first === undefined)
+        return null;
+    return { reasonId: first.reasonId, remedy: blockers.map((blocker) => blocker.remedy).join(" ") };
+}
+function renderFreshnessRows(rows, heading = 'Plane freshness:') {
+    return [heading, ...rows.flatMap(row => [
+            `  [${row.status === 'fail' && row.blocking ? 'Blocking' : row.status === 'warn' ? 'Warning' : 'Informational'}] ${row.label}${row.detail ? ` — ${row.detail}` : ''}`,
+            ...(row.remedy ? [`      → ${row.remedy}`] : []),
+        ])];
+}
+/**
+ * The guard for a CREATING launch, placed beside `checkPlaneAdmission` and before
+ * the first setup or run-create side effect. Returns an exit code only when it
+ * refuses; otherwise it prints any non-blocking finding and returns `null`.
+ *
+ * Fail-open on missing evidence: unreadable or absent evidence is a warning, so
+ * it is never proof of staleness and never permission to skip another safeguard.
+ */
+async function planeFreshnessCreateGuard(ctx, own, trailer = []) {
+    try {
+        const reports = await collectFreshnessObservations(ctx, own);
+        if (reports === null)
+            return null;
+        const boundRun = await boundRunForStaleRemedy(ctx, own, reports);
+        let assessment = assessPlaneFreshness(reports, null, "create", ctx.options.allowStalePlane === true, boundRun);
+        if (assessment.blockers.length > 0) {
+            // setup-epic REUSES the epic's live run instead of creating one, and a reuse
+            // is an attachment: it is warned about, never refused. Asked only when a
+            // confirmed finding would otherwise block, so the common path reads nothing.
+            const live = await ctx.deps
+                .readLiveEpicRun(ctx.access, ctx.epicKey)
+                .catch(() => ({ kind: "unknown" }));
+            if (live.kind === "live") {
+                assessment = assessPlaneFreshness(reports, null, "attach", ctx.options.allowStalePlane === true, boundRun);
+            }
+        }
+        const refusal = freshnessRefusalOf(assessment.blockers);
+        const adverse = adverseFreshnessRows(assessment.rows);
+        if (refusal !== null) {
+            return refuse(ctx.deps, [
+                `${ctx.epicKey}: REFUSED (${refusal.reasonId}) — the local plane is not current enough to ` +
+                    "create a run against.",
+                ...renderFreshnessRows(adverse),
+                "",
+                "Nothing was created.",
+                ...trailer,
+            ]);
+        }
+        if (adverse.length > 0) {
+            const log = ctx.deps.launchReadinessLog ?? ctx.deps.errorLog;
+            log([
+                assessment.overridden
+                    ? `${ctx.epicKey}: plane freshness — proceeding; a confirmed refusal was overridden for this invocation.`
+                    : `${ctx.epicKey}: plane freshness — proceeding; some evidence could not be verified.`,
+                ...renderFreshnessRows(adverse),
+            ].join("\n"));
+        }
+        return null;
+    }
+    catch {
+        // An unexpected failure of an advisory read never stops a launch.
+        return null;
+    }
+}
+/** The warning-only counterpart for an existing run. Never refuses, never throws. */
+async function surfacePlaneFreshnessForExistingRun(ctx, own) {
+    try {
+        const reports = await collectFreshnessObservations(ctx, own);
+        if (reports === null)
+            return;
+        const boundRun = await boundRunForStaleRemedy(ctx, own, reports);
+        const assessment = assessPlaneFreshness(reports, null, "attach", ctx.options.allowStalePlane === true, boundRun);
+        const adverse = adverseFreshnessRows(assessment.rows);
+        if (adverse.length === 0)
+            return;
+        const log = ctx.deps.launchReadinessLog ?? ctx.deps.errorLog;
+        log([
+            `${ctx.epicKey}: plane freshness — attaching to the existing run; findings below are warnings only.`,
+            ...renderFreshnessRows(adverse),
+        ].join("\n"));
+    }
+    catch {
+        // Advisory only.
+    }
+}
+// ---------------------------------------------------------------------------
+// BAPI-1496 — worker-database advisories on a LOCAL launch
+// ---------------------------------------------------------------------------
+/**
+ * Run the worker-database inspection for a local-plane target, once.
+ *
+ * `null` when nothing applies: a target that is not this machine's plane never
+ * runs the inspector, so a remote launch's requests and output are unchanged.
+ * An inspector that throws or times out prints one fixed line naming only the
+ * closed classification, then yields the doctor's all-unknown section — whose
+ * `worker-db-unverifiable` row is a warning, never a refusal.
+ */
+async function collectWorkerDatabaseAdvisory(deps, baseUrl, cache) {
+    if (baseUrl === null || planeEndpointForBaseUrl(deps, baseUrl) === null)
+        return null;
+    const inspect = deps.inspectWorkerDatabase;
+    if (inspect === undefined)
+        return null;
+    const run = async () => {
+        let failed = false;
+        const section = await collectWorkerDatabaseDoctorSection(inspect, WORKER_DATABASE_DOCTOR_TIMEOUT_MS, (failure) => {
+            failed = true;
+            deps.errorLog(`worker-db inspection failed: ${failure}`);
+        }).catch(() => null);
+        // A failed or timed-out inspection is ONE fact — the evidence is unverifiable —
+        // so a launch shows only the `worker-db-unverifiable` warning, not six unknown
+        // rows. The doctor's own all-unknown section is left as it is.
+        if (section !== null && failed) {
+            return { ...section, rows: section.rows.filter((row) => row.id === "worker-db-unverifiable") };
+        }
+        return section;
+    };
+    if (cache === undefined)
+        return run();
+    cache.workerDatabase ??= run();
+    return cache.workerDatabase;
+}
+/** The advisory rows for a local launch: non-healthy `worker-db-*` warnings only. */
+async function workerDatabaseAdvisoryRows(deps, baseUrl, cache) {
+    const section = await collectWorkerDatabaseAdvisory(deps, baseUrl, cache);
+    return section === null ? [] : previewLaunchRows(workerDatabaseReadinessChecks(section));
+}
+/**
+ * Print the worker-database warnings on a real local launch, beside the other
+ * launch readiness output. Called after the creating launch's freshness guard
+ * on every local creating path, attended and `--into-base` included. Advisory by
+ * construction: it never refuses, never changes a decision or an exit code, and
+ * an unexpected failure prints nothing.
+ */
+async function surfaceWorkerDatabaseAdvisory(ctx) {
+    try {
+        const rows = await workerDatabaseAdvisoryRows(ctx.deps, ctx.access.baseUrl, ctx.freshness);
+        if (rows.length === 0)
+            return;
+        const log = ctx.deps.launchReadinessLog ?? ctx.deps.errorLog;
+        log([
+            `${ctx.epicKey}: worker databases — warnings only; they never block a launch.`,
+            ...renderFreshnessRows(rows).map((line, index) => (index === 0 ? "Worker databases (advisory):" : line)),
+        ].join("\n"));
+    }
+    catch {
+        // Advisory only.
+    }
+}
+/**
+ * Append the worker-database warnings to a LOCAL-plane preview's
+ * `launch_checks`, modeled on {@link appendExecutorBuildFreshnessWarning}.
+ * Gated on the preview's own `target.kind`, so a remote preview never runs the
+ * inspector and its JSON is unchanged. Never changes the decision, a refusal,
+ * readiness, or the exit code.
+ */
+async function appendWorkerDatabaseAdvisoryRows(deps, preview) {
+    if (preview.target.kind !== "local_plane")
+        return null;
+    try {
+        // BAPI-1506: the section is returned so the launch-need step reuses this one
+        // inspection instead of running a second.
+        const section = await collectWorkerDatabaseAdvisory(deps, preview.target.base_url);
+        const rows = section === null ? [] : previewLaunchRows(workerDatabaseReadinessChecks(section));
+        if (rows.length > 0)
+            preview.launch_checks = [...(preview.launch_checks ?? []), ...rows];
+        return section;
+    }
+    catch {
+        // Leave the preview as it was.
+        return null;
+    }
+}
+// ---------------------------------------------------------------------------
+// BAPI-1496 — terminal-run plane cleanup before a LOCAL creating launch
+// ---------------------------------------------------------------------------
+/**
+ * Tear down this checkout's plane when it serves a finished run, before the
+ * launch can attach to it or its preflight can refuse on it.
+ *
+ * `null` when nothing applies: a target that is not this machine's plane never
+ * reaches the cleanup, so a remote launch makes no new call and sends no
+ * signal. Eligibility, ownership re-validation, and the guarded teardown all
+ * live in `plane/terminal-run-cleanup.ts`; this only routes. An incomplete or
+ * aborted cleanup prints its one line and the launch continues into ordinary
+ * preflight, whose `existing-plane` refusal still applies. A completed cleanup
+ * drops every cached freshness observation, because they described the plane
+ * that is now gone.
+ */
+async function cleanUpTerminalRunPlane(ctx, repoRoot) {
+    const { deps } = ctx;
+    const cleanup = deps.cleanupTerminalRunPlane;
+    if (cleanup === undefined)
+        return null;
+    const endpoint = planeEndpointForBaseUrl(deps, ctx.access.baseUrl);
+    if (endpoint === null)
+        return null;
+    let result;
+    try {
+        result = await cleanup({ repoRoot, endpoint });
+    }
+    catch {
+        deps.errorLog("terminal-run plane cleanup could not run; inspect `plane status`.");
+        return null;
+    }
+    const line = terminalRunCleanupStderrLine(result);
+    if (line !== null)
+        deps.errorLog(line);
+    if (result.kind === "completed" && ctx.freshness !== undefined) {
+        ctx.freshness.observations.clear();
+        ctx.freshness.sleep = undefined;
+    }
+    return result;
+}
 /**
  * COLD START: nothing is listening on the plane endpoint, so bring the control
  * plane up and compose the run against it.
@@ -1816,13 +2687,15 @@ async function coldStartPlane(ctx) {
     // before anything is started, exactly as every other plan-file route does.
     if (ctx.options.planFile)
         await surfaceContainmentAdvisory(deps, ctx.options.planFile);
-    deps.log(`${epicKey}: nothing is listening on the plane endpoint; cold-starting the conductor plane.`);
+    deps.log(`${epicKey}: nothing is listening on the plane endpoint; cold-starting the local plane.`);
     const repoRoot = deps.cwd();
+    // BAPI-1496: a plane bound to a finished run is torn down before preflight.
+    await cleanUpTerminalRunPlane(ctx, repoRoot);
     const preflight = await deps.runPlanePreflight(repoRoot);
     const precondition = firstPreconditionRefusal(preflight);
     if (precondition) {
         return refuse(deps, [
-            `${epicKey}: cannot start the conductor runtime — ${precondition.check} failed.`,
+            `${epicKey}: cannot start the Epic Implementer runtime — ${precondition.check} failed.`,
             formatPlaneDiagnostic(precondition),
             "",
             "Nothing was started. Fix the item above and run drive-epic again.",
@@ -1841,8 +2714,11 @@ async function coldStartPlane(ctx) {
         readiness = await deps.readReadiness(ctx.access);
     }
     catch (err) {
+        if (isSchemaIncompatibleError(err)) {
+            return refuse(deps, [...formatSchemaIncompatibleRefusal(epicKey, err), ...LAUNCHED_PLANE_LEFT_RUNNING]);
+        }
         return refuse(deps, [
-            `${epicKey}: the plane came up, but its conductor readiness could not be read: ` +
+            `${epicKey}: the plane came up, but its Epic Implementer readiness could not be read: ` +
                 safeDiagnosticMessage(err, "readiness request failed"),
             ...LAUNCHED_PLANE_LEFT_RUNNING,
         ]);
@@ -1862,7 +2738,7 @@ async function coldStartPlane(ctx) {
     });
     if (classification.kind === "operator_blocked") {
         return refuse(deps, [
-            `${epicKey}: the engine path still needs ${classification.describe} (${classification.id}).`,
+            `${epicKey}: the engine path still needs ${classification.describe}.`,
             operatorBlockedRemedy(classification),
             ...LAUNCHED_PLANE_LEFT_RUNNING,
         ]);
@@ -1879,12 +2755,17 @@ async function coldStartPlane(ctx) {
     if (admission !== null) {
         return refuse(deps, [...admission, ...LAUNCHED_PLANE_LEFT_RUNNING]);
     }
+    // BAPI-1476: before the first setup/run-create side effect.
+    const staleCold = await planeFreshnessCreateGuard(ctx, { repoRoot, ownsManifest: true, planeId: controlPlane.planeId }, LAUNCHED_PLANE_LEFT_RUNNING);
+    if (staleCold !== null)
+        return staleCold;
+    await surfaceWorkerDatabaseAdvisory(ctx);
     return createRunAndRequestLanes(ctx, {
         origin: "launched",
         repoRoot,
         planeId: controlPlane.planeId,
         awaitPlaneReady: controlPlane.awaitPlaneReady,
-    });
+    }, readiness);
 }
 /**
  * ATTACH: the plane endpoint already serves this repository's live plane.
@@ -1945,6 +2826,16 @@ async function attachToPlane(ctx, manifest, readiness) {
     if (admission !== null) {
         return refuse(deps, [...admission, "", "Nothing was started."]);
     }
+    // BAPI-1476: both branches below create a run, so the guard precedes both.
+    const staleAttach = await planeFreshnessCreateGuard(attachCtx, {
+        repoRoot: manifest.repoRoot,
+        ownsManifest: true,
+        planeId: manifest.planeId,
+        ...(manifest.epicRunId ? { epicRunId: manifest.epicRunId } : {}),
+    });
+    if (staleAttach !== null)
+        return staleAttach;
+    await surfaceWorkerDatabaseAdvisory(attachCtx);
     if (dedicatedExecutorReason !== null) {
         deps.log(`${epicKey}: attaching to this repository's running plane (${dedicatedExecutorReason}); ` +
             "its reconciler will drive this run too, and a dedicated executor will be started for it.");
@@ -1956,7 +2847,7 @@ async function attachToPlane(ctx, manifest, readiness) {
         repoRoot: manifest.repoRoot,
         planeId: manifest.planeId,
         ...(manifest.epicRunId !== undefined ? { boundRunId: manifest.epicRunId } : {}),
-    });
+    }, readiness);
 }
 /**
  * The shared tail: create/approve/cut through `setup-epic`, then request lanes
@@ -1967,9 +2858,16 @@ async function attachToPlane(ctx, manifest, readiness) {
  * `executorClaimScopeArgs` as `--epic-run-id`, and `--repo-wide` is not
  * constructible here.
  */
-async function createRunAndRequestLanes(ctx, plane) {
+async function createRunAndRequestLanes(ctx, plane, readiness) {
     const { deps, epicKey } = ctx;
     const launched = plane.origin === "launched";
+    // BAPI-1452: a plane lane owns this run's executor, so the launch evidence
+    // can only warn here; printed before the run exists.
+    if (readiness !== undefined) {
+        const gate = await launchCapabilityGate(ctx, readiness, { kind: "plane_lane" });
+        if (gate !== null)
+            return gate;
+    }
     // ---- PHASE TWO, part one: create the run ------------------------------
     const setup = await runSelectedSetupEpic(ctx);
     if (setup.exitCode !== 0) {
@@ -1981,7 +2879,7 @@ async function createRunAndRequestLanes(ctx, plane) {
         deps.errorLog((launched
             ? [
                 "",
-                `${epicKey}: the conductor CONTROL PLANE was started by this invocation and is STILL RUNNING.`,
+                `${epicKey}: the Epic Implementer CONTROL PLANE was started by this invocation and is STILL RUNNING.`,
                 "No executor lane was spawned, so nothing is claiming jobs.",
                 "It was not wound down automatically, because doing so would stop a run that may",
                 "already have been created and approved. Inspect it with `plane status`, and wind it",
@@ -2158,7 +3056,7 @@ function remoteRuntimeRefusal(epicKey, access, readiness) {
     const lines = [`${epicKey}: REFUSED (${reasonId}) — ${remedy}`];
     if (bringUp === null) {
         lines.push("This Bridge API version cannot report deployment liveness, so a launch against it cannot " +
-            "be confirmed. Upgrade the Bridge API deploy.");
+            "be confirmed. Try again later; if it keeps happening, email info@bridgegpt.ai.");
     }
     lines.push("", "No run was created.", REMOTE_NO_PLANE_LINE);
     return { reasonId, remedy, lines };
@@ -2171,7 +3069,7 @@ function remoteRuntimeRefusal(epicKey, access, readiness) {
 function durableCoverageRefusal(epicKey, access, profile, coverage, outcome) {
     const remedy = [
         "Start the durable host's executor with --repo-wide",
-        "  (`install conductor --execution-mode durable --executor-id <id> --repo-wide`),",
+        "  (`install conductor --execution-mode durable --executor-id <id> --repo-wide`; see `drive-epic --help-advanced`),",
         "or launch without the durable profile.",
     ].join("\n");
     return {
@@ -2272,6 +3170,11 @@ async function createRunWithRunExecutor(ctx, readiness) {
         if (coverage !== true) {
             return refuse(deps, durableCoverageRefusal(epicKey, access, profile, coverage, "No run was created").lines);
         }
+        // BAPI-1452: the durable host owns the executor clone and credential, so
+        // this can only warn — but it says so before the run exists.
+        const gate = await launchCapabilityGate(ctx, readiness, { kind: "durable_profile" }, "No run was created and no local executor was started.");
+        if (gate !== null)
+            return gate;
         const setup = await runSelectedSetupEpic(ctx);
         if (setup.exitCode === 0) {
             deps.log([
@@ -2287,6 +3190,11 @@ async function createRunWithRunExecutor(ctx, readiness) {
     if (!prepared.ok) {
         return refuse(deps, executorPreconditionRefusal(epicKey, prepared.message, "No run was created.").lines);
     }
+    // BAPI-1452: the launch capability gate checks the SAME clone the executor
+    // will own (`prepared.repoRoot`, its cwd) — not a second preparation.
+    const gate = await launchCapabilityGate(ctx, readiness, { kind: "local", repoRoot: prepared.prepared.repoRoot }, "No run was created.");
+    if (gate !== null)
+        return gate;
     const setup = await runSelectedSetupEpic(ctx);
     if (setup.exitCode !== 0) {
         // setup-epic already said why. Nothing was started for a run that may not exist.
@@ -2303,13 +3211,16 @@ async function createRunWithRunExecutor(ctx, readiness) {
             "server-side before retrying; retrying blindly could create a second run.",
         ]);
     }
-    // POST-CREATE: start or reuse exactly one executor scoped to this run.
+    // POST-CREATE: start or reuse exactly one executor scoped to this run. It
+    // receives the merge credential this launch resolved (BAPI-1461), so a token
+    // stored once works without exporting it or restarting the editor.
     const ensured = await deps.ensureRunExecutor({
         prepared: prepared.prepared,
         repoName: access.repoName,
         epicRunId: setup.epicRunId,
         access,
         profile,
+        mergeCredential: await launchCredentialForExecutor(ctx, readiness),
     });
     return reportExecutorOutcome(ctx, ensured, setup.epicRunId, "created");
 }
@@ -2400,7 +3311,7 @@ async function planeServesLiveRun(ctx, live) {
  *   - this checkout's plane bound to THIS run: its lanes serve it, start nothing;
  *   - otherwise: prepare, then ensure a run-scoped executor for the LIVE run's id.
  */
-async function attachToLiveRun(ctx, readiness, live) {
+async function attachToLiveRun(ctx, readiness, live, unusedDiscoveredPlan) {
     const { deps, epicKey, access, profile } = ctx;
     const classification = classifyV2Readiness(readiness, {
         attended: ctx.options.attended === true,
@@ -2409,7 +3320,7 @@ async function attachToLiveRun(ctx, readiness, live) {
     });
     if (classification.kind === "operator_blocked") {
         return refuse(deps, [
-            `${epicKey}: the engine path still needs ${classification.describe} (${classification.id}).`,
+            `${epicKey}: the engine path still needs ${classification.describe}.`,
             "",
             "This is not something starting the runtime can fix, so nothing was started.",
             operatorBlockedRemedy(classification),
@@ -2428,9 +3339,22 @@ async function attachToLiveRun(ctx, readiness, live) {
             if (admission !== null)
                 return refuse(deps, admission);
         }
+        // BAPI-1476: warning-only. An existing run is never stopped for freshness,
+        // and the plane is neither repaired nor restarted here.
+        await surfacePlaneFreshnessForExistingRun(ctx, manifest !== null
+            ? {
+                repoRoot: manifest.repoRoot,
+                ownsManifest: true,
+                planeId: manifest.planeId,
+                ...(manifest.epicRunId ? { epicRunId: manifest.epicRunId } : {}),
+            }
+            : { repoRoot: deps.cwd(), ownsManifest: false });
     }
-    deps.log(`${epicKey}: run ${live.epicRunId} is already live (${live.status}) and no plan was supplied or ` +
-        "found, so nothing will be created; making sure it has an executor.");
+    deps.log(unusedDiscoveredPlan === undefined
+        ? `${epicKey}: run ${live.epicRunId} is already live (${live.status}) and no plan was supplied or ` +
+            "found, so nothing will be created; making sure it has an executor."
+        : `${epicKey}: run ${live.epicRunId} is already live (${live.status}); the plan found by epic key ` +
+            `(${unusedDiscoveredPlan}) is not used, so nothing will be created; making sure it has an executor.`);
     if (live.effectivePolicy) {
         deps.log(`Effective policy: stored; serial execution; caps ${live.effectivePolicy.caps ? JSON.stringify(live.effectivePolicy.caps) : "unavailable"}; ` +
             `timeouts ${live.effectivePolicy.job_timeouts ? JSON.stringify(live.effectivePolicy.job_timeouts) : "unavailable"}; ` +
@@ -2472,6 +3396,7 @@ async function attachToLiveRun(ctx, readiness, live) {
         epicRunId: live.epicRunId,
         access,
         profile,
+        mergeCredential: await launchCredentialForExecutor(ctx, readiness),
     });
     return reportExecutorOutcome(ctx, ensured, live.epicRunId, "attached");
 }
@@ -2486,8 +3411,8 @@ function localReconcilerRefusal(epicKey, readiness) {
     const reasonId = reason ?? "local-reconciler-not-live";
     const remedy = reason !== null
         ? BRING_UP_REFUSAL_MESSAGES[reason]
-        : "the local conductor plane reports no live reconciler, so nothing would drive this run. " +
-            "Start it with `plane up`, or pass --plan-file so drive-epic can bring the runtime up.";
+        : "the local plane reports no live reconciler, so nothing would drive this run. " +
+            "Start it as `drive-epic --help-advanced` describes, or pass --plan-file so drive-epic can bring the runtime up.";
     return {
         reasonId,
         remedy,
@@ -2537,9 +3462,20 @@ export const DRIVE_EPIC_ACCESS_REFUSAL_REASON_IDS = {
     "credentials-unavailable": "access-credentials-unavailable",
     "credential-unbound": "access-credential-unbound",
 };
+/** BAPI-1452 — project launch rows into the stable preview shape. */
+function previewLaunchRows(checks) {
+    return checks.map((check) => ({
+        id: check.id,
+        label: check.label,
+        status: check.status,
+        blocking: check.blocking,
+        ...(check.detail ? { detail: check.detail } : {}),
+        ...(check.remediation ? { remedy: check.remediation } : {}),
+    }));
+}
 /** The readiness reason a preview reports for a generic not-ready engine. */
 const ENGINE_NOT_READY_REASON_ID = "engine-not-ready";
-const ENGINE_NOT_READY_REMEDY = `Resolve conductor readiness (\`${PRINTED_CONDUCTOR_INSTALL_COMMAND}\`, then \`${PRINTED_DOCTOR_COMMAND}\`) and run drive-epic again. ${PRINTED_CHECK_NAME_INSTRUCTION}`;
+const ENGINE_NOT_READY_REMEDY = `Resolve Epic Implementer readiness (\`${PRINTED_CONDUCTOR_INSTALL_COMMAND}\`, then \`${PRINTED_DOCTOR_COMMAND}\`) and run drive-epic again. ${PRINTED_CHECK_NAME_INSTRUCTION} See ${CONSUMER_GUIDE_POINTER}.`;
 /**
  * Read exactly one well-shaped setup-epic dry-run JSON document out of captured
  * `log` output. Anything else — none, several, or one with the wrong shape — is
@@ -2608,8 +3544,19 @@ function readSetupPreviewPayload(stdout) {
     return {
         existingRunId: typeof existing === "string" && existing !== "" ? existing : null,
         featureBranch: typeof branch === "string" && branch !== "" ? branch : null,
+        // An older bootstrap omits it; anything not a valid branch name is dropped.
+        scopeBaseBranch: typeof doc.scope_base_branch === "string" && validateBranchName(doc.scope_base_branch) === null
+            ? doc.scope_base_branch
+            : null,
         serverValidated: doc.server_validated,
         effectivePolicy,
+        ticketReview: typeof doc.ticket_review === 'string' && /^(on|off \(legacy choice not recorded\)|off requested \(admin key required; choice recorded at create\)|off \(set by actor_[a-z0-9]{4,32} on \d{4}-\d{2}-\d{2}\))$/.test(doc.ticket_review) ? doc.ticket_review : 'on',
+        launchReadiness: (() => { try {
+            return doc.launch_readiness ? parseConductorReadinessResponse(doc.launch_readiness) : null;
+        }
+        catch {
+            return null;
+        } })(),
     };
 }
 /** The plan DAG's node count, or `null` unless it parses to `{ nodes: [...] }`. */
@@ -2639,12 +3586,15 @@ async function runDriveEpicPreview(deps, options) {
         readiness: { kind: "unknown" },
         live_run: null,
         plan: { status: "not_found" },
+        already_done_children: { status: "not_checked", reason: "no_plan", children: [] },
         summary: {
             child_count: null,
+            children_to_run: null,
             branch: null,
             posture,
             auto_merge_scope: null,
             escalation_channel: null,
+            ticket_review: "on",
             server_validation: "not_run",
         },
         decision: "refuse",
@@ -2667,8 +3617,11 @@ async function runDriveEpicPreview(deps, options) {
         preview.refusal = { reason_id: named.reasonId, remedy: named.remedy };
         preview.decision = "refuse";
     };
+    // The readiness read previewDecision observed, for the reachability row. It stays
+    // `null` when no read succeeded, which the row reports as unconfirmed.
+    const observed = { readiness: null };
     try {
-        await previewDecision(deps, options, preview, refuseWithReadiness, refuseTopLevel);
+        await previewDecision(deps, options, preview, refuseWithReadiness, refuseTopLevel, observed);
     }
     catch {
         // Sanitized on purpose: nothing from the thrown value reaches the document.
@@ -2680,6 +3633,10 @@ async function runDriveEpicPreview(deps, options) {
         });
     }
     ensureRefusalExplained(preview);
+    const workerDatabase = await appendWorkerDatabaseAdvisoryRows(deps, preview);
+    appendEscalationReachabilityRow(preview, observed.readiness);
+    await appendExecutorBuildFreshnessWarning(deps, preview);
+    await appendLaunchNeedRows(deps, preview, observed, workerDatabase);
     const emitted = await emitPreview(deps, options, preview);
     // BAPI-1397 (F3): a `--json` document that could not reach stdout whole is a
     // failed preview, never a silently truncated one.
@@ -2687,9 +3644,159 @@ async function runDriveEpicPreview(deps, options) {
         return 1;
     return preview.decision === "create" || preview.decision === "attach" ? 0 : 1;
 }
+/**
+ * Give every `create` or `attach` preview exactly one non-blocking
+ * `escalation-reachability` row (BAPI-1490).
+ *
+ * Built from the readiness the preview already read and the channel the preview
+ * already resolved; it adds no request and never changes the decision, a refusal,
+ * a reason, or the exit code. A readiness that was not read (cold start, remote
+ * read failure) is passed as unavailable, so the row warns rather than vanishing.
+ * A refused or stopped preview describes no launch, so it gets none.
+ */
+function appendEscalationReachabilityRow(preview, readiness) {
+    if (preview.decision !== "create" && preview.decision !== "attach")
+        return;
+    const [row] = previewLaunchRows([
+        buildEscalationReachabilityCheck(readiness, preview.summary.escalation_channel),
+    ]);
+    preview.launch_checks = [
+        ...(preview.launch_checks ?? []).filter((existing) => existing.id !== ESCALATION_REACHABILITY_CHECK_ID),
+        row,
+    ];
+}
+/**
+ * Append a non-blocking `executor-build-freshness` warning to the preview when a
+ * local CLI override (`BAPI_MCP_CLI`) is set and the executor build is stale or
+ * unreadable. Fail-open and read-only: it never changes the decision, a refusal,
+ * readiness, or the exit code. A passing check, an unset or blank override, or a
+ * missing dependency leaves `launch_checks` untouched. A thrown check prints one
+ * fixed line and nothing from the exception.
+ */
+async function appendExecutorBuildFreshnessWarning(deps, preview) {
+    const override = process.env[BRIDGE_LAUNCHER_ENV];
+    if (override === undefined || override.trim() === "")
+        return;
+    if (deps.checkExecutorBuildFreshness === undefined)
+        return;
+    try {
+        const report = await deps.checkExecutorBuildFreshness(deps.cwd());
+        if (report.diagnostic === null)
+            return;
+        const outcome = report.outcomes.find((entry) => entry.status === "warn" || entry.status === "fail") ?? report.outcomes[0];
+        const row = {
+            id: "executor-build-freshness",
+            label: outcome?.label ?? "Executor build freshness",
+            status: "warn",
+            blocking: false,
+            ...(outcome?.detail ? { detail: outcome.detail } : {}),
+            remedy: PLANE_BUILD_FIX_REMEDIATION,
+        };
+        preview.launch_checks = [...(preview.launch_checks ?? []), row];
+    }
+    catch {
+        deps.errorLog("Executor build freshness check could not run.");
+    }
+}
+/**
+ * The base branch setup-epic's dry run reported, per preview. Kept off the
+ * preview document so its JSON shape is unchanged.
+ */
+const previewScopeBaseBranch = new WeakMap();
+/** Run one probe; a missing boundary or any rejection becomes the fallback fact. */
+async function guardedProbe(run, fallback) {
+    if (run === undefined)
+        return fallback;
+    try {
+        return await run();
+    }
+    catch {
+        return fallback;
+    }
+}
+/** Power evidence for the host the run's executor will run on. */
+async function collectHostPowerFact(deps, topology) {
+    // `local` and `plane_lane` executors run on this host (a plane lane is chosen
+    // only for this machine's own plane). Anything else runs elsewhere.
+    if (topology === undefined)
+        return { state: "unverifiable", reason: "unverified" };
+    if (topology.kind === "durable_profile")
+        return { state: "unverifiable", reason: "remote_executor" };
+    const inspect = deps.inspectHostSleep;
+    if (inspect === undefined)
+        return { state: "unverifiable", reason: "probe_failed" };
+    const repoRoot = topology.kind === "local" && topology.repoRoot !== null ? topology.repoRoot : deps.cwd();
+    const report = await inspect(repoRoot).catch(() => null);
+    return hostPowerFactFromReport(report);
+}
+/**
+ * Append the five launch-need rows to a `create` preview (BAPI-1506): worker DB
+ * role, self-hosted runner, host power (`host-sleep`), usage reset after the
+ * run, and the information-only epic branch behind base.
+ *
+ * Every probe runs concurrently and is guarded on its own, so a missing
+ * boundary, a rejection or a timeout is an `unverifiable` warning row. Rows
+ * are `blocking: false` and NEVER change the decision, a refusal, readiness or
+ * the exit code. An `attach`, refused or stopped preview gets none of them.
+ * The merged `worker-db-role` warning row is decorated in place rather than
+ * duplicated.
+ */
+async function appendLaunchNeedRows(deps, preview, observed, workerDatabase) {
+    if (preview.decision !== "create")
+        return;
+    try {
+        const repoRoot = deps.cwd();
+        const local = preview.target.kind === "local_plane";
+        const readiness = observed.readiness;
+        const access = observed.access;
+        const nowMs = (deps.now ?? Date.now)();
+        const [runner, power, usage, branch] = await Promise.all([
+            guardedProbe(deps.inspectRequiredRunners === undefined
+                ? undefined
+                : () => deps.inspectRequiredRunners({
+                    repoRoot,
+                    providerRepository: readiness?.provider_repository,
+                    gateProfile: readiness?.gate_profile,
+                }), { state: "unverifiable", reason: "probe_failed" }),
+            guardedProbe(() => collectHostPowerFact(deps, observed.launchTopology), { state: "unverifiable", reason: "probe_failed" }),
+            guardedProbe(deps.fetchUsageAdvisory === undefined || access === undefined
+                ? undefined
+                : () => deps.fetchUsageAdvisory(access), null),
+            guardedProbe(deps.inspectEpicBranchBehind === undefined
+                ? undefined
+                : () => deps.inspectEpicBranchBehind({
+                    repoRoot,
+                    branch: preview.summary.branch,
+                    baseBranch: previewScopeBaseBranch.get(preview) ?? null,
+                }), preview.summary.branch === null
+                ? { state: "not_applicable", reason: "no_epic_branch" }
+                : { state: "unverifiable", reason: "git_failed" }),
+        ]);
+        const workerRow = buildWorkerDbRoleLaunchRow(workerDatabase, local);
+        const rows = [
+            buildSelfHostedRunnerLaunchRow(runner),
+            buildHostPowerLaunchRow(power),
+            buildUsageResetAfterRunLaunchRow({
+                advisory: usage ?? REPOSITORY_USAGE_ADVISORY_UNAVAILABLE,
+                childCount: preview.summary.child_count,
+                nowMs,
+            }),
+            buildEpicBranchBehindBaseLaunchRow(branch),
+        ];
+        const existing = preview.launch_checks ?? [];
+        const roleIndex = existing.findIndex((row) => row.id === workerRow.id);
+        const merged = roleIndex >= 0
+            ? existing.map((row, index) => (index === roleIndex ? workerRow : row))
+            : [...existing, workerRow];
+        preview.launch_checks = [...merged, ...rows];
+    }
+    catch {
+        // Advisory only: leave the preview as it was.
+    }
+}
 /** The fixed explanation used when a refusal reached the end with none of its own. */
 export const PREVIEW_REFUSAL_FALLBACK_REASON_ID = "preview-refused";
-const PREVIEW_REFUSAL_FALLBACK_REMEDY = "The preview refused this launch without naming a specific cause. Resolve conductor readiness and preview again; nothing was created or started.";
+const PREVIEW_REFUSAL_FALLBACK_REMEDY = `The preview refused this launch without naming a specific cause. Resolve Epic Implementer readiness and preview again; nothing was created or started. See ${CONSUMER_GUIDE_POINTER}.`;
 function isNamedRefusal(value) {
     if (value === null || typeof value !== "object")
         return false;
@@ -2717,7 +3824,7 @@ export function ensureRefusalExplained(preview) {
         : { reason_id: PREVIEW_REFUSAL_FALLBACK_REASON_ID, remedy: PREVIEW_REFUSAL_FALLBACK_REMEDY };
 }
 /** Fill in `preview` by walking the same decisions a real launch makes, read-only. */
-async function previewDecision(deps, options, preview, refuseWithReadiness, refuseTopLevel) {
+async function previewDecision(deps, options, preview, refuseWithReadiness, refuseTopLevel, observed = { readiness: null }) {
     const { epicKey } = options;
     const unknownReadiness = () => refuseWithReadiness("unknown", {
         reasonId: READINESS_UNKNOWN_REASON_ID,
@@ -2753,11 +3860,22 @@ async function previewDecision(deps, options, preview, refuseWithReadiness, refu
             ? { source: accessResult.targetSource }
             : {}),
     };
-    const ctx = { deps, epicKey, options, access, profile, targetSource: accessResult.targetSource ?? "default" };
+    const ctx = {
+        deps,
+        epicKey,
+        options,
+        access,
+        profile,
+        targetSource: accessResult.targetSource ?? "default",
+        freshness: createPlaneFreshnessCache(),
+        launchCredential: {},
+    };
     // Discover before readiness so a selected local plane can preview its guarded
     // cold start. Keep the candidate out of ordinary failure documents.
     let planPath = options.planFile;
     let plan = { status: "not_found" };
+    // The full discovery result, kept for the guarded plane-down stop below.
+    let discovery = null;
     let docsRootUnresolved = false;
     if (planPath !== undefined) {
         plan = { status: "supplied", path: planPath };
@@ -2769,6 +3887,7 @@ async function previewDecision(deps, options, preview, refuseWithReadiness, refu
         }
         else {
             const discovered = await discoverEpicPlan(epicKey, docs.docsDir, deps.discoveryFs);
+            discovery = discovered;
             plan = {
                 status: discovered.status === "found" ? "found" : discovered.status === "plan_ambiguous" ? "ambiguous" : "not_found",
                 ...(discovered.status === "found" ? { path: discovered.path } : {}),
@@ -2782,12 +3901,21 @@ async function previewDecision(deps, options, preview, refuseWithReadiness, refu
                 planPath = discovered.path;
         }
     }
+    // Every later exit, refusal or not, reports the plan state as discovered.
+    preview.plan = plan;
     // --- Readiness. -----------------------------------------------------------
     let readiness;
     try {
         readiness = await deps.readReadiness(access);
     }
     catch (err) {
+        if (isSchemaIncompatibleError(err)) {
+            return refuseTopLevel({
+                reasonId: "schema-incompatible",
+                remedy: "Local schema incompatible: launch-critical schema objects are missing. " +
+                    `${SCHEMA_INCOMPATIBLE_REPAIR_ROUTE} Nothing was created or started.`,
+            });
+        }
         if (planPath !== undefined && endpoint !== null && profile?.executionMode !== "durable" &&
             err instanceof ConductorBridgeApiError && err.kind === "network") {
             const probe = await deps.probePlanePort(endpoint.host, endpoint.port).catch(() => ({ kind: "error" }));
@@ -2795,11 +3923,17 @@ async function previewDecision(deps, options, preview, refuseWithReadiness, refu
                 const preflight = await deps.runPlanePreflight(deps.cwd());
                 const blocker = firstPreconditionRefusal(preflight) ??
                     preflight.diagnostics.find((diagnostic) => diagnostic.severity === "blocking");
-                preview.plan = plan;
                 if (blocker) {
+                    // Keep the blocker's own evidence (e.g. Alembic revisions) and its
+                    // fix. The fixed sentence is only for a blocker that carries neither.
+                    const evidence = [blocker.message, blocker.remediation]
+                        .filter((part) => typeof part === "string" && part.trim() !== "")
+                        .join(" ");
                     return refuseTopLevel({
                         reasonId: blocker.check,
-                        remedy: `The local plane preflight refused ${blocker.check}. Fix that condition and preview again.`,
+                        remedy: evidence !== ""
+                            ? evidence
+                            : `The local plane preflight refused ${blocker.check}. Fix that condition and preview again.`,
                     });
                 }
                 if (!preflight.ok) {
@@ -2813,12 +3947,39 @@ async function previewDecision(deps, options, preview, refuseWithReadiness, refu
                 if (preview.decision === "create") {
                     preview.cold_start = { plane_endpoint: access.baseUrl, will_start_plane: true, live_run_checked: false };
                 }
+                // No plane exists yet, so there is no snapshot or database to compare;
+                // the host-sleep advisory still applies to the plane about to start.
+                observed.access = access;
+                observed.launchTopology = { kind: "local", repoRoot: null };
+                await applyPreviewFreshness(ctx, preview, {}, true);
+                return;
+            }
+        }
+        // The narrow no-plan stop. Mirrors the real launch exactly: a local,
+        // non-durable plane that refuses connections, and no usable plan. This is
+        // the pre-existing `stop` outcome with no refusal and no new reason id; the
+        // probe is the only port check the preview makes.
+        if (planPath === undefined &&
+            endpoint !== null &&
+            profile?.executionMode !== "durable" &&
+            err instanceof ConductorBridgeApiError &&
+            err.kind === "network" &&
+            discovery !== null &&
+            (discovery.status === "plan_not_found" || discovery.status === "plan_ambiguous")) {
+            const probe = await deps.probePlanePort(endpoint.host, endpoint.port).catch(() => ({ kind: "error" }));
+            if (probe.kind === "refused") {
+                preview.readiness = {
+                    kind: "unknown",
+                    remedy: planeDownNoPlanStopText(epicKey, { profile, options }, discovery),
+                };
+                preview.refusal = null;
+                preview.decision = "stop";
                 return;
             }
         }
         return unknownReadiness();
     }
-    preview.plan = plan;
+    observed.readiness = readiness;
     if (docsRootUnresolved)
         return refuseTopLevel(docsRootRefusal(epicKey));
     const live = await deps.readLiveEpicRun(access, epicKey);
@@ -2826,8 +3987,13 @@ async function previewDecision(deps, options, preview, refuseWithReadiness, refu
         return refuseTopLevel(liveRunAmbiguousRefusal(epicKey));
     if (live.kind === "unknown")
         return refuseTopLevel(liveRunUnknownRefusal(epicKey, live.reason));
-    const previewCtx = { ...ctx, options: { ...options, ...(planPath ? { planFile: planPath } : {}) } };
-    const prepared = planPath ? await prepareSetupSelection(previewCtx) : null;
+    // BAPI-1532 — a DISCOVERED plan beside a live run is unused: the launch attaches,
+    // so the effective plan path is cleared while the preview still reports the plan
+    // as found. An explicit --plan-file keeps its create-path behavior unchanged.
+    const attachingDiscoveredPlan = options.planFile === undefined && plan.status === "found" && live.kind === "live";
+    const effectivePlanPath = attachingDiscoveredPlan ? undefined : planPath;
+    const previewCtx = { ...ctx, options: { ...options, ...(effectivePlanPath ? { planFile: effectivePlanPath } : {}) } };
+    const prepared = effectivePlanPath ? await prepareSetupSelection(previewCtx) : null;
     if (prepared !== null && !prepared.ok) {
         return refuseTopLevel({
             reasonId: prepared.reasonId,
@@ -2838,13 +4004,19 @@ async function previewDecision(deps, options, preview, refuseWithReadiness, refu
         attended: options.attended === true,
         intoBase: options.intoBase === true,
         effectivePolicy: prepared?.ok ? prepared.handoff.selection : undefined,
-        approvedStoredPolicy: live.kind === "live" && !planPath,
+        approvedStoredPolicy: live.kind === "live" && !effectivePlanPath,
     });
     preview.readiness = { kind: classification.kind };
+    if (classification.kind === 'operator_blocked') {
+        const requirement = V2_READINESS_REQUIREMENTS.find(req => req.id === classification.id);
+        if (requirement)
+            preview.launch_checks = [{ id: requirement.id, label: requirement.describe, status: 'fail', blocking: true, remedy: classification.remedy }];
+    }
     const selection = selectConductor(readiness);
     // --- The live run. Conflict and unknown refuse whatever the plan says. ------
     if (live.kind === "live") {
         preview.live_run = { epic_run_id: live.epicRunId, status: live.status };
+        preview.summary.ticket_review = live.ticketReview ?? "on";
         if (live.effectivePolicy) {
             preview.summary.policy_source = live.effectivePolicy.source;
             preview.summary.serial_execution = live.effectivePolicy.serial_execution;
@@ -2852,11 +4024,14 @@ async function previewDecision(deps, options, preview, refuseWithReadiness, refu
             preview.summary.job_timeouts = live.effectivePolicy.job_timeouts;
             preview.summary.escalation_channel_label = live.effectivePolicy.escalation_channel;
             preview.summary.posture = live.effectivePolicy.posture;
-            preview.summary.escalation_channel = null;
+            preview.summary.escalation_channel =
+                live.effectivePolicy.escalation_channel === "configured webhook"
+                    ? "webhook"
+                    : live.effectivePolicy.escalation_channel === "account email" ? "email" : null;
         }
     }
     // --- No plan: attach to a live run, or stop. --------------------------------
-    if (planPath === undefined) {
+    if (effectivePlanPath === undefined) {
         if (live.kind !== "live") {
             if (selection.kind === "not_ready") {
                 return refuseWithReadiness(classification.kind, {
@@ -2870,20 +4045,47 @@ async function previewDecision(deps, options, preview, refuseWithReadiness, refu
         const blocked = previewReadinessRefusal(ctx, classification, readiness, planeTarget, "attach");
         if (blocked !== null)
             return refuseWithReadiness(classification.kind, blocked);
-        const facts = await previewExecutorFacts(ctx, readiness, planeTarget, live, "No run was changed");
+        const attachTopology = {};
+        const facts = await previewExecutorFacts(ctx, readiness, planeTarget, live, "No run was changed", attachTopology);
         if (facts !== null)
             return refuseWithReadiness(classification.kind, facts, true);
         preview.decision = "attach";
+        await applyPreviewFreshness(ctx, preview, attachTopology, false);
         return;
     }
+    // The create path below always has a plan.
+    const planPathForCreate = effectivePlanPath;
     // --- A plan is available: the create path's gates, then setup's own dry run. --
     const blocked = previewReadinessRefusal(ctx, classification, readiness, planeTarget, "create");
-    if (blocked !== null)
+    if (blocked !== null) {
+        // BAPI-1452: a disabled Setup-page posture keeps its exact control name and
+        // turn-it-back-on remedy in the structured output as well as the refusal.
+        if (classification.kind === "operator_blocked" && classification.id === "unattended_consent") {
+            preview.launch_checks = previewLaunchRows(projectReadinessRowBlocking([unattendedPostureCheck(readiness)], {
+                attended: options.attended === true,
+                intoBase: options.intoBase === true,
+            }));
+        }
         return refuseWithReadiness(classification.kind, blocked);
-    const facts = await previewExecutorFacts(ctx, readiness, planeTarget, null, "No run was created");
+    }
+    const topology = {};
+    const facts = await previewExecutorFacts(ctx, readiness, planeTarget, null, "No run was created", topology);
     if (facts !== null)
         return refuseWithReadiness(classification.kind, facts, true);
-    await finalizeCreatePreview(prepared?.ok ? { ...previewCtx, handoff: prepared.handoff } : previewCtx, preview, planPath, false, refuseTopLevel, live.kind === "live");
+    // BAPI-1452: the same launch evidence a real launch collects, before any
+    // setup preview. A local plane that still needs its runtime will run this
+    // launch on plane lanes, whose executor this launcher cannot inspect.
+    const launchTopology = planeTarget && classification.kind === "runtime_only"
+        ? { kind: "plane_lane" }
+        : topology.value ?? { kind: "local", repoRoot: null };
+    const launch = await previewLaunchCapability(prepared?.ok ? { ...previewCtx, handoff: prepared.handoff } : previewCtx, readiness, launchTopology);
+    preview.launch_checks = previewLaunchRows(launch.checks);
+    if (launch.refusal !== null)
+        return refuseWithReadiness("operator_blocked", launch.refusal);
+    observed.access = access;
+    observed.launchTopology = launchTopology;
+    await finalizeCreatePreview(prepared?.ok ? { ...previewCtx, handoff: prepared.handoff } : previewCtx, preview, planPathForCreate, false, refuseTopLevel, live.kind === "live");
+    await applyPreviewFreshness(ctx, preview, topology, false);
 }
 async function finalizeCreatePreview(ctx, preview, planPath, coldStart, refuseTopLevel, liveRunKnown = false) {
     const { deps, options, access } = ctx;
@@ -2905,11 +4107,59 @@ async function finalizeCreatePreview(ctx, preview, planPath, coldStart, refuseTo
             : prepared.handoff.selection.escalationChannel === "account email" ? "email" : null;
     }
     preview.summary.child_count = await readPlanChildCount(deps, planPath);
-    const setup = await deps.previewSetupEpic({
-        argv: [...buildSetupEpicArgv({ ...options, planFile: planPath }), ...(coldStart ? ["--local-only"] : []), "--dry-run", "--json"],
+    preview.summary.children_to_run = preview.summary.child_count;
+    // BAPI-1510 — the already-merged check, after plan discovery and BEFORE the
+    // setup dry run, so the dry run validates the plan a real create would submit.
+    // An attach, a disabled check, and a cold start (no plane to ask yet) classify
+    // nothing and keep every child.
+    let evaluation = null;
+    if (liveRunKnown) {
+        preview.already_done_children = { status: "not_checked", reason: "attach", children: [] };
+    }
+    else if (options.noMergedCheck === true) {
+        preview.already_done_children = { status: "not_checked", reason: "disabled", children: [] };
+    }
+    else if (coldStart) {
+        preview.already_done_children = { status: "not_checked", reason: "cold_start", children: [] };
+    }
+    else {
+        evaluation = await evaluateMergedChildren(ctx, planPath);
+        preview.already_done_children = evaluation.state;
+        if (evaluation.refusals.length > 0) {
+            return refuseTopLevel({
+                reasonId: "skip-child-refused",
+                remedy: `${skipRefusalRemedy(evaluation.refusals)} Nothing was created.`,
+            });
+        }
+        if (evaluation.skipKeys.size > 0 && evaluation.skipKeys.size >= evaluation.childKeys.length) {
+            return refuseTopLevel({
+                reasonId: EPIC_ALREADY_COMPLETE_REASON_ID,
+                remedy: EPIC_ALREADY_COMPLETE_REMEDY,
+            });
+        }
+        if (preview.summary.child_count !== null) {
+            preview.summary.children_to_run = preview.summary.child_count - evaluation.skipKeys.size;
+        }
+    }
+    const trim = evaluation !== null &&
+        evaluation.skipKeys.size > 0 &&
+        evaluation.plan !== null &&
+        evaluation.cutCommitSha !== null
+        ? { plan: trimDonePlanNodes(evaluation.plan, evaluation.skipKeys), cut: evaluation.cutCommitSha }
+        : null;
+    const runPreviewSetup = (effectivePlanPath) => deps.previewSetupEpic({
+        argv: [...buildSetupEpicArgv({ ...options, planFile: effectivePlanPath }), ...(coldStart ? ["--local-only"] : []), "--dry-run", "--json"],
         baseUrl: access.baseUrl,
-        handoff: prepared.handoff,
+        handoff: trim !== null ? { ...prepared.handoff, expectedCutCommitSha: trim.cut } : prepared.handoff,
     });
+    const setup = trim !== null
+        ? await (deps.withPlanPath ?? withPlanPath)({
+            originalPath: planPath,
+            trimmedJson: JSON.stringify(trim.plan, null, 2),
+            skipped: true,
+            warn: (message) => deps.errorLog(message),
+        }, runPreviewSetup)
+        : await runPreviewSetup(planPath);
     if (setup.exitCode !== 0) {
         preview.summary.server_validation = "failed";
         return refuseTopLevel({
@@ -2929,6 +4179,16 @@ async function finalizeCreatePreview(ctx, preview, planPath, coldStart, refuseTo
     }
     preview.summary.server_validation = payload.serverValidated ? "passed" : "partial";
     preview.summary.branch = payload.featureBranch;
+    if (payload.scopeBaseBranch !== null)
+        previewScopeBaseBranch.set(preview, payload.scopeBaseBranch);
+    preview.summary.ticket_review = payload.ticketReview;
+    if (payload.launchReadiness) {
+        preview.prerequisites = payload.launchReadiness.prerequisites;
+        preview.is_production = payload.launchReadiness.is_production;
+        const launch = classifyV2Readiness(payload.launchReadiness, { attended: options.attended, intoBase: options.intoBase });
+        if (launch.kind === 'operator_blocked')
+            return refuseTopLevel({ reasonId: launch.id, remedy: launch.remedy ?? 'Retry readiness.' });
+    }
     if (payload.effectivePolicy) {
         const facts = payload.effectivePolicy;
         preview.summary.policy_source = facts.source;
@@ -2945,6 +4205,9 @@ async function finalizeCreatePreview(ctx, preview, planPath, coldStart, refuseTo
         preview.summary.posture === "unattended" ? payload.featureBranch : null;
     // The bootstrap reusing a run IS an attach: it reports the run's id.
     if (payload.existingRunId !== null) {
+        // Existing runs are never trimmed: report the check as not applied.
+        preview.already_done_children = { status: "not_checked", reason: "attach", children: [] };
+        preview.summary.children_to_run = preview.summary.child_count;
         preview.live_run = {
             epic_run_id: payload.existingRunId,
             status: preview.live_run?.epic_run_id === payload.existingRunId ? preview.live_run.status : null,
@@ -2973,15 +4236,67 @@ function previewReadinessRefusal(ctx, classification, readiness, planeTarget, pa
     }
     return null;
 }
+/**
+ * Append the freshness rows to a preview and, for a decision that would CREATE a
+ * run, apply the creation policy. An `attach` decision (an existing live run, or a
+ * bootstrap that reuses one) only ever warns. Reads nothing for a non-plane target.
+ *
+ * Advisory by construction: an unexpected failure here leaves the preview exactly
+ * as it was.
+ */
+async function applyPreviewFreshness(ctx, preview, topology, coldStart) {
+    if (preview.decision !== "create" && preview.decision !== "attach")
+        return;
+    const { deps } = ctx;
+    if (planeEndpointForBaseUrl(deps, ctx.access.baseUrl) === null)
+        return;
+    try {
+        const manifest = topology.manifest ?? null;
+        const own = manifest !== null
+            ? {
+                repoRoot: manifest.repoRoot,
+                ownsManifest: true,
+                planeId: manifest.planeId,
+                ...(manifest.epicRunId ? { epicRunId: manifest.epicRunId } : {}),
+            }
+            : { repoRoot: deps.cwd(), ownsManifest: false };
+        const reports = coldStart ? null : await collectFreshnessObservations(ctx, own);
+        // BAPI-1506: a `create` preview reports host sleep as a launch need on every
+        // target (see appendLaunchNeedRows); only `attach` keeps it here.
+        const sleep = preview.decision === "attach" ? await collectHostSleep(ctx, own.repoRoot) : null;
+        // Read-only: one run-state read, local plane only, and only for a bound plane.
+        const boundRun = await boundRunForStaleRemedy(ctx, own, reports);
+        const assessment = assessPlaneFreshness(reports, sleep, preview.decision === "create" ? "create" : "attach", ctx.options.allowStalePlane === true, boundRun);
+        if (assessment.rows.length > 0) {
+            preview.launch_checks = [...(preview.launch_checks ?? []), ...assessment.rows];
+        }
+        const refusal = freshnessRefusalOf(assessment.blockers);
+        if (refusal !== null) {
+            preview.decision = "refuse";
+            preview.refusal = { reason_id: refusal.reasonId, remedy: refusal.remedy };
+        }
+    }
+    catch {
+        // Leave the preview as it was; nothing from the failure reaches the document.
+    }
+}
 /**
  * The executor-side refusals a real launch would hit, decided read-only: the
  * durable profile's coverage check, else whether an executor could be started
  * from this checkout at all. Returns `null` when neither refuses, including when
  * this checkout's plane already serves the live run and needs no executor.
  */
-async function previewExecutorFacts(ctx, readiness, planeTarget, live, outcome) {
+async function previewExecutorFacts(ctx, readiness, planeTarget, live, outcome, 
+/**
+ * BAPI-1452 — receives the executor topology a real launch would use.
+ * BAPI-1476 — and the attachable plane manifest this checkout owns, if any, so
+ * freshness compares only the selected plane's snapshot.
+ */
+topologyOut) {
     const { deps, epicKey, access, profile } = ctx;
     if (profile !== null && profile.executionMode === "durable") {
+        if (topologyOut)
+            topologyOut.value = { kind: "durable_profile" };
         if (durableActorAdmissionDenied(readiness)) {
             return {
                 reasonId: "actor-admission-denied",
@@ -2996,6 +4311,8 @@ async function previewExecutorFacts(ctx, readiness, planeTarget, live, outcome)
     if (planeTarget) {
         if (live !== null) {
             const manifest = await findAttachablePlane(ctx).catch(() => null);
+            if (topologyOut)
+                topologyOut.manifest = manifest;
             if (manifest?.epicRunId === live.epicRunId) {
                 const admission = await checkPlaneAdmission(ctx, readiness, manifest);
                 if (admission !== null) {
@@ -3005,15 +4322,140 @@ async function previewExecutorFacts(ctx, readiness, planeTarget, live, outcome)
             if (await planeServesLiveRun(ctx, live))
                 return null;
         }
-        else if ((await findAttachablePlane(ctx).catch(() => null)) !== null) {
-            return null;
+        else {
+            const attachable = await findAttachablePlane(ctx).catch(() => null);
+            if (topologyOut)
+                topologyOut.manifest = attachable;
+            if (attachable !== null) {
+                if (topologyOut)
+                    topologyOut.value = { kind: "plane_lane" };
+                return null;
+            }
         }
     }
     const inspected = await deps.inspectRunExecutorPrecondition(deps.cwd());
+    // BAPI-1452: the read-only inspection names the clone a run-scoped executor
+    // would own; the preview never calls `prepareRunExecutor` to learn it.
+    if (topologyOut && inspected.ok) {
+        topologyOut.value = { kind: "local", repoRoot: inspected.repoRoot ?? null };
+    }
     return inspected.ok
         ? null
         : executorPreconditionRefusal(epicKey, inspected.message, outcome === "No run was created" ? "No run was created." : "No run was changed.");
 }
+/**
+ * True for the guarded plane-down no-plan stop: a `stop` that is not a refusal,
+ * with unknown readiness carrying the shared handoff text as its remedy.
+ */
+function isPlaneDownStop(preview) {
+    return (preview.decision === "stop" &&
+        preview.refusal === null &&
+        preview.readiness.kind === "unknown" &&
+        typeof preview.readiness.remedy === "string" &&
+        preview.readiness.remedy !== "");
+}
+/**
+ * The escalation-reachability row as text, directly under the `Escalation:` line.
+ * An explicit `WARN` or `PASS` word carries the meaning (never colour), and the
+ * explanation and fix sit on their own indented lines so a narrow terminal wraps
+ * them beneath the label.
+ */
+function reachabilityLines(preview) {
+    const row = preview.launch_checks?.find((entry) => entry.id === ESCALATION_REACHABILITY_CHECK_ID);
+    if (row === undefined)
+        return [];
+    return [
+        `    ${row.status === "pass" ? "PASS" : "WARN"}  ${ESCALATION_REACHABILITY_CHECK_ID}`,
+        ...(row.detail ? [`      ${row.detail}`] : []),
+        ...(row.remedy ? [`      Fix: ${row.remedy}`] : []),
+    ];
+}
+/** Operator wording for each reason a child that was checked could not be proven merged. */
+const UNKNOWN_REASON_TEXT = {
+    ancestry_unknown: "its merge could not be compared with the indexed commit",
+    binding_ambiguous: "its delivery records name more than one pull request",
+    provider_unavailable: "the code host could not be read",
+    binding_read_failed: "its delivery records could not be read",
+    merge_sha_unavailable: "its merge commit could not be confirmed",
+    deadline_exceeded: "the check ran out of time",
+};
+const NOT_CHECKED_TEXT = {
+    disabled: "Merged check: turned off (--no-merged-check). Every child will run.",
+    attach: "Merged check: not applied; existing runs are unchanged.",
+    cold_start: "Merged check: will be checked at create.",
+    cut_commit_unavailable: "Merged check: the indexed commit could not be read. Every child will run.",
+    check_failed: "Merged check: could not complete. Every child will run.",
+    no_plan: null,
+};
+/**
+ * The already-merged summary for the human preview (BAPI-1510). Leads with the
+ * children to run and skipped, then the groups in a fixed order. Meaning is carried
+ * by words, never colour; only customer ticket keys and validated PR numbers appear.
+ */
+function alreadyDoneLines(preview) {
+    const s = preview.summary;
+    const state = preview.already_done_children ?? { status: "not_checked", reason: "no_plan", children: [] };
+    const lines = [];
+    if (preview.refusal?.reason_id === EPIC_ALREADY_COMPLETE_REASON_ID) {
+        lines.push("  Status:     no work to run — every child is already merged", `              ${preview.refusal.remedy}`);
+        return lines;
+    }
+    const skipped = state.children.filter((child) => child.will_skip);
+    if (state.status === "checked" || s.child_count !== null) {
+        if (s.children_to_run !== null && s.children_to_run !== undefined) {
+            lines.push(`  To run:     ${s.children_to_run}`);
+        }
+        lines.push(`  Skipped:    ${skipped.length}`);
+    }
+    if (state.status === "not_checked") {
+        const text = NOT_CHECKED_TEXT[state.reason];
+        if (text !== null)
+            lines.push(`  ${text}`);
+        return lines;
+    }
+    const pr = (child) => child.pr_number !== null && Number.isSafeInteger(child.pr_number) && child.pr_number > 0
+        ? ` (#${child.pr_number})`
+        : "";
+    if (skipped.length > 0) {
+        lines.push("  Skipped (already merged):");
+        for (const child of skipped) {
+            lines.push(`    ${child.ticket_key}${pr(child)} — ${child.classification === "done" ? "already merged" : "confirmed skip"}`);
+        }
+    }
+    const probably = state.children.filter((child) => child.classification === "probably_done" && !child.will_skip);
+    if (probably.length > 0) {
+        lines.push("  Probably done — confirmation needed:");
+        for (const child of probably) {
+            lines.push(`    ${child.ticket_key}${pr(child)} — on the indexed commit but has no delivery record; it will run. ` +
+                `To skip it, pass --skip-child ${child.ticket_key}.`);
+        }
+    }
+    const behind = state.children.filter((child) => child.reason === "merged_after_index");
+    for (const child of behind) {
+        lines.push(`    ${child.ticket_key}${pr(child)} — merged after the indexed commit; it will run. ` +
+            "Re-index the repository, or promote the branch it merged into, to skip it.");
+    }
+    const unknown = state.children.filter((child) => child.classification === "unknown");
+    if (unknown.some((child) => child.reason === "ancestry_unavailable_for_provider")) {
+        lines.push("  Merged-child detection is not supported for this repository's code host; every child will run.");
+    }
+    const byReason = new Map();
+    for (const child of unknown) {
+        if (child.reason === "ancestry_unavailable_for_provider")
+            continue;
+        byReason.set(child.reason, [...(byReason.get(child.reason) ?? []), child.ticket_key]);
+    }
+    for (const [reason, keys] of byReason) {
+        lines.push(`  Could not confirm ${keys.join(", ")}: ${UNKNOWN_REASON_TEXT[reason] ?? "the check was inconclusive"}. ` +
+            `${keys.length === 1 ? "It" : "They"} will run.`);
+    }
+    if (skipped.length > 0 && s.children_to_run === 1) {
+        lines.push(s.branch !== null
+            ? `  Strategy:   one child remains and runs on ${s.branch}`
+            : "  Strategy:   one child remains and runs directly on the repository base branch");
+    }
+    return lines;
+}
 /**
  * Print the preview: one JSON line with `--json`, short readable lines otherwise.
  *
@@ -3035,8 +4477,13 @@ async function emitPreview(deps, options, preview) {
         `  Readiness:  ${preview.readiness.kind}${preview.readiness.reason_id ? ` (${preview.readiness.reason_id})` : ""}`,
         `  Live run:   ${preview.live_run
             ? `${preview.live_run.epic_run_id}${preview.live_run.status ? ` (${preview.live_run.status})` : ""}`
-            : preview.cold_start ? "unchecked (plane not yet running)" : "none"}`,
-        `  Plan:       ${preview.plan.status}${preview.plan.path ? ` — ${preview.plan.path}` : ""}`,
+            : preview.cold_start ? "unchecked (plane not yet running)"
+                : isPlaneDownStop(preview) ? "unchecked (plane not running)" : "none"}`,
+        // BAPI-1532 — a plan found beside a live run is "Found, unused": the launch
+        // attaches and the local file is not read as approved input.
+        `  Plan:       ${preview.plan.status === "found" && preview.decision === "attach"
+            ? "Found, unused"
+            : preview.plan.status}${preview.plan.path ? ` — ${preview.plan.path}` : ""}`,
     ];
     for (const candidate of preview.plan.candidates ?? [])
         lines.push(`              candidate: ${candidate}`);
@@ -3044,15 +4491,35 @@ async function emitPreview(deps, options, preview) {
         lines.push(`              skipped:   ${skipped.path} (${skipped.reason})`);
     }
     const s = preview.summary;
-    lines.push(`  Posture:    ${s.posture ?? "n/a"}`, `  Children:   ${s.child_count ?? "n/a"}`, `  Branch:     ${s.branch ?? "n/a"}`, `  Auto-merge: ${s.auto_merge_scope ?? "n/a"}`, `  Escalation: ${s.escalation_channel ?? "n/a"}`, `  Validation: ${preview.cold_start ? "Partial — plane is not yet running" : s.server_validation ?? "n/a"}`, `  Decision:   ${preview.decision}`);
-    if (preview.readiness.remedy &&
+    lines.push(`  Ticket review: ${s.ticket_review ?? "on"}`, `  Posture:    ${s.posture ?? "n/a"}`, `  Children:   ${s.child_count ?? "n/a"}`, ...alreadyDoneLines(preview), `  Branch:     ${s.branch ?? "n/a"}`, `  Auto-merge: ${s.auto_merge_scope ?? "n/a"}`, `  Escalation: ${s.escalation_channel ?? "n/a"}`, ...reachabilityLines(preview), `  Validation: ${preview.cold_start ? "Partial — plane is not yet running" : s.server_validation ?? "n/a"}`, `  Decision:   ${preview.decision}`);
+    if (isPlaneDownStop(preview)) {
+        // The shared stop text, verbatim and unindented, so it reads exactly as the
+        // real launch prints it. It is a stop, not a refusal.
+        lines.push("", preview.readiness.remedy);
+    }
+    else if (preview.readiness.remedy &&
         preview.readiness.remedy !== preview.refusal?.remedy &&
         !preview.refusal?.reason_id.startsWith("access-")) {
         lines.push(`  Remedy:     ${preview.readiness.remedy}`);
     }
-    if (preview.refusal) {
+    if (preview.refusal && preview.refusal.reason_id !== EPIC_ALREADY_COMPLETE_REASON_ID) {
         lines.push(`  Refusal:    ${preview.refusal.reason_id} — ${preview.refusal.remedy}`);
     }
+    const summaryRows = (preview.launch_checks ?? []).filter(row => row.id !== ESCALATION_REACHABILITY_CHECK_ID);
+    lines.unshift(...formatLaunchReadinessSummary(summaryRows.map(row => ({
+        id: row.id, source: row.id.startsWith('server.') ? 'server' : 'conductor',
+        label: row.label, status: row.status, blocking: row.blocking,
+        ...(row.detail ? { detail: row.detail } : {}),
+        ...(row.remedy ? { remediation: row.remedy } : {}),
+    })), { all: options.all, isProduction: preview.is_production, prerequisites: preview.prerequisites }));
+    const localRows = summaryRows.filter(row => !READINESS_PREREQUISITE_BY_ID.has(READINESS_LEGACY_IDS[row.id] ?? row.id));
+    // BAPI-1506: launch-need rows get their own heading; they are not plane freshness.
+    const freshnessRows = localRows.filter(row => row.launch_need === undefined);
+    const launchNeedRows = localRows.filter(row => row.launch_need !== undefined);
+    if (freshnessRows.length)
+        lines.push(...renderFreshnessRows(freshnessRows));
+    if (launchNeedRows.length)
+        lines.push(...renderFreshnessRows(launchNeedRows, 'Launch needs (advisory; never blocks):'));
     deps.log(lines.join("\n"));
     return true;
 }