@claudexor/orchestrator 6.0.0 → 6.1.2

package/dist/orchestrator.js

@@ -51,10 +51,10 @@ import { budgetFailureRecord, classifyBudgetFailure } from "./budgetFailure.js";
 import { finalizeStructuredOutput } from "./structuredOutput.js";
 import { prepareRunAdmission } from "./runAdmission.js";
 import { dropDeltaPastBudget, emitPlanProgress, emitTransientExhausted, observeUsageSpend, recordAdapterThrow, } from "./laneStreamEvents.js";
-import { promptWithEngineConstraints, sleep, harnessEventPayload, safeErrorMessage, renderSummary, observeBudgetSignals, rotateOnStall, recordCleanAttemptMetrics, envInheritance, transientRetryPolicy, reviewerTimeoutMs, harnessInactivityTimeoutMs, observeAuthSwitch, emitPoolDegraded, deliveryRefusalFailure, winnerNeedsHuman, writeRaceDeliveryDecision, } from "./runSupport.js";
+import { promptWithEngineConstraints, sleep, harnessEventPayload, safeErrorMessage, renderSummary, observeBudgetSignals, rotateOnStall, recordCleanAttemptMetrics, envInheritance, transientRetryPolicy, reviewerTimeoutMs, harnessInactivityTimeoutMs, laneSuspension, observeAuthSwitch, emitPoolDegraded, deliveryRefusalFailure, winnerNeedsHuman, writeRaceDeliveryDecision, } from "./runSupport.js";
 import { candidateStatusInRouteContext, resolveReadOnlyRouteContext, } from "./routeContext.js";
 import { resolveAutoReviewerPanel, resolveExplicitReviewerPanel } from "./reviewerPanel.js";
-import { ensureClaudeBridgeForRun, ensureWriteModeGitBoundary } from "./git-precondition.js";
+import { ensureWriteModeGitBoundary } from "./git-precondition.js";
 import { buildContinuation } from "./continuity.js";
 import { resolveContinuitySummary, threadContinuityRequest } from "./continuity-facts.js";
 import { runDiffReview } from "./diffReview.js";
@@ -84,7 +84,7 @@ import { ReadinessLedger, evaluateConvergence, failureSignature, gatesPassed, re
 import { arbitrate } from "@claudexor/arbitration";
 import { buildSynthesisPlan, decideSynthesis } from "@claudexor/synthesis";
 import { billingKnowledgeForAuthRoute, attemptUsageCostSettlement, BudgetLedger, isBudgetTerminal, explainRanking, loadHarnessMetrics, promptFingerprint, rankHarnesses, } from "@claudexor/budget";
-import { hashJson, newId, noProjectRepoRoot, redactSecrets, safeInvoke, userConfigDir, } from "@claudexor/util";
+import { hashJson, measureSync, newId, noProjectRepoRoot, pacedByAppends, redactSecrets, safeInvoke, userConfigDir, } from "@claudexor/util";
 const LABELS = "ABCDEFGHIJ".split("");
 const NO_PROJECT_ROOT = noProjectRepoRoot();
 export class Orchestrator {
@@ -231,14 +231,14 @@ export class Orchestrator {
         }
         catch (err) {
             const message = safeErrorMessage(err);
-            store.writeText(join(paths.contextDir, "context_error.md"), `# Reviewer Panel Error\n\n${message}\n`);
+            await store.writeTextAsync(join(paths.contextDir, "context_error.md"), `# Reviewer Panel Error\n\n${message}\n`);
             writeFailure(store, paths, {
                 phase: "review_preflight",
                 category: "harness_unavailable",
                 safeMessage: message,
                 runDir: paths.root,
             });
-            store.writeText(join(paths.finalDir, "summary.md"), `# Run ${runId} (${mode})\n\n- Lifecycle: failed\n- Phase: review preflight\n\n${message}\n`);
+            await store.writeTextAsync(join(paths.finalDir, "summary.md"), `# Run ${runId} (${mode})\n\n- Lifecycle: failed\n- Phase: review preflight\n\n${message}\n`);
             log.emit("output.ready", { kind: "summary", path: "final/summary.md", state: "diagnostic" });
             log.emit("run.failed", {
                 lifecycle: "failed",
@@ -971,7 +971,7 @@ export class Orchestrator {
             include: projectCtx.include,
             exclude: projectCtx.exclude,
         });
-        store.writeYaml(join(paths.contextDir, "context_pack.yaml"), pack);
+        await store.writeYamlAsync(join(paths.contextDir, "context_pack.yaml"), pack);
         log.emit("context.pack.created", {
             hash: pack.hash,
             files: pack.atlas.length,
@@ -1188,7 +1188,7 @@ export class Orchestrator {
             if (!result.packetMarkdown)
                 return { pointerLine: null };
             const briefPath = join(paths.contextDir, "THREAD.md");
-            store.writeText(briefPath, result.packetMarkdown);
+            await store.writeTextAsync(briefPath, result.packetMarkdown);
             return {
                 pointerLine: threadContextPointer(briefPath),
             };
@@ -1419,6 +1419,7 @@ export class Orchestrator {
                 const rateLimitStart = telemetry.rateLimits.length;
                 rawLane.beginTry();
                 try {
+                    const pacing = { waiting: false, version: 0 };
                     const watched = withInactivityWatchdog(runModelGovernedRoute(routed, runSpec, dispatch), {
                         timeoutMs: inactivityMs,
                         countsAsProgress: countsAsAgentProgress,
@@ -1428,12 +1429,11 @@ export class Orchestrator {
                         },
                         // Waiting on the USER is legitimate silence. The interaction policy
                         // either enforces a finite deadline or waits until answer/cancel/
-                        // terminal/restart when the timeout is disabled.
-                        isSuspended: () => (interaction?.pendingCount?.() ?? 0) > 0,
-                        suspensionVersion: () => interaction?.suspensionVersion?.() ?? 0,
+                        // terminal/restart when the timeout is disabled. So is the journal wait.
+                        ...laneSuspension(pacing, interaction),
                         stopSignal: signal, // after Stop: drained events are recorded, never used
                     });
-                    for await (const ev of watched) {
+                    for await (const ev of pacedByAppends(watched, [paths.eventsPath], pacing)) {
                         // After Stop: stored evidence only, but file paths are still collected for the capture.
                         const stopped = signal?.aborted === true;
                         if (!stopped)
@@ -1708,7 +1708,7 @@ export class Orchestrator {
             aborted: signal?.aborted === true,
             authMode: telemetry.authMode,
         });
-        const { produced: producedFiles, omitted: producedOmitted } = AC.withAttemptFailureCost(() => writeCandidateAttemptArtifacts({
+        const { produced: producedFiles, omitted: producedOmitted } = await AC.withAttemptFailureCost(() => writeCandidateAttemptArtifacts({
             store,
             attemptDir,
             worktreePath: envelope.worktree_path,
@@ -1838,7 +1838,7 @@ export class Orchestrator {
         const mutatingRun = isMutatingAccess(contract.access.effective_profile);
         const planBrief = verifiedPlanBrief(input);
         const quotaSnapshots = this.quotaSnapshotPreflight();
-        const { store, paths, log, ledger, runContext } = beginAnnouncedRun({
+        const { store, paths, log, ledger, runContext } = await beginAnnouncedRun({
             input,
             contract,
             quotaSnapshots,
@@ -1860,7 +1860,7 @@ export class Orchestrator {
         const projectRoot = input.repoRoot;
         const wsm = new WorkspaceManager(execRoot, { projectRoot, runtimeRoot: runRuntimeRoot(input) });
         const anchors = secretDiff.revertAnchors(execRoot, projectRoot);
-        store.writeYaml(join(paths.contextDir, "task.yaml"), contract);
+        await store.writeYamlAsync(join(paths.contextDir, "task.yaml"), contract);
         log.emit("task.contract.created", { task_contract_hash: hashJson(contract) });
         // Write modes need a git boundary for worktree isolation and honest diffs.
         // A non-git project folder is initialized automatically (baseline commit),
@@ -1884,11 +1884,6 @@ export class Orchestrator {
                 };
             }
         }
-        // Same run-prep stage as the git boundary: if the PROJECT root uses AGENTS.md
-        // with no CLAUDE.md, bridge it so a Claude Code candidate reads it (INV-113).
-        if (mutatingRun && input.workspaceKind !== "directory") {
-            ensureClaudeBridgeForRun(input.repoRoot, input.inPlace === true, log);
-        }
         // Pre-turn snapshot of the live tree for in-place runs: the revert restore
         // target (server-owned revertInPlace). A snapshot failure must never fail the
         // run — revert is simply unavailable then.
@@ -2213,7 +2208,7 @@ export class Orchestrator {
                     error: message,
                     phase: infraPhase,
                 });
-                store.writeYaml(join(paths.attemptsDir, slot.attemptId, "attempt.yaml"), AC.attemptFailureRecord(slot.attemptId, adapter.id, failureCost, infraPhase, message, applied));
+                await store.writeYamlAsync(join(paths.attemptsDir, slot.attemptId, "attempt.yaml"), AC.attemptFailureRecord(slot.attemptId, adapter.id, failureCost, infraPhase, message, applied));
                 runsBySlot[slotIdx] = {
                     attemptId: slot.attemptId,
                     harnessId: adapter.id,
@@ -2410,7 +2405,7 @@ export class Orchestrator {
                 sources: evidences.map((evidence) => evidence.attemptId),
             };
         try {
-            store.writeYaml(join(paths.arbitrationDir, "synthesis.yaml"), synth);
+            await store.writeYamlAsync(join(paths.arbitrationDir, "synthesis.yaml"), synth);
             log.emit("synthesis.started", { synthesize: synth.synthesize, reason: synth.reason });
             if (synth.synthesize && !budgetStopped) {
                 const synthRouted = adapters[0];
@@ -2583,7 +2578,7 @@ export class Orchestrator {
                 facts = { ...facts, checks: "failed", reason: "checks_failed" };
         }
         const needsDec = facts.review === "blocked" || facts.checks === "failed";
-        store.writeYaml(join(paths.arbitrationDir, "decision.yaml"), {
+        await store.writeYamlAsync(join(paths.arbitrationDir, "decision.yaml"), {
             ...result.decision,
             ...(needsDec
                 ? blockedDecisionOverride(result.decision.evidence_facts, facts, finalVerify)
@@ -2591,7 +2586,7 @@ export class Orchestrator {
             review_verified: actualReviewVerified,
             final_verify: finalVerify,
         });
-        store.writeYaml(join(paths.arbitrationDir, "pairwise.yaml"), result.pairwise);
+        await store.writeYamlAsync(join(paths.arbitrationDir, "pairwise.yaml"), result.pairwise);
         const decisionPath = join(paths.arbitrationDir, "decision.yaml");
         // Every attempt's failed tries by the FINAL outcome (delivery below can
         // still fail the checks); a review or check block is not an account failure.
@@ -2606,7 +2601,7 @@ export class Orchestrator {
             }
             const winnerAnswer = winnerRun.answerText ?? "";
             if (winnerAnswer.length > 0) {
-                store.writeText(join(paths.finalDir, "answer.md"), winnerAnswer + "\n");
+                await store.writeTextAsync(join(paths.finalDir, "answer.md"), winnerAnswer + "\n");
             }
             if (contract.output_schema) {
                 finalizeStructuredOutput({
@@ -2628,7 +2623,7 @@ export class Orchestrator {
                     const delivered = await verifyAndDeliverFiles(execRoot, winnerRun.files, {}, gateSpecsFromContract(contract, input.runScopeMarker), (freshVerify) => finalVerifyBlocks(freshVerify)
                         ? (freshVerify.reason ?? "final verify failed before directory race adoption")
                         : null, log);
-                    store.writeYaml(join(paths.finalDir, "delivery_receipt.yaml"), delivered);
+                    await store.writeYamlAsync(join(paths.finalDir, "delivery_receipt.yaml"), delivered);
                     directoryDeliveryReceipt = true;
                     directoryDelivery = delivered;
                     finalVerify = delivered.finalVerify;
@@ -2660,7 +2655,7 @@ export class Orchestrator {
                 });
             }
             else if (mutatingRun) {
-                const savedPatch = secretDiff.persistFinalPatch(store, paths.finalDir, winnerRun);
+                const savedPatch = await secretDiff.persistFinalPatch(store, paths.finalDir, winnerRun);
                 const patchSha256 = savedPatch.patchSha256;
                 const wstats = secretDiff.resultDiffStats(winnerRun);
                 const hasDiff = secretDiff.hasCandidateChanges(winnerRun);
@@ -2695,7 +2690,7 @@ export class Orchestrator {
                                 : null;
                         }, log);
                         raceDeliveryReceipt = applied;
-                        store.writeYaml(join(paths.finalDir, "delivery_receipt.yaml"), applied);
+                        await store.writeYamlAsync(join(paths.finalDir, "delivery_receipt.yaml"), applied);
                         finalVerify = applied.finalVerify;
                         if (applied.applied) {
                             adopted = true;
@@ -2741,7 +2736,7 @@ export class Orchestrator {
                     revertAnchorId = await anchors.turn(preTurnSha, postTurnSha);
                 }
                 const capturedNoGitChange = capturedNoGitChangeValue(winnerRun);
-                store.writeYaml(join(paths.finalDir, "work_product.yaml"), {
+                await store.writeYamlAsync(join(paths.finalDir, "work_product.yaml"), {
                     id: newId("wp"),
                     kind: input.create === true ? "new_repo" : "patch",
                     source_task_id: taskId,
@@ -2776,7 +2771,7 @@ export class Orchestrator {
                     },
                 });
             }
-            store.writeText(join(paths.finalDir, "summary.md"), withPoolAttempts(renderSummary(runId, mode, { ...result.decision, facts }, evidences, synth.reason, actualReviewVerified, delegateFailure.raceSummaryDisclosure(winnerRun, runs)), racePool()));
+            await store.writeTextAsync(join(paths.finalDir, "summary.md"), withPoolAttempts(renderSummary(runId, mode, { ...result.decision, facts }, evidences, synth.reason, actualReviewVerified, delegateFailure.raceSummaryDisclosure(winnerRun, runs)), racePool()));
             // summary.md is a DIAGNOSTIC artifact only (V8/PLAN addendum 2): it no
             // longer carries primary-output authority. A clean applyable success or a
             // winner answer still marks it ready for legacy INV-116 ordering; any
@@ -2888,7 +2883,7 @@ export class Orchestrator {
                 ...(decisionBlock ? {} : erroredWinnerFailure(winnerRun, keptSources)),
             });
             if (!winnerRun) {
-                store.writeText(join(paths.finalDir, "summary.md"), `# Run ${runId} (${mode})\n\n- Lifecycle: ${facts.lifecycle}${facts.reason ? ` (${facts.reason})` : ""}\n- Phase: arbitration\n\n${withPoolAttempts(result.decision.why_winner, pool)}\n`);
+                await store.writeTextAsync(join(paths.finalDir, "summary.md"), `# Run ${runId} (${mode})\n\n- Lifecycle: ${facts.lifecycle}${facts.reason ? ` (${facts.reason})` : ""}\n- Phase: arbitration\n\n${withPoolAttempts(result.decision.why_winner, pool)}\n`);
                 log.emit("output.ready", {
                     kind: "summary",
                     path: "final/summary.md",
@@ -2954,9 +2949,10 @@ export class Orchestrator {
     writeRunTelemetry(store, paths, contract, runId, taskId, mode, attempts, finalAttemptId, deepScanSynthesis) {
         // QA-034: attach the routing rationale recorded at pool ordering (if this
         // run computed one), then clear it — telemetry is written once at terminal.
+        // It stays synchronous (several callers are synchronous callbacks), labeled (#688).
         const routingRationale = this.routingRationaleByRun.get(runId) ?? null;
         this.routingRationaleByRun.delete(runId);
-        writeRunTelemetryArtifact({
+        measureSync("run.telemetry_write", () => writeRunTelemetryArtifact({
             store,
             finalDir: paths.finalDir,
             contract,
@@ -2968,7 +2964,7 @@ export class Orchestrator {
             routingRationale,
             deepScanSynthesis: deepScanSynthesis ?? null,
             resolveAuthPreference: (harnessId) => this.authPreferenceForHarness(contract.repo.root, harnessId, contract.auth_preference),
-        });
+        }));
     }
     /**
      * SINGLE funnel for every reviewer-panel invocation: run it inside a per-review
@@ -3022,7 +3018,7 @@ export class Orchestrator {
         const contract = this.buildContract(input, taskId, mode);
         const planBrief = verifiedPlanBrief(input);
         const quotaSnapshots = this.quotaSnapshotPreflight();
-        const { store, paths, log, ledger, runContext } = beginAnnouncedRun({
+        const { store, paths, log, ledger, runContext } = await beginAnnouncedRun({
             input,
             contract,
             quotaSnapshots,
@@ -3047,7 +3043,7 @@ export class Orchestrator {
         });
         const anchors = secretDiff.revertAnchors(execRoot, input.repoRoot);
         const readiness = new ReadinessLedger();
-        store.writeYaml(join(paths.contextDir, "task.yaml"), contract);
+        await store.writeYamlAsync(join(paths.contextDir, "task.yaml"), contract);
         // Legacy Git envelopes need their boundary; explicit directory execution
         // keeps the requested strategy without initializing the selected folder.
         if (!input.inPlace && input.workspaceKind !== "directory") {
@@ -3066,11 +3062,6 @@ export class Orchestrator {
                     candidates: [],
                 };
             }
-            // Same run-prep stage as the git boundary (and the same `!inPlace`
-            // exclusion — we are inside that branch, so inPlace is false here): bridge
-            // an AGENTS.md-only PROJECT root so a Claude Code convergence attempt reads
-            // it (INV-113).
-            ensureClaudeBridgeForRun(input.repoRoot, false, log);
         }
         const reviewDir = join(paths.root, "review-evidence");
         if (contract.review_requested !== false)
@@ -3118,7 +3109,7 @@ export class Orchestrator {
         if (contract.convergence.require_final_cross_family_clean_review && !reviewVerified) {
             const message = `convergence requires a cross-family clean review (>=2 healthy reviewer provider families); found ${new Set(reviewers.map((r) => r.providerFamily)).size}. ` +
                 "Configure reviewers from a second provider family and check `claudexor doctor` for reviewer readiness.";
-            store.writeText(join(paths.contextDir, "context_error.md"), `# Convergence Preflight Error\n\n${message}\n`);
+            await store.writeTextAsync(join(paths.contextDir, "context_error.md"), `# Convergence Preflight Error\n\n${message}\n`);
             writeFailure(store, paths, {
                 phase: "review",
                 category: "policy",
@@ -3129,7 +3120,7 @@ export class Orchestrator {
                     "Check harness doctor for reviewer readiness",
                 ],
             });
-            store.writeText(join(paths.finalDir, "summary.md"), `# Run ${runId} (${mode})\n\n- Lifecycle: failed\n- Phase: review preflight\n\n${message}\n`);
+            await store.writeTextAsync(join(paths.finalDir, "summary.md"), `# Run ${runId} (${mode})\n\n- Lifecycle: failed\n- Phase: review preflight\n\n${message}\n`);
             log.emit("output.ready", { kind: "summary", path: "final/summary.md", state: "diagnostic" });
             log.emit("run.failed", {
                 lifecycle: "failed",
@@ -3294,7 +3285,7 @@ export class Orchestrator {
                         status: "failed",
                         error: message,
                     });
-                    store.writeYaml(join(paths.attemptsDir, attemptId, "attempt.yaml"), AC.attemptFailureRecord(attemptId, adapter.id, failureCost, "harness", message, applied));
+                    await store.writeYamlAsync(join(paths.attemptsDir, attemptId, "attempt.yaml"), AC.attemptFailureRecord(attemptId, adapter.id, failureCost, "harness", message, applied));
                     run = {
                         applied,
                         attemptId,
@@ -3550,7 +3541,7 @@ export class Orchestrator {
                 toCandidateEvidence(lastRun, contract, lastFindings, lastFinalReviewClean, actualReviewVerified),
             ], { ...arbitrationBudgetOptions(ledger), reviewRequested: contract.review_requested });
             decision = arb.decision;
-            store.writeYaml(join(paths.arbitrationDir, "decision.yaml"), decision);
+            await store.writeYamlAsync(join(paths.arbitrationDir, "decision.yaml"), decision);
             // A converged run adopts the arbitration axes (checks/review); an
             // otherwise not-converged loop that nonetheless produced an applyable
             // decision adopts it too.
@@ -3626,7 +3617,7 @@ export class Orchestrator {
                     : { facts }),
                 final_verify: convFinalVerify,
             };
-            store.writeYaml(join(paths.arbitrationDir, "decision.yaml"), decision);
+            await store.writeYamlAsync(join(paths.arbitrationDir, "decision.yaml"), decision);
         }
         this.writeRunTelemetry(store, paths, contract, runId, taskId, mode, attemptTelemetries, lastRun?.attemptId ?? null);
         // Deliver the converged/last work to final/ so `apply` and `inspect` can
@@ -3648,7 +3639,7 @@ export class Orchestrator {
                 });
             }
             else {
-                const savedPatch = secretDiff.persistFinalPatch(store, paths.finalDir, lastRun);
+                const savedPatch = await secretDiff.persistFinalPatch(store, paths.finalDir, lastRun);
                 const patchSha256 = savedPatch.patchSha256;
                 // Honest apply-state (parity with runRace single-candidate in-place): a
                 // convergence run with inPlace mutated the live tree directly across its
@@ -3662,7 +3653,7 @@ export class Orchestrator {
                     : "not_applied";
                 const revertAnchorId = convAdopted === true ? await anchors.turn(preTurnSha, lastPostTurnSha) : null;
                 const capturedNoGitChange = capturedNoGitChangeValue(lastRun);
-                store.writeYaml(join(paths.finalDir, "work_product.yaml"), {
+                await store.writeYamlAsync(join(paths.finalDir, "work_product.yaml"), {
                     id: newId("wp"),
                     kind: "patch",
                     source_task_id: taskId,
@@ -3688,10 +3679,10 @@ export class Orchestrator {
             }
             // The exact answer is kept for every convergence result, patch or files.
             if (lastRun.answerText) {
-                store.writeText(join(paths.finalDir, "answer.md"), lastRun.answerText);
+                await store.writeTextAsync(join(paths.finalDir, "answer.md"), lastRun.answerText);
                 log.emit("output.ready", { kind: "answer", path: "final/answer.md" });
             }
-            store.writeText(join(paths.finalDir, "summary.md"), `${withPoolAttempts(`# Run ${runId} (${mode})\n\n- Lifecycle: ${facts.lifecycle}${facts.reason ? ` (${facts.reason})` : ""}\n- Attempts: ${attempt}\n- Winner: ${lastRun.attemptId}\n- Review verified (cross-family): ${actualReviewVerified}\n- Apply recommendation: ${decision?.apply_recommendation ?? "inspect"}${stuckNoProgressReason ? `\n- No-progress reason: ${stuckNoProgressReason}` : ""}${convCause ? `\n- Failure: ${convCause}` : ""}${secretDiff.resultSummaryDisclosure(lastRun)}`, convPool)}\n`);
+            await store.writeTextAsync(join(paths.finalDir, "summary.md"), `${withPoolAttempts(`# Run ${runId} (${mode})\n\n- Lifecycle: ${facts.lifecycle}${facts.reason ? ` (${facts.reason})` : ""}\n- Attempts: ${attempt}\n- Winner: ${lastRun.attemptId}\n- Review verified (cross-family): ${actualReviewVerified}\n- Apply recommendation: ${decision?.apply_recommendation ?? "inspect"}${stuckNoProgressReason ? `\n- No-progress reason: ${stuckNoProgressReason}` : ""}${convCause ? `\n- Failure: ${convCause}` : ""}${secretDiff.resultSummaryDisclosure(lastRun)}`, convPool)}\n`);
             // Lifecycle invariant (all modes): output.ready precedes the terminal
             // event so a client that applied the terminal event has the output.
             log.emit("output.ready", {
@@ -3774,7 +3765,7 @@ export class Orchestrator {
             // ARCHITECTURE event contract guarantees output.ready precedes the
             // terminal in every mode.
             if (!lastRun || (interrupted && input.inPlace !== true && !lastRun.files)) {
-                store.writeText(join(paths.finalDir, "summary.md"), `${withPoolAttempts(`# Run ${runId} (${mode})\n\n- Lifecycle: ${facts.lifecycle}${facts.reason ? ` (${facts.reason})` : ""}\n- Attempts: ${attempt}`, convPool)}\n`);
+                await store.writeTextAsync(join(paths.finalDir, "summary.md"), `${withPoolAttempts(`# Run ${runId} (${mode})\n\n- Lifecycle: ${facts.lifecycle}${facts.reason ? ` (${facts.reason})` : ""}\n- Attempts: ${attempt}`, convPool)}\n`);
                 log.emit("output.ready", {
                     kind: "summary",
                     path: "final/summary.md",
@@ -3918,7 +3909,7 @@ export class Orchestrator {
         // contract validation runs BEFORE the run is announced (see runRace).
         const contract = this.buildContract(input, taskId, "plan");
         const quotaSnapshots = this.quotaSnapshotPreflight();
-        const { store, paths, log, ledger } = beginAnnouncedRun({
+        const { store, paths, log, ledger } = await beginAnnouncedRun({
             input,
             contract,
             quotaSnapshots,
@@ -3930,7 +3921,7 @@ export class Orchestrator {
             phase: "plan",
             prompt: input.prompt,
         }, announce);
-        store.writeYaml(join(paths.contextDir, "task.yaml"), contract);
+        await store.writeYamlAsync(join(paths.contextDir, "task.yaml"), contract);
         log.emit("task.contract.created", { task_contract_hash: hashJson(contract) });
         // W3.3: ONE resolved read-only context — the routing point-probe and every
         // planner spawn consume the SAME scoped env (see routeContext.ts).
@@ -3946,7 +3937,7 @@ export class Orchestrator {
             adapters = await this.resolveCandidateAdapters({ ...input, n: undefined }, "plan", ledger, log, roHome, runId);
         }
         catch (err) {
-            roHome.dispose();
+            await roHome.dispose();
             const message = safeErrorMessage(err);
             writeRoutingFailureTerminal(store, paths, log, {
                 runId,
@@ -3973,16 +3964,16 @@ export class Orchestrator {
             contextSection = await this.lazyContextSection(input, contract, store, paths, log);
         }
         catch (err) {
-            roHome.dispose();
+            await roHome.dispose();
             const message = safeErrorMessage(err);
-            store.writeText(join(paths.contextDir, "context_error.md"), `# Context Error\n\n${message}\n`);
+            await store.writeTextAsync(join(paths.contextDir, "context_error.md"), `# Context Error\n\n${message}\n`);
             writeFailure(store, paths, {
                 phase: "context",
                 category: "project",
                 safeMessage: message,
                 runDir: paths.root,
             });
-            store.writeText(join(paths.finalDir, "summary.md"), `# Run ${runId} (plan)\n\n- Lifecycle: failed\n- Phase: context\n\n${message}\n`);
+            await store.writeTextAsync(join(paths.finalDir, "summary.md"), `# Run ${runId} (plan)\n\n- Lifecycle: failed\n- Phase: context\n\n${message}\n`);
             log.emit("output.ready", { kind: "summary", path: "final/summary.md", state: "diagnostic" });
             log.emit("run.failed", {
                 lifecycle: "failed",
@@ -4095,7 +4086,7 @@ export class Orchestrator {
                 const text = outcome.text ?? "(no output)";
                 plans.push({ id: outcome.harnessId, text });
                 // The planner's own saved copy keeps its exact text (INV-146).
-                store.writeText(join(paths.root, "plans", `${outcome.harnessId}.md`), text + "\n");
+                await store.writeTextAsync(join(paths.root, "plans", `${outcome.harnessId}.md`), text + "\n");
                 // Solo planning (D31): the FIRST successful planner is the plan; later
                 // pool members are a sequential fallback chain (ask parity), not
                 // parallel co-authors. Council re-enables the multi-draft round.
@@ -4112,7 +4103,7 @@ export class Orchestrator {
         }
         finally {
             // Planners done (or threw) — reclaim scoped scratch/API-route state.
-            roHome.dispose();
+            await roHome.dispose();
         }
         if (input.signal?.aborted) {
             return cancelledResult(log, runId, taskId, "plan", paths.root, planAttempts.map((p) => ({
@@ -4282,7 +4273,7 @@ export class Orchestrator {
         // recorded user intent is the CALLER's goal.
         const contract = this.buildContract({ ...input, prompt: opts.contractIntent ?? prompt }, taskId, opts.mode);
         const quotaSnapshots = this.quotaSnapshotPreflight();
-        const { store, paths, log, ledger, runContext } = beginAnnouncedRun({
+        const { store, paths, log, ledger, runContext } = await beginAnnouncedRun({
             input,
             contract,
             quotaSnapshots,
@@ -4294,7 +4285,7 @@ export class Orchestrator {
             phase: "report",
             prompt,
         }, announce);
-        store.writeYaml(join(paths.contextDir, "task.yaml"), contract);
+        await store.writeYamlAsync(join(paths.contextDir, "task.yaml"), contract);
         log.emit("task.contract.created", { task_contract_hash: hashJson(contract) });
         // The ask/deep-scan report stays bare (its scouts read the tree themselves);
         // no lazy ContextPack section is attached here.
@@ -4321,7 +4312,7 @@ export class Orchestrator {
             }));
         }
         catch (err) {
-            roHome.dispose();
+            await roHome.dispose();
             const message = safeErrorMessage(err);
             writeRoutingFailureTerminal(store, paths, log, {
                 runId,
@@ -4549,7 +4540,7 @@ export class Orchestrator {
                 });
                 attemptTelemetries.push({ attemptId, harnessId: adapter.id, telemetry });
                 if (opts.deepScan) {
-                    store.writeText(join(paths.findingsDir, `${attemptId}-error.md`), `# Explorer ${attemptId} failed\n\n${message}\n`);
+                    await store.writeTextAsync(join(paths.findingsDir, `${attemptId}-error.md`), `# Explorer ${attemptId} failed\n\n${message}\n`);
                 }
                 return { status: "launched" };
             }
@@ -4618,6 +4609,7 @@ export class Orchestrator {
                         ...(knobs.ignored.length > 0 ? { ignored_settings: knobs.ignored } : {}),
                     });
                     try {
+                        const pacing = { waiting: false, version: 0 };
                         const watchedReport = withInactivityWatchdog(runModelGovernedRoute(routed, runSpec), {
                             timeoutMs: harnessInactivityTimeoutMs(this.config(input.repoRoot)),
                             countsAsProgress: countsAsAgentProgress,
@@ -4625,11 +4617,12 @@ export class Orchestrator {
                                 tryAbort.abort();
                                 void adapter.cancel?.(activeSessionId)?.catch(() => { });
                             },
-                            isSuspended: () => (reportInteraction?.pendingCount?.() ?? 0) > 0,
-                            suspensionVersion: () => reportInteraction?.suspensionVersion?.() ?? 0,
+                            ...laneSuspension(pacing, reportInteraction),
                             stopSignal: input.signal, // after Stop: drained events are recorded, never used
                         });
-                        for await (const ev of watchedReport) {
+                        const files = [paths.eventsPath, attemptEventsPath];
+                        const read = pacedByAppends(watchedReport, files, pacing);
+                        for await (const ev of read) {
                             // A read after Stop is stored evidence only; a callback may itself press Stop.
                             const shown = !input.signal?.aborted && ev.payload?.["buffered"] !== true;
                             if (shown)
@@ -4814,7 +4807,7 @@ export class Orchestrator {
                 });
                 launched.delete(tried);
                 if (opts.deepScan) {
-                    store.writeText(join(paths.findingsDir, `${attemptId}-error.md`), `# Explorer ${attemptId} failed\n\n${harnessError}\n`);
+                    await store.writeTextAsync(join(paths.findingsDir, `${attemptId}-error.md`), `# Explorer ${attemptId} failed\n\n${harnessError}\n`);
                 }
                 return { status: "launched" };
             }
@@ -4846,7 +4839,7 @@ export class Orchestrator {
                 const scoutTag = scoutInterrupted
                     ? ` interrupted (${interruptionDetail(roFinalized.reason)})`
                     : ` (${adapter.id})`;
-                store.writeText(join(paths.findingsDir, `${attemptId}${scoutInterrupted ? "-interrupted" : ""}.md`), `# Explorer ${attemptId}${scoutTag}\n\n${report || "(no output)"}${warningNote}\n`);
+                await store.writeTextAsync(join(paths.findingsDir, `${attemptId}${scoutInterrupted ? "-interrupted" : ""}.md`), `# Explorer ${attemptId}${scoutTag}\n\n${report || "(no output)"}${warningNote}\n`);
             }
             return { status: "launched" };
         };
@@ -4991,7 +4984,7 @@ export class Orchestrator {
         finally {
             // All read-only attempts done (or threw) — reclaim scoped scratch and
             // injected API-route state. Vendor-owned native credentials were not copied.
-            roHome.dispose();
+            await roHome.dispose();
         }
         const candidateSummaries = attempts.map((a) => ({
             attemptId: a.attemptId,
@@ -5047,7 +5040,7 @@ export class Orchestrator {
             : reducedReport !== null
                 ? reducedReport
                 : rawScoutBundle({ succeeded, unsuccessful, status: deepScanSynthesis });
-        store.writeText(join(paths.finalDir, opts.artifactName), `# ${opts.title}\n\n${report}\n`);
+        await store.writeTextAsync(join(paths.finalDir, opts.artifactName), `# ${opts.title}\n\n${report}\n`);
         // ask is the only read-only strategy that can carry a structured-output
         // contract (the boundary refuses the rest); validate the FINAL aggregate
         // (the reduced synthesis, or the honest bundle for a degraded scan) — never
@@ -5068,7 +5061,7 @@ export class Orchestrator {
             path: `final/${opts.artifactName}`,
         });
         if (opts.deepScan) {
-            store.writeYaml(join(paths.finalDir, "explore-findings.yaml"), {
+            await store.writeYamlAsync(join(paths.finalDir, "explore-findings.yaml"), {
                 mode: "explore",
                 width,
                 attempts: attempts.map((a) => ({
@@ -5087,7 +5080,7 @@ export class Orchestrator {
                 })),
                 read_only: true,
             });
-            store.writeText(join(paths.finalDir, "omissions.md"), `# Omissions\n\n${unsuccessful.map((a) => `- ${a.attemptId} / ${a.harnessId} (${a.status}): ${a.error}`).join("\n") || "- None recorded by the runner. Synthesis claims still require evidence checks."}\n`);
+            await store.writeTextAsync(join(paths.finalDir, "omissions.md"), `# Omissions\n\n${unsuccessful.map((a) => `- ${a.attemptId} / ${a.harnessId} (${a.status}): ${a.error}`).join("\n") || "- None recorded by the runner. Synthesis claims still require evidence checks."}\n`);
         }
         let terminalFacts = makeOutcomeFacts("succeeded");
         const reportBudgetTerminal = ledger.terminal();
@@ -5116,13 +5109,13 @@ export class Orchestrator {
             .join(", ");
         // A delivered report that still ends unsuccessfully or blocked keeps it and names every failed try.
         const reportPool = terminalPoolAttempts(terminalFacts, attempts);
-        store.writeText(join(paths.finalDir, "summary.md"), `# Run ${runId} (${opts.mode})\n\n- Harnesses: ${harnessLabel}\n- Lifecycle: ${terminalFacts.lifecycle}${terminalFacts.reason ? ` (${terminalFacts.reason})` : ""}\n\n${withPoolAttempts(report, reportPool)}\n`);
+        await store.writeTextAsync(join(paths.finalDir, "summary.md"), `# Run ${runId} (${opts.mode})\n\n- Harnesses: ${harnessLabel}\n- Lifecycle: ${terminalFacts.lifecycle}${terminalFacts.reason ? ` (${terminalFacts.reason})` : ""}\n\n${withPoolAttempts(report, reportPool)}\n`);
         const reportProducerAttemptId = opts.deepScan &&
             deepScanSynthesis?.status === "succeeded" &&
             deepScanSynthesis.reducer_attempt_id
             ? deepScanSynthesis.reducer_attempt_id
             : (succeeded[0]?.attemptId ?? "a01");
-        store.writeYaml(join(paths.finalDir, "work_product.yaml"), {
+        await store.writeYamlAsync(join(paths.finalDir, "work_product.yaml"), {
             id: newId("wp"),
             kind: "report",
             source_task_id: taskId,