@cleocode/core 2026.10.27 → 2026.11.1-canary.10

package/dist/orchestrate/spawn-ops.js

@@ -60,11 +60,14 @@
 import { execFileSync } from 'node:child_process';
 import { existsSync } from 'node:fs';
 import { join } from 'node:path';
-import { RESOURCE_DEFERRED_CODE } from '@cleocode/contracts/resource-governor.js';
-import { acquireWorktreeTaskLock, destroyWorktree, isWorktreeLockedError, releaseWorktreeTaskLock, runWorktreeHooks, } from '@cleocode/worktree';
+import { RESOURCE_DEFERRED_CODE, RESOURCE_EXTERNAL_PRESSURE_CODE, } from '@cleocode/contracts/resource-governor.js';
+import { readDeclaredProjectIdentity } from '@cleocode/paths';
+import { acquireWorktreeTaskLock, destroyWorktree, disposeOwnedWorktree, isWorktreeLockedError, releaseWorktreeTaskLock, runWorktreeHooks, } from '@cleocode/worktree';
 import { findLeastLoadedAgent } from '../agents/capacity.js';
 import { substituteCantAgentBody } from '../agents/variable-substitution.js';
 import { engineError } from '../engine-result.js';
+import { CleoError } from '../errors.js';
+import { cleoErrorToEngineResult } from '../errors-to-engine.js';
 import { selectHarnessSpawnProvider } from '../harness/spawn-provider-selection.js';
 import { hooks } from '../hooks/registry.js';
 import { getLogger } from '../logger.js';
@@ -72,14 +75,34 @@ import { composeSpawnPayload } from '../orchestration/spawn.js';
 import { resolveEffectiveTier } from '../orchestration/tier-selector.js';
 import { validateSpawnReadiness } from '../orchestration/validate-spawn.js';
 import { getProjectRoot } from '../paths.js';
-import { admitFailOpen, governor } from '../resources/governor.js';
+import { releaseAgentLease, writeAgentLease, } from '../resources/agent-lease.js';
+import { admitFailOpen, agentSessionBudgetConfig, governor, takeAgentSessionLease, } from '../resources/governor.js';
+import { externalPressureFix } from '../resources/pressure-gate.js';
 import { provisionIsolatedShell } from '../sdk/isolation.js';
 import { spawnWorktree } from '../sentient/worktree-dispatch.js';
-import { initializeDefaultAdapters, spawnRegistry } from '../spawn/adapter-registry.js';
+import { getSpawnAdapterFix, initializeDefaultAdapters, spawnRegistry, } from '../spawn/adapter-registry.js';
 import { abandonSpawnSession, requireSpawnSession, } from '../spawn/agent-identity.js';
 import { auditWorktreeLockReclaim, resolveLockSessionProbe, resolveSpawnLockHolder, } from '../spawn/worktree-lock-holder.js';
 import { getTaskAccessor } from '../store/data-accessor.js';
+import { resolveBoundSession } from '../store/session-store.js';
+import { getTaskPipelineStageSource } from '../tasks/pipeline-stage.js';
+import { resolveLeadMailbox } from './agentmbx.js';
+import { isLeadWorkerV1Enabled, resolveIsolation } from './isolation-policy.js';
 import { openAgentRegistryDbForComposer } from './plan.js';
+import { abandonWorkerRecord, findOrcaWorker, newWorkerInstanceId, recordWorker, settleWorkerAtSpawn, } from './worker-records.js';
+/** Refuse every spawn entry point while an external attempt retains custody. */
+function orcaCustodyRefusal(record) {
+    // @sync-invariant none:local-only an external editor may still run even after its launch CLI disappeared
+    return engineError('E_ORCA_ATTEMPT_FENCED', `Task ${record.taskId} has a retained Orca execution attempt.`, {
+        details: {
+            recordId: record.recordId,
+            state: record.execution?.state,
+            dispatchId: record.execution?.dispatchId,
+            runtimeId: record.execution?.context.runtimeId,
+        },
+        fix: 'Inspect the stored runtime, Dispatch and issued request; recover that exact attempt before dispatching another editor.',
+    });
+}
 // ---------------------------------------------------------------------------
 // T9545 — Spawn pipeline timeout supervisor
 // ---------------------------------------------------------------------------
@@ -111,17 +134,6 @@ export const SPAWN_BUDGET_MS = 180_000;
  * @task T9545
  */
 export const CLEANUP_BUDGET_MS = 5_000;
-/**
- * Best-effort, bounded cleanup of a partially-provisioned worktree after the
- * spawn supervisor fires. Idempotent: re-running against an absent worktree
- * returns `worktreeRemoved: true` without erroring. Wrapped in its own
- * `setTimeout` so cleanup itself can never wedge the timeout envelope.
- *
- * @param projectRoot - Absolute path to the project root.
- * @param taskId      - Task ID whose worktree is being cleaned up.
- * @returns Structured cleanup outcome (never throws).
- * @task T9545
- */
 /**
  * Map a {@link SpawnResult} status onto the `SubagentStop` payload vocabulary.
  *
@@ -154,27 +166,81 @@ export function toSubagentStopStatus(status) {
     }
 }
 /**
- * Decide whether a failed `spawnWorktree` may be answered with
- * {@link runTimeoutCleanup} (T12506). Only a worktree the failing call itself
- * created (`freshWorktreeCreated === true`, set by `createWorktree`) is ours
- * to destroy; every other failure — including every lock error — is a
- * refusal that leaves the existing worktree untouched.
+ * The cleanup `createWorktree` already ran for a worktree its failed call
+ * freshly created (T12506). It runs there, while the per-task lock is still
+ * held: once the lock is released a concurrent re-spawn may own the path, so
+ * a failed provision is never cleaned up from here (T14407). Every other
+ * failure, including every lock error, carries none and left the existing
+ * worktree untouched.
  *
  * @param err - The error thrown by `spawnWorktree` / `createWorktree`.
- * @returns True only when cleanup is safe.
- * @task T12506
+ * @returns The cleanup outcome, or `undefined` when no worktree was created.
+ * @task T14407
  */
-export function shouldCleanUpFailedProvision(err) {
-    if (isWorktreeLockedError(err))
-        return false;
-    return (err !== null &&
-        typeof err === 'object' &&
-        err.freshWorktreeCreated === true);
+function failedProvisionCleanup(err) {
+    const cleanup = err?.cleanup;
+    if (!cleanup)
+        return undefined;
+    return {
+        attempted: true,
+        worktreeRemoved: cleanup.worktreeRemoved,
+        branchDeleted: cleanup.branchDeleted,
+        ...(cleanup.error !== undefined ? { error: cleanup.error } : {}),
+    };
 }
-export async function runTimeoutCleanup(projectRoot, taskId) {
+/**
+ * Best-effort, bounded cleanup of a partially-provisioned worktree after the
+ * spawn supervisor fires. Idempotent: re-running against an absent worktree
+ * returns `worktreeRemoved: true` without erroring. Wrapped in its own
+ * `setTimeout` so cleanup itself can never wedge the timeout envelope.
+ *
+ * With `owned`, removal goes through `disposeOwnedWorktree`: nothing is
+ * removed unless, under the task lock's mutex, the lock still carries the
+ * token this spawn acquired and the task's checkout is the exact path and
+ * branch this spawn created (T14483). After a supervisor timeout or a session
+ * abandonment a newer spawn of the same task may have reclaimed the lock and
+ * now owns that checkout. The branch is kept.
+ *
+ * @param projectRoot - Absolute path to the project root.
+ * @param taskId      - Task ID whose worktree is being cleaned up.
+ * @param owned       - The exact worktree path and lock token this spawn created.
+ * @returns Structured cleanup outcome (never throws).
+ * @task T9545
+ * @task T14483
+ */
+export async function runTimeoutCleanup(projectRoot, taskId, owned) {
     const startedAt = Date.now();
     let timer;
     try {
+        if (owned) {
+            // T14483: token, canonical path, branch and removal are all checked
+            // under the task lock's mutex, so a re-spawn never loses its worktree.
+            const disposed = disposeOwnedWorktree({
+                projectHash: owned.projectHash,
+                taskId,
+                worktreePath: owned.worktreePath,
+                branch: owned.branch,
+                lockToken: owned.lockToken,
+                projectRoot,
+                reason: 'spawn-timeout-cleanup',
+                force: true,
+            });
+            return disposed.outcome === 'removed'
+                ? {
+                    attempted: true,
+                    worktreeRemoved: true,
+                    branchDeleted: false,
+                    elapsedMs: Date.now() - startedAt,
+                }
+                : {
+                    attempted: false,
+                    worktreeRemoved: false,
+                    branchDeleted: false,
+                    notOwned: true,
+                    error: `Cleanup skipped: ${disposed.reason}; nothing was removed`,
+                    elapsedMs: Date.now() - startedAt,
+                };
+        }
         const result = await Promise.race([
             destroyWorktree(projectRoot, {
                 taskId,
@@ -412,18 +478,25 @@ export async function composeSpawnForTask(taskId, root, options = {}) {
     const effectiveTier = options.tier !== undefined
         ? options.tier
         : resolveEffectiveTier(task, inferredRole ?? 'worker', undefined);
+    // T14379 — spawn and fanout both compose here, so the recorded project lead
+    // mailbox fills in for a missing `--lead-mbx` on every path.
+    const leadMailbox = await resolveLeadMailbox(root, options.leadMailbox);
     const db = await openAgentRegistryDbForComposer();
     try {
         return await composeSpawnPayload(db, task, {
             tier: effectiveTier,
             projectRoot: root,
             sessionId: options.sessionId ?? null,
+            workerSession: options.workerSession,
+            coordinatorSessionId: options.coordinatorSessionId,
             role: inferredRole,
             protocol: options.protocol,
+            harnessHint: options.harnessHint,
+            pipelineStageSource: await getTaskPipelineStageSource(task, accessor),
             skipAtomicityCheck: options.skipAtomicityCheck ?? false,
             worktreePath: options.worktreePath,
             worktreeBranch: options.worktreeBranch,
-            ...(options.leadMailbox ? { leadMailbox: options.leadMailbox } : {}),
+            ...(leadMailbox ? { leadMailbox } : {}),
             spawnCloneExclude: options.spawnCloneExclude,
             // T10430 — pass the atomicity waiver into the composer. When set to
             // 'orchestrator-defer', checkAtomicity grants the spawn for a worker
@@ -464,6 +537,28 @@ function atomicityRefusal(taskId, payload) {
 export async function orchestrateSpawnSelectProvider(capabilities, _projectRoot) {
     return selectHarnessSpawnProvider(capabilities);
 }
+/**
+ * The stable code, optional repair and numeric exit code of a thrown coded refusal such
+ * as `LeadToolsUnstrippedError`; `null` for any other throw.
+ *
+ * @param error - What the spawn threw.
+ * @returns The code, optional exit code and repair command, or `null`.
+ * @task T14363
+ */
+function codedError(error) {
+    if (!(error instanceof Error) || !('code' in error))
+        return null;
+    const { code } = error;
+    if (typeof code !== 'string' || !code.startsWith('E_'))
+        return null;
+    const exitCode = 'exitCode' in error ? error.exitCode : undefined;
+    const fix = 'fix' in error ? error.fix : undefined;
+    return {
+        code,
+        ...(typeof exitCode === 'number' ? { exitCode } : {}),
+        ...(typeof fix === 'string' ? { fix } : {}),
+    };
+}
 /**
  * orchestrate.spawn.execute - Execute spawn for a task using adapter registry
  *
@@ -472,6 +567,8 @@ export async function orchestrateSpawnSelectProvider(capabilities, _projectRoot)
  * (`git merge --no-ff` per ADR-062) back into the project default branch
  * and pruned. The behaviour is idempotent and can be disabled by passing
  * `autoComplete: false` in {@link OrchestrateSpawnExecuteOpts}.
+ * A supplied Orca port selects supervised execution only after local context
+ * verification; those launches retain custody and never integrate at spawn.
  *
  * @param taskId - Task to spawn.
  * @param adapterId - Optional adapter id to use. Auto-selects if not provided.
@@ -485,7 +582,8 @@ export async function orchestrateSpawnSelectProvider(capabilities, _projectRoot)
  */
 export async function orchestrateSpawnExecute(taskId, adapterId, protocolType, projectRoot, tier, opts = {}) {
     const cwd = getProjectRoot(projectRoot);
-    const autoComplete = opts.autoComplete ?? true;
+    // T14363: a lead does no work of its own, so there is nothing to integrate.
+    const autoComplete = opts.lead === undefined && (opts.autoComplete ?? true);
     // T12000 (Never-OOM): acquire an `agent-session` grant BEFORE any worktree or
     // process is provisioned, so a denial under memory pressure leaves NO partial
     // artifacts behind — the orchestrator gets a structured, retryable deferral
@@ -497,7 +595,9 @@ export async function orchestrateSpawnExecute(taskId, adapterId, protocolType, p
     // ownership is the supervisor-mode backend's job, T11998).
     // Fail open (#1777 R8-1): a governor that can't write its state (sandboxed or
     // read-only CLEO home) spawns ungated instead of deferring forever.
-    const { admission: admit, ungoverned } = await admitFailOpen('agent-session', () => governor.tryAcquire('agent-session'));
+    // T14227, T14283: the project's resources.agentSession.maxSessions.
+    const budgetConfig = await agentSessionBudgetConfig(cwd);
+    const { admission: admit, ungoverned } = await admitFailOpen('agent-session', () => governor.tryAcquire('agent-session', budgetConfig));
     if (ungoverned !== null) {
         getLogger('engine:orchestrate').warn({ taskId, ...ungoverned }, 'agent-session admission skipped: governor state is not writable; spawning ungated');
     }
@@ -514,32 +614,50 @@ export async function orchestrateSpawnExecute(taskId, adapterId, protocolType, p
     /** T12502 — the task claim + session this spawn took; undone unless dispatched. */
     let execClaim;
     let dispatched = false;
+    /** T14359 — worker record written before spawn (only with `orchestrate.leadWorker.v1`). */
+    let pendingWorker = null;
     try {
+        const custodyBudget = new AbortController();
+        const custodyTimer = setTimeout(() => custodyBudget.abort(), SPAWN_BUDGET_MS);
+        const external = await raceAgainstAbort(findOrcaWorker(taskId, cwd), custodyBudget.signal, 'validate-readiness').finally(() => clearTimeout(custodyTimer));
+        if (external)
+            return orcaCustodyRefusal(external);
+        // A lead's own restricted launch remains native; its worker dispatches use this port.
+        const orca = opts.lead === undefined ? await opts.orca?.discover(cwd) : null;
+        if (orca && opts.accountId !== undefined) {
+            // @sync-invariant none:input-shape unsupported account placement cannot silently become the host's active account
+            return engineError('E_ORCA_ACCOUNT_UNSUPPORTED', 'Exact per-worker account placement is unavailable.', {
+                exitCode: 63,
+                fix: 'Omit the account constraint to use Orca’s active account for an agent in orchestrate.orca.agents.',
+            });
+        }
         // Get spawn registry
-        await initializeDefaultAdapters();
+        if (!orca)
+            await initializeDefaultAdapters();
         // Find adapter
         let adapter;
-        if (adapterId) {
+        if (!orca && adapterId) {
             adapter = spawnRegistry.get(adapterId);
         }
-        else {
+        else if (!orca) {
             // Auto-select first capable adapter
             const capable = await spawnRegistry.listSpawnCapable();
             adapter = capable[0];
         }
-        if (!adapter) {
+        if (!orca && !adapter) {
             return {
                 success: false,
                 error: {
                     code: 'E_SPAWN_NO_ADAPTER',
                     message: 'No spawn adapter available for this provider',
+                    fix: await getSpawnAdapterFix(),
                     exitCode: 60,
                 },
             };
         }
         // Verify provider supports subagents using providerSupportsById
         const { providerSupportsById } = await import('@cleocode/caamp');
-        if (!providerSupportsById(adapter.providerId, 'spawn.supportsSubagents')) {
+        if (adapter && !providerSupportsById(adapter.providerId, 'spawn.supportsSubagents')) {
             return {
                 success: false,
                 error: {
@@ -558,6 +676,7 @@ export async function orchestrateSpawnExecute(taskId, adapterId, protocolType, p
         // orchestrateSpawn for the full rationale. T12500 — no fallback: a failed
         // allocation refuses the spawn with the REAL store error instead of handing
         // over the orchestrator's (newest active) session.
+        const coordinatorSessionId = (await resolveBoundSession(cwd))?.session.id ?? null;
         const spawnSession = await requireSpawnSession(cwd, taskId);
         if (!spawnSession.ok) {
             return {
@@ -578,10 +697,20 @@ export async function orchestrateSpawnExecute(taskId, adapterId, protocolType, p
         execClaim = spawnSession;
         const activeSessionId = spawnSession.identity.sessionId;
         const spawnAgentId = spawnSession.identity.agentId;
-        const payload = await composeSpawnForTask(taskId, cwd, {
+        const workerSession = {
+            ...spawnSession.identity,
+            role: opts.lead ? 'lead' : 'worker',
+        };
+        let payload = await composeSpawnForTask(taskId, cwd, {
             tier,
             sessionId: activeSessionId,
+            workerSession,
+            coordinatorSessionId,
             protocol: protocolType,
+            ...(orca ? { harnessHint: 'generic' } : {}),
+            ...(opts.leadMailbox ? { leadMailbox: opts.leadMailbox } : {}),
+            // T14363 — a lead is told it is one: the ct-lead excerpt and dispatch rules load.
+            ...(opts.lead !== undefined ? { role: 'lead' } : {}),
         });
         // Atomicity violations short-circuit the spawn so the adapter never sees
         // a rejected payload. Full verdict is preserved under `error.details`.
@@ -604,13 +733,16 @@ export async function orchestrateSpawnExecute(taskId, adapterId, protocolType, p
         // Build CLEO spawn context from core spawn payload
         const { getSpawnCapableProviders } = await import('@cleocode/caamp');
         const providers = getSpawnCapableProviders();
-        const provider = providers.find((p) => p.id === adapter.providerId);
-        if (!provider) {
+        const provider = adapter
+            ? providers.find((p) => p.id === adapter.providerId)
+            : undefined;
+        if (adapter && !provider) {
             return {
                 success: false,
                 error: {
                     code: 'E_SPAWN_NO_PROVIDER',
                     message: `Provider ${adapter.providerId} not found`,
+                    fix: await getSpawnAdapterFix(),
                     exitCode: 60,
                 },
             };
@@ -636,19 +768,22 @@ export async function orchestrateSpawnExecute(taskId, adapterId, protocolType, p
         // body was substituted (T1238), it is prepended to the composer prompt
         // so subagents receive the fully-resolved template alongside the
         // standard spawn context.
-        const rawPrompt = templateSubstitution.resolvedBody
-            ? `${templateSubstitution.resolvedBody}\n\n${payload.prompt}`
-            : payload.prompt;
         // T1759 — Worktree provisioning + centralized isolation.
         //
         // Provision a worktree for the task so the agent runs in its own isolated
         // branch. On success, `provisionIsolatedShell` computes the authoritative
-        // cwd, env-var block, and preamble from the single source of truth. On
-        // failure (non-git repo, git not installed, etc.) we degrade gracefully and
-        // fall back to the project root so spawn continues without isolation.
+        // cwd, env-var block, and preamble from the single source of truth.
+        // T14358 — `resolveIsolation` decides what a failure means: with
+        // `orchestrate.leadWorker.v1` on (or a `--base` asked for) the spawn is
+        // refused; otherwise it falls back to the project root without isolation.
         let agentWorkingDirectory = cwd;
-        let agentEnvOverride;
-        try {
+        let agentEnvOverride = {
+            CLEO_SESSION_ID: activeSessionId,
+            CLEO_AGENT_ID: spawnAgentId,
+            CLEO_AGENT_ROLE: opts.lead ? 'lead' : 'worker',
+        };
+        const leadWorkerV1 = await isLeadWorkerV1Enabled(cwd);
+        const provisionWorktree = async () => {
             const worktreeResult = await spawnWorktree(cwd, {
                 taskId,
                 holder: resolveSpawnLockHolder({ sessionId: activeSessionId, agentId: spawnAgentId }),
@@ -668,6 +803,16 @@ export async function orchestrateSpawnExecute(taskId, adapterId, protocolType, p
                 ...(activeSessionId ? { sessionId: activeSessionId } : {}),
                 ...(spawnAgentId ? { agentId: spawnAgentId } : {}),
             });
+            return { worktreeResult, isolation };
+        };
+        // T14363: a lead cannot write, so it runs in the project root, unprovisioned.
+        const isolationResolution = opts.lead !== undefined
+            ? { kind: 'lead' }
+            : await resolveIsolation(provisionWorktree, {
+                failClosed: Boolean(orca) || leadWorkerV1 || opts.baseRef !== undefined,
+            });
+        if (isolationResolution.kind === 'isolated') {
+            const { worktreeResult, isolation } = isolationResolution.result;
             agentWorkingDirectory = isolation.cwd;
             agentEnvOverride = isolation.env;
             if (worktreeResult.lock) {
@@ -676,8 +821,19 @@ export async function orchestrateSpawnExecute(taskId, adapterId, protocolType, p
                     token: worktreeResult.lock.record.token,
                 };
             }
+            payload = await composeSpawnForTask(taskId, cwd, {
+                tier,
+                workerSession,
+                coordinatorSessionId,
+                protocol: protocolType,
+                ...(orca ? { harnessHint: 'generic' } : {}),
+                worktreePath: worktreeResult.path,
+                worktreeBranch: worktreeResult.branch,
+                ...(opts.leadMailbox ? { leadMailbox: opts.leadMailbox } : {}),
+            });
         }
-        catch (wtErr) {
+        else if (isolationResolution.kind === 'refused') {
+            const wtErr = isolationResolution.error;
             // T12506: a live holder owns this task's worktree. Degrading to the
             // project root would run a SECOND agent on the same task — refuse.
             if (isWorktreeLockedError(wtErr)) {
@@ -691,30 +847,175 @@ export async function orchestrateSpawnExecute(taskId, adapterId, protocolType, p
                     },
                 };
             }
+            const refusalCode = wtErr?.code;
+            const code = typeof refusalCode === 'string' && refusalCode.startsWith('E_')
+                ? refusalCode
+                : 'E_WORKTREE_PROVISION_FAILED';
+            const message = wtErr instanceof Error ? wtErr.message : String(wtErr);
+            // T14396: like orchestrateSpawn, report the removal of a worktree THIS
+            // call freshly created; any other failure left the worktree alone.
+            const cleanup = failedProvisionCleanup(wtErr);
+            const cleanupDetails = cleanup ? { cleanup } : {};
             // T14046: a bad --base ref or a worktree on another base. Running the
             // agent in the project root would ignore the base it was asked for.
             if (opts.baseRef !== undefined) {
-                const refusalCode = wtErr?.code;
                 // @sync-invariant none:input-shape an unusable --base refuses; the finally hands the claim back
-                return engineError(typeof refusalCode === 'string' && refusalCode.startsWith('E_')
-                    ? refusalCode
-                    : 'E_WORKTREE_PROVISION_FAILED', wtErr instanceof Error ? wtErr.message : String(wtErr), {
-                    details: { taskId, baseRef: opts.baseRef },
+                return engineError(code, message, {
+                    details: { taskId, baseRef: opts.baseRef, ...cleanupDetails },
                     fix: `Check that '${opts.baseRef}' resolves to a commit and that no worktree or branch for ${taskId} exists on another base.`,
                 });
             }
+            if (orca) {
+                // @sync-invariant none:local-only a verified Orca context requires canonical isolation even with leadWorker.v1 off
+                return engineError(code, message, {
+                    exitCode: 63,
+                    details: { taskId, isolation: 'refused', ...cleanupDetails },
+                    fix: `Repair canonical worktree provisioning for ${taskId}; the Orca backend requires its exact task checkout and lock.`,
+                });
+            }
+            // T14358: orchestrate.leadWorker.v1 is on — no agent runs in the project root.
+            // @sync-invariant none:local-only fail-closed isolation refuses; the finally hands the claim back
+            return engineError(code, message, {
+                details: {
+                    taskId,
+                    isolation: 'refused',
+                    flag: 'orchestrate.leadWorker.v1',
+                    ...cleanupDetails,
+                },
+                fix: `Fix worktree provisioning for ${taskId} (\`git worktree list\`, \`git branch --list task/${taskId}\`) and retry; orchestrate.leadWorker.v1 refuses to run a worker without isolation.`,
+            });
+        }
+        else if (isolationResolution.kind === 'project-root') {
             // Worktree provisioning failure — spawn continues without isolation.
-            // This matches the graceful-degradation policy of orchestrateSpawn.
             getLogger('engine:orchestrate').warn({ taskId }, 'T1759 worktree provisioning failed in orchestrateSpawnExecute — spawning without isolation');
         }
+        if (!payload.atomicity.allowed)
+            return atomicityRefusal(taskId, payload);
+        const composedPrompt = templateSubstitution.resolvedBody
+            ? `${templateSubstitution.resolvedBody}\n\n${payload.prompt}`
+            : payload.prompt;
+        // A lead's mode-specific instructions follow the final bound prompt.
+        const rawPrompt = opts.lead?.promptAppendix
+            ? `${composedPrompt}\n\n${opts.lead.promptAppendix}`
+            : composedPrompt;
+        if (orca && opts.orca) {
+            const identity = readDeclaredProjectIdentity(cwd);
+            if (!identity || !execLock || isolationResolution.kind !== 'isolated') {
+                // @sync-invariant none:local-only Orca never creates another checkout or launches without canonical custody
+                return engineError('E_ORCA_WORKSPACE', 'The canonical CLEO project, worktree or lock is unproven.', {
+                    exitCode: 63,
+                    fix: 'Repair the declared CLEO project identity and canonical task worktree before retrying this dispatch.',
+                });
+            }
+            try {
+                const { launchRoutedOrcaWorker } = await import('./orca-routing.js');
+                const record = await launchRoutedOrcaWorker({
+                    projectId: identity.projectId,
+                    projectRoot: cwd,
+                    taskId,
+                    workerSessionId: activeSessionId,
+                    agentId: spawnAgentId,
+                    role: 'worker',
+                    protocol: protocolType ?? payload.meta.protocol,
+                    worktreePath: agentWorkingDirectory,
+                    worktreeBranch: isolationResolution.result.worktreeResult.branch,
+                    projectHash: execLock.projectHash,
+                    lockToken: execLock.token,
+                    prompt: rawPrompt,
+                    leadMailbox: (await resolveLeadMailbox(cwd, opts.leadMailbox)) ?? null,
+                }, orca, opts.orca, adapterId);
+                const execution = record.execution;
+                // @sync-invariant none:local-only admission requires the persisted external binding
+                if (!execution)
+                    throw new Error('The Orca worker has no durable execution binding.');
+                if (!['ready', 'turn_unobserved'].includes(execution.state)) {
+                    // @sync-invariant none:local-only uncertain launch receipts retain their exact worker record and task claim
+                    return engineError('E_ORCA_ATTEMPT_FENCED', `Orca launch remains ${execution.state}.`, {
+                        exitCode: 63,
+                        details: {
+                            recordId: record.recordId,
+                            state: execution.state,
+                            dispatchId: execution.dispatchId,
+                        },
+                        fix: `Inspect cleo orchestrate worker show ${record.recordId}; recover its original issued request before dispatching another editor.`,
+                    });
+                }
+                return {
+                    success: true,
+                    data: {
+                        backend: 'orca',
+                        instanceId: record.instanceId,
+                        recordId: record.recordId,
+                        status: execution.state === 'ready' ? 'running' : 'pending',
+                        providerId: record.provider,
+                        taskId,
+                        agentId: spawnAgentId,
+                        persona: payload.agentId,
+                        role: payload.role,
+                        tier: tier ?? null,
+                        atomicity: payload.atomicity,
+                        execution: {
+                            runtimeId: execution.context.runtimeId,
+                            runId: execution.runId,
+                            orcaTaskId: execution.orcaTaskId,
+                            dispatchId: execution.dispatchId,
+                            workspaceId: execution.workspaceId,
+                            state: execution.state,
+                        },
+                        meta: {
+                            ...payload.meta,
+                            autoComplete: { ran: false, reason: 'Orca launch is not worker completion' },
+                        },
+                    },
+                };
+            }
+            catch (error) {
+                const retained = await findOrcaWorker(taskId, cwd);
+                if (retained) {
+                    // @sync-invariant none:local-only every post-launch refusal must retain exact recovery addressing
+                    return engineError('E_ORCA_ATTEMPT_FENCED', error instanceof Error ? error.message : String(error), {
+                        exitCode: 63,
+                        details: {
+                            recordId: retained.recordId,
+                            state: retained.execution?.state,
+                            dispatchId: retained.execution?.dispatchId,
+                        },
+                        fix: `Inspect cleo orchestrate worker show ${retained.recordId}; preserve its claim and worktree while reconciling the original Run.`,
+                    });
+                }
+                if (error instanceof CleoError) {
+                    // @sync-invariant none:local-only routing refusals preserve the repair instruction and release only proven unsent custody
+                    return engineError(error.toLAFSError().code, error.message, {
+                        exitCode: error.code,
+                        fix: error.fix,
+                        details: error.details,
+                    });
+                }
+                throw error;
+            }
+            finally {
+                // A failure after persistence cannot release custody, even if receipt storage threw.
+                dispatched = true;
+                keepExecLock = true;
+                const retained = await findOrcaWorker(taskId, cwd);
+                dispatched = retained !== null;
+                keepExecLock = dispatched;
+            }
+        }
+        // @sync-invariant none:local-only native execution requires its previously selected provider and adapter
+        if (!adapter || !provider)
+            throw new Error('The native spawn adapter is unavailable.');
         const cleoSpawnContext = {
             taskId: payload.taskId,
             protocol: protocolType || payload.meta.protocol,
+            protocolResolution: payload.meta.protocolResolution,
+            workerSession,
+            coordinatorSessionId,
             prompt: rawPrompt,
             provider: provider.id,
             options: {
                 prompt: rawPrompt,
-                ...(agentEnvOverride !== undefined ? { env: agentEnvOverride } : {}),
+                env: agentEnvOverride,
             },
             workingDirectory: agentWorkingDirectory,
             tokenResolution: {
@@ -722,7 +1023,23 @@ export async function orchestrateSpawnExecute(taskId, adapterId, protocolType, p
                 unresolved: [],
                 totalTokens: 0,
             },
+            // T14363 — a lead spawn loses its denied tools; the bridge refuses a
+            // provider that cannot strip them (T14357).
+            ...(opts.lead !== undefined ? { leadDeniedTools: opts.lead.deniedTools } : {}),
+            ...(opts.lead?.onStarted ? { onLeadStarted: opts.lead.onStarted } : {}),
         };
+        if (opts.lead?.sessionId !== undefined) {
+            cleoSpawnContext.options = {
+                ...cleoSpawnContext.options,
+                leadSessionId: opts.lead.sessionId,
+            };
+        }
+        if (opts.lead !== undefined) {
+            cleoSpawnContext.options = {
+                ...cleoSpawnContext.options,
+                leadMode: opts.lead.mode ?? 'interactive',
+            };
+        }
         // Wave 6-C/D: Capacity-aware routing — find the least-loaded agent and
         // attach it as a preferred routing hint on the spawn options.
         // Best-effort: if no agents are registered or the check throws, fall
@@ -757,6 +1074,35 @@ export async function orchestrateSpawnExecute(taskId, adapterId, protocolType, p
         catch {
             /* Hook registry unavailable — non-fatal */
         }
+        // T14359 — with `orchestrate.leadWorker.v1`, record the worker BEFORE
+        // spawning, under a pre-assigned instance id the adapter may adopt for
+        // its exit hook, so a worker that dies at once still finds its record.
+        const hookAgentId = cleoSpawnContext.options?.preferredAgent ?? `worker-${taskId}`;
+        if (opts.lead === undefined && leadWorkerV1) {
+            const workerInstanceId = newWorkerInstanceId(adapter.providerId);
+            try {
+                pendingWorker = await recordWorker({
+                    taskId,
+                    instanceId: workerInstanceId,
+                    agentId: hookAgentId,
+                    provider: adapter.providerId,
+                    pid: null,
+                    pgid: null,
+                    worktree: agentWorkingDirectory,
+                    leadMailbox: opts.leadMailbox ?? null,
+                    sessionId: activeSessionId,
+                }, cwd);
+                cleoSpawnContext.options = { ...cleoSpawnContext.options, workerInstanceId };
+            }
+            catch (err) {
+                getLogger('engine:orchestrate').warn({ taskId, err: err instanceof Error ? err.message : String(err) }, 'T14359 worker record not stored — SubagentStop fires at spawn');
+            }
+        }
+        // T14363 — the lead is admitted (resource grant, task claim, prompt): let
+        // the caller claim its mailbox and record it before it starts.
+        if (opts.lead?.onAdmitted) {
+            await opts.lead.onAdmitted({ cleoSessionId: activeSessionId, agentId: spawnAgentId ?? null });
+        }
         // Execute spawn
         const result = await adapter.spawn(cleoSpawnContext);
         // T12502 — an adapter may REPORT a failure (status `failed`) instead of
@@ -775,29 +1121,45 @@ export async function orchestrateSpawnExecute(taskId, adapterId, protocolType, p
         catch {
             /* Worktree hooks are best-effort — never block spawn */
         }
-        // Dispatch SubagentStop hook AFTER spawn returns — records completion
-        // status in brain and conduit (T555).
-        try {
-            await hooks
-                .dispatch('SubagentStop', cwd, {
-                timestamp: new Date().toISOString(),
-                taskId,
-                agentId: cleoSpawnContext.options?.preferredAgent ?? `worker-${taskId}`,
-                // T12071: `SpawnResult.status` and `SubagentStopPayload.status` are
-                // DIFFERENT vocabularies — 'completed' vs 'complete', and spawn also
-                // emits 'pending'/'running'/'cancelled', none of which the payload
-                // union admits. Every value this site ever sent was therefore outside
-                // the declared type; nothing caught it because `dispatch` did not
-                // relate the event to its payload.
-                status: toSubagentStopStatus(result.status),
-                metadata: { instanceId: result.instanceId },
-            })
-                .catch(() => {
-                /* Hooks are best-effort — never block spawn */
-            });
+        // T14359 — a tracked worker (record + observable exit) gets its
+        // SubagentStop when it exits. Every other spawn emits it here, as before.
+        let workerTracked = false;
+        if (pendingWorker) {
+            const record = pendingWorker;
+            pendingWorker = null;
+            try {
+                workerTracked = await settleWorkerAtSpawn(record, {
+                    instanceId: result.instanceId,
+                    running: keepExecLock,
+                    ...(result.ownership ? { ownership: result.ownership } : {}),
+                    stopStatus: toSubagentStopStatus(result.status),
+                }, cwd);
+            }
+            catch (err) {
+                getLogger('engine:orchestrate').warn({ taskId, err: err instanceof Error ? err.message : String(err) }, 'T14359 worker record not settled after spawn');
+            }
         }
-        catch {
-            /* Hook registry unavailable — non-fatal */
+        else {
+            try {
+                await hooks
+                    .dispatch('SubagentStop', cwd, {
+                    timestamp: new Date().toISOString(),
+                    taskId,
+                    agentId: hookAgentId,
+                    // T12071: `SpawnResult.status` and `SubagentStopPayload.status` are
+                    // DIFFERENT vocabularies — 'completed' vs 'complete', and spawn also
+                    // emits 'pending'/'running'/'cancelled', none of which the payload
+                    // union admits.
+                    status: toSubagentStopStatus(result.status),
+                    metadata: { instanceId: result.instanceId },
+                })
+                    .catch(() => {
+                    /* Hooks are best-effort — never block spawn */
+                });
+            }
+            catch {
+                /* Hook registry unavailable — non-fatal */
+            }
         }
         // ---- T9548 — Auto-invoke worktree-complete post-success. --------------
         //
@@ -818,7 +1180,15 @@ export async function orchestrateSpawnExecute(taskId, adapterId, protocolType, p
         // leaves the worktree alone, and the skip is audited.
         const { integrationDisabledReason, recordAutoCompleteEnvSkip } = await import('./worktree-complete.js');
         const envDisabled = integrationDisabledReason(false);
-        if (autoComplete && result.exitCode === 0 && envDisabled !== undefined) {
+        if (autoComplete && workerTracked) {
+            // T14359 — a tracked worker is still running (the adapter's exitCode
+            // is only a placeholder), so there is nothing to integrate yet.
+            autoCompleteOutcome = {
+                ran: false,
+                reason: 'worker still running — not integrated at spawn',
+            };
+        }
+        else if (autoComplete && result.exitCode === 0 && envDisabled !== undefined) {
             recordAutoCompleteEnvSkip(taskId, cwd);
             autoCompleteOutcome = { ran: false, reason: envDisabled };
         }
@@ -883,16 +1253,33 @@ export async function orchestrateSpawnExecute(taskId, adapterId, protocolType, p
                 persona: payload.agentId,
                 role: payload.role,
                 harnessHint: payload.harnessHint,
+                // T14423 — the MCP servers a lead spawn loaded.
+                ...(result.leadMcp ? { leadMcp: result.leadMcp } : {}),
+                // T14363 — a detached lead's temp dir, for its lead record.
+                ...(result.leadTempDir ? { leadTempDir: result.leadTempDir } : {}),
             },
         };
     }
     catch (error) {
+        // T14359 — the spawn threw, so the pre-spawn record's worker never ran.
+        if (pendingWorker)
+            await abandonWorkerRecord(pendingWorker, cwd).catch(() => undefined);
+        // T14490 — a thrown CleoError keeps its own code name, exit code and fix.
+        // The custody read opens the store before adapter preflight, so a store
+        // refusal (E_STORE_RESTORING, E_WORKTREE_BUILD_SCHEMA) reaches this catch:
+        // it must not collapse to E_SPAWN_FAILED with its fix dropped.
+        if (error instanceof CleoError)
+            return cleoErrorToEngineResult(error);
+        // T14363 — keep a coded refusal's own code (e.g. E_LEAD_TOOLS_UNSTRIPPED).
+        const coded = codedError(error);
+        // @sync-invariant none:local-only the spawn threw before an agent ran; the finally hands the claim back
         return {
             success: false,
             error: {
-                code: 'E_SPAWN_FAILED',
+                code: coded?.code ?? 'E_SPAWN_FAILED',
                 message: error instanceof Error ? error.message : 'Unknown spawn error',
-                exitCode: 60,
+                exitCode: coded?.exitCode ?? 60,
+                ...(coded?.fix ? { fix: coded.fix } : {}),
             },
         };
     }
@@ -1020,6 +1407,9 @@ includeDeps) {
     let spawnSucceeded = false;
     /** T12502 — the task claim + session this spawn took; undone in `finally` on failure. */
     let spawnClaim;
+    /** T14133 — the agent-session lease this spawn holds; a new one is given back on failure. */
+    let spawnLease = null;
+    let spawnLeaseReused = false;
     /**
      * Build the E_TIMEOUT envelope AND run bounded auto-cleanup on the
      * partially-provisioned worktree (Saga T10176 / D010). The original T9545
@@ -1036,10 +1426,29 @@ includeDeps) {
         // skip otherwise so we don't churn against absent state. destroyWorktree
         // is idempotent (returns worktreeRemoved=true when the path is already
         // gone) so repeated invocations are safe.
+        // T14483: `spawnLock` may no longer be ours. A session abandonment or a
+        // lock reclaim may have handed the task to a newer spawn while this one
+        // was stuck, so only the exact worktree, branch and lock token this spawn
+        // created are removed, checked under the lock (disposeOwnedWorktree).
         let cleanup;
         if (partialState.worktreePath && partialState.rootResolved) {
             try {
-                cleanup = await runTimeoutCleanup(partialState.rootResolved, taskId);
+                cleanup =
+                    spawnLock && partialState.worktreeBranch
+                        ? await runTimeoutCleanup(partialState.rootResolved, taskId, {
+                            worktreePath: partialState.worktreePath,
+                            branch: partialState.worktreeBranch,
+                            projectHash: spawnLock.projectHash,
+                            lockToken: spawnLock.token,
+                        })
+                        : {
+                            attempted: false,
+                            worktreeRemoved: false,
+                            branchDeleted: false,
+                            notOwned: true,
+                            error: 'Cleanup skipped: this spawn holds no task lock token or branch; nothing was removed',
+                            elapsedMs: 0,
+                        };
                 spawnLogger.info({ taskId, cleanup }, 'T9545 auto-cleanup completed after spawn timeout');
             }
             catch (cleanupErr) {
@@ -1063,13 +1472,18 @@ includeDeps) {
                 partial,
                 ...(cleanup ? { cleanup } : {}),
             },
-            fix: cleanup && !cleanup.worktreeRemoved
-                ? 'Auto-cleanup did not remove the worktree — run `cleo worktree prune --taskId <id>` to force-remove the orphan, then retry the spawn.'
-                : 'Auto-cleanup removed the partial worktree — safe to retry the spawn directly.',
+            fix: cleanup?.notOwned
+                ? `Nothing was removed: the worktree for ${taskId} may belong to a newer spawn. Check \`cleo worktree list\` before retrying.`
+                : cleanup && !cleanup.worktreeRemoved
+                    ? 'Auto-cleanup did not remove the worktree — run `cleo worktree prune --taskId <id>` to force-remove the orphan, then retry the spawn.'
+                    : 'Auto-cleanup removed the partial worktree — safe to retry the spawn directly.',
         });
     };
     try {
         const root = getProjectRoot(projectRoot);
+        const external = await raceAgainstAbort(findOrcaWorker(taskId, root), budgetCtrl.signal, 'validate-readiness');
+        if (external)
+            return orcaCustodyRefusal(external);
         partialState.rootResolved = root;
         spawnLogger.info({ taskId, tier, noWorktree, budgetMs: SPAWN_BUDGET_MS }, 'T9545 spawn pipeline started');
         // Step 1: Validate readiness.
@@ -1142,6 +1556,34 @@ includeDeps) {
         // scope-leakage. Allocation is idempotent across `--resume` (reuses the
         // same-handle active session). T12500 — failure is FATAL: degrading to
         // the orchestrator's active session id is exactly the bleed above.
+        // T14133 — the spawned session holds an agent-session slot for its whole
+        // life, through a lease: taken before any claim or worktree, so a full
+        // budget refuses the spawn as retryable with nothing left behind.
+        const { taskClaimLeaseMs } = await import('../store/task-claim.js');
+        const leased = await takeAgentSessionLease(taskId, root, taskClaimLeaseMs(), await agentSessionBudgetConfig(root));
+        if ('deferral' in leased && leased.externalPressure !== undefined) {
+            // @sync-invariant none:local-only critical memory held outside CLEO; nothing is written
+            return engineError(RESOURCE_EXTERNAL_PRESSURE_CODE, leased.deferral.reason, {
+                exitCode: 75,
+                details: { ...leased.externalPressure, class: 'agent-session', taskId },
+                fix: externalPressureFix(leased.externalPressure),
+            });
+        }
+        if ('deferral' in leased) {
+            // @sync-invariant none:local-only the machine-wide agent-session budget is full; nothing is written
+            return engineError(RESOURCE_DEFERRED_CODE, leased.deferral.reason, {
+                exitCode: 75,
+                details: {
+                    class: leased.deferral.class,
+                    retryAfterMs: leased.deferral.retryAfterMs,
+                    taskId,
+                },
+                fix: 'Retry the spawn after retryAfterMs, once a spawned session ends or its lease lapses.',
+            });
+        }
+        spawnLease = leased.lease;
+        spawnLeaseReused = leased.reused;
+        const coordinatorSessionId = (await resolveBoundSession(root))?.session.id ?? null;
         const spawnSession = await requireSpawnSession(root, taskId);
         if (!spawnSession.ok) {
             spawnLogger.error({ taskId, cause: spawnSession.cause }, 'spawn session allocation failed');
@@ -1159,8 +1601,8 @@ includeDeps) {
         // Worktrees are created by default for every spawn. The `--no-worktree`
         // flag opts out and logs an audit entry so the choice is traceable.
         //
-        // When provisioning fails (non-git repo, git not installed, etc.) we
-        // degrade gracefully — spawn continues without isolation, same as T1118.
+        // T1878 / T14358 — a failed provision refuses the spawn: this path calls
+        // `resolveIsolation` fail-closed, so no agent runs in the project root.
         //
         // T10078 — `--resume` skips provisioning entirely and attaches to an
         // existing locked worktree at the canonical XDG path.
@@ -1220,6 +1662,11 @@ includeDeps) {
                 throw lockErr;
             }
             // Build a minimal sdkWorktreeResult for downstream envelope consumers.
+            // T14126: with the same env a fresh worktree gets (every isolation key
+            // the prompt exports, and the git shim), not an empty one.
+            const { buildWorktreeEnvVars } = await import('@cleocode/worktree');
+            const { ensureGitShimDir } = await import('../spawn/branch-lock.js');
+            const shim = ensureGitShimDir(root);
             sdkWorktreeResult = {
                 path: worktreePath,
                 branch: worktreeBranch,
@@ -1229,7 +1676,10 @@ includeDeps) {
                 createdAt: new Date().toISOString(),
                 locked: true,
                 reused: true,
-                envVars: {},
+                envVars: buildWorktreeEnvVars(worktreePath, worktreeBranch, projectHashForResume, {
+                    dir: shim.dir,
+                    installed: shim.installed,
+                }),
                 preamble: '',
                 hookResults: [],
                 appliedPatterns: [],
@@ -1263,11 +1713,11 @@ includeDeps) {
             // T9545: the spawnWorktree call is the historical hang site — wrap it
             // in the budget supervisor so a wedged git child cannot block forever.
             spawnLogger.info({ taskId, step: 'provision-worktree' }, 'provisioning worktree');
-            try {
-                // T9226 — spawn-clone-exclude: exclude heavyweight artefacts to keep
-                // the worktree lean (T9337 removed per-task verifier exclusions).
-                const { SPAWN_CLONE_EXCLUDE_PATTERNS } = await import('../orchestration/spawn-prompt.js');
-                sdkWorktreeResult = await raceAgainstAbort(spawnWorktree(root, {
+            // T9226 — spawn-clone-exclude: exclude heavyweight artefacts to keep
+            // the worktree lean (T9337 removed per-task verifier exclusions).
+            const { SPAWN_CLONE_EXCLUDE_PATTERNS } = await import('../orchestration/spawn-prompt.js');
+            const isolationResolution = await resolveIsolation(async () => {
+                const provisioned = await raceAgainstAbort(spawnWorktree(root, {
                     taskId,
                     spawnCloneExclude: SPAWN_CLONE_EXCLUDE_PATTERNS,
                     ...(spawnScope ? { spawnScope } : {}),
@@ -1279,7 +1729,11 @@ includeDeps) {
                     // T14027 — only the base commit differs from a normal spawn.
                     ...(worktreeBase !== undefined ? { baseRef: worktreeBase } : {}),
                 }), budgetCtrl.signal, 'provision-worktree');
-                auditWorktreeLockReclaim(root, taskId, sdkWorktreeResult.path, sdkWorktreeResult.lock);
+                auditWorktreeLockReclaim(root, taskId, provisioned.path, provisioned.lock);
+                return provisioned;
+            }, { failClosed: true });
+            if (isolationResolution.kind === 'isolated') {
+                sdkWorktreeResult = isolationResolution.result;
                 worktreePath = sdkWorktreeResult.path;
                 worktreeBranch = sdkWorktreeResult.branch;
                 // T9545 — record for the timeout supervisor so auto-cleanup can target
@@ -1301,16 +1755,17 @@ includeDeps) {
                     ...SPAWN_CLONE_EXCLUDE_PATTERNS,
                 ];
             }
-            catch (wtErr) {
+            else {
+                const wtErr = isolationResolution.error;
                 const message = wtErr instanceof Error ? wtErr.message : String(wtErr);
                 getLogger('engine:orchestrate').error({ taskId, err: wtErr }, `T1878 worktree provisioning failed for ${taskId}: ${message}`);
-                // T12506 — cleanup runs ONLY for a worktree THIS invocation freshly
-                // created (createWorktree flags it). Every other failure — a lock
-                // refusal, a lock I/O error, a dirty branch, an invalid path, a
-                // failure while re-attaching — left a pre-existing, possibly live
-                // worktree behind, and destroyWorktree(force, deleteBranch) would
-                // delete its holder's work.
-                if (!shouldCleanUpFailedProvision(wtErr)) {
+                // T12506 — only a worktree THIS invocation freshly created is removed,
+                // by createWorktree itself under the task lock (T14407). Every other
+                // failure — a lock refusal, a lock I/O error, a dirty branch, an
+                // invalid path, a failure while re-attaching — left a pre-existing,
+                // possibly live worktree behind that holds its holder's work.
+                const cleanup = failedProvisionCleanup(wtErr);
+                if (cleanup === undefined) {
                     const refusalCode = wtErr?.code;
                     const code = typeof refusalCode === 'string' && refusalCode.startsWith('E_')
                         ? refusalCode
@@ -1329,22 +1784,10 @@ includeDeps) {
                             : `Inspect the existing worktree/branch for ${taskId} (\`git worktree list\`, \`git branch --list task/${taskId}\`); nothing was removed.`,
                     });
                 }
-                // T10078 — best-effort cleanup of any partially-provisioned worktree.
-                // If createWorktree partially succeeded (e.g. git worktree add ran but
-                // a later step failed), an orphan worktree + task branch would remain.
-                // destroyWorktree is idempotent — it safely no-ops when nothing exists.
-                let cleanupNote;
-                try {
-                    const cleanupResult = await runTimeoutCleanup(root, taskId);
-                    cleanupNote = cleanupResult.worktreeRemoved
-                        ? 'Orphan worktree cleaned up'
-                        : cleanupResult.error
-                            ? `Cleanup attempted but may be incomplete: ${cleanupResult.error}`
-                            : 'No orphan worktree found';
-                }
-                catch {
-                    cleanupNote = 'Cleanup attempt failed';
-                }
+                // T10078 — an orphan worktree + task branch would otherwise remain.
+                const cleanupNote = cleanup.worktreeRemoved
+                    ? 'Orphan worktree cleaned up'
+                    : `Cleanup attempted but may be incomplete: ${cleanup.error ?? 'worktree kept'}`;
                 return engineError('E_WORKTREE_PROVISION_FAILED', message, {
                     details: { taskId, cause: message, cleanup: cleanupNote },
                     fix: 'Check git repository state, branch availability, and disk space. Run `git worktree list` and `git branch --list task/<taskId>` to diagnose.',
@@ -1366,6 +1809,8 @@ includeDeps) {
         const payload = await raceAgainstAbort(composeSpawnForTask(taskId, root, {
             tier,
             sessionId: activeSessionId,
+            workerSession: spawnSession.identity,
+            coordinatorSessionId,
             protocol: protocolType,
             worktreePath,
             worktreeBranch,
@@ -1421,6 +1866,11 @@ includeDeps) {
         // Return shape: `prompt` at the top level is the primary payload every
         // caller should consume. `atomicity` + `meta` surface the T932 composer
         // guarantees. `spawnContext` mirrors the prompt for legacy readers.
+        if (spawnLease !== null) {
+            // T14133: on success the lease ends with this session (its end or its
+            // heartbeat finds it by id). A failed spawn never re-tags a reused lease.
+            writeAgentLease({ ...spawnLease, sessionId: activeSessionId });
+        }
         spawnSucceeded = true;
         return {
             success: true,
@@ -1435,6 +1885,8 @@ includeDeps) {
                 harnessHint: payload.harnessHint,
                 atomicity: payload.atomicity,
                 meta: payload.meta,
+                workerSession: spawnSession.identity,
+                coordinatorSessionId,
                 // T1118 L1+L2 / T1140 — worktree binding for harness adapters.
                 worktree: worktreeAdapterResult?.worktree ?? null,
                 worktreeEnv: worktreeAdapterResult?.envVars ?? null,
@@ -1447,6 +1899,9 @@ includeDeps) {
                     protocolType: protocolType || payload.meta.protocol,
                     tier: payload.tier,
                     prompt: finalPrompt,
+                    workerSession: spawnSession.identity,
+                    coordinatorSessionId,
+                    protocolResolution: payload.meta.protocolResolution,
                 },
                 protocolType: protocolType || payload.meta.protocol,
                 sessionId: activeSessionId,
@@ -1454,6 +1909,12 @@ includeDeps) {
         };
     }
     catch (err) {
+        // T14490 — a thrown CleoError keeps its own code name, exit code and fix.
+        // The custody read opens the store before any pipeline step, so a store
+        // refusal (E_STORE_RESTORING, E_WORKTREE_BUILD_SCHEMA) reaches this catch:
+        // it must not surface as a bare numeric code with its fix dropped.
+        if (err instanceof CleoError)
+            return cleoErrorToEngineResult(err);
         const code = err.code ?? 'E_GENERAL';
         // T9545 — when our budget supervisor aborts a step, the helper throws
         // an Error with `code === 'E_TIMEOUT'`. Surface a structured envelope
@@ -1467,7 +1928,7 @@ includeDeps) {
             const step = (stepMatch?.[1] ?? 'budget-exceeded');
             return await buildTimeoutEnvelope(step);
         }
-        return engineError(code, err.message);
+        return engineError(code, err.message, { fix: codedError(err)?.fix });
     }
     finally {
         // T9545 — always release the budget timer so the Node event loop can exit.
@@ -1480,6 +1941,11 @@ includeDeps) {
         if (spawnClaim && !spawnSucceeded) {
             await abandonSpawnSession(spawnClaim.root, taskId, spawnClaim.resolution);
         }
+        // T14133 — nor the agent-session slot.
+        // A reused lease (a resume) still belongs to the task's working session.
+        if (spawnLease !== null && !spawnLeaseReused && !spawnSucceeded) {
+            releaseAgentLease(spawnLease.id);
+        }
     }
 }
 //# sourceMappingURL=spawn-ops.js.map