@codedology/code-forge 0.15.3 → 0.15.4

package/src/state/block.mjs

@@ -27,7 +27,7 @@ import { checkWorkerPin, readRun, saveRun, withRunLock, writeSigned } from './ru
 import { canonicalJSON, verifyRow, loadKey, signRow } from './signer.mjs';
 import { readAllRows } from '../ledger/write.mjs';
 import * as reviewQueue from '../worker/queue.mjs';
-import { contentHash, repoRootOf } from '../worker/ticket.mjs';
+import { assertInsideRoot, contentHash, repoRootOf } from '../worker/ticket.mjs';
 
 /** @typedef {import('./run.mjs').WriteRow} WriteRow */
 
@@ -293,6 +293,16 @@ function activeBlocks(record) {
   return Object.fromEntries(Object.entries(record.blocks).filter(([, b]) => b.status === 'open'));
 }
 
+/** Earlier claims are authoritative only when their run, block and MAC match.
+ * @param {Record<string, any>} record @param {string} id @returns {Promise<string[]>}
+ */
+async function signedClaims(record, id) {
+  const key = await loadKey(record.run_id);
+  const rows = await readAllRows(record.project);
+  return [...new Set(rows.filter((row) => row.event === 'block.claim' && row.run === record.run_id && row.block === id && verifyRow(row, key).ok)
+    .map((row) => assertOwned([row.path])[0]))];
+}
+
 /**
  * B58: with `review.external.required` set in the run's snapshot, the project's `.code-forge.yml`
  * is the owner's switch past the local per-file review, so no block may own it. These are the
@@ -387,7 +397,7 @@ function refuseConfigOwner(owned, kinds, guarded) {
  *   decision?: {question: 'lane', answer: string, source: 'rules', facts: Record<string, unknown>}, decisionId?: string,
  *   worktree?: (ctx: {baseSha: string, baseExplicit: boolean, previous: TreeRecord | null}) => Promise<{path: string, make: () => Promise<OpenTree>}>,
  * }} opts
- * @returns {Promise<{block: Record<string, any>, pointer: string | null, worktreeReused: boolean}>} `worktreeReused`:
+ * @returns {Promise<{block: Record<string, any>, pointer: string | null, worktreeReused: boolean, keptClaims: number}>} `worktreeReused`:
  *   the block took an earlier attempt's worktree as it was.
  */
 export async function openBlock(opts) {
@@ -398,12 +408,12 @@ export async function openBlock(opts) {
   if (lines !== null && !(Number.isInteger(lines) && lines > 0)) throw new StateError('bad-lines', 'lines forecast must be a positive integer');
   if (opts.kind !== undefined && opts.kind !== 'light' && !BLOCK_KINDS.includes(opts.kind)) throw new StateError('bad-kind', `kind must be one of ${[...BLOCK_KINDS, 'light'].join(', ')}`);
   if (opts.decision && opts.decision.answer !== level) throw new StateError('bad-decision', `the decision answer ${opts.decision.answer} is not the requested level ${level}`);
-  const owned = assertOwned(opts.owned);
+  const declaredOwned = assertOwned(opts.owned);
   const acceptance = assertAcceptance(opts.acceptance);
   const humanChecks = acceptance.filter((c) => c.kind === 'human_check').map((c) => c.clause);
   const tests = opts.tests === undefined ? null : [...assertOwned(opts.tests, { label: 'test files', code: 'bad-tests' })];
   const after = opts.after === undefined ? null : [...new Set(opts.after)];
-  const kind = opts.kind === 'light' ? 'light' : blockKind({ owned, declared: opts.kind });
+  const kind = opts.kind === 'light' ? 'light' : blockKind({ owned: declaredOwned, declared: opts.kind });
   const dispatched = dispatchLevel({ lane: level, kind, cfg: opts.cfg });
   const pointer = opts.brief ? briefPointer(opts.brief.path, opts.brief.content) : null;
 
@@ -428,7 +438,7 @@ export async function openBlock(opts) {
   /** @type {OpenTree | null} */
   let made = null;
   try {
-    const { block, reused } = await mutateRun(runId, null, writeRow, async (record) => {
+    const { block, reused, keptClaims } = await mutateRun(runId, null, writeRow, async (record) => {
       if (record.blocks[id]?.status === 'open') throw new StateError('already-open', `block ${id} is already open`);
       if (record.blocks[id]?.status === 'awaiting_human_check') throw new StateError('already-open', `block ${id} is awaiting a human check`);
       if (after !== null) {
@@ -441,6 +451,8 @@ export async function openBlock(opts) {
       }
       // B57: what each exact owned entry is on disk, under the lock (as `block claim`) — a regular
       // file owns only itself, here and in every later check
+      const claims = attempt > 1 ? await signedClaims(record, id) : [];
+      const owned = [...new Set([...declaredOwned, ...claims])];
       const kinds = ownedKinds(record.workspace, owned);
       refuseConfigOwner(owned, kinds, guarded);
       const prior = previousTree(record);
@@ -467,7 +479,7 @@ export async function openBlock(opts) {
       const floor = dispatched.trigger === 'docs_floor' ? { requested_level: level, trigger: 'docs_floor' } : {};
       const created = tree?.created ? [{ event: 'worktree.created', block: id, path: tree.worktree.path, branch: tree.worktree.branch, base: tree.worktree.base_sha }] : [];
       return {
-        result: { block: entry, reused: tree !== null && !tree.created },
+        result: { block: entry, reused: tree !== null && !tree.created, keptClaims: claims.length },
         rows: [
           ...(opts.decision ? [{ ...opts.decision, event: 'decision', decision_id: opts.decisionId ?? randomUUID(), block: id }] : []),
           ...created,
@@ -475,7 +487,7 @@ export async function openBlock(opts) {
         ],
       };
     });
-    return { block, pointer, worktreeReused: reused };
+    return { block, pointer, worktreeReused: reused, keptClaims };
   } catch (err) {
     // B62a: nothing was recorded, so a tree this open made must not outlive it
     if (made?.created && made.rollback) {
@@ -493,9 +505,12 @@ export async function openBlock(opts) {
 
 /** @param {{runId: string, id: string, writeRow: WriteRow}} opts */
 export async function attemptBlock({ runId, id, writeRow }) {
-  return mutateRun(runId, id, writeRow, (_record, block) => {
+  return mutateRun(runId, id, writeRow, async (record, block) => {
+    const claims = await signedClaims(record, id);
+    block.owned_files = [...new Set([...block.owned_files, ...claims])];
+    block.owned_kinds = { ...ownedKinds(record.workspace, claims), ...block.owned_kinds };
     block.attempt += 1;
-    return { result: block.attempt, rows: [{ event: 'block.attempt', block: id, attempt: block.attempt }] };
+    return { result: { attempt: block.attempt, keptClaims: claims.length }, rows: [{ event: 'block.attempt', block: id, attempt: block.attempt }] };
   });
 }
 
@@ -654,25 +669,33 @@ async function rebaseWorktreeBlock({ runId, id, writeRow, acceptChanged, reason,
  * B58: with `review.external.required` set, a path that owns the project's config is refused
  * (`config-owned`), as at `block open`. B62a: two blocks that each have their own worktree may
  * own the same path (`blocksOverlap`).
- * @param {{runId: string, id: string, file: string, writeRow: WriteRow}} opts
+ * @param {{runId: string, id: string, file: string, writeRow: WriteRow, auto?: boolean}} opts
  */
-export async function claimPath({ runId, id, file, writeRow }) {
+export async function claimPath({ runId, id, file, writeRow, auto = false }) {
   assertOwned([file]);
   if (!isExactEntry(file)) throw new StateError('bad-owned', `block claim takes one exact path, not a glob (${JSON.stringify(file)})`);
   const guarded = await guardedConfigPaths(await readRun(runId));
-  await mutateRun(runId, id, writeRow, (record, block) => {
-    const kinds = { [file]: pathKind(record.workspace, file) };
+  await mutateRun(runId, id, writeRow, async (record, block) => {
+    const root = auto ? await repoTop(block.worktree?.path ?? record.workspace) : record.workspace;
+    if (auto) {
+      if (file.split('/').some((part) => ['.git', '.code-forge'].includes(part.toLowerCase()))) throw new StateError('unowned_change', `unowned_change ${file}: cannot auto-claim repository state`);
+      try { assertInsideRoot(root, file); }
+      catch { throw new StateError('unowned_change', `unowned_change ${file}: cannot auto-claim a path outside the repository or a symlink`); }
+    }
+    const kinds = { [file]: pathKind(root, file) };
     refuseConfigOwner([file], kinds, guarded);
+    const prefix = auto ? path.relative(await repoTop(record.workspace), realpathSync(record.workspace)).split(path.sep).join('/') : '';
     for (const [otherId, other] of Object.entries(activeBlocks(record))) {
-      const pair = otherId === id ? null : blocksOverlap({ owned_files: [file], owned_kinds: kinds, worktree: block.worktree ?? null }, other);
-      if (pair) throw new StateError('overlap', `${file} overlaps ${pair[1]} owned by open block ${otherId}`);
+      const pair = otherId === id ? null : blocksOverlap({ owned_files: [file], owned_kinds: kinds, worktree: auto ? null : block.worktree ?? null }, other);
+      const relativeOwner = auto && otherId !== id && prefix !== '' && file.startsWith(`${prefix}/`) && ownsFile(other.owned_files, file.slice(prefix.length + 1), other.owned_kinds);
+      if (pair || relativeOwner) throw new StateError(auto ? 'unowned_change' : 'overlap', `${auto ? 'unowned_change ' : ''}${file} overlaps ${pair?.[1] ?? file} owned by open block ${otherId}`);
     }
     if (!block.owned_files.includes(file)) {
       block.owned_files.push(file);
       block.owned_kinds = { ...block.owned_kinds, ...kinds };
     }
     record.orphans = record.orphans.filter((/** @type {string} */ o) => !ownsFile([file], o, kinds));
-    return { result: undefined, rows: [{ event: 'block.claim', block: id, path: file }] };
+    return { result: undefined, rows: [{ event: 'block.claim', block: id, path: file, ...(auto ? { auto: true, reason: 'auto-claim: changed outside owned files' } : {}) }] };
   });
 }
 

package/src/util/native.mjs

@@ -0,0 +1,131 @@
+import { spawn } from 'node:child_process';
+import { accessSync, constants, statSync } from 'node:fs';
+import net from 'node:net';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import pkg from '../../package.json' with { type: 'json' };
+import { exec } from './exec.mjs';
+
+/** @returns {string | null} the optional executable shipped for this host. */
+export function nativePath() {
+  if (process.env.CODE_FORGE_NATIVE === '0') return null;
+  const binary = fileURLToPath(new URL(`../../native/bin/${process.platform}-${process.arch}/code-forge-native`, import.meta.url));
+  try {
+    if (!statSync(binary).isFile()) return null;
+    accessSync(binary, constants.X_OK);
+    return binary;
+  } catch { return null; }
+}
+
+/**
+ * @param {string[]} args
+ * @returns {Promise<import('./exec.mjs').ExecResult | null>} null requests the Node fallback.
+ */
+export async function runNative(args) {
+  const binary = nativePath();
+  return binary ? exec([binary, ...args], { timeoutMs: 30_000 }) : null;
+}
+
+/** @param {Record<string, any> | null} [config] @param {NodeJS.ProcessEnv} [env] */
+export function daemonEnabled(config, env = process.env) {
+  return env.CODE_FORGE_NATIVE !== '0' && config?.native?.daemon !== false;
+}
+
+/**
+ * One connection per call. Ping negotiates the package version before sending the method;
+ * no socket is opened when disabled. Protocol and transport failures request Node fallback.
+ * @param {string} run
+ * @param {{method: string, block?: string, max_ms?: number}} request
+ * @param {{config?: Record<string, any> | null, timeoutMs?: number}} [opts]
+ * @returns {Promise<Record<string, any> | null>}
+ */
+export async function daemonRequest(run, request, { config, timeoutMs = request.method === 'wait-block' ? (request.max_ms ?? 0) + 2500 : 6500 } = {}) {
+  if (!daemonEnabled(config) || !/^[a-z0-9][a-z0-9-]{0,63}$/.test(run)) return null;
+  return new Promise((resolve) => {
+    let settled = false;
+    let negotiated = false;
+    let buffer = '';
+    const socket = net.createConnection(path.join(os.homedir(), '.code-forge', 'runs', run, 'native.sock'));
+    socket.setEncoding('utf8');
+    const finish = (/** @type {Record<string, any> | null} */ value) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      socket.destroy();
+      resolve(value);
+    };
+    let timer = setTimeout(() => finish(null), Math.min(2000, timeoutMs));
+    const deadline = (/** @type {number} */ ms) => {
+      clearTimeout(timer);
+      timer = setTimeout(() => finish(null), ms);
+    };
+    socket.on('error', () => finish(null));
+    socket.on('close', () => finish(null));
+    socket.on('connect', () => {
+      deadline(Math.min(2000, timeoutMs));
+      socket.write('{"method":"ping"}\n');
+    });
+    socket.on('data', (chunk) => {
+      buffer += chunk;
+      if (buffer.length > 8 * 1024 * 1024) return finish(null);
+      const end = buffer.indexOf('\n');
+      if (end < 0) return;
+      let answer;
+      try { answer = JSON.parse(buffer.slice(0, end)); } catch { return finish(null); }
+      buffer = buffer.slice(end + 1);
+      if (!answer || typeof answer !== 'object' || Array.isArray(answer) || answer.ok === false) return finish(null);
+      if (!negotiated) {
+        if (answer.ok !== true || answer.version !== pkg.version || answer.run !== run) return finish(null);
+        if (request.method === 'ping') return finish(answer);
+        negotiated = true;
+        deadline(timeoutMs);
+        socket.write(`${JSON.stringify(request)}\n`);
+      } else {
+        const { stats, ...result } = answer;
+        if (request.method === 'wait-block' && (result.block !== request.block || !Array.isArray(result.files) || typeof result.done !== 'boolean'
+          || !result.files.every((/** @type {any} */ file) => file && typeof file.file === 'string' && typeof file.status === 'string'))) return finish(null);
+        if (request.method === 'status' && (!Array.isArray(result.runs) || result.runs.length !== 1 || result.runs[0]?.run_id !== run || !Array.isArray(result.runs[0]?.blocks))) return finish(null);
+        finish(result);
+      }
+    });
+  }).catch(() => null);
+}
+
+/**
+ * The daemon serializes startup with its own OS lock. A loser exits harmlessly;
+ * only this child is stopped, never a daemon another worker already owns.
+ * @param {string} run @param {Record<string, any> | null} config
+ * @param {NodeJS.ProcessEnv} [env]
+ * @returns {Promise<() => Promise<void>>}
+ */
+export async function startNativeDaemon(run, config, env = process.env) {
+  const noop = async () => {};
+  if (!daemonEnabled(config, env)) return noop;
+  const binary = nativePath();
+  if (!binary || await daemonRequest(run, { method: 'ping' }, { config })) return noop;
+  let child;
+  try { child = spawn(binary, ['serve', '--home', os.homedir(), '--run', run], { stdio: 'ignore', env }); }
+  catch { return noop; }
+  let ended = false;
+  const exited = new Promise((resolve) => {
+    child.once('error', () => { ended = true; resolve(undefined); });
+    child.once('exit', () => { ended = true; resolve(undefined); });
+  });
+  for (let i = 0; i < 100 && !ended; i++) {
+    if (await daemonRequest(run, { method: 'ping' }, { config, timeoutMs: 100 })) break;
+    await new Promise((resolve) => setTimeout(resolve, 20));
+  }
+  /** @type {Promise<void> | undefined} */
+  let stopping;
+  return () => {
+    stopping ??= (async () => {
+      if (ended) return;
+      child.kill('SIGTERM');
+      const timer = setTimeout(() => child.kill('SIGKILL'), 2000);
+      timer.unref();
+      try { await exited; } finally { clearTimeout(timer); }
+    })();
+    return stopping;
+  };
+}

package/src/worker/loop.mjs

@@ -20,7 +20,7 @@
  * restarted worker boots on the snapshot, not on whatever the file says now. A record from before
  * snapshots (or none) keeps the config the worker booted with.
  *
- * Ticket pool (B42): the worker runs up to `review.parallel_tickets` (default 3, 1–16) tickets at
+ * Ticket pool (B42): the worker runs up to `review.parallel_tickets` (default 6, 1–16) tickets at
  * once, oldest first (or fewest running per block with `review.fair_share`); when one ends the
  * next pending one starts. Two tickets for the same (block, file) never overlap (a file lock;
  * the later one stays pending without taking a slot),
@@ -45,13 +45,14 @@ import { loadProjectConfig } from '../config/load.mjs';
 import { reviewWorkers } from '../config/validate.mjs';
 import { cacheHoursFrom, createDefaultKeyStore, resolveKey } from '../keys/store.mjs';
 import { appendRow, readAllRows } from '../ledger/write.mjs';
-import { spawnSession } from '../session/spawn.mjs';
+import { providerLimit, spawnSession } from '../session/spawn.mjs';
 import { snapshotFor } from '../state/config-snapshot.mjs';
 import { runRecordPath } from '../state/paths.mjs';
 import { processStartTime, readRun, reattachWorker } from '../state/run.mjs';
 import { loadKey, signRow } from '../state/signer.mjs';
 import { logWarning } from '../util/error-log.mjs';
 import { withLock, tryLock } from '../util/file-locks.mjs';
+import { startNativeDaemon } from '../util/native.mjs';
 import { redact, writeSafe } from '../util/redact.mjs';
 import { sweepProcesses } from '../util/reaper.mjs';
 import { runRoot, setRunRoot } from '../util/tmp.mjs';
@@ -69,7 +70,8 @@ export const DEFAULT_POLL_MS = 250;
 export const DEFAULT_SESSION_TIMEOUT_S = 300;
 
 /** B42: `review.parallel_tickets` when the config does not set a valid one. */
-export const DEFAULT_PARALLEL_TICKETS = 3;
+export const DEFAULT_PARALLEL_TICKETS = 6;
+export const DEFAULT_PROVIDER_PARALLEL = 4;
 
 /** B48: the fixed text of a failed autopilot expiry check in a drain (stderr and the warning log). */
 export const EXPIRY_CHECK_FAILED = 'the autopilot expiry check failed in a worker drain; it runs again at the next drain';
@@ -281,6 +283,8 @@ export async function createWorker(opts, deps = {}) {
   const pollMs = opts.pollMs ?? DEFAULT_POLL_MS;
   const heartbeatMs = Number.isInteger(opts.heartbeatMs) && /** @type {number} */ (opts.heartbeatMs) >= MIN_HEARTBEAT_MS ? /** @type {number} */ (opts.heartbeatMs) : HEARTBEAT_MS;
   let stopping = false;
+  let stopDaemon = async () => {};
+  let daemonStarted = false;
   /** @type {ReturnType<typeof setInterval> | null} */
   let heartbeat = null;
   /** @type {ReturnType<typeof announceWorker> | null} */
@@ -291,6 +295,63 @@ export async function createWorker(opts, deps = {}) {
   let poolWake = null;
   let activity = 0;
 
+  // Sessions waiting for a provider retain their ticket's pool slot. Resolve the actual provider
+  // at spawn time, after routing and second-level overrides; admission hints never bypass caps.
+  let ticketLimit = parallelTickets(cfg);
+  let providerParallel = DEFAULT_PROVIDER_PARALLEL;
+  /** @type {Map<string, {active: number, pending: number}>} */
+  const ticketSessions = new Map();
+  /** @type {Map<string, number>} */
+  const providerActive = new Map();
+  /** @type {Array<{id: string, provider: string, start: () => void}>} */
+  const sessionQueue = [];
+
+  function dispatchSessions() {
+    for (let i = 0; i < sessionQueue.length;) {
+      const next = sessionQueue[i];
+      const state = ticketSessions.get(next.id);
+      const liveTickets = [...ticketSessions.values()].filter((s) => s.active > 0).length;
+      if ((providerActive.get(next.provider) ?? 0) >= providerParallel || (state.active === 0 && liveTickets >= ticketLimit)) {
+        i += 1;
+        continue;
+      }
+      sessionQueue.splice(i, 1);
+      state.pending -= 1;
+      state.active += 1;
+      providerActive.set(next.provider, (providerActive.get(next.provider) ?? 0) + 1);
+      next.start();
+    }
+  }
+
+  /** @param {string} id @param {Parameters<typeof spawnSession>[0]} opts @returns {ReturnType<typeof spawnSession>} */
+  function spawnPooled(id, opts) {
+    // Match the spawner's per-level override and top-level fallback; validation stays there.
+    const provider = opts.cfg?.levels?.[opts.level]?.provider ?? opts.cfg?.provider ?? 'unresolved';
+    const state = ticketSessions.get(id) ?? { active: 0, pending: 0 };
+    ticketSessions.set(id, state);
+    state.pending += 1;
+    // The spawner's existing per-attempt semaphores also cover fallback providers. Retain
+    // stricter provider_concurrency settings while applying this cap to fallback attempts.
+    const providerConcurrency = Object.fromEntries(['anthropic', 'openai', 'xai'].map((p) => [p, Math.min(providerParallel, providerLimit(opts.cfg, p))]));
+    const needsCap = Object.entries(providerConcurrency).some(([p, limit]) => limit < providerLimit(opts.cfg, p));
+    const sessionCfg = needsCap ? { ...opts.cfg, review: { ...opts.cfg.review, provider_concurrency: providerConcurrency } } : opts.cfg;
+    return new Promise((resolve, reject) => {
+      sessionQueue.push({ id, provider, start: () => {
+        Promise.resolve().then(() => spawn({ ...opts, cfg: sessionCfg },
+          { env: childEnv, ...(deps.bins ? { bins: deps.bins } : {}), ...(deps.stderr ? { stderr: deps.stderr } : {}) },
+        )).then(resolve, reject).finally(() => {
+          state.active -= 1;
+          providerActive.set(provider, providerActive.get(provider) - 1);
+          if (state.active === 0 && state.pending === 0) ticketSessions.delete(id);
+          dispatchSessions();
+          poolWake?.();
+        });
+      } });
+      dispatchSessions();
+      poolWake?.();
+    });
+  }
+
   /** @param {Record<string, any>} row */
   const ledger = (row) => writeRow(signRow({ run: runId, ...row }, key));
   // Shared across direct ticks and the scheduler, so running tickets are never superseded.
@@ -305,6 +366,11 @@ export async function createWorker(opts, deps = {}) {
    * @throws {Error} `config-snapshot` — a record that cannot be read, or a missing/altered snapshot.
    */
   async function configFor(id) {
+    return snapshotFor(await configRecord(), id)?.config ?? cfg;
+  }
+
+  /** Read once for pool admission hints; ticket processing still re-reads its own snapshot. */
+  async function configRecord() {
     // The Jev key and the run root were settled at boot from `cfg`; a reload can never change
     // them, because `keys`, `system1.key` and `tmp.root` are fixed keys `run reload` refuses.
     let record;
@@ -313,13 +379,13 @@ export async function createWorker(opts, deps = {}) {
         record = await loadRun(runId);
         break;
       } catch (err) {
-        if (/** @type {any} */ (err)?.code === 'no-run') return cfg;
+        if (/** @type {any} */ (err)?.code === 'no-run') return null;
         // a transient read error (e.g. the record caught mid-replace) gets ONE retry
         if (attempt >= 2) throw new Error('config-snapshot');
         await new Promise((resolve) => setTimeout(resolve, CONFIG_RETRY_MS));
       }
     }
-    return snapshotFor(record, id)?.config ?? cfg;
+    return record;
   }
 
   /**
@@ -338,7 +404,9 @@ export async function createWorker(opts, deps = {}) {
     // A route list that cannot be used is `unavailable` — never a review on a model it did not name.
     let routed;
     try {
-      routed = routeTicket(snapshotCfg, { lines: size.lines, deleted: size.deleted, timeoutS: baseTimeoutS });
+      routed = routeTicket(snapshotCfg, { lines: size.lines, deleted: size.deleted, timeoutS: baseTimeoutS },
+        snapshotCfg.review?.adaptive?.enabled === false || !snapshotCfg.levels?.L2?.model
+          ? undefined : { rows: await readRows(), ticketId: id, runId });
     } catch (err) {
       // only a route list that cannot be used is `route-invalid`; anything else is a real failure
       // and goes to runOne (`worker-error`), named as a routing-step failure with its own text
@@ -382,9 +450,8 @@ export async function createWorker(opts, deps = {}) {
       // `sessionOpts.cfg` (a per-call config, e.g. the consensus second reviewer's level) wins
       // over the ticket's; everything else the worker pins.
       spawn: (sessionOpts) =>
-        spawn(
+        spawnPooled(id,
           /** @type {any} */ ({ cfg: tcfg, ...sessionOpts, runRoot: runRootDir, run: runId, block: ticket.block, slug, timeoutMs: timeoutS * 1000 }),
-          { env: childEnv, ...(deps.bins ? { bins: deps.bins } : {}), ...(deps.stderr ? { stderr: deps.stderr } : {}) },
         ),
       writeRow: (row) => ledger({ ...row, block: ticket.block, file: ticket.file, content_hash: ticket.content_hash }),
       writeBlockRow: (row) => ledger({ ...row, block: ticket.block }),
@@ -559,16 +626,21 @@ export async function createWorker(opts, deps = {}) {
   /**
    * Pool settings from the snapshot in force, else the boot config. A run reload applies at the
    * next drain; anything but an integer 1–16 uses the default size.
-   * @returns {Promise<{limit: number, fairShare: boolean}>}
+   * @returns {Promise<{limit: number, fairShare: boolean, record: Record<string, any> | null}>}
    */
   async function poolSettings() {
     let current = cfg;
+    let record = null;
     try {
-      current = await configFor('');
+      record = await configRecord();
+      current = snapshotFor(record, '')?.config ?? cfg;
     } catch {
       // an unreadable record: the boot settings (each ticket still fails closed on its own)
     }
-    return { limit: parallelTickets(current), fairShare: current?.review?.fair_share === true };
+    ticketLimit = parallelTickets(current);
+    const cap = current?.review?.provider_parallel;
+    providerParallel = Number.isInteger(cap) && cap >= 1 && cap <= MAX_PARALLEL_TICKETS ? cap : DEFAULT_PROVIDER_PARALLEL;
+    return { limit: parallelTickets(current), fairShare: current?.review?.fair_share === true, record };
   }
 
   /**
@@ -598,6 +670,27 @@ export async function createWorker(opts, deps = {}) {
     }
   }
 
+  /**
+   * The initial reviewer's provider is an admission hint, including snapshot and size routing.
+   * Unknown or invalid hints still enter the bounded pool so the normal checks can refuse them.
+   * Later sessions may use another provider; `spawnPooled` enforces their actual session caps.
+   * @param {string} id @param {Record<string, any> | null} record @returns {Promise<string | null>}
+   */
+  async function providerHint(id, record) {
+    try {
+      let current = snapshotFor(record, id)?.config ?? cfg;
+      if (current?.review?.routes?.length) {
+        const ticket = loadTicket(repoRoot, id);
+        const root = await contentRootFor(runId, ticket.block, repoRoot);
+        const bytes = readRegularFileNoFollow(root, ticket.file);
+        current = routeTicket(current, { lines: countLines(bytes), deleted: bytes === null, timeoutS: DEFAULT_SESSION_TIMEOUT_S }).cfg;
+      }
+      return current?.levels?.L2?.provider ?? current?.provider ?? null;
+    } catch {
+      return null;
+    }
+  }
+
   /**
    * Serve every pending ticket (B42): up to `review.parallel_tickets` at once, oldest first; with
    * fair share, each slot goes to the block with fewest running tickets, ties oldest first. When
@@ -625,6 +718,8 @@ export async function createWorker(opts, deps = {}) {
     }
     /** @type {number | null} */
     let limit = null;
+    /** @type {Record<string, any> | null} */
+    let record = null;
     let fairShare = false;
     let done = 0;
     /** @type {Map<string, Promise<void>>} */
@@ -633,6 +728,8 @@ export async function createWorker(opts, deps = {}) {
     const busy = new Set();
     /** @type {Map<string, number>} running tickets per block */
     const runningByBlock = new Map();
+    /** @type {Map<string, number>} reserve provider capacity while admitted tickets prepare */
+    const admittedByProvider = new Map();
     /** @type {Set<string>} */
     const started = new Set();
     for (;;) {
@@ -660,10 +757,12 @@ export async function createWorker(opts, deps = {}) {
         }
         const pending = pendingTickets(repoRoot).filter((id) => !poisoned.has(id) && !started.has(id));
         if (pending.length > 0 || running.size > 0) activity += 1;
-        if (pending.length > 0 && limit === null) ({ limit, fairShare } = await poolSettings());
+        if (pending.length > 0 && limit === null) ({ limit, fairShare, record } = await poolSettings());
         // Cache even unreadable hints for this tick: ranking never reads a ticket twice.
         /** @type {Map<string, ReturnType<typeof fileKeyOf>>} */
         const hints = new Map();
+        /** @type {Map<string, string | null>} */
+        const providers = new Map();
         while (pending.length > 0 && running.size < limit && !stopping) {
           let next = -1;
           let fewest = Infinity;
@@ -672,6 +771,9 @@ export async function createWorker(opts, deps = {}) {
             if (!hints.has(id)) hints.set(id, fileKeyOf(id));
             const file = hints.get(id);
             if (file && busy.has(file.key)) continue; // waits without a slot
+            if (!providers.has(id)) providers.set(id, await providerHint(id, record));
+            const provider = providers.get(id);
+            if (provider && Math.max(admittedByProvider.get(provider) ?? 0, providerActive.get(provider) ?? 0) >= providerParallel) continue;
             const count = fairShare && file ? runningByBlock.get(file.block) ?? 0 : 0;
             if (count < fewest) {
               next = i;
@@ -691,10 +793,12 @@ export async function createWorker(opts, deps = {}) {
           }
           const file = hints.get(id);
           const fileKey = file?.key ?? null;
+          const provider = providers.get(id);
           started.add(id);
           activeTickets.add(id);
           if (fileKey !== null) busy.add(fileKey);
           if (file) runningByBlock.set(file.block, (runningByBlock.get(file.block) ?? 0) + 1);
+          if (provider) admittedByProvider.set(provider, (admittedByProvider.get(provider) ?? 0) + 1);
           const slot = runOne(id)
             .then((n) => {
               done += n;
@@ -707,6 +811,7 @@ export async function createWorker(opts, deps = {}) {
               fileKeys.delete(id);
               if (fileKey !== null) busy.delete(fileKey);
               if (file) runningByBlock.set(file.block, runningByBlock.get(file.block) - 1);
+              if (provider) admittedByProvider.set(provider, admittedByProvider.get(provider) - 1);
             });
           running.set(id, slot);
         }
@@ -769,14 +874,22 @@ export async function createWorker(opts, deps = {}) {
     heartbeat = null;
   }
 
+  async function startDaemon() {
+    if (daemonStarted) return;
+    daemonStarted = true;
+    stopDaemon = await startNativeDaemon(runId, cfg, env);
+    if (stopping) await stopDaemon();
+  }
+
   /** Serve the queue until `stop()`. */
   async function run() {
-    announce();
     let interval = pollMs;
     let polled = false;
     /** @type {import('node:fs').FSWatcher | null} */
     let queueWatch = null;
     try {
+      await startDaemon();
+      announce();
       // Enqueue publishes a ticket by rename. Wake even during the longest idle back-off;
       // heartbeat and temporary files do not wake an idle worker.
       try {
@@ -818,37 +931,42 @@ export async function createWorker(opts, deps = {}) {
     } finally {
       queueWatch?.close();
       release();
+      await stopDaemon();
     }
   }
 
   /** Drain the queue once while announced, then release (`worker --once`). */
   async function once() {
-    announce();
     try {
+      await startDaemon();
+      announce();
       const done = await drain();
       if (done > 0) await cleanOrphans();
       return done;
     } finally {
       stop();
       release();
+      await stopDaemon();
     }
   }
 
   /** Stop taking tickets; the running ones are awaited (a killed one is abandoned, see `processTicket`). */
   function stop() {
     stopping = true;
+    void stopDaemon();
     wake?.();
     poolWake?.();
   }
 
   /** Withdraw this process's announcement (`worker.json`) if it is still ours. */
   function release() {
+    void stopDaemon();
     stopBeating();
     if (self !== null) retractWorker(repoRoot, self.pid, self.start_time);
     self = null;
   }
 
-  return { processTicket, drain, run, once, stop, release, announce, watchTick: tickWatch, jevKeyResolved: jevKey !== null, sessionEnv: childEnv };
+  return { processTicket, drain, run, once, stop, release, announce, startDaemon, stopDaemon: () => stopDaemon(), watchTick: tickWatch, jevKeyResolved: jevKey !== null, sessionEnv: childEnv };
 }
 
 /**
@@ -890,7 +1008,17 @@ export async function bootWorker(opts, deps = {}) {
     if (entries.some((entry) => entry.live && !entry.worker) || (legacy && legacy.run !== opts.runId) || entries.some((entry) => entry.live && entry.worker?.run !== opts.runId) || count >= limit) {
       throw new WorkerError('worker-running', `review.workers limit ${limit}: a live or unreadable worker entry already serves this queue`);
     }
-    worker.announce();
+    // Startup must finish before worker.json signals readiness: an owner may
+    // remove HOME immediately after that announcement to stop an orphan worker.
+    try {
+      await worker.startDaemon();
+      worker.announce();
+    } catch (error) {
+      worker.stop();
+      worker.release();
+      await worker.stopDaemon();
+      throw error;
+    }
   });
   return { ...worker, repoRoot, runRootDir };
 }

package/src/worker/queue.mjs

@@ -589,7 +589,7 @@ export function readTicket(repoRoot, id) {
   const t = readJSON(path.join(queueDir(repoRoot), `${assertTicketId(id)}.json`));
   if (!t || typeof t !== 'object') throw new WorkerError('bad-ticket', `ticket ${id} is not readable JSON`);
   assertRowPath(t.file);
-  if (t.tree !== undefined && (typeof t.tree !== 'string' || !path.isAbsolute(t.tree))) throw new WorkerError('bad-ticket', `ticket ${id} names a tree that is not an absolute path`);
+  if (t.tree != null && (typeof t.tree !== 'string' || !path.isAbsolute(t.tree))) throw new WorkerError('bad-ticket', `ticket ${id} names a tree that is not an absolute path`);
   if (typeof t.run !== 'string' || typeof t.block !== 'string' || typeof t.content_hash !== 'string') {
     throw new WorkerError('bad-ticket', `ticket ${id} does not match its id`);
   }