@codedology/code-forge 0.9.0 → 0.11.0

package/src/worker/engine.mjs

@@ -42,7 +42,7 @@
  * second `schema` miss — this round's first try after the earlier ticket's — is tried once on
  * `review.second_levels.<level>` when one is configured.
  * B56: every round gets ONE memoised reader of the block's OTHER changed files' diffs
- * (`blockPeerDiffs`: listed and read at most once per ticket) so the review can name code moved
+ * (the ticket's `fileContext`: listed once, diffs read lazily at most once per ticket) so the review can name code moved
  * between them in a `## moved code` packet section (round 1, rechecks and patch check alike).
  * The review NEVER approves an empty or failed session: that is `unavailable` (§4.2 stub guard).
  * A throw inside the round is `unavailable` too, with the state saved as `next: retry` (see
@@ -169,14 +169,14 @@ import { assertTicketId, contentHash, readRegularFileNoFollow, WorkerError } fro
  * `tree` (B62b) is the recorded `worktree` `{path, branch, base_sha}`, null when the block has
  * none; `base` is then the tree's `base_sha`. A recorded worktree that `worktreeRecord` refuses
  * (path, branch, hex base_sha) throws `worktree-malformed`.
- * @returns {Promise<{base: string | null, level: string, owned: string[], ownedKinds: Record<string, string>, acceptance?: unknown, kind: string | null, tree: WorktreeEntry | null, workspace: string | null}>}
+ * @returns {Promise<{base: string | null, level: string, owned: string[], ownedKinds: Record<string, string>, testFiles: string[], acceptance?: unknown, kind: string | null, tree: WorktreeEntry | null, workspace: string | null}>}
  */
 export async function blockEntryFor(runId, block) {
   let record;
   try {
     record = await readRun(runId);
   } catch (err) {
-    if (/** @type {any} */ (err)?.code === 'no-run') return { base: null, level: 'L2', owned: [], ownedKinds: {}, acceptance: undefined, kind: null, tree: null, workspace: null };
+    if (/** @type {any} */ (err)?.code === 'no-run') return { base: null, level: 'L2', owned: [], ownedKinds: {}, testFiles: [], acceptance: undefined, kind: null, tree: null, workspace: null };
     throw new Error('run-record-unreadable');
   }
   if (!record || typeof record !== 'object' || !record.blocks || typeof record.blocks !== 'object') throw new Error('run-record-unreadable');
@@ -187,6 +187,7 @@ export async function blockEntryFor(runId, block) {
   const owned = Array.isArray(entry.owned_files) ? entry.owned_files.filter((f) => typeof f === 'string') : [];
   const kinds = entry.owned_kinds;
   const ownedKinds = kinds && typeof kinds === 'object' && !Array.isArray(kinds) ? kinds : {};
+  const testFiles = Array.isArray(entry.test_files) ? entry.test_files.filter((f) => typeof f === 'string' && !/[*?\[\]{}]/.test(f) && ownsFile(owned, f, ownedKinds)) : [];
   /** @type {WorktreeEntry | null} */
   let tree = null;
   if (entry.worktree !== undefined && entry.worktree !== null) {
@@ -196,10 +197,11 @@ export async function blockEntryFor(runId, block) {
       throw new Error('worktree-malformed');
     }
   }
-  return { base: tree ? tree.base_sha : sha, level: typeof entry.level === 'string' && /^L[0-3]$/.test(entry.level) ? entry.level : 'L2', owned, ownedKinds, acceptance: entry.acceptance, kind: blockKind({ owned, declared: entry.kind }), tree, workspace: typeof record.workspace === 'string' ? record.workspace : null };
+  return { base: tree ? tree.base_sha : sha, level: typeof entry.level === 'string' && /^L[0-3]$/.test(entry.level) ? entry.level : 'L2', owned, ownedKinds, testFiles, acceptance: entry.acceptance, kind: blockKind({ owned, declared: entry.kind }), tree, workspace: typeof record.workspace === 'string' ? record.workspace : null };
 }
 
 /** @typedef {{path: string, branch: string, base_sha: string}} WorktreeEntry */
+/** @typedef {{peers: string[], changedFiles: string[], ownedFiles: string[], testFiles: string[]}} FileContext */
 
 /** The refusals of {@link blockTree} a ticket answers with, as its `reason`. */
 const TREE_CODES = new Set(['worktree-malformed', 'worktree-missing', 'worktree-not-dir', 'worktree-branch-mismatch', 'worktree-workspace-missing', 'worktree-foreign', 'git-failed']);
@@ -373,7 +375,28 @@ export async function reviewTicket(ticket, ctx) {
     }
   }
   const factsExcerpt = factsFor(entry, ctx.cfg);
-  const peerDiffs = blockPeerDiffs(contentRoot, { base: entry.base, owned: entry.owned, ownedKinds: entry.ownedKinds, file: ticket.file });
+  // Resolve concrete paths in this block's tree; neither globs nor another block's tests
+  // authorize an untracked attachment. Read lazily so a stopped ticket needs no file listing.
+  /** @type {Promise<FileContext> | undefined} */
+  let contextOnce;
+  /** @type {() => Promise<import('../review/moved.mjs').PeerDiff[]>} */
+  let readDiffs = () => Promise.resolve([]);
+  const fileContext = () => contextOnce ??= (async () => {
+    try {
+      // Read the listing directly: blockPeers' [] fallback would hide a git failure and
+      // still authorize explicit tests. Context and peer diffs must fail soft together.
+      const peers = entry.base === null || entry.owned.length === 0 ? [] : (await computeFileSet({ cwd: contentRoot, base: entry.base })).all.filter((f) => f !== ticket.file && ownsFile(entry.owned, f, entry.ownedKinds));
+      readDiffs = peerDiffReader({ repoRoot: contentRoot, base: entry.base, file: ticket.file, peers });
+      const changedFiles = [...peers, ticket.file].filter((f) => ownsFile(entry.owned, f, entry.ownedKinds));
+      return { peers, changedFiles, ownedFiles: [...new Set([...changedFiles, ...entry.testFiles])], testFiles: entry.testFiles };
+    } catch {
+      return { peers: [], changedFiles: [], ownedFiles: [], testFiles: [] };
+    }
+  })();
+  const peerDiffs = async () => {
+    await fileContext();
+    return readDiffs();
+  };
   try {
     // B63a: the `context` rules and lessons, read from the MAIN tree (`ctx.repoRoot`, never the
     // block's worktree) with the config in force for this ticket; '' without a `context` key, so
@@ -390,11 +413,11 @@ export async function reviewTicket(ticket, ctx) {
     const digest = rulesDigest === '' ? {} : { rulesDigest };
     if (!ctx.key) {
       return await reviewFile(
-        { repoRoot: contentRoot, file: ticket.file, base: entry.base, cfg: ctx.cfg, kind: entry.kind, workDir, factsExcerpt, ...digest, peerDiffs },
+        { repoRoot: contentRoot, file: ticket.file, base: entry.base, cfg: ctx.cfg, kind: entry.kind, workDir, factsExcerpt, ...digest, peerDiffs, ...(await fileContext()) },
         { spawn: ctx.spawn, ...(ctx.writeRow ? { writeRow: ctx.writeRow } : {}) },
       );
     }
-    return await fixLoopRound(ticket, tctx, { base: entry.base, level: entry.level, owned: entry.owned, ownedKinds: entry.ownedKinds, blockKindOf: entry.kind, key: ctx.key, workDir, factsExcerpt, rulesDigest, peerDiffs });
+    return await fixLoopRound(ticket, tctx, { base: entry.base, level: entry.level, owned: entry.owned, ownedKinds: entry.ownedKinds, blockKindOf: entry.kind, key: ctx.key, workDir, factsExcerpt, rulesDigest, peerDiffs, fileContext });
   } finally {
     rmSync(workDir, { recursive: true, force: true });
   }
@@ -506,10 +529,10 @@ export function mayTakeRung(state, kind, cfg, rungUsed) {
  * first full round, or any round once the rung is gone) runs outside the block lock, in parallel
  * with the block's other files.
  * @param {import('./queue.mjs').Ticket} ticket @param {ReviewContext} ctx
- * @param {{base: string | null, level: string, owned: string[], ownedKinds?: Record<string, string>, blockKindOf: string, key: Buffer, workDir: string, factsExcerpt: string, rulesDigest?: string, peerDiffs?: () => Promise<import('../review/moved.mjs').PeerDiff[]>}} opts
+ * @param {{base: string | null, level: string, owned: string[], ownedKinds?: Record<string, string>, blockKindOf: string, key: Buffer, workDir: string, factsExcerpt: string, rulesDigest?: string, peerDiffs?: () => Promise<import('../review/moved.mjs').PeerDiff[]>, fileContext: () => Promise<FileContext>}} opts
  * @returns {Promise<ReviewOutcome>}
  */
-async function fixLoopRound(ticket, ctx, { base, level, owned, ownedKinds, blockKindOf, key, workDir, factsExcerpt, rulesDigest = '', peerDiffs }) {
+async function fixLoopRound(ticket, ctx, { base, level, owned, ownedKinds, blockKindOf, key, workDir, factsExcerpt, rulesDigest = '', peerDiffs, fileContext }) {
   if (!ctx.readRows || !ctx.writeRow) return { status: 'unavailable', reason: 'no-ledger', approved: false, engine: 'adaptive', sessions: [] };
   const readRows = ctx.readRows;
   /** @type {{outcome: ReviewOutcome} | {round: () => Promise<ReviewOutcome>}} */
@@ -572,7 +595,7 @@ async function fixLoopRound(ticket, ctx, { base, level, owned, ownedKinds, block
       state.l3_rung_used = true; // the orchestrator ran the block's one L3 patch before this ticket
     }
     const fixed = state;
-    const round = () => playRound(ticket, ctx, { state: fixed, kind, where, seq, base, blockKindOf, workDir, factsExcerpt, rulesDigest, extraRounds, peerDiffs });
+    const round = () => playRound(ticket, ctx, { state: fixed, kind, where, seq, base, blockKindOf, workDir, factsExcerpt, rulesDigest, extraRounds, peerDiffs, fileContext });
     // a round that could take the rung keeps the block lock until its state is saved
     if (mayTakeRung(fixed, kind, ctx.cfg, rungUsed)) return { outcome: await round() };
     return { round };
@@ -583,10 +606,10 @@ async function fixLoopRound(ticket, ctx, { base, level, owned, ownedKinds, block
 /**
  * Run the prepared round and save the file's state: the ticket's outcome.
  * @param {import('./queue.mjs').Ticket} ticket @param {ReviewContext} ctx
- * @param {{state: import('../review/fixloop.mjs').FileState, kind: 'full' | 'recheck' | 'patch_check', where: import('./review-state.mjs').Where, seq: number, base: string | null, blockKindOf: string, workDir: string, factsExcerpt: string, rulesDigest?: string, extraRounds?: number, peerDiffs?: () => Promise<import('../review/moved.mjs').PeerDiff[]>}} opts
+ * @param {{state: import('../review/fixloop.mjs').FileState, kind: 'full' | 'recheck' | 'patch_check', where: import('./review-state.mjs').Where, seq: number, base: string | null, blockKindOf: string, workDir: string, factsExcerpt: string, rulesDigest?: string, extraRounds?: number, peerDiffs?: () => Promise<import('../review/moved.mjs').PeerDiff[]>, fileContext: () => Promise<FileContext>}} opts
  * @returns {Promise<ReviewOutcome>}
  */
-async function playRound(ticket, ctx, { state, kind, where, seq, base, blockKindOf, workDir, factsExcerpt, rulesDigest = '', extraRounds = 0, peerDiffs }) {
+async function playRound(ticket, ctx, { state, kind, where, seq, base, blockKindOf, workDir, factsExcerpt, rulesDigest = '', extraRounds = 0, peerDiffs, fileContext }) {
   /** @type {Record<string, any> | null} */
   let engineOutcome = null;
   let approvalWritten = false;
@@ -626,6 +649,7 @@ async function playRound(ticket, ctx, { state, kind, where, seq, base, blockKind
     const schemaHistory = ctx.readRows
       ? ledgerSchemaHistory({ readRows: ctx.readRows, verify: (row) => verifyRow(row, where.key).ok, runId: ctx.runId, file: ticket.file, contentHash: ticket.content_hash })
       : undefined;
+    const files = await fileContext();
     await runRound(
       state,
       {
@@ -637,16 +661,20 @@ async function playRound(ticket, ctx, { state, kind, where, seq, base, blockKind
         factsExcerpt,
         ...(rulesDigest !== '' ? { rulesDigest } : {}),
         extraRounds,
+        ...files,
         ...(peerDiffs ? { peerDiffs } : {}),
         ...(jev ? { jev } : {}),
         ...(schemaHistory ? { schemaHistory } : {}),
         review: async () => {
-          engineOutcome = await reviewFile({ repoRoot: ctx.contentRoot ?? ctx.repoRoot, file: ticket.file, base, cfg: ctx.cfg, kind: blockKindOf, workDir, factsExcerpt, ...(rulesDigest !== '' ? { rulesDigest } : {}), ...(peerDiffs ? { peerDiffs } : {}) }, { spawn: ctx.spawn, writeRow, ...(schemaHistory ? { schemaHistory } : {}) });
+          engineOutcome = await reviewFile({ repoRoot: ctx.contentRoot ?? ctx.repoRoot, file: ticket.file, base, cfg: ctx.cfg, kind: blockKindOf, workDir, factsExcerpt, ...files, ...(rulesDigest !== '' ? { rulesDigest } : {}), ...(peerDiffs ? { peerDiffs } : {}) }, { spawn: ctx.spawn, writeRow, ...(schemaHistory ? { schemaHistory } : {}) });
           return engineOutcome;
         },
         spawn: async (opts) => {
           const res = await ctx.spawn(opts);
-          rechecks.push({ lens: opts?.rowExtra?.lens ?? null, role: opts?.role ?? null, level: opts?.level ?? null, provider: res?.provider ?? null, model: res?.model ?? null });
+          rechecks.push({ lens: opts?.rowExtra?.lens ?? null, role: opts?.role ?? null, level: opts?.level ?? null, provider: res?.provider ?? null, model: res?.model ?? null,
+            status: res?.status ?? null, tokens_in: res?.usage?.tokens_in ?? res?.row?.tokens_in ?? null, tokens_out: res?.usage?.tokens_out ?? res?.row?.tokens_out ?? null,
+            ...(typeof res?.status === 'string' && res.status !== 'ok' ? { reason: res.reason ?? res.status } : {}),
+          });
           return res;
         },
       },
@@ -689,7 +717,7 @@ async function playRound(ticket, ctx, { state, kind, where, seq, base, blockKind
     return { ...head, status: 'reviewed', approved: true, findings: [] };
   }
   if (status === 'stopped') return { ...head, status: 'stopped', stopped: next?.reason ?? 'stopped', ...stopSize(state), approved: false, findings: state.open };
-  return { ...head, status: 'reviewed', approved: false, reason: 'findings-open', findings: state.open };
+  return { ...head, status: 'reviewed', approved: false, reason: next?.reason === 'no-fix-hunks' ? 'no-fix-hunks' : 'findings-open', findings: state.open };
 }
 
 /**

package/src/worker/loop.mjs

@@ -35,24 +35,28 @@
  */
 
 import { spawn as nodeSpawn } from 'node:child_process';
+import { existsSync, statSync } from 'node:fs';
+import os from 'node:os';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { expiryChecks } from '../autopilot/limits.mjs';
 import { loadProjectConfig } from '../config/load.mjs';
-import { createDefaultKeyStore, resolveKey } from '../keys/store.mjs';
+import { cacheHoursFrom, createDefaultKeyStore, resolveKey } from '../keys/store.mjs';
 import { appendRow, readAllRows } from '../ledger/write.mjs';
 import { spawnSession } from '../session/spawn.mjs';
 import { snapshotFor } from '../state/config-snapshot.mjs';
+import { runRecordPath } from '../state/paths.mjs';
 import { readRun, reattachWorker } from '../state/run.mjs';
 import { loadKey, signRow } from '../state/signer.mjs';
 import { logWarning } from '../util/error-log.mjs';
 import { keyedLock } from '../util/locks.mjs';
-import { writeSafe } from '../util/redact.mjs';
+import { redact, writeSafe } from '../util/redact.mjs';
 import { runRoot, setRunRoot } from '../util/tmp.mjs';
 import { openFindings } from '../review/gate-check.mjs';
+import { countLines, RouteError, routeTicket } from '../review/route.mjs';
 import { canonicalPath, contentRootFor, reviewTicket } from './engine.mjs';
 import { announceWorker, beatWorker, HEARTBEAT_MS, liveWorker, pendingTickets, readTicket, retractWorker, writeResult } from './queue.mjs';
-import { contentHash, DELETED_HASH, repoRootOf, WorkerError } from './ticket.mjs';
+import { DELETED_HASH, hashBytes, readRegularFileNoFollow, repoRootOf, WorkerError } from './ticket.mjs';
 
 /** Name of the key the worker resolves for System 1 (`keys.jev` / `system1.key` reference). */
 export const JEV_KEY_NAME = 'jev';
@@ -136,16 +140,37 @@ export function sessionEnv(env, secrets) {
 /**
  * Resolve the Jev key through B2's chain (env → store → 1Password). A missing key is not an error:
  * System 1 then falls back (`system1.fallback`, B3). The value is registered for redaction by B2.
+ * A refresh from 1Password is cached for the config's `keys.cache_hours` (B84: the run's snapshot;
+ * a snapshot from before the key has none ⇒ 8 h).
  * @param {Record<string, any>} cfg
- * @param {{store: import('../keys/store.mjs').KeyStore, env: NodeJS.ProcessEnv, opRead?: any}} deps
+ * @param {{store: import('../keys/store.mjs').KeyStore, env: NodeJS.ProcessEnv, opRead?: any, now?: number}} deps
  * @returns {Promise<string | null>}
  */
-export async function resolveJevKey(cfg, { store, env, opRead }) {
+export async function resolveJevKey(cfg, { store, env, opRead, now }) {
   const ref = cfg?.system1?.key ?? cfg?.keys?.[JEV_KEY_NAME];
-  const res = await resolveKey(JEV_KEY_NAME, { store, env, ref: typeof ref === 'string' ? ref : undefined, ...(opRead ? { opRead } : {}) });
+  const res = await resolveKey(JEV_KEY_NAME, {
+    store,
+    env,
+    ref: typeof ref === 'string' ? ref : undefined,
+    cacheHours: cacheHoursFrom(cfg).hours,
+    ...(opRead ? { opRead } : {}),
+    ...(now !== undefined ? { now } : {}),
+  });
   return res.value;
 }
 
+/**
+ * B90: an unexpected failure inside a named worker step (today: `routing`). The ticket still ends
+ * `worker-error`; its result's `detail` says `<step>: <original error text>` (redacted).
+ */
+class StepError extends Error {
+  /** @param {string} step @param {unknown} cause */
+  constructor(step, cause) {
+    super(`${step}: ${cause instanceof Error ? `${cause.name}: ${cause.message}` : String(cause)}`, { cause });
+    this.step = step;
+  }
+}
+
 /** The fix-loop fields of an engine outcome the result carries (B12c, §4.11). */
 const LOOP_FIELDS = Object.freeze(['round', 'kind', 'level', 'next', 'trigger', 'stopped', 'late']);
 
@@ -198,6 +223,7 @@ export function recordedVerdict(result) {
  * @property {string} slug - ledger project slug (the run record's `project`).
  * @property {Buffer} key - the run's HMAC key.
  * @property {number} [pollMs]
+ * @property {string} [guardRunRecordPath] - booted workers stop when this authoritative record disappears.
  * @property {number} [heartbeatMs] - how often `heartbeat_at` is refreshed: an integer ≥ `MIN_HEARTBEAT_MS`,
  *   else `HEARTBEAT_MS`.
  */
@@ -282,14 +308,51 @@ export async function createWorker(opts, deps = {}) {
   }
 
   /**
-   * One ticket through the engine hook with `tcfg` (the ticket's config snapshot): the unsigned result.
+   * One ticket through the engine hook with the ticket's config snapshot, routed by size (B90): the unsigned result.
+   * @param {string} id - the ticket id (B90: a retried ticket never writes its route rows twice).
    * @param {import('./queue.mjs').Ticket} ticket @param {Record<string, any>} base
-   * @param {Record<string, any>} tcfg
+   * @param {Record<string, any>} snapshotCfg - the ticket's config snapshot, before B90 routing.
    * @param {string} contentRoot - B62b: the tree the content was hashed in, and is reviewed in.
+   * @param {{lines: number, deleted: boolean}} size - B90: the line count of the hashed bytes.
    * @returns {Promise<Record<string, any>>}
    */
-  async function reviewWith(ticket, base, tcfg, contentRoot) {
-    const timeoutS = Number.isInteger(tcfg?.review?.session_timeout_s) && tcfg.review.session_timeout_s > 0 ? tcfg.review.session_timeout_s : DEFAULT_SESSION_TIMEOUT_S;
+  async function reviewWith(id, ticket, base, snapshotCfg, contentRoot, size) {
+    const baseTimeoutS = Number.isInteger(snapshotCfg?.review?.session_timeout_s) && snapshotCfg.review.session_timeout_s > 0 ? snapshotCfg.review.session_timeout_s : DEFAULT_SESSION_TIMEOUT_S;
+    // B90: `review.routes` picks the model, second level and timeout of every session of this
+    // ticket from its size, once, before the first session. No route ⇒ the snapshot object itself.
+    // A route list that cannot be used is `unavailable` — never a review on a model it did not name.
+    let routed;
+    try {
+      routed = routeTicket(snapshotCfg, { lines: size.lines, deleted: size.deleted, timeoutS: baseTimeoutS });
+    } catch (err) {
+      // only a route list that cannot be used is `route-invalid`; anything else is a real failure
+      // and goes to runOne (`worker-error`), named as a routing-step failure with its own text
+      if (!(err instanceof RouteError)) throw new StepError('routing', err);
+      return { ...base, status: 'unavailable', reason: 'route-invalid', approved: false };
+    }
+    const tcfg = routed.cfg;
+    const timeoutS = routed.timeoutS;
+    // the signed `review.route` row comes before the first session; a row that cannot be written
+    // is `unavailable` (a routed review the ledger cannot explain never runs). One row per routed
+    // level per ticket: a retried ticket (same id) skips the levels whose row the ledger already has.
+    // `runId` is the run this ticket belongs to (reviewOne refuses `ticket.run !== runId` as
+    // other-run), and a restarted worker serves the same run id (startWorker: `opts.runId`), so the
+    // check holds across workers of that run.
+    if (routed.rows.length > 0) {
+      try {
+        const have = new Set(
+          (await readRows())
+            .filter((r) => r?.event === 'review.route' && r.run === runId && r.ticket === id)
+            .map((r) => r.level),
+        );
+        for (const row of routed.rows) {
+          if (have.has(row.level)) continue;
+          await ledger({ ...row, ticket: id, block: ticket.block, file: ticket.file, content_hash: ticket.content_hash });
+        }
+      } catch {
+        return { ...base, status: 'unavailable', reason: 'route-row', approved: false };
+      }
+    }
     /** @type {import('./engine.mjs').ReviewContext} */
     const ctx = {
       repoRoot,
@@ -382,8 +445,12 @@ export async function createWorker(opts, deps = {}) {
     if (canonicalPath(hashedIn) !== canonicalPath(contentRoot)) return { ...base, status: 'unavailable', reason: 'worktree-mismatch', approved: false };
     /** @type {string} */
     let current;
+    /** @type {Buffer | null} */
+    let bytes;
     try {
-      current = contentHash(contentRoot, ticket.file);
+      // B90: one read — the bytes hashed are the bytes whose lines route the review
+      bytes = readRegularFileNoFollow(contentRoot, ticket.file);
+      current = hashBytes(bytes);
     } catch (err) {
       // the path no longer passes the on-disk check, or the file cannot be read
       const reason = err instanceof WorkerError ? err.code : 'unreadable';
@@ -398,7 +465,7 @@ export async function createWorker(opts, deps = {}) {
     } catch {
       return { ...base, status: 'unavailable', reason: 'config-snapshot', approved: false };
     }
-    return reviewWith(ticket, base, ticketCfg, contentRoot);
+    return reviewWith(id, ticket, base, ticketCfg, contentRoot, { lines: countLines(bytes), deleted: bytes === null });
   }
 
   /**
@@ -445,9 +512,11 @@ export async function createWorker(opts, deps = {}) {
   async function runOne(id) {
     try {
       return (await processTicket(id)) !== null ? 1 : 0;
-    } catch {
+    } catch (err) {
+      // B90: a failure a step names (StepError) keeps its step and original text, redacted
+      const detail = err instanceof StepError ? { detail: redact(err.message) } : {};
       try {
-        await complete(id, { event: 'review.result', status: 'unavailable', reason: 'worker-error', approved: false });
+        await complete(id, { event: 'review.result', status: 'unavailable', reason: 'worker-error', ...detail, approved: false });
         return 1;
       } catch {
         poisoned.add(id);
@@ -533,6 +602,20 @@ export async function createWorker(opts, deps = {}) {
     /** @type {Set<string>} */
     const started = new Set();
     for (;;) {
+      // One cheap stat per scheduler tick, including while tickets are in flight. Removing a
+      // test HOME (or the run record) stops new tickets; an open real run remains untouched.
+      if (!stopping && opts.guardRunRecordPath) {
+        try {
+          statSync(opts.guardRunRecordPath);
+        } catch (err) {
+          if (err.code === 'ENOENT' || err.code === 'ENOTDIR') {
+            stop();
+            // The error log lives under HOME: never write it when HOME itself is gone, or the
+            // log write would create the removed HOME again.
+            if (existsSync(os.homedir())) await logWarning({ warning: 'worker_orphan_stop', message: `run record missing: ${opts.guardRunRecordPath}` }).catch(() => null);
+          }
+        }
+      }
       if (!stopping) {
         for (const id of pendingTickets(repoRoot)) {
           if (poisoned.has(id) || started.has(id)) continue;
@@ -685,7 +768,7 @@ export async function bootWorker(opts, deps = {}) {
   const runRootDir = runRoot(opts.runId, { root: tmpRoot });
   setRunRoot(runRootDir);
   const key = await loadKey(opts.runId);
-  const worker = await createWorker({ runId: opts.runId, repoRoot, cfg, runRootDir, slug: record.project, key, pollMs: opts.pollMs }, deps);
+  const worker = await createWorker({ runId: opts.runId, repoRoot, cfg, runRootDir, slug: record.project, key, pollMs: opts.pollMs, guardRunRecordPath: runRecordPath(opts.runId) }, deps);
   return { ...worker, repoRoot, runRootDir };
 }
 

package/src/worker/ticket.mjs

@@ -185,7 +185,15 @@ function realOrSelf(p) {
  * @returns {string}
  */
 export function contentHash(repoRoot, file) {
-  const bytes = readRegularFileNoFollow(repoRoot, file);
+  return hashBytes(readRegularFileNoFollow(repoRoot, file));
+}
+
+/**
+ * The one content-hash rule (B90: the worker hashes the bytes it also counts lines on): sha256 of
+ * the bytes, or `DELETED_HASH` for `null` (no file).
+ * @param {Buffer | null} bytes @returns {string}
+ */
+export function hashBytes(bytes) {
   if (bytes === null) return DELETED_HASH;
   return createHash('sha256').update(bytes).digest('hex');
 }