@gobing-ai/spur 0.3.74 → 0.3.75

package/spur.js

@@ -58609,6 +58609,132 @@ class SystemEventDao {
       throw error51;
     }
   }
+  async eventSummary(spec) {
+    const until = spec.until ?? new Date().toISOString();
+    const since = spec.since;
+    const sinceMs = Date.parse(since);
+    const untilMs = Date.parse(until);
+    if (Number.isNaN(sinceMs) || Number.isNaN(untilMs) || untilMs <= sinceMs) {
+      return {
+        window: { since, until },
+        totalEvents: 0,
+        errorEventCount: 0,
+        warningEventCount: 0,
+        eventVolumeBuckets: [],
+        topEventTypes: [],
+        recentErrors: []
+      };
+    }
+    const width = untilMs - sinceMs;
+    let bucketMs = spec.bucketMs && spec.bucketMs > 0 ? spec.bucketMs : width <= 3600000 ? 60000 : width <= 21600000 ? 300000 : width <= 86400000 ? 900000 : width <= 604800000 ? 3600000 : 86400000;
+    while (Math.ceil((untilMs - sinceMs) / bucketMs) > 240) {
+      bucketMs *= 2;
+    }
+    const bucketCount = Math.max(1, Math.ceil((untilMs - sinceMs) / bucketMs));
+    const buckets = [];
+    for (let i2 = 0;i2 < bucketCount; i2++) {
+      buckets.push({
+        timestamp: new Date(sinceMs + i2 * bucketMs).toISOString(),
+        total: 0,
+        byPrefix: {},
+        bySeverity: { info: 0, warning: 0, error: 0, unknown: 0 }
+      });
+    }
+    try {
+      const totalsRow = await this.db.queryFirst(`SELECT
+                    COUNT(*) AS total,
+                    SUM(CASE WHEN sev = 'error' THEN 1 ELSE 0 END) AS error_count,
+                    SUM(CASE WHEN sev = 'warning' THEN 1 ELSE 0 END) AS warning_count
+                FROM (
+                    SELECT COALESCE(json_extract(payload_json, '$.presentation.severity'), 'unknown') AS sev
+                    FROM system_events
+                    WHERE occurred_at >= ?1 AND occurred_at < ?2
+                )`, since, until);
+      const bucketRows = await this.db.queryAll(`SELECT
+                    CAST((strftime('%s', occurred_at) * 1000 - ?1) / ?2 AS INTEGER) AS bucket_idx,
+                    CASE WHEN instr(event_name, '.') > 0 THEN substr(event_name, 1, instr(event_name, '.') - 1) ELSE event_name END AS prefix,
+                    COALESCE(json_extract(payload_json, '$.presentation.severity'), 'unknown') AS sev,
+                    COUNT(*) AS cnt
+                FROM system_events
+                WHERE occurred_at >= ?3 AND occurred_at < ?4
+                GROUP BY bucket_idx, prefix, sev`, sinceMs, bucketMs, since, until);
+      for (const row of bucketRows) {
+        const idx = Number(row.bucket_idx);
+        if (idx >= 0 && idx < buckets.length) {
+          const b = buckets[idx];
+          if (b !== undefined) {
+            const cnt = Number(row.cnt);
+            b.total += cnt;
+            b.byPrefix[row.prefix] = (b.byPrefix[row.prefix] ?? 0) + cnt;
+            if (row.sev === "info" || row.sev === "warning" || row.sev === "error") {
+              b.bySeverity[row.sev] += cnt;
+            } else {
+              b.bySeverity.unknown += cnt;
+            }
+          }
+        }
+      }
+      const topRows = await this.db.queryAll(`SELECT
+                    event_name AS name,
+                    CASE WHEN instr(event_name, '.') > 0 THEN substr(event_name, 1, instr(event_name, '.') - 1) ELSE event_name END AS prefix,
+                    COUNT(*) AS count,
+                    MAX(occurred_at) AS latest_at
+                FROM system_events
+                WHERE occurred_at >= ?1 AND occurred_at < ?2
+                GROUP BY event_name
+                ORDER BY count DESC, event_name ASC
+                LIMIT 10`, since, until);
+      const recentRows = await this.db.queryAll(`SELECT
+                    id,
+                    event_name AS name,
+                    occurred_at,
+                    COALESCE(
+                        json_extract(payload_json, '$.presentation.summary'),
+                        json_extract(payload_json, '$.presentation.title'),
+                        json_extract(payload_json, '$.error'),
+                        event_name
+                    ) AS message,
+                    run_id AS ref_id
+                FROM system_events
+                WHERE occurred_at >= ?1 AND occurred_at < ?2
+                  AND COALESCE(json_extract(payload_json, '$.presentation.severity'), '') = 'error'
+                ORDER BY occurred_at DESC, id DESC
+                LIMIT 10`, since, until);
+      return {
+        window: { since, until },
+        totalEvents: Number(totalsRow?.total ?? 0),
+        errorEventCount: Number(totalsRow?.error_count ?? 0),
+        warningEventCount: Number(totalsRow?.warning_count ?? 0),
+        eventVolumeBuckets: buckets,
+        topEventTypes: topRows.map((r) => ({
+          name: r.name,
+          prefix: r.prefix,
+          count: Number(r.count),
+          latestAt: r.latest_at
+        })),
+        recentErrors: recentRows.map((r) => ({
+          id: r.id,
+          name: r.name,
+          occurredAt: r.occurred_at,
+          message: String(r.message ?? r.name),
+          ...r.ref_id ? { refId: r.ref_id } : {}
+        }))
+      };
+    } catch (error51) {
+      if (error51 instanceof Error && error51.message.includes("no such table: system_events")) {
+        return {
+          window: { since, until },
+          totalEvents: 0,
+          errorEventCount: 0,
+          warningEventCount: 0,
+          eventVolumeBuckets: buckets,
+          topEventTypes: [],
+          recentErrors: []
+        };
+      }
+      throw error51;
+    }
+  }
   async deleteAll() {
     await this.db.run("DELETE FROM system_events");
   }
@@ -60660,14 +60786,19 @@ var init_run_dao = __esm(() => {
     stampMetadata(runId, metadata) {
       return this.mergeMetadata(runId, metadata);
     }
-    stampRunIdentity(runId, definitionDigest, workflowVersion) {
+    stampRunIdentity(runId, definitionDigest, workflowVersion, source) {
+      const sourceSet = source === undefined ? "" : `,
+                 '$.definitionSource.path', ?4,
+                 '$.definitionSource.layer', ?5,
+                 '$.definitionSource.workdir', ?6`;
       return this.adapter.run(`UPDATE runs
              SET metadata_json = json_set(
                  COALESCE(NULLIF(metadata_json, ''), '{}'),
                  '$.definitionDigest', ?1,
-                 '$.workflowVersion', ?2
+                 '$.workflowVersion', ?2${sourceSet}
              )
-             WHERE id = ?3`, definitionDigest, workflowVersion, runId);
+             WHERE id = ?3
+               AND json_type(COALESCE(NULLIF(metadata_json, ''), '{}'), '$.definitionDigest') IS NULL`, definitionDigest, workflowVersion, runId, ...source !== undefined ? [source.path, source.layer, source.workdir] : []);
     }
     stampFailureReason(runId, reason) {
       return this.adapter.run(`UPDATE runs
@@ -68066,6 +68197,208 @@ async function enqueueCoalesced(db2, spec) {
   }
   return { status: "enqueued", jobId: fallback.id, payload: spec.payload };
 }
+async function queryQueueJobs(db2, spec = {}) {
+  const limit = Math.min(500, Math.max(1, spec.limit ?? 100));
+  const offset = Math.max(0, spec.offset ?? 0);
+  let sinceMs;
+  if (spec.since !== undefined) {
+    sinceMs = typeof spec.since === "number" ? spec.since : Date.parse(spec.since);
+    if (Number.isNaN(sinceMs))
+      sinceMs = undefined;
+  }
+  try {
+    const countConditions = ["1=1"];
+    const countParams = [];
+    if (sinceMs !== undefined) {
+      countConditions.push("created_at >= ?");
+      countParams.push(sinceMs);
+    }
+    const countRows = await db2.queryAll(`SELECT status, COUNT(*) AS cnt
+             FROM queue_jobs
+             WHERE ${countConditions.join(" AND ")}
+             GROUP BY status`, ...countParams);
+    const countsByStatus = {
+      all: 0,
+      pending: 0,
+      processing: 0,
+      completed: 0,
+      failed: 0
+    };
+    for (const row of countRows) {
+      const count3 = Number(row.cnt);
+      countsByStatus.all += count3;
+      if (row.status === "pending")
+        countsByStatus.pending = count3;
+      else if (row.status === "processing")
+        countsByStatus.processing = count3;
+      else if (row.status === "completed")
+        countsByStatus.completed = count3;
+      else if (row.status === "failed")
+        countsByStatus.failed = count3;
+    }
+    const queryConditions = ["1=1"];
+    const queryParams = [];
+    if (spec.status !== undefined) {
+      queryConditions.push("status = ?");
+      queryParams.push(spec.status);
+    }
+    if (sinceMs !== undefined) {
+      queryConditions.push("created_at >= ?");
+      queryParams.push(sinceMs);
+    }
+    queryParams.push(limit + 1);
+    queryParams.push(offset);
+    const rows = await db2.queryAll(`SELECT id, type, payload, status, attempts, max_retries,
+                    created_at, updated_at, next_retry_at, last_error,
+                    processing_at, expires_at
+             FROM queue_jobs
+             WHERE ${queryConditions.join(" AND ")}
+             ORDER BY created_at DESC, id DESC
+             LIMIT ? OFFSET ?`, ...queryParams);
+    const hasMore = rows.length > limit;
+    const pageRows = hasMore ? rows.slice(0, limit) : rows;
+    const jobs = pageRows.map((r) => {
+      const queuedAt = new Date(r.created_at).toISOString();
+      const startedAt = r.processing_at ? new Date(r.processing_at).toISOString() : null;
+      const endedAt = r.status === "completed" || r.status === "failed" ? new Date(r.updated_at).toISOString() : null;
+      const durationMs = startedAt && endedAt && r.processing_at != null ? r.updated_at - r.processing_at : null;
+      let parsedPayload = null;
+      if (r.payload) {
+        try {
+          const parsed = JSON.parse(r.payload);
+          if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+            parsedPayload = parsed;
+          }
+        } catch {
+          parsedPayload = null;
+        }
+      }
+      return {
+        id: r.id,
+        type: r.type,
+        status: r.status,
+        attempts: r.attempts,
+        maxRetries: r.max_retries,
+        queuedAt,
+        startedAt,
+        endedAt,
+        durationMs,
+        lastError: r.last_error ?? null,
+        payload: parsedPayload
+      };
+    });
+    const total = spec.status !== undefined ? countsByStatus[spec.status] ?? 0 : countsByStatus.all;
+    return {
+      jobs,
+      total,
+      hasMore,
+      countsByStatus
+    };
+  } catch (error51) {
+    if (error51 instanceof Error && error51.message.includes("no such table: queue_jobs")) {
+      return {
+        jobs: [],
+        total: 0,
+        hasMore: false,
+        countsByStatus: { all: 0, pending: 0, processing: 0, completed: 0, failed: 0 }
+      };
+    }
+    throw error51;
+  }
+}
+async function queueJobKpis(db2, sinceMs, untilMs) {
+  try {
+    const countsRows = await db2.queryAll(`SELECT status, COUNT(*) AS cnt
+             FROM queue_jobs
+             WHERE created_at >= ?1 AND created_at < ?2
+             GROUP BY status`, sinceMs, untilMs);
+    let pending = 0;
+    let processing = 0;
+    let completed = 0;
+    let failed = 0;
+    for (const row of countsRows) {
+      const count3 = Number(row.cnt);
+      if (row.status === "pending")
+        pending = count3;
+      else if (row.status === "processing")
+        processing = count3;
+      else if (row.status === "completed")
+        completed = count3;
+      else if (row.status === "failed")
+        failed = count3;
+    }
+    const activeJobs = pending + processing;
+    const totalTerminal = completed + failed;
+    const successRatePct = totalTerminal > 0 ? Math.round(completed / totalTerminal * 100) : 0;
+    const errorRows = await db2.queryAll(`SELECT id, type, updated_at, last_error
+             FROM queue_jobs
+             WHERE status = 'failed' AND created_at >= ?1 AND created_at < ?2
+             ORDER BY updated_at DESC, id DESC
+             LIMIT 10`, sinceMs, untilMs);
+    const recentJobErrors = errorRows.map((r) => ({
+      id: r.id,
+      name: r.type,
+      occurredAt: new Date(r.updated_at).toISOString(),
+      message: r.last_error ?? "Job failed with no error message"
+    }));
+    return {
+      activeJobs,
+      completedJobs: completed,
+      failedJobs: failed,
+      successRatePct,
+      recentJobErrors
+    };
+  } catch (error51) {
+    if (error51 instanceof Error && error51.message.includes("no such table: queue_jobs")) {
+      return {
+        activeJobs: 0,
+        completedJobs: 0,
+        failedJobs: 0,
+        successRatePct: 0,
+        recentJobErrors: []
+      };
+    }
+    throw error51;
+  }
+}
+async function queryScheduleLastExecution(db2, source, name) {
+  try {
+    if (source === "builtin") {
+      const row2 = await db2.queryFirst(`SELECT status, updated_at FROM queue_jobs WHERE type = ? ORDER BY created_at DESC, id DESC LIMIT 1`, name);
+      return row2 ?? null;
+    }
+    const row = await db2.queryFirst(`SELECT status, updated_at FROM queue_jobs
+             WHERE type = 'scheduler.custom'
+               AND json_extract(payload, '$.name') = ?
+             ORDER BY created_at DESC, id DESC LIMIT 1`, name);
+    return row ?? null;
+  } catch (error51) {
+    if (error51 instanceof Error && error51.message.includes("no such table: queue_jobs")) {
+      return null;
+    }
+    throw error51;
+  }
+}
+async function findActiveSchedulerCustomJob(db2, name) {
+  const row = await db2.queryFirst(`SELECT id FROM queue_jobs
+         WHERE type = 'scheduler.custom' AND status IN ('pending', 'processing')
+           AND json_extract(payload, '$.name') = ?
+         LIMIT 1`, name);
+  return row ?? undefined;
+}
+async function failOrphanedProcessingJobs(db2, now) {
+  const orphan = await db2.queryFirst(`SELECT count(*) AS cnt FROM queue_jobs WHERE status = 'processing'`);
+  const count3 = orphan?.cnt ?? 0;
+  if (count3 > 0) {
+    await db2.run(`UPDATE queue_jobs
+             SET status = 'failed',
+                 last_error = 'Process terminated: server restarted while job was in flight',
+                 processing_at = NULL,
+                 updated_at = ?
+             WHERE status = 'processing'`, now);
+  }
+  return count3;
+}
 var SQLITE_BUSY_TIMEOUT_MS = 30000;
 var init_db2 = __esm(() => {
   init_migrations();
@@ -70009,6 +70342,9 @@ function buildTaskSkeleton(options) {
 `).trimEnd()}
 `;
 }
+function serializeTaskFrontmatter(data) {
+  return $stringify(data, { lineWidth: 0 });
+}
 function extractTemplateBodies(templateMarkdown) {
   const doc2 = MarkdownDocument.parse(templateMarkdown, "task");
   const bodies = {};
@@ -70037,6 +70373,7 @@ function renderTaskTemplate(templateContent, vars) {
 }
 var sectionNameSchema, matrixEntrySchema, matrixStatusSchema, sectionMatrixSchema, SECTION_GUIDANCE, CANONICAL_INDEX;
 var init_task_skeleton = __esm(() => {
+  init_dist2();
   init_zod();
   init_markdown_document();
   sectionNameSchema = exports_external.enum(TASK_CANONICAL_SECTIONS);
@@ -70351,6 +70688,7 @@ __export(exports_src, {
   sessionToolDurations: () => sessionToolDurations,
   sessionTimeline: () => sessionTimeline,
   sessionSpans: () => sessionSpans,
+  serializeTaskFrontmatter: () => serializeTaskFrontmatter,
   serializeStablePrefix: () => serializeStablePrefix,
   serializeLayer: () => serializeLayer,
   serializeEnvelope: () => serializeEnvelope,
@@ -70378,6 +70716,9 @@ __export(exports_src, {
   readRollupWatermarks: () => readRollupWatermarks,
   readRecordedImporterSchemaVersion: () => readRecordedImporterSchemaVersion,
   readLockMetadata: () => readLockMetadata,
+  queueJobKpis: () => queueJobKpis,
+  queryScheduleLastExecution: () => queryScheduleLastExecution,
+  queryQueueJobs: () => queryQueueJobs,
   projectSnapshotSchema: () => projectSnapshotSchema,
   passAllResolver: () => passAllResolver,
   parseTodoItems: () => parseTodoItems,
@@ -70448,9 +70789,11 @@ __export(exports_src, {
   formatRatio: () => formatRatio,
   foldTotals: () => foldTotals,
   findPendingQueueJob: () => findPendingQueueJob,
+  findActiveSchedulerCustomJob: () => findActiveSchedulerCustomJob,
   featureStatusIcon: () => featureStatusIcon,
   featureSnapshotSchema: () => featureSnapshotSchema,
   featureFrontmatterSchema: () => featureFrontmatterSchema,
+  failOrphanedProcessingJobs: () => failOrphanedProcessingJobs,
   extractTemplateBodies: () => extractTemplateBodies,
   extractStablePrefix: () => extractStablePrefix,
   extractPhases: () => extractPhases,
@@ -74601,7 +74944,7 @@ class PlanningCheckService {
     }
     findings.push(...structuralFindings(raw, this.docKind));
   }
-  summarizeWithStatus(status, findings, strict, overrides, accepted, id) {
+  summarizeWithStatus(status, findings, strict, overrides, accepted, id, requiredList) {
     const effectiveFindings = [];
     const notes = [];
     for (const f of findings) {
@@ -74643,12 +74986,24 @@ class PlanningCheckService {
         break;
       }
     }
-    const requiredSections = [];
     const missingSections = [];
-    for (const f of effectiveFindings) {
-      if (f.layer === "L2" && f.section && f.message.startsWith("Missing required")) {
-        requiredSections.push(f.section);
-        missingSections.push(f.section);
+    let requiredSections;
+    if (requiredList !== undefined) {
+      requiredSections = [...requiredList];
+      const seen = new Set;
+      for (const f of effectiveFindings) {
+        if (f.layer === "L2" && f.section && f.message.startsWith("Missing required") && !seen.has(f.section)) {
+          seen.add(f.section);
+          missingSections.push(f.section);
+        }
+      }
+    } else {
+      requiredSections = [];
+      for (const f of effectiveFindings) {
+        if (f.layer === "L2" && f.section && f.message.startsWith("Missing required")) {
+          requiredSections.push(f.section);
+          missingSections.push(f.section);
+        }
       }
     }
     return { status, findings: effectiveFindings, requiredSections, missingSections, pass: !hasError, notes };
@@ -76069,13 +76424,29 @@ var init_task_check = __esm(() => {
       }
       return {
         wbs,
-        ...this.summarizeWithStatus(effectiveStatus, findings, strict, options?.severityOverrides, options?.accepted, wbs),
+        ...this.summarizeWithStatus(effectiveStatus, findings, strict, options?.severityOverrides, options?.accepted, wbs, entry?.required),
         repairs
       };
     }
+    checkContentPolicy(raw, wbs, options) {
+      const findings = [];
+      const doc2 = this.runL1(raw, wbs, findings);
+      if (doc2 === null) {
+        return { doc: null, findings };
+      }
+      const fm = doc2.frontmatterData ?? {};
+      const effectiveStatus = options?.asStatus ?? fm.status ?? "backlog";
+      const variant = fm.template ?? DEFAULT_TASK_VARIANT;
+      const entry = this.resolveMatrixEntry(variant, effectiveStatus);
+      this.runL2(doc2, entry, findings, raw);
+      this.runL3(doc2, entry, effectiveStatus, findings);
+      const { findings: effectiveFindings } = this.summarizeWithStatus(effectiveStatus, findings, options?.strict, options?.severityOverrides, undefined, wbs, entry?.required);
+      return { doc: doc2, findings: effectiveFindings, entry };
+    }
     runL3(doc2, entry, status, findings) {
+      const requiredAtStatus = new Set(entry?.required ?? []);
       const reqBodyRaw = doc2.getSection("Requirements");
-      if (reqBodyRaw !== null && isPlaceholderBody(reqBodyRaw)) {
+      if (requiredAtStatus.has("Requirements") && reqBodyRaw !== null && isPlaceholderBody(reqBodyRaw)) {
         findings.push({
           layer: "L3",
           code: FINDING_CODES.L3_REQUIREMENTS_EMPTY,
@@ -76085,7 +76456,7 @@ var init_task_check = __esm(() => {
         });
       }
       const acBodyRaw = doc2.getSection("Acceptance Criteria");
-      if (acBodyRaw !== null && isPlaceholderBody(stripAcFence(acBodyRaw))) {
+      if (requiredAtStatus.has("Acceptance Criteria") && acBodyRaw !== null && isPlaceholderBody(stripAcFence(acBodyRaw))) {
         findings.push({
           layer: "L3",
           code: FINDING_CODES.L3_AC_EMPTY,
@@ -76201,9 +76572,8 @@ var init_task_check = __esm(() => {
           });
         }
       }
-      const requiredSections = new Set(entry?.required ?? []);
       for (const sectionName of ["Testing", "Solution"]) {
-        if (!requiredSections.has(sectionName))
+        if (!requiredAtStatus.has(sectionName))
           continue;
         const body = doc2.getSection(sectionName);
         if (body === null || !isPlaceholderBody(body))
@@ -83503,7 +83873,7 @@ class HistoryService {
       ...opts.file !== undefined && opts.file.length > 0 ? { files: [opts.file] } : opts.root !== undefined && opts.root.length > 0 ? { roots: [opts.root] } : { roots: discovery?.roots ?? [] },
       dryRun
     });
-    if (!dryRun) {
+    if (!dryRun && result.importedRecords > 0) {
       for (const runRoot of discovery?.runRoots ?? []) {
         const sourceFilePrefix = runRoot.root.endsWith(sep) ? runRoot.root : `${runRoot.root}${sep}`;
         await dao2.observeImportedSessions({
@@ -86232,25 +86602,36 @@ function validateSchedulerCustomJobPayload(raw) {
 }
 async function handleSchedulerCustomJob(deps, job) {
   const payload = validateSchedulerCustomJobPayload(job.payload);
-  const result = await deps.executor.run({
-    command: "/bin/sh",
-    args: ["-c", payload.command],
-    cwd: deps.cwd,
-    timeout: deps.timeoutMs ?? SCHEDULER_CUSTOM_TIMEOUT_MS,
-    maxOutput: SCHEDULER_CUSTOM_MAX_OUTPUT,
-    forceBuffered: true,
-    rejectOnError: false
-  });
-  const detail = outputTail2(result.stderr) || outputTail2(result.stdout);
-  if (result.exitCode === null) {
-    const signalDetail = result.signal === undefined ? "" : ` (${result.signal})`;
-    throw new Error(`scheduler job "${payload.name}" terminated before a normal exit${signalDetail}${detail}`);
+  if (activeJobs.has(payload.name)) {
+    throw new Error(`scheduler job "${payload.name}" is already running in this process; skipping duplicate execution`);
   }
-  if (result.exitCode !== 0) {
-    throw new Error(`scheduler job "${payload.name}" exited ${result.exitCode}${detail}`);
+  activeJobs.add(payload.name);
+  try {
+    const result = await deps.executor.run({
+      command: "/bin/sh",
+      args: ["-c", payload.command],
+      cwd: deps.cwd,
+      timeout: deps.timeoutMs ?? SCHEDULER_CUSTOM_TIMEOUT_MS,
+      maxOutput: SCHEDULER_CUSTOM_MAX_OUTPUT,
+      forceBuffered: true,
+      rejectOnError: false
+    });
+    const detail = outputTail2(result.stderr) || outputTail2(result.stdout);
+    if (result.exitCode === null) {
+      const signalDetail = result.signal === undefined ? "" : ` (${result.signal})`;
+      throw new Error(`scheduler job "${payload.name}" terminated before a normal exit${signalDetail}${detail}`);
+    }
+    if (result.exitCode !== 0) {
+      throw new Error(`scheduler job "${payload.name}" exited ${result.exitCode}${detail}`);
+    }
+  } finally {
+    activeJobs.delete(payload.name);
   }
 }
-var SCHEDULER_CUSTOM_JOB = "scheduler.custom", SCHEDULER_CUSTOM_TIMEOUT_MS = 3600000, SCHEDULER_CUSTOM_MAX_OUTPUT = 1e6;
+var SCHEDULER_CUSTOM_JOB = "scheduler.custom", SCHEDULER_CUSTOM_TIMEOUT_MS = 3600000, SCHEDULER_CUSTOM_MAX_OUTPUT = 1e6, activeJobs;
+var init_scheduler_custom_job_service = __esm(() => {
+  activeJobs = new Set;
+});
 
 // ../../packages/app/src/services/supervisor-service.ts
 function defaultWrapperArgv(agentId) {
@@ -86716,6 +87097,248 @@ var init_system_event_follow = __esm(() => {
   init_src2();
 });
 
+// ../../packages/app/src/services/task-readiness.ts
+import { createHash as createHash8 } from "crypto";
+function readyRefineCommand(wbs) {
+  return `/sp:dev-refine ${wbs} --auto --depth ready`;
+}
+function readyRefineAllCommand(featureId2) {
+  return `/sp:dev-refineall --feature ${featureId2} --auto --depth ready`;
+}
+async function prepareCreatedTaskReady(opts) {
+  const { wbs, tasks, agents, checkTask } = opts;
+  const recoveryCommand = readyRefineCommand(wbs);
+  const before = await tasks.show(wbs).catch((err) => {
+    throw new TaskPreparationError({
+      stage: "post-check",
+      message: `saved task ${wbs} is unreadable before preparation: ${err instanceof Error ? err.message : String(err)}`,
+      wbs,
+      recoveryCommand
+    });
+  });
+  const flags = {
+    mode: "text",
+    timeout: String(opts.timeoutMs ?? DEFAULT_READY_PREPARE_TIMEOUT_MS)
+  };
+  if (opts.agentSelector !== undefined && opts.agentSelector !== "")
+    flags.agent = opts.agentSelector;
+  if (opts.cwd !== undefined && opts.cwd !== "")
+    flags.cwd = opts.cwd;
+  const traced = await agents.runTraced(readyRefineCommand(wbs), flags);
+  if (traced.exitCode === 2) {
+    throw new TaskPreparationError({
+      stage: "agent-dispatch",
+      message: `ready preparation could not dispatch an executor for ${wbs}: ${traced.message ?? "agent resolution failed"}`,
+      wbs,
+      filePath: before.filePath,
+      recoveryCommand
+    });
+  }
+  if (traced.exitCode !== 0) {
+    const why = traced.signal !== undefined ? `terminated by signal ${traced.signal}` : `executor exited ${traced.exitCode}`;
+    throw new TaskPreparationError({
+      stage: "agent-run",
+      message: `ready preparation failed for ${wbs}: ${why}. Partial section edits are preserved on the task.`,
+      wbs,
+      filePath: before.filePath,
+      recoveryCommand
+    });
+  }
+  const after = await tasks.show(wbs).catch((err) => {
+    throw new TaskPreparationError({
+      stage: "post-check",
+      message: `saved task ${wbs} is unreadable after preparation: ${err instanceof Error ? err.message : String(err)}`,
+      wbs,
+      filePath: before.filePath,
+      recoveryCommand
+    });
+  });
+  const check2 = await checkTask(after.filePath, wbs).catch((err) => {
+    throw new TaskPreparationError({
+      stage: "post-check",
+      message: `post-check for ${wbs} could not run: ${err instanceof Error ? err.message : String(err)}`,
+      wbs,
+      filePath: after.filePath,
+      recoveryCommand
+    });
+  });
+  if (!check2.pass) {
+    const summary = check2.findings.filter((f) => f.severity === "error").map((f) => `${f.layer}:${f.code} ${f.section !== undefined ? `(${f.section}) ` : ""}${f.message}`).slice(0, 5).join("; ");
+    throw new TaskPreparationError({
+      stage: "post-check",
+      message: `ready post-check failed for ${wbs}: ${summary || "check did not pass"}`,
+      wbs,
+      filePath: after.filePath,
+      findings: check2.findings,
+      recoveryCommand
+    });
+  }
+  if (after.status !== "todo") {
+    try {
+      await tasks.updateStatus(wbs, "todo", opts.actor ?? "ready-preparation");
+    } catch (err) {
+      throw new TaskPreparationError({
+        stage: "promotion",
+        message: `ready preparation could not promote ${wbs} to todo: ${err instanceof Error ? err.message : String(err)}`,
+        wbs,
+        filePath: after.filePath,
+        recoveryCommand
+      });
+    }
+  }
+  return READY_DONE;
+}
+function extractBatchArray(answer) {
+  const attempt = (text4) => {
+    try {
+      return JSON.parse(text4);
+    } catch {
+      return;
+    }
+  };
+  const direct = attempt(answer);
+  if (direct !== undefined)
+    return direct;
+  const start = answer.indexOf("[");
+  const end = answer.lastIndexOf("]");
+  if (start === -1 || end <= start) {
+    throw new TaskPreparationError({
+      stage: "invalid-output",
+      message: "prepared batch output carried no JSON array"
+    });
+  }
+  const sliced = attempt(answer.slice(start, end + 1));
+  if (sliced === undefined) {
+    throw new TaskPreparationError({
+      stage: "invalid-output",
+      message: "prepared batch output is not valid JSON"
+    });
+  }
+  return sliced;
+}
+async function prepareBatchTaskReady(opts) {
+  const { agents } = opts;
+  const flags = {
+    mode: "text",
+    timeout: String(opts.timeoutMs ?? DEFAULT_READY_PREPARE_TIMEOUT_MS)
+  };
+  if (opts.agentSelector !== undefined && opts.agentSelector !== "")
+    flags.agent = opts.agentSelector;
+  if (opts.cwd !== undefined && opts.cwd !== "")
+    flags.cwd = opts.cwd;
+  let recoveryCommand;
+  try {
+    const supplied = JSON.parse(opts.batchSource);
+    if (Array.isArray(supplied)) {
+      for (const item of supplied) {
+        if (typeof item === "object" && item !== null && "feature_id" in item) {
+          const featureId2 = item.feature_id;
+          if (typeof featureId2 === "string" && featureId2 !== "") {
+            recoveryCommand = readyRefineAllCommand(featureId2);
+            break;
+          }
+        }
+      }
+    }
+  } catch {}
+  const prompt = "Prepare this task batch to the ready checklist (requirements, design, plan, ac, decisions, dependencies, " + "premises). Read the batch file, assess and synthesize every candidate item in input order, preserving " + "names, feature_id, parent_wbs and authored constraints, and fill Requirements, Design, Plan and Acceptance " + "Criteria substantively (never placeholders). Never author Solution, Testing or Review sections. " + `Print ONLY the prepared JSON array \u2014 no prose, no code fence.
+` + `Batch file: ${opts.batchPath}
+` + `Batch contents:
+${opts.batchSource}`;
+  const captured = await agents.runCapture(prompt, flags);
+  if (captured.exitCode === 2) {
+    throw new TaskPreparationError({
+      stage: "agent-dispatch",
+      message: `batch preparation could not dispatch an executor: ${captured.stderr || "agent resolution failed"}`,
+      recoveryCommand
+    });
+  }
+  if (captured.exitCode !== 0) {
+    const why = captured.signal !== undefined ? `terminated by signal ${captured.signal}` : `executor exited ${captured.exitCode}`;
+    throw new TaskPreparationError({
+      stage: "agent-run",
+      message: `batch preparation failed: ${why}`,
+      recoveryCommand
+    });
+  }
+  const parsed = extractBatchArray(captured.answer);
+  const validated = taskBatchSchema.safeParse(parsed);
+  if (!validated.success) {
+    const issues = validated.error.issues.map((i2) => `  [${i2.path.join(".")}] ${i2.message}`).join(`
+`);
+    throw new TaskPreparationError({
+      stage: "validation",
+      message: `prepared batch failed schema validation:
+${issues}`,
+      recoveryCommand
+    });
+  }
+  return { items: validated.data };
+}
+function computePlanningDigest(raw) {
+  const doc2 = MarkdownDocument.parse(raw, "task");
+  const fm = doc2.frontmatterData ?? {};
+  const payload = {
+    sections: PLANNING_DIGEST_SECTIONS.map((name) => {
+      const body = doc2.getSection(name);
+      return { name, body: body === null ? null : body.trim() };
+    }),
+    featureId: typeof fm.feature_id === "string" ? fm.feature_id : null,
+    template: typeof fm.template === "string" ? fm.template : null,
+    dependencies: Array.isArray(fm.dependencies) ? [...fm.dependencies].map(String).sort() : null
+  };
+  return createHash8("sha256").update(JSON.stringify(payload)).digest("hex");
+}
+function verifyReadyChecks(checks4) {
+  if (checks4 === undefined || checks4.length === 0) {
+    return { ok: false, reason: "no ready-checklist evidence" };
+  }
+  for (const id of READY_CHECKLIST_IDS) {
+    const row = checks4.find((c3) => c3.id === id);
+    if (row === undefined)
+      return { ok: false, reason: `checklist row "${id}" missing` };
+    if (row.pass !== true)
+      return { ok: false, reason: `checklist row "${id}" not passing` };
+    if (typeof row.evidence !== "string" || row.evidence.trim() === "") {
+      return { ok: false, reason: `checklist row "${id}" has empty evidence` };
+    }
+  }
+  return { ok: true };
+}
+var READY_CHECKLIST_IDS, DEFAULT_READY_PREPARE_TIMEOUT_MS = 900000, TaskPreparationError, READY_SKIPPED, READY_DONE, EXECUTION_OWNED_SECTIONS, PLANNING_DIGEST_SECTIONS;
+var init_task_readiness = __esm(() => {
+  init_src2();
+  READY_CHECKLIST_IDS = [
+    "requirements",
+    "design",
+    "plan",
+    "ac",
+    "decisions",
+    "dependencies",
+    "premises"
+  ];
+  TaskPreparationError = class TaskPreparationError extends Error {
+    stage;
+    wbs;
+    filePath;
+    findings;
+    recoveryCommand;
+    constructor(init) {
+      super(init.message);
+      this.name = "TaskPreparationError";
+      this.stage = init.stage;
+      this.wbs = init.wbs;
+      this.filePath = init.filePath;
+      this.findings = init.findings;
+      this.recoveryCommand = init.recoveryCommand;
+    }
+  };
+  READY_SKIPPED = { readiness: { status: "skipped", depth: "ready" } };
+  READY_DONE = { readiness: { status: "ready", depth: "ready" } };
+  EXECUTION_OWNED_SECTIONS = { Solution: true, Testing: true, Review: true, History: true };
+  PLANNING_DIGEST_SECTIONS = TASK_CANONICAL_SECTIONS.filter((s3) => !(s3 in EXECUTION_OWNED_SECTIONS));
+});
+
 // ../../packages/app/src/services/task-scaffold.ts
 import { dirname as dirname13 } from "path";
 
@@ -86934,14 +87557,99 @@ class TaskService {
     }
     return null;
   }
+  async resolveCandidateShape(input) {
+    const variant = input.template ?? (input.featureId !== undefined ? "feature-impl" : DEFAULT_TASK_VARIANT);
+    let background = input.background ?? "";
+    if (background === "" && input.featureId !== undefined) {
+      background = await this.deriveBackground(input.featureId);
+    }
+    const taskBodies = {};
+    if (background !== "")
+      taskBodies.Background = background;
+    if ((input.requirements ?? "").trim() !== "") {
+      taskBodies.Requirements = bulletizeRequirements(input.requirements ?? "");
+    }
+    if ((input.design ?? "").trim() !== "") {
+      taskBodies.Design = (input.design ?? "").trim();
+    }
+    if ((input.plan ?? "").trim() !== "") {
+      taskBodies.Plan = (input.plan ?? "").trim();
+    }
+    if ((input.acceptanceCriteria ?? "").trim() !== "") {
+      taskBodies["Acceptance Criteria"] = normalizeAcFence((input.acceptanceCriteria ?? "").trim());
+    }
+    if (taskBodies.Background === undefined) {
+      taskBodies.Background = `Captured from the creation title: "${input.title}".`;
+    }
+    const templateBackground = this.ctx.resolveTemplateBodies?.(variant).Background;
+    if (input.background === undefined && input.featureId === undefined && templateBackground !== undefined && templateBackground.trim() !== "") {
+      taskBodies.Background = `${taskBodies.Background}
+
+${templateBackground}`;
+    }
+    const now2 = new Date().toISOString();
+    const fmFor = (status2) => ({
+      schema_version: 1,
+      name: input.title,
+      status: status2,
+      template: variant,
+      created_at: now2,
+      updated_at: now2,
+      ...input.featureId !== undefined ? { feature_id: input.featureId } : {},
+      ...input.parentWbs !== undefined ? { parent_wbs: input.parentWbs } : {},
+      ...input.priority !== undefined ? { priority: input.priority } : {},
+      ...input.tags !== undefined && input.tags.length > 0 ? { tags: input.tags } : {}
+    });
+    let status;
+    if (input.explicitStatus !== undefined) {
+      status = input.explicitStatus;
+    } else {
+      const probe = buildTaskSkeleton({
+        wbs: CANDIDATE_PROBE_WBS,
+        title: input.title,
+        frontmatter: serializeTaskFrontmatter(fmFor("todo")),
+        sections: this.sectionsForStatus(variant, "todo"),
+        bodies: this.bodiesFor(variant, taskBodies)
+      });
+      const probeFindings = this.checkCandidateContent(probe, CANDIDATE_PROBE_WBS, "todo");
+      status = probeFindings.some((f) => f.severity === "error") ? "backlog" : "todo";
+    }
+    return { variant, status, fm: fmFor(status), taskBodies };
+  }
+  checkCandidateContent(raw, wbs, asStatus) {
+    const matrix = this.ctx.sectionMatrix;
+    if (matrix === undefined) {
+      throw new Error(`no section-matrix available for candidate validation (status=${asStatus}); ` + "a canonical section-matrix.yaml is required for task creation (F92 R1)");
+    }
+    const checker = new TaskCheckService(this.ctx.fs, matrix);
+    return checker.checkContentPolicy(raw, wbs, { asStatus }).findings;
+  }
+  renderCandidate(title, wbs, shape) {
+    return buildTaskSkeleton({
+      wbs,
+      title,
+      frontmatter: serializeTaskFrontmatter(shape.fm),
+      sections: this.sectionsForStatus(shape.variant, shape.status),
+      bodies: this.bodiesFor(shape.variant, shape.taskBodies)
+    });
+  }
+  validateCandidateOrThrow(title, shape) {
+    const probe = this.renderCandidate(title, CANDIDATE_PROBE_WBS, shape);
+    const findings = this.checkCandidateContent(probe, CANDIDATE_PROBE_WBS, shape.status);
+    if (findings.some((f) => f.severity === "error")) {
+      throw new TaskCandidateInvalidError(title, findings);
+    }
+  }
   async create(params) {
     const folder = this.ctx.tasksDir;
-    let background = "";
-    if (params.featureId !== undefined) {
-      background = await this.deriveBackground(params.featureId);
-    }
-    const variant = params.template ?? (params.featureId !== undefined ? "feature-impl" : DEFAULT_TASK_VARIANT);
-    const status = params.status ?? (params.featureId !== undefined ? "todo" : "backlog");
+    const shape = await this.resolveCandidateShape({
+      title: params.title,
+      featureId: params.featureId,
+      parentWbs: params.parentWbs,
+      template: params.template,
+      explicitStatus: params.status
+    });
+    this.validateCandidateOrThrow(params.title, shape);
     return this.writeService.createAllocated(folder, async () => {
       const dedupeWithinSec = params.dedupeWithinSec === null ? undefined : params.dedupeWithinSec ?? 300;
       if (dedupeWithinSec !== undefined) {
@@ -86952,25 +87660,7 @@ class TaskService {
       }
       const slug = this.slugify(params.title);
       const { wbs, filePath } = await this.allocateWbsChecked(slug);
-      const now2 = new Date().toISOString();
-      const frontmatter = [
-        "schema_version: 1",
-        `name: "${params.title}"`,
-        `status: ${status}`,
-        `template: ${variant}`,
-        `created_at: ${now2}`,
-        `updated_at: ${now2}`,
-        params.featureId !== undefined ? `feature_id: ${params.featureId}` : null,
-        params.parentWbs !== undefined ? `parent_wbs: "${params.parentWbs}"` : null
-      ].filter(Boolean).join(`
-`);
-      const content = buildTaskSkeleton({
-        wbs,
-        title: params.title,
-        frontmatter,
-        sections: this.sectionsForStatus(variant, status),
-        bodies: this.bodiesFor(variant, background !== "" ? { Background: background } : {})
-      });
+      const content = this.renderCandidate(params.title, wbs, shape);
       const ref = { kind: "task", id: wbs, filePath, folder };
       return { ref, content };
     });
@@ -87389,11 +88079,37 @@ class TaskService {
 ${issues}`);
     }
     const items = result.data;
+    const prepared = [];
+    for (const [index2, item] of items.entries()) {
+      const shape = await this.resolveCandidateShape({
+        title: item.name,
+        featureId: item.feature_id ?? undefined,
+        parentWbs: item.parent_wbs ?? undefined,
+        template: item.template,
+        explicitStatus: undefined,
+        background: item.background,
+        requirements: item.requirements,
+        design: item.design,
+        plan: item.plan,
+        acceptanceCriteria: item.acceptance_criteria,
+        priority: item.priority,
+        tags: item.tags
+      });
+      try {
+        this.validateCandidateOrThrow(item.name, shape);
+      } catch (err) {
+        if (err instanceof TaskCandidateInvalidError) {
+          throw new TaskCandidateInvalidError(item.name, err.findings, `batch item ${index2 + 1}/${items.length}`);
+        }
+        throw err;
+      }
+      prepared.push({ item, shape });
+    }
     const writeResults = [];
     const createdRefs = [];
     try {
-      for (const item of items) {
-        const wr = await this.createBatchItem(item);
+      for (const { item, shape } of prepared) {
+        const wr = await this.createBatchItem(item, shape);
         writeResults.push(wr);
         createdRefs.push(wr.ref);
       }
@@ -87449,54 +88165,12 @@ ${issues}`);
     }
     return out;
   }
-  async createBatchItem(item) {
+  async createBatchItem(item, shape) {
     const folder = this.ctx.tasksDir;
-    let background = item.background ?? "";
-    if (!background && item.feature_id !== undefined && item.feature_id !== null) {
-      background = await this.deriveBackground(item.feature_id);
-    }
-    const hasSpec = background !== "" || (item.requirements ?? "").trim() !== "" || (item.design ?? "").trim() !== "" || (item.plan ?? "").trim() !== "" || (item.acceptance_criteria ?? "").trim() !== "";
-    const status = hasSpec ? "todo" : "backlog";
-    const variant = item.template ?? (item.feature_id !== undefined && item.feature_id !== null ? "feature-impl" : DEFAULT_TASK_VARIANT);
     return this.writeService.createAllocated(folder, async () => {
       const slug = this.slugify(item.name);
       const { wbs, filePath } = await this.allocateWbsChecked(slug);
-      const now2 = new Date().toISOString();
-      const fmLines = [
-        "schema_version: 1",
-        `name: "${item.name}"`,
-        `status: ${status}`,
-        `template: ${variant}`,
-        `created_at: ${now2}`,
-        `updated_at: ${now2}`,
-        item.feature_id !== undefined ? `feature_id: ${item.feature_id}` : null,
-        item.parent_wbs !== undefined ? `parent_wbs: "${item.parent_wbs}"` : null,
-        item.priority !== undefined ? `priority: ${item.priority}` : null,
-        item.tags !== undefined && item.tags.length > 0 ? `tags: [${item.tags.map((t) => `"${t}"`).join(", ")}]` : null
-      ].filter(Boolean).join(`
-`);
-      const taskBodies = {};
-      if (background !== "")
-        taskBodies.Background = background;
-      if ((item.requirements ?? "").trim() !== "") {
-        taskBodies.Requirements = bulletizeRequirements(item.requirements ?? "");
-      }
-      if ((item.design ?? "").trim() !== "") {
-        taskBodies.Design = (item.design ?? "").trim();
-      }
-      if ((item.plan ?? "").trim() !== "") {
-        taskBodies.Plan = (item.plan ?? "").trim();
-      }
-      if ((item.acceptance_criteria ?? "").trim() !== "") {
-        taskBodies["Acceptance Criteria"] = normalizeAcFence((item.acceptance_criteria ?? "").trim());
-      }
-      const content = buildTaskSkeleton({
-        wbs,
-        title: item.name,
-        frontmatter: fmLines,
-        sections: this.sectionsForStatus(variant, status),
-        bodies: this.bodiesFor(variant, taskBodies)
-      });
+      const content = this.renderCandidate(item.name, wbs, shape);
       const ref = { kind: "task", id: wbs, filePath, folder };
       return { ref, content };
     });
@@ -87688,7 +88362,7 @@ ${block}` : block);
     return title.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 60);
   }
 }
-var DependencyMutationError, SectionMutationError, DuplicateFollowUpError, WbsCollisionError, ROSTER_START = "<!-- AUTO-GENERATED by spur task refresh-roster -->", ROSTER_END = "<!-- END AUTO-GENERATED -->", ROSTER_REGION_RE, TASK_ACTION_COMMANDS;
+var DependencyMutationError, SectionMutationError, DuplicateFollowUpError, WbsCollisionError, TaskCandidateInvalidError, CANDIDATE_PROBE_WBS = "0000", ROSTER_START = "<!-- AUTO-GENERATED by spur task refresh-roster -->", ROSTER_END = "<!-- END AUTO-GENERATED -->", ROSTER_REGION_RE, TASK_ACTION_COMMANDS;
 var init_task_service = __esm(() => {
   init_src2();
   init_errors7();
@@ -87737,6 +88411,16 @@ var init_task_service = __esm(() => {
       this.attemptedPath = attemptedPath;
     }
   };
+  TaskCandidateInvalidError = class TaskCandidateInvalidError extends Error {
+    findings;
+    constructor(title, findings, context4) {
+      const where = context4 !== undefined ? ` (${context4})` : "";
+      const detail = findings.filter((f) => f.severity === "error").map((f) => `${f.layer}${f.section !== "" ? `/${f.section}` : ""}: ${f.message}`).join("; ");
+      super(`candidate task "${title}"${where} rejected before persistence \u2014 it would fail \`spur task check\`: ${detail}`);
+      this.name = "TaskCandidateInvalidError";
+      this.findings = findings;
+    }
+  };
   ROSTER_REGION_RE = /<!--[ \t]*AUTO-GENERATED[^>]*-->[\s\S]*?<!--[ \t]*END[ \t]*AUTO-GENERATED[^>]*-->/g;
   TASK_ACTION_COMMANDS = {
     refine: (wbs) => `/sp:dev-refine ${wbs} --auto`,
@@ -89959,8 +90643,93 @@ var init_child_env = __esm(() => {
   SHIM_INTERNAL_ENV = /^PROTO_(SHIM|INTERNAL)_/;
 });
 
+// ../../packages/app/src/workflow/actions/run-path.ts
+import { dirname as dirname16, join as join22, normalize, relative as relative5, resolve as resolve9, sep as sep2 } from "path";
+function within(child, ancestor) {
+  return child === ancestor || child.startsWith(`${ancestor}${sep2}`);
+}
+async function resolveRunArtifactPath(fileSystem, workdir, pathRaw) {
+  if (typeof fileSystem.realPath !== "function") {
+    throw new RunArtifactPathError("physical path confinement requires a FileSystem with realPath support \u2014 refusing to skip confinement (0785 R2)");
+  }
+  const lexicalTarget = normalize(resolve9(workdir, pathRaw));
+  const lexicalRunRoot = normalize(join22(resolve9(workdir), ".spur", "run"));
+  if (!lexicalTarget.startsWith(`${lexicalRunRoot}${sep2}`)) {
+    throw new RunArtifactPathError(`must resolve beneath .spur/run/ (got ${pathRaw})`);
+  }
+  const workdirAbs = resolve9(workdir);
+  let canonicalWorkdir;
+  try {
+    canonicalWorkdir = fileSystem.realPath(workdirAbs);
+  } catch (error51) {
+    throw new RunArtifactPathError(`project workdir could not be canonicalized: ${error51.message}`);
+  }
+  const canonicalRunRootCandidate = join22(canonicalWorkdir, ".spur", "run");
+  let canonicalRunRoot = canonicalRunRootCandidate;
+  const rootStat = await fileSystem.stat(canonicalRunRootCandidate);
+  if (rootStat !== null) {
+    try {
+      canonicalRunRoot = fileSystem.realPath(canonicalRunRootCandidate);
+    } catch (error51) {
+      throw new RunArtifactPathError(`.spur/run could not be canonicalized: ${error51.message}`);
+    }
+    if (!within(canonicalRunRoot, canonicalWorkdir)) {
+      throw new RunArtifactPathError(".spur/run resolves outside the project workdir through a symlink");
+    }
+  }
+  let probe = lexicalTarget;
+  for (;; ) {
+    const stat = await fileSystem.stat(probe);
+    if (stat !== null)
+      break;
+    const parent = dirname16(probe);
+    let listed;
+    try {
+      listed = await fileSystem.readDir(parent);
+    } catch (error51) {
+      if (String(error51.message).includes("ENOENT")) {
+        listed = null;
+      } else {
+        throw new RunArtifactPathError(`ancestor ${parent} is unreadable: ${error51.message}`);
+      }
+    }
+    const base2 = probe.slice(parent.length + 1);
+    if (listed?.includes(base2)) {
+      throw new RunArtifactPathError(`dangling symlink at ${probe} \u2014 refusing artifact path`);
+    }
+    const parentNorm = normalize(parent);
+    if (parentNorm === probe) {
+      throw new RunArtifactPathError(`no existing ancestor found for ${pathRaw}`);
+    }
+    probe = parentNorm;
+  }
+  let anchor;
+  try {
+    anchor = fileSystem.realPath(probe);
+  } catch (error51) {
+    throw new RunArtifactPathError(`ancestor ${probe} could not be canonicalized: ${error51.message}`);
+  }
+  if (!within(anchor, canonicalWorkdir)) {
+    throw new RunArtifactPathError(`ancestor ${probe} escapes the project workdir through a symlink`);
+  }
+  const reconstructed = normalize(join22(anchor, relative5(probe, lexicalTarget)));
+  if (!reconstructed.startsWith(`${canonicalRunRoot}${sep2}`)) {
+    throw new RunArtifactPathError(`path escapes .spur/run/ through a symlink (got ${pathRaw})`);
+  }
+  return reconstructed;
+}
+var RunArtifactPathError;
+var init_run_path = __esm(() => {
+  RunArtifactPathError = class RunArtifactPathError extends Error {
+    constructor(message) {
+      super(message);
+      this.name = "RunArtifactPathError";
+    }
+  };
+});
+
 // ../../packages/app/src/workflow/actions/command-gate.ts
-import { normalize, resolve as resolve9 } from "path";
+import { join as join23, normalize as normalize2 } from "path";
 function sleep3(ms) {
   return new Promise((resolve10) => setTimeout(resolve10, ms));
 }
@@ -90012,13 +90781,13 @@ class CommandGateActionRunner {
       };
     }
     const workdir = context4.workdir ?? process.cwd();
-    const allowedDir = resolve9(workdir, ".spur", "run");
-    const resolvedResultFile = resolve9(workdir, resultFileRaw);
-    const normalized = normalize(resolvedResultFile);
-    if (!normalized.startsWith(allowedDir)) {
+    let normalized;
+    try {
+      normalized = await resolveRunArtifactPath(this.fileSystem, workdir, resultFileRaw);
+    } catch (error51) {
       return {
         ok: false,
-        error: `resultFile must resolve beneath .spur/run/ (got ${resultFileRaw})`
+        error: `resultFile ${error51.message}`
       };
     }
     const split = splitLaunchCommand(executable, 'command.gate "executable"');
@@ -90032,7 +90801,7 @@ class CommandGateActionRunner {
     const retryOn = Array.isArray(retry.on) ? retry.on : [];
     const timeoutMs = typeof options.timeoutMs === "number" ? options.timeoutMs : undefined;
     const env = childProcessEnv(context4.vars);
-    await this.fileSystem.ensureDir(allowedDir);
+    await this.fileSystem.ensureDir(normalize2(join23(normalized, "..")));
     let lastStdout = "";
     let lastStderr = "";
     let lastExitCode = -1;
@@ -90102,10 +90871,11 @@ var init_command_gate = __esm(() => {
   init_dist5();
   init_split_launch_command();
   init_child_env();
+  init_run_path();
 });
 
 // ../../packages/app/src/workflow/actions/doctor-probe.ts
-import { normalize as normalize2, resolve as resolve10, sep as sep2 } from "path";
+import { normalize as normalize3, resolve as resolve10, sep as sep3 } from "path";
 function stringOption2(options, key2, fallback) {
   const value = options[key2];
   if (typeof value === "string")
@@ -90155,8 +90925,8 @@ class DoctorProbeActionRunner {
     const resolvedAgentVar = stringOption2(options, "resolvedAgentVar", "");
     const workdir = context4.workdir ?? process.cwd();
     const allowedDir = resolve10(workdir, ".spur", "run");
-    const normalized = normalize2(resolve10(workdir, resultFileRaw));
-    const withinAllowed = normalized === allowedDir || normalized.startsWith(allowedDir + sep2);
+    const normalized = normalize3(resolve10(workdir, resultFileRaw));
+    const withinAllowed = normalized === allowedDir || normalized.startsWith(allowedDir + sep3);
     if (!withinAllowed) {
       return {
         ok: false,
@@ -90753,11 +91523,59 @@ var init_composition_baseline = () => {};
 // ../../packages/app/src/workflow/proof-input-fingerprint.ts
 import crypto4 from "crypto";
 import { tmpdir as tmpdir2 } from "os";
-import { dirname as dirname16, join as join22 } from "path";
+import { dirname as dirname17, join as join24, resolve as resolve11, sep as sep4 } from "path";
+async function readProofInputContents(fileSystem, workdir, options) {
+  for (const name of ["taskFile", "featureFile"]) {
+    const value = options[name];
+    if (value !== undefined && typeof value !== "string") {
+      return { ok: false, error: `${name} must be a string when supplied (got ${typeof value})` };
+    }
+  }
+  const readOne = async (name) => {
+    const raw = name === "taskFile" ? options.taskFile : options.featureFile;
+    if (raw === undefined || raw === "")
+      return {};
+    const workdirAbs = resolve11(workdir);
+    const resolved = resolve11(workdirAbs, raw);
+    if (!(resolved === workdirAbs || resolved.startsWith(`${workdirAbs}${sep4}`))) {
+      return { error: `${name} must resolve under the workflow workdir (${workdirAbs}): ${raw}` };
+    }
+    let stat;
+    try {
+      stat = await fileSystem.stat(resolved);
+    } catch (error51) {
+      return { error: `${name} could not be inspected: ${error51.message}` };
+    }
+    if (stat === null) {
+      return {
+        error: `${name} does not exist: ${raw} (resolved ${resolved}) \u2014 an explicitly supplied spec must be readable, not silently omitted`
+      };
+    }
+    if (!stat.isFile()) {
+      return { error: `${name} is not a regular file: ${resolved}` };
+    }
+    try {
+      return { content: await fileSystem.readFile(resolved) };
+    } catch (error51) {
+      return { error: `${name} is not readable: ${error51.message}` };
+    }
+  };
+  const task = await readOne("taskFile");
+  if (task.error !== undefined)
+    return { ok: false, error: task.error };
+  const feature = await readOne("featureFile");
+  if (feature.error !== undefined)
+    return { ok: false, error: feature.error };
+  return {
+    ok: true,
+    ...task.content !== undefined ? { taskContent: task.content } : {},
+    ...feature.content !== undefined ? { featureContent: feature.content } : {}
+  };
+}
 async function createGitAlternateTree(cwd, excludeGlobs = DEFAULT_EXCLUDE_GLOBS, executor = new NodeProcessExecutor3, fs3 = createNodeFileSystem3()) {
-  const indexFile = join22(tmpdir2(), `spur-proof-fingerprint-${crypto4.randomUUID()}.index`);
+  const indexFile = join24(tmpdir2(), `spur-proof-fingerprint-${crypto4.randomUUID()}.index`);
   try {
-    await fs3.ensureDir(dirname16(indexFile));
+    await fs3.ensureDir(dirname17(indexFile));
     const env = Object.fromEntries(Object.entries(process.env).filter((entry) => entry[1] !== undefined));
     env.GIT_INDEX_FILE = indexFile;
     const common4 = { cwd, env, forceBuffered: true, rejectOnError: false };
@@ -90874,15 +91692,6 @@ var init_proof_input_fingerprint = __esm(() => {
 });
 
 // ../../packages/app/src/workflow/actions/proof-fingerprint.ts
-async function readOptional(fileSystem, path9) {
-  if (path9 === undefined || path9 === "")
-    return;
-  const stat = await fileSystem.stat(path9);
-  if (stat === null)
-    return;
-  return await fileSystem.readFile(path9);
-}
-
 class ProofFingerprintActionRunner {
   fileSystem;
   processExecutor;
@@ -90901,14 +91710,16 @@ class ProofFingerprintActionRunner {
     if (!VAR_NAME_RE.test(varName)) {
       return { ok: false, error: `${KIND11}: var name must match ${VAR_NAME_RE}, got "${varName}"` };
     }
-    const taskContent = await readOptional(this.fileSystem, options.taskFile);
-    const featureContent = await readOptional(this.fileSystem, options.featureFile);
+    const inputs = await readProofInputContents(this.fileSystem, context4.workdir ?? ".", options);
+    if (!inputs.ok) {
+      return { ok: false, error: `${KIND11}: ${inputs.error}` };
+    }
     let digest;
     try {
       digest = await computeProofInputFingerprint({
         cwd: context4.workdir ?? ".",
-        ...taskContent !== undefined ? { taskContent } : {},
-        ...featureContent !== undefined ? { featureContent } : {},
+        ...inputs.taskContent !== undefined ? { taskContent: inputs.taskContent } : {},
+        ...inputs.featureContent !== undefined ? { featureContent: inputs.featureContent } : {},
         ...this.processExecutor !== undefined ? { processExecutor: this.processExecutor } : {},
         fileSystem: this.fileSystem
       });
@@ -91055,17 +91866,19 @@ var init_rule_check = __esm(() => {
 });
 
 // ../../packages/app/src/workflow/actions/run-artifact.ts
-import { normalize as normalize3, resolve as resolve11 } from "path";
+import { join as join25, resolve as resolve12 } from "path";
 
 class RunArtifactActionRunner {
   getDb;
   fileSystem;
   artifactDao;
+  processExecutor;
   kind = KIND14;
-  constructor(getDb, fileSystem = createNodeFileSystem3(), artifactDao) {
+  constructor(getDb, fileSystem = createNodeFileSystem3(), artifactDao, processExecutor) {
     this.getDb = getDb;
     this.fileSystem = fileSystem;
     this.artifactDao = artifactDao;
+    this.processExecutor = processExecutor;
   }
   async execute(options, context4) {
     const pathRaw = options.path;
@@ -91082,39 +91895,36 @@ class RunArtifactActionRunner {
         error: 'Action option "artifactKind" must be a non-empty string'
       };
     }
-    const workdir = context4.workdir ?? process.cwd();
-    const allowedDir = resolve11(workdir, ".spur", "run");
-    const resolvedPath = resolve11(workdir, pathRaw);
-    const normalized = normalize3(resolvedPath);
-    if (!normalized.startsWith(allowedDir)) {
+    const proofBinding = options.proofBinding;
+    if (proofBinding !== undefined && proofBinding !== "current") {
       return {
         ok: false,
-        error: `path must resolve beneath .spur/run/ (got ${pathRaw})`
+        error: `${KIND14}: unsupported proofBinding "${String(proofBinding)}" - only "current" is defined (ADR-071)`
       };
     }
+    const workdir = context4.workdir ?? process.cwd();
+    if (proofBinding === "current") {
+      return await this.executeBound(pathRaw, artifactKind, options, context4, workdir);
+    }
+    let normalized;
+    try {
+      normalized = await resolveRunArtifactPath(this.fileSystem, workdir, pathRaw);
+    } catch (error51) {
+      return { ok: false, error: `path ${error51.message}` };
+    }
     const requireExisting = options.requireExisting !== false;
     if (requireExisting) {
-      const exists2 = await this.fileSystem.exists(normalized);
-      if (!exists2) {
+      const stat = await this.fileSystem.stat(normalized);
+      if (stat === null) {
         return {
           ok: false,
           error: `run.artifact required file does not exist: ${pathRaw} (${normalized})`
         };
       }
-    }
-    const proofBinding = options.proofBinding;
-    if (proofBinding !== undefined) {
-      if (proofBinding !== "current") {
-        return {
-          ok: false,
-          error: `${KIND14}: unsupported proofBinding "${String(proofBinding)}" - only "current" is defined (ADR-071)`
-        };
-      }
-      const digest = context4.vars.proofDigestNow ?? context4.vars.proofDigest;
-      if (typeof digest !== "string" || !PROOF_DIGEST_RE.test(digest)) {
+      if (!stat.isFile()) {
         return {
           ok: false,
-          error: `${KIND14}: proofBinding "current" does not hold - the run has no current proof input ` + `digest (vars.proofDigestNow/proofDigest missing or malformed), so the artifact cannot be ` + `bound to a proof that was never captured; capture one with proof.fingerprint first`
+          error: `run.artifact required file is not a regular file: ${pathRaw} (${normalized})`
         };
       }
     }
@@ -91138,9 +91948,232 @@ class RunArtifactActionRunner {
         id: recordId,
         path: normalized,
         kind: artifactKind,
-        runId: context4.runId,
-        ...options.proofBinding !== undefined ? { proofBinding: options.proofBinding } : {}
+        runId: context4.runId
+      }
+    };
+  }
+  async executeBound(pathRaw, artifactKind, options, context4, workdir) {
+    if (artifactKind !== "verify-verdict") {
+      return {
+        ok: false,
+        error: `${KIND14}: proofBinding "current" is only supported for the verify-verdict artifact kind (got "${artifactKind}")`
+      };
+    }
+    if (!this.getDb) {
+      return {
+        ok: false,
+        error: `${KIND14}: proofBinding "current" requires the composed database context (RunDao run identity) \u2014 refusing an unverifiable binding`
+      };
+    }
+    if (typeof options.taskFile !== "string" || options.taskFile.trim() === "") {
+      return {
+        ok: false,
+        error: `${KIND14}: proofBinding "current" requires a non-empty "taskFile" option \u2014 the fresh digest must cover the canonical task spec`
+      };
+    }
+    const inputs = await readProofInputContents(this.fileSystem, workdir, options);
+    if (!inputs.ok) {
+      return { ok: false, error: `${KIND14}: ${inputs.error}` };
+    }
+    let digest;
+    try {
+      digest = await computeProofInputFingerprint({
+        cwd: workdir,
+        ...inputs.taskContent !== undefined ? { taskContent: inputs.taskContent } : {},
+        ...inputs.featureContent !== undefined ? { featureContent: inputs.featureContent } : {},
+        ...this.processExecutor !== undefined ? { processExecutor: this.processExecutor } : {},
+        fileSystem: this.fileSystem
+      });
+    } catch (error51) {
+      return { ok: false, error: `${KIND14}: fresh proof capture failed: ${error51.message}` };
+    }
+    const varDigest = context4.vars.proofDigestNow ?? context4.vars.proofDigest;
+    if (typeof varDigest !== "string" || !PROOF_DIGEST_RE.test(varDigest)) {
+      return {
+        ok: false,
+        error: `${KIND14}: proofBinding "current" does not hold - the run has no current proof input ` + `digest (vars.proofDigestNow/proofDigest missing or malformed), so the artifact cannot be ` + `bound to a proof that was never captured; capture one with proof.fingerprint first`
+      };
+    }
+    if (varDigest !== digest) {
+      return {
+        ok: false,
+        error: `${KIND14}: the run's declared proof digest (${varDigest}) does not match the freshly ` + `captured digest (${digest}) \u2014 a stale or forged var cannot bless artifact content (0785 R3)`
+      };
+    }
+    let normalized;
+    try {
+      normalized = await resolveRunArtifactPath(this.fileSystem, workdir, pathRaw);
+    } catch (error51) {
+      return { ok: false, error: `path ${error51.message}` };
+    }
+    const requireExisting = options.requireExisting !== false;
+    if (requireExisting) {
+      const stat = await this.fileSystem.stat(normalized);
+      if (stat === null) {
+        return {
+          ok: false,
+          error: `run.artifact required file does not exist: ${pathRaw} (${normalized})`
+        };
+      }
+      if (!stat.isFile()) {
+        return {
+          ok: false,
+          error: `run.artifact required file is not a regular file: ${pathRaw} (${normalized})`
+        };
+      }
+    }
+    let raw;
+    try {
+      raw = await this.fileSystem.readFile(normalized);
+    } catch (error51) {
+      return { ok: false, error: `${KIND14}: verdict artifact unreadable: ${error51.message}` };
+    }
+    const taskWbs = String(context4.vars.wbs ?? "");
+    const outcome = parseVerifyVerdict(raw, taskWbs);
+    if (outcome.kind !== "valid") {
+      const detail = outcome.kind === "invalid" && outcome.reason !== undefined ? `: ${outcome.reason}` : "";
+      return {
+        ok: false,
+        error: `${KIND14}: verdict artifact is ${outcome.kind}${detail} \u2014 refusing to bind (0785 R3)`
+      };
+    }
+    const verdict = outcome.verdict;
+    if (verdict.wbs !== taskWbs) {
+      return {
+        ok: false,
+        error: `${KIND14}: verdict artifact names wbs "${verdict.wbs}" but the run carries task "${taskWbs}"`
+      };
+    }
+    if (verdict.verdict !== "PASS") {
+      return {
+        ok: false,
+        error: `${KIND14}: verdict aggregate is ${verdict.verdict}, not PASS \u2014 refusing to bind`
+      };
+    }
+    let root;
+    try {
+      root = JSON.parse(raw);
+    } catch {
+      return { ok: false, error: `${KIND14}: verdict artifact is malformed JSON` };
+    }
+    const proof = root.proof;
+    if (proof === null || typeof proof !== "object" || Array.isArray(proof)) {
+      return {
+        ok: false,
+        error: `${KIND14}: verdict artifact carries no raw proof block \u2014 binding refused (0785 R3)`
+      };
+    }
+    const p = proof;
+    const stageOf = (name) => {
+      const stages = p.stages;
+      if (stages === null || typeof stages !== "object" || Array.isArray(stages))
+        return null;
+      const s3 = stages[name];
+      return s3 !== null && typeof s3 === "object" && !Array.isArray(s3) ? s3 : null;
+    };
+    if (p.digest !== digest) {
+      return {
+        ok: false,
+        error: `${KIND14}: proof.digest ${String(p.digest)} does not equal the freshly captured digest (${digest})`
+      };
+    }
+    if (p.runId !== context4.runId) {
+      return {
+        ok: false,
+        error: `${KIND14}: proof.runId ${String(p.runId)} does not match the certifying run ${context4.runId}`
+      };
+    }
+    const db2 = await this.getDb();
+    const runRow = await new RunDao(db2).traceRowById(context4.runId);
+    if (runRow === undefined) {
+      return {
+        ok: false,
+        error: `${KIND14}: run ${context4.runId} has no authoritative row \u2014 refusing binding (0785 R3)`
+      };
+    }
+    let metadata = {};
+    try {
+      metadata = JSON.parse(runRow.metadata_json || "{}");
+    } catch {
+      return { ok: false, error: `${KIND14}: run ${context4.runId} metadata_json is malformed \u2014 refusing binding` };
+    }
+    const resumeDigest = metadata.resumeDefinitionDigest;
+    const expectedDefinition = typeof resumeDigest === "string" && resumeDigest !== "" ? resumeDigest : metadata.definitionDigest;
+    if (typeof expectedDefinition !== "string" || p.definitionDigest !== expectedDefinition) {
+      return {
+        ok: false,
+        error: `${KIND14}: proof.definitionDigest ${String(p.definitionDigest)} does not match the run's ` + `${typeof resumeDigest === "string" && resumeDigest !== "" ? "resume " : ""}definition digest \u2014 ` + `a stale-definition artifact cannot certify this run (0785 R3)`
+      };
+    }
+    const qualityGate = stageOf("qualityGate");
+    const review = stageOf("review");
+    const verification = stageOf("verification");
+    if (qualityGate === null || review === null || verification === null) {
+      return {
+        ok: false,
+        error: `${KIND14}: proof.stages is missing qualityGate/review/verification evidence \u2014 binding refused`
+      };
+    }
+    for (const [name, stage] of [
+      ["qualityGate", qualityGate],
+      ["review", review],
+      ["verification", verification]
+    ]) {
+      if (stage.digest !== digest) {
+        return {
+          ok: false,
+          error: `${KIND14}: proof.stages.${name}.digest does not equal the freshly captured digest`
+        };
       }
+    }
+    if (qualityGate.status !== "PASS") {
+      return {
+        ok: false,
+        error: `${KIND14}: proof.stages.qualityGate.status is ${String(qualityGate.status)}, not PASS`
+      };
+    }
+    if (verification.status !== "PASS") {
+      return {
+        ok: false,
+        error: `${KIND14}: proof.stages.verification.status is ${String(verification.status)}, not PASS`
+      };
+    }
+    if (review.status !== "completed") {
+      return {
+        ok: false,
+        error: `${KIND14}: proof.stages.review.status is "${String(review.status)}" \u2014 a skipped or stale review is not completed evidence (0785 R4)`
+      };
+    }
+    const markerPath = join25(resolve12(workdir), ".spur", "run", `${context4.runId}-review-proof.digest`);
+    let marker = null;
+    try {
+      marker = await this.fileSystem.readFile(markerPath);
+    } catch {
+      marker = null;
+    }
+    if (marker === null || marker.trim() !== digest) {
+      return {
+        ok: false,
+        error: `${KIND14}: review-proof marker ${context4.runId}-review-proof.digest is missing or does not name ` + `the current digest \u2014 review completion is not evidenced for this run (0785 R4)`
+      };
+    }
+    const dao2 = this.artifactDao ?? new ArtifactDao(db2);
+    const record2 = await dao2.record({
+      path: normalized,
+      kind: artifactKind,
+      runId: context4.runId
+    });
+    return {
+      ok: true,
+      data: {
+        id: record2.id,
+        path: normalized,
+        kind: artifactKind,
+        runId: context4.runId,
+        proofBinding: "current",
+        proofDigest: digest
+      },
+      setVars: { proofDigestNow: digest }
     };
   }
 }
@@ -91148,6 +92181,9 @@ var KIND14 = "run.artifact", PROOF_DIGEST_RE;
 var init_run_artifact = __esm(() => {
   init_src2();
   init_dist5();
+  init_verify_verdict();
+  init_proof_input_fingerprint();
+  init_run_path();
   PROOF_DIGEST_RE = /^sha256:[0-9a-f]{64}$/;
 });
 
@@ -91332,7 +92368,7 @@ function registerSpurBuiltins(host, options) {
   host.registerAction(new HitlInputActionRunner(options.hitlResponder), "builtin");
   host.registerAction(new CommandGateActionRunner(options.processExecutor ?? new NodeProcessExecutor3, fileSystem), "builtin");
   host.registerAction(new DoctorProbeActionRunner(options.processExecutor ?? new NodeProcessExecutor3, fileSystem, options.observabilityBus), "builtin");
-  host.registerAction(new RunArtifactActionRunner(options.getDb, fileSystem, options.artifactDao), "builtin");
+  host.registerAction(new RunArtifactActionRunner(options.getDb, fileSystem, options.artifactDao, options.processExecutor), "builtin");
   host.registerAction(new ProofFingerprintActionRunner(fileSystem, options.processExecutor, options.observabilityBus), "builtin");
   if (options.httpRequester) {
     host.registerAction(new HttpRequestActionRunner(options.httpRequester, options.hostAllowlist ?? new Set), "builtin");
@@ -91377,11 +92413,11 @@ function parseCheckpointMetadata(raw) {
       continue;
     }
     inArtifacts = false;
-    const sep3 = line.indexOf(":");
-    if (sep3 <= 0)
+    const sep5 = line.indexOf(":");
+    if (sep5 <= 0)
       continue;
-    const key2 = line.slice(0, sep3).trim();
-    const value = line.slice(sep3 + 1).trim().replace(/^"|"$/g, "");
+    const key2 = line.slice(0, sep5).trim();
+    const value = line.slice(sep5 + 1).trim().replace(/^"|"$/g, "");
     if (key2 === "artifacts") {
       inArtifacts = true;
       if (value !== "" && value !== "[]") {
@@ -91451,7 +92487,7 @@ var init_checkpoint_contract = __esm(() => {
 });
 
 // ../../packages/app/src/workflow/workflow-resolver.ts
-import { basename as basename7, isAbsolute as isAbsolute6, join as join23, resolve as resolve12 } from "path";
+import { basename as basename7, isAbsolute as isAbsolute6, join as join26, resolve as resolve13 } from "path";
 function createEmbeddedSchemaOptions(embedded) {
   if (embedded === undefined || embedded.size === 0)
     return;
@@ -91482,12 +92518,12 @@ async function readWorkflowNameFast(fs3, filePath) {
 }
 async function scanWorkflowByName(cwd, name) {
   const fs3 = createNodeFileSystem3();
-  const projectSpurDir = resolve12(cwd, ".spur", "workflows");
+  const projectSpurDir = resolve13(cwd, ".spur", "workflows");
   if (fs3.exists(projectSpurDir)) {
     try {
       const files = (await fs3.readDir(projectSpurDir)).filter((f) => f.endsWith(".yaml") || f.endsWith(".yml"));
       for (const f of files) {
-        const abs = join23(projectSpurDir, f);
+        const abs = join26(projectSpurDir, f);
         const wfName = await readWorkflowNameFast(fs3, abs);
         if (wfName === name) {
           return { path: abs, source: "project" };
@@ -91497,12 +92533,12 @@ async function scanWorkflowByName(cwd, name) {
   }
   const bundledRoot = bundledConfigRoot();
   if (bundledRoot !== null) {
-    const bundledWorkflowsDir = join23(bundledRoot, "workflows");
+    const bundledWorkflowsDir = join26(bundledRoot, "workflows");
     if (fs3.exists(bundledWorkflowsDir)) {
       try {
         const files = (await fs3.readDir(bundledWorkflowsDir)).filter((f) => f.endsWith(".yaml") || f.endsWith(".yml"));
         for (const f of files) {
-          const abs = join23(bundledWorkflowsDir, f);
+          const abs = join26(bundledWorkflowsDir, f);
           const wfName = await readWorkflowNameFast(fs3, abs);
           if (wfName === name) {
             return { path: abs, source: "bundled" };
@@ -91515,7 +92551,7 @@ async function scanWorkflowByName(cwd, name) {
 }
 function resolveWorkflowFile(cwd, file2) {
   const fs3 = createNodeFileSystem3();
-  const projectPath = resolve12(cwd, file2);
+  const projectPath = resolve13(cwd, file2);
   if (fs3.exists(projectPath)) {
     return { path: projectPath, source: "project" };
   }
@@ -91523,20 +92559,20 @@ function resolveWorkflowFile(cwd, file2) {
   const base2 = basename7(file2);
   if (!isAbsolute6(file2)) {
     const withYaml = isYaml ? file2 : `${file2}.yaml`;
-    const projectSpur = resolve12(cwd, ".spur", "workflows", withYaml);
+    const projectSpur = resolve13(cwd, ".spur", "workflows", withYaml);
     if (fs3.exists(projectSpur)) {
       return { path: projectSpur, source: "project" };
     }
     if (!isYaml) {
-      const projectDirect = resolve12(cwd, `${file2}.yaml`);
+      const projectDirect = resolve13(cwd, `${file2}.yaml`);
       if (fs3.exists(projectDirect)) {
         return { path: projectDirect, source: "project" };
       }
-      const projectSpurPipeline = resolve12(cwd, ".spur", "workflows", `${file2}-pipeline.yaml`);
+      const projectSpurPipeline = resolve13(cwd, ".spur", "workflows", `${file2}-pipeline.yaml`);
       if (fs3.exists(projectSpurPipeline)) {
         return { path: projectSpurPipeline, source: "project" };
       }
-      const projectDirectPipeline = resolve12(cwd, `${file2}-pipeline.yaml`);
+      const projectDirectPipeline = resolve13(cwd, `${file2}-pipeline.yaml`);
       if (fs3.exists(projectDirectPipeline)) {
         return { path: projectDirectPipeline, source: "project" };
       }
@@ -91545,16 +92581,16 @@ function resolveWorkflowFile(cwd, file2) {
   const bundledRoot = bundledConfigRoot();
   if (bundledRoot !== null) {
     const bundledName = isYaml ? base2 : `${base2}.yaml`;
-    const bundledPath = join23(bundledRoot, "workflows", bundledName);
+    const bundledPath = join26(bundledRoot, "workflows", bundledName);
     if (fs3.exists(bundledPath)) {
       return { path: bundledPath, source: "bundled" };
     }
     if (!isYaml) {
-      const bundledPipeline = join23(bundledRoot, "workflows", `${base2}-pipeline.yaml`);
+      const bundledPipeline = join26(bundledRoot, "workflows", `${base2}-pipeline.yaml`);
       if (fs3.exists(bundledPipeline)) {
         return { path: bundledPipeline, source: "bundled" };
       }
-      const bundledLiteral = join23(bundledRoot, "workflows", base2);
+      const bundledLiteral = join26(bundledRoot, "workflows", base2);
       if (fs3.exists(bundledLiteral)) {
         return { path: bundledLiteral, source: "bundled" };
       }
@@ -91602,7 +92638,7 @@ var init_workflow_resolver = __esm(() => {
 // ../../packages/app/src/services/workflow-service.ts
 import { realpathSync as realpathSync5 } from "fs";
 import { homedir as homedir8 } from "os";
-import { basename as basename8, dirname as dirname17, join as join24, resolve as resolve13, sep as sep3 } from "path";
+import { basename as basename8, dirname as dirname18, isAbsolute as isAbsolute7, join as join27, resolve as resolve14, sep as sep5 } from "path";
 function signalSubprocess(pid) {
   if (!Number.isInteger(pid) || pid <= 1)
     return false;
@@ -91647,7 +92683,7 @@ function withSelfPidRecording(inner, db2) {
 }
 function withRunIdentityRecording(inner, db2, identity7) {
   const stamp = async (runId) => {
-    await new RunDao(db2).stampRunIdentity(runId, identity7.definitionDigest, identity7.workflowVersion);
+    await new RunDao(db2).stampRunIdentity(runId, identity7.definitionDigest, identity7.workflowVersion, identity7.source);
   };
   return new Proxy(inner, {
     get(target, prop, receiver) {
@@ -91659,8 +92695,10 @@ function withRunIdentityRecording(inner, db2, identity7) {
       }
       if (prop === "createOrAttachRun") {
         return async (record2) => {
+          const existing = await new RunDao(db2).traceRowById(record2.id);
           const result = await target.createOrAttachRun(record2);
-          await stamp(result.id);
+          if (existing === undefined)
+            await stamp(result.id);
           return result;
         };
       }
@@ -91761,7 +92799,8 @@ class WorkflowAppService {
       recordSelfPid: opts.recordSelfPid === true,
       events: eventsBus,
       steeringController: opts.steeringController,
-      extensions: { workflow, file: absolute }
+      extensions: { workflow, file: absolute },
+      definitionSource: { path: absolute, layer: resolved.layer, workdir: this.ctx.cwd }
     });
     const runId = opts.runId ?? crypto.randomUUID();
     const isDry = opts.dryRun === true;
@@ -91862,7 +92901,7 @@ class WorkflowAppService {
     };
   }
   async cleanRunLogs(retentionDays = 30, dryRun = false) {
-    const runDir = join24(this.ctx.cwd, ".spur", "run");
+    const runDir = join27(this.ctx.cwd, ".spur", "run");
     const fs3 = createNodeFileSystem3();
     const cutoffMs = Date.now() - retentionDays * 24 * 60 * 60 * 1000;
     const reclaimed = [];
@@ -91874,7 +92913,7 @@ class WorkflowAppService {
       return { retentionDays, dryRun, reclaimed, failures };
     }
     for (const name of entries) {
-      const path9 = join24(runDir, name);
+      const path9 = join27(runDir, name);
       const stat = await fs3.stat(path9);
       if (stat === null || !stat.isFile() || stat.mtimeMs >= cutoffMs)
         continue;
@@ -91893,13 +92932,13 @@ class WorkflowAppService {
     return { retentionDays, dryRun, reclaimed, failures };
   }
   async cleanCheckpoints(retentionDays = 30, dryRun = false) {
-    const sessionsDir = join24(this.ctx.cwd, ".spur", "memory", "sessions");
+    const sessionsDir = join27(this.ctx.cwd, ".spur", "memory", "sessions");
     const fs3 = createNodeFileSystem3();
     let sessionsReal;
     try {
       sessionsReal = realpathSync5(sessionsDir);
     } catch {
-      sessionsReal = resolve13(sessionsDir);
+      sessionsReal = resolve14(sessionsDir);
     }
     const cutoffMs = Date.now() - retentionDays * 24 * 60 * 60 * 1000;
     const reclaimed = [];
@@ -91913,14 +92952,14 @@ class WorkflowAppService {
     }
     const activeRunIds = new Set((await new RunDao(await this.ctx.getDb()).listActiveRuns()).map((r) => r.id));
     for (const name of entries) {
-      const path9 = join24(sessionsDir, name);
+      const path9 = join27(sessionsDir, name);
       let resolved;
       try {
         resolved = realpathSync5(path9);
       } catch {
-        resolved = resolve13(path9);
+        resolved = resolve14(path9);
       }
-      if (!resolved.startsWith(sessionsReal + sep3)) {
+      if (!resolved.startsWith(sessionsReal + sep5)) {
         skipped.push({ name, reason: "path-confinement: resolved outside .spur/memory/sessions" });
         continue;
       }
@@ -91990,22 +93029,60 @@ class WorkflowAppService {
     if (row?.status !== "paused") {
       throw new Error(`Run "${runId}" is not paused (or does not exist) - nothing to continue.`);
     }
-    await this.validateResumeCheckpointFreshness(runId, row);
-    let resolved;
-    try {
-      resolved = await resolveWorkflowDefinition(this.ctx.cwd, row.workflow_name, {
-        validateSchema: true,
-        embeddedSchemas: this.ctx.embeddedSchemas?.()
-      });
-    } catch {
-      throw new Error(`Cannot resume run "${runId}": workflow definition "${row.workflow_name}" not found in the workflow search paths.`);
-    }
     let rawMeta = {};
     try {
       rawMeta = JSON.parse(row.metadata_json || "{}");
     } catch {
       rawMeta = {};
     }
+    const warnings = [];
+    const emitWarning = (message) => {
+      warnings.push(message);
+      try {
+        this.ctx.warn?.(message);
+      } catch {}
+    };
+    let pinned = null;
+    const rawSource = rawMeta.definitionSource;
+    if (rawSource !== undefined) {
+      if (rawSource === null || typeof rawSource !== "object" || Array.isArray(rawSource)) {
+        throw new Error(`Cannot resume run "${runId}": recorded definitionSource metadata is malformed (expected {path, layer, workdir}). Resume refused.`);
+      }
+      const candidate = rawSource;
+      const sourcePath = candidate.path;
+      const sourceLayer = candidate.layer;
+      const sourceWorkdir = candidate.workdir;
+      if (typeof sourcePath !== "string" || sourcePath === "" || sourceLayer !== "project" && sourceLayer !== "bundled" || typeof sourceWorkdir !== "string" || sourceWorkdir === "") {
+        throw new Error(`Cannot resume run "${runId}": recorded definitionSource metadata is malformed (expected an absolute path, a project|bundled layer, and a workdir). Resume refused.`);
+      }
+      pinned = { path: sourcePath, layer: sourceLayer, workdir: sourceWorkdir };
+    }
+    const launchWorkdir = pinned?.workdir ?? this.ctx.cwd;
+    await this.validateResumeCheckpointFreshness(runId, row, launchWorkdir);
+    let resolved;
+    if (pinned !== null) {
+      const fs3 = createNodeFileSystem3();
+      if (!fs3.exists(pinned.path)) {
+        throw new Error(`Cannot resume run "${runId}": recorded launch source "${pinned.path}" no longer exists. Repair the source or start a new run; name-based fallback is refused.`);
+      }
+      resolved = await resolveWorkflowDefinition(pinned.workdir, pinned.path, {
+        validateSchema: true,
+        embeddedSchemas: this.ctx.embeddedSchemas?.()
+      });
+      if (resolved.path !== pinned.path) {
+        throw new Error(`Cannot resume run "${runId}": definition resolved to "${resolved.path}" instead of the recorded launch source "${pinned.path}". Resume refused.`);
+      }
+    } else {
+      try {
+        resolved = await resolveWorkflowDefinition(this.ctx.cwd, row.workflow_name, {
+          validateSchema: true,
+          embeddedSchemas: this.ctx.embeddedSchemas?.()
+        });
+      } catch {
+        throw new Error(`Cannot resume run "${runId}": workflow definition "${row.workflow_name}" not found in the workflow search paths.`);
+      }
+      emitWarning(`Run "${runId}" resumed by workflow name "${row.workflow_name}" (no recorded launch source \u2014 pre-source-pin run); identity checks run against the name-resolved definition.`);
+    }
     const persistedDigest = typeof rawMeta.definitionDigest === "string" ? rawMeta.definitionDigest : null;
     const identityStamped = "workflowVersion" in rawMeta;
     const persistedVersion = identityStamped && (typeof rawMeta.workflowVersion === "string" || rawMeta.workflowVersion === null) ? rawMeta.workflowVersion : undefined;
@@ -92025,6 +93102,18 @@ class WorkflowAppService {
           throw new Error(`Cannot resume run "${runId}": workflow definition drift detected (launched with ${persistedDigest}, currently ${resolved.digest}). Resume refused.`);
         }
       }
+      const db2 = await this.ctx.getDb();
+      await new RunDao(db2).mergeMetadata(runId, {
+        resumeDefinitionDigest: resolved.digest,
+        resumeWorkflowVersion: workflowVersionLiteral(resolved.workflow)
+      });
+      emitWarning(`Consented definition drift on resume of run "${runId}": launched ${persistedDigest}, executing ${resolved.digest}; launch identity preserved, proof vars carry the executed digest.`);
+    } else if ((("resumeDefinitionDigest" in rawMeta) || ("resumeWorkflowVersion" in rawMeta)) && (persistedDigest === null || persistedDigest === resolved.digest)) {
+      const db2 = await this.ctx.getDb();
+      await new RunDao(db2).mergeMetadata(runId, {
+        resumeDefinitionDigest: null,
+        resumeWorkflowVersion: null
+      });
     }
     const svc = await this.createEngineService({
       events: eventsBus,
@@ -92032,10 +93121,15 @@ class WorkflowAppService {
     });
     const workflow = resolved.workflow;
     const hitlVar = opts?.hitlVar ?? "__hitlAnswer";
-    const resumeVars = opts?.hitlAnswer !== undefined ? { [hitlVar]: opts.hitlAnswer } : undefined;
+    const resumeVars = {};
+    if (opts?.hitlAnswer !== undefined)
+      resumeVars[hitlVar] = opts.hitlAnswer;
+    if (persistedDigest !== null && persistedDigest !== resolved.digest && "resumeDefinitionDigest" in rawMeta) {
+      resumeVars.__definitionDigest = resolved.digest;
+    }
     const result = await svc.resumeRun(workflow, runId, {
-      workdir: this.ctx.cwd,
-      ...resumeVars !== undefined ? { vars: resumeVars } : {},
+      workdir: launchWorkdir,
+      ...Object.keys(resumeVars).length > 0 ? { vars: resumeVars } : {},
       ...eventsBus !== undefined ? {
         events: withWorkflowIdentity(bridgeEventBus(eventsBus), workflow)
       } : {}
@@ -92045,6 +93139,8 @@ class WorkflowAppService {
     runResult.definitionDigest = persistedDigest;
     if (persistedVersion !== undefined)
       runResult.version = persistedVersion;
+    if (warnings.length > 0)
+      runResult.warnings = warnings;
     return runResult;
   }
   async stampFailureReason(runId, result) {
@@ -92054,8 +93150,8 @@ class WorkflowAppService {
     const db2 = await this.ctx.getDb();
     await new RunDao(db2).stampFailureReason(runId, result.reason);
   }
-  async validateResumeCheckpointFreshness(runId, row) {
-    const sessionsDir = join24(this.ctx.cwd, ".spur", "memory", "sessions");
+  async validateResumeCheckpointFreshness(runId, row, workdir) {
+    const sessionsDir = join27(workdir, ".spur", "memory", "sessions");
     const fs3 = createNodeFileSystem3();
     let entries;
     try {
@@ -92070,8 +93166,26 @@ class WorkflowAppService {
       rawMeta = {};
     }
     const wbs = typeof rawMeta.wbs === "string" ? rawMeta.wbs : undefined;
+    const executor = this.ctx.processExecutor?.() ?? new NodeProcessExecutor3;
+    let head = null;
+    const resolveHead = async () => {
+      if (head !== null)
+        return head;
+      const probe = await executor.run({
+        command: "git",
+        args: ["rev-parse", "HEAD"],
+        cwd: workdir,
+        forceBuffered: true,
+        rejectOnError: false
+      });
+      if (probe.exitCode !== 0 || probe.stdout.trim() === "") {
+        throw new Error(`Cannot resume run "${runId}": checkpoint freshness requires the launch workdir's git HEAD, but "git rev-parse HEAD" failed in "${workdir}". Refusing rather than skipping the commit-drift check.`);
+      }
+      head = probe.stdout.trim();
+      return head;
+    };
     for (const name of entries) {
-      const filePath = join24(sessionsDir, name);
+      const filePath = join27(sessionsDir, name);
       let raw;
       try {
         raw = await fs3.readFile(filePath);
@@ -92090,10 +93204,20 @@ class WorkflowAppService {
         if (meta3.workflow !== "" && meta3.workflow !== row.workflow_name) {
           throw new Error(`Cannot resume run "${runId}": checkpoint is stale (workflow-mismatch: checkpoint workflow "${meta3.workflow}" != "${row.workflow_name}").`);
         }
-        if (meta3.status !== "" && meta3.status !== row.status) {
-          throw new Error(`Cannot resume run "${runId}": checkpoint is stale (status-mismatch: checkpoint status "${meta3.status}" does not match run status "${row.status}").`);
+        if (meta3.status === "") {
+          throw new Error(`Cannot resume run "${runId}": checkpoint is stale (status-missing: checkpoint carries no status).`);
         }
-        const staleness = checkpointStaleness(meta3);
+        if (isTerminalCheckpointStatus(meta3.status)) {
+          throw new Error(`Cannot resume run "${runId}": checkpoint is stale (terminal: status=${meta3.status}).`);
+        }
+        if (meta3.status !== "pending" && meta3.status !== "running" && meta3.status !== "approved") {
+          throw new Error(`Cannot resume run "${runId}": checkpoint is stale (unknown checkpoint status "${meta3.status}" \u2014 expected pending/running/approved).`);
+        }
+        const staleness = checkpointStaleness(meta3, {
+          ...wbs !== undefined ? { taskWbs: wbs } : {},
+          ...meta3.sourceCommit === "" ? {} : { sourceCommit: await resolveHead() },
+          artifactExists: (p) => fs3.exists(isAbsolute7(p) ? p : join27(workdir, p))
+        });
         if (staleness.stale) {
           throw new Error(`Cannot resume run "${runId}": checkpoint is stale (${staleness.reason}).`);
         }
@@ -92102,12 +93226,12 @@ class WorkflowAppService {
   }
   async list(workflowPaths = [".spur/workflows/"]) {
     const projectRoot = this.ctx.cwd;
-    const globalRoot = join24(homedir8(), ".config", "spur");
+    const globalRoot = join27(homedir8(), ".config", "spur");
     const layers = [];
     const entries = [];
     const scannedPaths = new Set;
     for (const relPath of workflowPaths) {
-      const absPath = resolve13(projectRoot, relPath);
+      const absPath = resolve14(projectRoot, relPath);
       layers.push({ id: "project", path: absPath });
       scannedPaths.add(absPath);
       try {
@@ -92116,7 +93240,7 @@ class WorkflowAppService {
       } catch {}
     }
     for (const relPath of workflowPaths) {
-      const absPath = resolve13(globalRoot, relPath);
+      const absPath = resolve14(globalRoot, relPath);
       if (scannedPaths.has(absPath))
         continue;
       layers.push({ id: "global", path: absPath });
@@ -92302,14 +93426,15 @@ class WorkflowAppService {
     if (opts.extensions !== undefined) {
       persistence2 = withRunIdentityRecording(persistence2, db2, {
         definitionDigest: computeDefinitionDigest(opts.extensions.workflow),
-        workflowVersion: workflowVersionLiteral(opts.extensions.workflow)
+        workflowVersion: workflowVersionLiteral(opts.extensions.workflow),
+        ...opts.definitionSource !== undefined ? { source: opts.definitionSource } : {}
       });
     }
     const adapter = bus ? new ObservableWorkflowAdapter(persistence2, opts.extensions !== undefined ? withWorkflowIdentity(bus, opts.extensions.workflow) : bus) : persistence2;
     return new WorkflowService(host, adapter);
   }
   async loadWorkflowExtensions(host, workflow, file2) {
-    const refs = collectWorkflowExtensions(workflow.name, dirname17(file2), workflow.extensions);
+    const refs = collectWorkflowExtensions(workflow.name, dirname18(file2), workflow.extensions);
     if (refs.length === 0)
       return;
     const nodeFs = createNodeFileSystem3();
@@ -92576,8 +93701,8 @@ function resolveOutputLogConfig(config4) {
   };
 }
 async function outputArtifactForRun(cwd, runId) {
-  const relative5 = join24(".spur", "run", `${runId}.log`);
-  return await fileExists(join24(cwd, relative5)) ? relative5 : undefined;
+  const relative6 = join27(".spur", "run", `${runId}.log`);
+  return await fileExists(join27(cwd, relative6)) ? relative6 : undefined;
 }
 async function scanWorkflowFiles(rootPath, source, loadEntry) {
   const entries = [];
@@ -92590,7 +93715,7 @@ async function scanWorkflowFiles(rootPath, source, loadEntry) {
   async function walk3(dirPath) {
     const names = await fs3.readDir(dirPath);
     for (const name of names) {
-      const fullPath = resolve13(dirPath, name);
+      const fullPath = resolve14(dirPath, name);
       const st = await fs3.stat(fullPath);
       if (!st)
         continue;
@@ -92762,8 +93887,8 @@ function projectActionTraceResult(resultJson, secretValues = []) {
 async function partialArtifactForAction(cwd, runId, node, ok) {
   if (ok !== false || !TRACE_IDENTIFIER.test(runId) || !TRACE_IDENTIFIER.test(node))
     return;
-  const relativePath2 = join24(".spur", "run", `${runId}-${node}-partial.md`);
-  return await fileExists(resolve13(cwd, relativePath2)) ? relativePath2 : undefined;
+  const relativePath2 = join27(".spur", "run", `${runId}-${node}-partial.md`);
+  return await fileExists(resolve14(cwd, relativePath2)) ? relativePath2 : undefined;
 }
 var TASK_PIPELINE_WORKFLOW = "task-pipeline", PIPELINE_LINK_KIND = "pipeline", TRACE_IDENTIFIER, TRACE_RESULT_FIELDS, TRACE_INVOCATION_FIELDS;
 var init_workflow_service = __esm(() => {
@@ -92801,7 +93926,7 @@ var init_workflow_service = __esm(() => {
 });
 
 // ../../packages/app/src/workflow/idea-handoff.ts
-import { resolve as resolve14 } from "path";
+import { resolve as resolve15 } from "path";
 function processEvidence(r) {
   return `exit=${r.exitCode ?? "null"}${r.signal ? ` signal=${r.signal}` : ""}: ${r.stderr.trim() || "no stderr"}`;
 }
@@ -92811,11 +93936,12 @@ async function finalizeIdeaHandoff(options) {
   const executor = options.processExecutor ?? new NodeProcessExecutor3;
   const spurBin = options.spurBin ?? "spur";
   const { runId, featureId: featureId2 } = options;
-  const runDir = resolve14(root, ".spur", "run");
-  const batchPath = resolve14(runDir, `${runId}-idea-task-batch.json`);
-  const resultPath = resolve14(runDir, `${runId}-idea-batch-create-result.json`);
-  const orderPath = resolve14(runDir, `${runId}-idea-task-order.json`);
-  const reportPath = resolve14(runDir, `${runId}-idea-handoff.md`);
+  const runDir = resolve15(root, ".spur", "run");
+  const batchPath = resolve15(runDir, `${runId}-idea-task-batch.json`);
+  const resultPath = resolve15(runDir, `${runId}-idea-batch-create-result.json`);
+  const orderPath = resolve15(runDir, `${runId}-idea-task-order.json`);
+  const readyPath = resolve15(runDir, `${runId}-idea-ready.json`);
+  const reportPath = resolve15(runDir, `${runId}-idea-handoff.md`);
   const spurSplit = splitLaunchCommand(spurBin, 'idea-handoff "spurBin"');
   if ("error" in spurSplit) {
     return {
@@ -92841,6 +93967,23 @@ async function finalizeIdeaHandoff(options) {
     const batch = JSON.parse(await fs3.readFile(batchPath));
     const result = JSON.parse(await fs3.readFile(resultPath));
     const order = JSON.parse(await fs3.readFile(orderPath));
+    const sidecarExists = await fs3.exists(readyPath);
+    const evidenceRows = await (async () => {
+      if (!sidecarExists)
+        return [];
+      try {
+        const parsed = JSON.parse(await fs3.readFile(readyPath));
+        const tasks = typeof parsed === "object" && parsed !== null && "tasks" in parsed ? parsed.tasks : undefined;
+        return Array.isArray(tasks) ? tasks : [];
+      } catch {
+        return [];
+      }
+    })();
+    const evidenceByWbs = new Map;
+    for (const row of evidenceRows) {
+      if (typeof row?.wbs === "string")
+        evidenceByWbs.set(row.wbs, row);
+    }
     if (!Array.isArray(batch) || !Array.isArray(result?.wbs) || !Array.isArray(order)) {
       return {
         ok: false,
@@ -92932,23 +94075,92 @@ async function finalizeIdeaHandoff(options) {
     }
     const checkResults = [];
     for (const wbs of result.wbs) {
-      const checkRes = await executor.run({
+      const pathRes = await executor.run({
         command: spurCommand,
-        args: [...spurArgsPrefix, "task", "check", wbs, "--json"],
+        args: [...spurArgsPrefix, "task", "path", wbs, "--json"],
         cwd: root,
         forceBuffered: true,
         rejectOnError: false
       });
-      if (checkRes.exitCode === null) {
+      if (pathRes.exitCode === null) {
         return {
           ok: false,
           wbsList: result.wbs,
           nextCommand: "",
           reportPath,
-          error: `Task check for ${wbs} could not be spawned (${spurCommand}): ${processEvidence(checkRes)}`
+          error: `Task path for ${wbs} could not be spawned (${spurCommand}): ${processEvidence(pathRes)}`
         };
       }
-      checkResults.push({ wbs, pass: checkRes.exitCode === 0 });
+      let reason;
+      if (pathRes.exitCode !== 0) {
+        reason = `task path resolution failed: ${processEvidence(pathRes)}`;
+      } else {
+        let filePath;
+        try {
+          const parsed = JSON.parse(pathRes.stdout);
+          if (typeof parsed === "object" && parsed !== null && "filePath" in parsed) {
+            const fp = parsed.filePath;
+            if (typeof fp === "string")
+              filePath = fp;
+          }
+        } catch {
+          filePath = undefined;
+        }
+        if (filePath === undefined) {
+          reason = "task path output carried no filePath";
+        } else {
+          let digest;
+          try {
+            digest = computePlanningDigest(await fs3.readFile(filePath));
+          } catch {
+            digest = undefined;
+          }
+          if (digest === undefined) {
+            reason = `task file unreadable at ${filePath}`;
+          } else {
+            const row = evidenceByWbs.get(wbs);
+            if (row === undefined) {
+              reason = "no ready evidence recorded for this run";
+            } else if (row.status !== "ready") {
+              reason = `ready evidence status is ${String(row.status)}`;
+            } else if (typeof row.planningDigest !== "string" || row.planningDigest !== digest) {
+              reason = "planning digest stale \u2014 task content changed after preparation";
+            } else {
+              const verdict = verifyReadyChecks(Array.isArray(row.checks) ? row.checks : undefined);
+              if (!verdict.ok)
+                reason = verdict.reason;
+            }
+          }
+        }
+      }
+      if (reason === undefined) {
+        const checkRes = await executor.run({
+          command: spurCommand,
+          args: [...spurArgsPrefix, "task", "check", wbs, "--json"],
+          cwd: root,
+          forceBuffered: true,
+          rejectOnError: false
+        });
+        if (checkRes.exitCode === null) {
+          return {
+            ok: false,
+            wbsList: result.wbs,
+            nextCommand: "",
+            reportPath,
+            error: `Task check for ${wbs} could not be spawned (${spurCommand}): ${processEvidence(checkRes)}`
+          };
+        }
+        if (checkRes.exitCode !== 0) {
+          reason = `deterministic task check failed (${processEvidence(checkRes)})`;
+        }
+      }
+      const pass = reason === undefined;
+      checkResults.push({
+        wbs,
+        pass,
+        status: pass ? "ready" : "unready",
+        ...pass ? {} : { reason, action: readyRefineCommand(wbs) }
+      });
     }
     const anyFailed = checkResults.some((c3) => !c3.pass);
     const nextCommand = anyFailed ? `/sp:dev-refineall --feature ${featureId2} --auto --depth ready` : `/sp:dev-runall --feature ${featureId2} --auto`;
@@ -92961,12 +94173,18 @@ async function finalizeIdeaHandoff(options) {
       "## Created tasks",
       ...result.wbs.map((w) => `  - ${w}`),
       "",
-      "## Per-task readiness (spur task check)",
+      "## Per-task readiness (evidence + digest + task check)",
       "",
-      "| WBS | Outcome |",
-      "|-----|---------|",
-      ...checkResults.map((c3) => `| ${c3.wbs} | ${c3.pass ? "PASS" : "FAIL"} |`),
+      "| WBS | Outcome | Reason |",
+      "|-----|---------|--------|",
+      ...checkResults.map((c3) => `| ${c3.wbs} | ${c3.pass ? "READY" : "UNREADY"} | ${c3.reason ?? "-"} |`),
       "",
+      ...anyFailed ? [
+        "## Preparation actions",
+        "",
+        ...checkResults.filter((c3) => !c3.pass).map((c3) => `  - ${c3.wbs}: ${c3.action}`),
+        ""
+      ] : [],
       "## Next command",
       "",
       nextCommand,
@@ -92993,6 +94211,7 @@ async function finalizeIdeaHandoff(options) {
 }
 var init_idea_handoff = __esm(() => {
   init_dist5();
+  init_task_readiness();
   init_split_launch_command();
 });
 
@@ -93515,7 +94734,7 @@ var init_progress_follow = __esm(() => {
 });
 
 // ../../packages/app/src/workflow/trace-writer.ts
-import { dirname as dirname18, join as join25 } from "path";
+import { dirname as dirname19, join as join28 } from "path";
 
 class WorkflowTraceWriter {
   path;
@@ -93523,7 +94742,7 @@ class WorkflowTraceWriter {
   pending = Promise.resolve();
   constructor(cwd, runId) {
     const safeRunId = runId.replace(/[^A-Za-z0-9._-]/g, "_");
-    this.path = join25(cwd, ".spur", "runs", "workflow", `${safeRunId}.jsonl`);
+    this.path = join28(cwd, ".spur", "runs", "workflow", `${safeRunId}.jsonl`);
   }
   attach(bus) {
     bus.on("workflow.run.started", (event) => this.enqueue("workflow.run.started", event));
@@ -93549,7 +94768,7 @@ class WorkflowTraceWriter {
 `;
     this.pending = this.pending.then(async () => {
       const fs3 = createNodeFileSystem3();
-      await fs3.ensureDir(dirname18(this.path));
+      await fs3.ensureDir(dirname19(this.path));
       await fs3.appendFile(this.path, line);
     });
   }
@@ -93563,6 +94782,7 @@ var exports_src2 = {};
 __export(exports_src2, {
   writeJsonError: () => writeJsonError,
   waitForOccupant: () => waitForOccupant,
+  verifyReadyChecks: () => verifyReadyChecks,
   verdictRowsMatchScenarios: () => verdictRowsMatchScenarios,
   validateSchedulerCustomJobPayload: () => validateSchedulerCustomJobPayload,
   validateHistoryRefreshPayload: () => validateHistoryRefreshPayload,
@@ -93605,6 +94825,8 @@ __export(exports_src2, {
   registerSpurBuiltins: () => registerSpurBuiltins,
   refreshHistoryRollups: () => refreshHistoryRollups,
   redactAndBound: () => redactAndBound,
+  readyRefineCommand: () => readyRefineCommand,
+  readyRefineAllCommand: () => readyRefineAllCommand,
   readVerdictArtifact: () => readVerdictArtifact,
   readVerdict: () => readVerdict,
   qualifySectionBody: () => qualifySectionBody,
@@ -93615,6 +94837,8 @@ __export(exports_src2, {
   projectStoredSystemEventEnvelope: () => projectStoredSystemEventEnvelope,
   projectLifecycle: () => projectLifecycle,
   probePort: () => probePort,
+  prepareCreatedTaskReady: () => prepareCreatedTaskReady,
+  prepareBatchTaskReady: () => prepareBatchTaskReady,
   portBindingAvailable: () => portBindingAvailable,
   permissionFailureEvidence: () => permissionFailureEvidence,
   parseVerdict: () => parseVerdict,
@@ -93654,6 +94878,7 @@ __export(exports_src2, {
   extractResolvedWorkflowFacts: () => extractResolvedWorkflowFacts,
   extractProofDigest: () => extractProofDigest,
   extractFeatureProofData: () => extractFeatureProofData,
+  extractBatchArray: () => extractBatchArray,
   evaluateDoneTransition: () => evaluateDoneTransition,
   escalationFingerprint: () => escalationFingerprint,
   envelopeEnabled: () => envelopeEnabled,
@@ -93670,6 +94895,7 @@ __export(exports_src2, {
   createFileAgentInstanceStore: () => createFileAgentInstanceStore,
   configuredSecretValues: () => configuredSecretValues,
   computeProofInputFingerprint: () => computeProofInputFingerprint,
+  computePlanningDigest: () => computePlanningDigest,
   computeExitCode: () => computeExitCode,
   computeDefinitionDigest: () => computeDefinitionDigest,
   computeAggregate: () => computeAggregate,
@@ -93702,8 +94928,10 @@ __export(exports_src2, {
   TeamService: () => TeamService,
   TaskService: () => TaskService,
   TaskScaffoldService: () => TaskScaffoldService,
+  TaskPreparationError: () => TaskPreparationError,
   TaskLocator: () => TaskLocator,
   TaskCheckService: () => TaskCheckService,
+  TaskCandidateInvalidError: () => TaskCandidateInvalidError,
   TOKEN_LEDGER_RELATIVE_PATH: () => TOKEN_LEDGER_RELATIVE_PATH,
   TOKEN_LEDGER_MAX_LIMIT: () => TOKEN_LEDGER_MAX_LIMIT,
   TOKEN_LEDGER_DEFAULT_LIMIT: () => TOKEN_LEDGER_DEFAULT_LIMIT,
@@ -93735,6 +94963,9 @@ __export(exports_src2, {
   RUN_STORE_WBS_DEFAULT_LIMIT: () => RUN_STORE_WBS_DEFAULT_LIMIT,
   RUN_STORE_LIST_MAX_LIMIT: () => RUN_STORE_LIST_MAX_LIMIT,
   RUN_STORE_LIST_DEFAULT_LIMIT: () => RUN_STORE_LIST_DEFAULT_LIMIT,
+  READY_SKIPPED: () => READY_SKIPPED,
+  READY_DONE: () => READY_DONE,
+  READY_CHECKLIST_IDS: () => READY_CHECKLIST_IDS,
   ProofInputFingerprint: () => ProofInputFingerprint,
   ProofCaptureError: () => ProofCaptureError,
   ProjectRegistry: () => ProjectRegistry,
@@ -93744,6 +94975,7 @@ __export(exports_src2, {
   PS_LIST_ARGV: () => PS_LIST_ARGV,
   POLL_INTERVAL_MS: () => POLL_INTERVAL_MS,
   PLANNING_EVENT_NAMES: () => PLANNING_EVENT_NAMES,
+  PLANNING_DIGEST_SECTIONS: () => PLANNING_DIGEST_SECTIONS,
   ObservableWorkflowAdapter: () => ObservableWorkflowAdapter,
   MockHistoryBoardService: () => MockHistoryBoardService,
   MIN_SAFE_PI_BASH_IMPORTER_VERSION: () => MIN_SAFE_PI_BASH_IMPORTER_VERSION,
@@ -93776,6 +95008,7 @@ __export(exports_src2, {
   DEFAULT_SYSTEM_EVENT_RETENTION_QUOTA: () => DEFAULT_SYSTEM_EVENT_RETENTION_QUOTA,
   DEFAULT_STALL_MS: () => DEFAULT_STALL_MS,
   DEFAULT_RUN_LOG_MAX_BYTES: () => DEFAULT_RUN_LOG_MAX_BYTES,
+  DEFAULT_READY_PREPARE_TIMEOUT_MS: () => DEFAULT_READY_PREPARE_TIMEOUT_MS,
   DEFAULT_FEATURE_MATRIX: () => DEFAULT_FEATURE_MATRIX,
   CorpusMigrator: () => CorpusMigrator,
   CommandGateActionRunner: () => CommandGateActionRunner,
@@ -93821,6 +95054,7 @@ var init_src3 = __esm(async () => {
   init_rule_service();
   init_run_session_observer();
   init_run_store_service();
+  init_scheduler_custom_job_service();
   init_supervisor_service();
   init_system_event_emitter();
   init_system_event_follow();
@@ -93829,6 +95063,7 @@ var init_src3 = __esm(async () => {
   init_task_attribution2();
   init_task_check();
   init_task_locator();
+  init_task_readiness();
   init_task_record();
   init_task_scaffold();
   init_task_service();
@@ -101924,15 +103159,15 @@ function parseTimeout(raw) {
   return n3;
 }
 function loopSleep(ms, signal) {
-  return new Promise((resolve15) => {
+  return new Promise((resolve16) => {
     if (signal?.aborted) {
-      resolve15();
+      resolve16();
       return;
     }
-    const timer = setTimeout(resolve15, ms);
+    const timer = setTimeout(resolve16, ms);
     signal?.addEventListener("abort", () => {
       clearTimeout(timer);
-      resolve15();
+      resolve16();
     }, { once: true });
   });
 }
@@ -102064,7 +103299,7 @@ function waitFail(context4, options, code, message) {
 // src/release-ops.ts
 init_dist5();
 import { existsSync as existsSync10, readdirSync as readdirSync7, readFileSync as readFileSync10 } from "fs";
-import { join as join26 } from "path";
+import { join as join29 } from "path";
 var SEMVER = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z-.]+)?(?:\+[0-9A-Za-z-.]+)?$/;
 function releaseTag(config4, version3) {
   return `${config4.packageName}${config4.tagVersionSeparator}${version3}`;
@@ -102110,7 +103345,7 @@ async function readJson(path9) {
 function rootWorkspaceGlobs(repoRoot) {
   let root;
   try {
-    root = JSON.parse(readFileSync10(join26(repoRoot, "package.json"), "utf8"));
+    root = JSON.parse(readFileSync10(join29(repoRoot, "package.json"), "utf8"));
   } catch {
     return [];
   }
@@ -102127,11 +103362,11 @@ function workspaceDirs(repoRoot) {
     if (!glob.endsWith("/*"))
       continue;
     const parent = glob.slice(0, -2);
-    const parentAbs = join26(repoRoot, parent);
+    const parentAbs = join29(repoRoot, parent);
     if (!existsSync10(parentAbs))
       continue;
     for (const entry of readdirSync7(parentAbs, { withFileTypes: true })) {
-      if (entry.isDirectory() && existsSync10(join26(parentAbs, entry.name, "package.json"))) {
+      if (entry.isDirectory() && existsSync10(join29(parentAbs, entry.name, "package.json"))) {
         dirs.push(`${parent}/${entry.name}`);
       }
     }
@@ -102139,14 +103374,14 @@ function workspaceDirs(repoRoot) {
   return dirs;
 }
 async function releaseContext(repoRoot) {
-  const rootManifest = await readJson(join26(repoRoot, "package.json"));
+  const rootManifest = await readJson(join29(repoRoot, "package.json"));
   if (rootManifest === null) {
     throw new Error(`no package.json found at ${repoRoot} \u2014 builder operates on a package workspace root.`);
   }
   const rootName = typeof rootManifest.name === "string" ? rootManifest.name : "root";
   const workspaces2 = [];
   for (const dir of workspaceDirs(repoRoot)) {
-    const manifest = await readJson(join26(repoRoot, dir, "package.json"));
+    const manifest = await readJson(join29(repoRoot, dir, "package.json"));
     if (manifest === null)
       continue;
     workspaces2.push({
@@ -102159,7 +103394,7 @@ async function releaseContext(repoRoot) {
   const shortName = (name) => name.split("/").pop() ?? name;
   const packages = new Map;
   for (const ws of workspaces2) {
-    const versionSourceFile = existsSync10(join26(repoRoot, ws.dir, "src", "config.ts")) ? `${ws.dir}/src/config.ts` : undefined;
+    const versionSourceFile = existsSync10(join29(repoRoot, ws.dir, "src", "config.ts")) ? `${ws.dir}/src/config.ts` : undefined;
     packages.set(shortName(ws.name), {
       packageDir: ws.dir,
       packageName: ws.name,
@@ -102194,7 +103429,7 @@ async function updateWorkspacePins(ctx, pkgName, oldVersion, newVersion, output2
   const changed = [];
   for (const dir of workspaceDirs(ctx.repoRoot)) {
     const relPath = `${dir}/package.json`;
-    const manifest = await readJson(join26(ctx.repoRoot, relPath));
+    const manifest = await readJson(join29(ctx.repoRoot, relPath));
     if (manifest === null)
       continue;
     let dirty = false;
@@ -102211,7 +103446,7 @@ async function updateWorkspacePins(ctx, pkgName, oldVersion, newVersion, output2
       }
     }
     if (dirty) {
-      await Bun.write(join26(ctx.repoRoot, relPath), `${JSON.stringify(manifest, null, 4)}
+      await Bun.write(join29(ctx.repoRoot, relPath), `${JSON.stringify(manifest, null, 4)}
 `);
       output2.write(`  \u21B3 ${relPath}: ${pkgName} workspace pin ${oldVersion} \u2192 ${newVersion}`);
       changed.push(relPath);
@@ -102220,7 +103455,7 @@ async function updateWorkspacePins(ctx, pkgName, oldVersion, newVersion, output2
   return changed;
 }
 async function updateVersionSourceFile(ctx, filePath, previous, next, output2) {
-  const absPath = join26(ctx.repoRoot, filePath);
+  const absPath = join29(ctx.repoRoot, filePath);
   const content = await Bun.file(absPath).text();
   const updated = content.replace(/(binaryVersion:\s*['"])\d+\.\d+\.\d+(?:-[0-9A-Za-z-.]+)?(?:\+[0-9A-Za-z-.]+)?(['"])/, `$1${next}$2`);
   if (updated === content) {
@@ -102232,7 +103467,7 @@ async function updateVersionSourceFile(ctx, filePath, previous, next, output2) {
   return true;
 }
 async function syncMarketplaceAndPlugins(ctx, version3, staged, output2) {
-  const marketplacePath = join26(ctx.repoRoot, ".claude-plugin", "marketplace.json");
+  const marketplacePath = join29(ctx.repoRoot, ".claude-plugin", "marketplace.json");
   const marketplaceFile = Bun.file(marketplacePath);
   if (!await marketplaceFile.exists())
     return;
@@ -102262,7 +103497,7 @@ async function syncMarketplaceAndPlugins(ctx, version3, staged, output2) {
     output2.write(`Bumped marketplace plugins to ${version3}`);
   }
   for (const entry of plugins) {
-    const pluginJsonPath = join26(ctx.repoRoot, entry.source, "plugin.json");
+    const pluginJsonPath = join29(ctx.repoRoot, entry.source, "plugin.json");
     const pluginJson = await readJson(pluginJsonPath);
     if (pluginJson === null) {
       output2.write(`  \u26A0 plugin.json not found at ${entry.source}/plugin.json \u2014 skipping`);
@@ -102311,7 +103546,7 @@ async function bumpVersion(ctx, config4, version3, options, output2) {
   if (await npmViewVersion(ctx.repoRoot, config4.packageName, version3)) {
     throw new Error(`${config4.packageName}@${version3} is already published on npm. Use a new version.`);
   }
-  const manifestPath = join26(ctx.repoRoot, config4.packageDir, "package.json");
+  const manifestPath = join29(ctx.repoRoot, config4.packageDir, "package.json");
   const manifest = await readJson(manifestPath);
   if (manifest === null)
     throw new Error(`missing or malformed manifest at ${config4.packageDir}/package.json`);
@@ -102328,7 +103563,7 @@ async function bumpVersion(ctx, config4, version3, options, output2) {
   }
   staged.push(...await updateWorkspacePins(ctx, config4.packageName, previous, version3, output2));
   await syncMarketplaceAndPlugins(ctx, version3, staged, output2);
-  const lockPath = join26(ctx.repoRoot, "bun.lock");
+  const lockPath = join29(ctx.repoRoot, "bun.lock");
   if (existsSync10(lockPath) && Bun.file(lockPath).size > 0)
     staged.push("bun.lock");
   await git2(ctx.repoRoot, ["add", ...staged]);
@@ -102384,7 +103619,7 @@ async function bumpAll(ctx, version3, options, output2) {
   }
   const staged = [];
   for (const config4 of configs) {
-    const manifestPath = join26(ctx.repoRoot, config4.packageDir, "package.json");
+    const manifestPath = join29(ctx.repoRoot, config4.packageDir, "package.json");
     const manifest = await readJson(manifestPath);
     if (manifest === null) {
       throw new Error(`missing or malformed manifest at ${config4.packageDir}/package.json`);
@@ -102403,7 +103638,7 @@ async function bumpAll(ctx, version3, options, output2) {
     staged.push(...await updateWorkspacePins(ctx, config4.packageName, previous, version3, output2));
   }
   await syncMarketplaceAndPlugins(ctx, version3, staged, output2);
-  const lockPath = join26(ctx.repoRoot, "bun.lock");
+  const lockPath = join29(ctx.repoRoot, "bun.lock");
   if (existsSync10(lockPath) && Bun.file(lockPath).size > 0)
     staged.push("bun.lock");
   await git2(ctx.repoRoot, ["add", ...staged]);
@@ -103064,7 +104299,7 @@ import { createRequire } from "module";
 var CLI_CONFIG = {
   binaryName: "spur",
   binaryLabel: "spur",
-  binaryVersion: "0.3.74",
+  binaryVersion: "0.3.75",
   configDir: ".spur",
   configFile: ".spur/config.yaml",
   databaseFile: ".spur/spur.db"
@@ -103449,7 +104684,7 @@ init_loader();
 init_src2();
 init_dist10();
 import { homedir as homedir9 } from "os";
-import { join as join27, resolve as resolve15 } from "path";
+import { join as join30, resolve as resolve16 } from "path";
 
 // src/config/scaffold-manifest.ts
 var SCAFFOLD_MANIFEST = [
@@ -103478,8 +104713,8 @@ var SCAFFOLD_MANIFEST = [
 ];
 
 // src/commands/init.ts
-var GLOBAL_CONFIG_DIR = join27(".config", "spur");
-var GLOBAL_RULES_DIR2 = join27(GLOBAL_CONFIG_DIR, "rules");
+var GLOBAL_CONFIG_DIR = join30(".config", "spur");
+var GLOBAL_RULES_DIR2 = join30(GLOBAL_CONFIG_DIR, "rules");
 var GLOBAL_CONFIG_EXAMPLE = BUNDLED_GLOBAL_CONFIG;
 var GLOBAL_CONFIG_FILE2 = "config.yaml";
 var INDEXED_CONTEXT_MARKER = "## Indexed context";
@@ -103510,7 +104745,7 @@ If \`.spur/context/\` is absent, proceed normally. Never block work on its absen
 `;
 function globalRulesRoot(context4) {
   const override = context4.env.SPUR_GLOBAL_RULES_DIR;
-  return override !== undefined && override.length > 0 ? resolve15(context4.cwd, override) : join27(homedir9(), GLOBAL_RULES_DIR2);
+  return override !== undefined && override.length > 0 ? resolve16(context4.cwd, override) : join30(homedir9(), GLOBAL_RULES_DIR2);
 }
 async function writeIfNew(context4, path9, content, force, result) {
   if (!force && await context4.fs.exists(path9)) {
@@ -103527,18 +104762,18 @@ async function seedGlobalRules(context4) {
   const target = globalRulesRoot(context4);
   let written = 0;
   for (const relPath of await listBundledRuleFiles()) {
-    const destination = join27(target, relPath);
+    const destination = join30(target, relPath);
     if (await context4.fs.exists(destination))
       continue;
-    await context4.fs.ensureDir(join27(target, ...relPath.split("/").slice(0, -1)));
-    await context4.fs.writeFile(destination, await context4.fs.readFile(join27(source, relPath)));
+    await context4.fs.ensureDir(join30(target, ...relPath.split("/").slice(0, -1)));
+    await context4.fs.writeFile(destination, await context4.fs.readFile(join30(source, relPath)));
     written += 1;
   }
   return written;
 }
 function resolveGlobalConfigDir(context4) {
   const globalOverride = context4.env.SPUR_GLOBAL_RULES_DIR;
-  return globalOverride !== undefined && globalOverride.length > 0 ? resolve15(context4.cwd, globalOverride) : join27(homedir9(), GLOBAL_CONFIG_DIR);
+  return globalOverride !== undefined && globalOverride.length > 0 ? resolve16(context4.cwd, globalOverride) : join30(homedir9(), GLOBAL_CONFIG_DIR);
 }
 async function seedGlobalConfig(context4) {
   const source = bundledConfigRoot();
@@ -103549,15 +104784,15 @@ async function seedGlobalConfig(context4) {
   for (const relPath of listBundledConfigFiles()) {
     if (relPath === GLOBAL_CONFIG_EXAMPLE)
       continue;
-    const destination = join27(target, relPath);
+    const destination = join30(target, relPath);
     if (await context4.fs.exists(destination))
       continue;
-    await context4.fs.ensureDir(join27(target, ...relPath.split("/").slice(0, -1)));
-    await context4.fs.writeFile(destination, await context4.fs.readFile(join27(source, relPath)));
+    await context4.fs.ensureDir(join30(target, ...relPath.split("/").slice(0, -1)));
+    await context4.fs.writeFile(destination, await context4.fs.readFile(join30(source, relPath)));
     written += 1;
   }
-  const examplePath = join27(source, GLOBAL_CONFIG_EXAMPLE);
-  const globalConfigPath = join27(target, GLOBAL_CONFIG_FILE2);
+  const examplePath = join30(source, GLOBAL_CONFIG_EXAMPLE);
+  const globalConfigPath = join30(target, GLOBAL_CONFIG_FILE2);
   if (await context4.fs.exists(examplePath) && !await context4.fs.exists(globalConfigPath)) {
     await context4.fs.ensureDir(target);
     await context4.fs.writeFile(globalConfigPath, await context4.fs.readFile(examplePath));
@@ -103572,10 +104807,10 @@ function registerInitCommand(program2, context4, options = {}) {
     const minimal = options2.minimal === true;
     const adoptGlobal = options2.adoptGlobalConfig === true;
     const projectName = options2.name ?? "default";
-    const configPath = join27(context4.cwd, CLI_CONFIG.configFile);
+    const configPath = join30(context4.cwd, CLI_CONFIG.configFile);
     const result = { created: [], skipped: [] };
     const globalConfigDir = resolveGlobalConfigDir(context4);
-    const globalConfigPath = join27(globalConfigDir, GLOBAL_CONFIG_FILE2);
+    const globalConfigPath = join30(globalConfigDir, GLOBAL_CONFIG_FILE2);
     const globalConfigExists = await context4.fs.exists(globalConfigPath);
     let misplacedKeys = [];
     if (globalConfigExists) {
@@ -103588,20 +104823,20 @@ function registerInitCommand(program2, context4, options = {}) {
       const configRoot = bundledConfigRoot();
       if (configRoot !== null && !minimal) {
         for (const relPath of listBundledProjectSeedFiles()) {
-          const sourcePath = join27(configRoot, relPath);
+          const sourcePath = join30(configRoot, relPath);
           if (!await context4.fs.exists(sourcePath))
             continue;
-          const targetPath = join27(context4.cwd, CLI_CONFIG.configDir, relPath);
-          await context4.fs.ensureDir(join27(targetPath, ".."));
+          const targetPath = join30(context4.cwd, CLI_CONFIG.configDir, relPath);
+          await context4.fs.ensureDir(join30(targetPath, ".."));
           await writeIfNew(context4, targetPath, await context4.fs.readFile(sourcePath), false, result);
         }
         for (const entry of SCAFFOLD_MANIFEST) {
-          const sourcePath = join27(configRoot, entry.source);
+          const sourcePath = join30(configRoot, entry.source);
           if (!await context4.fs.exists(sourcePath))
             continue;
-          const baseDir = entry.root === true ? context4.cwd : join27(context4.cwd, CLI_CONFIG.configDir);
-          const targetPath = join27(baseDir, entry.target);
-          await context4.fs.ensureDir(join27(targetPath, ".."));
+          const baseDir = entry.root === true ? context4.cwd : join30(context4.cwd, CLI_CONFIG.configDir);
+          const targetPath = join30(baseDir, entry.target);
+          await context4.fs.ensureDir(join30(targetPath, ".."));
           const entryForce = false;
           let body = await context4.fs.readFile(sourcePath);
           if (entry.target === "AGENTS.md") {
@@ -103618,7 +104853,7 @@ function registerInitCommand(program2, context4, options = {}) {
         const backupPath = `${globalConfigPath}.bak-${new Date().toISOString().replace(/[:.]/g, "-")}`;
         await context4.fs.writeFile(backupPath, await context4.fs.readFile(globalConfigPath));
         const bundledRoot = bundledConfigRoot();
-        const examplePath = bundledRoot !== null ? join27(bundledRoot, GLOBAL_CONFIG_EXAMPLE) : null;
+        const examplePath = bundledRoot !== null ? join30(bundledRoot, GLOBAL_CONFIG_EXAMPLE) : null;
         if (examplePath !== null && await context4.fs.exists(examplePath)) {
           await context4.fs.writeFile(globalConfigPath, await context4.fs.readFile(examplePath));
           adoptedGlobal = true;
@@ -103688,13 +104923,13 @@ function registerInitCommand(program2, context4, options = {}) {
     ].join(`
 `)}
 `;
-    await context4.fs.ensureDir(join27(context4.cwd, CLI_CONFIG.configDir));
+    await context4.fs.ensureDir(join30(context4.cwd, CLI_CONFIG.configDir));
     await context4.fs.writeFile(configPath, configYaml);
     result.created.push(configPath);
-    const agentsDir = join27(context4.cwd, CLI_CONFIG.configDir, "agents");
+    const agentsDir = join30(context4.cwd, CLI_CONFIG.configDir, "agents");
     await context4.fs.ensureDir(agentsDir);
-    await writeIfNew(context4, join27(agentsDir, ".gitkeep"), "", force, result);
-    const gitignorePath = join27(context4.cwd, ".gitignore");
+    await writeIfNew(context4, join30(agentsDir, ".gitkeep"), "", force, result);
+    const gitignorePath = join30(context4.cwd, ".gitignore");
     const contextEntry = ".spur/context/";
     if (await context4.fs.exists(gitignorePath)) {
       const existing = await context4.fs.readFile(gitignorePath);
@@ -103714,20 +104949,20 @@ ${contextEntry}
       const configRoot = bundledConfigRoot();
       if (configRoot !== null) {
         for (const relPath of listBundledProjectSeedFiles()) {
-          const sourcePath = join27(configRoot, relPath);
+          const sourcePath = join30(configRoot, relPath);
           if (!await context4.fs.exists(sourcePath))
             continue;
-          const targetPath = join27(context4.cwd, CLI_CONFIG.configDir, relPath);
-          await context4.fs.ensureDir(join27(targetPath, ".."));
+          const targetPath = join30(context4.cwd, CLI_CONFIG.configDir, relPath);
+          await context4.fs.ensureDir(join30(targetPath, ".."));
           await writeIfNew(context4, targetPath, await context4.fs.readFile(sourcePath), force, result);
         }
         for (const entry of SCAFFOLD_MANIFEST) {
-          const sourcePath = join27(configRoot, entry.source);
+          const sourcePath = join30(configRoot, entry.source);
           if (!await context4.fs.exists(sourcePath))
             continue;
-          const baseDir = entry.root === true ? context4.cwd : join27(context4.cwd, CLI_CONFIG.configDir);
-          const targetPath = join27(baseDir, entry.target);
-          await context4.fs.ensureDir(join27(targetPath, ".."));
+          const baseDir = entry.root === true ? context4.cwd : join30(context4.cwd, CLI_CONFIG.configDir);
+          const targetPath = join30(baseDir, entry.target);
+          await context4.fs.ensureDir(join30(targetPath, ".."));
           const entryForce = entry.preserve === true ? false : force;
           let body = await context4.fs.readFile(sourcePath);
           if (entry.target === "AGENTS.md") {
@@ -103740,7 +104975,7 @@ ${contextEntry}
         }
       }
     }
-    const agentsMdPath = join27(context4.cwd, "AGENTS.md");
+    const agentsMdPath = join30(context4.cwd, "AGENTS.md");
     if (await context4.fs.exists(agentsMdPath)) {
       const existing = await context4.fs.readFile(agentsMdPath);
       if (!existing.includes(INDEXED_CONTEXT_MARKER)) {
@@ -103781,11 +105016,11 @@ ${contextEntry}
 // src/commands/maintain.ts
 init_src();
 init_src2();
-import { join as join28 } from "path";
+import { join as join31 } from "path";
 function registerMaintainCommand(program2, context4, options = {}) {
   program2.command("maintain", { hidden: options.hidden === true }).summary("run database maintenance (optimize, WAL checkpoint truncation, optional VACUUM)").description("Run database maintenance: PRAGMA optimize, WAL checkpoint truncation; optionally VACUUM compaction.").option("--vacuum", "Run VACUUM defragmentation and page compaction", false).option(...SHARED_OPTIONS.jsonSupported).option(...SHARED_OPTIONS.jsonEnvelope).action(async (options2) => {
     const db2 = await context4.getDb();
-    const dbPath = context4.env.DATABASE_URL ?? join28(context4.cwd, DEFAULT_DATABASE_URL);
+    const dbPath = context4.env.DATABASE_URL ?? join31(context4.cwd, DEFAULT_DATABASE_URL);
     const result = await maintainDatabase(db2, {
       vacuum: options2.vacuum === true,
       dbPath: dbPath.startsWith(":memory:") ? undefined : dbPath
@@ -104084,15 +105319,15 @@ async function runMessageWatch(svc, output2, options, runtime = {}) {
   }
 }
 function defaultSleep(ms, signal) {
-  return new Promise((resolve16) => {
+  return new Promise((resolve17) => {
     if (signal?.aborted) {
-      resolve16();
+      resolve17();
       return;
     }
-    const timer = setTimeout(resolve16, ms);
+    const timer = setTimeout(resolve17, ms);
     signal?.addEventListener("abort", () => {
       clearTimeout(timer);
-      resolve16();
+      resolve17();
     }, { once: true });
   });
 }
@@ -104119,15 +105354,15 @@ function parseTimeout2(raw) {
   return n3;
 }
 function sendSleep(ms, signal) {
-  return new Promise((resolve16) => {
+  return new Promise((resolve17) => {
     if (signal?.aborted) {
-      resolve16();
+      resolve17();
       return;
     }
-    const timer = setTimeout(resolve16, ms);
+    const timer = setTimeout(resolve17, ms);
     signal?.addEventListener("abort", () => {
       clearTimeout(timer);
-      resolve16();
+      resolve17();
     }, { once: true });
   });
 }
@@ -104185,10 +105420,10 @@ async function waitForPendingDrain(agentService, teamService, pin, timeoutMs, si
 
 // src/commands/migrate.ts
 init_src2();
-import { join as join29 } from "path";
+import { join as join32 } from "path";
 function registerMigrateCommand(program2, context4, options = {}) {
   program2.command("migrate", { hidden: options.hidden === true }).summary("apply CLI-owned schema migrations").option(...SHARED_OPTIONS.json).option(...SHARED_OPTIONS.jsonEnvelope).action(async (options2) => {
-    const migrations = await loadSqlMigrations(join29(context4.cwd, "drizzle")).catch(() => {
+    const migrations = await loadSqlMigrations(join32(context4.cwd, "drizzle")).catch(() => {
       return;
     });
     const applied = await applyCliMigrations(await context4.getDb(), migrations);
@@ -104200,12 +105435,12 @@ function registerMigrateCommand(program2, context4, options = {}) {
 // src/commands/projects.ts
 init_dist5();
 await init_src3();
-import { basename as basename10, resolve as resolve16 } from "path";
+import { basename as basename10, resolve as resolve17 } from "path";
 function registerProjectsCommand(program2, context4) {
   const projectsCmd = program2.command("projects").summary("manage the Spur multi-project registry");
   projectsCmd.command("add").argument("<path>", "Project root directory path").option(...SHARED_OPTIONS.nameProjectDisplay).option(...SHARED_OPTIONS.jsonProjectsResponse).option(...SHARED_OPTIONS.jsonEnvelope).action(async (pathArg, options) => {
     try {
-      const absolutePath = resolve16(context4.cwd, pathArg);
+      const absolutePath = resolve17(context4.cwd, pathArg);
       if (!await context4.fs.exists(absolutePath)) {
         throw new Error(`Directory does not exist: ${absolutePath}`);
       }
@@ -104627,7 +105862,7 @@ function formatTraceDetail(detail) {
 
 // src/commands/serve.ts
 init_src();
-import { join as join33 } from "path";
+import { join as join36 } from "path";
 
 // ../server/src/index.ts
 init_src();
@@ -104637,11 +105872,11 @@ init_src();
 init_loader();
 init_src2();
 await init_src3();
-import { basename as basename12, dirname as dirname20, isAbsolute as isAbsolute7, join as join32 } from "path";
+import { basename as basename12, dirname as dirname21, isAbsolute as isAbsolute8, join as join35 } from "path";
 init_dist5();
 
 // ../server/src/bootstrap.ts
-import { join as join30 } from "path";
+import { join as join33 } from "path";
 
 // ../../node_modules/.bun/radash@12.1.1/node_modules/radash/dist/esm/async.mjs
 var guard = (func, shouldGuard) => {
@@ -104914,8 +106149,8 @@ class EventPublisher {
       if (bufferedEvents.length > 0) {
         return { done: false, value: bufferedEvents.shift() };
       }
-      return new Promise((resolve17, reject) => {
-        pullResolvers.push([resolve17, reject]);
+      return new Promise((resolve18, reject) => {
+        pullResolvers.push([resolve18, reject]);
       });
     }, async () => {
       unsubscribe();
@@ -111108,6 +112343,93 @@ var taskContract = {
     tags: ["task"]
   }).input(taskActionInputSchema).output(taskActionResponseSchema)
 };
+// ../../packages/contracts/src/observability.ts
+init_zod();
+var observabilitySummaryKpisSchema = exports_external.object({
+  totalEvents: exports_external.number(),
+  activeJobs: exports_external.number(),
+  completedJobs: exports_external.number(),
+  failedJobs: exports_external.number(),
+  successRatePct: exports_external.number(),
+  errorEventCount: exports_external.number(),
+  warningEventCount: exports_external.number()
+});
+var observabilityVolumeBucketSchema = exports_external.object({
+  timestamp: exports_external.string(),
+  total: exports_external.number(),
+  byPrefix: exports_external.record(exports_external.string(), exports_external.number()),
+  bySeverity: exports_external.object({
+    info: exports_external.number(),
+    warning: exports_external.number(),
+    error: exports_external.number(),
+    unknown: exports_external.number()
+  })
+});
+var observabilityTopEventTypeSchema = exports_external.object({
+  name: exports_external.string(),
+  prefix: exports_external.string(),
+  count: exports_external.number(),
+  latestAt: exports_external.string()
+});
+var observabilityRecentErrorSchema = exports_external.object({
+  id: exports_external.string(),
+  source: exports_external.enum(["event", "job"]),
+  name: exports_external.string(),
+  occurredAt: exports_external.string(),
+  message: exports_external.string(),
+  refId: exports_external.string().optional()
+});
+var observabilitySummaryResponseSchema = exports_external.object({
+  window: exports_external.object({
+    since: exports_external.string(),
+    until: exports_external.string(),
+    range: exports_external.string()
+  }),
+  kpis: observabilitySummaryKpisSchema,
+  eventVolumeBuckets: exports_external.array(observabilityVolumeBucketSchema),
+  topEventTypes: exports_external.array(observabilityTopEventTypeSchema),
+  recentErrors: exports_external.array(observabilityRecentErrorSchema)
+});
+var queueJobStatusSchema = exports_external.enum(["pending", "processing", "completed", "failed"]);
+var queueJobRowSchema = exports_external.object({
+  id: exports_external.string(),
+  type: exports_external.string(),
+  status: queueJobStatusSchema,
+  attempts: exports_external.number(),
+  maxRetries: exports_external.number(),
+  queuedAt: exports_external.string(),
+  startedAt: exports_external.string().nullable(),
+  endedAt: exports_external.string().nullable(),
+  durationMs: exports_external.number().nullable(),
+  lastError: exports_external.string().nullable(),
+  payload: exports_external.record(exports_external.string(), exports_external.unknown()).nullable()
+});
+var queueJobStatusCountsSchema = exports_external.object({
+  all: exports_external.number(),
+  pending: exports_external.number(),
+  processing: exports_external.number(),
+  completed: exports_external.number(),
+  failed: exports_external.number()
+});
+var queueJobListResponseSchema = exports_external.object({
+  jobs: exports_external.array(queueJobRowSchema),
+  total: exports_external.number(),
+  hasMore: exports_external.boolean(),
+  countsByStatus: queueJobStatusCountsSchema
+});
+var schedulerLastStatusSchema = exports_external.enum(["completed", "failed", "processing", "none"]);
+var schedulerScheduleRowSchema = exports_external.object({
+  name: exports_external.string(),
+  cron: exports_external.string(),
+  cadence: exports_external.string(),
+  nextFireAt: exports_external.string().nullable(),
+  lastFiredAt: exports_external.string().nullable(),
+  lastStatus: schedulerLastStatusSchema,
+  source: exports_external.enum(["builtin", "config"])
+});
+var schedulerSchedulesResponseSchema = exports_external.object({
+  schedules: exports_external.array(schedulerScheduleRowSchema)
+});
 
 // ../../packages/contracts/src/index.ts
 var healthResponseSchema = exports_external.object({
@@ -111374,6 +112696,18 @@ var historyModule = {
   mount(_app, _ctx) {}
 };
 
+// ../server/src/modules/jobs/index.ts
+init_src2();
+
+// ../server/src/modules/jobs/schedule-registry.ts
+var registeredSchedules = [];
+function setRegisteredSchedules(entries) {
+  registeredSchedules = [...entries];
+}
+function getRegisteredSchedules() {
+  return [...registeredSchedules];
+}
+
 // ../server/src/modules/jobs/index.ts
 var jobsModule = {
   name: "jobs",
@@ -111385,6 +112719,100 @@ var jobsModule = {
       const stats = await queue.stats();
       return c3.json({ stats });
     });
+    app.get("/api/jobs", async (c3) => {
+      try {
+        const statusParam = c3.req.query("status");
+        const sinceParam = c3.req.query("since");
+        const limitParam = c3.req.query("limit");
+        const offsetParam = c3.req.query("offset");
+        const validStatuses = ["pending", "processing", "completed", "failed"];
+        let status;
+        if (statusParam !== undefined && statusParam !== "") {
+          if (!validStatuses.includes(statusParam)) {
+            return c3.json({
+              error: `unknown status: "${statusParam}", expected one of: ${validStatuses.join(", ")}`,
+              code: "VALIDATION_FAILED"
+            }, 400);
+          }
+          status = statusParam;
+        }
+        let limit = 100;
+        if (limitParam !== undefined && limitParam !== "") {
+          const parsedLimit = Number(limitParam);
+          if (!Number.isNaN(parsedLimit)) {
+            limit = Math.min(500, Math.max(1, parsedLimit));
+          }
+        }
+        let offset = 0;
+        if (offsetParam !== undefined && offsetParam !== "") {
+          const parsedOffset = Number(offsetParam);
+          if (!Number.isNaN(parsedOffset)) {
+            offset = Math.max(0, parsedOffset);
+          }
+        }
+        const db2 = await ctx.getDb();
+        const result = await queryQueueJobs(db2, {
+          status,
+          since: sinceParam,
+          limit,
+          offset
+        });
+        return c3.json(result);
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        return c3.json({ error: message }, 500);
+      }
+    });
+    app.get("/api/jobs/schedules", async (c3) => {
+      try {
+        const registrations = getRegisteredSchedules();
+        const db2 = await ctx.getDb();
+        const now2 = Date.now();
+        const schedules = await Promise.all(registrations.map(async (reg) => {
+          const matchingRow = await queryScheduleLastExecution(db2, reg.source, reg.name);
+          const lastFiredAt = matchingRow ? new Date(matchingRow.updated_at).toISOString() : null;
+          let lastStatus = "none";
+          if (matchingRow) {
+            lastStatus = matchingRow.status === "pending" ? "processing" : matchingRow.status;
+          }
+          const intervalMs = Number(reg.schedule);
+          const isInterval = !Number.isNaN(intervalMs) && intervalMs > 0 && /^\d+$/.test(reg.schedule);
+          let nextFireAt = null;
+          let cadence = reg.schedule;
+          if (isInterval) {
+            const elapsed = Math.max(0, now2 - reg.registeredAt);
+            const steps = Math.ceil(elapsed / intervalMs);
+            const nextTime = reg.registeredAt + (steps === 0 ? 1 : steps) * intervalMs;
+            const resolvedNextTime = nextTime <= now2 ? nextTime + intervalMs : nextTime;
+            nextFireAt = new Date(resolvedNextTime).toISOString();
+            if (intervalMs >= 60000 && intervalMs % 60000 === 0) {
+              cadence = `every ${intervalMs / 60000} minutes`;
+            } else if (intervalMs >= 1000 && intervalMs % 1000 === 0) {
+              cadence = `every ${intervalMs / 1000} seconds`;
+            } else {
+              cadence = `every ${intervalMs} ms`;
+            }
+          } else {
+            nextFireAt = null;
+            cadence = reg.schedule;
+          }
+          const row = {
+            name: reg.name,
+            cron: reg.schedule,
+            cadence,
+            nextFireAt,
+            lastFiredAt,
+            lastStatus,
+            source: reg.source
+          };
+          return row;
+        }));
+        return c3.json({ schedules });
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        return c3.json({ error: message }, 500);
+      }
+    });
   }
 };
 
@@ -111626,6 +113054,96 @@ function handleRoutingSummary(ctx) {
     }
   };
 }
+function handleObservabilitySummary(ctx) {
+  return async (c3) => {
+    try {
+      const sinceParam = c3.req.query("since");
+      const untilParam = c3.req.query("until");
+      const bucketParam = c3.req.query("bucket");
+      let untilMs = Date.now();
+      if (untilParam !== undefined && untilParam !== "") {
+        untilMs = Date.parse(untilParam);
+        if (Number.isNaN(untilMs)) {
+          return c3.json({
+            error: `malformed until: "${untilParam}" is not a valid ISO timestamp`,
+            code: "MALFORMED_TIMESTAMP"
+          }, 400);
+        }
+      }
+      let sinceMs = untilMs - 14400000;
+      if (sinceParam !== undefined && sinceParam !== "") {
+        sinceMs = Date.parse(sinceParam);
+        if (Number.isNaN(sinceMs)) {
+          return c3.json({
+            error: `malformed since: "${sinceParam}" is not a valid ISO timestamp`,
+            code: "MALFORMED_TIMESTAMP"
+          }, 400);
+        }
+      }
+      if (untilMs < sinceMs) {
+        return c3.json({
+          error: "until timestamp must not precede since timestamp",
+          code: "MALFORMED_RANGE"
+        }, 400);
+      }
+      let bucketMs;
+      if (bucketParam !== undefined && bucketParam !== "") {
+        const parsed = Number(bucketParam);
+        if (!Number.isNaN(parsed) && parsed > 0) {
+          bucketMs = parsed;
+        }
+      }
+      const since = new Date(sinceMs).toISOString();
+      const until = new Date(untilMs).toISOString();
+      const dao2 = await ctx.systemEventDao();
+      const db2 = await ctx.getDb();
+      const [eventSummary, jobKpis] = await Promise.all([
+        dao2.eventSummary({ since, until, bucketMs }),
+        queueJobKpis(db2, sinceMs, untilMs)
+      ]);
+      const combinedErrors = [
+        ...eventSummary.recentErrors.map((e) => ({
+          id: e.id,
+          source: "event",
+          name: e.name,
+          occurredAt: e.occurredAt,
+          message: e.message,
+          ...e.refId ? { refId: e.refId } : {}
+        })),
+        ...jobKpis.recentJobErrors.map((j) => ({
+          id: j.id,
+          source: "job",
+          name: j.name,
+          occurredAt: j.occurredAt,
+          message: j.message
+        }))
+      ].sort((a2, b) => Date.parse(b.occurredAt) - Date.parse(a2.occurredAt)).slice(0, 10);
+      const payload = {
+        window: {
+          since,
+          until,
+          range: c3.req.query("range") ?? "custom"
+        },
+        kpis: {
+          totalEvents: eventSummary.totalEvents,
+          activeJobs: jobKpis.activeJobs,
+          completedJobs: jobKpis.completedJobs,
+          failedJobs: jobKpis.failedJobs,
+          successRatePct: jobKpis.successRatePct,
+          errorEventCount: eventSummary.errorEventCount,
+          warningEventCount: eventSummary.warningEventCount
+        },
+        eventVolumeBuckets: eventSummary.eventVolumeBuckets,
+        topEventTypes: eventSummary.topEventTypes,
+        recentErrors: combinedErrors
+      };
+      return c3.json(payload);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      return c3.json({ error: message }, 500);
+    }
+  };
+}
 var observabilityModule = {
   name: "observability",
   mount(app, ctx) {
@@ -111635,6 +113153,7 @@ var observabilityModule = {
     app.get("/api/observability/tool-use", handleToolUseGet(ctx));
     app.get("/api/observability/tool-use/stream", handleToolUseStream(ctx));
     app.get("/api/observability/routing-summary", handleRoutingSummary(ctx));
+    app.get("/api/observability/summary", handleObservabilitySummary(ctx));
   }
 };
 
@@ -114062,7 +115581,7 @@ function createApp(appRt, opts) {
     app.use("*", async (c3, next) => {
       const pathname = c3.req.path === "/" ? "/index.html" : c3.req.path;
       try {
-        const file2 = Bun.file(join30(webDistPath, pathname));
+        const file2 = Bun.file(join33(webDistPath, pathname));
         if (await file2.exists()) {
           const headers = new Headers({ "content-type": file2.type });
           return new Response(file2.stream(), { headers });
@@ -114075,7 +115594,7 @@ function createApp(appRt, opts) {
         return c3.json({ error: "Not Found" }, 404);
       }
       try {
-        const indexFile = Bun.file(join30(webDistPath, "index.html"));
+        const indexFile = Bun.file(join33(webDistPath, "index.html"));
         if (await indexFile.exists()) {
           return new Response(indexFile.stream(), {
             headers: { "content-type": "text/html; charset=utf-8" }
@@ -114096,7 +115615,7 @@ init_src();
 init_src2();
 init_dist5();
 await init_src3();
-import { dirname as dirname19, join as join31 } from "path";
+import { dirname as dirname20, join as join34 } from "path";
 var NOOP_OUTPUT = { write: (_s) => {}, error: (_s) => {} };
 
 class LazyPlanningEventEmitter {
@@ -114132,7 +115651,7 @@ class NotConfiguredError extends Error {
 function createServerContext(appRt, options) {
   const cwd = options.cwd;
   const fs3 = options.fs;
-  const dbUrl = options.dbUrl ?? join31(cwd, DEFAULT_DATABASE_URL);
+  const dbUrl = options.dbUrl ?? join34(cwd, DEFAULT_DATABASE_URL);
   const eventsBus = options.eventsBus ?? appRt.events;
   const jobQueueEnabled = options.jobQueueEnabled ?? false;
   const eventProjectContext = systemEventProjectContext(cwd);
@@ -114170,7 +115689,7 @@ function createServerContext(appRt, options) {
       if (!dbPromise) {
         const created = (async () => {
           if (dbUrl !== IN_MEMORY_DATABASE_URL) {
-            await fs3.ensureDir(dirname19(dbUrl));
+            await fs3.ensureDir(dirname20(dbUrl));
           }
           return createMigratedDbViaRuntime({ url: dbUrl });
         })();
@@ -114418,7 +115937,7 @@ async function loadServerSectionMatrix() {
   }
   const root = bundledConfigRoot();
   if (root !== null) {
-    const matrixPath = join32(root, "tasks", "section-matrix.yaml");
+    const matrixPath = join35(root, "tasks", "section-matrix.yaml");
     if (await nodeFs.exists(matrixPath)) {
       return await loadStructuredSpurConfig(matrixPath, {
         validateJsonSchema: false
@@ -114427,7 +115946,7 @@ async function loadServerSectionMatrix() {
   }
   throw new Error(`no canonical section-matrix found for task creation (F92 R1); tried:
 ` + `  - ${localPath}
-` + (root !== null ? `  - ${join32(root, "tasks", "section-matrix.yaml")}
+` + (root !== null ? `  - ${join35(root, "tasks", "section-matrix.yaml")}
 ` : "") + "copy/generate section-matrix.yaml from the canonical build-time matrix asset (repo `config` `tasks` tree) into one of those paths");
 }
 var SYSTEM_EVENTS_PRUNE_JOB = "system-events-prune";
@@ -114446,6 +115965,8 @@ var defaultDeps = {
   resolveConfigFile
 };
 function registerSchedulerEntries(scheduler3, ctx, jobs = []) {
+  const registrations = [];
+  const now2 = Date.now();
   const register = (cron, name, action) => {
     scheduler3.register(cron, async () => {
       const startedAt2 = Date.now();
@@ -114469,17 +115990,48 @@ function registerSchedulerEntries(scheduler3, ctx, jobs = []) {
     const queue = await ctx.jobQueue();
     await queue.enqueue(SYSTEM_EVENTS_PRUNE_JOB, { source: "scheduler" }, { maxRetries: 1 });
   });
+  registrations.push({
+    name: SYSTEM_EVENTS_PRUNE_JOB,
+    schedule: SYSTEM_EVENTS_PRUNE_CRON,
+    source: "builtin",
+    registeredAt: now2
+  });
   register(SMOKE_CRON, SMOKE_JOB, async () => {
     const queue = await ctx.jobQueue();
     await queue.enqueue(SMOKE_JOB, { source: "scheduler" }, { maxRetries: 1 });
   });
+  registrations.push({
+    name: SMOKE_JOB,
+    schedule: SMOKE_CRON,
+    source: "builtin",
+    registeredAt: now2
+  });
   for (const job of jobs) {
     const schedule = job.cron ?? String(job.intervalMinutes * 60000);
     register(schedule, `${SCHEDULER_CUSTOM_JOB}:${job.name}`, async () => {
       const queue = await ctx.jobQueue();
+      const db2 = await ctx.getDb();
+      const active = await findActiveSchedulerCustomJob(db2, job.name);
+      if (active !== undefined) {
+        ctx.eventBus().emit("scheduler.job.executed", {
+          name: `${SCHEDULER_CUSTOM_JOB}:${job.name}`,
+          durationMs: 0,
+          severity: "info",
+          skipped: true,
+          reason: `active job ${active.id} already exists`
+        });
+        return;
+      }
       await queue.enqueue(SCHEDULER_CUSTOM_JOB, { name: job.name, command: job.command });
     });
+    registrations.push({
+      name: job.name,
+      schedule,
+      source: "config",
+      registeredAt: now2
+    });
   }
+  setRegisteredSchedules(registrations);
 }
 function parseTaskActionJob(payload) {
   if (typeof payload !== "object" || payload === null) {
@@ -114565,15 +116117,15 @@ async function handleFeatureActionJob(ctx, env, payload) {
   await runFeatureActionJob(ctx, env, payload);
 }
 async function resolveWebDistPath(configuredPath) {
-  const candidates = configuredPath && configuredPath.trim() !== "" ? [isAbsolute7(configuredPath) ? configuredPath : join32(process.cwd(), configuredPath)] : [
-    join32(process.cwd(), "dist/web"),
-    join32(import.meta.dir, "web"),
-    join32(dirname20(process.execPath), "web"),
-    join32(dirname20(process.execPath), "../web"),
-    join32(import.meta.dir, "../../../dist/web")
+  const candidates = configuredPath && configuredPath.trim() !== "" ? [isAbsolute8(configuredPath) ? configuredPath : join35(process.cwd(), configuredPath)] : [
+    join35(process.cwd(), "dist/web"),
+    join35(import.meta.dir, "web"),
+    join35(dirname21(process.execPath), "web"),
+    join35(dirname21(process.execPath), "../web"),
+    join35(import.meta.dir, "../../../dist/web")
   ];
   for (const candidate of candidates) {
-    if (await Bun.file(join32(candidate, "index.html")).exists()) {
+    if (await Bun.file(join35(candidate, "index.html")).exists()) {
       return candidate;
     }
   }
@@ -114589,7 +116141,7 @@ async function startServer(options, deps = defaultDeps) {
     async start(appRt) {
       const fs3 = deps.createNodeFileSystem(process.cwd());
       if (options.dbUrl && options.dbUrl !== IN_MEMORY_DATABASE_URL) {
-        await fs3.ensureDir(dirname20(options.dbUrl));
+        await fs3.ensureDir(dirname21(options.dbUrl));
       }
       const scheduler3 = appRt.config.scheduler.enabled ? appRt.scheduler : undefined;
       const webDistPath = await resolveWebDistPath(options.webDistPath);
@@ -114659,6 +116211,12 @@ async function startServer(options, deps = defaultDeps) {
           executor: childExecutor
         }, job));
         registry2.register(SCHEDULER_CUSTOM_JOB, (job) => handleSchedulerCustomJob({ cwd: ctx.cwd, executor: childExecutor }, job));
+        const orphanCount = await failOrphanedProcessingJobs(await ctx.getDb(), Date.now());
+        if (orphanCount > 0) {
+          appRt.logger.warn("Swept orphaned processing jobs at startup", {
+            count: orphanCount
+          });
+        }
         jobWorker = new JobWorkerService({
           consumer: await ctx.queueConsumer(),
           registry: registry2
@@ -114724,11 +116282,11 @@ async function startServer(options, deps = defaultDeps) {
       if (options.openBrowser) {
         await deps.openUrl(webDistPath ? `${url2}/board` : `${url2}/api/health`);
       }
-      if (options.keepAlive !== false) {
-        await new Promise(() => {});
-      }
     }
   });
+  if (options.keepAlive !== false) {
+    await new Promise(() => {});
+  }
 }
 // ../server/src/worker-app.ts
 var startedAt2 = Date.now();
@@ -114737,7 +116295,7 @@ if (false) {}
 
 // src/commands/serve.ts
 function resolveServeDbUrl(cwd, env, configuredUrl) {
-  return env.DATABASE_URL === undefined ? join33(cwd, DEFAULT_DATABASE_URL) : configuredUrl;
+  return env.DATABASE_URL === undefined ? join36(cwd, DEFAULT_DATABASE_URL) : configuredUrl;
 }
 function registerServeCommand(program2, context4, options = {}) {
   program2.command("serve", { hidden: options.hidden === true }).summary("start the Spur web server (local fallback)").option(...SHARED_OPTIONS.portServe, parseInt).option("--host <addr>", "Bind address (env: HOST, default: localhost)").option("--no-open", "Skip opening the browser").option(...SHARED_OPTIONS.cwdServe, context4.cwd).option(...SHARED_OPTIONS.jsonServePortUrl).option(...SHARED_OPTIONS.jsonEnvelope).action(async (options2) => {
@@ -114777,7 +116335,7 @@ function registerServeCommand(program2, context4, options = {}) {
 }
 
 // src/commands/status.ts
-import { join as join34 } from "path";
+import { join as join37 } from "path";
 
 // src/errors.ts
 class CommandError extends Error {
@@ -114848,8 +116406,8 @@ function registerStatusCommand(program2, context4, options = {}) {
 }
 async function runStatusCore(path9, options, context4) {
   const [packageJsonExists, spurConfigExists, git3, agentSpecs] = await Promise.all([
-    context4.fs.exists(join34(context4.cwd, "package.json")),
-    context4.fs.exists(join34(context4.cwd, ".spur", "config.yaml")),
+    context4.fs.exists(join37(context4.cwd, "package.json")),
+    context4.fs.exists(join37(context4.cwd, ".spur", "config.yaml")),
     gitContext(context4.cwd),
     listAgentSpecIds(context4)
   ]);
@@ -114877,14 +116435,14 @@ async function runStatusCore(path9, options, context4) {
   return status.ok ? 0 : 1;
 }
 async function listAgentSpecIds(context4) {
-  const dir = join34(context4.cwd, ".spur", "agents");
+  const dir = join37(context4.cwd, ".spur", "agents");
   if (!await context4.fs.exists(dir))
     return [];
   const entries = await context4.fs.readDir(dir);
   return entries.filter((entry) => entry.endsWith(".yaml") || entry.endsWith(".yml")).map((entry) => entry.replace(/\.ya?ml$/, "")).sort();
 }
 async function readTargetStatus(context4, targetPath) {
-  const resolved = join34(context4.cwd, targetPath);
+  const resolved = join37(context4.cwd, targetPath);
   const stat = await context4.fs.stat(resolved);
   if (stat === null)
     throw new CommandError(`status failed: path does not exist at ${resolved}`);
@@ -114897,7 +116455,9 @@ init_src2();
 init_dist5();
 await init_src3();
 import { existsSync as existsSync11, readFileSync as readFileSync11 } from "fs";
-import { dirname as dirname21, join as join35 } from "path";
+import { rm, writeFile } from "fs/promises";
+import { tmpdir as tmpdir3 } from "os";
+import { dirname as dirname22, join as join38 } from "path";
 // schemas/section-matrix.schema.json
 var section_matrix_schema_default = {
   $schema: "http://json-schema.org/draft-07/schema#",
@@ -115832,16 +117392,33 @@ function renderMigrationReport(report, dryRun, corpusDir) {
   return lines.join(`
 `);
 }
+function writeCreateJsonError(context4, options, code, message, extra) {
+  const text4 = typeof message === "string" ? message : String(message);
+  if (options.json === true) {
+    const bare = text4.startsWith("Error: ") ? text4.slice("Error: ".length) : text4;
+    context4.output.write(toEnvelopeJson({ ok: false, error: { code, message: bare, ...extra ?? {} } }, {
+      enveloped: options.jsonEnvelope,
+      error: { code: "INTERNAL_ERROR", message: bare, details: { cliCode: code, ...extra ?? {} } }
+    }));
+  } else {
+    context4.output.error(text4.startsWith("Error: ") ? text4.slice("Error: ".length) : text4);
+  }
+}
 function registerTaskCommand(program2, context4) {
   const task = program2.command("task").summary("manage tasks");
-  task.command("create").summary("Create a new task with race-safe WBS allocation.").argument("<title>", "Task title").option(...SHARED_OPTIONS.featureTrace).option("--parent <wbs>", "Parent WBS for sub-task grouping").option("--template <variant>", `Template variant (${TASK_VARIANTS.join("|")})`).option(...SHARED_OPTIONS.folderTasks).option("--dedupe-within <seconds>", "Override the default dedup window (seconds). Guard is on (300s) by default when --feature is set.", Number).option("--allow-duplicate-name", "Disable the dedup guard entirely (creates anyway)").option(...SHARED_OPTIONS.json).option(...SHARED_OPTIONS.jsonEnvelope).action(async (title2, options) => {
+  task.command("create").summary("Create a new task with race-safe WBS allocation.").argument("<title>", "Task title").option(...SHARED_OPTIONS.featureTrace).option("--parent <wbs>", "Parent WBS for sub-task grouping").option("--template <variant>", `Template variant (${TASK_VARIANTS.join("|")})`).option(...SHARED_OPTIONS.folderTasks).option("--dedupe-within <seconds>", "Override the default dedup window (seconds). Guard is on (300s) by default when --feature is set.", Number).option("--allow-duplicate-name", "Disable the dedup guard entirely (creates anyway)").option("--skip-ready", "Skip ready preparation (backlog capture only, no model dispatch)").option("--agent <selector>", "Agent used for ready preparation (defaults to the configured agent)").option(...SHARED_OPTIONS.json).option(...SHARED_OPTIONS.jsonEnvelope).action(async (title2, options) => {
     if (options.template !== undefined && !TASK_VARIANTS.includes(options.template)) {
-      writeJsonError(context4.output, options, `Unknown template variant "${options.template}". Valid: ${TASK_VARIANTS.join(", ")}`, "VALIDATION_FAILED");
+      writeCreateJsonError(context4, options, "invalid-usage", `Unknown template variant "${options.template}". Valid: ${TASK_VARIANTS.join(", ")}`);
+      context4.setExitCode(2);
+      return;
+    }
+    if (options.skipReady === true && options.agent !== undefined) {
+      writeCreateJsonError(context4, options, "invalid-usage", "--agent has no effect with --skip-ready (no preparation runs)");
       context4.setExitCode(2);
       return;
     }
     if (options.dedupeWithin !== undefined && (!Number.isInteger(options.dedupeWithin) || options.dedupeWithin <= 0)) {
-      writeJsonError(context4.output, options, "--dedupe-within must be a positive integer", "VALIDATION_FAILED");
+      writeCreateJsonError(context4, options, "invalid-usage", "--dedupe-within must be a positive integer");
       context4.setExitCode(2);
       return;
     }
@@ -115854,10 +117431,25 @@ function registerTaskCommand(program2, context4) {
         template: options.template,
         dedupeWithinSec: options.allowDuplicateName ? null : options.dedupeWithin
       });
+      let readiness = READY_SKIPPED;
+      if (options.skipReady !== true) {
+        const checkSvc = await makeCheckService(context4);
+        readiness = await prepareCreatedTaskReady({
+          wbs: result.ref.id,
+          tasks: svc,
+          agents: context4.agentService(),
+          checkTask: (filePath, wbs) => checkSvc.check(filePath, wbs, { asStatus: "todo" }),
+          agentSelector: options.agent,
+          cwd: context4.cwd
+        });
+      }
       if (options.json) {
-        context4.output.write(toEnvelopeJson({ ...result, wbs: result.ref.id, filePath: result.ref.filePath }, { enveloped: options.jsonEnvelope }));
+        context4.output.write(toEnvelopeJson({ ...result, wbs: result.ref.id, filePath: result.ref.filePath, ...readiness }, { enveloped: options.jsonEnvelope }));
       } else {
         context4.output.write(`Created task ${result.ref.id}: ${result.ref.filePath}`);
+        if (readiness.readiness.status === "ready") {
+          context4.output.write(`Ready: checklist + post-check passed (${result.ref.id} promoted to todo)`);
+        }
       }
     } catch (err) {
       if (err instanceof WbsCollisionError) {
@@ -115916,8 +117508,25 @@ function registerTaskCommand(program2, context4) {
           context4.output.error(err.message);
         }
         context4.setExitCode(3);
+      } else if (err instanceof TaskCandidateInvalidError) {
+        writeCreateJsonError(context4, options, "candidate-invalid", err.message, {
+          findings: err.findings
+        });
+        context4.setExitCode(1);
+      } else if (err instanceof TaskPreparationError) {
+        const message = !options.json && err.recoveryCommand !== undefined ? `${err.message}
+Recover with: ${err.recoveryCommand}` : err.message;
+        writeCreateJsonError(context4, options, "preparation-failed", message, {
+          wbs: err.wbs,
+          filePath: err.filePath,
+          failedStage: err.stage,
+          ...err.recoveryCommand !== undefined ? { recoveryCommand: err.recoveryCommand } : {},
+          ...err.findings !== undefined ? { findings: err.findings } : {},
+          readiness: { status: "failed", depth: "ready" }
+        });
+        context4.setExitCode(1);
       } else {
-        writeJsonError(context4.output, options, String(err));
+        writeCreateJsonError(context4, options, "create-failed", String(err));
         context4.setExitCode(1);
       }
     }
@@ -115999,7 +117608,7 @@ ${result.content}`);
         let forcedDoneVerdict;
         if (status === "done") {
           const current = await svc.show(wbs);
-          const verdictDir = options.verdictDir ?? join35(context4.cwd, ".spur", "run");
+          const verdictDir = options.verdictDir ?? join38(context4.cwd, ".spur", "run");
           const loaded = await readVerdictArtifact(context4.fs, verdictDir, wbs);
           const guardOutcome = evaluateDoneTransition({
             wbs,
@@ -116235,7 +117844,7 @@ ${result.content}`);
         dryRun,
         projectRoot: context4.cwd,
         write: async (filePath, wbs, section, newBody) => {
-          const ref = { kind: "task", id: wbs, filePath, folder: dirname21(filePath) };
+          const ref = { kind: "task", id: wbs, filePath, folder: dirname22(filePath) };
           const ws = new PlanningWriteService({ fs: context4.fs, emitter: makePlanningEmitter(context4) });
           await ws.updateSection(ref, section, newBody);
         }
@@ -116289,13 +117898,36 @@ ${result.content}`);
       context4.setExitCode(1);
     }
   });
-  task.command("batch-create").summary("Create many tasks from a validated JSON file \u2014 all-or-nothing (LLM\u2192CLI gate).").requiredOption(...SHARED_OPTIONS.fileTaskBatch).option(...SHARED_OPTIONS.folderTasks).option(...SHARED_OPTIONS.json).option(...SHARED_OPTIONS.jsonEnvelope).action(async (options) => {
+  task.command("batch-create").summary("Create many tasks from a validated JSON file \u2014 all-or-nothing (LLM\u2192CLI gate).").requiredOption(...SHARED_OPTIONS.fileTaskBatch).option("--skip-ready", "Skip ready preparation (write supplied content as-is, no model dispatch)").option("--agent <selector>", "Agent used for ready preparation (defaults to the configured agent)").option(...SHARED_OPTIONS.folderTasks).option(...SHARED_OPTIONS.json).option(...SHARED_OPTIONS.jsonEnvelope).action(async (options) => {
+    if (options.skipReady === true && options.agent !== undefined) {
+      writeCreateJsonError(context4, options, "invalid-usage", "--agent has no effect with --skip-ready (no preparation runs)");
+      context4.setExitCode(2);
+      return;
+    }
     const svc = await makeService2(context4, options.folder);
+    let tmpPath;
     try {
-      const { children, parentsWired } = await svc.batchCreate(options.file);
+      let batchFile = options.file;
+      let readiness = READY_SKIPPED;
+      if (options.skipReady !== true) {
+        const batchSource = await context4.fs.readFile(options.file);
+        const prepared = await prepareBatchTaskReady({
+          batchPath: options.file,
+          batchSource,
+          agents: context4.agentService(),
+          agentSelector: options.agent,
+          cwd: context4.cwd
+        });
+        tmpPath = join38(tmpdir3(), `spur-ready-batch-${Date.now()}-${Math.random().toString(36).slice(2, 8)}.json`);
+        await writeFile(tmpPath, `${JSON.stringify(prepared.items, null, 2)}
+`);
+        batchFile = tmpPath;
+        readiness = READY_DONE;
+      }
+      const { children, parentsWired } = await svc.batchCreate(batchFile);
       if (options.json) {
         const ids = children.map((r2) => r2.ref.id);
-        context4.output.write(toEnvelopeJson({ created: children.length, wbs: ids, parentsWired }, { enveloped: options.jsonEnvelope }));
+        context4.output.write(toEnvelopeJson({ created: children.length, wbs: ids, parentsWired, ...readiness }, { enveloped: options.jsonEnvelope }));
       } else {
         context4.output.write(`Created ${children.length} task(s)`);
         for (const r2 of children) {
@@ -116311,7 +117943,16 @@ ${result.content}`);
         }
       }
     } catch (err) {
-      if (err instanceof WbsCollisionError) {
+      if (err instanceof TaskPreparationError) {
+        const message = !options.json && err.recoveryCommand !== undefined ? `${err.message}
+Recover with: ${err.recoveryCommand}` : err.message;
+        writeCreateJsonError(context4, options, "preparation-failed", message, {
+          failedStage: err.stage,
+          ...err.recoveryCommand !== undefined ? { recoveryCommand: err.recoveryCommand } : {},
+          readiness: { status: "failed", depth: "ready" }
+        });
+        context4.setExitCode(1);
+      } else if (err instanceof WbsCollisionError) {
         if (options.json) {
           context4.output.write(toEnvelopeJson({
             ok: false,
@@ -116339,10 +117980,19 @@ ${result.content}`);
           context4.output.error(err.message);
         }
         context4.setExitCode(3);
+      } else if (err instanceof TaskCandidateInvalidError) {
+        writeCreateJsonError(context4, options, "candidate-invalid", err.message, {
+          findings: err.findings
+        });
+        context4.setExitCode(1);
       } else {
-        writeJsonError(context4.output, options, String(err));
+        writeCreateJsonError(context4, options, "batch-create-failed", String(err));
         context4.setExitCode(1);
       }
+    } finally {
+      if (tmpPath !== undefined) {
+        await rm(tmpPath, { force: true }).catch(() => {});
+      }
     }
   });
   task.command("record").summary("Record pipeline results into the task file \u2014 Testing, Review, and optional Solution backfill.").argument("<wbs>", "Task WBS number").option("--verdict-file <path>", "Path to verdict JSON (default: .spur/run/<wbs>-verdict.json)").option("--solution-from-diff", "Backfill Solution from git diff when bare").option("--transition <status>", "Optional lifecycle transition (e.g. testing)").option(...SHARED_OPTIONS.folderTasks).option(...SHARED_OPTIONS.json).option(...SHARED_OPTIONS.jsonEnvelope).action(async (wbs, options) => {
@@ -116549,9 +118199,8 @@ ${result.wbs} (${result.status}): ${result.pass ? "PASS" : "FAIL"}`);
           const msg = `Duplicate WBS ${first.wbs} found in ${dup.length} files:
 ` + dup.map((h2) => `  ${h2.filePath}`).join(`
 `);
-          if (json3) {
-            results.push({ wbs: first.wbs, pass: false, status: "duplicate", findings: [msg] });
-          } else {
+          results.push({ wbs: first.wbs, pass: false, status: "duplicate", findings: [msg] });
+          if (!json3) {
             context4.output.error(msg);
           }
         }
@@ -116682,13 +118331,13 @@ function loadTemplateBodies(projectRoot, variant) {
   if (cached2 !== undefined)
     return cached2;
   let bodies = {};
-  const localPath = join35(projectRoot, ".spur", "tasks", "templates", `${variant}.md`);
+  const localPath = join38(projectRoot, ".spur", "tasks", "templates", `${variant}.md`);
   if (existsSync11(localPath)) {
     bodies = extractTemplateBodies(readFileSync11(localPath, "utf8"));
   } else {
     const root = bundledConfigRoot();
     if (root !== null) {
-      const templatePath = join35(root, "templates", "task", `${variant}.md`);
+      const templatePath = join38(root, "templates", "task", `${variant}.md`);
       if (existsSync11(templatePath)) {
         bodies = extractTemplateBodies(readFileSync11(templatePath, "utf8"));
       }
@@ -116746,7 +118395,7 @@ async function loadSectionMatrixUncached(projectRoot) {
   }
   const root = bundledConfigRoot();
   if (root !== null) {
-    const matrixPath = join35(root, "tasks", "section-matrix.yaml");
+    const matrixPath = join38(root, "tasks", "section-matrix.yaml");
     if (await fs3.exists(matrixPath)) {
       const data = await loadStructuredSpurConfig(matrixPath, {
         validateJsonSchema: true,
@@ -116757,7 +118406,7 @@ async function loadSectionMatrixUncached(projectRoot) {
   }
   throw new Error(`no canonical section-matrix found for task section authority (F92 R1); tried:
 ` + `  - ${localPath}
-` + (root !== null ? `  - ${join35(root, "tasks", "section-matrix.yaml")}
+` + (root !== null ? `  - ${join38(root, "tasks", "section-matrix.yaml")}
 ` : "") + "copy/generate section-matrix.yaml from the canonical build-time matrix asset (repo `config` `tasks` tree) into one of those paths");
 }
 
@@ -117046,7 +118695,7 @@ init_dist7();
 init_dist5();
 await init_src3();
 import { closeSync as closeSync5, fstatSync as fstatSync3, openSync as openSync5, readSync as readSync3 } from "fs";
-import { join as join36 } from "path";
+import { join as join39 } from "path";
 import { createInterface } from "readline";
 import { setTimeout as sleep5 } from "timers/promises";
 
@@ -117224,11 +118873,11 @@ async function writeWorkflowPlanArtifact(cwd, runId, resolved, secretValues) {
       ...step.description !== undefined ? { description: redactAndBound(step.description, secretValues, 512) } : {}
     }))
   });
-  const { mkdir, writeFile } = await import("fs/promises");
-  const artifactsDir = join36(cwd, ".spur", "run");
+  const { mkdir, writeFile: writeFile2 } = await import("fs/promises");
+  const artifactsDir = join39(cwd, ".spur", "run");
   await mkdir(artifactsDir, { recursive: true });
-  const artifactPath = join36(artifactsDir, `${runId}-workflow-plan.json`);
-  await writeFile(artifactPath, payload);
+  const artifactPath = join39(artifactsDir, `${runId}-workflow-plan.json`);
+  await writeFile2(artifactPath, payload);
   return artifactPath;
 }
 async function makeEscalationPacketSink(bus, context4) {
@@ -117285,7 +118934,7 @@ function resolveWorkflowPaths(config4) {
   for (const path9 of paths) {
     if (path9.startsWith(BUNDLED_PATH_PREFIX)) {
       if (bundledRoot !== null)
-        expanded.push(join36(bundledRoot, path9.slice(BUNDLED_PATH_PREFIX.length)));
+        expanded.push(join39(bundledRoot, path9.slice(BUNDLED_PATH_PREFIX.length)));
     } else {
       expanded.push(path9);
     }
@@ -117522,7 +119171,7 @@ Monitor with: spur workflow trace ${runId2} --follow`);
     }
     const runLog = options.log === false ? undefined : new WorkflowRunLogSink({
       bus,
-      dir: join36(context4.cwd, ".spur", "run"),
+      dir: join39(context4.cwd, ".spur", "run"),
       runId,
       ...planPreview !== undefined ? { planPreview } : {},
       ...resolveOutputLogConfig(context4.spurConfig ?? null)
@@ -118049,7 +119698,7 @@ function readRunLogChunk(logPath, offset) {
   }
 }
 async function followRunLog(service, runId, dir, pollMs, write, wait = (ms) => sleep5(ms)) {
-  const logPath = join36(dir, ".spur", "run", `${runId}.log`);
+  const logPath = join39(dir, ".spur", "run", `${runId}.log`);
   let offset = 0;
   let everRead = false;
   while (true) {
@@ -118112,7 +119761,7 @@ init_src();
 init_src2();
 init_dist5();
 await init_src3();
-import { dirname as dirname22, join as join37, resolve as resolve17 } from "path";
+import { dirname as dirname23, join as join40, resolve as resolve18 } from "path";
 import { isatty as isatty4 } from "tty";
 
 // ../../node_modules/.bun/@clack+core@1.4.1/node_modules/@clack/core/dist/index.mjs
@@ -119527,7 +121176,7 @@ function resolveAgentRoles(agentConfig) {
   return resolved;
 }
 function createCliContext(options) {
-  const cwd = resolve17(options.cwd ?? process.cwd());
+  const cwd = resolve18(options.cwd ?? process.cwd());
   const env = options.env ?? process.env;
   const fs3 = createNodeFileSystem3(cwd);
   const agentConfig = options.agentConfig ?? options.spurConfig?.agent;
@@ -119575,10 +121224,10 @@ function createCliContext(options) {
 function noopSetExitCode(_code) {}
 async function createMigratedDbAdapter(cwd = process.cwd(), env = process.env, dbUrl) {
   const config4 = buildConfigFromEnv(env);
-  const configuredUrl = env.DATABASE_URL === undefined ? join37(cwd, DEFAULT_DATABASE_URL) : config4.database.url;
+  const configuredUrl = env.DATABASE_URL === undefined ? join40(cwd, DEFAULT_DATABASE_URL) : config4.database.url;
   const url2 = dbUrl ?? configuredUrl;
   if (url2 !== IN_MEMORY_DATABASE_URL) {
-    await createNodeFileSystem3().ensureDir(dirname22(url2));
+    await createNodeFileSystem3().ensureDir(dirname23(url2));
   }
   return createMigratedDb({ url: url2 });
 }
@@ -119694,8 +121343,7 @@ async function runCli() {
   return main();
 }
 if (import.meta.main) {
-  const exitCode = await runCli();
-  process.exit(exitCode);
+  process.exitCode = await runCli();
 }
 export {
   shouldRenderBanner,