@h-rig/server 0.0.6-alpha.3 → 0.0.6-alpha.30

package/dist/src/server-helpers/run-mutations.js

@@ -2,11 +2,11 @@
 // packages/server/src/server-helpers/run-mutations.ts
 import { spawn } from "child_process";
 import { loadConfig } from "@rig/core/load-config";
-import { existsSync as existsSync6, mkdirSync as mkdirSync5, readFileSync as readFileSync3, statSync as statSync3, writeFileSync as writeFileSync5 } from "fs";
-import { dirname as dirname5, relative as relative2, resolve as resolve9 } from "path";
+import { existsSync as existsSync7, mkdirSync as mkdirSync6, readFileSync as readFileSync4, statSync as statSync3, writeFileSync as writeFileSync6 } from "fs";
+import { dirname as dirname6, relative as relative2, resolve as resolve10 } from "path";
 import {
   listAuthorityRuns as listAuthorityRuns7,
-  readAuthorityRun as readAuthorityRun8,
+  readAuthorityRun as readAuthorityRun9,
   resolveAuthorityRunDir as resolveAuthorityRunDir4,
   writeJsonFile as writeJsonFile4
 } from "@rig/runtime/control-plane/authority-files";
@@ -16,6 +16,11 @@ import {
   buildTaskRunLifecycleComment as buildTaskRunLifecycleComment2,
   updateConfiguredTaskSourceTask as updateConfiguredTaskSourceTask2
 } from "@rig/runtime/control-plane/tasks/source-lifecycle";
+import {
+  closeIssueAfterMergedPr,
+  commitRunChanges,
+  runPrAutomation
+} from "@rig/runtime/control-plane/native/pr-automation";
 
 // packages/server/src/scheduler.ts
 import { normalizeTaskLifecycleStatus } from "@rig/runtime/control-plane/state-sync/types";
@@ -98,8 +103,8 @@ function normalizeStatus(value) {
 }
 
 // packages/server/src/server.ts
-import { existsSync as existsSync5, readdirSync, readFileSync as readFileSync2, statSync as statSync2 } from "fs";
-import { dirname as dirname4, resolve as resolve7 } from "path";
+import { existsSync as existsSync6, readdirSync, readFileSync as readFileSync3, statSync as statSync2 } from "fs";
+import { dirname as dirname5, resolve as resolve8 } from "path";
 import {
   listAuthorityArtifactRoots,
   listAuthorityRuns as listAuthorityRuns6,
@@ -180,6 +185,9 @@ import {
   readJsonlFile,
   resolveAuthorityRunDir
 } from "@rig/runtime/control-plane/authority-files";
+function runTimelinePath(projectRoot, runId) {
+  return resolve2(resolveAuthorityRunDir(projectRoot, runId), "timeline.jsonl");
+}
 function runLogsPath(projectRoot, runId) {
   return resolve2(resolveAuthorityRunDir(projectRoot, runId), "logs.jsonl");
 }
@@ -295,6 +303,24 @@ var snapshotCache = new Map;
 var contextCache = new Map;
 var taskListCache = new Map;
 
+// packages/server/src/server-helpers/task-projection.ts
+import { existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync, writeFileSync as writeFileSync3 } from "fs";
+import { resolve as resolve5 } from "path";
+function projectionPath(projectRoot) {
+  return resolve5(projectRoot, ".rig", "state", "task-projection.json");
+}
+function readTaskProjection(projectRoot) {
+  const file = projectionPath(projectRoot);
+  if (!existsSync3(file))
+    return null;
+  try {
+    const parsed = JSON.parse(readFileSync(file, "utf8"));
+    return parsed && parsed.version === 1 && Array.isArray(parsed.tasks) ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+
 // packages/server/src/server-helpers/terminal-runtime.ts
 import { WS_CHANNELS as WS_CHANNELS2 } from "@rig/contracts";
 
@@ -302,13 +328,20 @@ import { WS_CHANNELS as WS_CHANNELS2 } from "@rig/contracts";
 import { RIG_WS_CHANNELS } from "@rig/contracts";
 
 // packages/server/src/server-helpers/run-writers.ts
-import { resolve as resolve5 } from "path";
+import { resolve as resolve6 } from "path";
 import {
   appendJsonlRecord,
   readAuthorityRun as readAuthorityRun3,
   resolveAuthorityRunDir as resolveAuthorityRunDir2,
   writeJsonFile as writeJsonFile2
 } from "@rig/runtime/control-plane/authority-files";
+function appendRunTimelineEntry(projectRoot, runId, value) {
+  if (!readAuthorityRun3(projectRoot, runId)) {
+    return;
+  }
+  appendJsonlRecord(runTimelinePath(projectRoot, runId), value);
+  patchRunRecord(projectRoot, runId, {});
+}
 function appendRunLogEntry(projectRoot, runId, value) {
   if (!readAuthorityRun3(projectRoot, runId)) {
     return;
@@ -327,16 +360,21 @@ function patchRunRecord(projectRoot, runId, patch) {
     ...patch,
     updatedAt: normalizeString(patch.updatedAt) ?? new Date().toISOString()
   };
-  writeJsonFile2(resolve5(resolveAuthorityRunDir2(projectRoot, runId), "run.json"), next);
+  writeJsonFile2(resolve6(resolveAuthorityRunDir2(projectRoot, runId), "run.json"), next);
   return next;
 }
+function patchRunPiSessionMetadata(projectRoot, runId, metadata) {
+  return patchRunRecord(projectRoot, runId, {
+    piSession: metadata?.public ?? null,
+    piSessionPrivate: metadata
+  });
+}
 function buildRunStartPatch(startedAt) {
   return {
     status: "preparing",
     startedAt,
     completedAt: null,
-    errorText: null,
-    serverPid: process.pid
+    errorText: null
   };
 }
 
@@ -428,7 +466,7 @@ var DEFAULT_TERMINAL_SHELL = process.env.SHELL || "/bin/zsh";
 // packages/server/src/server-helpers/http-router.ts
 import {
   listAuthorityRuns as listAuthorityRuns4,
-  readAuthorityRun as readAuthorityRun5,
+  readAuthorityRun as readAuthorityRun6,
   resolveAuthorityPaths,
   writeJsonFile as writeJsonFile3
 } from "@rig/runtime/control-plane/authority-files";
@@ -448,8 +486,11 @@ import {
   RemoteWsClient
 } from "@rig/runtime/control-plane/remote";
 
+// packages/server/src/server-helpers/pi-session-proxy.ts
+import { readAuthorityRun as readAuthorityRun4 } from "@rig/runtime/control-plane/authority-files";
+
 // packages/server/src/server-helpers/run-steering.ts
-import { appendJsonlRecord as appendJsonlRecord2, readAuthorityRun as readAuthorityRun4, resolveAuthorityRunDir as resolveAuthorityRunDir3 } from "@rig/runtime/control-plane/authority-files";
+import { appendJsonlRecord as appendJsonlRecord2, readAuthorityRun as readAuthorityRun5, resolveAuthorityRunDir as resolveAuthorityRunDir3 } from "@rig/runtime/control-plane/authority-files";
 
 // packages/server/src/server-helpers/http-router.ts
 import { buildRigInitConfigSource } from "@rig/core";
@@ -460,8 +501,8 @@ import {
 
 // packages/server/src/server-helpers/github-auth-store.ts
 import { randomBytes } from "crypto";
-import { chmodSync, existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync, writeFileSync as writeFileSync3 } from "fs";
-import { resolve as resolve6 } from "path";
+import { chmodSync, copyFileSync, existsSync as existsSync4, mkdirSync as mkdirSync4, readFileSync as readFileSync2, writeFileSync as writeFileSync4 } from "fs";
+import { dirname as dirname4, resolve as resolve7 } from "path";
 function cleanString(value) {
   return typeof value === "string" && value.trim().length > 0 ? value.trim() : null;
 }
@@ -491,11 +532,31 @@ function parseApiSessions(value) {
     }];
   });
 }
+function parsePendingDevice(value) {
+  if (!value || typeof value !== "object")
+    return null;
+  const record = value;
+  const pollId = cleanString(record.pollId);
+  const deviceCode = cleanString(record.deviceCode);
+  const expiresAt = cleanString(record.expiresAt);
+  const intervalSeconds = typeof record.intervalSeconds === "number" && Number.isFinite(record.intervalSeconds) ? Math.max(1, Math.floor(record.intervalSeconds)) : null;
+  if (!pollId || !deviceCode || !expiresAt || !intervalSeconds)
+    return null;
+  return { pollId, deviceCode, expiresAt, intervalSeconds };
+}
+function parsePendingDevices(value) {
+  if (!Array.isArray(value))
+    return [];
+  return value.flatMap((entry) => {
+    const pending = parsePendingDevice(entry);
+    return pending ? [pending] : [];
+  });
+}
 function readStoredAuth(stateFile) {
-  if (!existsSync3(stateFile))
+  if (!existsSync4(stateFile))
     return {};
   try {
-    const parsed = JSON.parse(readFileSync(stateFile, "utf8"));
+    const parsed = JSON.parse(readFileSync2(stateFile, "utf8"));
     return {
       ...cleanString(parsed.token) ? { token: cleanString(parsed.token) } : {},
       login: cleanString(parsed.login),
@@ -504,6 +565,7 @@ function readStoredAuth(stateFile) {
       selectedRepo: cleanString(parsed.selectedRepo),
       tokenSource: parsed.tokenSource === "oauth-device" || parsed.tokenSource === "manual-token" || parsed.tokenSource === "env" ? parsed.tokenSource : undefined,
       pendingDevice: parsePendingDevice(parsed.pendingDevice),
+      pendingDevices: parsePendingDevices(parsed.pendingDevices),
       apiSessions: parseApiSessions(parsed.apiSessions),
       updatedAt: cleanString(parsed.updatedAt) ?? undefined
     };
@@ -511,34 +573,36 @@ function readStoredAuth(stateFile) {
     return {};
   }
 }
-function parsePendingDevice(value) {
-  if (!value || typeof value !== "object")
-    return null;
-  const record = value;
-  const pollId = cleanString(record.pollId);
-  const deviceCode = cleanString(record.deviceCode);
-  const expiresAt = cleanString(record.expiresAt);
-  const intervalSeconds = typeof record.intervalSeconds === "number" && Number.isFinite(record.intervalSeconds) ? Math.max(1, Math.floor(record.intervalSeconds)) : null;
-  if (!pollId || !deviceCode || !expiresAt || !intervalSeconds)
-    return null;
-  return { pollId, deviceCode, expiresAt, intervalSeconds };
-}
 function newApiSessionToken() {
   return `rig_${randomBytes(32).toString("base64url")}`;
 }
 function writeStoredAuth(stateFile, payload) {
-  mkdirSync3(resolve6(stateFile, ".."), { recursive: true });
-  writeFileSync3(stateFile, `${JSON.stringify(payload, null, 2)}
+  mkdirSync4(dirname4(stateFile), { recursive: true });
+  writeFileSync4(stateFile, `${JSON.stringify(payload, null, 2)}
 `, { encoding: "utf8", mode: 384 });
   try {
     chmodSync(stateFile, 384);
   } catch {}
 }
+function localProjectAuthStateFile(projectRoot) {
+  return resolve7(projectRoot, ".rig", "state", "github-auth.json");
+}
 function resolveGitHubAuthStateFile(projectRoot) {
-  return resolve6(resolveServerAuthorityPaths(projectRoot).stateDir, "github-auth.json");
+  return resolve7(resolveServerAuthorityPaths(projectRoot).stateDir, "github-auth.json");
 }
-function createGitHubAuthStore(projectRoot) {
-  const stateFile = resolveGitHubAuthStateFile(projectRoot);
+function copyGitHubAuthStateToLocalProjectRoot(stateFile, projectRoot) {
+  const targetFile = localProjectAuthStateFile(projectRoot);
+  mkdirSync4(dirname4(targetFile), { recursive: true });
+  if (existsSync4(stateFile)) {
+    copyFileSync(stateFile, targetFile);
+    try {
+      chmodSync(targetFile, 384);
+    } catch {}
+    return;
+  }
+  writeStoredAuth(targetFile, {});
+}
+function createGitHubAuthStoreFromStateFile(stateFile) {
   return {
     stateFile,
     status(options) {
@@ -568,6 +632,7 @@ function createGitHubAuthStore(projectRoot) {
         scopes: input.scopes ?? [],
         selectedRepo: input.selectedRepo ?? previous.selectedRepo ?? null,
         pendingDevice: null,
+        pendingDevices: [],
         apiSessions: previous.apiSessions ?? [],
         updatedAt: new Date().toISOString()
       });
@@ -596,15 +661,24 @@ function createGitHubAuthStore(projectRoot) {
       const session = (previous.apiSessions ?? []).find((candidate) => candidate.token === clean);
       return session ? { login: cleanString(session.login), userId: cleanString(session.userId) } : null;
     },
-    copyToProjectRoot(projectRoot2) {
-      const targetFile = resolveGitHubAuthStateFile(projectRoot2);
+    copyToProjectRoot(projectRoot) {
+      const targetFile = resolveGitHubAuthStateFile(projectRoot);
       writeStoredAuth(targetFile, readStoredAuth(stateFile));
     },
+    copyToLocalProjectRoot(projectRoot) {
+      copyGitHubAuthStateToLocalProjectRoot(stateFile, projectRoot);
+    },
     savePendingDevice(input) {
       const previous = readStoredAuth(stateFile);
+      const pendingDevices = [
+        ...previous.pendingDevice ? [previous.pendingDevice] : [],
+        ...previous.pendingDevices ?? [],
+        input
+      ].filter((entry, index, entries) => entries.findIndex((candidate) => candidate.pollId === entry.pollId) === index);
       writeStoredAuth(stateFile, {
         ...previous,
-        pendingDevice: input,
+        pendingDevice: null,
+        pendingDevices,
         updatedAt: new Date().toISOString()
       });
     },
@@ -617,23 +691,32 @@ function createGitHubAuthStore(projectRoot) {
       });
     },
     readPendingDevice(pollId) {
-      const pending = readStoredAuth(stateFile).pendingDevice ?? null;
-      if (!pending || pending.pollId !== pollId)
+      const previous = readStoredAuth(stateFile);
+      const pending = [
+        ...previous.pendingDevice ? [previous.pendingDevice] : [],
+        ...previous.pendingDevices ?? []
+      ].find((entry) => entry.pollId === pollId) ?? null;
+      if (!pending)
         return null;
       if (Date.parse(pending.expiresAt) <= Date.now())
         return null;
       return pending;
     },
-    clearPendingDevice() {
+    clearPendingDevice(pollId) {
       const previous = readStoredAuth(stateFile);
+      const remaining = pollId ? (previous.pendingDevices ?? []).filter((entry) => entry.pollId !== pollId) : [];
       writeStoredAuth(stateFile, {
         ...previous,
         pendingDevice: null,
+        pendingDevices: remaining,
         updatedAt: new Date().toISOString()
       });
     }
   };
 }
+function createGitHubAuthStore(projectRoot) {
+  return createGitHubAuthStoreFromStateFile(resolveGitHubAuthStateFile(projectRoot));
+}
 
 // packages/server/src/server-helpers/github-projects.ts
 function asRecord(value) {
@@ -752,6 +835,7 @@ var DEFAULT_PROJECT_STATUSES = {
   running: "In Progress",
   prOpen: "In Review",
   ciFixing: "In Review",
+  merging: "Merging",
   done: "Done",
   needsAttention: "Needs Attention"
 };
@@ -765,6 +849,8 @@ function lifecycleStatusForTaskStatus(status) {
     return "prOpen";
   if (normalized === "ci_fixing" || normalized === "fixing")
     return "ciFixing";
+  if (normalized === "merging" || normalized === "merge")
+    return "merging";
   if (normalized === "failed" || normalized === "needs_attention" || normalized === "blocked")
     return "needsAttention";
   if (normalized === "in_progress" || normalized === "running" || normalized === "ready" || normalized === "open")
@@ -848,7 +934,7 @@ import {
   RemoteWsClient as RemoteWsClient2
 } from "@rig/runtime/control-plane/remote";
 import { deleteRunState } from "@rig/runtime/control-plane/native/run-ops";
-import { readAuthorityRun as readAuthorityRun6 } from "@rig/runtime/control-plane/authority-files";
+import { readAuthorityRun as readAuthorityRun7 } from "@rig/runtime/control-plane/authority-files";
 
 // packages/server/src/server-helpers/inspector-jobs.ts
 import { readJsonFile as readJsonFile2 } from "@rig/runtime/control-plane/authority-files";
@@ -861,7 +947,7 @@ import {
 } from "@rig/runtime/control-plane/native/run-ops";
 import {
   listAuthorityRuns as listAuthorityRuns5,
-  readAuthorityRun as readAuthorityRun7
+  readAuthorityRun as readAuthorityRun8
 } from "@rig/runtime/control-plane/authority-files";
 
 // packages/server/src/inspector/service.ts
@@ -969,10 +1055,10 @@ var CLUSTERS = {
 };
 
 // packages/server/src/server-helpers/task-config.ts
-import { existsSync as existsSync4 } from "fs";
+import { existsSync as existsSync5 } from "fs";
 async function readTaskConfig(projectRoot) {
   const taskConfigPath = resolveRigServerPaths(projectRoot).taskConfigPath;
-  if (!existsSync4(taskConfigPath)) {
+  if (!existsSync5(taskConfigPath)) {
     return {};
   }
   try {
@@ -989,8 +1075,8 @@ var serverPathEnvQueue = Promise.resolve();
 async function withServerPathEnv(projectRoot, fn) {
   const waitForTurn = serverPathEnvQueue;
   let releaseTurn;
-  serverPathEnvQueue = new Promise((resolve8) => {
-    releaseTurn = resolve8;
+  serverPathEnvQueue = new Promise((resolve9) => {
+    releaseTurn = resolve9;
   });
   await waitForTurn;
   const paths = resolveServerAuthorityPaths(projectRoot);
@@ -1026,9 +1112,9 @@ async function withServerAuthorityEnvIfNeeded(projectRoot, fn) {
   return withServerPathEnv(projectRoot, fn);
 }
 async function readWorkspaceTasks(projectRoot) {
-  const issuesPath = resolve7(resolveMonorepoRoot5(projectRoot), ".beads", "issues.jsonl");
+  const issuesPath = resolve8(resolveMonorepoRoot5(projectRoot), ".beads", "issues.jsonl");
   const taskConfig = await readTaskConfig(projectRoot);
-  if (!existsSync5(issuesPath)) {
+  if (!existsSync6(issuesPath)) {
     return [];
   }
   const latestById = new Map;
@@ -1074,7 +1160,7 @@ async function readWorkspaceTasks(projectRoot) {
 if (false) {}
 
 // packages/server/src/server-helpers/validation-failure.ts
-import { resolve as resolve8 } from "path";
+import { resolve as resolve9 } from "path";
 import {
   readJsonFile as readJsonFile4,
   resolveTaskArtifactDirs
@@ -1088,7 +1174,7 @@ function summarizeRunValidationFailure(projectRoot, run) {
       continue;
     }
     seen.add(artifactRoot);
-    const summary = readJsonFile4(resolve8(artifactRoot, "validation-summary.json"), null);
+    const summary = readJsonFile4(resolve9(artifactRoot, "validation-summary.json"), null);
     if (!summary || summary.status !== "fail") {
       continue;
     }
@@ -1168,9 +1254,14 @@ function parseIssueRef(sourceTask, fallbackTaskId) {
     return null;
   return null;
 }
+function githubProjectsEnabled(config) {
+  const github = config?.github && typeof config.github === "object" && !Array.isArray(config.github) ? config.github : null;
+  const projects = github?.projects && typeof github.projects === "object" && !Array.isArray(github.projects) ? github.projects : null;
+  return projects?.enabled === true;
+}
 async function syncProjectStatusForRunLifecycle(projectRoot, run, status, config) {
   if (!run.taskId)
-    return;
+    return false;
   const issueNodeId = extractGitHubIssueNodeId(runSourceTaskIdentity(run));
   try {
     const result = await syncGitHubProjectStatusForTaskUpdate({
@@ -1181,28 +1272,86 @@ async function syncProjectStatusForRunLifecycle(projectRoot, run, status, config
       config
     });
     if (!result.synced && result.reason !== "project-sync-disabled") {
+      const detail = `Project status sync for ${run.taskId} could not run: ${result.reason}.`;
       appendRunLogEntry(projectRoot, run.runId, {
         id: `log:${run.runId}:github-project-sync:${status}`,
         title: "GitHub Project sync skipped",
-        detail: `Project status sync for ${run.taskId} could not run: ${result.reason}.`,
+        detail,
         tone: "warn",
         status: "running",
         createdAt: new Date().toISOString(),
         payload: { reason: result.reason, issueNodeId }
       });
+      if (githubProjectsEnabled(config)) {
+        throw new Error(detail);
+      }
+      return false;
     }
+    return result.synced === true;
   } catch (error) {
+    const detail = error instanceof Error ? error.message : String(error);
     appendRunLogEntry(projectRoot, run.runId, {
       id: `log:${run.runId}:github-project-sync-error:${status}`,
       title: "GitHub Project sync failed",
-      detail: error instanceof Error ? error.message : String(error),
+      detail,
       tone: "error",
       status: "running",
       createdAt: new Date().toISOString(),
       payload: { issueNodeId }
     });
+    if (githubProjectsEnabled(config)) {
+      throw new Error(detail);
+    }
+    return false;
   }
 }
+function createCommandRunner(binary, extraEnv = {}) {
+  return async (args, options) => {
+    const child = spawn(binary, [...args], {
+      cwd: options?.cwd,
+      env: { ...process.env, ...extraEnv },
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    const stdoutChunks = [];
+    const stderrChunks = [];
+    child.stdout?.on("data", (chunk) => stdoutChunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk))));
+    child.stderr?.on("data", (chunk) => stderrChunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk))));
+    const exitCode = await new Promise((resolve11) => {
+      child.once("error", () => resolve11(1));
+      child.once("close", (code) => resolve11(code ?? 1));
+    });
+    return {
+      exitCode,
+      stdout: Buffer.concat(stdoutChunks).toString("utf8"),
+      stderr: Buffer.concat(stderrChunks).toString("utf8")
+    };
+  };
+}
+function closeoutRecord(run) {
+  const value = run.serverCloseout;
+  return value && typeof value === "object" && !Array.isArray(value) ? value : null;
+}
+function closeoutPhasePatch(phase, status, extra = {}) {
+  const updatedAt = new Date().toISOString();
+  return {
+    serverCloseout: {
+      ...extra,
+      phase,
+      status,
+      updatedAt
+    }
+  };
+}
+function appendCloseoutStage(state, runId, phase, detail, status = "reviewing", tone = "info") {
+  appendRunLogEntryAndBroadcast(state, runId, {
+    id: `log:${runId}:server-closeout:${phase}:${Date.now()}`,
+    title: `Server closeout: ${phase}`,
+    detail,
+    tone,
+    status,
+    createdAt: new Date().toISOString()
+  }, `server-closeout-${phase}`);
+}
 async function autoAssignRunIssue(projectRoot, run) {
   if (!run.taskId)
     return;
@@ -1232,7 +1381,7 @@ async function updateRunTaskSourceLifecycle(projectRoot, run, status, summary, o
     return;
   }
   const config = await loadRigLifecycleConfig(projectRoot);
-  await syncProjectStatusForRunLifecycle(projectRoot, run, status, config);
+  const projectSynced = await syncProjectStatusForRunLifecycle(projectRoot, run, status, config);
   if (status === "in_progress") {
     await autoAssignRunIssue(projectRoot, run);
   }
@@ -1248,24 +1397,53 @@ async function updateRunTaskSourceLifecycle(projectRoot, run, status, summary, o
     });
     return;
   }
-  const result = await updateConfiguredTaskSourceTask2(projectRoot, {
-    taskId: run.taskId,
-    sourceTask: runSourceTaskIdentity(run),
-    update: {
-      status,
-      comment: buildTaskRunLifecycleComment2({
-        runId: run.runId,
+  const sourceTask = runSourceTaskIdentity(run);
+  const previousStatus = normalizeString(sourceTask?.status) ?? normalizeString(sourceTask?.sourceStatus);
+  const rollbackProjectSync = async () => {
+    if (!projectSynced || !previousStatus || !run.taskId || !githubProjectsEnabled(config))
+      return;
+    await syncGitHubProjectStatusForTaskUpdate({
+      taskId: run.taskId,
+      status: previousStatus,
+      issueNodeId: extractGitHubIssueNodeId(sourceTask),
+      token: createGitHubAuthStore(projectRoot).readToken(),
+      config
+    }).catch((rollbackError) => {
+      appendRunLogEntry(projectRoot, run.runId, {
+        id: `log:${run.runId}:github-project-sync-rollback:${status}`,
+        title: "GitHub Project sync rollback failed",
+        detail: rollbackError instanceof Error ? rollbackError.message : String(rollbackError),
+        tone: "error",
+        status: "running",
+        createdAt: new Date().toISOString()
+      });
+    });
+  };
+  let result;
+  try {
+    result = await updateConfiguredTaskSourceTask2(projectRoot, {
+      taskId: run.taskId,
+      sourceTask,
+      update: {
         status,
-        summary,
-        runtimeWorkspace: normalizeString(run.worktreePath),
-        logsDir: normalizeString(run.logRoot),
-        sessionDir: normalizeString(run.sessionPath),
-        errorText: options.errorText ?? normalizeString(run.errorText)
-      })
-    }
-  });
+        comment: buildTaskRunLifecycleComment2({
+          runId: run.runId,
+          status,
+          summary,
+          runtimeWorkspace: normalizeString(run.worktreePath),
+          logsDir: normalizeString(run.logRoot),
+          sessionDir: normalizeString(run.sessionPath),
+          errorText: options.errorText ?? normalizeString(run.errorText)
+        })
+      }
+    });
+  } catch (error) {
+    await rollbackProjectSync();
+    throw error;
+  }
   if (!result.updated) {
     if (result.source === "plugin" || result.sourceKind) {
+      await rollbackProjectSync();
       throw new Error(`Configured task source${result.sourceKind ? ` (${result.sourceKind})` : ""} did not accept lifecycle update for ${result.taskId}.`);
     }
     appendRunLogEntry(projectRoot, run.runId, {
@@ -1278,6 +1456,277 @@ async function updateRunTaskSourceLifecycle(projectRoot, run, status, summary, o
     });
   }
 }
+async function markServerOwnedCloseoutFailed(state, runId, error) {
+  const detail = error instanceof Error ? error.message : String(error);
+  const current = readAuthorityRun9(state.projectRoot, runId);
+  patchRunRecord(state.projectRoot, runId, {
+    status: "failed",
+    completedAt: new Date().toISOString(),
+    errorText: detail,
+    ...closeoutPhasePatch("failed", "failed", { error: detail })
+  });
+  appendRunLogEntryAndBroadcast(state, runId, {
+    id: `log:${runId}:server-closeout-failed`,
+    title: "Server-owned closeout failed",
+    detail,
+    tone: "error",
+    status: "failed",
+    createdAt: new Date().toISOString()
+  }, "server-closeout-failed");
+  if (current?.taskId) {
+    await updateRunTaskSourceLifecycle(state.projectRoot, { ...current, status: "failed", errorText: detail }, "failed", "Rig server-owned closeout failed.", { errorText: detail }).catch((sourceError) => {
+      appendRunLogEntry(state.projectRoot, runId, {
+        id: `log:${runId}:task-source-closeout-failed-update`,
+        title: "Task source closeout failure update failed",
+        detail: sourceError instanceof Error ? sourceError.message : String(sourceError),
+        tone: "error",
+        status: "failed",
+        createdAt: new Date().toISOString()
+      });
+    });
+  }
+}
+function scheduleServerOwnedPrCloseout(state, runId, reason) {
+  const startedAt = new Date().toISOString();
+  state.runProcesses.set(runId, {
+    runId,
+    child: null,
+    startedAt,
+    stopped: false
+  });
+  queueMicrotask(() => {
+    withServerAuthorityEnvIfNeeded(state.projectRoot, async () => {
+      try {
+        await runServerOwnedPrCloseout(state, runId);
+      } catch (error) {
+        await markServerOwnedCloseoutFailed(state, runId, error);
+      } finally {
+        state.runProcesses.delete(runId);
+        broadcastSnapshotInvalidation(state, `server-closeout-${reason}-terminal`);
+        await reconcileScheduler(state, `server-closeout-${reason}-terminal`);
+      }
+    });
+  });
+}
+async function runServerOwnedPrCloseout(state, runId) {
+  const run = readAuthorityRun9(state.projectRoot, runId);
+  if (!run)
+    throw new Error(`Run not found: ${runId}`);
+  const closeout = closeoutRecord(run);
+  if (!closeout)
+    return;
+  const taskId = normalizeString(closeout.taskId) ?? normalizeString(run.taskId);
+  if (!taskId)
+    throw new Error("Server-owned closeout requires a task id.");
+  const workspace = normalizeString(closeout.runtimeWorkspace) ?? normalizeString(run.worktreePath) ?? state.projectRoot;
+  let branch = normalizeString(closeout.branch) ?? `rig/${taskId}-${runId}`;
+  const config = await loadRigLifecycleConfig(state.projectRoot);
+  const runPrMode = normalizeString(run.prMode);
+  const prMode = runPrMode === "auto" || runPrMode === "ask" || runPrMode === "off" ? runPrMode : config?.pr?.mode ?? "off";
+  const effectiveConfig = {
+    ...config ?? {},
+    pr: {
+      ...config?.pr ?? {},
+      mode: prMode,
+      autoFixChecks: false,
+      autoFixReview: false
+    }
+  };
+  const readCurrentRun = () => readAuthorityRun9(state.projectRoot, runId) ?? run;
+  const sourceTask = runSourceTaskIdentity(run);
+  const closeoutPhase = normalizeString(closeout.phase)?.toLowerCase() ?? "";
+  const closeoutStatus = normalizeString(closeout.status)?.toLowerCase() ?? "";
+  const closeoutPrUrl = normalizeString(closeout.prUrl);
+  if (closeoutPhase === "completed" || closeoutStatus === "completed") {
+    return;
+  }
+  if (closeoutPhase === "close-source" && closeoutPrUrl) {
+    patchRunRecord(state.projectRoot, runId, {
+      status: "reviewing",
+      ...closeoutPhasePatch("close-source", "running", { ...closeout, prUrl: closeoutPrUrl, taskId, runtimeWorkspace: workspace, branch })
+    });
+    await closeIssueAfterMergedPr({
+      projectRoot: state.projectRoot,
+      taskId,
+      runId,
+      prUrl: closeoutPrUrl,
+      sourceTask,
+      updateTaskSource: async (projectRoot, input) => {
+        await updateRunTaskSourceLifecycle(projectRoot, readCurrentRun(), "closed", "Rig merged the pull request and closed this task source.");
+        return { updated: true, taskId: input.taskId, status: input.update.status, source: "server", sourceKind: "server" };
+      }
+    });
+    const completedAt = new Date().toISOString();
+    patchRunRecord(state.projectRoot, runId, {
+      status: "completed",
+      completedAt,
+      errorText: null,
+      ...closeoutPhasePatch("completed", "completed", { ...closeout, prUrl: closeoutPrUrl, iterations: closeout.iterations, completedAt })
+    });
+    appendCloseoutStage(state, runId, "completed", `PR merged and issue closed: ${closeoutPrUrl}`, "completed", "info");
+    emitRigEvent(state, {
+      type: "rig.run.completed",
+      aggregateId: runId,
+      payload: { runId, taskId, prUrl: closeoutPrUrl, closeout: "merged" },
+      createdAt: completedAt
+    });
+    return;
+  }
+  if (prMode === "off" || prMode === "ask") {
+    const completedAt = new Date().toISOString();
+    patchRunRecord(state.projectRoot, runId, {
+      status: "completed",
+      completedAt,
+      errorText: null,
+      ...closeoutPhasePatch("completed", "completed", { taskId, runtimeWorkspace: workspace, branch, reason: prMode === "ask" ? "pr-mode-ask" : "pr-mode-off" })
+    });
+    appendCloseoutStage(state, runId, "completed", prMode === "ask" ? "Validation completed; PR creation awaits operator approval." : "Validation completed; PR automation disabled.", "completed", "info");
+    emitRigEvent(state, {
+      type: "rig.run.completed",
+      aggregateId: runId,
+      payload: { runId, taskId, closeout: "skipped", reason: prMode === "ask" ? "pr-mode-ask" : "pr-mode-off" },
+      createdAt: completedAt
+    });
+    return;
+  }
+  const githubToken = createGitHubAuthStore(state.projectRoot).readToken();
+  const githubEnv = githubToken ? { RIG_GITHUB_TOKEN: githubToken, GITHUB_TOKEN: githubToken, GH_TOKEN: githubToken } : {};
+  const gitCommand = createCommandRunner("git", githubEnv);
+  const ghCommand = createCommandRunner("gh", githubEnv);
+  const workspaceBranch = await gitCommand(["rev-parse", "--abbrev-ref", "HEAD"], { cwd: workspace });
+  const currentWorkspaceBranch = workspaceBranch.exitCode === 0 ? normalizeString(workspaceBranch.stdout) : null;
+  if (currentWorkspaceBranch && currentWorkspaceBranch !== "HEAD" && currentWorkspaceBranch !== branch) {
+    appendCloseoutStage(state, runId, "branch", `Using runtime workspace branch ${currentWorkspaceBranch} instead of recorded branch ${branch}.`, "reviewing", "info");
+    branch = currentWorkspaceBranch;
+  }
+  const setCloseout = (phase, status, extra = {}) => {
+    const previous = closeoutRecord(readCurrentRun()) ?? closeout;
+    patchRunRecord(state.projectRoot, runId, {
+      status: status === "failed" ? "failed" : status === "needs_attention" ? "needs_attention" : "reviewing",
+      ...closeoutPhasePatch(phase, status, { ...previous, ...extra })
+    });
+  };
+  setCloseout("commit", "running", { runtimeWorkspace: workspace, branch, taskId });
+  appendCloseoutStage(state, runId, "commit", `Committing changes in ${workspace}.`, "reviewing", "tool");
+  const commit = await commitRunChanges({ cwd: workspace, message: `rig: complete task ${taskId}`, command: gitCommand });
+  appendCloseoutStage(state, runId, "commit", commit.committed ? "Committed run workspace changes." : "No workspace changes to commit.", "reviewing", "tool");
+  setCloseout("push", "running", { runtimeWorkspace: workspace, branch, taskId });
+  const push = await gitCommand(["push", "--set-upstream", "origin", branch], { cwd: workspace });
+  if (push.exitCode !== 0) {
+    throw new Error(`git push --set-upstream origin ${branch} failed (${push.exitCode}): ${push.stderr ?? push.stdout ?? ""}`.trim());
+  }
+  const sourceTaskForPr = {
+    title: normalizeString(sourceTask?.title) ?? normalizeString(run.title)
+  };
+  const artifactRoot = resolve10(state.projectRoot, "artifacts", taskId);
+  setCloseout("pr-review-merge", "running", { runtimeWorkspace: workspace, branch, taskId, artifactRoot });
+  const pr = await runPrAutomation({
+    projectRoot: workspace,
+    taskId,
+    runId,
+    branch,
+    config: effectiveConfig,
+    sourceTask: sourceTaskForPr,
+    artifactRoot,
+    command: ghCommand,
+    gitCommand,
+    steerPi: async (message) => {
+      appendCloseoutStage(state, runId, "feedback", message, "reviewing", "info");
+      appendRunTimelineEntry(state.projectRoot, runId, {
+        id: `message:${runId}:server-closeout-feedback:${Date.now()}`,
+        type: "user_message",
+        text: message,
+        createdAt: new Date().toISOString(),
+        state: "completed"
+      });
+    },
+    lifecycle: {
+      onPrOpened: async ({ prUrl }) => {
+        setCloseout("pr-opened", "running", { prUrl, runtimeWorkspace: workspace, branch, taskId, artifactRoot });
+        appendCloseoutStage(state, runId, "open-pr", prUrl, "reviewing", "tool");
+        await updateRunTaskSourceLifecycle(state.projectRoot, readCurrentRun(), "under_review", "Rig opened a pull request for this task.");
+      },
+      onReviewCiStarted: ({ prUrl, iteration }) => appendCloseoutStage(state, runId, "review-ci", `${prUrl} (iteration ${iteration})`, "reviewing", "info"),
+      onFeedback: async ({ feedback }) => {
+        appendCloseoutStage(state, runId, "feedback", feedback.join(`
+`), "reviewing", "error");
+        await updateRunTaskSourceLifecycle(state.projectRoot, readCurrentRun(), "ci_fixing", "Rig is fixing CI/review feedback for this task.");
+      },
+      onMergeStarted: async ({ prUrl }) => {
+        setCloseout("merge", "running", { prUrl, runtimeWorkspace: workspace, branch, taskId, artifactRoot });
+        appendCloseoutStage(state, runId, "merge", prUrl, "reviewing", "tool");
+        await updateRunTaskSourceLifecycle(state.projectRoot, readCurrentRun(), "merging", "Rig is merging the pull request for this task.");
+      },
+      onMerged: ({ prUrl }) => {
+        setCloseout("close-source", "running", { prUrl, runtimeWorkspace: workspace, branch, taskId, artifactRoot, merged: true });
+        appendCloseoutStage(state, runId, "merge", prUrl, "reviewing", "tool");
+      }
+    }
+  });
+  if (pr.status === "merged" && pr.prUrl) {
+    setCloseout("close-source", "running", { prUrl: pr.prUrl, iterations: pr.iterations });
+    await closeIssueAfterMergedPr({
+      projectRoot: state.projectRoot,
+      taskId,
+      runId,
+      prUrl: pr.prUrl,
+      sourceTask,
+      updateTaskSource: async (projectRoot, input) => {
+        await updateRunTaskSourceLifecycle(projectRoot, readCurrentRun(), "closed", "Rig merged the pull request and closed this task source.");
+        return { updated: true, taskId: input.taskId, status: input.update.status, source: "server", sourceKind: "server" };
+      }
+    });
+    const completedAt = new Date().toISOString();
+    patchRunRecord(state.projectRoot, runId, {
+      status: "completed",
+      completedAt,
+      errorText: null,
+      ...closeoutPhasePatch("completed", "completed", { prUrl: pr.prUrl, iterations: pr.iterations, completedAt })
+    });
+    appendCloseoutStage(state, runId, "completed", `PR merged and issue closed: ${pr.prUrl}`, "completed", "info");
+    emitRigEvent(state, {
+      type: "rig.run.completed",
+      aggregateId: runId,
+      payload: { runId, taskId, prUrl: pr.prUrl, closeout: "merged" },
+      createdAt: completedAt
+    });
+    return;
+  }
+  if (pr.status === "opened" && pr.prUrl) {
+    const completedAt = new Date().toISOString();
+    patchRunRecord(state.projectRoot, runId, {
+      status: "completed",
+      completedAt,
+      errorText: null,
+      ...closeoutPhasePatch("completed", "completed", { prUrl: pr.prUrl, iterations: pr.iterations })
+    });
+    appendCloseoutStage(state, runId, "completed", `PR ready without merge: ${pr.prUrl}`, "completed", "info");
+    emitRigEvent(state, {
+      type: "rig.run.completed",
+      aggregateId: runId,
+      payload: { runId, taskId, prUrl: pr.prUrl, closeout: "pr-ready" },
+      createdAt: completedAt
+    });
+    return;
+  }
+  const detail = pr.actionableFeedback.join(`
+`) || "PR automation did not merge the PR.";
+  await updateRunTaskSourceLifecycle(state.projectRoot, readCurrentRun(), "needs_attention", "Rig needs operator attention before this task can proceed.", { errorText: detail }).catch((error) => {
+    appendCloseoutStage(state, runId, "needs-attention-update", error instanceof Error ? error.message : String(error), "needs_attention", "error");
+  });
+  patchRunRecord(state.projectRoot, runId, {
+    status: "needs_attention",
+    completedAt: new Date().toISOString(),
+    errorText: detail,
+    ...closeoutPhasePatch("needs_attention", "needs_attention", { feedback: pr.actionableFeedback, prUrl: pr.prUrl ?? null, iterations: pr.iterations })
+  });
+  appendCloseoutStage(state, runId, "needs-attention", detail, "needs_attention", "error");
+  emitRigEvent(state, {
+    type: "rig.run.needs-attention",
+    aggregateId: runId,
+    payload: { runId, taskId, error: detail, prUrl: pr.prUrl ?? null }
+  });
+}
 var TERMINAL_RUN_STATUSES2 = new Set([
   "completed",
   "complete",
@@ -1303,11 +1752,23 @@ function assertNoActiveRunForTask(projectRoot, taskId, newRunId) {
     return;
   throw new Error(`Task ${taskId} already has an active Rig run: ${existing.runId}`);
 }
+async function resolveSourceTaskForRun(projectRoot, taskId, readTasks) {
+  const fromReader = (await readTasks(projectRoot)).find((task) => task.id === taskId) ?? null;
+  if (fromReader)
+    return fromReader;
+  const projected = readTaskProjection(projectRoot)?.tasks.find((task) => String(task.id) === taskId) ?? null;
+  if (projected)
+    return projected;
+  if (readTasks !== readWorkspaceTasks) {
+    return (await readWorkspaceTasks(projectRoot)).find((task) => task.id === taskId) ?? null;
+  }
+  return null;
+}
 async function createRunRecord(projectRoot, input, readTasks = readWorkspaceTasks) {
   if ("taskId" in input && input.taskId) {
     assertNoActiveRunForTask(projectRoot, input.taskId, input.runId);
   }
-  const sourceTask = "taskId" in input && input.taskId ? (await readTasks(projectRoot)).find((task) => task.id === input.taskId) ?? null : null;
+  const sourceTask = "taskId" in input && input.taskId ? await resolveSourceTaskForRun(projectRoot, input.taskId, readTasks) : null;
   const taskTitle = sourceTask?.title ?? ("taskId" in input && input.taskId ? input.taskId : null);
   const runDir = resolveAuthorityRunDir4(projectRoot, input.runId);
   const runRecord = {
@@ -1341,11 +1802,11 @@ async function createRunRecord(projectRoot, input, readTasks = readWorkspaceTask
     initiatedBy: input.initiatedBy ?? null,
     ...sourceTask ? { sourceTask: sourceTaskContract(sourceTask) } : {}
   };
-  mkdirSync5(runDir, { recursive: true });
-  writeFileSync5(resolve9(runDir, "run.json"), `${JSON.stringify(runRecord, null, 2)}
+  mkdirSync6(runDir, { recursive: true });
+  writeFileSync6(resolve10(runDir, "run.json"), `${JSON.stringify(runRecord, null, 2)}
 `, "utf8");
   if ("initialPrompt" in input && input.initialPrompt && input.initialPrompt.trim().length > 0) {
-    writeFileSync5(resolve9(runDir, "timeline.jsonl"), `${JSON.stringify({
+    writeFileSync6(resolve10(runDir, "timeline.jsonl"), `${JSON.stringify({
       id: `message-${Date.now()}`,
       type: "user_message",
       text: input.initialPrompt,
@@ -1374,11 +1835,12 @@ async function createRunRecord(projectRoot, input, readTasks = readWorkspaceTask
   }
 }
 async function startLocalRun(state, runId, options) {
-  const run = readAuthorityRun8(state.projectRoot, runId);
+  const run = readAuthorityRun9(state.projectRoot, runId);
   if (!run) {
     throw new Error(`Run not found: ${runId}`);
   }
   const startedAt = new Date().toISOString();
+  const resumeMode = options?.resume === true;
   state.runProcesses.set(runId, {
     runId,
     child: null,
@@ -1395,9 +1857,9 @@ async function startLocalRun(state, runId, options) {
     summary: run.title
   });
   appendRunLogEntry(state.projectRoot, runId, {
-    id: `log:${runId}:prepare`,
-    title: "Rig task run starting",
-    detail: run.taskId ?? run.title,
+    id: `log:${runId}:${resumeMode ? "resume" : "prepare"}`,
+    title: resumeMode ? "Rig task run resuming" : "Rig task run starting",
+    detail: resumeMode ? `Resuming ${run.taskId ?? run.title ?? runId} after server restart or operator resume.` : run.taskId ?? run.title,
     tone: "info",
     status: "preparing",
     createdAt: startedAt
@@ -1405,8 +1867,8 @@ async function startLocalRun(state, runId, options) {
   broadcastRunLogAppended(state, runId, readLatestRawRunLog(state.projectRoot, runId));
   broadcastSnapshotInvalidation(state);
   const cliProjectRoot = resolveLocalRunCliProjectRoot(state.projectRoot);
-  const cliEntryPoint = resolve9(cliProjectRoot, "packages/cli/bin/rig.ts");
-  if (!existsSync6(cliEntryPoint)) {
+  const cliEntryPoint = resolve10(cliProjectRoot, "packages/cli/bin/rig.ts");
+  if (!existsSync7(cliEntryPoint)) {
     const completedAt = new Date().toISOString();
     const failureSummary = `Rig task-run entrypoint missing at ${relative2(state.projectRoot, cliEntryPoint)}`;
     patchRunRecord(state.projectRoot, runId, {
@@ -1473,12 +1935,17 @@ async function startLocalRun(state, runId, options) {
           RIG_HOST_PROJECT_ROOT: cliProjectRoot,
           RIG_RUNTIME_BASE_REF: process.env.RIG_RUNTIME_BASE_REF ?? "HEAD",
           RIG_SERVER_INTERNAL_EXEC: "1",
+          RIG_SERVER_OWNS_CLOSEOUT: "1",
           ...serverUrl ? { RIG_SERVER_URL: serverUrl } : {},
           ...bridgeAuthToken ? { RIG_AUTH_TOKEN: bridgeAuthToken } : {},
           ...bridgeGitHubToken ? {
             RIG_GITHUB_TOKEN: bridgeGitHubToken,
             GITHUB_TOKEN: bridgeGitHubToken,
             GH_TOKEN: bridgeGitHubToken
+          } : {},
+          ...resumeMode ? {
+            RIG_RUN_RESUME: "1",
+            RIG_RUNTIME_ARTIFACT_CLEANUP: "preserve"
           } : {}
         },
         stdio: ["ignore", "pipe", "pipe"]
@@ -1502,6 +1969,25 @@ async function startLocalRun(state, runId, options) {
             broadcastSnapshotInvalidation(state);
             continue;
           }
+          if (line.startsWith("__RIG_WRAPPER_EVENT__")) {
+            try {
+              const wrapperEvent = JSON.parse(line.slice("__RIG_WRAPPER_EVENT__".length));
+              const eventType = normalizeString(wrapperEvent.type);
+              const payload = wrapperEvent.payload && typeof wrapperEvent.payload === "object" && !Array.isArray(wrapperEvent.payload) ? wrapperEvent.payload : {};
+              if (eventType === "pi.session.ready" && payload.privateMetadata && typeof payload.privateMetadata === "object" && !Array.isArray(payload.privateMetadata)) {
+                patchRunPiSessionMetadata(state.projectRoot, runId, payload.privateMetadata);
+              }
+              appendRunTimelineEntry(state.projectRoot, runId, {
+                id: `timeline:${runId}:${Date.now()}:wrapper:${eventType ?? "event"}`,
+                type: "wrapper-event",
+                eventType,
+                payload,
+                createdAt: normalizeString(wrapperEvent.at) ?? new Date().toISOString()
+              });
+            } catch {}
+            broadcastSnapshotInvalidation(state, "wrapper-event");
+            continue;
+          }
           appendRunLogEntryAndBroadcast(state, runId, {
             id: `log:${runId}:${Date.now()}`,
             title,
@@ -1519,18 +2005,24 @@ async function startLocalRun(state, runId, options) {
         handleRunProcessOutput(Buffer.isBuffer(data) ? data.toString("utf8") : String(data), "error", "Rig task run stderr");
       });
       try {
-        const exit = await new Promise((resolve10) => {
-          child.once("error", (error) => resolve10({ code: 1, signal: null, error }));
-          child.once("close", (code, signal) => resolve10({ code, signal }));
+        const exit = await new Promise((resolve11) => {
+          child.once("error", (error) => resolve11({ code: 1, signal: null, error }));
+          child.once("close", (code, signal) => resolve11({ code, signal }));
         });
         if (exit.error) {
           throw new Error(`Failed to start task run: ${exit.error.message}`);
         }
-        const current = readAuthorityRun8(state.projectRoot, runId);
+        const current = readAuthorityRun9(state.projectRoot, runId);
         if (!current) {
           return;
         }
-        if (exit.code !== 0 && current.status !== "completed" && current.status !== "stopped") {
+        if (closeoutRecord(current)?.status === "pending") {
+          try {
+            await runServerOwnedPrCloseout(state, runId);
+          } catch (closeoutError) {
+            await markServerOwnedCloseoutFailed(state, runId, closeoutError);
+          }
+        } else if (exit.code !== 0 && current.status !== "completed" && current.status !== "stopped") {
           const completedAt = current.completedAt ?? new Date().toISOString();
           const failureSummary = normalizeString(current.errorText) ?? summarizeRunValidationFailure(state.projectRoot, current) ?? `Rig task-run exited with code ${String(exit.code ?? "unknown")}`;
           if (current.status !== "failed") {
@@ -1621,24 +2113,24 @@ function resolveLocalRunCliProjectRoot(projectRoot) {
     process.env.PROJECT_RIG_ROOT?.trim()
   ].filter((value) => !!value);
   for (const candidate of envCandidates) {
-    if (existsSync6(resolve9(candidate, "packages/cli/bin/rig.ts"))) {
-      return resolve9(candidate);
+    if (existsSync7(resolve10(candidate, "packages/cli/bin/rig.ts"))) {
+      return resolve10(candidate);
     }
   }
-  if (existsSync6(resolve9(projectRoot, "packages/cli/bin/rig.ts"))) {
+  if (existsSync7(resolve10(projectRoot, "packages/cli/bin/rig.ts"))) {
     return projectRoot;
   }
   try {
     const monorepoRoot = resolveMonorepoRoot6(projectRoot);
-    const outerProjectRoot = dirname5(dirname5(monorepoRoot));
-    if (existsSync6(resolve9(outerProjectRoot, "packages/cli/bin/rig.ts"))) {
+    const outerProjectRoot = dirname6(dirname6(monorepoRoot));
+    if (existsSync7(resolve10(outerProjectRoot, "packages/cli/bin/rig.ts"))) {
       return outerProjectRoot;
     }
   } catch {}
   return projectRoot;
 }
 async function resumeRunRecord(state, input) {
-  const run = readAuthorityRun8(state.projectRoot, input.runId);
+  const run = readAuthorityRun9(state.projectRoot, input.runId);
   if (!run) {
     throw new Error(`Run not found: ${input.runId}`);
   }
@@ -1651,15 +2143,27 @@ async function resumeRunRecord(state, input) {
   if (run.status === "completed") {
     throw new Error("Completed runs cannot be resumed.");
   }
-  await startLocalRun(state, input.runId, { promptOverride: input.promptOverride ?? null });
+  const closeout = closeoutRecord(run);
+  const closeoutStatus = normalizeString(closeout?.status)?.toLowerCase() ?? "";
+  if (EXPLICIT_RESUMABLE_SERVER_CLOSEOUT_STATUSES.has(closeoutStatus)) {
+    patchRunRecord(state.projectRoot, input.runId, {
+      status: "reviewing",
+      completedAt: null,
+      errorText: null,
+      ...closeoutPhasePatch("queued", "pending", { ...closeout, resumedAt: input.createdAt })
+    });
+    scheduleServerOwnedPrCloseout(state, input.runId, "explicit-resume");
+    return;
+  }
+  await startLocalRun(state, input.runId, { promptOverride: input.promptOverride ?? null, resume: input.restart !== true });
 }
 function appendRunMessage(projectRoot, input) {
-  const run = readAuthorityRun8(projectRoot, input.runId);
+  const run = readAuthorityRun9(projectRoot, input.runId);
   if (!run) {
     throw new Error(`Run not found: ${input.runId}`);
   }
-  const timelinePath = resolve9(resolveAuthorityRunDir4(projectRoot, input.runId), "timeline.jsonl");
-  const existingLines = fileExists(timelinePath) ? readFileSync3(timelinePath, "utf8").trim() : "";
+  const timelinePath = resolve10(resolveAuthorityRunDir4(projectRoot, input.runId), "timeline.jsonl");
+  const existingLines = fileExists(timelinePath) ? readFileSync4(timelinePath, "utf8").trim() : "";
   const nextLine = JSON.stringify({
     id: input.messageId,
     type: "user_message",
@@ -1667,18 +2171,18 @@ function appendRunMessage(projectRoot, input) {
     attachments: input.attachments ?? [],
     createdAt: input.createdAt
   });
-  writeFileSync5(timelinePath, existingLines.length > 0 ? `${existingLines}
+  writeFileSync6(timelinePath, existingLines.length > 0 ? `${existingLines}
 ${nextLine}
 ` : `${nextLine}
 `, "utf8");
-  writeJsonFile4(resolve9(resolveAuthorityRunDir4(projectRoot, input.runId), "run.json"), {
+  writeJsonFile4(resolve10(resolveAuthorityRunDir4(projectRoot, input.runId), "run.json"), {
     ...run,
     updatedAt: input.createdAt
   });
 }
 async function stopRunRecord(stateOrProjectRoot, input) {
   const projectRoot = typeof stateOrProjectRoot === "string" ? stateOrProjectRoot : stateOrProjectRoot.projectRoot;
-  const run = readAuthorityRun8(projectRoot, input.runId);
+  const run = readAuthorityRun9(projectRoot, input.runId);
   if (!run) {
     throw new Error(`Run not found: ${input.runId}`);
   }
@@ -1697,7 +2201,7 @@ async function stopRunRecord(stateOrProjectRoot, input) {
     completedAt: run.completedAt ?? input.createdAt,
     updatedAt: input.createdAt
   };
-  writeJsonFile4(resolve9(resolveAuthorityRunDir4(projectRoot, input.runId), "run.json"), nextRun);
+  writeJsonFile4(resolve10(resolveAuthorityRunDir4(projectRoot, input.runId), "run.json"), nextRun);
   if (run.status !== "completed" && run.taskId) {
     const taskId = run.taskId;
     (async () => {
@@ -1735,34 +2239,63 @@ function removeTaskIdsFromQueueState2(projectRoot, taskIds) {
   writeQueueState(projectRoot, next);
   return next;
 }
-var ORPHANABLE_LOCAL_RUN_STATUSES = new Set(["preparing", "running"]);
-function reconcileOrphanedLocalRuns(state, runs, nowIso) {
-  let changed = false;
-  for (const run of runs) {
-    const status = normalizeString(run.status)?.toLowerCase() ?? "";
-    const serverPid = run.serverPid;
-    const wasStartedByRigServer = typeof serverPid === "number" || typeof serverPid === "string";
-    if (run.mode !== "local" || !wasStartedByRigServer || !ORPHANABLE_LOCAL_RUN_STATUSES.has(status) || state.runProcesses.has(run.runId)) {
-      continue;
-    }
-    const detail = "Recovered stale local run after Rig server restart; no live child process was attached to this server instance.";
-    patchRunRecord(state.projectRoot, run.runId, {
-      status: "failed",
-      completedAt: run.completedAt ?? nowIso,
-      updatedAt: nowIso,
-      errorText: detail
-    });
-    appendRunLogEntry(state.projectRoot, run.runId, {
-      id: `log:${run.runId}:stale-local-run`,
-      title: "Run marked stale after server restart",
-      detail,
-      tone: "error",
-      status: "failed",
-      createdAt: nowIso
+var RESUMABLE_SERVER_CLOSEOUT_STATUSES = new Set(["pending", "running"]);
+var EXPLICIT_RESUMABLE_SERVER_CLOSEOUT_STATUSES = new Set(["pending", "running", "needs_attention"]);
+var ACTIVE_LOCAL_RUN_STATUSES = new Set(["created", "preparing", "running", "validating", "reviewing"]);
+function processExists(pid) {
+  if (!Number.isInteger(pid) || pid <= 0)
+    return false;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function recoverStaleLocalRun(projectRoot, run) {
+  const record = run;
+  if (run.mode !== "local")
+    return false;
+  const closeout = closeoutRecord(record);
+  const closeoutStatus = normalizeString(closeout?.status)?.toLowerCase() ?? "";
+  const status = normalizeString(record.status)?.toLowerCase() ?? "";
+  if (RESUMABLE_SERVER_CLOSEOUT_STATUSES.has(closeoutStatus))
+    return false;
+  if (closeoutStatus === "needs_attention") {
+    if (!ACTIVE_LOCAL_RUN_STATUSES.has(status))
+      return false;
+    const completedAt2 = record.completedAt ?? new Date().toISOString();
+    patchRunRecord(projectRoot, run.runId, {
+      status: "needs_attention",
+      completedAt: completedAt2,
+      errorText: normalizeString(record.errorText) ?? (Array.isArray(closeout?.feedback) ? closeout.feedback.map(String).join(`
+`) : null)
     });
-    changed = true;
+    return true;
   }
-  return changed;
+  if (!ACTIVE_LOCAL_RUN_STATUSES.has(status))
+    return false;
+  const serverPid = typeof record.serverPid === "number" ? record.serverPid : null;
+  const childPid = typeof record.pid === "number" ? record.pid : null;
+  if (serverPid === null && childPid === null)
+    return false;
+  const hasLiveRecordedProcess = [serverPid, childPid].some((pid) => typeof pid === "number" && processExists(pid));
+  if (hasLiveRecordedProcess && serverPid === process.pid)
+    return false;
+  const completedAt = new Date().toISOString();
+  patchRunRecord(projectRoot, run.runId, {
+    status: "failed",
+    completedAt,
+    errorText: `Recovered stale local run ${run.runId} after server startup; no active server-owned process was tracking it.`
+  });
+  return true;
+}
+function collectResumableServerCloseouts(state, runs) {
+  return runs.filter((run) => {
+    const closeout = closeoutRecord(run);
+    const closeoutStatus = normalizeString(closeout?.status)?.toLowerCase() ?? "";
+    return run.mode === "local" && RESUMABLE_SERVER_CLOSEOUT_STATUSES.has(closeoutStatus) && !state.runProcesses.has(run.runId);
+  });
 }
 async function reconcileScheduler(state, reason) {
   if (state.scheduler.reconciling) {
@@ -1777,7 +2310,28 @@ async function reconcileScheduler(state, reason) {
         const queue = readQueueState(state.projectRoot);
         const tasks = await state.snapshotService.getWorkspaceTasks();
         let runs = listAuthorityRuns7(state.projectRoot);
-        let changed = reconcileOrphanedLocalRuns(state, runs, new Date().toISOString());
+        let changed = false;
+        for (const run of runs) {
+          if (!state.runProcesses.has(run.runId) && recoverStaleLocalRun(state.projectRoot, run)) {
+            changed = true;
+          }
+        }
+        if (changed) {
+          runs = listAuthorityRuns7(state.projectRoot);
+        }
+        const resumableCloseouts = collectResumableServerCloseouts(state, runs);
+        for (const run of resumableCloseouts) {
+          appendRunLogEntry(state.projectRoot, run.runId, {
+            id: `log:${run.runId}:server-closeout-auto-resume:${Date.now()}`,
+            title: "Server-owned closeout auto-resume scheduled",
+            detail: `Rig server recovered closeout checkpoint ${run.runId} after ${reason}; resuming the server-owned lifecycle phase.`,
+            tone: "info",
+            status: "reviewing",
+            createdAt: new Date().toISOString()
+          });
+          scheduleServerOwnedPrCloseout(state, run.runId, "auto-resume");
+          changed = true;
+        }
         if (changed) {
           runs = listAuthorityRuns7(state.projectRoot);
         }
@@ -1850,8 +2404,10 @@ async function reconcileScheduler(state, reason) {
   }
 }
 export {
+  updateRunTaskSourceLifecycle,
   stopRunRecord,
   startLocalRun,
+  runServerOwnedPrCloseout,
   resumeRunRecord,
   resolveLocalRunCliProjectRoot,
   removeTaskIdsFromQueueState2 as removeTaskIdsFromQueueState,