@harness-engineering/orchestrator 0.8.3 → 0.9.0

package/dist/index.mjs

@@ -1219,7 +1219,7 @@ var ClaimManager = class {
 // src/core/pr-detector.ts
 import { execFile } from "child_process";
 import { promisify } from "util";
-var PRDetector = class {
+var PRDetector = class _PRDetector {
   logger;
   execFileFn;
   projectRoot;
@@ -1335,35 +1335,124 @@ var PRDetector = class {
     }
   }
   /**
-   * Filters out candidates that already have an open GitHub PR, running
-   * checks with limited concurrency to avoid overwhelming the GitHub API.
-   * For candidates with an externalId, searches for PRs linked to the
-   * GitHub issue. Falls back to `feat/<identifier>` branch lookup otherwise.
-   * Fail-open on API errors.
+   * GitHub closing keywords that link a PR to an issue it will close.
+   * @see https://docs.github.com/articles/closing-issues-using-keywords
+   */
+  static CLOSING_REF_RE = /\b(?:close[sd]?|fix(?:e[sd])?|resolve[sd]?)[\s:]+#(\d+)/gi;
+  /**
+   * Extracts the issue numbers a PR body declares it will close
+   * (e.g. `Closes #42`, `fixes #7`, `Resolves: #99`).
+   */
+  parseClosingIssueNumbers(body) {
+    const nums = [];
+    for (const match of body.matchAll(_PRDetector.CLOSING_REF_RE)) {
+      nums.push(parseInt(match[1], 10));
+    }
+    return nums;
+  }
+  /**
+   * Lists every open PR for a repo in a single `gh pr list` call and returns
+   * the set of issue numbers those PRs close (parsed from their bodies).
+   *
+   * This is the batched replacement for per-issue `gh pr list --search
+   * "closes #N"` queries. Every `gh pr list` form (search or plain list) is
+   * served by GitHub's GraphQL API and consumes from the shared ~5000/hr
+   * GraphQL budget, so issuing one query per candidate per tick exhausted the
+   * limit on busy boards. A single `--state open` list returns every open PR
+   * in one request regardless of candidate count, collapsing N calls into 1.
+   *
+   * Returns `null` if the check itself failed (gh missing, rate limited,
+   * network error) so callers can fail open rather than block real work.
+   */
+  async fetchOpenPRClosures(owner, repo) {
+    try {
+      const exec = promisify(this.execFileFn);
+      const { stdout } = await exec(
+        "gh",
+        [
+          "pr",
+          "list",
+          "--repo",
+          `${owner}/${repo}`,
+          "--state",
+          "open",
+          "--json",
+          "body",
+          "--limit",
+          "200"
+        ],
+        {
+          cwd: this.projectRoot,
+          timeout: 15e3
+        }
+      );
+      const prs = JSON.parse(stdout);
+      const closed = /* @__PURE__ */ new Set();
+      for (const pr of prs) {
+        for (const n of this.parseClosingIssueNumbers(pr.body ?? "")) closed.add(n);
+      }
+      return closed;
+    } catch (err) {
+      this.logger.debug(`Failed to list open PRs for ${owner}/${repo}`, {
+        error: String(err)
+      });
+      return null;
+    }
+  }
+  /**
+   * Filters out candidates that already have an open GitHub PR.
+   *
+   * For GitHub-issue candidates the check is batched: one `gh pr list` per
+   * distinct repo (not one search per issue), parsing closing references
+   * locally. Candidates without a GitHub externalId fall back to a
+   * `feat/<identifier>` branch lookup, throttled to a few concurrent gh calls.
+   * Fail-open on API errors so a flaky/rate-limited GitHub never blocks work.
    */
   async filterCandidatesWithOpenPRs(candidates) {
+    const repos = /* @__PURE__ */ new Map();
+    for (const candidate of candidates) {
+      const parsed = candidate.externalId ? this.parseExternalId(candidate.externalId) : null;
+      if (parsed) repos.set(`${parsed.owner}/${parsed.repo}`, parsed);
+    }
+    const repoClosures = /* @__PURE__ */ new Map();
+    await Promise.all(
+      [...repos.values()].map(async ({ owner, repo }) => {
+        repoClosures.set(`${owner}/${repo}`, await this.fetchOpenPRClosures(owner, repo));
+      })
+    );
+    const identifierCandidates = candidates.filter(
+      (c) => !(c.externalId && this.parseExternalId(c.externalId))
+    );
+    const identifiersWithOpenPR = /* @__PURE__ */ new Set();
     const concurrency = 3;
-    const results = [];
-    for (let i = 0; i < candidates.length; i += concurrency) {
-      const batch = candidates.slice(i, i + concurrency);
-      const batchResults = await Promise.allSettled(
-        batch.map(async (candidate) => {
-          const hasOpenPR = candidate.externalId ? await this.hasOpenPRForExternalId(candidate.externalId) : await this.hasOpenPRForIdentifier(candidate.identifier);
-          return { candidate, hasOpenPR };
-        })
+    for (let i = 0; i < identifierCandidates.length; i += concurrency) {
+      const batch = identifierCandidates.slice(i, i + concurrency);
+      const settled = await Promise.allSettled(
+        batch.map(async (c) => ({
+          identifier: c.identifier,
+          hasOpenPR: await this.hasOpenPRForIdentifier(c.identifier)
+        }))
       );
-      results.push(...batchResults);
+      for (const result of settled) {
+        if (result.status === "fulfilled" && result.value.hasOpenPR) {
+          identifiersWithOpenPR.add(result.value.identifier);
+        }
+      }
     }
     const filtered = [];
-    for (let i = 0; i < results.length; i++) {
-      const result = results[i];
-      if (!result || result.status === "rejected") {
-        filtered.push(candidates[i]);
-        continue;
+    for (const candidate of candidates) {
+      const parsed = candidate.externalId ? this.parseExternalId(candidate.externalId) : null;
+      let hasOpenPR;
+      let via;
+      if (parsed) {
+        const closures = repoClosures.get(`${parsed.owner}/${parsed.repo}`);
+        hasOpenPR = closures ? closures.has(parsed.number) : false;
+        via = `externalId ${candidate.externalId}`;
+      } else {
+        hasOpenPR = identifiersWithOpenPR.has(candidate.identifier);
+        via = `feat/${candidate.identifier}`;
       }
-      const { candidate, hasOpenPR } = result.value;
       if (hasOpenPR) {
-        const via = candidate.externalId ? `externalId ${candidate.externalId}` : `feat/${candidate.identifier}`;
         this.logger.info(`Skipping ${candidate.title}: open PR exists (${via})`);
       } else {
         filtered.push(candidate);
@@ -2120,11 +2209,13 @@ var WorkflowLoader = class {
 };
 
 // src/tracker/adapters/roadmap.ts
-import * as fs8 from "fs/promises";
 import { createHash as createHash2 } from "crypto";
 import {
-  parseRoadmap,
-  serializeRoadmap
+  resolveRoadmapStoreForFile,
+  applyRoadmapDiff,
+  claim as claimFeature,
+  setStatus as setFeatureStatus,
+  isClaimableBy
 } from "@harness-engineering/core";
 import {
   Ok as Ok4,
@@ -2157,8 +2248,7 @@ var RoadmapTrackerAdapter = class {
   async fetchIssuesByStates(stateNames) {
     try {
       if (!this.config.filePath) return Err3(new Error("Missing filePath"));
-      const content = await fs8.readFile(this.config.filePath, "utf-8");
-      const roadmapResult = parseRoadmap(content);
+      const roadmapResult = await this.loadRoadmap();
       if (!roadmapResult.ok) return roadmapResult;
       const issues = [];
       for (const milestone of roadmapResult.value.milestones) {
@@ -2189,16 +2279,19 @@ var RoadmapTrackerAdapter = class {
       if (!terminal) {
         return Err3(new Error("Tracker config has no terminalStates; cannot mark complete"));
       }
-      const content = await fs8.readFile(this.config.filePath, "utf-8");
-      const roadmapResult = parseRoadmap(content);
+      const store = this.resolveStore();
+      const roadmapResult = await store.load();
       if (!roadmapResult.ok) return roadmapResult;
       const roadmap = roadmapResult.value;
+      const before = structuredClone(roadmap);
       const target = this.findFeatureById(roadmap.milestones, issueId);
       if (!target) return Ok4(void 0);
       const normalizedTerminal = this.config.terminalStates.map((s) => s.toLowerCase());
       if (normalizedTerminal.includes(target.status.toLowerCase())) return Ok4(void 0);
-      target.status = terminal;
-      await fs8.writeFile(this.config.filePath, serializeRoadmap(roadmap), "utf-8");
+      const now = (/* @__PURE__ */ new Date()).toISOString();
+      setFeatureStatus(roadmap, target, terminal, now.slice(0, 10));
+      const persisted = await applyRoadmapDiff(store, before, roadmap);
+      if (!persisted.ok) return persisted;
       return Ok4(void 0);
     } catch (error) {
       return Err3(error instanceof Error ? error : new Error(String(error)));
@@ -2212,22 +2305,24 @@ var RoadmapTrackerAdapter = class {
   async claimIssue(issueId, orchestratorId) {
     try {
       if (!this.config.filePath) return Err3(new Error("Missing filePath"));
-      const content = await fs8.readFile(this.config.filePath, "utf-8");
-      const roadmapResult = parseRoadmap(content);
+      const store = this.resolveStore();
+      const roadmapResult = await store.load();
       if (!roadmapResult.ok) return roadmapResult;
       const roadmap = roadmapResult.value;
+      const before = structuredClone(roadmap);
       const target = this.findFeatureById(roadmap.milestones, issueId);
       if (!target) return Ok4(void 0);
-      if (target.assignee != null && target.assignee !== orchestratorId) {
+      if (!isClaimableBy(target, orchestratorId)) {
         return Ok4(void 0);
       }
       if (target.status === "in-progress" && target.assignee === orchestratorId) {
         return Ok4(void 0);
       }
-      target.status = "in-progress";
-      target.assignee = orchestratorId;
-      target.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
-      await fs8.writeFile(this.config.filePath, serializeRoadmap(roadmap), "utf-8");
+      const now = (/* @__PURE__ */ new Date()).toISOString();
+      claimFeature(roadmap, target, orchestratorId, now.slice(0, 10));
+      target.updatedAt = now;
+      const persisted = await applyRoadmapDiff(store, before, roadmap);
+      if (!persisted.ok) return persisted;
       return Ok4(void 0);
     } catch (error) {
       return Err3(error instanceof Error ? error : new Error(String(error)));
@@ -2244,24 +2339,39 @@ var RoadmapTrackerAdapter = class {
       if (!activeState) {
         return Err3(new Error("Tracker config has no activeStates; cannot release"));
       }
-      const content = await fs8.readFile(this.config.filePath, "utf-8");
-      const roadmapResult = parseRoadmap(content);
+      const store = this.resolveStore();
+      const roadmapResult = await store.load();
       if (!roadmapResult.ok) return roadmapResult;
       const roadmap = roadmapResult.value;
+      const before = structuredClone(roadmap);
       const target = this.findFeatureById(roadmap.milestones, issueId);
       if (!target) return Ok4(void 0);
       if (this.config.activeStates.includes(target.status) && target.assignee === null) {
         return Ok4(void 0);
       }
-      target.status = activeState;
-      target.assignee = null;
+      const now = (/* @__PURE__ */ new Date()).toISOString();
+      setFeatureStatus(roadmap, target, activeState, now.slice(0, 10));
       target.updatedAt = null;
-      await fs8.writeFile(this.config.filePath, serializeRoadmap(roadmap), "utf-8");
+      const persisted = await applyRoadmapDiff(store, before, roadmap);
+      if (!persisted.ok) return persisted;
       return Ok4(void 0);
     } catch (error) {
       return Err3(error instanceof Error ? error : new Error(String(error)));
     }
   }
+  /**
+   * Resolve the roadmap store anchored on the configured aggregate file path.
+   * The shard backend is chosen when a sibling `roadmap.d/` exists next to the
+   * file; otherwise the monolith file is read/written whole. Callers guard
+   * `this.config.filePath` before invoking.
+   */
+  resolveStore() {
+    return resolveRoadmapStoreForFile({ roadmapPath: this.config.filePath });
+  }
+  /** Load the roadmap via the store (sharded or monolith), returning a Result. */
+  loadRoadmap() {
+    return this.resolveStore().load();
+  }
   findFeatureById(milestones, issueId) {
     for (const milestone of milestones) {
       for (const feature of milestone.features) {
@@ -2278,8 +2388,7 @@ var RoadmapTrackerAdapter = class {
   async fetchIssueStatesByIds(issueIds) {
     try {
       if (!this.config.filePath) return Err3(new Error("Missing filePath"));
-      const content = await fs8.readFile(this.config.filePath, "utf-8");
-      const roadmapResult = parseRoadmap(content);
+      const roadmapResult = await this.loadRoadmap();
       if (!roadmapResult.ok) return roadmapResult;
       const issueMap = /* @__PURE__ */ new Map();
       for (const milestone of roadmapResult.value.milestones) {
@@ -2334,7 +2443,57 @@ var RoadmapTrackerAdapter = class {
 };
 
 // src/tracker/extensions/linear.ts
-import { Ok as Ok5 } from "@harness-engineering/types";
+import { Ok as Ok5, Err as Err4 } from "@harness-engineering/types";
+var LINEAR_GRAPHQL_ENDPOINT = "https://api.linear.app/graphql";
+var LinearGraphQLClient = class {
+  apiKey;
+  endpoint;
+  fetchFn;
+  constructor(opts) {
+    this.apiKey = opts.apiKey;
+    this.endpoint = opts.endpoint ?? LINEAR_GRAPHQL_ENDPOINT;
+    this.fetchFn = opts.fetchFn ?? globalThis.fetch;
+  }
+  async query(query, variables) {
+    let res;
+    try {
+      res = await this.fetchFn(this.endpoint, {
+        method: "POST",
+        headers: {
+          Authorization: this.apiKey,
+          "Content-Type": "application/json"
+        },
+        body: JSON.stringify({ query, variables: variables ?? {} })
+      });
+    } catch (err) {
+      return Err4(
+        new Error(
+          `Linear GraphQL request failed: ${err instanceof Error ? err.message : String(err)}`
+        )
+      );
+    }
+    if (!res.ok) {
+      const body = await res.text().catch(() => "");
+      const detail = body ? `: ${body.slice(0, 500)}` : "";
+      return Err4(new Error(`Linear GraphQL HTTP ${res.status}${detail}`));
+    }
+    let envelope;
+    try {
+      envelope = await res.json();
+    } catch (err) {
+      return Err4(
+        new Error(
+          `Linear GraphQL response was not valid JSON: ${err instanceof Error ? err.message : String(err)}`
+        )
+      );
+    }
+    if (envelope.errors && envelope.errors.length > 0) {
+      const message = envelope.errors.map((e) => e.message ?? "unknown error").join("; ");
+      return Err4(new Error(`Linear GraphQL error: ${message}`));
+    }
+    return Ok5(envelope.data ?? {});
+  }
+};
 var LinearGraphQLStub = class {
   async query(query, _variables) {
     console.log("Linear GraphQL query (stub):", query);
@@ -2343,11 +2502,11 @@ var LinearGraphQLStub = class {
 };
 
 // src/workspace/manager.ts
-import * as fs9 from "fs/promises";
+import * as fs8 from "fs/promises";
 import * as path8 from "path";
 import { execFile as execFile2 } from "child_process";
 import { promisify as promisify2 } from "util";
-import { Ok as Ok6, Err as Err4 } from "@harness-engineering/types";
+import { Ok as Ok6, Err as Err5 } from "@harness-engineering/types";
 var WorkspaceManager = class _WorkspaceManager {
   config;
   /** Absolute path to the git repository root (resolved lazily). */
@@ -2383,7 +2542,7 @@ var WorkspaceManager = class _WorkspaceManager {
   async getRepoRoot() {
     if (this.repoRoot) return this.repoRoot;
     const root = path8.resolve(this.config.root);
-    await fs9.mkdir(root, { recursive: true });
+    await fs8.mkdir(root, { recursive: true });
     const stdout = await this.git(["rev-parse", "--show-toplevel"], root);
     this.repoRoot = stdout.trim();
     return this.repoRoot;
@@ -2396,21 +2555,21 @@ var WorkspaceManager = class _WorkspaceManager {
     try {
       const workspacePath = path8.resolve(this.resolvePath(identifier));
       try {
-        await fs9.access(path8.join(workspacePath, ".git"));
+        await fs8.access(path8.join(workspacePath, ".git"));
         const repoRoot2 = await this.getRepoRoot();
         try {
           await this.git(["worktree", "remove", "--force", workspacePath], repoRoot2);
         } catch {
-          await fs9.rm(workspacePath, { recursive: true, force: true });
+          await fs8.rm(workspacePath, { recursive: true, force: true });
         }
       } catch {
         try {
-          await fs9.access(workspacePath);
+          await fs8.access(workspacePath);
           const repoRoot2 = await this.getRepoRoot();
           try {
             await this.git(["worktree", "remove", "--force", workspacePath], repoRoot2);
           } catch {
-            await fs9.rm(workspacePath, { recursive: true, force: true });
+            await fs8.rm(workspacePath, { recursive: true, force: true });
           }
         } catch {
         }
@@ -2422,7 +2581,7 @@ var WorkspaceManager = class _WorkspaceManager {
       await this.seedWorkspace(workspacePath, repoRoot);
       return Ok6(workspacePath);
     } catch (error) {
-      return Err4(error instanceof Error ? error : new Error(String(error)));
+      return Err5(error instanceof Error ? error : new Error(String(error)));
     }
   }
   /**
@@ -2463,13 +2622,13 @@ var WorkspaceManager = class _WorkspaceManager {
       }
       const src = path8.join(repoRoot, rel);
       try {
-        await fs9.access(src);
+        await fs8.access(src);
       } catch {
         continue;
       }
       const dest = path8.join(workspacePath, rel);
       try {
-        await fs9.cp(src, dest, { recursive: true, force: true });
+        await fs8.cp(src, dest, { recursive: true, force: true });
       } catch {
       }
     }
@@ -2545,7 +2704,7 @@ var WorkspaceManager = class _WorkspaceManager {
   async exists(identifier) {
     try {
       const workspacePath = this.resolvePath(identifier);
-      await fs9.access(workspacePath);
+      await fs8.access(workspacePath);
       return true;
     } catch {
       return false;
@@ -2560,7 +2719,7 @@ var WorkspaceManager = class _WorkspaceManager {
     try {
       const workspacePath = path8.resolve(this.resolvePath(identifier));
       try {
-        await fs9.access(path8.join(workspacePath, ".git"));
+        await fs8.access(path8.join(workspacePath, ".git"));
       } catch {
         return null;
       }
@@ -2671,18 +2830,18 @@ var WorkspaceManager = class _WorkspaceManager {
         const repoRoot = await this.getRepoRoot();
         await this.git(["worktree", "remove", "--force", workspacePath], repoRoot);
       } catch {
-        await fs9.rm(workspacePath, { recursive: true, force: true });
+        await fs8.rm(workspacePath, { recursive: true, force: true });
       }
       return Ok6(void 0);
     } catch (error) {
-      return Err4(error instanceof Error ? error : new Error(String(error)));
+      return Err5(error instanceof Error ? error : new Error(String(error)));
     }
   }
 };
 
 // src/workspace/hooks.ts
 import { spawn } from "child_process";
-import { Ok as Ok7, Err as Err5 } from "@harness-engineering/types";
+import { Ok as Ok7, Err as Err6 } from "@harness-engineering/types";
 var WorkspaceHooks = class {
   config;
   constructor(config) {
@@ -2709,19 +2868,19 @@ var WorkspaceHooks = class {
       });
       const timeout = setTimeout(() => {
         child.kill();
-        resolve8(Err5(new Error(`Hook ${hookName} timed out after ${this.config.timeoutMs}ms`)));
+        resolve8(Err6(new Error(`Hook ${hookName} timed out after ${this.config.timeoutMs}ms`)));
       }, this.config.timeoutMs);
       child.on("exit", (code) => {
         clearTimeout(timeout);
         if (code === 0) {
           resolve8(Ok7(void 0));
         } else {
-          resolve8(Err5(new Error(`Hook ${hookName} failed with exit code ${code}`)));
+          resolve8(Err6(new Error(`Hook ${hookName} failed with exit code ${code}`)));
         }
       });
       child.on("error", (error) => {
         clearTimeout(timeout);
-        resolve8(Err5(error));
+        resolve8(Err6(error));
       });
     });
   }
@@ -3401,7 +3560,7 @@ import {
 } from "@harness-engineering/core";
 
 // src/tracker/adapters/github-issues-issue-tracker.ts
-import { Ok as Ok9, Err as Err6 } from "@harness-engineering/types";
+import { Ok as Ok9, Err as Err7 } from "@harness-engineering/types";
 var GitHubIssuesIssueTrackerAdapter = class {
   client;
   config;
@@ -3416,12 +3575,12 @@ var GitHubIssuesIssueTrackerAdapter = class {
     const r = await this.client.fetchByStatus(
       stateNames
     );
-    if (!r.ok) return Err6(r.error);
+    if (!r.ok) return Err7(r.error);
     return Ok9(r.value.map((f) => this.mapTrackedToIssue(f)));
   }
   async fetchIssueStatesByIds(issueIds) {
     const r = await this.client.fetchAll();
-    if (!r.ok) return Err6(r.error);
+    if (!r.ok) return Err7(r.error);
     const wanted = new Set(issueIds);
     const out = /* @__PURE__ */ new Map();
     for (const f of r.value.features) {
@@ -3431,17 +3590,17 @@ var GitHubIssuesIssueTrackerAdapter = class {
   }
   async claimIssue(issueId, orchestratorId) {
     const r = await this.client.claim(issueId, orchestratorId);
-    if (!r.ok) return Err6(r.error);
+    if (!r.ok) return Err7(r.error);
     return Ok9(void 0);
   }
   async releaseIssue(issueId) {
     const r = await this.client.release(issueId);
-    if (!r.ok) return Err6(r.error);
+    if (!r.ok) return Err7(r.error);
     return Ok9(void 0);
   }
   async markIssueComplete(issueId) {
     const r = await this.client.complete(issueId);
-    if (!r.ok) return Err6(r.error);
+    if (!r.ok) return Err7(r.error);
     return Ok9(void 0);
   }
   /**
@@ -4092,14 +4251,14 @@ import * as readline from "readline";
 import { randomUUID as randomUUID2 } from "crypto";
 import {
   Ok as Ok10,
-  Err as Err7
+  Err as Err8
 } from "@harness-engineering/types";
 function resolveExitCode(code, command, resolve8) {
   if (code === 0) {
     resolve8(Ok10(void 0));
   } else {
     resolve8(
-      Err7({
+      Err8({
         category: "agent_not_found",
         message: `Claude command '${command}' not found or failed`
       })
@@ -4107,7 +4266,7 @@ function resolveExitCode(code, command, resolve8) {
   }
 }
 function resolveSpawnError(command, resolve8) {
-  resolve8(Err7({ category: "agent_not_found", message: `Claude command '${command}' not found` }));
+  resolve8(Err8({ category: "agent_not_found", message: `Claude command '${command}' not found` }));
 }
 var JUST_PAST_GRACE_MS = 5 * 6e4;
 var PRIMARY_LIMIT_RE = /You[\u2019']ve hit your limit.*resets\s+(\d{1,2}(?::\d{2})?\s*(?:am|pm))\s*\(([^)]+)\)/i;
@@ -4457,7 +4616,7 @@ var ClaudeBackend = class {
 import Anthropic from "@anthropic-ai/sdk";
 import {
   Ok as Ok11,
-  Err as Err8
+  Err as Err9
 } from "@harness-engineering/types";
 import { AnthropicCacheAdapter } from "@harness-engineering/core";
 var AnthropicBackend = class {
@@ -4476,7 +4635,7 @@ var AnthropicBackend = class {
   }
   async startSession(params) {
     if (!this.config.apiKey) {
-      return Err8({
+      return Err9({
         category: "agent_not_found",
         message: "ANTHROPIC_API_KEY is not set"
       });
@@ -4557,7 +4716,7 @@ var AnthropicBackend = class {
   }
   async healthCheck() {
     if (!this.config.apiKey) {
-      return Err8({
+      return Err9({
         category: "response_error",
         message: "ANTHROPIC_API_KEY is not set"
       });
@@ -4570,7 +4729,7 @@ var AnthropicBackend = class {
 import OpenAI from "openai";
 import {
   Ok as Ok12,
-  Err as Err9
+  Err as Err10
 } from "@harness-engineering/types";
 import { OpenAICacheAdapter } from "@harness-engineering/core";
 var OpenAIBackend = class {
@@ -4588,7 +4747,7 @@ var OpenAIBackend = class {
   }
   async startSession(params) {
     if (!this.config.apiKey) {
-      return Err9({
+      return Err10({
         category: "agent_not_found",
         message: "OPENAI_API_KEY is not set"
       });
@@ -4683,7 +4842,7 @@ var OpenAIBackend = class {
       await this.client.models.list();
       return Ok12(void 0);
     } catch (err) {
-      return Err9({
+      return Err10({
         category: "response_error",
         message: err instanceof Error ? err.message : "OpenAI health check failed"
       });
@@ -4695,7 +4854,7 @@ var OpenAIBackend = class {
 import { GoogleGenAI } from "@google/genai";
 import {
   Ok as Ok13,
-  Err as Err10
+  Err as Err11
 } from "@harness-engineering/types";
 import { GeminiCacheAdapter } from "@harness-engineering/core";
 var GeminiBackend = class {
@@ -4711,7 +4870,7 @@ var GeminiBackend = class {
   }
   async startSession(params) {
     if (!this.config.apiKey) {
-      return Err10({
+      return Err11({
         category: "agent_not_found",
         message: "GEMINI_API_KEY is not set"
       });
@@ -4811,7 +4970,7 @@ var GeminiBackend = class {
   }
   async healthCheck() {
     if (!this.config.apiKey) {
-      return Err10({
+      return Err11({
         category: "agent_not_found",
         message: "GEMINI_API_KEY is not set"
       });
@@ -4820,7 +4979,7 @@ var GeminiBackend = class {
       new GoogleGenAI({ apiKey: this.config.apiKey });
       return Ok13(void 0);
     } catch (err) {
-      return Err10({
+      return Err11({
         category: "response_error",
         message: err instanceof Error ? err.message : "Gemini health check failed"
       });
@@ -4832,7 +4991,7 @@ var GeminiBackend = class {
 import OpenAI2 from "openai";
 import {
   Ok as Ok14,
-  Err as Err11
+  Err as Err12
 } from "@harness-engineering/types";
 var DEFAULT_TIMEOUT_MS = 9e4;
 var LocalBackend = class {
@@ -4859,7 +5018,7 @@ var LocalBackend = class {
     if (this.getModel) {
       const candidate = this.getModel();
       if (candidate === null) {
-        return Err11({
+        return Err12({
           category: "agent_not_found",
           message: "No local model available; check dashboard for details."
         });
@@ -4948,7 +5107,7 @@ var LocalBackend = class {
       await this.client.models.list();
       return Ok14(void 0);
     } catch (err) {
-      return Err11({
+      return Err12({
         category: "response_error",
         message: err instanceof Error ? err.message : "Local backend health check failed"
       });
@@ -4960,7 +5119,7 @@ var LocalBackend = class {
 import { randomUUID as randomUUID3 } from "crypto";
 import {
   Ok as Ok15,
-  Err as Err12
+  Err as Err13
 } from "@harness-engineering/types";
 var SILENT_EVENTS = /* @__PURE__ */ new Set([
   "turn_end",
@@ -5078,7 +5237,7 @@ var PiBackend = class {
       if (this.config.getModel) {
         const candidate = this.config.getModel();
         if (candidate === null) {
-          return Err12({
+          return Err13({
             category: "agent_not_found",
             message: "No local model available; check dashboard for details."
           });
@@ -5108,7 +5267,7 @@ var PiBackend = class {
       };
       return Ok15(session);
     } catch (err) {
-      return Err12({
+      return Err13({
         category: "response_error",
         message: `Failed to create pi session: ${err instanceof Error ? err.message : String(err)}`
       });
@@ -5245,7 +5404,7 @@ var PiBackend = class {
       await import("@earendil-works/pi-coding-agent");
       return Ok15(void 0);
     } catch (err) {
-      return Err12({
+      return Err13({
         category: "agent_not_found",
         message: `Pi SDK not available: ${err instanceof Error ? err.message : String(err)}`
       });
@@ -5257,7 +5416,7 @@ var PiBackend = class {
 import { spawn as spawn3 } from "child_process";
 import {
   Ok as Ok16,
-  Err as Err13
+  Err as Err14
 } from "@harness-engineering/types";
 var DEFAULT_TIMEOUT_MS2 = 9e4;
 var FORBIDDEN_HOST_CHARS = /[;&|`$()\n\r<>]/;
@@ -5404,7 +5563,7 @@ var SshBackend = class {
         });
       } catch (err) {
         resolve8(
-          Err13({
+          Err14({
             category: "agent_not_found",
             message: err instanceof Error ? err.message : "failed to spawn ssh"
           })
@@ -5427,7 +5586,7 @@ var SshBackend = class {
           resolve8(Ok16(void 0));
         } else {
           resolve8(
-            Err13({
+            Err14({
               category: "agent_not_found",
               message: `ssh health check failed (exit=${code ?? "null"}): ${stderr.slice(0, 500)}`
             })
@@ -5436,7 +5595,7 @@ var SshBackend = class {
       });
       child.on("error", (err) => {
         clearTimeout(timer);
-        resolve8(Err13({ category: "agent_not_found", message: err.message }));
+        resolve8(Err14({ category: "agent_not_found", message: err.message }));
       });
     });
   }
@@ -5498,7 +5657,7 @@ function waitForExit(child) {
 import { spawn as spawn4 } from "child_process";
 import {
   Ok as Ok17,
-  Err as Err14
+  Err as Err15
 } from "@harness-engineering/types";
 var ServerlessBackend = class {
   handles = /* @__PURE__ */ new Map();
@@ -5597,7 +5756,7 @@ var OciServerlessBackend = class extends ServerlessBackend {
     if (!result.ok) return result;
     const id = result.value.trim().split(/\s+/)[0] ?? "";
     if (!id) {
-      return Err14({
+      return Err15({
         category: "response_error",
         message: "OciServerlessBackend: empty container id from runtime"
       });
@@ -5657,7 +5816,7 @@ var OciServerlessBackend = class extends ServerlessBackend {
   }
   async teardown(handle) {
     if (handle.adapter !== this.name) {
-      return Err14({
+      return Err15({
         category: "response_error",
         message: `handle adapter mismatch: got '${handle.adapter}', expected '${this.name}'`
       });
@@ -5688,7 +5847,7 @@ var OciServerlessBackend = class extends ServerlessBackend {
         });
       } catch (err) {
         resolve8(
-          Err14({
+          Err15({
             category: "agent_not_found",
             message: err instanceof Error ? err.message : "failed to spawn runtime"
           })
@@ -5715,7 +5874,7 @@ var OciServerlessBackend = class extends ServerlessBackend {
           resolve8(Ok17(stdout));
         } else {
           resolve8(
-            Err14({
+            Err15({
               category: "response_error",
               message: `runtime '${binary} ${args.join(" ")}' exited ${code ?? "null"}: ${stderr.slice(0, 500)}`
             })
@@ -5724,7 +5883,7 @@ var OciServerlessBackend = class extends ServerlessBackend {
       });
       child.on("error", (err) => {
         clearTimeout(timer);
-        resolve8(Err14({ category: "agent_not_found", message: err.message }));
+        resolve8(Err15({ category: "agent_not_found", message: err.message }));
       });
     });
   }
@@ -5881,7 +6040,7 @@ function createBackend(def, options = {}) {
 
 // src/agent/backends/container.ts
 import {
-  Err as Err15
+  Err as Err16
 } from "@harness-engineering/types";
 function toAgentError(message, details) {
   return { category: "response_error", message, details };
@@ -5913,7 +6072,7 @@ var ContainerBackend = class {
     }
     const result = await this.secretBackend.resolveSecrets(this.secretKeys);
     if (!result.ok) {
-      return Err15(toAgentError(`Secret resolution failed: ${result.error.message}`, result.error));
+      return Err16(toAgentError(`Secret resolution failed: ${result.error.message}`, result.error));
     }
     return { ok: true, value: result.value };
   }
@@ -5938,7 +6097,7 @@ var ContainerBackend = class {
     const createOpts = this.buildCreateOpts(params, envResult.value);
     const containerResult = await this.runtime.createContainer(createOpts);
     if (!containerResult.ok) {
-      return Err15(
+      return Err16(
         toAgentError(
           `Container creation failed: ${containerResult.error.message}`,
           containerResult.error
@@ -5963,7 +6122,7 @@ var ContainerBackend = class {
       this.containerHandles.delete(session.sessionId);
       const removeResult = await this.runtime.removeContainer(handle);
       if (!removeResult.ok) {
-        return Err15(
+        return Err16(
           toAgentError(
             `Container removal failed: ${removeResult.error.message}`,
             removeResult.error
@@ -5976,7 +6135,7 @@ var ContainerBackend = class {
   async healthCheck() {
     const runtimeResult = await this.runtime.healthCheck();
     if (!runtimeResult.ok) {
-      return Err15({
+      return Err16({
         category: "agent_not_found",
         message: `Container runtime unhealthy: ${runtimeResult.error.message}`,
         details: runtimeResult.error
@@ -5988,7 +6147,7 @@ var ContainerBackend = class {
 
 // src/agent/runtime/docker.ts
 import { execFile as execFile3, spawn as spawn5 } from "child_process";
-import { Ok as Ok18, Err as Err16 } from "@harness-engineering/types";
+import { Ok as Ok18, Err as Err17 } from "@harness-engineering/types";
 function dockerExec(args) {
   return new Promise((resolve8, reject) => {
     execFile3("docker", args, (error, stdout) => {
@@ -6023,7 +6182,7 @@ var DockerRuntime = class {
       const containerId = await dockerExec(args);
       return Ok18({ containerId, runtime: this.name });
     } catch (error) {
-      return Err16({
+      return Err17({
         category: "container_create_failed",
         message: `Failed to create container: ${error instanceof Error ? error.message : String(error)}`,
         details: error
@@ -6069,7 +6228,7 @@ var DockerRuntime = class {
       await dockerExec(["rm", "-f", handle.containerId]);
       return Ok18(void 0);
     } catch (error) {
-      return Err16({
+      return Err17({
         category: "container_remove_failed",
         message: `Failed to remove container: ${error instanceof Error ? error.message : String(error)}`,
         details: error
@@ -6081,7 +6240,7 @@ var DockerRuntime = class {
       await dockerExec(["info", "--format", "{{.ServerVersion}}"]);
       return Ok18(void 0);
     } catch (error) {
-      return Err16({
+      return Err17({
         category: "runtime_not_found",
         message: `Docker is not available: ${error instanceof Error ? error.message : String(error)}`,
         details: error
@@ -6091,7 +6250,7 @@ var DockerRuntime = class {
 };
 
 // src/agent/secrets/env.ts
-import { Ok as Ok19, Err as Err17 } from "@harness-engineering/types";
+import { Ok as Ok19, Err as Err18 } from "@harness-engineering/types";
 var EnvSecretBackend = class {
   name = "env";
   async resolveSecrets(keys) {
@@ -6099,7 +6258,7 @@ var EnvSecretBackend = class {
     for (const key of keys) {
       const value = process.env[key];
       if (value === void 0) {
-        return Err17({
+        return Err18({
           category: "secret_not_found",
           message: `Environment variable '${key}' is not set`,
           key
@@ -6116,7 +6275,7 @@ var EnvSecretBackend = class {
 
 // src/agent/secrets/onepassword.ts
 import { execFile as execFile4 } from "child_process";
-import { Ok as Ok20, Err as Err18 } from "@harness-engineering/types";
+import { Ok as Ok20, Err as Err19 } from "@harness-engineering/types";
 function opExec(args) {
   return new Promise((resolve8, reject) => {
     execFile4("op", args, (error, stdout) => {
@@ -6141,7 +6300,7 @@ var OnePasswordSecretBackend = class {
         const value = await opExec(["read", `op://${this.vault}/${key}/password`]);
         secrets[key] = value;
       } catch (error) {
-        return Err18({
+        return Err19({
           category: "access_denied",
           message: `Failed to read secret '${key}' from 1Password: ${error instanceof Error ? error.message : String(error)}`,
           key
@@ -6155,7 +6314,7 @@ var OnePasswordSecretBackend = class {
       await opExec(["--version"]);
       return Ok20(void 0);
     } catch (error) {
-      return Err18({
+      return Err19({
         category: "provider_unavailable",
         message: `1Password CLI is not available: ${error instanceof Error ? error.message : String(error)}`
       });
@@ -6165,7 +6324,7 @@ var OnePasswordSecretBackend = class {
 
 // src/agent/secrets/vault.ts
 import { execFile as execFile5 } from "child_process";
-import { Ok as Ok21, Err as Err19 } from "@harness-engineering/types";
+import { Ok as Ok21, Err as Err20 } from "@harness-engineering/types";
 function vaultExec(args, env) {
   return new Promise((resolve8, reject) => {
     execFile5("vault", args, { env: { ...process.env, ...env } }, (error, stdout) => {
@@ -6196,11 +6355,11 @@ var VaultSecretBackend = class {
     } catch (error) {
       const msg = error instanceof Error ? error.message : String(error);
       const category = error instanceof SyntaxError ? "access_denied" : "access_denied";
-      return Err19({ category, message: `Failed to read from Vault: ${msg}` });
+      return Err20({ category, message: `Failed to read from Vault: ${msg}` });
     }
     const missing = keys.find((k) => !(k in data));
     if (missing) {
-      return Err19({
+      return Err20({
         category: "secret_not_found",
         message: `Secret key '${missing}' not found in Vault path '${this.path}'`,
         key: missing
@@ -6215,7 +6374,7 @@ var VaultSecretBackend = class {
       await vaultExec(["version"]);
       return Ok21(void 0);
     } catch (error) {
-      return Err19({
+      return Err20({
         category: "provider_unavailable",
         message: `Vault CLI is not available: ${error instanceof Error ? error.message : String(error)}`
       });
@@ -6344,6 +6503,96 @@ var OrchestratorBackendFactory = class {
   }
 };
 
+// src/agent/backend-resolver.ts
+function makeBackendResolver(backends) {
+  return (backendName) => {
+    const def = backends?.[backendName];
+    return def ? createBackend(def) : null;
+  };
+}
+
+// src/maintenance/agent-dispatcher.ts
+function syntheticIssue(branch, skill) {
+  return {
+    id: `maintenance:${branch}`,
+    identifier: branch,
+    title: `Maintenance: ${skill}`,
+    description: null,
+    priority: null,
+    state: "in_progress",
+    branchName: branch,
+    url: null,
+    labels: ["maintenance"],
+    blockedBy: [],
+    spec: null,
+    plans: [],
+    createdAt: null,
+    updatedAt: null,
+    externalId: null
+  };
+}
+function buildPrompt(skill, promptContext) {
+  const instruction = `Run the \`${skill}\` skill to detect and fix issues in this repository. Apply the fixes and commit each logical change. If there is nothing to fix, make no commits.`;
+  return promptContext ? `${promptContext}
+
+${instruction}` : instruction;
+}
+function headOf(git2, cwd) {
+  try {
+    return git2(["rev-parse", "HEAD"], cwd) || null;
+  } catch {
+    return null;
+  }
+}
+function createAgentDispatcher(deps) {
+  const maxTurns = deps.maxTurns ?? 10;
+  const dispatch = async (skill, branch, backendName, cwd, options) => {
+    const backend = deps.resolveBackend(backendName);
+    if (!backend) {
+      deps.logger.warn(`Maintenance agent dispatch skipped: unknown backend "${backendName}"`, {
+        skill,
+        branch
+      });
+      return { producedCommits: false, fixed: 0 };
+    }
+    const before = headOf(deps.git, cwd);
+    const runner = new AgentRunner(backend, { maxTurns });
+    const session = runner.runSession(
+      syntheticIssue(branch, skill),
+      cwd,
+      buildPrompt(skill, options?.promptContext)
+    );
+    let step = await session.next();
+    while (!step.done) step = await session.next();
+    const after = headOf(deps.git, cwd);
+    let fixed = 0;
+    if (after && after !== before) {
+      if (before) {
+        try {
+          fixed = parseInt(deps.git(["rev-list", "--count", `${before}..${after}`], cwd), 10) || 0;
+        } catch {
+          fixed = 1;
+        }
+      } else {
+        fixed = 1;
+      }
+    }
+    const producedCommits = fixed > 0;
+    deps.logger.info("Maintenance agent dispatch complete", {
+      skill,
+      branch,
+      backendName,
+      producedCommits,
+      fixed
+    });
+    return { producedCommits, fixed };
+  };
+  return { dispatch };
+}
+
+// src/orchestrator.ts
+import { execFileSync } from "child_process";
+
 // src/agent/intelligence-factory.ts
 import {
   IntelligencePipeline,
@@ -6854,7 +7103,7 @@ function handleV1InteractionsResolveRoute(req, res, queue) {
 
 // src/server/routes/plans.ts
 import { z as z5 } from "zod";
-import * as fs10 from "fs/promises";
+import * as fs9 from "fs/promises";
 import * as path11 from "path";
 var PlanWriteSchema = z5.object({
   filename: z5.string().min(1),
@@ -6883,9 +7132,9 @@ function handlePlansRoute(req, res, plansDir) {
           );
           return;
         }
-        await fs10.mkdir(plansDir, { recursive: true });
+        await fs9.mkdir(plansDir, { recursive: true });
         const filePath = path11.join(plansDir, basename3);
-        await fs10.writeFile(filePath, parsed.content, "utf-8");
+        await fs9.writeFile(filePath, parsed.content, "utf-8");
         res.writeHead(201, { "Content-Type": "application/json" });
         res.end(JSON.stringify({ ok: true, filename: basename3 }));
       } catch {
@@ -7260,11 +7509,10 @@ function handleAnalyzeRoute(req, res, pipeline) {
 }
 
 // src/server/routes/roadmap-actions.ts
-import * as fs11 from "fs/promises";
 import * as path12 from "path";
 import {
-  parseRoadmap as parseRoadmap2,
-  serializeRoadmap as serializeRoadmap2,
+  resolveRoadmapStoreForFile as resolveRoadmapStoreForFile2,
+  applyRoadmapDiff as applyRoadmapDiff2,
   loadProjectRoadmapMode,
   loadTrackerClientConfigFromProject,
   createTrackerClient,
@@ -7350,13 +7598,14 @@ function handleRoadmapActionsRoute(req, res, roadmapPath) {
         sendJSON2(res, 400, { error: "Title must not contain newlines or markdown headings" });
         return;
       }
-      const content = await fs11.readFile(roadmapPath, "utf-8");
-      const roadmapResult = parseRoadmap2(content);
-      if (!roadmapResult.ok) {
+      const store = resolveRoadmapStoreForFile2({ roadmapPath });
+      const loaded = await store.load();
+      if (!loaded.ok) {
         sendJSON2(res, 500, { error: "Failed to parse roadmap file" });
         return;
       }
-      const roadmap = roadmapResult.value;
+      const roadmap = loaded.value;
+      const before = structuredClone(roadmap);
       let backlog = roadmap.milestones.find((m) => m.isBacklog);
       if (!backlog) {
         backlog = { name: "Backlog", isBacklog: true, features: [] };
@@ -7379,10 +7628,11 @@ function handleRoadmapActionsRoute(req, res, roadmapPath) {
         updatedAt: null
       });
       roadmap.frontmatter.lastManualEdit = (/* @__PURE__ */ new Date()).toISOString();
-      const tmpPath = roadmapPath + ".tmp";
-      const serialized = serializeRoadmap2(roadmap);
-      await fs11.writeFile(tmpPath, serialized, "utf-8");
-      await fs11.rename(tmpPath, roadmapPath);
+      const persisted = await applyRoadmapDiff2(store, before, roadmap);
+      if (!persisted.ok) {
+        sendJSON2(res, 500, { error: persisted.error.message });
+        return;
+      }
       sendJSON2(res, 201, { ok: true, featureName: parsed.title });
     } catch (err) {
       const msg = err instanceof Error ? err.message : "Failed to append to roadmap";
@@ -7648,7 +7898,6 @@ function handleV1JobsMaintenanceRoute(req, res, deps) {
 }
 
 // src/server/routes/v1/events-sse.ts
-import { randomBytes as randomBytes2 } from "crypto";
 var SSE_TOPICS = [
   "state_change",
   "agent_event",
@@ -7664,8 +7913,55 @@ var SSE_TOPICS = [
   "webhook.subscription.deleted"
 ];
 var HEARTBEAT_MS = 15e3;
-function newEventId() {
-  return `evt_${randomBytes2(8).toString("hex")}`;
+var DEFAULT_REPLAY_BUFFER = 1024;
+var SseEventLog = class {
+  seq = 0;
+  buffer = [];
+  subscribers = /* @__PURE__ */ new Set();
+  constructor(bus, cap = DEFAULT_REPLAY_BUFFER) {
+    this.cap = cap;
+    for (const topic of SSE_TOPICS) {
+      bus.on(topic, (data) => this.record(topic, data));
+    }
+  }
+  cap;
+  record(topic, data) {
+    const event = { id: ++this.seq, topic, data };
+    this.buffer.push(event);
+    if (this.buffer.length > this.cap) this.buffer.shift();
+    for (const fn of this.subscribers) fn(event);
+  }
+  /** Highest assigned id (0 when nothing has been recorded yet). */
+  currentSeq() {
+    return this.seq;
+  }
+  /** Buffered events strictly newer than `lastId`, oldest-first. */
+  replayFrom(lastId) {
+    return this.buffer.filter((e) => e.id > lastId);
+  }
+  /** Register a live listener; returns an unsubscribe function. */
+  subscribe(fn) {
+    this.subscribers.add(fn);
+    return () => {
+      this.subscribers.delete(fn);
+    };
+  }
+};
+var logsByBus = /* @__PURE__ */ new WeakMap();
+function getSseEventLog(bus) {
+  let log = logsByBus.get(bus);
+  if (!log) {
+    log = new SseEventLog(bus);
+    logsByBus.set(bus, log);
+  }
+  return log;
+}
+function parseLastEventId(req) {
+  const raw = req.headers["last-event-id"];
+  const value = Array.isArray(raw) ? raw[0] : raw;
+  if (value === void 0) return null;
+  const n = Number(value);
+  return Number.isInteger(n) && n >= 0 ? n : null;
 }
 function handleV1EventsSseRoute(req, res, bus) {
   if (req.method !== "GET" || req.url !== "/api/v1/events") return false;
@@ -7677,22 +7973,28 @@ function handleV1EventsSseRoute(req, res, bus) {
   res.write(`: harness gateway SSE \u2014 connected at ${(/* @__PURE__ */ new Date()).toISOString()}
 
 `);
-  const listeners = [];
-  for (const topic of SSE_TOPICS) {
-    const fn = (data) => {
-      try {
-        const frame = `event: ${topic}
-data: ${JSON.stringify(data)}
-id: ${newEventId()}
+  const log = getSseEventLog(bus);
+  const send = (e) => {
+    try {
+      res.write(`event: ${e.topic}
+data: ${JSON.stringify(e.data)}
+id: ${e.id}
 
-`;
-        res.write(frame);
-      } catch {
-      }
-    };
-    bus.on(topic, fn);
-    listeners.push({ topic, fn });
+`);
+    } catch {
+    }
+  };
+  const lastId = parseLastEventId(req);
+  let replayedThrough = lastId ?? log.currentSeq();
+  if (lastId !== null) {
+    for (const e of log.replayFrom(lastId)) {
+      send(e);
+      replayedThrough = e.id;
+    }
   }
+  const unsubscribe = log.subscribe((e) => {
+    if (e.id > replayedThrough) send(e);
+  });
   const heartbeat = setInterval(() => {
     try {
       res.write(": heartbeat\n\n");
@@ -7702,7 +8004,7 @@ id: ${newEventId()}
   heartbeat.unref();
   const cleanup = () => {
     clearInterval(heartbeat);
-    for (const { topic, fn } of listeners) bus.removeListener(topic, fn);
+    unsubscribe();
   };
   res.on("close", cleanup);
   res.on("finish", cleanup);
@@ -8022,7 +8324,7 @@ async function runGate(projectPath, proposalId) {
 }
 
 // src/proposals/promote.ts
-import * as fs12 from "fs";
+import * as fs10 from "fs";
 import * as path13 from "path";
 import { parse as parseYaml3, stringify as stringifyYaml } from "yaml";
 import {
@@ -8048,7 +8350,7 @@ function skillDir(projectPath, name) {
 }
 function readIfExists(p) {
   try {
-    return fs12.readFileSync(p, "utf-8");
+    return fs10.readFileSync(p, "utf-8");
   } catch {
     return null;
   }
@@ -8094,15 +8396,15 @@ function assertGateReady(proposal) {
 }
 async function promoteNewSkill(projectPath, proposal) {
   const target = skillDir(projectPath, proposal.content.name);
-  if (fs12.existsSync(target)) {
+  if (fs10.existsSync(target)) {
     throw new PromotionError(
       `a catalog skill already exists at ${target}; use a refinement proposal to update it`
     );
   }
-  fs12.mkdirSync(target, { recursive: true });
+  fs10.mkdirSync(target, { recursive: true });
   const yamlOut = injectProvenanceIntoYaml(proposal.content.skillYaml ?? "", proposal.id);
-  fs12.writeFileSync(path13.join(target, "skill.yaml"), yamlOut);
-  fs12.writeFileSync(path13.join(target, "SKILL.md"), proposal.content.skillMd ?? "");
+  fs10.writeFileSync(path13.join(target, "skill.yaml"), yamlOut);
+  fs10.writeFileSync(path13.join(target, "SKILL.md"), proposal.content.skillMd ?? "");
   return { skillPath: target };
 }
 async function promoteRefinement(projectPath, proposal) {
@@ -8110,7 +8412,7 @@ async function promoteRefinement(projectPath, proposal) {
     throw new PromotionError("refinement proposal is missing targetSkill");
   }
   const target = skillDir(projectPath, proposal.targetSkill);
-  if (!fs12.existsSync(target)) {
+  if (!fs10.existsSync(target)) {
     throw new PromotionError(
       `target skill ${proposal.targetSkill} does not exist at ${target}; cannot refine`
     );
@@ -8123,7 +8425,7 @@ async function promoteRefinement(projectPath, proposal) {
       "no metadata changes detected; check that the reviewer applied the proposed diff before approving"
     );
   }
-  fs12.writeFileSync(yamlPath, after);
+  fs10.writeFileSync(yamlPath, after);
   return { skillPath: target };
 }
 async function promote(projectPath, proposalId, decidedBy) {
@@ -8561,7 +8863,7 @@ function handleV1RoutingRoute(req, res, deps) {
 }
 
 // src/server/routes/sessions.ts
-import * as fs13 from "fs/promises";
+import * as fs11 from "fs/promises";
 import * as path14 from "path";
 import { z as z15 } from "zod";
 var SessionCreateSchema = z15.object({
@@ -8582,12 +8884,12 @@ function extractSessionId(url) {
 }
 async function handleList2(res, sessionsDir) {
   try {
-    const entries = await fs13.readdir(sessionsDir, { withFileTypes: true });
+    const entries = await fs11.readdir(sessionsDir, { withFileTypes: true });
     const sessions = [];
     for (const entry of entries) {
       if (!entry.isDirectory()) continue;
       try {
-        const content = await fs13.readFile(
+        const content = await fs11.readFile(
           path14.join(sessionsDir, entry.name, "session.json"),
           "utf-8"
         );
@@ -8613,7 +8915,7 @@ async function handleGet2(res, id, sessionsDir) {
     return;
   }
   try {
-    const content = await fs13.readFile(path14.join(sessionsDir, id, "session.json"), "utf-8");
+    const content = await fs11.readFile(path14.join(sessionsDir, id, "session.json"), "utf-8");
     jsonResponse(res, 200, JSON.parse(content));
   } catch (err) {
     if (err.code === "ENOENT") {
@@ -8637,8 +8939,8 @@ async function handleCreate(req, res, sessionsDir) {
       return;
     }
     const sessionDir = path14.join(sessionsDir, session.sessionId);
-    await fs13.mkdir(sessionDir, { recursive: true });
-    await fs13.writeFile(path14.join(sessionDir, "session.json"), JSON.stringify(session, null, 2));
+    await fs11.mkdir(sessionDir, { recursive: true });
+    await fs11.writeFile(path14.join(sessionDir, "session.json"), JSON.stringify(session, null, 2));
     jsonResponse(res, 200, { ok: true });
   } catch {
     jsonResponse(res, 500, { error: "Failed to save session" });
@@ -8654,8 +8956,8 @@ async function handleUpdate(req, res, url, sessionsDir) {
     const body = await readBody(req);
     const updates = z15.record(z15.unknown()).parse(JSON.parse(body));
     const sessionFilePath = path14.join(sessionsDir, id, "session.json");
-    const current = JSON.parse(await fs13.readFile(sessionFilePath, "utf-8"));
-    await fs13.writeFile(sessionFilePath, JSON.stringify({ ...current, ...updates }, null, 2));
+    const current = JSON.parse(await fs11.readFile(sessionFilePath, "utf-8"));
+    await fs11.writeFile(sessionFilePath, JSON.stringify({ ...current, ...updates }, null, 2));
     jsonResponse(res, 200, { ok: true });
   } catch {
     jsonResponse(res, 500, { error: "Failed to update session" });
@@ -8668,7 +8970,7 @@ async function handleDelete(res, url, sessionsDir) {
       jsonResponse(res, 400, { error: "Missing or invalid sessionId" });
       return;
     }
-    await fs13.rm(path14.join(sessionsDir, id), { recursive: true, force: true });
+    await fs11.rm(path14.join(sessionsDir, id), { recursive: true, force: true });
     jsonResponse(res, 200, { ok: true });
   } catch {
     jsonResponse(res, 500, { error: "Failed to delete session" });
@@ -8916,7 +9218,7 @@ function handleLocalModelsRoute(req, res, getStatuses) {
 }
 
 // src/server/static.ts
-import * as fs14 from "fs";
+import * as fs12 from "fs";
 import * as path15 from "path";
 var MIME_TYPES = {
   ".html": "text/html; charset=utf-8",
@@ -8946,11 +9248,11 @@ function handleStaticFile(req, res, dashboardDir) {
   if (!resolved.startsWith(path15.resolve(dashboardDir))) {
     return serveFile(path15.join(dashboardDir, "index.html"), res);
   }
-  if (fs14.existsSync(resolved) && fs14.statSync(resolved).isFile()) {
+  if (fs12.existsSync(resolved) && fs12.statSync(resolved).isFile()) {
     return serveFile(resolved, res);
   }
   const indexPath = path15.join(dashboardDir, "index.html");
-  if (fs14.existsSync(indexPath)) {
+  if (fs12.existsSync(indexPath)) {
     return serveFile(indexPath, res);
   }
   return false;
@@ -8959,7 +9261,7 @@ function serveFile(filePath, res) {
   const ext = path15.extname(filePath).toLowerCase();
   const contentType = MIME_TYPES[ext] ?? "application/octet-stream";
   try {
-    const content = fs14.readFileSync(filePath);
+    const content = fs12.readFileSync(filePath);
     res.writeHead(200, { "Content-Type": contentType });
     res.end(content);
     return true;
@@ -8969,7 +9271,7 @@ function serveFile(filePath, res) {
 }
 
 // src/server/plan-watcher.ts
-import * as fs15 from "fs";
+import * as fs13 from "fs";
 import * as path16 from "path";
 var PlanWatcher = class {
   plansDir;
@@ -8984,11 +9286,11 @@ var PlanWatcher = class {
    * Creates the directory if it does not exist.
    */
   start() {
-    fs15.mkdirSync(this.plansDir, { recursive: true });
-    this.watcher = fs15.watch(this.plansDir, (eventType, filename) => {
+    fs13.mkdirSync(this.plansDir, { recursive: true });
+    this.watcher = fs13.watch(this.plansDir, (eventType, filename) => {
       if (eventType === "rename" && filename && filename.endsWith(".md")) {
         const filePath = path16.join(this.plansDir, filename);
-        if (fs15.existsSync(filePath)) {
+        if (fs13.existsSync(filePath)) {
           void this.handleNewPlan(filename);
         }
       }
@@ -9019,8 +9321,8 @@ var PlanWatcher = class {
 };
 
 // src/auth/tokens.ts
-import { randomBytes as randomBytes3, timingSafeEqual } from "crypto";
-import { readFile as readFile8, writeFile as writeFile8, mkdir as mkdir7, rename as rename2 } from "fs/promises";
+import { randomBytes as randomBytes2, timingSafeEqual } from "crypto";
+import { readFile as readFile6, writeFile as writeFile6, mkdir as mkdir7, rename } from "fs/promises";
 import { dirname as dirname5 } from "path";
 import bcrypt from "bcryptjs";
 import {
@@ -9030,10 +9332,10 @@ import {
 var BCRYPT_ROUNDS = 12;
 var LEGACY_ENV_ID = "tok_legacy_env";
 function genId() {
-  return `tok_${randomBytes3(8).toString("hex")}`;
+  return `tok_${randomBytes2(8).toString("hex")}`;
 }
 function genSecret() {
-  return randomBytes3(24).toString("base64url");
+  return randomBytes2(24).toString("base64url");
 }
 function parseToken(raw) {
   const dot = raw.indexOf(".");
@@ -9049,7 +9351,7 @@ var TokenStore = class {
   async load() {
     if (this.cache) return this.cache;
     try {
-      const raw = await readFile8(this.path, "utf8");
+      const raw = await readFile6(this.path, "utf8");
       const parsed = JSON.parse(raw);
       const list = Array.isArray(parsed) ? parsed : [];
       this.cache = list.map((entry) => {
@@ -9064,9 +9366,9 @@ var TokenStore = class {
   }
   async persist(records) {
     await mkdir7(dirname5(this.path), { recursive: true });
-    const tmp = `${this.path}.tmp-${process.pid}-${Date.now()}-${randomBytes3(4).toString("hex")}`;
-    await writeFile8(tmp, JSON.stringify(records, null, 2), "utf8");
-    await rename2(tmp, this.path);
+    const tmp = `${this.path}.tmp-${process.pid}-${Date.now()}-${randomBytes2(4).toString("hex")}`;
+    await writeFile6(tmp, JSON.stringify(records, null, 2), "utf8");
+    await rename(tmp, this.path);
     this.cache = records;
   }
   async create(input) {
@@ -9750,8 +10052,8 @@ var OrchestratorServer = class {
 };
 
 // src/gateway/webhooks/store.ts
-import { randomBytes as randomBytes4 } from "crypto";
-import { readFile as readFile9, writeFile as writeFile9, mkdir as mkdir9, rename as rename3, chmod } from "fs/promises";
+import { randomBytes as randomBytes3 } from "crypto";
+import { readFile as readFile7, writeFile as writeFile7, mkdir as mkdir9, rename as rename2, chmod } from "fs/promises";
 import { dirname as dirname7 } from "path";
 import { WebhookSubscriptionSchema } from "@harness-engineering/types";
 
@@ -9777,10 +10079,10 @@ function eventMatches(pattern, type) {
 
 // src/gateway/webhooks/store.ts
 function genId2() {
-  return `whk_${randomBytes4(8).toString("hex")}`;
+  return `whk_${randomBytes3(8).toString("hex")}`;
 }
 function genSecret2() {
-  return randomBytes4(32).toString("base64url");
+  return randomBytes3(32).toString("base64url");
 }
 var WebhookStore = class {
   constructor(path24) {
@@ -9791,7 +10093,7 @@ var WebhookStore = class {
   async load() {
     if (this.cache) return this.cache;
     try {
-      const raw = await readFile9(this.path, "utf8");
+      const raw = await readFile7(this.path, "utf8");
       const parsed = JSON.parse(raw);
       const list = Array.isArray(parsed) ? parsed : [];
       this.cache = list.map((entry) => {
@@ -9805,11 +10107,11 @@ var WebhookStore = class {
     return this.cache;
   }
   async persist(records) {
-    const tmp = `${this.path}.tmp-${process.pid}-${Date.now()}-${randomBytes4(4).toString("hex")}`;
+    const tmp = `${this.path}.tmp-${process.pid}-${Date.now()}-${randomBytes3(4).toString("hex")}`;
     try {
       await mkdir9(dirname7(this.path), { recursive: true });
-      await writeFile9(tmp, JSON.stringify(records, null, 2), { encoding: "utf8", mode: 384 });
-      await rename3(tmp, this.path);
+      await writeFile7(tmp, JSON.stringify(records, null, 2), { encoding: "utf8", mode: 384 });
+      await rename2(tmp, this.path);
       await chmod(this.path, 384);
     } catch (err) {
       if (err.code !== "ENOENT") throw err;
@@ -9849,7 +10151,7 @@ var WebhookStore = class {
 };
 
 // src/gateway/webhooks/delivery.ts
-import { randomBytes as randomBytes5 } from "crypto";
+import { randomBytes as randomBytes4 } from "crypto";
 
 // src/gateway/webhooks/queue.ts
 import Database from "better-sqlite3";
@@ -10059,7 +10361,7 @@ var WebhookDelivery = class {
   enqueue(sub, event) {
     const payload = JSON.stringify(event);
     this.queue.insert({
-      id: `dlv_${randomBytes5(8).toString("hex")}`,
+      id: `dlv_${randomBytes4(8).toString("hex")}`,
       subscriptionId: sub.id,
       eventType: event.type,
       payload
@@ -10167,7 +10469,7 @@ var WebhookDelivery = class {
 };
 
 // src/gateway/webhooks/events.ts
-import { randomBytes as randomBytes6 } from "crypto";
+import { randomBytes as randomBytes5 } from "crypto";
 var WEBHOOK_TOPICS = [
   "interaction.created",
   "interaction.resolved",
@@ -10182,8 +10484,8 @@ var WEBHOOK_TOPICS = [
   "proposal.approved",
   "proposal.rejected"
 ];
-function newEventId2() {
-  return `evt_${randomBytes6(8).toString("hex")}`;
+function newEventId() {
+  return `evt_${randomBytes5(8).toString("hex")}`;
 }
 function wireWebhookFanout({ bus, store, delivery }) {
   const handlers = [];
@@ -10194,7 +10496,7 @@ function wireWebhookFanout({ bus, store, delivery }) {
         const subs = await store.listForEvent(eventType);
         if (subs.length === 0) return;
         const event = {
-          id: newEventId2(),
+          id: newEventId(),
           type: eventType,
           timestamp: (/* @__PURE__ */ new Date()).toISOString(),
           data
@@ -10213,7 +10515,7 @@ function wireWebhookFanout({ bus, store, delivery }) {
 }
 
 // src/gateway/telemetry/fanout.ts
-import { randomBytes as randomBytes7 } from "crypto";
+import { randomBytes as randomBytes6 } from "crypto";
 import { SpanKind } from "@harness-engineering/core";
 var TOPICS = {
   MAINTENANCE_STARTED: "maintenance:started",
@@ -10236,14 +10538,14 @@ var SPAN_NAME = {
   [TOPICS.DISPATCH_DECISION]: "dispatch_decision",
   [TOPICS.SKILL_INVOCATION]: "skill_invocation"
 };
-function newEventId3() {
-  return `evt_${randomBytes7(8).toString("hex")}`;
+function newEventId2() {
+  return `evt_${randomBytes6(8).toString("hex")}`;
 }
 function newTraceId() {
-  return randomBytes7(16).toString("hex");
+  return randomBytes6(16).toString("hex");
 }
 function newSpanId() {
-  return randomBytes7(8).toString("hex");
+  return randomBytes6(8).toString("hex");
 }
 function nowNs() {
   return BigInt(Date.now()) * 1000000n;
@@ -10357,7 +10659,7 @@ function wireTelemetryFanout(params) {
     };
     exporter.push(span);
     const gatewayEvent = {
-      id: newEventId3(),
+      id: newEventId2(),
       type: TELEMETRY_TYPE[topic],
       timestamp: (/* @__PURE__ */ new Date()).toISOString(),
       data: payload,
@@ -10551,7 +10853,7 @@ function buildSlackSink(config, options) {
 }
 
 // src/notifications/events.ts
-import { randomBytes as randomBytes8 } from "crypto";
+import { randomBytes as randomBytes7 } from "crypto";
 
 // src/notifications/envelope.ts
 function asObj(data) {
@@ -10682,8 +10984,8 @@ var NOTIFICATION_TOPICS = [
   "proposal.approved",
   "proposal.rejected"
 ];
-function newEventId4() {
-  return `evt_${randomBytes8(8).toString("hex")}`;
+function newEventId3() {
+  return `evt_${randomBytes7(8).toString("hex")}`;
 }
 function dispatchToEntry(bus, entry, event) {
   const eventType = event.type;
@@ -10718,7 +11020,7 @@ function wireNotificationSinks({ bus, registry }) {
       const entries = registry.list();
       if (entries.length === 0) return;
       const event = {
-        id: newEventId4(),
+        id: newEventId3(),
         type: eventType,
         timestamp: (/* @__PURE__ */ new Date()).toISOString(),
         data
@@ -10829,6 +11131,37 @@ async function scanWorkspaceConfig(workspacePath) {
   return { exitCode: computeScanExitCode(results), results };
 }
 
+// src/core/lane-persistence.ts
+import { eventSourcing } from "@harness-engineering/core";
+import { Err as Err21 } from "@harness-engineering/types";
+var SIGNAL_TO_LANE = {
+  claim: "claimed",
+  dispatch: "in_progress",
+  success: "in_review",
+  failure: "blocked",
+  abandon: "canceled"
+};
+function mapOrchestratorLane(signal) {
+  return SIGNAL_TO_LANE[signal];
+}
+async function persistLane(projectPath, issueId, signal) {
+  try {
+    const reg = await eventSourcing.registerTask(projectPath, issueId, []);
+    if (!reg.ok) return reg;
+    return await eventSourcing.transitionLane(projectPath, issueId, mapOrchestratorLane(signal));
+  } catch (err) {
+    return Err21(err instanceof Error ? err : new Error(String(err)));
+  }
+}
+async function readPersistedLanes(projectPath) {
+  try {
+    const snap = await eventSourcing.readSnapshot(projectPath);
+    return snap.ok ? snap.value.lanes : { tasks: {} };
+  } catch {
+    return { tasks: {} };
+  }
+}
+
 // src/maintenance/task-registry.ts
 var BUILT_IN_TASKS = [
   // --- Mechanical-AI ---
@@ -10892,7 +11225,13 @@ var BUILT_IN_TASKS = [
     description: "Detect and fix cross-check violations",
     schedule: "0 6 * * 1",
     branch: "harness-maint/cross-check-fixes",
-    checkCommand: ["validate-cross-check"],
+    // `harness cross-check` is a dedicated read-only CLI subcommand that surfaces
+    // JUST cross-artifact consistency (plan→implementation coverage + staleness),
+    // mirroring the `validate_cross_check` MCP tool's core (`runCrossCheck`)
+    // WITHOUT running the full `harness validate` suite. It prints a parseable
+    // `Cross-check: N issues` line and exits 0 (clean) / 1 (N issues), so the
+    // maintenance runner reports real results instead of an honest `failure`.
+    checkCommand: ["cross-check"],
     fixSkill: "harness-cross-check-fix"
   },
   // --- Pure-AI ---
@@ -10951,7 +11290,10 @@ var BUILT_IN_TASKS = [
     description: "Assess overall project health",
     schedule: "0 6 * * *",
     branch: null,
-    checkCommand: ["assess_project"]
+    // `assess_project` is an MCP tool name, not a CLI subcommand. The CLI
+    // composite project-health report is `harness insights` (health, entropy,
+    // decay, attention, impact) — a read-only report that records metrics.
+    checkCommand: ["insights"]
   },
   {
     id: "stale-constraints",
@@ -10959,7 +11301,14 @@ var BUILT_IN_TASKS = [
     description: "Detect stale architectural constraints",
     schedule: "0 2 1 * *",
     branch: null,
-    checkCommand: ["detect_stale_constraints"]
+    // `harness stale-constraints` is a dedicated read-only CLI subcommand that
+    // surfaces the `detect_stale_constraints` MCP tool's core in-process. It is
+    // precondition-gated on the knowledge graph: with no graph it emits the
+    // "No knowledge graph found. Run `harness scan` first." signature and exits
+    // non-zero, which the runner classifies as `skipped` (not failure). With a
+    // graph it prints a parseable `Stale constraints: N findings` line and exits
+    // 0 (clean) / 1 (N stale), recorded as report-only metrics.
+    checkCommand: ["stale-constraints"]
   },
   {
     id: "graph-refresh",
@@ -10992,7 +11341,8 @@ var BUILT_IN_TASKS = [
     description: "Clean up stale orchestrator sessions",
     schedule: "0 0 * * *",
     branch: null,
-    checkCommand: ["cleanup-sessions"]
+    checkCommand: ["cleanup-sessions"],
+    excludeFromHumanSweep: true
   },
   {
     id: "perf-baselines",
@@ -11000,7 +11350,8 @@ var BUILT_IN_TASKS = [
     description: "Update performance baselines",
     schedule: "0 7 * * *",
     branch: null,
-    checkCommand: ["perf", "baselines", "update"]
+    checkCommand: ["perf", "baselines", "update"],
+    excludeFromHumanSweep: true
   },
   {
     id: "main-sync",
@@ -11008,7 +11359,8 @@ var BUILT_IN_TASKS = [
     description: "Fast-forward local default branch from origin",
     schedule: "*/15 * * * *",
     branch: null,
-    checkCommand: ["harness", "sync-main", "--json"]
+    checkCommand: ["harness", "sync-main", "--json"],
+    excludeFromHumanSweep: true
   },
   // Hermes Phase 4 — one-shot backfill that stamps `provenance: user-authored`
   // on every existing catalog skill. Schedule is Feb 31 (a date that never
@@ -11021,7 +11373,8 @@ var BUILT_IN_TASKS = [
     description: "Backfill provenance: user-authored on every existing skill (one-shot, idempotent)",
     schedule: "0 0 31 2 *",
     branch: null,
-    checkCommand: ["backfill-skill-provenance"]
+    checkCommand: ["backfill-skill-provenance"],
+    excludeFromHumanSweep: true
   }
 ];
 
@@ -11088,6 +11441,17 @@ function cronMatchesNow(expression, now) {
   const daysOfWeek = parseField(dowField, 0, 6);
   return minutes.has(minute) && hours.has(hour) && daysOfMonth.has(dayOfMonth) && months.has(month) && daysOfWeek.has(dayOfWeek);
 }
+function cronMatchesDate(expression, date) {
+  const fields = expression.trim().split(/\s+/);
+  if (fields.length !== 5) {
+    throw new Error(`Invalid cron expression: expected 5 fields, got ${fields.length}`);
+  }
+  const [, , domField, monthField, dowField] = fields;
+  const daysOfMonth = parseField(domField, 1, 31);
+  const months = parseField(monthField, 1, 12);
+  const daysOfWeek = parseField(dowField, 0, 6);
+  return daysOfMonth.has(date.getDate()) && months.has(date.getMonth() + 1) && daysOfWeek.has(date.getDay());
+}
 
 // src/maintenance/scheduler.ts
 var MaintenanceScheduler = class {
@@ -11337,7 +11701,7 @@ var SingleProcessLeaderElector = class {
 };
 
 // src/maintenance/reporter.ts
-import * as fs16 from "fs";
+import * as fs14 from "fs";
 import * as path18 from "path";
 import { z as z17 } from "zod";
 var RunResultSchema = z17.object({
@@ -11373,9 +11737,9 @@ var MaintenanceReporter = class {
    */
   async load() {
     try {
-      await fs16.promises.mkdir(this.persistDir, { recursive: true });
+      await fs14.promises.mkdir(this.persistDir, { recursive: true });
       const filePath = path18.join(this.persistDir, "history.json");
-      const data = await fs16.promises.readFile(filePath, "utf-8");
+      const data = await fs14.promises.readFile(filePath, "utf-8");
       const parsed = z17.array(RunResultSchema).safeParse(JSON.parse(data));
       if (parsed.success) {
         this.history = parsed.data.slice(0, MAX_HISTORY);
@@ -11409,9 +11773,9 @@ var MaintenanceReporter = class {
    */
   async persist() {
     try {
-      await fs16.promises.mkdir(this.persistDir, { recursive: true });
+      await fs14.promises.mkdir(this.persistDir, { recursive: true });
       const filePath = path18.join(this.persistDir, "history.json");
-      await fs16.promises.writeFile(filePath, JSON.stringify(this.history, null, 2), "utf-8");
+      await fs14.promises.writeFile(filePath, JSON.stringify(this.history, null, 2), "utf-8");
     } catch (err) {
       this.logger.error("MaintenanceReporter: failed to persist history", { error: String(err) });
     }
@@ -11451,20 +11815,20 @@ var TaskRunner = class {
    * @param origin - Hermes Phase 2 trigger-source tag; defaults to `'cron'`
    *                 when called from the scheduler path.
    */
-  async run(task, origin = "cron") {
+  async run(task, origin = "cron", mode = "fix") {
     const startedAt = (/* @__PURE__ */ new Date()).toISOString();
     let result;
     let captured;
     try {
       switch (task.type) {
         case "mechanical-ai": {
-          const out = await this.runMechanicalAI(task, startedAt);
+          const out = await this.runMechanicalAI(task, startedAt, mode);
           result = out.result;
           captured = out.captured;
           break;
         }
         case "pure-ai":
-          result = await this.runPureAI(task, startedAt);
+          result = await this.runPureAI(task, startedAt, mode);
           break;
         case "report-only": {
           const out = await this.runReportOnly(task, startedAt);
@@ -11473,7 +11837,7 @@ var TaskRunner = class {
           break;
         }
         case "housekeeping": {
-          const out = await this.runHousekeeping(task, startedAt);
+          const out = await this.runHousekeeping(task, startedAt, mode);
           result = out.result;
           captured = out.captured;
           break;
@@ -11537,7 +11901,8 @@ var TaskRunner = class {
         findings: r2.findings,
         stdout: r2.output,
         stderr: r2.stderr,
-        structured: r2.structured ? r2.structured : null
+        structured: r2.structured ? r2.structured : null,
+        executionFailed: false
       };
     }
     if (!task.checkCommand || task.checkCommand.length === 0) {
@@ -11549,7 +11914,8 @@ var TaskRunner = class {
       findings: r.findings,
       stdout: r.output,
       stderr: "",
-      structured: null
+      structured: null,
+      executionFailed: r.executionFailed ?? false
     };
   }
   /**
@@ -11574,7 +11940,7 @@ var TaskRunner = class {
    * only if fixable findings exist; persist captured stdout/stderr/context
    * via the output store on the way out.
    */
-  async runMechanicalAI(task, startedAt) {
+  async runMechanicalAI(task, startedAt, mode = "fix") {
     if (!task.fixSkill) {
       return wrap(this.failureResult(task.id, startedAt, "mechanical-ai task missing fixSkill"));
     }
@@ -11596,6 +11962,27 @@ var TaskRunner = class {
     } catch (err) {
       return wrap(this.failureResult(task.id, startedAt, String(err)));
     }
+    if (check.executionFailed) {
+      const cls = classifyCheckExecutionFailure(`${check.stdout}
+${check.stderr}`);
+      if (cls.kind === "unrunnable") {
+        return wrap(
+          this.failureResult(task.id, startedAt, checkExecutionError(check)),
+          captureFromCheck(check)
+        );
+      }
+      if (cls.kind === "precondition") {
+        return wrap(
+          this.skippedResult(task.id, startedAt, cls.reason ?? "precondition not met"),
+          captureFromCheck(check)
+        );
+      }
+      check = {
+        ...check,
+        executionFailed: false,
+        findings: check.findings > 0 ? check.findings : recoverFindingsCount(check.stdout)
+      };
+    }
     const promptContext = await this.composePromptContext(task);
     const baseCaptured = {
       stdout: check.stdout,
@@ -11604,13 +11991,14 @@ var TaskRunner = class {
       ...promptContext ? { context: promptContext } : {}
     };
     const wakeAgentExplicitlyFalse = check.structured !== null && typeof check.structured === "object" && check.structured.wakeAgent === false;
-    if (check.findings === 0 || wakeAgentExplicitlyFalse) {
+    if (check.findings === 0 || wakeAgentExplicitlyFalse || mode === "report") {
+      const reportedWithFindings = mode === "report" && check.findings > 0;
       return {
         result: {
           taskId: task.id,
           startedAt,
           completedAt: (/* @__PURE__ */ new Date()).toISOString(),
-          status: "no-issues",
+          status: reportedWithFindings ? "success" : "no-issues",
           findings: check.findings,
           fixed: 0,
           prUrl: null,
@@ -11680,7 +12068,19 @@ var TaskRunner = class {
   /**
    * Pure-AI: always dispatch agent with configured skill.
    */
-  async runPureAI(task, startedAt) {
+  async runPureAI(task, startedAt, mode = "fix") {
+    if (mode === "report") {
+      return {
+        taskId: task.id,
+        startedAt,
+        completedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        status: "no-issues",
+        findings: 0,
+        fixed: 0,
+        prUrl: null,
+        prUpdated: false
+      };
+    }
     if (!task.fixSkill) {
       return this.failureResult(task.id, startedAt, "pure-ai task missing fixSkill");
     }
@@ -11754,6 +12154,27 @@ var TaskRunner = class {
       return wrap(this.failureResult(task.id, startedAt, String(err)));
     }
     const parsed = parseStatusLine(check.stdout);
+    if (parsed === null && check.executionFailed) {
+      const cls = classifyCheckExecutionFailure(`${check.stdout}
+${check.stderr}`);
+      if (cls.kind === "unrunnable") {
+        return wrap(
+          this.failureResult(task.id, startedAt, checkExecutionError(check)),
+          captureFromCheck(check)
+        );
+      }
+      if (cls.kind === "precondition") {
+        return wrap(
+          this.skippedResult(task.id, startedAt, cls.reason ?? "precondition not met"),
+          captureFromCheck(check)
+        );
+      }
+      check = {
+        ...check,
+        executionFailed: false,
+        findings: check.findings > 0 ? check.findings : recoverFindingsCount(check.stdout)
+      };
+    }
     const status = parsed?.status ?? "success";
     const findings = parsed === null ? check.findings : typeof parsed.candidatesFound === "number" ? parsed.candidatesFound : 0;
     const result = {
@@ -11787,7 +12208,20 @@ var TaskRunner = class {
    * Hermes Phase 2: a `checkScript` may replace `checkCommand` for housekeeping
    * tasks; the runner falls through to the same JSON-status parsing path.
    */
-  async runHousekeeping(task, startedAt) {
+  async runHousekeeping(task, startedAt, mode = "fix") {
+    if (mode === "report") {
+      return wrap({
+        taskId: task.id,
+        startedAt,
+        completedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        status: "skipped",
+        findings: 0,
+        fixed: 0,
+        prUrl: null,
+        prUpdated: false,
+        error: "skipped in report mode: housekeeping may mutate and report runs are read-only"
+      });
+    }
     if (!task.checkCommand && !task.checkScript) {
       return wrap(
         this.failureResult(
@@ -11854,10 +12288,86 @@ var TaskRunner = class {
       error
     };
   }
+  /**
+   * A precondition-gated check (e.g. `predict` with <3 snapshots, or a
+   * graph-backed check before `harness scan`). The command is correctly
+   * configured; the repo just lacks the state it needs. Reported as `skipped`
+   * — distinct from a hard `failure` — carrying the refusal line as the reason
+   * (surfaced in the run-report summary column). ADR 0050.
+   */
+  skippedResult(taskId, startedAt, reason) {
+    return {
+      taskId,
+      startedAt,
+      completedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      status: "skipped",
+      findings: 0,
+      fixed: 0,
+      prUrl: null,
+      prUpdated: false,
+      error: reason
+    };
+  }
 };
 function wrap(result, captured) {
   return captured ? { result, captured } : { result };
 }
+function checkExecutionError(check) {
+  const detail = (check.stderr || check.stdout || "").trim();
+  return detail ? `check command failed to execute: ${detail}` : "check command failed to execute";
+}
+function captureFromCheck(check) {
+  return { stdout: check.stdout, stderr: check.stderr, structured: check.structured };
+}
+var PRECONDITION_PATTERNS = [
+  /requires at least \d+ snapshots?/i,
+  /Run ["'`]?harness snapshot/i,
+  /no knowledge graph found/i,
+  /Run ["'`]?harness scan/i,
+  /no graph (?:available|found)/i
+];
+var UNRUNNABLE_PATTERNS = [
+  /unknown command/i,
+  /unknown option/i,
+  /\bENOENT\b/,
+  /command not found/i,
+  /cannot find module/i,
+  // A timed-out check did not complete — it is a hard failure, never a
+  // "ran-no-count" success. The runners synthesize this message on SIGTERM.
+  /timed out/i,
+  /\bETIMEDOUT\b/
+];
+var TIMEOUT_SIGNATURE = /check timed out after \d+\s*ms/i;
+function explicitFindingsCount(output) {
+  const after = output.match(/(?:findings?|issues?|violations?|errors?)\s*[:=]\s*(\d+)/i);
+  if (after) return parseInt(after[1], 10);
+  const before = output.match(/(\d+)\s+(?:findings?|issues?|violations?|errors?)\b/i);
+  if (before) return parseInt(before[1], 10);
+  return null;
+}
+function recoverFindingsCount(output) {
+  return explicitFindingsCount(output) ?? 1;
+}
+function firstMeaningfulLine(output) {
+  const line = output.split("\n").map((l) => l.trim()).find(Boolean);
+  if (!line) return "precondition not met";
+  return line.replace(/^[x✗✓!-]\s*/u, "").trim();
+}
+var CLASSIFY_HEAD_LINES = 3;
+function classifyCheckExecutionFailure(output) {
+  const text = (output ?? "").trim();
+  if (text.length === 0) return { kind: "unrunnable" };
+  if (TIMEOUT_SIGNATURE.test(text)) return { kind: "unrunnable" };
+  if (explicitFindingsCount(text) !== null) return { kind: "ran-no-count" };
+  const head = text.split("\n").filter((l) => l.trim()).slice(0, CLASSIFY_HEAD_LINES).join("\n");
+  for (const re of PRECONDITION_PATTERNS) {
+    if (re.test(head)) return { kind: "precondition", reason: firstMeaningfulLine(text) };
+  }
+  for (const re of UNRUNNABLE_PATTERNS) {
+    if (re.test(head)) return { kind: "unrunnable" };
+  }
+  return { kind: "ran-no-count" };
+}
 function parseStatusLine(output) {
   const lines = output.split("\n").map((l) => l.trim()).filter(Boolean);
   for (let i = lines.length - 1; i >= 0; i--) {
@@ -12006,8 +12516,49 @@ function heuristicResult(stdout, stderr, exitedAbnormally) {
   };
 }
 
+// src/maintenance/check-runner.ts
+import { execFile as nodeExecFile } from "child_process";
+import { promisify as promisify4 } from "util";
+var MAINTENANCE_CHECK_MAX_BUFFER = 64 * 1024 * 1024;
+var MAINTENANCE_CHECK_TIMEOUT_MS = 3e5;
+var FINDINGS_RE = /(\d+)\s+(?:finding|issue|violation|error)/i;
+var nodeExecFileAsync = promisify4(nodeExecFile);
+function isCheckTimeoutError(e) {
+  return e.killed === true || e.signal === "SIGTERM" || e.code === "ETIMEDOUT";
+}
+async function runHarnessCheck(spawn7, cwd, opts = {}) {
+  const execFileAsync2 = opts.execFileAsync ?? nodeExecFileAsync;
+  const timeoutMs = opts.timeoutMs ?? MAINTENANCE_CHECK_TIMEOUT_MS;
+  const maxBuffer = opts.maxBuffer ?? MAINTENANCE_CHECK_MAX_BUFFER;
+  try {
+    const { stdout } = await execFileAsync2(spawn7.file, spawn7.args, {
+      cwd,
+      timeout: timeoutMs,
+      maxBuffer
+    });
+    const text = String(stdout);
+    const m = text.match(FINDINGS_RE);
+    const findings = m ? parseInt(m[1], 10) : 0;
+    return { passed: findings === 0, findings, output: text, executionFailed: false };
+  } catch (err) {
+    const e = err;
+    let output = [e.stdout, e.stderr].map((v) => v == null ? "" : String(v)).filter(Boolean).join("\n");
+    if (isCheckTimeoutError(e)) {
+      const note = `check timed out after ${timeoutMs}ms`;
+      output = output.trim() ? `${output}
+${note}` : note;
+      return { passed: false, findings: 0, output, executionFailed: true };
+    }
+    const m = output.match(FINDINGS_RE);
+    if (m) {
+      return { passed: false, findings: parseInt(m[1], 10), output, executionFailed: false };
+    }
+    return { passed: false, findings: 0, output, executionFailed: true };
+  }
+}
+
 // src/maintenance/output-store.ts
-import * as fs17 from "fs";
+import * as fs15 from "fs";
 import * as path20 from "path";
 var DEFAULT_RETENTION = {
   runs: 50,
@@ -12048,13 +12599,13 @@ var TaskOutputStore = class {
   async write(taskId, entry, retention) {
     this.ensureSafeTaskId(taskId);
     const dir = this.dirFor(taskId);
-    await fs17.promises.mkdir(dir, { recursive: true });
+    await fs15.promises.mkdir(dir, { recursive: true });
     const fileName = `${sanitizeIso(entry.completedAt || (/* @__PURE__ */ new Date()).toISOString())}.json`;
     const filePath = path20.join(dir, fileName);
     const tmpPath = `${filePath}.tmp`;
     const payload = JSON.stringify(entry, null, 2);
-    await fs17.promises.writeFile(tmpPath, payload, "utf-8");
-    await fs17.promises.rename(tmpPath, filePath);
+    await fs15.promises.writeFile(tmpPath, payload, "utf-8");
+    await fs15.promises.rename(tmpPath, filePath);
     try {
       await this.applyRetention(taskId, retention);
     } catch (err) {
@@ -12105,7 +12656,7 @@ var TaskOutputStore = class {
   }
   async readEntry(filePath) {
     try {
-      const buf = await fs17.promises.readFile(filePath, "utf-8");
+      const buf = await fs15.promises.readFile(filePath, "utf-8");
       const parsed = JSON.parse(buf);
       return parsed;
     } catch {
@@ -12127,7 +12678,7 @@ var TaskOutputStore = class {
     const toRemove = /* @__PURE__ */ new Set([...overflow, ...aged]);
     for (const name of toRemove) {
       try {
-        await fs17.promises.unlink(path20.join(dir, name));
+        await fs15.promises.unlink(path20.join(dir, name));
       } catch {
       }
     }
@@ -12136,7 +12687,7 @@ var TaskOutputStore = class {
 async function listJsonFilesDescending(dir) {
   let names;
   try {
-    names = await fs17.promises.readdir(dir);
+    names = await fs15.promises.readdir(dir);
   } catch {
     return [];
   }
@@ -12245,7 +12796,7 @@ var fallbackLogger3 = {
 };
 
 // src/maintenance/custom-task-validator.ts
-import { Ok as Ok23, Err as Err20 } from "@harness-engineering/types";
+import { Ok as Ok23, Err as Err22 } from "@harness-engineering/types";
 var ID_PATTERN = /^[a-z0-9][a-z0-9-]*$/;
 var REQUIRED_FIELDS_BY_TYPE = {
   "mechanical-ai": ["branch", "fixSkill"],
@@ -12265,7 +12816,7 @@ function validateCustomTasks(customTasks, builtIns, deps = {}) {
     validateOne(id, task, builtInIds, allIds, deps, errors);
   }
   detectCycles(customTasks, builtIns, errors);
-  return errors.length === 0 ? Ok23(void 0) : Err20(errors);
+  return errors.length === 0 ? Ok23(void 0) : Err22(errors);
 }
 function validateOne(id, task, builtInIds, allIds, deps, errors) {
   const prefix = `customTasks.${id}`;
@@ -12454,6 +13005,11 @@ function deriveSeedPaths(config) {
   const roadmapPath = config.tracker.kind === "roadmap" && config.tracker.filePath ? config.tracker.filePath : "docs/roadmap.md";
   return [".harness/proposals", roadmapPath];
 }
+function normalizeHarnessCommand(command) {
+  if (command.length === 0) return [];
+  if (command[0] === "harness") return command;
+  return ["harness", ...command];
+}
 var Orchestrator = class extends EventEmitter {
   state;
   config;
@@ -12580,6 +13136,11 @@ var Orchestrator = class extends EventEmitter {
   abortControllers = /* @__PURE__ */ new Map();
   /** Guards against overlapping ticks when a tick takes longer than the polling interval */
   tickInProgress = false;
+  /** Phase 4 (DLane-5): lanes read back from the durable log on first tick, for
+   *  observability only — NOT fed into reconciliation. Empty until the first tick. */
+  persistedLanes = { tasks: {} };
+  /** Ensures the lane read-back diagnostic runs at most once (first tick). */
+  laneReadbackDone = false;
   /** Timestamp of the last stale branch sweep (at most once per hour) */
   lastBranchSweepMs = 0;
   /** Current tick-phase activity visible to the dashboard */
@@ -12826,48 +13387,30 @@ var Orchestrator = class extends EventEmitter {
     const logger = this.logger;
     const checkRunner = {
       run: async (command, cwd) => {
-        const { execFile: execFile7 } = await import("child_process");
-        const { promisify: promisify5 } = await import("util");
-        const execFileAsync2 = promisify5(execFile7);
-        const [cmd, ...args] = command;
-        if (!cmd) return { passed: true, findings: 0, output: "" };
-        try {
-          const { stdout } = await execFileAsync2(cmd, args, { cwd, timeout: 12e4 });
-          const findingsMatch = stdout.match(/(\d+)\s+(?:finding|issue|violation|error)/i);
-          const findings = findingsMatch ? parseInt(findingsMatch[1], 10) : 0;
-          return { passed: findings === 0, findings, output: stdout };
-        } catch (err) {
-          const error = err;
-          const output = [error.stdout, error.stderr].filter(Boolean).join("\n");
-          const findingsMatch = output.match(/(\d+)\s+(?:finding|issue|violation|error)/i);
-          const findings = findingsMatch ? parseInt(findingsMatch[1], 10) : 1;
-          return { passed: false, findings, output };
-        }
-      }
-    };
-    const agentDispatcher = {
-      dispatch: async (skill, branch, backendName, cwd) => {
-        logger.info(
-          "Maintenance agent dispatcher invoked (stub \u2014 skill dispatch integration pending)",
-          {
-            skill,
-            branch,
-            backendName,
-            cwd
-          }
-        );
-        return { producedCommits: false, fixed: 0 };
+        const [cmd, ...args] = normalizeHarnessCommand(command);
+        if (!cmd) return { passed: true, findings: 0, output: "", executionFailed: false };
+        return runHarnessCheck({ file: cmd, args }, cwd);
       }
     };
+    const resolveBackend2 = makeBackendResolver(this.getBackends());
+    const agentDispatcher = createAgentDispatcher({
+      resolveBackend: resolveBackend2,
+      git: (args, cwd) => execFileSync("git", args, { cwd, encoding: "utf-8" }).toString().trim(),
+      logger
+    });
     const commandExecutor = {
       exec: async (command, cwd) => {
         const { execFile: execFile7 } = await import("child_process");
-        const { promisify: promisify5 } = await import("util");
-        const execFileAsync2 = promisify5(execFile7);
-        const [cmd, ...args] = command;
+        const { promisify: promisify6 } = await import("util");
+        const execFileAsync2 = promisify6(execFile7);
+        const [cmd, ...args] = normalizeHarnessCommand(command);
         if (!cmd) return { stdout: "" };
         try {
-          const { stdout } = await execFileAsync2(cmd, args, { cwd, timeout: 12e4 });
+          const { stdout } = await execFileAsync2(cmd, args, {
+            cwd,
+            timeout: MAINTENANCE_CHECK_TIMEOUT_MS,
+            maxBuffer: MAINTENANCE_CHECK_MAX_BUFFER
+          });
           return { stdout: String(stdout) };
         } catch (err) {
           logger.warn("Maintenance command execution failed", {
@@ -13002,6 +13545,10 @@ ${messages}`);
   async asyncTick() {
     await this.ensureClaimManager();
     await this.intelligenceRunner.loadPersistedData();
+    if (!this.laneReadbackDone) {
+      this.laneReadbackDone = true;
+      await this.readBackPersistedLanes();
+    }
     const nowMs = Date.now();
     this.setTickActivity("fetching", "Polling tracker for candidates");
     const candidatesResult = await this.tracker.fetchCandidateIssues();
@@ -13154,12 +13701,48 @@ ${messages}`);
         break;
       case "escalate":
         await this.handleEscalation(effect);
+        await this.persistLaneSafe(effect.issueId, "abandon");
         break;
       case "claim":
         await this.handleClaimEffect(effect);
         break;
     }
   }
+  /**
+   * Phase 4 (DLane-5): persist an orchestrator lane transition to the durable
+   * core event log at the effect boundary. NEVER throws — `persistLane` returns
+   * an `Err` Result on failure, which is logged and swallowed here so a
+   * lane-persistence failure can never break orchestrator dispatch.
+   */
+  async persistLaneSafe(issueId, signal) {
+    const r = await persistLane(this.projectRoot, issueId, signal);
+    if (!r.ok) {
+      this.logger.warn(`lane persist failed for ${issueId} (${signal}): ${r.error.message}`);
+    }
+  }
+  /**
+   * Phase 4 (DLane-5): read persisted task lanes back from the durable log and
+   * log a one-line summary. Stores the projection on `this.persistedLanes` for
+   * observability. Read-only — never feeds reconciliation, never throws.
+   */
+  async readBackPersistedLanes() {
+    const lanes = await readPersistedLanes(this.projectRoot);
+    this.persistedLanes = lanes;
+    const entries = Object.keys(lanes.tasks).map((id) => `${id}:${lanes.tasks[id]?.lane}`);
+    const nonTerminal = entries.filter((e) => !e.endsWith(":done") && !e.endsWith(":canceled"));
+    this.logger.info(
+      `Lane read-back on startup: ${entries.length} persisted task(s), ${nonTerminal.length} non-terminal`,
+      { nonTerminal }
+    );
+  }
+  /**
+   * Phase 4 (DLane-5): the task lanes most recently read back from the durable
+   * log on startup, exposed for external observability. Read-only — a fresh
+   * `{ tasks: {} }` until the first tick's read-back has run.
+   */
+  getPersistedLanes() {
+    return this.persistedLanes;
+  }
   /**
    * Guards workspace cleanup by checking whether the agent pushed a branch
    * that does not yet have a pull request. If so, the worktree is preserved
@@ -13346,6 +13929,7 @@ ${messages}`);
       }
       return;
     }
+    await this.persistLaneSafe(effect.issue.id, "claim");
     await this.postClaimComment(effect.issue);
     await this.dispatchIssue(effect.issue, effect.attempt, effect.backend);
   }
@@ -13406,6 +13990,7 @@ ${messages}`);
     this.logger.info(`Dispatching issue: ${issue.identifier} (attempt ${attempt})`, {
       issueId: issue.id
     });
+    await this.persistLaneSafe(issue.id, "dispatch");
     try {
       const workspaceResult = await this.workspace.ensureWorkspace(issue.identifier);
       if (!workspaceResult.ok) throw workspaceResult.error;
@@ -13614,6 +14199,7 @@ ${messages}`);
    * Informs the state machine that an agent worker has exited.
    */
   async emitWorkerExit(issueId, reason, attempt, error) {
+    await this.persistLaneSafe(issueId, reason === "normal" ? "success" : "failure");
     await this.completionHandler.handleWorkerExit(
       issueId,
       reason,
@@ -14149,11 +14735,11 @@ function launchTUI(orchestrator) {
 }
 
 // src/maintenance/sync-main.ts
-import { execFile as nodeExecFile } from "child_process";
-import { promisify as promisify4 } from "util";
+import { execFile as nodeExecFile2 } from "child_process";
+import { promisify as promisify5 } from "util";
 var DEFAULT_TIMEOUT_MS3 = 6e4;
 async function git(execFileFn, args, cwd, timeoutMs) {
-  const exec = promisify4(execFileFn);
+  const exec = promisify5(execFileFn);
   const { stdout, stderr } = await exec("git", args, { cwd, timeout: timeoutMs });
   return { stdout: String(stdout), stderr: String(stderr) };
 }
@@ -14215,7 +14801,7 @@ async function isAncestor(execFileFn, a, b, cwd, timeoutMs) {
   }
 }
 async function syncMain(repoRoot, opts = {}) {
-  const execFileFn = opts.execFileFn ?? nodeExecFile;
+  const execFileFn = opts.execFileFn ?? nodeExecFile2;
   const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS3;
   try {
     const originRef = await resolveOriginDefault(execFileFn, repoRoot, timeoutMs);
@@ -14292,8 +14878,56 @@ async function syncMain(repoRoot, opts = {}) {
   }
 }
 
+// src/maintenance/overdue.ts
+var LOOKBACK_DAYS = 366;
+function previousFireTime(schedule, now) {
+  let day = new Date(now.getFullYear(), now.getMonth(), now.getDate());
+  for (let d = 0; d <= LOOKBACK_DAYS; d++) {
+    if (cronMatchesDate(schedule, day)) {
+      const dayStartMs = day.getTime();
+      const scanStart = d === 0 ? new Date(
+        now.getFullYear(),
+        now.getMonth(),
+        now.getDate(),
+        now.getHours(),
+        now.getMinutes()
+      ) : new Date(day.getFullYear(), day.getMonth(), day.getDate(), 23, 59);
+      for (let ms = scanStart.getTime(); ms >= dayStartMs; ms -= 6e4) {
+        const candidate = new Date(ms);
+        if (cronMatchesNow(schedule, candidate)) return candidate;
+      }
+    }
+    day = new Date(day.getFullYear(), day.getMonth(), day.getDate() - 1);
+  }
+  return null;
+}
+function isSatisfyingRun(r) {
+  return r.status === "success" || r.status === "no-issues";
+}
+function isOverdue(task, history, now) {
+  const satisfyingRuns = history.filter((r) => r.taskId === task.id && isSatisfyingRun(r));
+  const fire = previousFireTime(task.schedule, now);
+  if (fire === null) return satisfyingRuns.length === 0;
+  const fireMs = fire.getTime();
+  const satisfied = satisfyingRuns.some((r) => new Date(r.completedAt).getTime() >= fireMs);
+  return !satisfied;
+}
+function selectTasks(tasks, history, filter) {
+  const eligible = tasks.filter((t) => t.excludeFromHumanSweep !== true);
+  switch (filter.mode) {
+    case "all":
+      return eligible;
+    case "ids": {
+      const wanted = new Set(filter.ids ?? []);
+      return eligible.filter((t) => wanted.has(t.id));
+    }
+    case "overdue":
+      return eligible.filter((t) => isOverdue(t, history, filter.now));
+  }
+}
+
 // src/sessions/search-index.ts
-import * as fs18 from "fs";
+import * as fs16 from "fs";
 import * as path22 from "path";
 import Database2 from "better-sqlite3";
 import { INDEXED_FILE_KINDS } from "@harness-engineering/types";
@@ -14354,7 +14988,7 @@ var SqliteSearchIndex = class {
   removeSessionStmt;
   totalStmt;
   constructor(dbPath) {
-    fs18.mkdirSync(path22.dirname(dbPath), { recursive: true });
+    fs16.mkdirSync(path22.dirname(dbPath), { recursive: true });
     this.db = new Database2(dbPath);
     this.db.pragma("journal_mode = WAL");
     this.db.pragma("synchronous = NORMAL");
@@ -14460,12 +15094,12 @@ function indexSessionDirectory(idx, args) {
   for (const kind of kinds) {
     const fileName = FILE_KIND_TO_FILENAME[kind];
     const filePath = path22.join(args.sessionDir, fileName);
-    if (!fs18.existsSync(filePath)) continue;
-    let body = fs18.readFileSync(filePath, "utf8");
+    if (!fs16.existsSync(filePath)) continue;
+    let body = fs16.readFileSync(filePath, "utf8");
     if (Buffer.byteLength(body, "utf8") > cap) {
       body = body.slice(0, cap) + "\n\n[TRUNCATED]";
     }
-    const stat = fs18.statSync(filePath);
+    const stat = fs16.statSync(filePath);
     const relPath = path22.relative(args.projectPath, filePath).replaceAll("\\", "/");
     idx.upsertSessionDoc({
       sessionId: args.sessionId,
@@ -14487,8 +15121,8 @@ function reindexFromArchive(projectPath, opts = {}) {
     idx.resetArchived();
     let sessionsIndexed = 0;
     let docsWritten = 0;
-    if (fs18.existsSync(archiveBase)) {
-      const entries = fs18.readdirSync(archiveBase, { withFileTypes: true });
+    if (fs16.existsSync(archiveBase)) {
+      const entries = fs16.readdirSync(archiveBase, { withFileTypes: true });
       for (const entry of entries) {
         if (!entry.isDirectory()) continue;
         const sessionDir = path22.join(archiveBase, entry.name);
@@ -14511,12 +15145,12 @@ function reindexFromArchive(projectPath, opts = {}) {
 }
 
 // src/sessions/summarize.ts
-import * as fs19 from "fs";
+import * as fs17 from "fs";
 import * as path23 from "path";
 import {
   SessionSummarySchema
 } from "@harness-engineering/types";
-import { Ok as Ok24, Err as Err21 } from "@harness-engineering/types";
+import { Ok as Ok24, Err as Err23 } from "@harness-engineering/types";
 var LLM_SUMMARY_FILE = "llm-summary.md";
 var SUMMARY_INPUT_FILES = [
   { filename: "summary.md", kind: "summary" },
@@ -14543,9 +15177,9 @@ function readInputCorpus(archiveDir) {
   const parts = [];
   for (const { filename, kind } of SUMMARY_INPUT_FILES) {
     const p = path23.join(archiveDir, filename);
-    if (!fs19.existsSync(p)) continue;
+    if (!fs17.existsSync(p)) continue;
     try {
-      const content = fs19.readFileSync(p, "utf8");
+      const content = fs17.readFileSync(p, "utf8");
       if (content.trim().length === 0) continue;
       parts.push(`## FILE: ${kind}
 
@@ -14607,17 +15241,17 @@ status: failed
 
 - reason: ${reason}
 `;
-  fs19.writeFileSync(filePath, body, "utf8");
+  fs17.writeFileSync(filePath, body, "utf8");
   return filePath;
 }
 async function summarizeArchivedSession(ctx) {
   const writeStubOnError = ctx.writeStubOnError ?? true;
-  if (!fs19.existsSync(ctx.archiveDir)) {
-    return Err21(new Error(`archive directory not found: ${ctx.archiveDir}`));
+  if (!fs17.existsSync(ctx.archiveDir)) {
+    return Err23(new Error(`archive directory not found: ${ctx.archiveDir}`));
   }
   const corpus = readInputCorpus(ctx.archiveDir);
   if (corpus.trim().length === 0) {
-    return Err21(new Error(`no summary input files found in ${ctx.archiveDir}`));
+    return Err23(new Error(`no summary input files found in ${ctx.archiveDir}`));
   }
   const inputBudgetTokens = ctx.config?.inputBudgetTokens ?? DEFAULT_INPUT_BUDGET_TOKENS;
   const truncated = truncateForBudget(corpus, inputBudgetTokens);
@@ -14650,7 +15284,7 @@ async function summarizeArchivedSession(ctx) {
       } catch {
       }
     }
-    return Err21(
+    return Err23(
       new Error(`session summary failed: ${reason}` + (stubPath ? ` (stub: ${stubPath})` : ""))
     );
   }
@@ -14664,7 +15298,7 @@ async function summarizeArchivedSession(ctx) {
       } catch {
       }
     }
-    return Err21(new Error(reason));
+    return Err23(new Error(reason));
   }
   const meta = {
     generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
@@ -14675,7 +15309,7 @@ async function summarizeArchivedSession(ctx) {
   };
   const filePath = path23.join(ctx.archiveDir, LLM_SUMMARY_FILE);
   const body = renderLlmSummaryMarkdown(parsed.data, meta);
-  fs19.writeFileSync(filePath, body, "utf8");
+  fs17.writeFileSync(filePath, body, "utf8");
   return Ok24({ summary: parsed.data, meta, filePath });
 }
 function isSummaryEnabled(config) {
@@ -14755,13 +15389,18 @@ export {
   BUILT_IN_TASKS,
   BackendDefSchema,
   BackendRouter,
+  CheckScriptRunner,
   ClaimManager,
   GateNotReadyError,
   GateRunError,
   InteractionQueue,
+  LinearGraphQLClient,
   LinearGraphQLStub,
   LocalModelResolver,
+  MAINTENANCE_CHECK_MAX_BUFFER,
+  MAINTENANCE_CHECK_TIMEOUT_MS,
   MAX_ATTEMPTS,
+  MaintenanceReporter,
   MockBackend,
   ORCHESTRATOR_IDENTITY_FILE,
   Orchestrator,
@@ -14779,6 +15418,7 @@ export {
   SqliteSearchIndex,
   StreamRecorder,
   TaskOutputStore,
+  TaskRunner,
   TokenStore,
   WebhookQueue,
   WorkflowLoader,
@@ -14789,7 +15429,9 @@ export {
   buildArchiveHooks,
   calculateRetryDelay,
   canDispatch,
+  classifyCheckExecutionFailure,
   computeRateLimitDelay,
+  createAgentDispatcher,
   createBackend,
   createEmptyState,
   crossFieldRoutingIssues,
@@ -14801,22 +15443,27 @@ export {
   emitProposalApproved,
   emitProposalCreated,
   emitProposalRejected,
+  explicitFindingsCount,
   extractHighlights,
   extractTitlePrefix,
   getAvailableSlots,
   getDefaultConfig,
   getPerStateCount,
   indexSessionDirectory,
+  isCheckTimeoutError,
   isEligible,
   isSummaryEnabled,
   launchTUI,
   loadPublishedIndex,
+  makeBackendResolver,
   migrateAgentConfig,
   normalizeFts5Query,
+  normalizeHarnessCommand,
   normalizeLocalModel,
   openSearchIndex,
   promote,
   reconcile,
+  recoverFindingsCount,
   reindexFromArchive,
   renderAnalysisComment,
   renderLlmSummaryMarkdown,
@@ -14826,9 +15473,11 @@ export {
   routeIssue,
   routingWarnings,
   runGate,
+  runHarnessCheck,
   savePublishedIndex,
   searchIndexPath,
   selectCandidates,
+  selectTasks,
   sortCandidates,
   summarizeArchivedSession,
   syncMain,