@harness-engineering/orchestrator 0.8.4 → 0.9.0

package/dist/index.js

@@ -34,13 +34,18 @@ __export(index_exports, {
   BUILT_IN_TASKS: () => BUILT_IN_TASKS,
   BackendDefSchema: () => BackendDefSchema,
   BackendRouter: () => BackendRouter,
+  CheckScriptRunner: () => CheckScriptRunner,
   ClaimManager: () => ClaimManager,
   GateNotReadyError: () => GateNotReadyError,
   GateRunError: () => GateRunError,
   InteractionQueue: () => InteractionQueue,
+  LinearGraphQLClient: () => LinearGraphQLClient,
   LinearGraphQLStub: () => LinearGraphQLStub,
   LocalModelResolver: () => LocalModelResolver,
+  MAINTENANCE_CHECK_MAX_BUFFER: () => MAINTENANCE_CHECK_MAX_BUFFER,
+  MAINTENANCE_CHECK_TIMEOUT_MS: () => MAINTENANCE_CHECK_TIMEOUT_MS,
   MAX_ATTEMPTS: () => MAX_ATTEMPTS,
+  MaintenanceReporter: () => MaintenanceReporter,
   MockBackend: () => MockBackend,
   ORCHESTRATOR_IDENTITY_FILE: () => ORCHESTRATOR_IDENTITY_FILE,
   Orchestrator: () => Orchestrator,
@@ -58,6 +63,7 @@ __export(index_exports, {
   SqliteSearchIndex: () => SqliteSearchIndex,
   StreamRecorder: () => StreamRecorder,
   TaskOutputStore: () => TaskOutputStore,
+  TaskRunner: () => TaskRunner,
   TokenStore: () => TokenStore,
   WebhookQueue: () => WebhookQueue,
   WorkflowLoader: () => WorkflowLoader,
@@ -68,7 +74,9 @@ __export(index_exports, {
   buildArchiveHooks: () => buildArchiveHooks,
   calculateRetryDelay: () => calculateRetryDelay,
   canDispatch: () => canDispatch,
+  classifyCheckExecutionFailure: () => classifyCheckExecutionFailure,
   computeRateLimitDelay: () => computeRateLimitDelay,
+  createAgentDispatcher: () => createAgentDispatcher,
   createBackend: () => createBackend,
   createEmptyState: () => createEmptyState,
   crossFieldRoutingIssues: () => crossFieldRoutingIssues,
@@ -80,22 +88,27 @@ __export(index_exports, {
   emitProposalApproved: () => emitProposalApproved,
   emitProposalCreated: () => emitProposalCreated,
   emitProposalRejected: () => emitProposalRejected,
+  explicitFindingsCount: () => explicitFindingsCount,
   extractHighlights: () => extractHighlights,
   extractTitlePrefix: () => extractTitlePrefix,
   getAvailableSlots: () => getAvailableSlots,
   getDefaultConfig: () => getDefaultConfig,
   getPerStateCount: () => getPerStateCount,
   indexSessionDirectory: () => indexSessionDirectory,
+  isCheckTimeoutError: () => isCheckTimeoutError,
   isEligible: () => isEligible,
   isSummaryEnabled: () => isSummaryEnabled,
   launchTUI: () => launchTUI,
   loadPublishedIndex: () => loadPublishedIndex,
+  makeBackendResolver: () => makeBackendResolver,
   migrateAgentConfig: () => migrateAgentConfig,
   normalizeFts5Query: () => normalizeFts5Query,
+  normalizeHarnessCommand: () => normalizeHarnessCommand,
   normalizeLocalModel: () => normalizeLocalModel,
   openSearchIndex: () => openSearchIndex,
   promote: () => promote,
   reconcile: () => reconcile,
+  recoverFindingsCount: () => recoverFindingsCount,
   reindexFromArchive: () => reindexFromArchive,
   renderAnalysisComment: () => renderAnalysisComment,
   renderLlmSummaryMarkdown: () => renderLlmSummaryMarkdown,
@@ -105,9 +118,11 @@ __export(index_exports, {
   routeIssue: () => routeIssue,
   routingWarnings: () => routingWarnings,
   runGate: () => runGate,
+  runHarnessCheck: () => runHarnessCheck,
   savePublishedIndex: () => savePublishedIndex,
   searchIndexPath: () => searchIndexPath,
   selectCandidates: () => selectCandidates,
+  selectTasks: () => selectTasks,
   sortCandidates: () => sortCandidates,
   summarizeArchivedSession: () => summarizeArchivedSession,
   syncMain: () => syncMain,
@@ -2327,7 +2342,6 @@ var WorkflowLoader = class {
 };
 
 // src/tracker/adapters/roadmap.ts
-var fs8 = __toESM(require("fs/promises"));
 var import_node_crypto2 = require("crypto");
 var import_core = require("@harness-engineering/core");
 var import_types4 = require("@harness-engineering/types");
@@ -2358,8 +2372,7 @@ var RoadmapTrackerAdapter = class {
   async fetchIssuesByStates(stateNames) {
     try {
       if (!this.config.filePath) return (0, import_types4.Err)(new Error("Missing filePath"));
-      const content = await fs8.readFile(this.config.filePath, "utf-8");
-      const roadmapResult = (0, import_core.parseRoadmap)(content);
+      const roadmapResult = await this.loadRoadmap();
       if (!roadmapResult.ok) return roadmapResult;
       const issues = [];
       for (const milestone of roadmapResult.value.milestones) {
@@ -2390,17 +2403,19 @@ var RoadmapTrackerAdapter = class {
       if (!terminal) {
         return (0, import_types4.Err)(new Error("Tracker config has no terminalStates; cannot mark complete"));
       }
-      const content = await fs8.readFile(this.config.filePath, "utf-8");
-      const roadmapResult = (0, import_core.parseRoadmap)(content);
+      const store = this.resolveStore();
+      const roadmapResult = await store.load();
       if (!roadmapResult.ok) return roadmapResult;
       const roadmap = roadmapResult.value;
+      const before = structuredClone(roadmap);
       const target = this.findFeatureById(roadmap.milestones, issueId);
       if (!target) return (0, import_types4.Ok)(void 0);
       const normalizedTerminal = this.config.terminalStates.map((s) => s.toLowerCase());
       if (normalizedTerminal.includes(target.status.toLowerCase())) return (0, import_types4.Ok)(void 0);
       const now = (/* @__PURE__ */ new Date()).toISOString();
       (0, import_core.setStatus)(roadmap, target, terminal, now.slice(0, 10));
-      await fs8.writeFile(this.config.filePath, (0, import_core.serializeRoadmap)(roadmap), "utf-8");
+      const persisted = await (0, import_core.applyRoadmapDiff)(store, before, roadmap);
+      if (!persisted.ok) return persisted;
       return (0, import_types4.Ok)(void 0);
     } catch (error) {
       return (0, import_types4.Err)(error instanceof Error ? error : new Error(String(error)));
@@ -2414,10 +2429,11 @@ var RoadmapTrackerAdapter = class {
   async claimIssue(issueId, orchestratorId) {
     try {
       if (!this.config.filePath) return (0, import_types4.Err)(new Error("Missing filePath"));
-      const content = await fs8.readFile(this.config.filePath, "utf-8");
-      const roadmapResult = (0, import_core.parseRoadmap)(content);
+      const store = this.resolveStore();
+      const roadmapResult = await store.load();
       if (!roadmapResult.ok) return roadmapResult;
       const roadmap = roadmapResult.value;
+      const before = structuredClone(roadmap);
       const target = this.findFeatureById(roadmap.milestones, issueId);
       if (!target) return (0, import_types4.Ok)(void 0);
       if (!(0, import_core.isClaimableBy)(target, orchestratorId)) {
@@ -2429,7 +2445,8 @@ var RoadmapTrackerAdapter = class {
       const now = (/* @__PURE__ */ new Date()).toISOString();
       (0, import_core.claim)(roadmap, target, orchestratorId, now.slice(0, 10));
       target.updatedAt = now;
-      await fs8.writeFile(this.config.filePath, (0, import_core.serializeRoadmap)(roadmap), "utf-8");
+      const persisted = await (0, import_core.applyRoadmapDiff)(store, before, roadmap);
+      if (!persisted.ok) return persisted;
       return (0, import_types4.Ok)(void 0);
     } catch (error) {
       return (0, import_types4.Err)(error instanceof Error ? error : new Error(String(error)));
@@ -2446,10 +2463,11 @@ var RoadmapTrackerAdapter = class {
       if (!activeState) {
         return (0, import_types4.Err)(new Error("Tracker config has no activeStates; cannot release"));
       }
-      const content = await fs8.readFile(this.config.filePath, "utf-8");
-      const roadmapResult = (0, import_core.parseRoadmap)(content);
+      const store = this.resolveStore();
+      const roadmapResult = await store.load();
       if (!roadmapResult.ok) return roadmapResult;
       const roadmap = roadmapResult.value;
+      const before = structuredClone(roadmap);
       const target = this.findFeatureById(roadmap.milestones, issueId);
       if (!target) return (0, import_types4.Ok)(void 0);
       if (this.config.activeStates.includes(target.status) && target.assignee === null) {
@@ -2458,12 +2476,26 @@ var RoadmapTrackerAdapter = class {
       const now = (/* @__PURE__ */ new Date()).toISOString();
       (0, import_core.setStatus)(roadmap, target, activeState, now.slice(0, 10));
       target.updatedAt = null;
-      await fs8.writeFile(this.config.filePath, (0, import_core.serializeRoadmap)(roadmap), "utf-8");
+      const persisted = await (0, import_core.applyRoadmapDiff)(store, before, roadmap);
+      if (!persisted.ok) return persisted;
       return (0, import_types4.Ok)(void 0);
     } catch (error) {
       return (0, import_types4.Err)(error instanceof Error ? error : new Error(String(error)));
     }
   }
+  /**
+   * Resolve the roadmap store anchored on the configured aggregate file path.
+   * The shard backend is chosen when a sibling `roadmap.d/` exists next to the
+   * file; otherwise the monolith file is read/written whole. Callers guard
+   * `this.config.filePath` before invoking.
+   */
+  resolveStore() {
+    return (0, import_core.resolveRoadmapStoreForFile)({ roadmapPath: this.config.filePath });
+  }
+  /** Load the roadmap via the store (sharded or monolith), returning a Result. */
+  loadRoadmap() {
+    return this.resolveStore().load();
+  }
   findFeatureById(milestones, issueId) {
     for (const milestone of milestones) {
       for (const feature of milestone.features) {
@@ -2480,8 +2512,7 @@ var RoadmapTrackerAdapter = class {
   async fetchIssueStatesByIds(issueIds) {
     try {
       if (!this.config.filePath) return (0, import_types4.Err)(new Error("Missing filePath"));
-      const content = await fs8.readFile(this.config.filePath, "utf-8");
-      const roadmapResult = (0, import_core.parseRoadmap)(content);
+      const roadmapResult = await this.loadRoadmap();
       if (!roadmapResult.ok) return roadmapResult;
       const issueMap = /* @__PURE__ */ new Map();
       for (const milestone of roadmapResult.value.milestones) {
@@ -2537,6 +2568,56 @@ var RoadmapTrackerAdapter = class {
 
 // src/tracker/extensions/linear.ts
 var import_types5 = require("@harness-engineering/types");
+var LINEAR_GRAPHQL_ENDPOINT = "https://api.linear.app/graphql";
+var LinearGraphQLClient = class {
+  apiKey;
+  endpoint;
+  fetchFn;
+  constructor(opts) {
+    this.apiKey = opts.apiKey;
+    this.endpoint = opts.endpoint ?? LINEAR_GRAPHQL_ENDPOINT;
+    this.fetchFn = opts.fetchFn ?? globalThis.fetch;
+  }
+  async query(query, variables) {
+    let res;
+    try {
+      res = await this.fetchFn(this.endpoint, {
+        method: "POST",
+        headers: {
+          Authorization: this.apiKey,
+          "Content-Type": "application/json"
+        },
+        body: JSON.stringify({ query, variables: variables ?? {} })
+      });
+    } catch (err) {
+      return (0, import_types5.Err)(
+        new Error(
+          `Linear GraphQL request failed: ${err instanceof Error ? err.message : String(err)}`
+        )
+      );
+    }
+    if (!res.ok) {
+      const body = await res.text().catch(() => "");
+      const detail = body ? `: ${body.slice(0, 500)}` : "";
+      return (0, import_types5.Err)(new Error(`Linear GraphQL HTTP ${res.status}${detail}`));
+    }
+    let envelope;
+    try {
+      envelope = await res.json();
+    } catch (err) {
+      return (0, import_types5.Err)(
+        new Error(
+          `Linear GraphQL response was not valid JSON: ${err instanceof Error ? err.message : String(err)}`
+        )
+      );
+    }
+    if (envelope.errors && envelope.errors.length > 0) {
+      const message = envelope.errors.map((e) => e.message ?? "unknown error").join("; ");
+      return (0, import_types5.Err)(new Error(`Linear GraphQL error: ${message}`));
+    }
+    return (0, import_types5.Ok)(envelope.data ?? {});
+  }
+};
 var LinearGraphQLStub = class {
   async query(query, _variables) {
     console.log("Linear GraphQL query (stub):", query);
@@ -2545,7 +2626,7 @@ var LinearGraphQLStub = class {
 };
 
 // src/workspace/manager.ts
-var fs9 = __toESM(require("fs/promises"));
+var fs8 = __toESM(require("fs/promises"));
 var path8 = __toESM(require("path"));
 var import_node_child_process2 = require("child_process");
 var import_node_util2 = require("util");
@@ -2585,7 +2666,7 @@ var WorkspaceManager = class _WorkspaceManager {
   async getRepoRoot() {
     if (this.repoRoot) return this.repoRoot;
     const root = path8.resolve(this.config.root);
-    await fs9.mkdir(root, { recursive: true });
+    await fs8.mkdir(root, { recursive: true });
     const stdout = await this.git(["rev-parse", "--show-toplevel"], root);
     this.repoRoot = stdout.trim();
     return this.repoRoot;
@@ -2598,21 +2679,21 @@ var WorkspaceManager = class _WorkspaceManager {
     try {
       const workspacePath = path8.resolve(this.resolvePath(identifier));
       try {
-        await fs9.access(path8.join(workspacePath, ".git"));
+        await fs8.access(path8.join(workspacePath, ".git"));
         const repoRoot2 = await this.getRepoRoot();
         try {
           await this.git(["worktree", "remove", "--force", workspacePath], repoRoot2);
         } catch {
-          await fs9.rm(workspacePath, { recursive: true, force: true });
+          await fs8.rm(workspacePath, { recursive: true, force: true });
         }
       } catch {
         try {
-          await fs9.access(workspacePath);
+          await fs8.access(workspacePath);
           const repoRoot2 = await this.getRepoRoot();
           try {
             await this.git(["worktree", "remove", "--force", workspacePath], repoRoot2);
           } catch {
-            await fs9.rm(workspacePath, { recursive: true, force: true });
+            await fs8.rm(workspacePath, { recursive: true, force: true });
           }
         } catch {
         }
@@ -2665,13 +2746,13 @@ var WorkspaceManager = class _WorkspaceManager {
       }
       const src = path8.join(repoRoot, rel);
       try {
-        await fs9.access(src);
+        await fs8.access(src);
       } catch {
         continue;
       }
       const dest = path8.join(workspacePath, rel);
       try {
-        await fs9.cp(src, dest, { recursive: true, force: true });
+        await fs8.cp(src, dest, { recursive: true, force: true });
       } catch {
       }
     }
@@ -2747,7 +2828,7 @@ var WorkspaceManager = class _WorkspaceManager {
   async exists(identifier) {
     try {
       const workspacePath = this.resolvePath(identifier);
-      await fs9.access(workspacePath);
+      await fs8.access(workspacePath);
       return true;
     } catch {
       return false;
@@ -2762,7 +2843,7 @@ var WorkspaceManager = class _WorkspaceManager {
     try {
       const workspacePath = path8.resolve(this.resolvePath(identifier));
       try {
-        await fs9.access(path8.join(workspacePath, ".git"));
+        await fs8.access(path8.join(workspacePath, ".git"));
       } catch {
         return null;
       }
@@ -2873,7 +2954,7 @@ var WorkspaceManager = class _WorkspaceManager {
         const repoRoot = await this.getRepoRoot();
         await this.git(["worktree", "remove", "--force", workspacePath], repoRoot);
       } catch {
-        await fs9.rm(workspacePath, { recursive: true, force: true });
+        await fs8.rm(workspacePath, { recursive: true, force: true });
       }
       return (0, import_types6.Ok)(void 0);
     } catch (error) {
@@ -3014,8 +3095,8 @@ var PromptRenderer = class {
 // src/orchestrator.ts
 var import_node_events = require("events");
 var path21 = __toESM(require("path"));
-var import_node_crypto16 = require("crypto");
-var import_core14 = require("@harness-engineering/core");
+var import_node_crypto15 = require("crypto");
+var import_core15 = require("@harness-engineering/core");
 
 // src/core/stall-detector.ts
 function detectStalledIssues(running, nowMs, stallTimeoutMs) {
@@ -3591,7 +3672,7 @@ var CompletionHandler = class {
 };
 
 // src/orchestrator.ts
-var import_core15 = require("@harness-engineering/core");
+var import_core16 = require("@harness-engineering/core");
 
 // src/tracker/adapters/github-issues-issue-tracker.ts
 var import_types9 = require("@harness-engineering/types");
@@ -6511,6 +6592,96 @@ var OrchestratorBackendFactory = class {
   }
 };
 
+// src/agent/backend-resolver.ts
+function makeBackendResolver(backends) {
+  return (backendName) => {
+    const def = backends?.[backendName];
+    return def ? createBackend(def) : null;
+  };
+}
+
+// src/maintenance/agent-dispatcher.ts
+function syntheticIssue(branch, skill) {
+  return {
+    id: `maintenance:${branch}`,
+    identifier: branch,
+    title: `Maintenance: ${skill}`,
+    description: null,
+    priority: null,
+    state: "in_progress",
+    branchName: branch,
+    url: null,
+    labels: ["maintenance"],
+    blockedBy: [],
+    spec: null,
+    plans: [],
+    createdAt: null,
+    updatedAt: null,
+    externalId: null
+  };
+}
+function buildPrompt(skill, promptContext) {
+  const instruction = `Run the \`${skill}\` skill to detect and fix issues in this repository. Apply the fixes and commit each logical change. If there is nothing to fix, make no commits.`;
+  return promptContext ? `${promptContext}
+
+${instruction}` : instruction;
+}
+function headOf(git2, cwd) {
+  try {
+    return git2(["rev-parse", "HEAD"], cwd) || null;
+  } catch {
+    return null;
+  }
+}
+function createAgentDispatcher(deps) {
+  const maxTurns = deps.maxTurns ?? 10;
+  const dispatch = async (skill, branch, backendName, cwd, options) => {
+    const backend = deps.resolveBackend(backendName);
+    if (!backend) {
+      deps.logger.warn(`Maintenance agent dispatch skipped: unknown backend "${backendName}"`, {
+        skill,
+        branch
+      });
+      return { producedCommits: false, fixed: 0 };
+    }
+    const before = headOf(deps.git, cwd);
+    const runner = new AgentRunner(backend, { maxTurns });
+    const session = runner.runSession(
+      syntheticIssue(branch, skill),
+      cwd,
+      buildPrompt(skill, options?.promptContext)
+    );
+    let step = await session.next();
+    while (!step.done) step = await session.next();
+    const after = headOf(deps.git, cwd);
+    let fixed = 0;
+    if (after && after !== before) {
+      if (before) {
+        try {
+          fixed = parseInt(deps.git(["rev-list", "--count", `${before}..${after}`], cwd), 10) || 0;
+        } catch {
+          fixed = 1;
+        }
+      } else {
+        fixed = 1;
+      }
+    }
+    const producedCommits = fixed > 0;
+    deps.logger.info("Maintenance agent dispatch complete", {
+      skill,
+      branch,
+      backendName,
+      producedCommits,
+      fixed
+    });
+    return { producedCommits, fixed };
+  };
+  return { dispatch };
+}
+
+// src/orchestrator.ts
+var import_node_child_process13 = require("child_process");
+
 // src/agent/intelligence-factory.ts
 var import_intelligence3 = require("@harness-engineering/intelligence");
 var import_graph = require("@harness-engineering/graph");
@@ -7012,7 +7183,7 @@ function handleV1InteractionsResolveRoute(req, res, queue) {
 
 // src/server/routes/plans.ts
 var import_zod5 = require("zod");
-var fs10 = __toESM(require("fs/promises"));
+var fs9 = __toESM(require("fs/promises"));
 var path11 = __toESM(require("path"));
 var PlanWriteSchema = import_zod5.z.object({
   filename: import_zod5.z.string().min(1),
@@ -7041,9 +7212,9 @@ function handlePlansRoute(req, res, plansDir) {
           );
           return;
         }
-        await fs10.mkdir(plansDir, { recursive: true });
+        await fs9.mkdir(plansDir, { recursive: true });
         const filePath = path11.join(plansDir, basename3);
-        await fs10.writeFile(filePath, parsed.content, "utf-8");
+        await fs9.writeFile(filePath, parsed.content, "utf-8");
         res.writeHead(201, { "Content-Type": "application/json" });
         res.end(JSON.stringify({ ok: true, filename: basename3 }));
       } catch {
@@ -7418,7 +7589,6 @@ function handleAnalyzeRoute(req, res, pipeline) {
 }
 
 // src/server/routes/roadmap-actions.ts
-var fs11 = __toESM(require("fs/promises"));
 var path12 = __toESM(require("path"));
 var import_core7 = require("@harness-engineering/core");
 var import_zod8 = require("zod");
@@ -7500,13 +7670,14 @@ function handleRoadmapActionsRoute(req, res, roadmapPath) {
         sendJSON2(res, 400, { error: "Title must not contain newlines or markdown headings" });
         return;
       }
-      const content = await fs11.readFile(roadmapPath, "utf-8");
-      const roadmapResult = (0, import_core7.parseRoadmap)(content);
-      if (!roadmapResult.ok) {
+      const store = (0, import_core7.resolveRoadmapStoreForFile)({ roadmapPath });
+      const loaded = await store.load();
+      if (!loaded.ok) {
         sendJSON2(res, 500, { error: "Failed to parse roadmap file" });
         return;
       }
-      const roadmap = roadmapResult.value;
+      const roadmap = loaded.value;
+      const before = structuredClone(roadmap);
       let backlog = roadmap.milestones.find((m) => m.isBacklog);
       if (!backlog) {
         backlog = { name: "Backlog", isBacklog: true, features: [] };
@@ -7529,10 +7700,11 @@ function handleRoadmapActionsRoute(req, res, roadmapPath) {
         updatedAt: null
       });
       roadmap.frontmatter.lastManualEdit = (/* @__PURE__ */ new Date()).toISOString();
-      const tmpPath = roadmapPath + ".tmp";
-      const serialized = (0, import_core7.serializeRoadmap)(roadmap);
-      await fs11.writeFile(tmpPath, serialized, "utf-8");
-      await fs11.rename(tmpPath, roadmapPath);
+      const persisted = await (0, import_core7.applyRoadmapDiff)(store, before, roadmap);
+      if (!persisted.ok) {
+        sendJSON2(res, 500, { error: persisted.error.message });
+        return;
+      }
       sendJSON2(res, 201, { ok: true, featureName: parsed.title });
     } catch (err) {
       const msg = err instanceof Error ? err.message : "Failed to append to roadmap";
@@ -7798,7 +7970,6 @@ function handleV1JobsMaintenanceRoute(req, res, deps) {
 }
 
 // src/server/routes/v1/events-sse.ts
-var import_node_crypto8 = require("crypto");
 var SSE_TOPICS = [
   "state_change",
   "agent_event",
@@ -7814,8 +7985,55 @@ var SSE_TOPICS = [
   "webhook.subscription.deleted"
 ];
 var HEARTBEAT_MS = 15e3;
-function newEventId() {
-  return `evt_${(0, import_node_crypto8.randomBytes)(8).toString("hex")}`;
+var DEFAULT_REPLAY_BUFFER = 1024;
+var SseEventLog = class {
+  seq = 0;
+  buffer = [];
+  subscribers = /* @__PURE__ */ new Set();
+  constructor(bus, cap = DEFAULT_REPLAY_BUFFER) {
+    this.cap = cap;
+    for (const topic of SSE_TOPICS) {
+      bus.on(topic, (data) => this.record(topic, data));
+    }
+  }
+  cap;
+  record(topic, data) {
+    const event = { id: ++this.seq, topic, data };
+    this.buffer.push(event);
+    if (this.buffer.length > this.cap) this.buffer.shift();
+    for (const fn of this.subscribers) fn(event);
+  }
+  /** Highest assigned id (0 when nothing has been recorded yet). */
+  currentSeq() {
+    return this.seq;
+  }
+  /** Buffered events strictly newer than `lastId`, oldest-first. */
+  replayFrom(lastId) {
+    return this.buffer.filter((e) => e.id > lastId);
+  }
+  /** Register a live listener; returns an unsubscribe function. */
+  subscribe(fn) {
+    this.subscribers.add(fn);
+    return () => {
+      this.subscribers.delete(fn);
+    };
+  }
+};
+var logsByBus = /* @__PURE__ */ new WeakMap();
+function getSseEventLog(bus) {
+  let log = logsByBus.get(bus);
+  if (!log) {
+    log = new SseEventLog(bus);
+    logsByBus.set(bus, log);
+  }
+  return log;
+}
+function parseLastEventId(req) {
+  const raw = req.headers["last-event-id"];
+  const value = Array.isArray(raw) ? raw[0] : raw;
+  if (value === void 0) return null;
+  const n = Number(value);
+  return Number.isInteger(n) && n >= 0 ? n : null;
 }
 function handleV1EventsSseRoute(req, res, bus) {
   if (req.method !== "GET" || req.url !== "/api/v1/events") return false;
@@ -7827,22 +8045,28 @@ function handleV1EventsSseRoute(req, res, bus) {
   res.write(`: harness gateway SSE \u2014 connected at ${(/* @__PURE__ */ new Date()).toISOString()}
 
 `);
-  const listeners = [];
-  for (const topic of SSE_TOPICS) {
-    const fn = (data) => {
-      try {
-        const frame = `event: ${topic}
-data: ${JSON.stringify(data)}
-id: ${newEventId()}
+  const log = getSseEventLog(bus);
+  const send = (e) => {
+    try {
+      res.write(`event: ${e.topic}
+data: ${JSON.stringify(e.data)}
+id: ${e.id}
 
-`;
-        res.write(frame);
-      } catch {
-      }
-    };
-    bus.on(topic, fn);
-    listeners.push({ topic, fn });
+`);
+    } catch {
+    }
+  };
+  const lastId = parseLastEventId(req);
+  let replayedThrough = lastId ?? log.currentSeq();
+  if (lastId !== null) {
+    for (const e of log.replayFrom(lastId)) {
+      send(e);
+      replayedThrough = e.id;
+    }
   }
+  const unsubscribe = log.subscribe((e) => {
+    if (e.id > replayedThrough) send(e);
+  });
   const heartbeat = setInterval(() => {
     try {
       res.write(": heartbeat\n\n");
@@ -7852,7 +8076,7 @@ id: ${newEventId()}
   heartbeat.unref();
   const cleanup = () => {
     clearInterval(heartbeat);
-    for (const { topic, fn } of listeners) bus.removeListener(topic, fn);
+    unsubscribe();
   };
   res.on("close", cleanup);
   res.on("finish", cleanup);
@@ -8161,7 +8385,7 @@ async function runGate(projectPath, proposalId) {
 }
 
 // src/proposals/promote.ts
-var fs12 = __toESM(require("fs"));
+var fs10 = __toESM(require("fs"));
 var path13 = __toESM(require("path"));
 var import_yaml4 = require("yaml");
 var import_core9 = require("@harness-engineering/core");
@@ -8183,7 +8407,7 @@ function skillDir(projectPath, name) {
 }
 function readIfExists(p) {
   try {
-    return fs12.readFileSync(p, "utf-8");
+    return fs10.readFileSync(p, "utf-8");
   } catch {
     return null;
   }
@@ -8229,15 +8453,15 @@ function assertGateReady(proposal) {
 }
 async function promoteNewSkill(projectPath, proposal) {
   const target = skillDir(projectPath, proposal.content.name);
-  if (fs12.existsSync(target)) {
+  if (fs10.existsSync(target)) {
     throw new PromotionError(
       `a catalog skill already exists at ${target}; use a refinement proposal to update it`
     );
   }
-  fs12.mkdirSync(target, { recursive: true });
+  fs10.mkdirSync(target, { recursive: true });
   const yamlOut = injectProvenanceIntoYaml(proposal.content.skillYaml ?? "", proposal.id);
-  fs12.writeFileSync(path13.join(target, "skill.yaml"), yamlOut);
-  fs12.writeFileSync(path13.join(target, "SKILL.md"), proposal.content.skillMd ?? "");
+  fs10.writeFileSync(path13.join(target, "skill.yaml"), yamlOut);
+  fs10.writeFileSync(path13.join(target, "SKILL.md"), proposal.content.skillMd ?? "");
   return { skillPath: target };
 }
 async function promoteRefinement(projectPath, proposal) {
@@ -8245,7 +8469,7 @@ async function promoteRefinement(projectPath, proposal) {
     throw new PromotionError("refinement proposal is missing targetSkill");
   }
   const target = skillDir(projectPath, proposal.targetSkill);
-  if (!fs12.existsSync(target)) {
+  if (!fs10.existsSync(target)) {
     throw new PromotionError(
       `target skill ${proposal.targetSkill} does not exist at ${target}; cannot refine`
     );
@@ -8258,7 +8482,7 @@ async function promoteRefinement(projectPath, proposal) {
       "no metadata changes detected; check that the reviewer applied the proposed diff before approving"
     );
   }
-  fs12.writeFileSync(yamlPath, after);
+  fs10.writeFileSync(yamlPath, after);
   return { skillPath: target };
 }
 async function promote(projectPath, proposalId, decidedBy) {
@@ -8696,7 +8920,7 @@ function handleV1RoutingRoute(req, res, deps) {
 }
 
 // src/server/routes/sessions.ts
-var fs13 = __toESM(require("fs/promises"));
+var fs11 = __toESM(require("fs/promises"));
 var path14 = __toESM(require("path"));
 var import_zod15 = require("zod");
 var SessionCreateSchema = import_zod15.z.object({
@@ -8717,12 +8941,12 @@ function extractSessionId(url) {
 }
 async function handleList2(res, sessionsDir) {
   try {
-    const entries = await fs13.readdir(sessionsDir, { withFileTypes: true });
+    const entries = await fs11.readdir(sessionsDir, { withFileTypes: true });
     const sessions = [];
     for (const entry of entries) {
       if (!entry.isDirectory()) continue;
       try {
-        const content = await fs13.readFile(
+        const content = await fs11.readFile(
           path14.join(sessionsDir, entry.name, "session.json"),
           "utf-8"
         );
@@ -8748,7 +8972,7 @@ async function handleGet2(res, id, sessionsDir) {
     return;
   }
   try {
-    const content = await fs13.readFile(path14.join(sessionsDir, id, "session.json"), "utf-8");
+    const content = await fs11.readFile(path14.join(sessionsDir, id, "session.json"), "utf-8");
     jsonResponse(res, 200, JSON.parse(content));
   } catch (err) {
     if (err.code === "ENOENT") {
@@ -8772,8 +8996,8 @@ async function handleCreate(req, res, sessionsDir) {
       return;
     }
     const sessionDir = path14.join(sessionsDir, session.sessionId);
-    await fs13.mkdir(sessionDir, { recursive: true });
-    await fs13.writeFile(path14.join(sessionDir, "session.json"), JSON.stringify(session, null, 2));
+    await fs11.mkdir(sessionDir, { recursive: true });
+    await fs11.writeFile(path14.join(sessionDir, "session.json"), JSON.stringify(session, null, 2));
     jsonResponse(res, 200, { ok: true });
   } catch {
     jsonResponse(res, 500, { error: "Failed to save session" });
@@ -8789,8 +9013,8 @@ async function handleUpdate(req, res, url, sessionsDir) {
     const body = await readBody(req);
     const updates = import_zod15.z.record(import_zod15.z.unknown()).parse(JSON.parse(body));
     const sessionFilePath = path14.join(sessionsDir, id, "session.json");
-    const current = JSON.parse(await fs13.readFile(sessionFilePath, "utf-8"));
-    await fs13.writeFile(sessionFilePath, JSON.stringify({ ...current, ...updates }, null, 2));
+    const current = JSON.parse(await fs11.readFile(sessionFilePath, "utf-8"));
+    await fs11.writeFile(sessionFilePath, JSON.stringify({ ...current, ...updates }, null, 2));
     jsonResponse(res, 200, { ok: true });
   } catch {
     jsonResponse(res, 500, { error: "Failed to update session" });
@@ -8803,7 +9027,7 @@ async function handleDelete(res, url, sessionsDir) {
       jsonResponse(res, 400, { error: "Missing or invalid sessionId" });
       return;
     }
-    await fs13.rm(path14.join(sessionsDir, id), { recursive: true, force: true });
+    await fs11.rm(path14.join(sessionsDir, id), { recursive: true, force: true });
     jsonResponse(res, 200, { ok: true });
   } catch {
     jsonResponse(res, 500, { error: "Failed to delete session" });
@@ -9047,7 +9271,7 @@ function handleLocalModelsRoute(req, res, getStatuses) {
 }
 
 // src/server/static.ts
-var fs14 = __toESM(require("fs"));
+var fs12 = __toESM(require("fs"));
 var path15 = __toESM(require("path"));
 var MIME_TYPES = {
   ".html": "text/html; charset=utf-8",
@@ -9077,11 +9301,11 @@ function handleStaticFile(req, res, dashboardDir) {
   if (!resolved.startsWith(path15.resolve(dashboardDir))) {
     return serveFile(path15.join(dashboardDir, "index.html"), res);
   }
-  if (fs14.existsSync(resolved) && fs14.statSync(resolved).isFile()) {
+  if (fs12.existsSync(resolved) && fs12.statSync(resolved).isFile()) {
     return serveFile(resolved, res);
   }
   const indexPath = path15.join(dashboardDir, "index.html");
-  if (fs14.existsSync(indexPath)) {
+  if (fs12.existsSync(indexPath)) {
     return serveFile(indexPath, res);
   }
   return false;
@@ -9090,7 +9314,7 @@ function serveFile(filePath, res) {
   const ext = path15.extname(filePath).toLowerCase();
   const contentType = MIME_TYPES[ext] ?? "application/octet-stream";
   try {
-    const content = fs14.readFileSync(filePath);
+    const content = fs12.readFileSync(filePath);
     res.writeHead(200, { "Content-Type": contentType });
     res.end(content);
     return true;
@@ -9100,7 +9324,7 @@ function serveFile(filePath, res) {
 }
 
 // src/server/plan-watcher.ts
-var fs15 = __toESM(require("fs"));
+var fs13 = __toESM(require("fs"));
 var path16 = __toESM(require("path"));
 var PlanWatcher = class {
   plansDir;
@@ -9115,11 +9339,11 @@ var PlanWatcher = class {
    * Creates the directory if it does not exist.
    */
   start() {
-    fs15.mkdirSync(this.plansDir, { recursive: true });
-    this.watcher = fs15.watch(this.plansDir, (eventType, filename) => {
+    fs13.mkdirSync(this.plansDir, { recursive: true });
+    this.watcher = fs13.watch(this.plansDir, (eventType, filename) => {
       if (eventType === "rename" && filename && filename.endsWith(".md")) {
         const filePath = path16.join(this.plansDir, filename);
-        if (fs15.existsSync(filePath)) {
+        if (fs13.existsSync(filePath)) {
           void this.handleNewPlan(filename);
         }
       }
@@ -9150,7 +9374,7 @@ var PlanWatcher = class {
 };
 
 // src/auth/tokens.ts
-var import_node_crypto9 = require("crypto");
+var import_node_crypto8 = require("crypto");
 var import_promises = require("fs/promises");
 var import_node_path = require("path");
 var import_bcryptjs = __toESM(require("bcryptjs"));
@@ -9158,10 +9382,10 @@ var import_types26 = require("@harness-engineering/types");
 var BCRYPT_ROUNDS = 12;
 var LEGACY_ENV_ID = "tok_legacy_env";
 function genId() {
-  return `tok_${(0, import_node_crypto9.randomBytes)(8).toString("hex")}`;
+  return `tok_${(0, import_node_crypto8.randomBytes)(8).toString("hex")}`;
 }
 function genSecret() {
-  return (0, import_node_crypto9.randomBytes)(24).toString("base64url");
+  return (0, import_node_crypto8.randomBytes)(24).toString("base64url");
 }
 function parseToken(raw) {
   const dot = raw.indexOf(".");
@@ -9192,7 +9416,7 @@ var TokenStore = class {
   }
   async persist(records) {
     await (0, import_promises.mkdir)((0, import_node_path.dirname)(this.path), { recursive: true });
-    const tmp = `${this.path}.tmp-${process.pid}-${Date.now()}-${(0, import_node_crypto9.randomBytes)(4).toString("hex")}`;
+    const tmp = `${this.path}.tmp-${process.pid}-${Date.now()}-${(0, import_node_crypto8.randomBytes)(4).toString("hex")}`;
     await (0, import_promises.writeFile)(tmp, JSON.stringify(records, null, 2), "utf8");
     await (0, import_promises.rename)(tmp, this.path);
     this.cache = records;
@@ -9261,7 +9485,7 @@ var TokenStore = class {
     const a = Buffer.from(presented);
     const b = Buffer.from(envValue);
     if (a.length !== b.length) return null;
-    if (!(0, import_node_crypto9.timingSafeEqual)(a, b)) return null;
+    if (!(0, import_node_crypto8.timingSafeEqual)(a, b)) return null;
     return {
       id: LEGACY_ENV_ID,
       name: "legacy-env",
@@ -9878,15 +10102,15 @@ var OrchestratorServer = class {
 };
 
 // src/gateway/webhooks/store.ts
-var import_node_crypto11 = require("crypto");
+var import_node_crypto10 = require("crypto");
 var import_promises3 = require("fs/promises");
 var import_node_path3 = require("path");
 var import_types28 = require("@harness-engineering/types");
 
 // src/gateway/webhooks/signer.ts
-var import_node_crypto10 = require("crypto");
+var import_node_crypto9 = require("crypto");
 function sign(secret, body) {
-  const hex = (0, import_node_crypto10.createHmac)("sha256", secret).update(body).digest("hex");
+  const hex = (0, import_node_crypto9.createHmac)("sha256", secret).update(body).digest("hex");
   return `sha256=${hex}`;
 }
 function eventMatches(pattern, type) {
@@ -9905,10 +10129,10 @@ function eventMatches(pattern, type) {
 
 // src/gateway/webhooks/store.ts
 function genId2() {
-  return `whk_${(0, import_node_crypto11.randomBytes)(8).toString("hex")}`;
+  return `whk_${(0, import_node_crypto10.randomBytes)(8).toString("hex")}`;
 }
 function genSecret2() {
-  return (0, import_node_crypto11.randomBytes)(32).toString("base64url");
+  return (0, import_node_crypto10.randomBytes)(32).toString("base64url");
 }
 var WebhookStore = class {
   constructor(path24) {
@@ -9933,7 +10157,7 @@ var WebhookStore = class {
     return this.cache;
   }
   async persist(records) {
-    const tmp = `${this.path}.tmp-${process.pid}-${Date.now()}-${(0, import_node_crypto11.randomBytes)(4).toString("hex")}`;
+    const tmp = `${this.path}.tmp-${process.pid}-${Date.now()}-${(0, import_node_crypto10.randomBytes)(4).toString("hex")}`;
     try {
       await (0, import_promises3.mkdir)((0, import_node_path3.dirname)(this.path), { recursive: true });
       await (0, import_promises3.writeFile)(tmp, JSON.stringify(records, null, 2), { encoding: "utf8", mode: 384 });
@@ -9977,7 +10201,7 @@ var WebhookStore = class {
 };
 
 // src/gateway/webhooks/delivery.ts
-var import_node_crypto12 = require("crypto");
+var import_node_crypto11 = require("crypto");
 
 // src/gateway/webhooks/queue.ts
 var import_better_sqlite3 = __toESM(require("better-sqlite3"));
@@ -10187,7 +10411,7 @@ var WebhookDelivery = class {
   enqueue(sub, event) {
     const payload = JSON.stringify(event);
     this.queue.insert({
-      id: `dlv_${(0, import_node_crypto12.randomBytes)(8).toString("hex")}`,
+      id: `dlv_${(0, import_node_crypto11.randomBytes)(8).toString("hex")}`,
       subscriptionId: sub.id,
       eventType: event.type,
       payload
@@ -10295,7 +10519,7 @@ var WebhookDelivery = class {
 };
 
 // src/gateway/webhooks/events.ts
-var import_node_crypto13 = require("crypto");
+var import_node_crypto12 = require("crypto");
 var WEBHOOK_TOPICS = [
   "interaction.created",
   "interaction.resolved",
@@ -10310,8 +10534,8 @@ var WEBHOOK_TOPICS = [
   "proposal.approved",
   "proposal.rejected"
 ];
-function newEventId2() {
-  return `evt_${(0, import_node_crypto13.randomBytes)(8).toString("hex")}`;
+function newEventId() {
+  return `evt_${(0, import_node_crypto12.randomBytes)(8).toString("hex")}`;
 }
 function wireWebhookFanout({ bus, store, delivery }) {
   const handlers = [];
@@ -10322,7 +10546,7 @@ function wireWebhookFanout({ bus, store, delivery }) {
         const subs = await store.listForEvent(eventType);
         if (subs.length === 0) return;
         const event = {
-          id: newEventId2(),
+          id: newEventId(),
           type: eventType,
           timestamp: (/* @__PURE__ */ new Date()).toISOString(),
           data
@@ -10341,7 +10565,7 @@ function wireWebhookFanout({ bus, store, delivery }) {
 }
 
 // src/gateway/telemetry/fanout.ts
-var import_node_crypto14 = require("crypto");
+var import_node_crypto13 = require("crypto");
 var import_core12 = require("@harness-engineering/core");
 var TOPICS = {
   MAINTENANCE_STARTED: "maintenance:started",
@@ -10364,14 +10588,14 @@ var SPAN_NAME = {
   [TOPICS.DISPATCH_DECISION]: "dispatch_decision",
   [TOPICS.SKILL_INVOCATION]: "skill_invocation"
 };
-function newEventId3() {
-  return `evt_${(0, import_node_crypto14.randomBytes)(8).toString("hex")}`;
+function newEventId2() {
+  return `evt_${(0, import_node_crypto13.randomBytes)(8).toString("hex")}`;
 }
 function newTraceId() {
-  return (0, import_node_crypto14.randomBytes)(16).toString("hex");
+  return (0, import_node_crypto13.randomBytes)(16).toString("hex");
 }
 function newSpanId() {
-  return (0, import_node_crypto14.randomBytes)(8).toString("hex");
+  return (0, import_node_crypto13.randomBytes)(8).toString("hex");
 }
 function nowNs() {
   return BigInt(Date.now()) * 1000000n;
@@ -10485,7 +10709,7 @@ function wireTelemetryFanout(params) {
     };
     exporter.push(span);
     const gatewayEvent = {
-      id: newEventId3(),
+      id: newEventId2(),
       type: TELEMETRY_TYPE[topic],
       timestamp: (/* @__PURE__ */ new Date()).toISOString(),
       data: payload,
@@ -10679,7 +10903,7 @@ function buildSlackSink(config, options) {
 }
 
 // src/notifications/events.ts
-var import_node_crypto15 = require("crypto");
+var import_node_crypto14 = require("crypto");
 
 // src/notifications/envelope.ts
 function asObj(data) {
@@ -10810,8 +11034,8 @@ var NOTIFICATION_TOPICS = [
   "proposal.approved",
   "proposal.rejected"
 ];
-function newEventId4() {
-  return `evt_${(0, import_node_crypto15.randomBytes)(8).toString("hex")}`;
+function newEventId3() {
+  return `evt_${(0, import_node_crypto14.randomBytes)(8).toString("hex")}`;
 }
 function dispatchToEntry(bus, entry, event) {
   const eventType = event.type;
@@ -10846,7 +11070,7 @@ function wireNotificationSinks({ bus, registry }) {
       const entries = registry.list();
       if (entries.length === 0) return;
       const event = {
-        id: newEventId4(),
+        id: newEventId3(),
         type: eventType,
         timestamp: (/* @__PURE__ */ new Date()).toISOString(),
         data
@@ -10864,7 +11088,7 @@ function wireNotificationSinks({ bus, registry }) {
 }
 
 // src/orchestrator.ts
-var import_core16 = require("@harness-engineering/core");
+var import_core17 = require("@harness-engineering/core");
 
 // src/logging/logger.ts
 var StructuredLogger = class {
@@ -10949,6 +11173,37 @@ async function scanWorkspaceConfig(workspacePath) {
   return { exitCode: (0, import_core13.computeScanExitCode)(results), results };
 }
 
+// src/core/lane-persistence.ts
+var import_core14 = require("@harness-engineering/core");
+var import_types29 = require("@harness-engineering/types");
+var SIGNAL_TO_LANE = {
+  claim: "claimed",
+  dispatch: "in_progress",
+  success: "in_review",
+  failure: "blocked",
+  abandon: "canceled"
+};
+function mapOrchestratorLane(signal) {
+  return SIGNAL_TO_LANE[signal];
+}
+async function persistLane(projectPath, issueId, signal) {
+  try {
+    const reg = await import_core14.eventSourcing.registerTask(projectPath, issueId, []);
+    if (!reg.ok) return reg;
+    return await import_core14.eventSourcing.transitionLane(projectPath, issueId, mapOrchestratorLane(signal));
+  } catch (err) {
+    return (0, import_types29.Err)(err instanceof Error ? err : new Error(String(err)));
+  }
+}
+async function readPersistedLanes(projectPath) {
+  try {
+    const snap = await import_core14.eventSourcing.readSnapshot(projectPath);
+    return snap.ok ? snap.value.lanes : { tasks: {} };
+  } catch {
+    return { tasks: {} };
+  }
+}
+
 // src/maintenance/task-registry.ts
 var BUILT_IN_TASKS = [
   // --- Mechanical-AI ---
@@ -11012,7 +11267,13 @@ var BUILT_IN_TASKS = [
     description: "Detect and fix cross-check violations",
     schedule: "0 6 * * 1",
     branch: "harness-maint/cross-check-fixes",
-    checkCommand: ["validate-cross-check"],
+    // `harness cross-check` is a dedicated read-only CLI subcommand that surfaces
+    // JUST cross-artifact consistency (plan→implementation coverage + staleness),
+    // mirroring the `validate_cross_check` MCP tool's core (`runCrossCheck`)
+    // WITHOUT running the full `harness validate` suite. It prints a parseable
+    // `Cross-check: N issues` line and exits 0 (clean) / 1 (N issues), so the
+    // maintenance runner reports real results instead of an honest `failure`.
+    checkCommand: ["cross-check"],
     fixSkill: "harness-cross-check-fix"
   },
   // --- Pure-AI ---
@@ -11071,7 +11332,10 @@ var BUILT_IN_TASKS = [
     description: "Assess overall project health",
     schedule: "0 6 * * *",
     branch: null,
-    checkCommand: ["assess_project"]
+    // `assess_project` is an MCP tool name, not a CLI subcommand. The CLI
+    // composite project-health report is `harness insights` (health, entropy,
+    // decay, attention, impact) — a read-only report that records metrics.
+    checkCommand: ["insights"]
   },
   {
     id: "stale-constraints",
@@ -11079,7 +11343,14 @@ var BUILT_IN_TASKS = [
     description: "Detect stale architectural constraints",
     schedule: "0 2 1 * *",
     branch: null,
-    checkCommand: ["detect_stale_constraints"]
+    // `harness stale-constraints` is a dedicated read-only CLI subcommand that
+    // surfaces the `detect_stale_constraints` MCP tool's core in-process. It is
+    // precondition-gated on the knowledge graph: with no graph it emits the
+    // "No knowledge graph found. Run `harness scan` first." signature and exits
+    // non-zero, which the runner classifies as `skipped` (not failure). With a
+    // graph it prints a parseable `Stale constraints: N findings` line and exits
+    // 0 (clean) / 1 (N stale), recorded as report-only metrics.
+    checkCommand: ["stale-constraints"]
   },
   {
     id: "graph-refresh",
@@ -11112,7 +11383,8 @@ var BUILT_IN_TASKS = [
     description: "Clean up stale orchestrator sessions",
     schedule: "0 0 * * *",
     branch: null,
-    checkCommand: ["cleanup-sessions"]
+    checkCommand: ["cleanup-sessions"],
+    excludeFromHumanSweep: true
   },
   {
     id: "perf-baselines",
@@ -11120,7 +11392,8 @@ var BUILT_IN_TASKS = [
     description: "Update performance baselines",
     schedule: "0 7 * * *",
     branch: null,
-    checkCommand: ["perf", "baselines", "update"]
+    checkCommand: ["perf", "baselines", "update"],
+    excludeFromHumanSweep: true
   },
   {
     id: "main-sync",
@@ -11128,7 +11401,8 @@ var BUILT_IN_TASKS = [
     description: "Fast-forward local default branch from origin",
     schedule: "*/15 * * * *",
     branch: null,
-    checkCommand: ["harness", "sync-main", "--json"]
+    checkCommand: ["harness", "sync-main", "--json"],
+    excludeFromHumanSweep: true
   },
   // Hermes Phase 4 — one-shot backfill that stamps `provenance: user-authored`
   // on every existing catalog skill. Schedule is Feb 31 (a date that never
@@ -11141,7 +11415,8 @@ var BUILT_IN_TASKS = [
     description: "Backfill provenance: user-authored on every existing skill (one-shot, idempotent)",
     schedule: "0 0 31 2 *",
     branch: null,
-    checkCommand: ["backfill-skill-provenance"]
+    checkCommand: ["backfill-skill-provenance"],
+    excludeFromHumanSweep: true
   }
 ];
 
@@ -11208,6 +11483,17 @@ function cronMatchesNow(expression, now) {
   const daysOfWeek = parseField(dowField, 0, 6);
   return minutes.has(minute) && hours.has(hour) && daysOfMonth.has(dayOfMonth) && months.has(month) && daysOfWeek.has(dayOfWeek);
 }
+function cronMatchesDate(expression, date) {
+  const fields = expression.trim().split(/\s+/);
+  if (fields.length !== 5) {
+    throw new Error(`Invalid cron expression: expected 5 fields, got ${fields.length}`);
+  }
+  const [, , domField, monthField, dowField] = fields;
+  const daysOfMonth = parseField(domField, 1, 31);
+  const months = parseField(monthField, 1, 12);
+  const daysOfWeek = parseField(dowField, 0, 6);
+  return daysOfMonth.has(date.getDate()) && months.has(date.getMonth() + 1) && daysOfWeek.has(date.getDay());
+}
 
 // src/maintenance/scheduler.ts
 var MaintenanceScheduler = class {
@@ -11449,15 +11735,15 @@ var MaintenanceScheduler = class {
 };
 
 // src/maintenance/leader-elector.ts
-var import_types29 = require("@harness-engineering/types");
+var import_types30 = require("@harness-engineering/types");
 var SingleProcessLeaderElector = class {
   async electLeader() {
-    return (0, import_types29.Ok)("claimed");
+    return (0, import_types30.Ok)("claimed");
   }
 };
 
 // src/maintenance/reporter.ts
-var fs16 = __toESM(require("fs"));
+var fs14 = __toESM(require("fs"));
 var path18 = __toESM(require("path"));
 var import_zod17 = require("zod");
 var RunResultSchema = import_zod17.z.object({
@@ -11493,9 +11779,9 @@ var MaintenanceReporter = class {
    */
   async load() {
     try {
-      await fs16.promises.mkdir(this.persistDir, { recursive: true });
+      await fs14.promises.mkdir(this.persistDir, { recursive: true });
       const filePath = path18.join(this.persistDir, "history.json");
-      const data = await fs16.promises.readFile(filePath, "utf-8");
+      const data = await fs14.promises.readFile(filePath, "utf-8");
       const parsed = import_zod17.z.array(RunResultSchema).safeParse(JSON.parse(data));
       if (parsed.success) {
         this.history = parsed.data.slice(0, MAX_HISTORY);
@@ -11529,9 +11815,9 @@ var MaintenanceReporter = class {
    */
   async persist() {
     try {
-      await fs16.promises.mkdir(this.persistDir, { recursive: true });
+      await fs14.promises.mkdir(this.persistDir, { recursive: true });
       const filePath = path18.join(this.persistDir, "history.json");
-      await fs16.promises.writeFile(filePath, JSON.stringify(this.history, null, 2), "utf-8");
+      await fs14.promises.writeFile(filePath, JSON.stringify(this.history, null, 2), "utf-8");
     } catch (err) {
       this.logger.error("MaintenanceReporter: failed to persist history", { error: String(err) });
     }
@@ -11571,20 +11857,20 @@ var TaskRunner = class {
    * @param origin - Hermes Phase 2 trigger-source tag; defaults to `'cron'`
    *                 when called from the scheduler path.
    */
-  async run(task, origin = "cron") {
+  async run(task, origin = "cron", mode = "fix") {
     const startedAt = (/* @__PURE__ */ new Date()).toISOString();
     let result;
     let captured;
     try {
       switch (task.type) {
         case "mechanical-ai": {
-          const out = await this.runMechanicalAI(task, startedAt);
+          const out = await this.runMechanicalAI(task, startedAt, mode);
           result = out.result;
           captured = out.captured;
           break;
         }
         case "pure-ai":
-          result = await this.runPureAI(task, startedAt);
+          result = await this.runPureAI(task, startedAt, mode);
           break;
         case "report-only": {
           const out = await this.runReportOnly(task, startedAt);
@@ -11593,7 +11879,7 @@ var TaskRunner = class {
           break;
         }
         case "housekeeping": {
-          const out = await this.runHousekeeping(task, startedAt);
+          const out = await this.runHousekeeping(task, startedAt, mode);
           result = out.result;
           captured = out.captured;
           break;
@@ -11657,7 +11943,8 @@ var TaskRunner = class {
         findings: r2.findings,
         stdout: r2.output,
         stderr: r2.stderr,
-        structured: r2.structured ? r2.structured : null
+        structured: r2.structured ? r2.structured : null,
+        executionFailed: false
       };
     }
     if (!task.checkCommand || task.checkCommand.length === 0) {
@@ -11669,7 +11956,8 @@ var TaskRunner = class {
       findings: r.findings,
       stdout: r.output,
       stderr: "",
-      structured: null
+      structured: null,
+      executionFailed: r.executionFailed ?? false
     };
   }
   /**
@@ -11694,7 +11982,7 @@ var TaskRunner = class {
    * only if fixable findings exist; persist captured stdout/stderr/context
    * via the output store on the way out.
    */
-  async runMechanicalAI(task, startedAt) {
+  async runMechanicalAI(task, startedAt, mode = "fix") {
     if (!task.fixSkill) {
       return wrap(this.failureResult(task.id, startedAt, "mechanical-ai task missing fixSkill"));
     }
@@ -11716,6 +12004,27 @@ var TaskRunner = class {
     } catch (err) {
       return wrap(this.failureResult(task.id, startedAt, String(err)));
     }
+    if (check.executionFailed) {
+      const cls = classifyCheckExecutionFailure(`${check.stdout}
+${check.stderr}`);
+      if (cls.kind === "unrunnable") {
+        return wrap(
+          this.failureResult(task.id, startedAt, checkExecutionError(check)),
+          captureFromCheck(check)
+        );
+      }
+      if (cls.kind === "precondition") {
+        return wrap(
+          this.skippedResult(task.id, startedAt, cls.reason ?? "precondition not met"),
+          captureFromCheck(check)
+        );
+      }
+      check = {
+        ...check,
+        executionFailed: false,
+        findings: check.findings > 0 ? check.findings : recoverFindingsCount(check.stdout)
+      };
+    }
     const promptContext = await this.composePromptContext(task);
     const baseCaptured = {
       stdout: check.stdout,
@@ -11724,13 +12033,14 @@ var TaskRunner = class {
       ...promptContext ? { context: promptContext } : {}
     };
     const wakeAgentExplicitlyFalse = check.structured !== null && typeof check.structured === "object" && check.structured.wakeAgent === false;
-    if (check.findings === 0 || wakeAgentExplicitlyFalse) {
+    if (check.findings === 0 || wakeAgentExplicitlyFalse || mode === "report") {
+      const reportedWithFindings = mode === "report" && check.findings > 0;
       return {
         result: {
           taskId: task.id,
           startedAt,
           completedAt: (/* @__PURE__ */ new Date()).toISOString(),
-          status: "no-issues",
+          status: reportedWithFindings ? "success" : "no-issues",
           findings: check.findings,
           fixed: 0,
           prUrl: null,
@@ -11800,7 +12110,19 @@ var TaskRunner = class {
   /**
    * Pure-AI: always dispatch agent with configured skill.
    */
-  async runPureAI(task, startedAt) {
+  async runPureAI(task, startedAt, mode = "fix") {
+    if (mode === "report") {
+      return {
+        taskId: task.id,
+        startedAt,
+        completedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        status: "no-issues",
+        findings: 0,
+        fixed: 0,
+        prUrl: null,
+        prUpdated: false
+      };
+    }
     if (!task.fixSkill) {
       return this.failureResult(task.id, startedAt, "pure-ai task missing fixSkill");
     }
@@ -11874,6 +12196,27 @@ var TaskRunner = class {
       return wrap(this.failureResult(task.id, startedAt, String(err)));
     }
     const parsed = parseStatusLine(check.stdout);
+    if (parsed === null && check.executionFailed) {
+      const cls = classifyCheckExecutionFailure(`${check.stdout}
+${check.stderr}`);
+      if (cls.kind === "unrunnable") {
+        return wrap(
+          this.failureResult(task.id, startedAt, checkExecutionError(check)),
+          captureFromCheck(check)
+        );
+      }
+      if (cls.kind === "precondition") {
+        return wrap(
+          this.skippedResult(task.id, startedAt, cls.reason ?? "precondition not met"),
+          captureFromCheck(check)
+        );
+      }
+      check = {
+        ...check,
+        executionFailed: false,
+        findings: check.findings > 0 ? check.findings : recoverFindingsCount(check.stdout)
+      };
+    }
     const status = parsed?.status ?? "success";
     const findings = parsed === null ? check.findings : typeof parsed.candidatesFound === "number" ? parsed.candidatesFound : 0;
     const result = {
@@ -11907,7 +12250,20 @@ var TaskRunner = class {
    * Hermes Phase 2: a `checkScript` may replace `checkCommand` for housekeeping
    * tasks; the runner falls through to the same JSON-status parsing path.
    */
-  async runHousekeeping(task, startedAt) {
+  async runHousekeeping(task, startedAt, mode = "fix") {
+    if (mode === "report") {
+      return wrap({
+        taskId: task.id,
+        startedAt,
+        completedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        status: "skipped",
+        findings: 0,
+        fixed: 0,
+        prUrl: null,
+        prUpdated: false,
+        error: "skipped in report mode: housekeeping may mutate and report runs are read-only"
+      });
+    }
     if (!task.checkCommand && !task.checkScript) {
       return wrap(
         this.failureResult(
@@ -11974,10 +12330,86 @@ var TaskRunner = class {
       error
     };
   }
+  /**
+   * A precondition-gated check (e.g. `predict` with <3 snapshots, or a
+   * graph-backed check before `harness scan`). The command is correctly
+   * configured; the repo just lacks the state it needs. Reported as `skipped`
+   * — distinct from a hard `failure` — carrying the refusal line as the reason
+   * (surfaced in the run-report summary column). ADR 0050.
+   */
+  skippedResult(taskId, startedAt, reason) {
+    return {
+      taskId,
+      startedAt,
+      completedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      status: "skipped",
+      findings: 0,
+      fixed: 0,
+      prUrl: null,
+      prUpdated: false,
+      error: reason
+    };
+  }
 };
 function wrap(result, captured) {
   return captured ? { result, captured } : { result };
 }
+function checkExecutionError(check) {
+  const detail = (check.stderr || check.stdout || "").trim();
+  return detail ? `check command failed to execute: ${detail}` : "check command failed to execute";
+}
+function captureFromCheck(check) {
+  return { stdout: check.stdout, stderr: check.stderr, structured: check.structured };
+}
+var PRECONDITION_PATTERNS = [
+  /requires at least \d+ snapshots?/i,
+  /Run ["'`]?harness snapshot/i,
+  /no knowledge graph found/i,
+  /Run ["'`]?harness scan/i,
+  /no graph (?:available|found)/i
+];
+var UNRUNNABLE_PATTERNS = [
+  /unknown command/i,
+  /unknown option/i,
+  /\bENOENT\b/,
+  /command not found/i,
+  /cannot find module/i,
+  // A timed-out check did not complete — it is a hard failure, never a
+  // "ran-no-count" success. The runners synthesize this message on SIGTERM.
+  /timed out/i,
+  /\bETIMEDOUT\b/
+];
+var TIMEOUT_SIGNATURE = /check timed out after \d+\s*ms/i;
+function explicitFindingsCount(output) {
+  const after = output.match(/(?:findings?|issues?|violations?|errors?)\s*[:=]\s*(\d+)/i);
+  if (after) return parseInt(after[1], 10);
+  const before = output.match(/(\d+)\s+(?:findings?|issues?|violations?|errors?)\b/i);
+  if (before) return parseInt(before[1], 10);
+  return null;
+}
+function recoverFindingsCount(output) {
+  return explicitFindingsCount(output) ?? 1;
+}
+function firstMeaningfulLine(output) {
+  const line = output.split("\n").map((l) => l.trim()).find(Boolean);
+  if (!line) return "precondition not met";
+  return line.replace(/^[x✗✓!-]\s*/u, "").trim();
+}
+var CLASSIFY_HEAD_LINES = 3;
+function classifyCheckExecutionFailure(output) {
+  const text = (output ?? "").trim();
+  if (text.length === 0) return { kind: "unrunnable" };
+  if (TIMEOUT_SIGNATURE.test(text)) return { kind: "unrunnable" };
+  if (explicitFindingsCount(text) !== null) return { kind: "ran-no-count" };
+  const head = text.split("\n").filter((l) => l.trim()).slice(0, CLASSIFY_HEAD_LINES).join("\n");
+  for (const re of PRECONDITION_PATTERNS) {
+    if (re.test(head)) return { kind: "precondition", reason: firstMeaningfulLine(text) };
+  }
+  for (const re of UNRUNNABLE_PATTERNS) {
+    if (re.test(head)) return { kind: "unrunnable" };
+  }
+  return { kind: "ran-no-count" };
+}
 function parseStatusLine(output) {
   const lines = output.split("\n").map((l) => l.trim()).filter(Boolean);
   for (let i = lines.length - 1; i >= 0; i--) {
@@ -12126,8 +12558,49 @@ function heuristicResult(stdout, stderr, exitedAbnormally) {
   };
 }
 
+// src/maintenance/check-runner.ts
+var import_node_child_process12 = require("child_process");
+var import_node_util4 = require("util");
+var MAINTENANCE_CHECK_MAX_BUFFER = 64 * 1024 * 1024;
+var MAINTENANCE_CHECK_TIMEOUT_MS = 3e5;
+var FINDINGS_RE = /(\d+)\s+(?:finding|issue|violation|error)/i;
+var nodeExecFileAsync = (0, import_node_util4.promisify)(import_node_child_process12.execFile);
+function isCheckTimeoutError(e) {
+  return e.killed === true || e.signal === "SIGTERM" || e.code === "ETIMEDOUT";
+}
+async function runHarnessCheck(spawn7, cwd, opts = {}) {
+  const execFileAsync2 = opts.execFileAsync ?? nodeExecFileAsync;
+  const timeoutMs = opts.timeoutMs ?? MAINTENANCE_CHECK_TIMEOUT_MS;
+  const maxBuffer = opts.maxBuffer ?? MAINTENANCE_CHECK_MAX_BUFFER;
+  try {
+    const { stdout } = await execFileAsync2(spawn7.file, spawn7.args, {
+      cwd,
+      timeout: timeoutMs,
+      maxBuffer
+    });
+    const text = String(stdout);
+    const m = text.match(FINDINGS_RE);
+    const findings = m ? parseInt(m[1], 10) : 0;
+    return { passed: findings === 0, findings, output: text, executionFailed: false };
+  } catch (err) {
+    const e = err;
+    let output = [e.stdout, e.stderr].map((v) => v == null ? "" : String(v)).filter(Boolean).join("\n");
+    if (isCheckTimeoutError(e)) {
+      const note = `check timed out after ${timeoutMs}ms`;
+      output = output.trim() ? `${output}
+${note}` : note;
+      return { passed: false, findings: 0, output, executionFailed: true };
+    }
+    const m = output.match(FINDINGS_RE);
+    if (m) {
+      return { passed: false, findings: parseInt(m[1], 10), output, executionFailed: false };
+    }
+    return { passed: false, findings: 0, output, executionFailed: true };
+  }
+}
+
 // src/maintenance/output-store.ts
-var fs17 = __toESM(require("fs"));
+var fs15 = __toESM(require("fs"));
 var path20 = __toESM(require("path"));
 var DEFAULT_RETENTION = {
   runs: 50,
@@ -12168,13 +12641,13 @@ var TaskOutputStore = class {
   async write(taskId, entry, retention) {
     this.ensureSafeTaskId(taskId);
     const dir = this.dirFor(taskId);
-    await fs17.promises.mkdir(dir, { recursive: true });
+    await fs15.promises.mkdir(dir, { recursive: true });
     const fileName = `${sanitizeIso(entry.completedAt || (/* @__PURE__ */ new Date()).toISOString())}.json`;
     const filePath = path20.join(dir, fileName);
     const tmpPath = `${filePath}.tmp`;
     const payload = JSON.stringify(entry, null, 2);
-    await fs17.promises.writeFile(tmpPath, payload, "utf-8");
-    await fs17.promises.rename(tmpPath, filePath);
+    await fs15.promises.writeFile(tmpPath, payload, "utf-8");
+    await fs15.promises.rename(tmpPath, filePath);
     try {
       await this.applyRetention(taskId, retention);
     } catch (err) {
@@ -12225,7 +12698,7 @@ var TaskOutputStore = class {
   }
   async readEntry(filePath) {
     try {
-      const buf = await fs17.promises.readFile(filePath, "utf-8");
+      const buf = await fs15.promises.readFile(filePath, "utf-8");
       const parsed = JSON.parse(buf);
       return parsed;
     } catch {
@@ -12247,7 +12720,7 @@ var TaskOutputStore = class {
     const toRemove = /* @__PURE__ */ new Set([...overflow, ...aged]);
     for (const name of toRemove) {
       try {
-        await fs17.promises.unlink(path20.join(dir, name));
+        await fs15.promises.unlink(path20.join(dir, name));
       } catch {
       }
     }
@@ -12256,7 +12729,7 @@ var TaskOutputStore = class {
 async function listJsonFilesDescending(dir) {
   let names;
   try {
-    names = await fs17.promises.readdir(dir);
+    names = await fs15.promises.readdir(dir);
   } catch {
     return [];
   }
@@ -12365,7 +12838,7 @@ var fallbackLogger3 = {
 };
 
 // src/maintenance/custom-task-validator.ts
-var import_types30 = require("@harness-engineering/types");
+var import_types31 = require("@harness-engineering/types");
 var ID_PATTERN = /^[a-z0-9][a-z0-9-]*$/;
 var REQUIRED_FIELDS_BY_TYPE = {
   "mechanical-ai": ["branch", "fixSkill"],
@@ -12375,7 +12848,7 @@ var REQUIRED_FIELDS_BY_TYPE = {
 };
 function validateCustomTasks(customTasks, builtIns, deps = {}) {
   const errors = [];
-  if (!customTasks) return (0, import_types30.Ok)(void 0);
+  if (!customTasks) return (0, import_types31.Ok)(void 0);
   const builtInIds = new Set(builtIns.map((t) => t.id));
   const customIds = Object.keys(customTasks);
   const allIds = /* @__PURE__ */ new Set([...builtInIds, ...customIds]);
@@ -12385,7 +12858,7 @@ function validateCustomTasks(customTasks, builtIns, deps = {}) {
     validateOne(id, task, builtInIds, allIds, deps, errors);
   }
   detectCycles(customTasks, builtIns, errors);
-  return errors.length === 0 ? (0, import_types30.Ok)(void 0) : (0, import_types30.Err)(errors);
+  return errors.length === 0 ? (0, import_types31.Ok)(void 0) : (0, import_types31.Err)(errors);
 }
 function validateOne(id, task, builtInIds, allIds, deps, errors) {
   const prefix = `customTasks.${id}`;
@@ -12574,6 +13047,11 @@ function deriveSeedPaths(config) {
   const roadmapPath = config.tracker.kind === "roadmap" && config.tracker.filePath ? config.tracker.filePath : "docs/roadmap.md";
   return [".harness/proposals", roadmapPath];
 }
+function normalizeHarnessCommand(command) {
+  if (command.length === 0) return [];
+  if (command[0] === "harness") return command;
+  return ["harness", ...command];
+}
 var Orchestrator = class extends import_node_events.EventEmitter {
   state;
   config;
@@ -12700,6 +13178,11 @@ var Orchestrator = class extends import_node_events.EventEmitter {
   abortControllers = /* @__PURE__ */ new Map();
   /** Guards against overlapping ticks when a tick takes longer than the polling interval */
   tickInProgress = false;
+  /** Phase 4 (DLane-5): lanes read back from the durable log on first tick, for
+   *  observability only — NOT fed into reconciliation. Empty until the first tick. */
+  persistedLanes = { tasks: {} };
+  /** Ensures the lane read-back diagnostic runs at most once (first tick). */
+  laneReadbackDone = false;
   /** Timestamp of the last stale branch sweep (at most once per hour) */
   lastBranchSweepMs = 0;
   /** Current tick-phase activity visible to the dashboard */
@@ -12773,7 +13256,7 @@ var Orchestrator = class extends import_node_events.EventEmitter {
         this.localResolvers.set(name, new LocalModelResolver(resolverOpts));
       }
     }
-    this.cacheMetrics = new import_core16.CacheMetricsRecorder();
+    this.cacheMetrics = new import_core17.CacheMetricsRecorder();
     if (this.config.agent.backends !== void 0 && Object.keys(this.config.agent.backends).length > 0) {
       const sandboxPolicy = this.config.agent.sandboxPolicy === "docker" ? "docker" : "none";
       const firstBackendName = Object.keys(this.config.agent.backends)[0];
@@ -12859,7 +13342,7 @@ var Orchestrator = class extends import_node_events.EventEmitter {
       this.setupNotifications(config.notifications);
       const otlpCfg = config.telemetry?.export?.otlp;
       if (otlpCfg) {
-        this.otlpExporter = new import_core16.OTLPExporter({
+        this.otlpExporter = new import_core17.OTLPExporter({
           endpoint: otlpCfg.endpoint,
           ...otlpCfg.enabled !== void 0 ? { enabled: otlpCfg.enabled } : {},
           ...otlpCfg.headers !== void 0 ? { headers: otlpCfg.headers } : {},
@@ -12928,7 +13411,7 @@ var Orchestrator = class extends import_node_events.EventEmitter {
         ...this.config.tracker.apiKey ? { token: this.config.tracker.apiKey } : {},
         ...this.config.tracker.endpoint ? { apiBase: this.config.tracker.endpoint } : {}
       };
-      const clientResult = (0, import_core15.createTrackerClient)(trackerCfg);
+      const clientResult = (0, import_core16.createTrackerClient)(trackerCfg);
       if (!clientResult.ok) throw clientResult.error;
       return new GitHubIssuesIssueTrackerAdapter(clientResult.value, this.config.tracker);
     }
@@ -12946,48 +13429,30 @@ var Orchestrator = class extends import_node_events.EventEmitter {
     const logger = this.logger;
     const checkRunner = {
       run: async (command, cwd) => {
-        const { execFile: execFile7 } = await import("child_process");
-        const { promisify: promisify5 } = await import("util");
-        const execFileAsync2 = promisify5(execFile7);
-        const [cmd, ...args] = command;
-        if (!cmd) return { passed: true, findings: 0, output: "" };
-        try {
-          const { stdout } = await execFileAsync2(cmd, args, { cwd, timeout: 12e4 });
-          const findingsMatch = stdout.match(/(\d+)\s+(?:finding|issue|violation|error)/i);
-          const findings = findingsMatch ? parseInt(findingsMatch[1], 10) : 0;
-          return { passed: findings === 0, findings, output: stdout };
-        } catch (err) {
-          const error = err;
-          const output = [error.stdout, error.stderr].filter(Boolean).join("\n");
-          const findingsMatch = output.match(/(\d+)\s+(?:finding|issue|violation|error)/i);
-          const findings = findingsMatch ? parseInt(findingsMatch[1], 10) : 1;
-          return { passed: false, findings, output };
-        }
-      }
-    };
-    const agentDispatcher = {
-      dispatch: async (skill, branch, backendName, cwd) => {
-        logger.info(
-          "Maintenance agent dispatcher invoked (stub \u2014 skill dispatch integration pending)",
-          {
-            skill,
-            branch,
-            backendName,
-            cwd
-          }
-        );
-        return { producedCommits: false, fixed: 0 };
+        const [cmd, ...args] = normalizeHarnessCommand(command);
+        if (!cmd) return { passed: true, findings: 0, output: "", executionFailed: false };
+        return runHarnessCheck({ file: cmd, args }, cwd);
       }
     };
+    const resolveBackend2 = makeBackendResolver(this.getBackends());
+    const agentDispatcher = createAgentDispatcher({
+      resolveBackend: resolveBackend2,
+      git: (args, cwd) => (0, import_node_child_process13.execFileSync)("git", args, { cwd, encoding: "utf-8" }).toString().trim(),
+      logger
+    });
     const commandExecutor = {
       exec: async (command, cwd) => {
         const { execFile: execFile7 } = await import("child_process");
-        const { promisify: promisify5 } = await import("util");
-        const execFileAsync2 = promisify5(execFile7);
-        const [cmd, ...args] = command;
+        const { promisify: promisify6 } = await import("util");
+        const execFileAsync2 = promisify6(execFile7);
+        const [cmd, ...args] = normalizeHarnessCommand(command);
         if (!cmd) return { stdout: "" };
         try {
-          const { stdout } = await execFileAsync2(cmd, args, { cwd, timeout: 12e4 });
+          const { stdout } = await execFileAsync2(cmd, args, {
+            cwd,
+            timeout: MAINTENANCE_CHECK_TIMEOUT_MS,
+            maxBuffer: MAINTENANCE_CHECK_MAX_BUFFER
+          });
           return { stdout: String(stdout) };
         } catch (err) {
           logger.warn("Maintenance command execution failed", {
@@ -13122,6 +13587,10 @@ ${messages}`);
   async asyncTick() {
     await this.ensureClaimManager();
     await this.intelligenceRunner.loadPersistedData();
+    if (!this.laneReadbackDone) {
+      this.laneReadbackDone = true;
+      await this.readBackPersistedLanes();
+    }
     const nowMs = Date.now();
     this.setTickActivity("fetching", "Polling tracker for candidates");
     const candidatesResult = await this.tracker.fetchCandidateIssues();
@@ -13274,12 +13743,48 @@ ${messages}`);
         break;
       case "escalate":
         await this.handleEscalation(effect);
+        await this.persistLaneSafe(effect.issueId, "abandon");
         break;
       case "claim":
         await this.handleClaimEffect(effect);
         break;
     }
   }
+  /**
+   * Phase 4 (DLane-5): persist an orchestrator lane transition to the durable
+   * core event log at the effect boundary. NEVER throws — `persistLane` returns
+   * an `Err` Result on failure, which is logged and swallowed here so a
+   * lane-persistence failure can never break orchestrator dispatch.
+   */
+  async persistLaneSafe(issueId, signal) {
+    const r = await persistLane(this.projectRoot, issueId, signal);
+    if (!r.ok) {
+      this.logger.warn(`lane persist failed for ${issueId} (${signal}): ${r.error.message}`);
+    }
+  }
+  /**
+   * Phase 4 (DLane-5): read persisted task lanes back from the durable log and
+   * log a one-line summary. Stores the projection on `this.persistedLanes` for
+   * observability. Read-only — never feeds reconciliation, never throws.
+   */
+  async readBackPersistedLanes() {
+    const lanes = await readPersistedLanes(this.projectRoot);
+    this.persistedLanes = lanes;
+    const entries = Object.keys(lanes.tasks).map((id) => `${id}:${lanes.tasks[id]?.lane}`);
+    const nonTerminal = entries.filter((e) => !e.endsWith(":done") && !e.endsWith(":canceled"));
+    this.logger.info(
+      `Lane read-back on startup: ${entries.length} persisted task(s), ${nonTerminal.length} non-terminal`,
+      { nonTerminal }
+    );
+  }
+  /**
+   * Phase 4 (DLane-5): the task lanes most recently read back from the durable
+   * log on startup, exposed for external observability. Read-only — a fresh
+   * `{ tasks: {} }` until the first tick's read-back has run.
+   */
+  getPersistedLanes() {
+    return this.persistedLanes;
+  }
   /**
    * Guards workspace cleanup by checking whether the agent pushed a branch
    * that does not yet have a pull request. If so, the worktree is preserved
@@ -13312,7 +13817,7 @@ ${messages}`);
           { issueId }
         );
         await this.interactionQueue.push({
-          id: `interaction-${(0, import_node_crypto16.randomUUID)()}`,
+          id: `interaction-${(0, import_node_crypto15.randomUUID)()}`,
           issueId,
           type: "needs-human",
           reasons: [`Agent pushed branch "${branch}" but did not create a PR. Worktree preserved.`],
@@ -13388,7 +13893,7 @@ ${messages}`);
       { issueId: effect.issueId }
     );
     await this.interactionQueue.push({
-      id: `interaction-${(0, import_node_crypto16.randomUUID)()}`,
+      id: `interaction-${(0, import_node_crypto15.randomUUID)()}`,
       issueId: effect.issueId,
       type: "needs-human",
       reasons: effect.reasons,
@@ -13466,6 +13971,7 @@ ${messages}`);
       }
       return;
     }
+    await this.persistLaneSafe(effect.issue.id, "claim");
     await this.postClaimComment(effect.issue);
     await this.dispatchIssue(effect.issue, effect.attempt, effect.backend);
   }
@@ -13484,12 +13990,12 @@ ${messages}`);
   async postLifecycleComment(identifier, externalId, event) {
     try {
       if (!externalId) return;
-      const trackerConfig = (0, import_core15.loadTrackerSyncConfig)(this.projectRoot);
+      const trackerConfig = (0, import_core16.loadTrackerSyncConfig)(this.projectRoot);
       if (!trackerConfig) return;
       const token = process.env.GITHUB_TOKEN;
       if (!token) return;
       const orchestratorId = await this.orchestratorIdPromise;
-      const adapter = new import_core15.GitHubIssuesSyncAdapter({ token, config: trackerConfig });
+      const adapter = new import_core16.GitHubIssuesSyncAdapter({ token, config: trackerConfig });
       const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace("T", " ").slice(0, 19);
       const actionMap = {
         claimed: "Dispatching agent for autonomous execution",
@@ -13526,6 +14032,7 @@ ${messages}`);
     this.logger.info(`Dispatching issue: ${issue.identifier} (attempt ${attempt})`, {
       issueId: issue.id
     });
+    await this.persistLaneSafe(issue.id, "dispatch");
     try {
       const workspaceResult = await this.workspace.ensureWorkspace(issue.identifier);
       if (!workspaceResult.ok) throw workspaceResult.error;
@@ -13562,7 +14069,7 @@ ${messages}`);
             ...f.line !== void 0 ? { line: f.line } : {}
           }))
         );
-        (0, import_core14.writeTaint)(
+        (0, import_core15.writeTaint)(
           workspacePath,
           issue.id,
           "Medium-severity injection patterns found in workspace config files",
@@ -13734,6 +14241,7 @@ ${messages}`);
    * Informs the state machine that an agent worker has exited.
    */
   async emitWorkerExit(issueId, reason, attempt, error) {
+    await this.persistLaneSafe(issueId, reason === "normal" ? "success" : "failure");
     await this.completionHandler.handleWorkerExit(
       issueId,
       reason,
@@ -14269,11 +14777,11 @@ function launchTUI(orchestrator) {
 }
 
 // src/maintenance/sync-main.ts
-var import_node_child_process12 = require("child_process");
-var import_node_util4 = require("util");
+var import_node_child_process14 = require("child_process");
+var import_node_util5 = require("util");
 var DEFAULT_TIMEOUT_MS3 = 6e4;
 async function git(execFileFn, args, cwd, timeoutMs) {
-  const exec = (0, import_node_util4.promisify)(execFileFn);
+  const exec = (0, import_node_util5.promisify)(execFileFn);
   const { stdout, stderr } = await exec("git", args, { cwd, timeout: timeoutMs });
   return { stdout: String(stdout), stderr: String(stderr) };
 }
@@ -14335,7 +14843,7 @@ async function isAncestor(execFileFn, a, b, cwd, timeoutMs) {
   }
 }
 async function syncMain(repoRoot, opts = {}) {
-  const execFileFn = opts.execFileFn ?? import_node_child_process12.execFile;
+  const execFileFn = opts.execFileFn ?? import_node_child_process14.execFile;
   const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS3;
   try {
     const originRef = await resolveOriginDefault(execFileFn, repoRoot, timeoutMs);
@@ -14412,11 +14920,59 @@ async function syncMain(repoRoot, opts = {}) {
   }
 }
 
+// src/maintenance/overdue.ts
+var LOOKBACK_DAYS = 366;
+function previousFireTime(schedule, now) {
+  let day = new Date(now.getFullYear(), now.getMonth(), now.getDate());
+  for (let d = 0; d <= LOOKBACK_DAYS; d++) {
+    if (cronMatchesDate(schedule, day)) {
+      const dayStartMs = day.getTime();
+      const scanStart = d === 0 ? new Date(
+        now.getFullYear(),
+        now.getMonth(),
+        now.getDate(),
+        now.getHours(),
+        now.getMinutes()
+      ) : new Date(day.getFullYear(), day.getMonth(), day.getDate(), 23, 59);
+      for (let ms = scanStart.getTime(); ms >= dayStartMs; ms -= 6e4) {
+        const candidate = new Date(ms);
+        if (cronMatchesNow(schedule, candidate)) return candidate;
+      }
+    }
+    day = new Date(day.getFullYear(), day.getMonth(), day.getDate() - 1);
+  }
+  return null;
+}
+function isSatisfyingRun(r) {
+  return r.status === "success" || r.status === "no-issues";
+}
+function isOverdue(task, history, now) {
+  const satisfyingRuns = history.filter((r) => r.taskId === task.id && isSatisfyingRun(r));
+  const fire = previousFireTime(task.schedule, now);
+  if (fire === null) return satisfyingRuns.length === 0;
+  const fireMs = fire.getTime();
+  const satisfied = satisfyingRuns.some((r) => new Date(r.completedAt).getTime() >= fireMs);
+  return !satisfied;
+}
+function selectTasks(tasks, history, filter) {
+  const eligible = tasks.filter((t) => t.excludeFromHumanSweep !== true);
+  switch (filter.mode) {
+    case "all":
+      return eligible;
+    case "ids": {
+      const wanted = new Set(filter.ids ?? []);
+      return eligible.filter((t) => wanted.has(t.id));
+    }
+    case "overdue":
+      return eligible.filter((t) => isOverdue(t, history, filter.now));
+  }
+}
+
 // src/sessions/search-index.ts
-var fs18 = __toESM(require("fs"));
+var fs16 = __toESM(require("fs"));
 var path22 = __toESM(require("path"));
 var import_better_sqlite32 = __toESM(require("better-sqlite3"));
-var import_types31 = require("@harness-engineering/types");
+var import_types32 = require("@harness-engineering/types");
 var SEARCH_INDEX_FILE = "search-index.sqlite";
 var SCHEMA_SQL2 = `
   CREATE TABLE IF NOT EXISTS session_docs (
@@ -14474,7 +15030,7 @@ var SqliteSearchIndex = class {
   removeSessionStmt;
   totalStmt;
   constructor(dbPath) {
-    fs18.mkdirSync(path22.dirname(dbPath), { recursive: true });
+    fs16.mkdirSync(path22.dirname(dbPath), { recursive: true });
     this.db = new import_better_sqlite32.default(dbPath);
     this.db.pragma("journal_mode = WAL");
     this.db.pragma("synchronous = NORMAL");
@@ -14574,18 +15130,18 @@ function openSearchIndex(projectPath) {
   return new SqliteSearchIndex(searchIndexPath(projectPath));
 }
 function indexSessionDirectory(idx, args) {
-  const kinds = args.fileKinds ?? [...import_types31.INDEXED_FILE_KINDS];
+  const kinds = args.fileKinds ?? [...import_types32.INDEXED_FILE_KINDS];
   const cap = args.maxBytesPerBody ?? 256 * 1024;
   let docsWritten = 0;
   for (const kind of kinds) {
     const fileName = FILE_KIND_TO_FILENAME[kind];
     const filePath = path22.join(args.sessionDir, fileName);
-    if (!fs18.existsSync(filePath)) continue;
-    let body = fs18.readFileSync(filePath, "utf8");
+    if (!fs16.existsSync(filePath)) continue;
+    let body = fs16.readFileSync(filePath, "utf8");
     if (Buffer.byteLength(body, "utf8") > cap) {
       body = body.slice(0, cap) + "\n\n[TRUNCATED]";
     }
-    const stat = fs18.statSync(filePath);
+    const stat = fs16.statSync(filePath);
     const relPath = path22.relative(args.projectPath, filePath).replaceAll("\\", "/");
     idx.upsertSessionDoc({
       sessionId: args.sessionId,
@@ -14607,8 +15163,8 @@ function reindexFromArchive(projectPath, opts = {}) {
     idx.resetArchived();
     let sessionsIndexed = 0;
     let docsWritten = 0;
-    if (fs18.existsSync(archiveBase)) {
-      const entries = fs18.readdirSync(archiveBase, { withFileTypes: true });
+    if (fs16.existsSync(archiveBase)) {
+      const entries = fs16.readdirSync(archiveBase, { withFileTypes: true });
       for (const entry of entries) {
         if (!entry.isDirectory()) continue;
         const sessionDir = path22.join(archiveBase, entry.name);
@@ -14631,10 +15187,10 @@ function reindexFromArchive(projectPath, opts = {}) {
 }
 
 // src/sessions/summarize.ts
-var fs19 = __toESM(require("fs"));
+var fs17 = __toESM(require("fs"));
 var path23 = __toESM(require("path"));
-var import_types32 = require("@harness-engineering/types");
 var import_types33 = require("@harness-engineering/types");
+var import_types34 = require("@harness-engineering/types");
 var LLM_SUMMARY_FILE = "llm-summary.md";
 var SUMMARY_INPUT_FILES = [
   { filename: "summary.md", kind: "summary" },
@@ -14661,9 +15217,9 @@ function readInputCorpus(archiveDir) {
   const parts = [];
   for (const { filename, kind } of SUMMARY_INPUT_FILES) {
     const p = path23.join(archiveDir, filename);
-    if (!fs19.existsSync(p)) continue;
+    if (!fs17.existsSync(p)) continue;
     try {
-      const content = fs19.readFileSync(p, "utf8");
+      const content = fs17.readFileSync(p, "utf8");
       if (content.trim().length === 0) continue;
       parts.push(`## FILE: ${kind}
 
@@ -14725,17 +15281,17 @@ status: failed
 
 - reason: ${reason}
 `;
-  fs19.writeFileSync(filePath, body, "utf8");
+  fs17.writeFileSync(filePath, body, "utf8");
   return filePath;
 }
 async function summarizeArchivedSession(ctx) {
   const writeStubOnError = ctx.writeStubOnError ?? true;
-  if (!fs19.existsSync(ctx.archiveDir)) {
-    return (0, import_types33.Err)(new Error(`archive directory not found: ${ctx.archiveDir}`));
+  if (!fs17.existsSync(ctx.archiveDir)) {
+    return (0, import_types34.Err)(new Error(`archive directory not found: ${ctx.archiveDir}`));
   }
   const corpus = readInputCorpus(ctx.archiveDir);
   if (corpus.trim().length === 0) {
-    return (0, import_types33.Err)(new Error(`no summary input files found in ${ctx.archiveDir}`));
+    return (0, import_types34.Err)(new Error(`no summary input files found in ${ctx.archiveDir}`));
   }
   const inputBudgetTokens = ctx.config?.inputBudgetTokens ?? DEFAULT_INPUT_BUDGET_TOKENS;
   const truncated = truncateForBudget(corpus, inputBudgetTokens);
@@ -14744,7 +15300,7 @@ async function summarizeArchivedSession(ctx) {
   const analyzeOpts = {
     prompt,
     systemPrompt: SYSTEM_PROMPT,
-    responseSchema: import_types32.SessionSummarySchema,
+    responseSchema: import_types33.SessionSummarySchema,
     ...ctx.config?.model && { model: ctx.config.model }
   };
   let response;
@@ -14768,11 +15324,11 @@ async function summarizeArchivedSession(ctx) {
       } catch {
       }
     }
-    return (0, import_types33.Err)(
+    return (0, import_types34.Err)(
       new Error(`session summary failed: ${reason}` + (stubPath ? ` (stub: ${stubPath})` : ""))
     );
   }
-  const parsed = import_types32.SessionSummarySchema.safeParse(response.result);
+  const parsed = import_types33.SessionSummarySchema.safeParse(response.result);
   if (!parsed.success) {
     const reason = `schema validation failed: ${parsed.error.message}`;
     ctx.logger?.warn?.("session summary: invalid provider payload", { reason });
@@ -14782,7 +15338,7 @@ async function summarizeArchivedSession(ctx) {
       } catch {
       }
     }
-    return (0, import_types33.Err)(new Error(reason));
+    return (0, import_types34.Err)(new Error(reason));
   }
   const meta = {
     generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
@@ -14793,8 +15349,8 @@ async function summarizeArchivedSession(ctx) {
   };
   const filePath = path23.join(ctx.archiveDir, LLM_SUMMARY_FILE);
   const body = renderLlmSummaryMarkdown(parsed.data, meta);
-  fs19.writeFileSync(filePath, body, "utf8");
-  return (0, import_types33.Ok)({ summary: parsed.data, meta, filePath });
+  fs17.writeFileSync(filePath, body, "utf8");
+  return (0, import_types34.Ok)({ summary: parsed.data, meta, filePath });
 }
 function isSummaryEnabled(config) {
   if (!config) return false;
@@ -14874,13 +15430,18 @@ function buildArchiveHooks(opts) {
   BUILT_IN_TASKS,
   BackendDefSchema,
   BackendRouter,
+  CheckScriptRunner,
   ClaimManager,
   GateNotReadyError,
   GateRunError,
   InteractionQueue,
+  LinearGraphQLClient,
   LinearGraphQLStub,
   LocalModelResolver,
+  MAINTENANCE_CHECK_MAX_BUFFER,
+  MAINTENANCE_CHECK_TIMEOUT_MS,
   MAX_ATTEMPTS,
+  MaintenanceReporter,
   MockBackend,
   ORCHESTRATOR_IDENTITY_FILE,
   Orchestrator,
@@ -14898,6 +15459,7 @@ function buildArchiveHooks(opts) {
   SqliteSearchIndex,
   StreamRecorder,
   TaskOutputStore,
+  TaskRunner,
   TokenStore,
   WebhookQueue,
   WorkflowLoader,
@@ -14908,7 +15470,9 @@ function buildArchiveHooks(opts) {
   buildArchiveHooks,
   calculateRetryDelay,
   canDispatch,
+  classifyCheckExecutionFailure,
   computeRateLimitDelay,
+  createAgentDispatcher,
   createBackend,
   createEmptyState,
   crossFieldRoutingIssues,
@@ -14920,22 +15484,27 @@ function buildArchiveHooks(opts) {
   emitProposalApproved,
   emitProposalCreated,
   emitProposalRejected,
+  explicitFindingsCount,
   extractHighlights,
   extractTitlePrefix,
   getAvailableSlots,
   getDefaultConfig,
   getPerStateCount,
   indexSessionDirectory,
+  isCheckTimeoutError,
   isEligible,
   isSummaryEnabled,
   launchTUI,
   loadPublishedIndex,
+  makeBackendResolver,
   migrateAgentConfig,
   normalizeFts5Query,
+  normalizeHarnessCommand,
   normalizeLocalModel,
   openSearchIndex,
   promote,
   reconcile,
+  recoverFindingsCount,
   reindexFromArchive,
   renderAnalysisComment,
   renderLlmSummaryMarkdown,
@@ -14945,9 +15514,11 @@ function buildArchiveHooks(opts) {
   routeIssue,
   routingWarnings,
   runGate,
+  runHarnessCheck,
   savePublishedIndex,
   searchIndexPath,
   selectCandidates,
+  selectTasks,
   sortCandidates,
   summarizeArchivedSession,
   syncMain,