@harness-engineering/orchestrator 0.8.4 → 0.9.1

package/dist/index.mjs

@@ -2209,11 +2209,10 @@ var WorkflowLoader = class {
 };
 
 // src/tracker/adapters/roadmap.ts
-import * as fs8 from "fs/promises";
 import { createHash as createHash2 } from "crypto";
 import {
-  parseRoadmap,
-  serializeRoadmap,
+  resolveRoadmapStoreForFile,
+  applyRoadmapDiff,
   claim as claimFeature,
   setStatus as setFeatureStatus,
   isClaimableBy
@@ -2249,8 +2248,7 @@ var RoadmapTrackerAdapter = class {
   async fetchIssuesByStates(stateNames) {
     try {
       if (!this.config.filePath) return Err3(new Error("Missing filePath"));
-      const content = await fs8.readFile(this.config.filePath, "utf-8");
-      const roadmapResult = parseRoadmap(content);
+      const roadmapResult = await this.loadRoadmap();
       if (!roadmapResult.ok) return roadmapResult;
       const issues = [];
       for (const milestone of roadmapResult.value.milestones) {
@@ -2281,17 +2279,19 @@ var RoadmapTrackerAdapter = class {
       if (!terminal) {
         return Err3(new Error("Tracker config has no terminalStates; cannot mark complete"));
       }
-      const content = await fs8.readFile(this.config.filePath, "utf-8");
-      const roadmapResult = parseRoadmap(content);
+      const store = this.resolveStore();
+      const roadmapResult = await store.load();
       if (!roadmapResult.ok) return roadmapResult;
       const roadmap = roadmapResult.value;
+      const before = structuredClone(roadmap);
       const target = this.findFeatureById(roadmap.milestones, issueId);
       if (!target) return Ok4(void 0);
       const normalizedTerminal = this.config.terminalStates.map((s) => s.toLowerCase());
       if (normalizedTerminal.includes(target.status.toLowerCase())) return Ok4(void 0);
       const now = (/* @__PURE__ */ new Date()).toISOString();
       setFeatureStatus(roadmap, target, terminal, now.slice(0, 10));
-      await fs8.writeFile(this.config.filePath, serializeRoadmap(roadmap), "utf-8");
+      const persisted = await applyRoadmapDiff(store, before, roadmap);
+      if (!persisted.ok) return persisted;
       return Ok4(void 0);
     } catch (error) {
       return Err3(error instanceof Error ? error : new Error(String(error)));
@@ -2305,10 +2305,11 @@ var RoadmapTrackerAdapter = class {
   async claimIssue(issueId, orchestratorId) {
     try {
       if (!this.config.filePath) return Err3(new Error("Missing filePath"));
-      const content = await fs8.readFile(this.config.filePath, "utf-8");
-      const roadmapResult = parseRoadmap(content);
+      const store = this.resolveStore();
+      const roadmapResult = await store.load();
       if (!roadmapResult.ok) return roadmapResult;
       const roadmap = roadmapResult.value;
+      const before = structuredClone(roadmap);
       const target = this.findFeatureById(roadmap.milestones, issueId);
       if (!target) return Ok4(void 0);
       if (!isClaimableBy(target, orchestratorId)) {
@@ -2320,7 +2321,8 @@ var RoadmapTrackerAdapter = class {
       const now = (/* @__PURE__ */ new Date()).toISOString();
       claimFeature(roadmap, target, orchestratorId, now.slice(0, 10));
       target.updatedAt = now;
-      await fs8.writeFile(this.config.filePath, serializeRoadmap(roadmap), "utf-8");
+      const persisted = await applyRoadmapDiff(store, before, roadmap);
+      if (!persisted.ok) return persisted;
       return Ok4(void 0);
     } catch (error) {
       return Err3(error instanceof Error ? error : new Error(String(error)));
@@ -2337,10 +2339,11 @@ var RoadmapTrackerAdapter = class {
       if (!activeState) {
         return Err3(new Error("Tracker config has no activeStates; cannot release"));
       }
-      const content = await fs8.readFile(this.config.filePath, "utf-8");
-      const roadmapResult = parseRoadmap(content);
+      const store = this.resolveStore();
+      const roadmapResult = await store.load();
       if (!roadmapResult.ok) return roadmapResult;
       const roadmap = roadmapResult.value;
+      const before = structuredClone(roadmap);
       const target = this.findFeatureById(roadmap.milestones, issueId);
       if (!target) return Ok4(void 0);
       if (this.config.activeStates.includes(target.status) && target.assignee === null) {
@@ -2349,12 +2352,26 @@ var RoadmapTrackerAdapter = class {
       const now = (/* @__PURE__ */ new Date()).toISOString();
       setFeatureStatus(roadmap, target, activeState, now.slice(0, 10));
       target.updatedAt = null;
-      await fs8.writeFile(this.config.filePath, serializeRoadmap(roadmap), "utf-8");
+      const persisted = await applyRoadmapDiff(store, before, roadmap);
+      if (!persisted.ok) return persisted;
       return Ok4(void 0);
     } catch (error) {
       return Err3(error instanceof Error ? error : new Error(String(error)));
     }
   }
+  /**
+   * Resolve the roadmap store anchored on the configured aggregate file path.
+   * The shard backend is chosen when a sibling `roadmap.d/` exists next to the
+   * file; otherwise the monolith file is read/written whole. Callers guard
+   * `this.config.filePath` before invoking.
+   */
+  resolveStore() {
+    return resolveRoadmapStoreForFile({ roadmapPath: this.config.filePath });
+  }
+  /** Load the roadmap via the store (sharded or monolith), returning a Result. */
+  loadRoadmap() {
+    return this.resolveStore().load();
+  }
   findFeatureById(milestones, issueId) {
     for (const milestone of milestones) {
       for (const feature of milestone.features) {
@@ -2371,8 +2388,7 @@ var RoadmapTrackerAdapter = class {
   async fetchIssueStatesByIds(issueIds) {
     try {
       if (!this.config.filePath) return Err3(new Error("Missing filePath"));
-      const content = await fs8.readFile(this.config.filePath, "utf-8");
-      const roadmapResult = parseRoadmap(content);
+      const roadmapResult = await this.loadRoadmap();
       if (!roadmapResult.ok) return roadmapResult;
       const issueMap = /* @__PURE__ */ new Map();
       for (const milestone of roadmapResult.value.milestones) {
@@ -2427,7 +2443,70 @@ var RoadmapTrackerAdapter = class {
 };
 
 // src/tracker/extensions/linear.ts
-import { Ok as Ok5 } from "@harness-engineering/types";
+import { Ok as Ok5, Err as Err4 } from "@harness-engineering/types";
+var LINEAR_GRAPHQL_ENDPOINT = "https://api.linear.app/graphql";
+function errorMessage(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+var LinearGraphQLClient = class {
+  apiKey;
+  endpoint;
+  fetchFn;
+  constructor(opts) {
+    this.apiKey = opts.apiKey;
+    this.endpoint = opts.endpoint ?? LINEAR_GRAPHQL_ENDPOINT;
+    this.fetchFn = opts.fetchFn ?? globalThis.fetch;
+  }
+  async query(query, variables) {
+    const sent = await this.sendRequest(query, variables);
+    if (!sent.ok) return sent;
+    const res = sent.value;
+    if (!res.ok) {
+      return Err4(await this.httpError(res));
+    }
+    const parsed = await this.parseEnvelope(res);
+    if (!parsed.ok) return parsed;
+    const envelope = parsed.value;
+    const graphqlError = envelopeError(envelope);
+    if (graphqlError) return Err4(graphqlError);
+    return Ok5(envelope.data ?? {});
+  }
+  /** POST the operation to Linear, normalizing transport throws into an `Err`. */
+  async sendRequest(query, variables) {
+    try {
+      const res = await this.fetchFn(this.endpoint, {
+        method: "POST",
+        headers: {
+          Authorization: this.apiKey,
+          "Content-Type": "application/json"
+        },
+        body: JSON.stringify({ query, variables: variables ?? {} })
+      });
+      return Ok5(res);
+    } catch (err) {
+      return Err4(new Error(`Linear GraphQL request failed: ${errorMessage(err)}`));
+    }
+  }
+  /** Build the error for a non-2xx HTTP response, including a truncated body. */
+  async httpError(res) {
+    const body = await res.text().catch(() => "");
+    const detail = body ? `: ${body.slice(0, 500)}` : "";
+    return new Error(`Linear GraphQL HTTP ${res.status}${detail}`);
+  }
+  /** Parse the JSON envelope, normalizing parse failures into an `Err`. */
+  async parseEnvelope(res) {
+    try {
+      return Ok5(await res.json());
+    } catch (err) {
+      return Err4(new Error(`Linear GraphQL response was not valid JSON: ${errorMessage(err)}`));
+    }
+  }
+};
+function envelopeError(envelope) {
+  if (!envelope.errors || envelope.errors.length === 0) return void 0;
+  const message = envelope.errors.map((e) => e.message ?? "unknown error").join("; ");
+  return new Error(`Linear GraphQL error: ${message}`);
+}
 var LinearGraphQLStub = class {
   async query(query, _variables) {
     console.log("Linear GraphQL query (stub):", query);
@@ -2436,11 +2515,11 @@ var LinearGraphQLStub = class {
 };
 
 // src/workspace/manager.ts
-import * as fs9 from "fs/promises";
+import * as fs8 from "fs/promises";
 import * as path8 from "path";
 import { execFile as execFile2 } from "child_process";
 import { promisify as promisify2 } from "util";
-import { Ok as Ok6, Err as Err4 } from "@harness-engineering/types";
+import { Ok as Ok6, Err as Err5 } from "@harness-engineering/types";
 var WorkspaceManager = class _WorkspaceManager {
   config;
   /** Absolute path to the git repository root (resolved lazily). */
@@ -2476,7 +2555,7 @@ var WorkspaceManager = class _WorkspaceManager {
   async getRepoRoot() {
     if (this.repoRoot) return this.repoRoot;
     const root = path8.resolve(this.config.root);
-    await fs9.mkdir(root, { recursive: true });
+    await fs8.mkdir(root, { recursive: true });
     const stdout = await this.git(["rev-parse", "--show-toplevel"], root);
     this.repoRoot = stdout.trim();
     return this.repoRoot;
@@ -2489,21 +2568,21 @@ var WorkspaceManager = class _WorkspaceManager {
     try {
       const workspacePath = path8.resolve(this.resolvePath(identifier));
       try {
-        await fs9.access(path8.join(workspacePath, ".git"));
+        await fs8.access(path8.join(workspacePath, ".git"));
         const repoRoot2 = await this.getRepoRoot();
         try {
           await this.git(["worktree", "remove", "--force", workspacePath], repoRoot2);
         } catch {
-          await fs9.rm(workspacePath, { recursive: true, force: true });
+          await fs8.rm(workspacePath, { recursive: true, force: true });
         }
       } catch {
         try {
-          await fs9.access(workspacePath);
+          await fs8.access(workspacePath);
           const repoRoot2 = await this.getRepoRoot();
           try {
             await this.git(["worktree", "remove", "--force", workspacePath], repoRoot2);
           } catch {
-            await fs9.rm(workspacePath, { recursive: true, force: true });
+            await fs8.rm(workspacePath, { recursive: true, force: true });
           }
         } catch {
         }
@@ -2515,7 +2594,7 @@ var WorkspaceManager = class _WorkspaceManager {
       await this.seedWorkspace(workspacePath, repoRoot);
       return Ok6(workspacePath);
     } catch (error) {
-      return Err4(error instanceof Error ? error : new Error(String(error)));
+      return Err5(error instanceof Error ? error : new Error(String(error)));
     }
   }
   /**
@@ -2556,13 +2635,13 @@ var WorkspaceManager = class _WorkspaceManager {
       }
       const src = path8.join(repoRoot, rel);
       try {
-        await fs9.access(src);
+        await fs8.access(src);
       } catch {
         continue;
       }
       const dest = path8.join(workspacePath, rel);
       try {
-        await fs9.cp(src, dest, { recursive: true, force: true });
+        await fs8.cp(src, dest, { recursive: true, force: true });
       } catch {
       }
     }
@@ -2638,7 +2717,7 @@ var WorkspaceManager = class _WorkspaceManager {
   async exists(identifier) {
     try {
       const workspacePath = this.resolvePath(identifier);
-      await fs9.access(workspacePath);
+      await fs8.access(workspacePath);
       return true;
     } catch {
       return false;
@@ -2653,7 +2732,7 @@ var WorkspaceManager = class _WorkspaceManager {
     try {
       const workspacePath = path8.resolve(this.resolvePath(identifier));
       try {
-        await fs9.access(path8.join(workspacePath, ".git"));
+        await fs8.access(path8.join(workspacePath, ".git"));
       } catch {
         return null;
       }
@@ -2764,18 +2843,18 @@ var WorkspaceManager = class _WorkspaceManager {
         const repoRoot = await this.getRepoRoot();
         await this.git(["worktree", "remove", "--force", workspacePath], repoRoot);
       } catch {
-        await fs9.rm(workspacePath, { recursive: true, force: true });
+        await fs8.rm(workspacePath, { recursive: true, force: true });
       }
       return Ok6(void 0);
     } catch (error) {
-      return Err4(error instanceof Error ? error : new Error(String(error)));
+      return Err5(error instanceof Error ? error : new Error(String(error)));
     }
   }
 };
 
 // src/workspace/hooks.ts
 import { spawn } from "child_process";
-import { Ok as Ok7, Err as Err5 } from "@harness-engineering/types";
+import { Ok as Ok7, Err as Err6 } from "@harness-engineering/types";
 var WorkspaceHooks = class {
   config;
   constructor(config) {
@@ -2802,19 +2881,19 @@ var WorkspaceHooks = class {
       });
       const timeout = setTimeout(() => {
         child.kill();
-        resolve8(Err5(new Error(`Hook ${hookName} timed out after ${this.config.timeoutMs}ms`)));
+        resolve8(Err6(new Error(`Hook ${hookName} timed out after ${this.config.timeoutMs}ms`)));
       }, this.config.timeoutMs);
       child.on("exit", (code) => {
         clearTimeout(timeout);
         if (code === 0) {
           resolve8(Ok7(void 0));
         } else {
-          resolve8(Err5(new Error(`Hook ${hookName} failed with exit code ${code}`)));
+          resolve8(Err6(new Error(`Hook ${hookName} failed with exit code ${code}`)));
         }
       });
       child.on("error", (error) => {
         clearTimeout(timeout);
-        resolve8(Err5(error));
+        resolve8(Err6(error));
       });
     });
   }
@@ -3494,7 +3573,7 @@ import {
 } from "@harness-engineering/core";
 
 // src/tracker/adapters/github-issues-issue-tracker.ts
-import { Ok as Ok9, Err as Err6 } from "@harness-engineering/types";
+import { Ok as Ok9, Err as Err7 } from "@harness-engineering/types";
 var GitHubIssuesIssueTrackerAdapter = class {
   client;
   config;
@@ -3509,12 +3588,12 @@ var GitHubIssuesIssueTrackerAdapter = class {
     const r = await this.client.fetchByStatus(
       stateNames
     );
-    if (!r.ok) return Err6(r.error);
+    if (!r.ok) return Err7(r.error);
     return Ok9(r.value.map((f) => this.mapTrackedToIssue(f)));
   }
   async fetchIssueStatesByIds(issueIds) {
     const r = await this.client.fetchAll();
-    if (!r.ok) return Err6(r.error);
+    if (!r.ok) return Err7(r.error);
     const wanted = new Set(issueIds);
     const out = /* @__PURE__ */ new Map();
     for (const f of r.value.features) {
@@ -3524,17 +3603,17 @@ var GitHubIssuesIssueTrackerAdapter = class {
   }
   async claimIssue(issueId, orchestratorId) {
     const r = await this.client.claim(issueId, orchestratorId);
-    if (!r.ok) return Err6(r.error);
+    if (!r.ok) return Err7(r.error);
     return Ok9(void 0);
   }
   async releaseIssue(issueId) {
     const r = await this.client.release(issueId);
-    if (!r.ok) return Err6(r.error);
+    if (!r.ok) return Err7(r.error);
     return Ok9(void 0);
   }
   async markIssueComplete(issueId) {
     const r = await this.client.complete(issueId);
-    if (!r.ok) return Err6(r.error);
+    if (!r.ok) return Err7(r.error);
     return Ok9(void 0);
   }
   /**
@@ -4185,14 +4264,14 @@ import * as readline from "readline";
 import { randomUUID as randomUUID2 } from "crypto";
 import {
   Ok as Ok10,
-  Err as Err7
+  Err as Err8
 } from "@harness-engineering/types";
 function resolveExitCode(code, command, resolve8) {
   if (code === 0) {
     resolve8(Ok10(void 0));
   } else {
     resolve8(
-      Err7({
+      Err8({
         category: "agent_not_found",
         message: `Claude command '${command}' not found or failed`
       })
@@ -4200,7 +4279,7 @@ function resolveExitCode(code, command, resolve8) {
   }
 }
 function resolveSpawnError(command, resolve8) {
-  resolve8(Err7({ category: "agent_not_found", message: `Claude command '${command}' not found` }));
+  resolve8(Err8({ category: "agent_not_found", message: `Claude command '${command}' not found` }));
 }
 var JUST_PAST_GRACE_MS = 5 * 6e4;
 var PRIMARY_LIMIT_RE = /You[\u2019']ve hit your limit.*resets\s+(\d{1,2}(?::\d{2})?\s*(?:am|pm))\s*\(([^)]+)\)/i;
@@ -4550,7 +4629,7 @@ var ClaudeBackend = class {
 import Anthropic from "@anthropic-ai/sdk";
 import {
   Ok as Ok11,
-  Err as Err8
+  Err as Err9
 } from "@harness-engineering/types";
 import { AnthropicCacheAdapter } from "@harness-engineering/core";
 var AnthropicBackend = class {
@@ -4569,7 +4648,7 @@ var AnthropicBackend = class {
   }
   async startSession(params) {
     if (!this.config.apiKey) {
-      return Err8({
+      return Err9({
         category: "agent_not_found",
         message: "ANTHROPIC_API_KEY is not set"
       });
@@ -4630,18 +4709,18 @@ var AnthropicBackend = class {
         usage
       };
     } catch (err) {
-      const errorMessage = err instanceof Error ? err.message : "Anthropic request failed";
+      const errorMessage2 = err instanceof Error ? err.message : "Anthropic request failed";
       yield {
         type: "error",
         timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-        content: errorMessage,
+        content: errorMessage2,
         sessionId: session.sessionId
       };
       return {
         success: false,
         sessionId: session.sessionId,
         usage: { inputTokens: 0, outputTokens: 0, totalTokens: 0 },
-        error: errorMessage
+        error: errorMessage2
       };
     }
   }
@@ -4650,7 +4729,7 @@ var AnthropicBackend = class {
   }
   async healthCheck() {
     if (!this.config.apiKey) {
-      return Err8({
+      return Err9({
         category: "response_error",
         message: "ANTHROPIC_API_KEY is not set"
       });
@@ -4663,7 +4742,7 @@ var AnthropicBackend = class {
 import OpenAI from "openai";
 import {
   Ok as Ok12,
-  Err as Err9
+  Err as Err10
 } from "@harness-engineering/types";
 import { OpenAICacheAdapter } from "@harness-engineering/core";
 var OpenAIBackend = class {
@@ -4681,7 +4760,7 @@ var OpenAIBackend = class {
   }
   async startSession(params) {
     if (!this.config.apiKey) {
-      return Err9({
+      return Err10({
         category: "agent_not_found",
         message: "OPENAI_API_KEY is not set"
       });
@@ -4735,18 +4814,18 @@ var OpenAIBackend = class {
         }
       }
     } catch (err) {
-      const errorMessage = err instanceof Error ? err.message : "OpenAI request failed";
+      const errorMessage2 = err instanceof Error ? err.message : "OpenAI request failed";
       yield {
         type: "error",
         timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-        content: errorMessage,
+        content: errorMessage2,
         sessionId: session.sessionId
       };
       return {
         success: false,
         sessionId: session.sessionId,
         usage: { inputTokens: 0, outputTokens: 0, totalTokens: 0 },
-        error: errorMessage
+        error: errorMessage2
       };
     }
     const usage = {
@@ -4776,7 +4855,7 @@ var OpenAIBackend = class {
       await this.client.models.list();
       return Ok12(void 0);
     } catch (err) {
-      return Err9({
+      return Err10({
         category: "response_error",
         message: err instanceof Error ? err.message : "OpenAI health check failed"
       });
@@ -4788,7 +4867,7 @@ var OpenAIBackend = class {
 import { GoogleGenAI } from "@google/genai";
 import {
   Ok as Ok13,
-  Err as Err10
+  Err as Err11
 } from "@harness-engineering/types";
 import { GeminiCacheAdapter } from "@harness-engineering/core";
 var GeminiBackend = class {
@@ -4804,7 +4883,7 @@ var GeminiBackend = class {
   }
   async startSession(params) {
     if (!this.config.apiKey) {
-      return Err10({
+      return Err11({
         category: "agent_not_found",
         message: "GEMINI_API_KEY is not set"
       });
@@ -4860,11 +4939,11 @@ var GeminiBackend = class {
         }
       }
     } catch (err) {
-      const errorMessage = err instanceof Error ? err.message : "Gemini request failed";
+      const errorMessage2 = err instanceof Error ? err.message : "Gemini request failed";
       yield {
         type: "error",
         timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-        content: errorMessage,
+        content: errorMessage2,
         sessionId: session.sessionId
       };
       return {
@@ -4877,7 +4956,7 @@ var GeminiBackend = class {
           cacheCreationTokens,
           cacheReadTokens
         },
-        error: errorMessage
+        error: errorMessage2
       };
     }
     const usage = {
@@ -4904,7 +4983,7 @@ var GeminiBackend = class {
   }
   async healthCheck() {
     if (!this.config.apiKey) {
-      return Err10({
+      return Err11({
         category: "agent_not_found",
         message: "GEMINI_API_KEY is not set"
       });
@@ -4913,7 +4992,7 @@ var GeminiBackend = class {
       new GoogleGenAI({ apiKey: this.config.apiKey });
       return Ok13(void 0);
     } catch (err) {
-      return Err10({
+      return Err11({
         category: "response_error",
         message: err instanceof Error ? err.message : "Gemini health check failed"
       });
@@ -4925,7 +5004,7 @@ var GeminiBackend = class {
 import OpenAI2 from "openai";
 import {
   Ok as Ok14,
-  Err as Err11
+  Err as Err12
 } from "@harness-engineering/types";
 var DEFAULT_TIMEOUT_MS = 9e4;
 var LocalBackend = class {
@@ -4952,7 +5031,7 @@ var LocalBackend = class {
     if (this.getModel) {
       const candidate = this.getModel();
       if (candidate === null) {
-        return Err11({
+        return Err12({
           category: "agent_not_found",
           message: "No local model available; check dashboard for details."
         });
@@ -5006,18 +5085,18 @@ var LocalBackend = class {
         }
       }
     } catch (err) {
-      const errorMessage = err instanceof Error ? err.message : "Local backend request failed";
+      const errorMessage2 = err instanceof Error ? err.message : "Local backend request failed";
       yield {
         type: "error",
         timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-        content: errorMessage,
+        content: errorMessage2,
         sessionId: session.sessionId
       };
       return {
         success: false,
         sessionId: session.sessionId,
         usage: { inputTokens: 0, outputTokens: 0, totalTokens: 0 },
-        error: errorMessage
+        error: errorMessage2
       };
     }
     const usage = { inputTokens, outputTokens, totalTokens };
@@ -5041,7 +5120,7 @@ var LocalBackend = class {
       await this.client.models.list();
       return Ok14(void 0);
     } catch (err) {
-      return Err11({
+      return Err12({
         category: "response_error",
         message: err instanceof Error ? err.message : "Local backend health check failed"
       });
@@ -5053,7 +5132,7 @@ var LocalBackend = class {
 import { randomUUID as randomUUID3 } from "crypto";
 import {
   Ok as Ok15,
-  Err as Err12
+  Err as Err13
 } from "@harness-engineering/types";
 var SILENT_EVENTS = /* @__PURE__ */ new Set([
   "turn_end",
@@ -5171,7 +5250,7 @@ var PiBackend = class {
       if (this.config.getModel) {
         const candidate = this.config.getModel();
         if (candidate === null) {
-          return Err12({
+          return Err13({
             category: "agent_not_found",
             message: "No local model available; check dashboard for details."
           });
@@ -5201,7 +5280,7 @@ var PiBackend = class {
       };
       return Ok15(session);
     } catch (err) {
-      return Err12({
+      return Err13({
         category: "response_error",
         message: `Failed to create pi session: ${err instanceof Error ? err.message : String(err)}`
       });
@@ -5338,7 +5417,7 @@ var PiBackend = class {
       await import("@earendil-works/pi-coding-agent");
       return Ok15(void 0);
     } catch (err) {
-      return Err12({
+      return Err13({
         category: "agent_not_found",
         message: `Pi SDK not available: ${err instanceof Error ? err.message : String(err)}`
       });
@@ -5350,7 +5429,7 @@ var PiBackend = class {
 import { spawn as spawn3 } from "child_process";
 import {
   Ok as Ok16,
-  Err as Err13
+  Err as Err14
 } from "@harness-engineering/types";
 var DEFAULT_TIMEOUT_MS2 = 9e4;
 var FORBIDDEN_HOST_CHARS = /[;&|`$()\n\r<>]/;
@@ -5359,30 +5438,8 @@ var SshBackend = class {
   config;
   spawnImpl;
   constructor(config) {
-    if (!config.host || typeof config.host !== "string") {
-      throw new Error("SshBackend: `host` is required");
-    }
-    if (FORBIDDEN_HOST_CHARS.test(config.host) || config.host.startsWith("-")) {
-      throw new Error(
-        `SshBackend: invalid host '${config.host}' (contains shell metacharacters or starts with '-')`
-      );
-    }
-    if (!config.remoteCommand || typeof config.remoteCommand !== "string") {
-      throw new Error("SshBackend: `remoteCommand` is required");
-    }
-    if (config.user !== void 0 && /[\s;&|`$]/.test(config.user)) {
-      throw new Error(`SshBackend: invalid user '${config.user}'`);
-    }
-    this.config = {
-      host: config.host,
-      remoteCommand: config.remoteCommand,
-      sshBinary: config.sshBinary ?? "ssh",
-      sshOptions: config.sshOptions ?? [],
-      timeoutMs: config.timeoutMs ?? DEFAULT_TIMEOUT_MS2,
-      ...config.user !== void 0 ? { user: config.user } : {},
-      ...config.port !== void 0 ? { port: config.port } : {},
-      ...config.identityFile !== void 0 ? { identityFile: config.identityFile } : {}
-    };
+    validateSshConfig(config);
+    this.config = normalizeSshConfig(config);
     this.spawnImpl = config.spawnImpl ?? spawn3;
   }
   /**
@@ -5497,7 +5554,7 @@ var SshBackend = class {
         });
       } catch (err) {
         resolve8(
-          Err13({
+          Err14({
             category: "agent_not_found",
             message: err instanceof Error ? err.message : "failed to spawn ssh"
           })
@@ -5520,7 +5577,7 @@ var SshBackend = class {
           resolve8(Ok16(void 0));
         } else {
           resolve8(
-            Err13({
+            Err14({
               category: "agent_not_found",
               message: `ssh health check failed (exit=${code ?? "null"}): ${stderr.slice(0, 500)}`
             })
@@ -5529,11 +5586,39 @@ var SshBackend = class {
       });
       child.on("error", (err) => {
         clearTimeout(timer);
-        resolve8(Err13({ category: "agent_not_found", message: err.message }));
+        resolve8(Err14({ category: "agent_not_found", message: err.message }));
       });
     });
   }
 };
+function validateSshConfig(config) {
+  if (!config.host || typeof config.host !== "string") {
+    throw new Error("SshBackend: `host` is required");
+  }
+  if (FORBIDDEN_HOST_CHARS.test(config.host) || config.host.startsWith("-")) {
+    throw new Error(
+      `SshBackend: invalid host '${config.host}' (contains shell metacharacters or starts with '-')`
+    );
+  }
+  if (!config.remoteCommand || typeof config.remoteCommand !== "string") {
+    throw new Error("SshBackend: `remoteCommand` is required");
+  }
+  if (config.user !== void 0 && /[\s;&|`$]/.test(config.user)) {
+    throw new Error(`SshBackend: invalid user '${config.user}'`);
+  }
+}
+function normalizeSshConfig(config) {
+  return {
+    host: config.host,
+    remoteCommand: config.remoteCommand,
+    sshBinary: config.sshBinary ?? "ssh",
+    sshOptions: config.sshOptions ?? [],
+    timeoutMs: config.timeoutMs ?? DEFAULT_TIMEOUT_MS2,
+    ...config.user !== void 0 ? { user: config.user } : {},
+    ...config.port !== void 0 ? { port: config.port } : {},
+    ...config.identityFile !== void 0 ? { identityFile: config.identityFile } : {}
+  };
+}
 function errResult(sessionId, message) {
   return {
     success: false,
@@ -5591,7 +5676,7 @@ function waitForExit(child) {
 import { spawn as spawn4 } from "child_process";
 import {
   Ok as Ok17,
-  Err as Err14
+  Err as Err15
 } from "@harness-engineering/types";
 var ServerlessBackend = class {
   handles = /* @__PURE__ */ new Map();
@@ -5643,23 +5728,8 @@ var OciServerlessBackend = class extends ServerlessBackend {
   envSource;
   constructor(config) {
     super();
-    if (!config.image || typeof config.image !== "string") {
-      throw new Error("OciServerlessBackend: `image` is required");
-    }
-    if (FORBIDDEN_IMAGE_CHARS.test(config.image) || config.image.startsWith("-")) {
-      throw new Error(
-        `OciServerlessBackend: invalid image '${config.image}' (contains shell metacharacters or starts with '-')`
-      );
-    }
-    this.config = {
-      image: config.image,
-      pullPolicy: config.pullPolicy ?? "if-not-present",
-      runtime: config.runtime ?? "docker",
-      envPassthrough: config.envPassthrough ?? [],
-      timeoutMs: config.timeoutMs ?? DEFAULT_OCI_TIMEOUT_MS,
-      extraArgs: sanitizeExtraArgs(config.extraArgs),
-      ...config.registry !== void 0 ? { registry: config.registry } : {}
-    };
+    validateOciImage(config.image);
+    this.config = resolveOciConfig(config);
     this.spawnImpl = config.spawnImpl ?? spawn4;
     this.envSource = config.envSource ?? process.env;
   }
@@ -5690,7 +5760,7 @@ var OciServerlessBackend = class extends ServerlessBackend {
     if (!result.ok) return result;
     const id = result.value.trim().split(/\s+/)[0] ?? "";
     if (!id) {
-      return Err14({
+      return Err15({
         category: "response_error",
         message: "OciServerlessBackend: empty container id from runtime"
       });
@@ -5750,7 +5820,7 @@ var OciServerlessBackend = class extends ServerlessBackend {
   }
   async teardown(handle) {
     if (handle.adapter !== this.name) {
-      return Err14({
+      return Err15({
         category: "response_error",
         message: `handle adapter mismatch: got '${handle.adapter}', expected '${this.name}'`
       });
@@ -5781,7 +5851,7 @@ var OciServerlessBackend = class extends ServerlessBackend {
         });
       } catch (err) {
         resolve8(
-          Err14({
+          Err15({
             category: "agent_not_found",
             message: err instanceof Error ? err.message : "failed to spawn runtime"
           })
@@ -5808,7 +5878,7 @@ var OciServerlessBackend = class extends ServerlessBackend {
           resolve8(Ok17(stdout));
         } else {
           resolve8(
-            Err14({
+            Err15({
               category: "response_error",
               message: `runtime '${binary} ${args.join(" ")}' exited ${code ?? "null"}: ${stderr.slice(0, 500)}`
             })
@@ -5817,11 +5887,32 @@ var OciServerlessBackend = class extends ServerlessBackend {
       });
       child.on("error", (err) => {
         clearTimeout(timer);
-        resolve8(Err14({ category: "agent_not_found", message: err.message }));
+        resolve8(Err15({ category: "agent_not_found", message: err.message }));
       });
     });
   }
 };
+function validateOciImage(image) {
+  if (!image || typeof image !== "string") {
+    throw new Error("OciServerlessBackend: `image` is required");
+  }
+  if (FORBIDDEN_IMAGE_CHARS.test(image) || image.startsWith("-")) {
+    throw new Error(
+      `OciServerlessBackend: invalid image '${image}' (contains shell metacharacters or starts with '-')`
+    );
+  }
+}
+function resolveOciConfig(config) {
+  return {
+    image: config.image,
+    pullPolicy: config.pullPolicy ?? "if-not-present",
+    runtime: config.runtime ?? "docker",
+    envPassthrough: config.envPassthrough ?? [],
+    timeoutMs: config.timeoutMs ?? DEFAULT_OCI_TIMEOUT_MS,
+    extraArgs: sanitizeExtraArgs(config.extraArgs),
+    ...config.registry !== void 0 ? { registry: config.registry } : {}
+  };
+}
 function sanitizeExtraArgs(extraArgs) {
   if (!extraArgs) return [];
   return extraArgs.filter((arg) => !BLOCKED_DOCKER_FLAGS.some((flag) => arg.startsWith(flag)));
@@ -5893,78 +5984,96 @@ function makeGetModel(model) {
   if (Array.isArray(model) && model.length > 0) return () => model[0] ?? null;
   return () => null;
 }
+function createClaudeBackend(def, options) {
+  return new ClaudeBackend(def.command ?? "claude", {
+    ...options.cacheMetrics ? { cacheMetrics: options.cacheMetrics } : {}
+  });
+}
+function createAnthropicBackend(def) {
+  return new AnthropicBackend({
+    model: def.model,
+    ...def.apiKey !== void 0 ? { apiKey: def.apiKey } : {}
+  });
+}
+function createOpenAIBackend(def) {
+  return new OpenAIBackend({
+    model: def.model,
+    ...def.apiKey !== void 0 ? { apiKey: def.apiKey } : {}
+  });
+}
+function createGeminiBackend(def) {
+  return new GeminiBackend({
+    model: def.model,
+    ...def.apiKey !== void 0 ? { apiKey: def.apiKey } : {}
+  });
+}
+function createLocalBackend(def) {
+  const isArray = Array.isArray(def.model);
+  return new LocalBackend({
+    endpoint: def.endpoint,
+    ...typeof def.model === "string" ? { model: def.model } : {},
+    ...isArray ? { getModel: makeGetModel(def.model) } : {},
+    ...def.apiKey !== void 0 ? { apiKey: def.apiKey } : {},
+    ...def.timeoutMs !== void 0 ? { timeoutMs: def.timeoutMs } : {}
+  });
+}
+function createPiBackend(def) {
+  const isArray = Array.isArray(def.model);
+  return new PiBackend({
+    endpoint: def.endpoint,
+    ...typeof def.model === "string" ? { model: def.model } : {},
+    ...isArray ? { getModel: makeGetModel(def.model) } : {},
+    ...def.apiKey !== void 0 ? { apiKey: def.apiKey } : {},
+    ...def.timeoutMs !== void 0 ? { timeoutMs: def.timeoutMs } : {}
+  });
+}
+function createSshBackend(def) {
+  return new SshBackend({
+    host: def.host,
+    remoteCommand: def.remoteCommand,
+    ...def.user !== void 0 ? { user: def.user } : {},
+    ...def.port !== void 0 ? { port: def.port } : {},
+    ...def.identityFile !== void 0 ? { identityFile: def.identityFile } : {},
+    ...def.sshOptions !== void 0 ? { sshOptions: def.sshOptions } : {},
+    ...def.sshBinary !== void 0 ? { sshBinary: def.sshBinary } : {}
+  });
+}
+function createServerlessBackend(def) {
+  switch (def.adapter) {
+    case "oci":
+      return new OciServerlessBackend({
+        image: def.image,
+        ...def.registry !== void 0 ? { registry: def.registry } : {},
+        ...def.pullPolicy !== void 0 ? { pullPolicy: def.pullPolicy } : {},
+        ...def.envPassthrough !== void 0 ? { envPassthrough: def.envPassthrough } : {},
+        ...def.runtime !== void 0 ? { runtime: def.runtime } : {}
+      });
+    default: {
+      const exhaustive = def.adapter;
+      throw new Error(`createBackend: unknown serverless adapter ${JSON.stringify(exhaustive)}`);
+    }
+  }
+}
 function createBackend(def, options = {}) {
   switch (def.type) {
     case "mock":
       return new MockBackend();
     case "claude":
-      return new ClaudeBackend(def.command ?? "claude", {
-        ...options.cacheMetrics ? { cacheMetrics: options.cacheMetrics } : {}
-      });
+      return createClaudeBackend(def, options);
     case "anthropic":
-      return new AnthropicBackend({
-        model: def.model,
-        ...def.apiKey !== void 0 ? { apiKey: def.apiKey } : {}
-      });
+      return createAnthropicBackend(def);
     case "openai":
-      return new OpenAIBackend({
-        model: def.model,
-        ...def.apiKey !== void 0 ? { apiKey: def.apiKey } : {}
-      });
+      return createOpenAIBackend(def);
     case "gemini":
-      return new GeminiBackend({
-        model: def.model,
-        ...def.apiKey !== void 0 ? { apiKey: def.apiKey } : {}
-      });
-    case "local": {
-      const isArray = Array.isArray(def.model);
-      return new LocalBackend({
-        endpoint: def.endpoint,
-        ...typeof def.model === "string" ? { model: def.model } : {},
-        ...isArray ? { getModel: makeGetModel(def.model) } : {},
-        ...def.apiKey !== void 0 ? { apiKey: def.apiKey } : {},
-        ...def.timeoutMs !== void 0 ? { timeoutMs: def.timeoutMs } : {}
-      });
-    }
-    case "pi": {
-      const isArray = Array.isArray(def.model);
-      return new PiBackend({
-        endpoint: def.endpoint,
-        ...typeof def.model === "string" ? { model: def.model } : {},
-        ...isArray ? { getModel: makeGetModel(def.model) } : {},
-        ...def.apiKey !== void 0 ? { apiKey: def.apiKey } : {},
-        ...def.timeoutMs !== void 0 ? { timeoutMs: def.timeoutMs } : {}
-      });
-    }
-    case "ssh": {
-      return new SshBackend({
-        host: def.host,
-        remoteCommand: def.remoteCommand,
-        ...def.user !== void 0 ? { user: def.user } : {},
-        ...def.port !== void 0 ? { port: def.port } : {},
-        ...def.identityFile !== void 0 ? { identityFile: def.identityFile } : {},
-        ...def.sshOptions !== void 0 ? { sshOptions: def.sshOptions } : {},
-        ...def.sshBinary !== void 0 ? { sshBinary: def.sshBinary } : {}
-      });
-    }
-    case "serverless": {
-      switch (def.adapter) {
-        case "oci":
-          return new OciServerlessBackend({
-            image: def.image,
-            ...def.registry !== void 0 ? { registry: def.registry } : {},
-            ...def.pullPolicy !== void 0 ? { pullPolicy: def.pullPolicy } : {},
-            ...def.envPassthrough !== void 0 ? { envPassthrough: def.envPassthrough } : {},
-            ...def.runtime !== void 0 ? { runtime: def.runtime } : {}
-          });
-        default: {
-          const exhaustive = def.adapter;
-          throw new Error(
-            `createBackend: unknown serverless adapter ${JSON.stringify(exhaustive)}`
-          );
-        }
-      }
-    }
+      return createGeminiBackend(def);
+    case "local":
+      return createLocalBackend(def);
+    case "pi":
+      return createPiBackend(def);
+    case "ssh":
+      return createSshBackend(def);
+    case "serverless":
+      return createServerlessBackend(def);
     default: {
       const exhaustive = def;
       throw new Error(`createBackend: unknown backend type ${JSON.stringify(exhaustive)}`);
@@ -5974,7 +6083,7 @@ function createBackend(def, options = {}) {
 
 // src/agent/backends/container.ts
 import {
-  Err as Err15
+  Err as Err16
 } from "@harness-engineering/types";
 function toAgentError(message, details) {
   return { category: "response_error", message, details };
@@ -6006,7 +6115,7 @@ var ContainerBackend = class {
     }
     const result = await this.secretBackend.resolveSecrets(this.secretKeys);
     if (!result.ok) {
-      return Err15(toAgentError(`Secret resolution failed: ${result.error.message}`, result.error));
+      return Err16(toAgentError(`Secret resolution failed: ${result.error.message}`, result.error));
     }
     return { ok: true, value: result.value };
   }
@@ -6031,7 +6140,7 @@ var ContainerBackend = class {
     const createOpts = this.buildCreateOpts(params, envResult.value);
     const containerResult = await this.runtime.createContainer(createOpts);
     if (!containerResult.ok) {
-      return Err15(
+      return Err16(
         toAgentError(
           `Container creation failed: ${containerResult.error.message}`,
           containerResult.error
@@ -6056,7 +6165,7 @@ var ContainerBackend = class {
       this.containerHandles.delete(session.sessionId);
       const removeResult = await this.runtime.removeContainer(handle);
       if (!removeResult.ok) {
-        return Err15(
+        return Err16(
           toAgentError(
             `Container removal failed: ${removeResult.error.message}`,
             removeResult.error
@@ -6069,7 +6178,7 @@ var ContainerBackend = class {
   async healthCheck() {
     const runtimeResult = await this.runtime.healthCheck();
     if (!runtimeResult.ok) {
-      return Err15({
+      return Err16({
         category: "agent_not_found",
         message: `Container runtime unhealthy: ${runtimeResult.error.message}`,
         details: runtimeResult.error
@@ -6081,7 +6190,7 @@ var ContainerBackend = class {
 
 // src/agent/runtime/docker.ts
 import { execFile as execFile3, spawn as spawn5 } from "child_process";
-import { Ok as Ok18, Err as Err16 } from "@harness-engineering/types";
+import { Ok as Ok18, Err as Err17 } from "@harness-engineering/types";
 function dockerExec(args) {
   return new Promise((resolve8, reject) => {
     execFile3("docker", args, (error, stdout) => {
@@ -6116,7 +6225,7 @@ var DockerRuntime = class {
       const containerId = await dockerExec(args);
       return Ok18({ containerId, runtime: this.name });
     } catch (error) {
-      return Err16({
+      return Err17({
         category: "container_create_failed",
         message: `Failed to create container: ${error instanceof Error ? error.message : String(error)}`,
         details: error
@@ -6162,7 +6271,7 @@ var DockerRuntime = class {
       await dockerExec(["rm", "-f", handle.containerId]);
       return Ok18(void 0);
     } catch (error) {
-      return Err16({
+      return Err17({
         category: "container_remove_failed",
         message: `Failed to remove container: ${error instanceof Error ? error.message : String(error)}`,
         details: error
@@ -6174,7 +6283,7 @@ var DockerRuntime = class {
       await dockerExec(["info", "--format", "{{.ServerVersion}}"]);
       return Ok18(void 0);
     } catch (error) {
-      return Err16({
+      return Err17({
         category: "runtime_not_found",
         message: `Docker is not available: ${error instanceof Error ? error.message : String(error)}`,
         details: error
@@ -6184,7 +6293,7 @@ var DockerRuntime = class {
 };
 
 // src/agent/secrets/env.ts
-import { Ok as Ok19, Err as Err17 } from "@harness-engineering/types";
+import { Ok as Ok19, Err as Err18 } from "@harness-engineering/types";
 var EnvSecretBackend = class {
   name = "env";
   async resolveSecrets(keys) {
@@ -6192,7 +6301,7 @@ var EnvSecretBackend = class {
     for (const key of keys) {
       const value = process.env[key];
       if (value === void 0) {
-        return Err17({
+        return Err18({
           category: "secret_not_found",
           message: `Environment variable '${key}' is not set`,
           key
@@ -6209,7 +6318,7 @@ var EnvSecretBackend = class {
 
 // src/agent/secrets/onepassword.ts
 import { execFile as execFile4 } from "child_process";
-import { Ok as Ok20, Err as Err18 } from "@harness-engineering/types";
+import { Ok as Ok20, Err as Err19 } from "@harness-engineering/types";
 function opExec(args) {
   return new Promise((resolve8, reject) => {
     execFile4("op", args, (error, stdout) => {
@@ -6234,7 +6343,7 @@ var OnePasswordSecretBackend = class {
         const value = await opExec(["read", `op://${this.vault}/${key}/password`]);
         secrets[key] = value;
       } catch (error) {
-        return Err18({
+        return Err19({
           category: "access_denied",
           message: `Failed to read secret '${key}' from 1Password: ${error instanceof Error ? error.message : String(error)}`,
           key
@@ -6248,7 +6357,7 @@ var OnePasswordSecretBackend = class {
       await opExec(["--version"]);
       return Ok20(void 0);
     } catch (error) {
-      return Err18({
+      return Err19({
         category: "provider_unavailable",
         message: `1Password CLI is not available: ${error instanceof Error ? error.message : String(error)}`
       });
@@ -6258,7 +6367,7 @@ var OnePasswordSecretBackend = class {
 
 // src/agent/secrets/vault.ts
 import { execFile as execFile5 } from "child_process";
-import { Ok as Ok21, Err as Err19 } from "@harness-engineering/types";
+import { Ok as Ok21, Err as Err20 } from "@harness-engineering/types";
 function vaultExec(args, env) {
   return new Promise((resolve8, reject) => {
     execFile5("vault", args, { env: { ...process.env, ...env } }, (error, stdout) => {
@@ -6289,11 +6398,11 @@ var VaultSecretBackend = class {
     } catch (error) {
       const msg = error instanceof Error ? error.message : String(error);
       const category = error instanceof SyntaxError ? "access_denied" : "access_denied";
-      return Err19({ category, message: `Failed to read from Vault: ${msg}` });
+      return Err20({ category, message: `Failed to read from Vault: ${msg}` });
     }
     const missing = keys.find((k) => !(k in data));
     if (missing) {
-      return Err19({
+      return Err20({
         category: "secret_not_found",
         message: `Secret key '${missing}' not found in Vault path '${this.path}'`,
         key: missing
@@ -6308,7 +6417,7 @@ var VaultSecretBackend = class {
       await vaultExec(["version"]);
       return Ok21(void 0);
     } catch (error) {
-      return Err19({
+      return Err20({
         category: "provider_unavailable",
         message: `Vault CLI is not available: ${error instanceof Error ? error.message : String(error)}`
       });
@@ -6437,6 +6546,96 @@ var OrchestratorBackendFactory = class {
   }
 };
 
+// src/agent/backend-resolver.ts
+function makeBackendResolver(backends) {
+  return (backendName) => {
+    const def = backends?.[backendName];
+    return def ? createBackend(def) : null;
+  };
+}
+
+// src/maintenance/agent-dispatcher.ts
+function syntheticIssue(branch, skill) {
+  return {
+    id: `maintenance:${branch}`,
+    identifier: branch,
+    title: `Maintenance: ${skill}`,
+    description: null,
+    priority: null,
+    state: "in_progress",
+    branchName: branch,
+    url: null,
+    labels: ["maintenance"],
+    blockedBy: [],
+    spec: null,
+    plans: [],
+    createdAt: null,
+    updatedAt: null,
+    externalId: null
+  };
+}
+function buildPrompt(skill, promptContext) {
+  const instruction = `Run the \`${skill}\` skill to detect and fix issues in this repository. Apply the fixes and commit each logical change. If there is nothing to fix, make no commits.`;
+  return promptContext ? `${promptContext}
+
+${instruction}` : instruction;
+}
+function headOf(git2, cwd) {
+  try {
+    return git2(["rev-parse", "HEAD"], cwd) || null;
+  } catch {
+    return null;
+  }
+}
+function createAgentDispatcher(deps) {
+  const maxTurns = deps.maxTurns ?? 10;
+  const dispatch = async (skill, branch, backendName, cwd, options) => {
+    const backend = deps.resolveBackend(backendName);
+    if (!backend) {
+      deps.logger.warn(`Maintenance agent dispatch skipped: unknown backend "${backendName}"`, {
+        skill,
+        branch
+      });
+      return { producedCommits: false, fixed: 0 };
+    }
+    const before = headOf(deps.git, cwd);
+    const runner = new AgentRunner(backend, { maxTurns });
+    const session = runner.runSession(
+      syntheticIssue(branch, skill),
+      cwd,
+      buildPrompt(skill, options?.promptContext)
+    );
+    let step = await session.next();
+    while (!step.done) step = await session.next();
+    const after = headOf(deps.git, cwd);
+    let fixed = 0;
+    if (after && after !== before) {
+      if (before) {
+        try {
+          fixed = parseInt(deps.git(["rev-list", "--count", `${before}..${after}`], cwd), 10) || 0;
+        } catch {
+          fixed = 1;
+        }
+      } else {
+        fixed = 1;
+      }
+    }
+    const producedCommits = fixed > 0;
+    deps.logger.info("Maintenance agent dispatch complete", {
+      skill,
+      branch,
+      backendName,
+      producedCommits,
+      fixed
+    });
+    return { producedCommits, fixed };
+  };
+  return { dispatch };
+}
+
+// src/orchestrator.ts
+import { execFileSync } from "child_process";
+
 // src/agent/intelligence-factory.ts
 import {
   IntelligencePipeline,
@@ -6947,7 +7146,7 @@ function handleV1InteractionsResolveRoute(req, res, queue) {
 
 // src/server/routes/plans.ts
 import { z as z5 } from "zod";
-import * as fs10 from "fs/promises";
+import * as fs9 from "fs/promises";
 import * as path11 from "path";
 var PlanWriteSchema = z5.object({
   filename: z5.string().min(1),
@@ -6976,9 +7175,9 @@ function handlePlansRoute(req, res, plansDir) {
           );
           return;
         }
-        await fs10.mkdir(plansDir, { recursive: true });
+        await fs9.mkdir(plansDir, { recursive: true });
         const filePath = path11.join(plansDir, basename3);
-        await fs10.writeFile(filePath, parsed.content, "utf-8");
+        await fs9.writeFile(filePath, parsed.content, "utf-8");
         res.writeHead(201, { "Content-Type": "application/json" });
         res.end(JSON.stringify({ ok: true, filename: basename3 }));
       } catch {
@@ -7353,11 +7552,10 @@ function handleAnalyzeRoute(req, res, pipeline) {
 }
 
 // src/server/routes/roadmap-actions.ts
-import * as fs11 from "fs/promises";
 import * as path12 from "path";
 import {
-  parseRoadmap as parseRoadmap2,
-  serializeRoadmap as serializeRoadmap2,
+  resolveRoadmapStoreForFile as resolveRoadmapStoreForFile2,
+  applyRoadmapDiff as applyRoadmapDiff2,
   loadProjectRoadmapMode,
   loadTrackerClientConfigFromProject,
   createTrackerClient,
@@ -7443,13 +7641,14 @@ function handleRoadmapActionsRoute(req, res, roadmapPath) {
         sendJSON2(res, 400, { error: "Title must not contain newlines or markdown headings" });
         return;
       }
-      const content = await fs11.readFile(roadmapPath, "utf-8");
-      const roadmapResult = parseRoadmap2(content);
-      if (!roadmapResult.ok) {
+      const store = resolveRoadmapStoreForFile2({ roadmapPath });
+      const loaded = await store.load();
+      if (!loaded.ok) {
         sendJSON2(res, 500, { error: "Failed to parse roadmap file" });
         return;
       }
-      const roadmap = roadmapResult.value;
+      const roadmap = loaded.value;
+      const before = structuredClone(roadmap);
       let backlog = roadmap.milestones.find((m) => m.isBacklog);
       if (!backlog) {
         backlog = { name: "Backlog", isBacklog: true, features: [] };
@@ -7472,10 +7671,11 @@ function handleRoadmapActionsRoute(req, res, roadmapPath) {
         updatedAt: null
       });
       roadmap.frontmatter.lastManualEdit = (/* @__PURE__ */ new Date()).toISOString();
-      const tmpPath = roadmapPath + ".tmp";
-      const serialized = serializeRoadmap2(roadmap);
-      await fs11.writeFile(tmpPath, serialized, "utf-8");
-      await fs11.rename(tmpPath, roadmapPath);
+      const persisted = await applyRoadmapDiff2(store, before, roadmap);
+      if (!persisted.ok) {
+        sendJSON2(res, 500, { error: persisted.error.message });
+        return;
+      }
       sendJSON2(res, 201, { ok: true, featureName: parsed.title });
     } catch (err) {
       const msg = err instanceof Error ? err.message : "Failed to append to roadmap";
@@ -7741,7 +7941,6 @@ function handleV1JobsMaintenanceRoute(req, res, deps) {
 }
 
 // src/server/routes/v1/events-sse.ts
-import { randomBytes as randomBytes2 } from "crypto";
 var SSE_TOPICS = [
   "state_change",
   "agent_event",
@@ -7757,8 +7956,55 @@ var SSE_TOPICS = [
   "webhook.subscription.deleted"
 ];
 var HEARTBEAT_MS = 15e3;
-function newEventId() {
-  return `evt_${randomBytes2(8).toString("hex")}`;
+var DEFAULT_REPLAY_BUFFER = 1024;
+var SseEventLog = class {
+  seq = 0;
+  buffer = [];
+  subscribers = /* @__PURE__ */ new Set();
+  constructor(bus, cap = DEFAULT_REPLAY_BUFFER) {
+    this.cap = cap;
+    for (const topic of SSE_TOPICS) {
+      bus.on(topic, (data) => this.record(topic, data));
+    }
+  }
+  cap;
+  record(topic, data) {
+    const event = { id: ++this.seq, topic, data };
+    this.buffer.push(event);
+    if (this.buffer.length > this.cap) this.buffer.shift();
+    for (const fn of this.subscribers) fn(event);
+  }
+  /** Highest assigned id (0 when nothing has been recorded yet). */
+  currentSeq() {
+    return this.seq;
+  }
+  /** Buffered events strictly newer than `lastId`, oldest-first. */
+  replayFrom(lastId) {
+    return this.buffer.filter((e) => e.id > lastId);
+  }
+  /** Register a live listener; returns an unsubscribe function. */
+  subscribe(fn) {
+    this.subscribers.add(fn);
+    return () => {
+      this.subscribers.delete(fn);
+    };
+  }
+};
+var logsByBus = /* @__PURE__ */ new WeakMap();
+function getSseEventLog(bus) {
+  let log = logsByBus.get(bus);
+  if (!log) {
+    log = new SseEventLog(bus);
+    logsByBus.set(bus, log);
+  }
+  return log;
+}
+function parseLastEventId(req) {
+  const raw = req.headers["last-event-id"];
+  const value = Array.isArray(raw) ? raw[0] : raw;
+  if (value === void 0) return null;
+  const n = Number(value);
+  return Number.isInteger(n) && n >= 0 ? n : null;
 }
 function handleV1EventsSseRoute(req, res, bus) {
   if (req.method !== "GET" || req.url !== "/api/v1/events") return false;
@@ -7770,22 +8016,28 @@ function handleV1EventsSseRoute(req, res, bus) {
   res.write(`: harness gateway SSE \u2014 connected at ${(/* @__PURE__ */ new Date()).toISOString()}
 
 `);
-  const listeners = [];
-  for (const topic of SSE_TOPICS) {
-    const fn = (data) => {
-      try {
-        const frame = `event: ${topic}
-data: ${JSON.stringify(data)}
-id: ${newEventId()}
+  const log = getSseEventLog(bus);
+  const send = (e) => {
+    try {
+      res.write(`event: ${e.topic}
+data: ${JSON.stringify(e.data)}
+id: ${e.id}
 
-`;
-        res.write(frame);
-      } catch {
-      }
-    };
-    bus.on(topic, fn);
-    listeners.push({ topic, fn });
+`);
+    } catch {
+    }
+  };
+  const lastId = parseLastEventId(req);
+  let replayedThrough = lastId ?? log.currentSeq();
+  if (lastId !== null) {
+    for (const e of log.replayFrom(lastId)) {
+      send(e);
+      replayedThrough = e.id;
+    }
   }
+  const unsubscribe = log.subscribe((e) => {
+    if (e.id > replayedThrough) send(e);
+  });
   const heartbeat = setInterval(() => {
     try {
       res.write(": heartbeat\n\n");
@@ -7795,7 +8047,7 @@ id: ${newEventId()}
   heartbeat.unref();
   const cleanup = () => {
     clearInterval(heartbeat);
-    for (const { topic, fn } of listeners) bus.removeListener(topic, fn);
+    unsubscribe();
   };
   res.on("close", cleanup);
   res.on("finish", cleanup);
@@ -8115,7 +8367,7 @@ async function runGate(projectPath, proposalId) {
 }
 
 // src/proposals/promote.ts
-import * as fs12 from "fs";
+import * as fs10 from "fs";
 import * as path13 from "path";
 import { parse as parseYaml3, stringify as stringifyYaml } from "yaml";
 import {
@@ -8141,7 +8393,7 @@ function skillDir(projectPath, name) {
 }
 function readIfExists(p) {
   try {
-    return fs12.readFileSync(p, "utf-8");
+    return fs10.readFileSync(p, "utf-8");
   } catch {
     return null;
   }
@@ -8187,15 +8439,15 @@ function assertGateReady(proposal) {
 }
 async function promoteNewSkill(projectPath, proposal) {
   const target = skillDir(projectPath, proposal.content.name);
-  if (fs12.existsSync(target)) {
+  if (fs10.existsSync(target)) {
     throw new PromotionError(
       `a catalog skill already exists at ${target}; use a refinement proposal to update it`
     );
   }
-  fs12.mkdirSync(target, { recursive: true });
+  fs10.mkdirSync(target, { recursive: true });
   const yamlOut = injectProvenanceIntoYaml(proposal.content.skillYaml ?? "", proposal.id);
-  fs12.writeFileSync(path13.join(target, "skill.yaml"), yamlOut);
-  fs12.writeFileSync(path13.join(target, "SKILL.md"), proposal.content.skillMd ?? "");
+  fs10.writeFileSync(path13.join(target, "skill.yaml"), yamlOut);
+  fs10.writeFileSync(path13.join(target, "SKILL.md"), proposal.content.skillMd ?? "");
   return { skillPath: target };
 }
 async function promoteRefinement(projectPath, proposal) {
@@ -8203,7 +8455,7 @@ async function promoteRefinement(projectPath, proposal) {
     throw new PromotionError("refinement proposal is missing targetSkill");
   }
   const target = skillDir(projectPath, proposal.targetSkill);
-  if (!fs12.existsSync(target)) {
+  if (!fs10.existsSync(target)) {
     throw new PromotionError(
       `target skill ${proposal.targetSkill} does not exist at ${target}; cannot refine`
     );
@@ -8216,7 +8468,7 @@ async function promoteRefinement(projectPath, proposal) {
       "no metadata changes detected; check that the reviewer applied the proposed diff before approving"
     );
   }
-  fs12.writeFileSync(yamlPath, after);
+  fs10.writeFileSync(yamlPath, after);
   return { skillPath: target };
 }
 async function promote(projectPath, proposalId, decidedBy) {
@@ -8654,7 +8906,7 @@ function handleV1RoutingRoute(req, res, deps) {
 }
 
 // src/server/routes/sessions.ts
-import * as fs13 from "fs/promises";
+import * as fs11 from "fs/promises";
 import * as path14 from "path";
 import { z as z15 } from "zod";
 var SessionCreateSchema = z15.object({
@@ -8675,12 +8927,12 @@ function extractSessionId(url) {
 }
 async function handleList2(res, sessionsDir) {
   try {
-    const entries = await fs13.readdir(sessionsDir, { withFileTypes: true });
+    const entries = await fs11.readdir(sessionsDir, { withFileTypes: true });
     const sessions = [];
     for (const entry of entries) {
       if (!entry.isDirectory()) continue;
       try {
-        const content = await fs13.readFile(
+        const content = await fs11.readFile(
           path14.join(sessionsDir, entry.name, "session.json"),
           "utf-8"
         );
@@ -8706,7 +8958,7 @@ async function handleGet2(res, id, sessionsDir) {
     return;
   }
   try {
-    const content = await fs13.readFile(path14.join(sessionsDir, id, "session.json"), "utf-8");
+    const content = await fs11.readFile(path14.join(sessionsDir, id, "session.json"), "utf-8");
     jsonResponse(res, 200, JSON.parse(content));
   } catch (err) {
     if (err.code === "ENOENT") {
@@ -8730,8 +8982,8 @@ async function handleCreate(req, res, sessionsDir) {
       return;
     }
     const sessionDir = path14.join(sessionsDir, session.sessionId);
-    await fs13.mkdir(sessionDir, { recursive: true });
-    await fs13.writeFile(path14.join(sessionDir, "session.json"), JSON.stringify(session, null, 2));
+    await fs11.mkdir(sessionDir, { recursive: true });
+    await fs11.writeFile(path14.join(sessionDir, "session.json"), JSON.stringify(session, null, 2));
     jsonResponse(res, 200, { ok: true });
   } catch {
     jsonResponse(res, 500, { error: "Failed to save session" });
@@ -8747,8 +8999,8 @@ async function handleUpdate(req, res, url, sessionsDir) {
     const body = await readBody(req);
     const updates = z15.record(z15.unknown()).parse(JSON.parse(body));
     const sessionFilePath = path14.join(sessionsDir, id, "session.json");
-    const current = JSON.parse(await fs13.readFile(sessionFilePath, "utf-8"));
-    await fs13.writeFile(sessionFilePath, JSON.stringify({ ...current, ...updates }, null, 2));
+    const current = JSON.parse(await fs11.readFile(sessionFilePath, "utf-8"));
+    await fs11.writeFile(sessionFilePath, JSON.stringify({ ...current, ...updates }, null, 2));
     jsonResponse(res, 200, { ok: true });
   } catch {
     jsonResponse(res, 500, { error: "Failed to update session" });
@@ -8761,7 +9013,7 @@ async function handleDelete(res, url, sessionsDir) {
       jsonResponse(res, 400, { error: "Missing or invalid sessionId" });
       return;
     }
-    await fs13.rm(path14.join(sessionsDir, id), { recursive: true, force: true });
+    await fs11.rm(path14.join(sessionsDir, id), { recursive: true, force: true });
     jsonResponse(res, 200, { ok: true });
   } catch {
     jsonResponse(res, 500, { error: "Failed to delete session" });
@@ -9009,7 +9261,7 @@ function handleLocalModelsRoute(req, res, getStatuses) {
 }
 
 // src/server/static.ts
-import * as fs14 from "fs";
+import * as fs12 from "fs";
 import * as path15 from "path";
 var MIME_TYPES = {
   ".html": "text/html; charset=utf-8",
@@ -9039,11 +9291,11 @@ function handleStaticFile(req, res, dashboardDir) {
   if (!resolved.startsWith(path15.resolve(dashboardDir))) {
     return serveFile(path15.join(dashboardDir, "index.html"), res);
   }
-  if (fs14.existsSync(resolved) && fs14.statSync(resolved).isFile()) {
+  if (fs12.existsSync(resolved) && fs12.statSync(resolved).isFile()) {
     return serveFile(resolved, res);
   }
   const indexPath = path15.join(dashboardDir, "index.html");
-  if (fs14.existsSync(indexPath)) {
+  if (fs12.existsSync(indexPath)) {
     return serveFile(indexPath, res);
   }
   return false;
@@ -9052,7 +9304,7 @@ function serveFile(filePath, res) {
   const ext = path15.extname(filePath).toLowerCase();
   const contentType = MIME_TYPES[ext] ?? "application/octet-stream";
   try {
-    const content = fs14.readFileSync(filePath);
+    const content = fs12.readFileSync(filePath);
     res.writeHead(200, { "Content-Type": contentType });
     res.end(content);
     return true;
@@ -9062,7 +9314,7 @@ function serveFile(filePath, res) {
 }
 
 // src/server/plan-watcher.ts
-import * as fs15 from "fs";
+import * as fs13 from "fs";
 import * as path16 from "path";
 var PlanWatcher = class {
   plansDir;
@@ -9077,11 +9329,11 @@ var PlanWatcher = class {
    * Creates the directory if it does not exist.
    */
   start() {
-    fs15.mkdirSync(this.plansDir, { recursive: true });
-    this.watcher = fs15.watch(this.plansDir, (eventType, filename) => {
+    fs13.mkdirSync(this.plansDir, { recursive: true });
+    this.watcher = fs13.watch(this.plansDir, (eventType, filename) => {
       if (eventType === "rename" && filename && filename.endsWith(".md")) {
         const filePath = path16.join(this.plansDir, filename);
-        if (fs15.existsSync(filePath)) {
+        if (fs13.existsSync(filePath)) {
           void this.handleNewPlan(filename);
         }
       }
@@ -9112,8 +9364,8 @@ var PlanWatcher = class {
 };
 
 // src/auth/tokens.ts
-import { randomBytes as randomBytes3, timingSafeEqual } from "crypto";
-import { readFile as readFile8, writeFile as writeFile8, mkdir as mkdir7, rename as rename2 } from "fs/promises";
+import { randomBytes as randomBytes2, timingSafeEqual } from "crypto";
+import { readFile as readFile6, writeFile as writeFile6, mkdir as mkdir7, rename } from "fs/promises";
 import { dirname as dirname5 } from "path";
 import bcrypt from "bcryptjs";
 import {
@@ -9123,10 +9375,10 @@ import {
 var BCRYPT_ROUNDS = 12;
 var LEGACY_ENV_ID = "tok_legacy_env";
 function genId() {
-  return `tok_${randomBytes3(8).toString("hex")}`;
+  return `tok_${randomBytes2(8).toString("hex")}`;
 }
 function genSecret() {
-  return randomBytes3(24).toString("base64url");
+  return randomBytes2(24).toString("base64url");
 }
 function parseToken(raw) {
   const dot = raw.indexOf(".");
@@ -9142,7 +9394,7 @@ var TokenStore = class {
   async load() {
     if (this.cache) return this.cache;
     try {
-      const raw = await readFile8(this.path, "utf8");
+      const raw = await readFile6(this.path, "utf8");
       const parsed = JSON.parse(raw);
       const list = Array.isArray(parsed) ? parsed : [];
       this.cache = list.map((entry) => {
@@ -9157,9 +9409,9 @@ var TokenStore = class {
   }
   async persist(records) {
     await mkdir7(dirname5(this.path), { recursive: true });
-    const tmp = `${this.path}.tmp-${process.pid}-${Date.now()}-${randomBytes3(4).toString("hex")}`;
-    await writeFile8(tmp, JSON.stringify(records, null, 2), "utf8");
-    await rename2(tmp, this.path);
+    const tmp = `${this.path}.tmp-${process.pid}-${Date.now()}-${randomBytes2(4).toString("hex")}`;
+    await writeFile6(tmp, JSON.stringify(records, null, 2), "utf8");
+    await rename(tmp, this.path);
     this.cache = records;
   }
   async create(input) {
@@ -9409,26 +9661,41 @@ function hasScope(held, required) {
   if (held.includes("admin")) return true;
   return held.includes(required);
 }
-function requiredScopeForRoute(method, path24) {
-  const bridgeScope = requiredBridgeScope(method, path24);
-  if (bridgeScope) return bridgeScope;
+function exactScopeForRoute(method, path24) {
   if (path24 === "/api/v1/auth/token" && method === "POST") return "admin";
   if (path24 === "/api/v1/auth/tokens" && method === "GET") return "admin";
   if (/^\/api\/v1\/auth\/tokens\/[^/]+$/.test(path24) && method === "DELETE") return "admin";
   if ((path24 === "/api/state" || path24 === "/api/v1/state") && method === "GET") return "read-status";
-  if (path24.startsWith("/api/interactions")) return "resolve-interaction";
-  if (path24.startsWith("/api/plans")) return "read-status";
-  if (path24.startsWith("/api/analyze") || path24.startsWith("/api/analyses")) return "read-status";
-  if (path24.startsWith("/api/roadmap-actions")) return "modify-roadmap";
-  if (path24.startsWith("/api/dispatch-actions")) return "trigger-job";
-  if (path24.startsWith("/api/local-model") || path24.startsWith("/api/local-models"))
-    return "read-status";
-  if (path24.startsWith("/api/maintenance")) return "trigger-job";
-  if (path24.startsWith("/api/streams")) return "read-status";
-  if (path24.startsWith("/api/sessions")) return "read-status";
-  if (path24 === "/api/chat" || path24.startsWith("/api/chat-proxy")) return "trigger-job";
   return null;
 }
+var PREFIX_SCOPES = [
+  ["/api/interactions", "resolve-interaction"],
+  ["/api/plans", "read-status"],
+  ["/api/analyze", "read-status"],
+  ["/api/analyses", "read-status"],
+  ["/api/roadmap-actions", "modify-roadmap"],
+  ["/api/dispatch-actions", "trigger-job"],
+  ["/api/local-model", "read-status"],
+  ["/api/local-models", "read-status"],
+  ["/api/maintenance", "trigger-job"],
+  ["/api/streams", "read-status"],
+  ["/api/sessions", "read-status"],
+  ["/api/chat-proxy", "trigger-job"]
+];
+function prefixScopeForPath(path24) {
+  if (path24 === "/api/chat") return "trigger-job";
+  for (const [prefix, scope] of PREFIX_SCOPES) {
+    if (path24.startsWith(prefix)) return scope;
+  }
+  return null;
+}
+function requiredScopeForRoute(method, path24) {
+  const bridgeScope = requiredBridgeScope(method, path24);
+  if (bridgeScope) return bridgeScope;
+  const exactScope = exactScopeForRoute(method, path24);
+  if (exactScope) return exactScope;
+  return prefixScopeForPath(path24);
+}
 
 // src/server/http.ts
 var RATE_LIMIT = Number(process.env["HARNESS_RATE_LIMIT"]) || 100;
@@ -9843,8 +10110,8 @@ var OrchestratorServer = class {
 };
 
 // src/gateway/webhooks/store.ts
-import { randomBytes as randomBytes4 } from "crypto";
-import { readFile as readFile9, writeFile as writeFile9, mkdir as mkdir9, rename as rename3, chmod } from "fs/promises";
+import { randomBytes as randomBytes3 } from "crypto";
+import { readFile as readFile7, writeFile as writeFile7, mkdir as mkdir9, rename as rename2, chmod } from "fs/promises";
 import { dirname as dirname7 } from "path";
 import { WebhookSubscriptionSchema } from "@harness-engineering/types";
 
@@ -9870,10 +10137,10 @@ function eventMatches(pattern, type) {
 
 // src/gateway/webhooks/store.ts
 function genId2() {
-  return `whk_${randomBytes4(8).toString("hex")}`;
+  return `whk_${randomBytes3(8).toString("hex")}`;
 }
 function genSecret2() {
-  return randomBytes4(32).toString("base64url");
+  return randomBytes3(32).toString("base64url");
 }
 var WebhookStore = class {
   constructor(path24) {
@@ -9884,7 +10151,7 @@ var WebhookStore = class {
   async load() {
     if (this.cache) return this.cache;
     try {
-      const raw = await readFile9(this.path, "utf8");
+      const raw = await readFile7(this.path, "utf8");
       const parsed = JSON.parse(raw);
       const list = Array.isArray(parsed) ? parsed : [];
       this.cache = list.map((entry) => {
@@ -9898,11 +10165,11 @@ var WebhookStore = class {
     return this.cache;
   }
   async persist(records) {
-    const tmp = `${this.path}.tmp-${process.pid}-${Date.now()}-${randomBytes4(4).toString("hex")}`;
+    const tmp = `${this.path}.tmp-${process.pid}-${Date.now()}-${randomBytes3(4).toString("hex")}`;
     try {
       await mkdir9(dirname7(this.path), { recursive: true });
-      await writeFile9(tmp, JSON.stringify(records, null, 2), { encoding: "utf8", mode: 384 });
-      await rename3(tmp, this.path);
+      await writeFile7(tmp, JSON.stringify(records, null, 2), { encoding: "utf8", mode: 384 });
+      await rename2(tmp, this.path);
       await chmod(this.path, 384);
     } catch (err) {
       if (err.code !== "ENOENT") throw err;
@@ -9942,7 +10209,7 @@ var WebhookStore = class {
 };
 
 // src/gateway/webhooks/delivery.ts
-import { randomBytes as randomBytes5 } from "crypto";
+import { randomBytes as randomBytes4 } from "crypto";
 
 // src/gateway/webhooks/queue.ts
 import Database from "better-sqlite3";
@@ -10152,7 +10419,7 @@ var WebhookDelivery = class {
   enqueue(sub, event) {
     const payload = JSON.stringify(event);
     this.queue.insert({
-      id: `dlv_${randomBytes5(8).toString("hex")}`,
+      id: `dlv_${randomBytes4(8).toString("hex")}`,
       subscriptionId: sub.id,
       eventType: event.type,
       payload
@@ -10260,7 +10527,7 @@ var WebhookDelivery = class {
 };
 
 // src/gateway/webhooks/events.ts
-import { randomBytes as randomBytes6 } from "crypto";
+import { randomBytes as randomBytes5 } from "crypto";
 var WEBHOOK_TOPICS = [
   "interaction.created",
   "interaction.resolved",
@@ -10275,8 +10542,8 @@ var WEBHOOK_TOPICS = [
   "proposal.approved",
   "proposal.rejected"
 ];
-function newEventId2() {
-  return `evt_${randomBytes6(8).toString("hex")}`;
+function newEventId() {
+  return `evt_${randomBytes5(8).toString("hex")}`;
 }
 function wireWebhookFanout({ bus, store, delivery }) {
   const handlers = [];
@@ -10287,7 +10554,7 @@ function wireWebhookFanout({ bus, store, delivery }) {
         const subs = await store.listForEvent(eventType);
         if (subs.length === 0) return;
         const event = {
-          id: newEventId2(),
+          id: newEventId(),
           type: eventType,
           timestamp: (/* @__PURE__ */ new Date()).toISOString(),
           data
@@ -10306,7 +10573,7 @@ function wireWebhookFanout({ bus, store, delivery }) {
 }
 
 // src/gateway/telemetry/fanout.ts
-import { randomBytes as randomBytes7 } from "crypto";
+import { randomBytes as randomBytes6 } from "crypto";
 import { SpanKind } from "@harness-engineering/core";
 var TOPICS = {
   MAINTENANCE_STARTED: "maintenance:started",
@@ -10329,14 +10596,14 @@ var SPAN_NAME = {
   [TOPICS.DISPATCH_DECISION]: "dispatch_decision",
   [TOPICS.SKILL_INVOCATION]: "skill_invocation"
 };
-function newEventId3() {
-  return `evt_${randomBytes7(8).toString("hex")}`;
+function newEventId2() {
+  return `evt_${randomBytes6(8).toString("hex")}`;
 }
 function newTraceId() {
-  return randomBytes7(16).toString("hex");
+  return randomBytes6(16).toString("hex");
 }
 function newSpanId() {
-  return randomBytes7(8).toString("hex");
+  return randomBytes6(8).toString("hex");
 }
 function nowNs() {
   return BigInt(Date.now()) * 1000000n;
@@ -10387,79 +10654,102 @@ function buildAttributes(payload, extras = {}) {
   }
   return attrs;
 }
+function extractIds(payload) {
+  const correlationId = typeof payload["correlationId"] === "string" ? payload["correlationId"] : void 0;
+  const taskId = typeof payload["taskId"] === "string" ? payload["taskId"] : void 0;
+  return { correlationId, taskId };
+}
+function resolveActiveRun(registry, correlationId, taskId) {
+  return registry.resolve({
+    ...correlationId !== void 0 ? { correlationId } : {},
+    ...taskId !== void 0 ? { taskId } : {}
+  });
+}
+function openMaintenanceSpan(registry, correlationId, taskId) {
+  const traceId = newTraceId();
+  const spanId = newSpanId();
+  const key = correlationId ?? taskId ?? `run_${spanId}`;
+  registry.open(key, { traceId, spanId });
+  return { traceId, spanId };
+}
+function closeMaintenanceSpan(registry, topic, correlationId, taskId) {
+  const existing = resolveActiveRun(registry, correlationId, taskId);
+  const traceId = existing?.traceId ?? newTraceId();
+  const spanId = existing?.spanId ?? newSpanId();
+  const statusCode = topic === TOPICS.MAINTENANCE_ERROR ? 2 : 1;
+  const key = correlationId ?? taskId ?? "";
+  if (key) registry.close(key);
+  return { traceId, spanId, statusCode };
+}
+function childSpan(registry, correlationId, taskId) {
+  const parent = resolveActiveRun(registry, correlationId, taskId);
+  const plan = {
+    traceId: parent?.traceId ?? newTraceId(),
+    spanId: newSpanId()
+  };
+  if (parent?.spanId !== void 0) plan.parentSpanId = parent.spanId;
+  return plan;
+}
+function planSpan(registry, topic, correlationId, taskId) {
+  if (topic === TOPICS.MAINTENANCE_STARTED) {
+    return openMaintenanceSpan(registry, correlationId, taskId);
+  }
+  if (topic === TOPICS.MAINTENANCE_COMPLETED || topic === TOPICS.MAINTENANCE_ERROR) {
+    return closeMaintenanceSpan(registry, topic, correlationId, taskId);
+  }
+  return childSpan(registry, correlationId, taskId);
+}
+function buildSpan(topic, plan, payload) {
+  const startNs = nowNs();
+  return {
+    traceId: plan.traceId,
+    spanId: plan.spanId,
+    ...plan.parentSpanId !== void 0 ? { parentSpanId: plan.parentSpanId } : {},
+    name: SPAN_NAME[topic],
+    kind: SpanKind.INTERNAL,
+    startTimeNs: startNs,
+    endTimeNs: startNs,
+    attributes: buildAttributes(payload, { "harness.topic": topic }),
+    ...plan.statusCode !== void 0 ? { statusCode: plan.statusCode } : {}
+  };
+}
+function buildGatewayEvent(topic, payload, correlationId) {
+  return {
+    id: newEventId2(),
+    type: TELEMETRY_TYPE[topic],
+    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+    data: payload,
+    ...correlationId !== void 0 ? { correlationId } : {}
+  };
+}
+async function enqueueToMatchingSubs(store, webhookDelivery, event) {
+  const subs = await store.listForEvent(event.type);
+  if (subs.length === 0) return;
+  const filtered = subs.filter((sub) => sub.events.some((p) => eventMatches(p, event.type)));
+  for (const sub of filtered) {
+    webhookDelivery.enqueue(sub, event);
+  }
+}
+function makeTelemetryHandler(ctx, topic) {
+  return (data) => {
+    const payload = data ?? {};
+    const { correlationId, taskId } = extractIds(payload);
+    const plan = planSpan(ctx.registry, topic, correlationId, taskId);
+    ctx.exporter.push(buildSpan(topic, plan, payload));
+    void enqueueToMatchingSubs(
+      ctx.store,
+      ctx.webhookDelivery,
+      buildGatewayEvent(topic, payload, correlationId)
+    );
+  };
+}
 function wireTelemetryFanout(params) {
   const { bus, exporter, webhookDelivery, store } = params;
   const registry = new ActiveRunRegistry();
   const handlers = [];
-  const enqueueToMatchingSubs = async (event) => {
-    const subs = await store.listForEvent(event.type);
-    if (subs.length === 0) return;
-    const filtered = subs.filter((sub) => sub.events.some((p) => eventMatches(p, event.type)));
-    for (const sub of filtered) {
-      webhookDelivery.enqueue(sub, event);
-    }
-  };
-  const makeHandler = (topic) => (data) => {
-    const payload = data ?? {};
-    const correlationId = typeof payload["correlationId"] === "string" ? payload["correlationId"] : void 0;
-    const taskId = typeof payload["taskId"] === "string" ? payload["taskId"] : void 0;
-    let traceId;
-    let spanId;
-    let parentSpanId;
-    let statusCode;
-    if (topic === TOPICS.MAINTENANCE_STARTED) {
-      traceId = newTraceId();
-      spanId = newSpanId();
-      const key = correlationId ?? taskId ?? `run_${spanId}`;
-      registry.open(key, { traceId, spanId });
-    } else if (topic === TOPICS.MAINTENANCE_COMPLETED || topic === TOPICS.MAINTENANCE_ERROR) {
-      const existing = registry.resolve({
-        ...correlationId !== void 0 ? { correlationId } : {},
-        ...taskId !== void 0 ? { taskId } : {}
-      });
-      if (existing !== void 0) {
-        traceId = existing.traceId;
-        spanId = existing.spanId;
-      } else {
-        traceId = newTraceId();
-        spanId = newSpanId();
-      }
-      statusCode = topic === TOPICS.MAINTENANCE_ERROR ? 2 : 1;
-      const key = correlationId ?? taskId ?? "";
-      if (key) registry.close(key);
-    } else {
-      const parent = registry.resolve({
-        ...correlationId !== void 0 ? { correlationId } : {},
-        ...taskId !== void 0 ? { taskId } : {}
-      });
-      traceId = parent?.traceId ?? newTraceId();
-      spanId = newSpanId();
-      parentSpanId = parent?.spanId;
-    }
-    const startNs = nowNs();
-    const span = {
-      traceId,
-      spanId,
-      ...parentSpanId !== void 0 ? { parentSpanId } : {},
-      name: SPAN_NAME[topic],
-      kind: SpanKind.INTERNAL,
-      startTimeNs: startNs,
-      endTimeNs: startNs,
-      attributes: buildAttributes(payload, { "harness.topic": topic }),
-      ...statusCode !== void 0 ? { statusCode } : {}
-    };
-    exporter.push(span);
-    const gatewayEvent = {
-      id: newEventId3(),
-      type: TELEMETRY_TYPE[topic],
-      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-      data: payload,
-      ...correlationId !== void 0 ? { correlationId } : {}
-    };
-    void enqueueToMatchingSubs(gatewayEvent);
-  };
+  const ctx = { registry, exporter, webhookDelivery, store };
   for (const topic of Object.values(TOPICS)) {
-    const fn = makeHandler(topic);
+    const fn = makeTelemetryHandler(ctx, topic);
     bus.on(topic, fn);
     handlers.push({ topic, fn });
   }
@@ -10644,7 +10934,7 @@ function buildSlackSink(config, options) {
 }
 
 // src/notifications/events.ts
-import { randomBytes as randomBytes8 } from "crypto";
+import { randomBytes as randomBytes7 } from "crypto";
 
 // src/notifications/envelope.ts
 function asObj(data) {
@@ -10775,8 +11065,8 @@ var NOTIFICATION_TOPICS = [
   "proposal.approved",
   "proposal.rejected"
 ];
-function newEventId4() {
-  return `evt_${randomBytes8(8).toString("hex")}`;
+function newEventId3() {
+  return `evt_${randomBytes7(8).toString("hex")}`;
 }
 function dispatchToEntry(bus, entry, event) {
   const eventType = event.type;
@@ -10811,7 +11101,7 @@ function wireNotificationSinks({ bus, registry }) {
       const entries = registry.list();
       if (entries.length === 0) return;
       const event = {
-        id: newEventId4(),
+        id: newEventId3(),
         type: eventType,
         timestamp: (/* @__PURE__ */ new Date()).toISOString(),
         data
@@ -10922,6 +11212,37 @@ async function scanWorkspaceConfig(workspacePath) {
   return { exitCode: computeScanExitCode(results), results };
 }
 
+// src/core/lane-persistence.ts
+import { eventSourcing } from "@harness-engineering/core";
+import { Err as Err21 } from "@harness-engineering/types";
+var SIGNAL_TO_LANE = {
+  claim: "claimed",
+  dispatch: "in_progress",
+  success: "in_review",
+  failure: "blocked",
+  abandon: "canceled"
+};
+function mapOrchestratorLane(signal) {
+  return SIGNAL_TO_LANE[signal];
+}
+async function persistLane(projectPath, issueId, signal) {
+  try {
+    const reg = await eventSourcing.registerTask(projectPath, issueId, []);
+    if (!reg.ok) return reg;
+    return await eventSourcing.transitionLane(projectPath, issueId, mapOrchestratorLane(signal));
+  } catch (err) {
+    return Err21(err instanceof Error ? err : new Error(String(err)));
+  }
+}
+async function readPersistedLanes(projectPath) {
+  try {
+    const snap = await eventSourcing.readSnapshot(projectPath);
+    return snap.ok ? snap.value.lanes : { tasks: {} };
+  } catch {
+    return { tasks: {} };
+  }
+}
+
 // src/maintenance/task-registry.ts
 var BUILT_IN_TASKS = [
   // --- Mechanical-AI ---
@@ -10985,7 +11306,13 @@ var BUILT_IN_TASKS = [
     description: "Detect and fix cross-check violations",
     schedule: "0 6 * * 1",
     branch: "harness-maint/cross-check-fixes",
-    checkCommand: ["validate-cross-check"],
+    // `harness cross-check` is a dedicated read-only CLI subcommand that surfaces
+    // JUST cross-artifact consistency (plan→implementation coverage + staleness),
+    // mirroring the `validate_cross_check` MCP tool's core (`runCrossCheck`)
+    // WITHOUT running the full `harness validate` suite. It prints a parseable
+    // `Cross-check: N issues` line and exits 0 (clean) / 1 (N issues), so the
+    // maintenance runner reports real results instead of an honest `failure`.
+    checkCommand: ["cross-check"],
     fixSkill: "harness-cross-check-fix"
   },
   // --- Pure-AI ---
@@ -11044,7 +11371,10 @@ var BUILT_IN_TASKS = [
     description: "Assess overall project health",
     schedule: "0 6 * * *",
     branch: null,
-    checkCommand: ["assess_project"]
+    // `assess_project` is an MCP tool name, not a CLI subcommand. The CLI
+    // composite project-health report is `harness insights` (health, entropy,
+    // decay, attention, impact) — a read-only report that records metrics.
+    checkCommand: ["insights"]
   },
   {
     id: "stale-constraints",
@@ -11052,7 +11382,14 @@ var BUILT_IN_TASKS = [
     description: "Detect stale architectural constraints",
     schedule: "0 2 1 * *",
     branch: null,
-    checkCommand: ["detect_stale_constraints"]
+    // `harness stale-constraints` is a dedicated read-only CLI subcommand that
+    // surfaces the `detect_stale_constraints` MCP tool's core in-process. It is
+    // precondition-gated on the knowledge graph: with no graph it emits the
+    // "No knowledge graph found. Run `harness scan` first." signature and exits
+    // non-zero, which the runner classifies as `skipped` (not failure). With a
+    // graph it prints a parseable `Stale constraints: N findings` line and exits
+    // 0 (clean) / 1 (N stale), recorded as report-only metrics.
+    checkCommand: ["stale-constraints"]
   },
   {
     id: "graph-refresh",
@@ -11085,7 +11422,8 @@ var BUILT_IN_TASKS = [
     description: "Clean up stale orchestrator sessions",
     schedule: "0 0 * * *",
     branch: null,
-    checkCommand: ["cleanup-sessions"]
+    checkCommand: ["cleanup-sessions"],
+    excludeFromHumanSweep: true
   },
   {
     id: "perf-baselines",
@@ -11093,7 +11431,8 @@ var BUILT_IN_TASKS = [
     description: "Update performance baselines",
     schedule: "0 7 * * *",
     branch: null,
-    checkCommand: ["perf", "baselines", "update"]
+    checkCommand: ["perf", "baselines", "update"],
+    excludeFromHumanSweep: true
   },
   {
     id: "main-sync",
@@ -11101,7 +11440,8 @@ var BUILT_IN_TASKS = [
     description: "Fast-forward local default branch from origin",
     schedule: "*/15 * * * *",
     branch: null,
-    checkCommand: ["harness", "sync-main", "--json"]
+    checkCommand: ["harness", "sync-main", "--json"],
+    excludeFromHumanSweep: true
   },
   // Hermes Phase 4 — one-shot backfill that stamps `provenance: user-authored`
   // on every existing catalog skill. Schedule is Feb 31 (a date that never
@@ -11114,7 +11454,8 @@ var BUILT_IN_TASKS = [
     description: "Backfill provenance: user-authored on every existing skill (one-shot, idempotent)",
     schedule: "0 0 31 2 *",
     branch: null,
-    checkCommand: ["backfill-skill-provenance"]
+    checkCommand: ["backfill-skill-provenance"],
+    excludeFromHumanSweep: true
   }
 ];
 
@@ -11181,6 +11522,17 @@ function cronMatchesNow(expression, now) {
   const daysOfWeek = parseField(dowField, 0, 6);
   return minutes.has(minute) && hours.has(hour) && daysOfMonth.has(dayOfMonth) && months.has(month) && daysOfWeek.has(dayOfWeek);
 }
+function cronMatchesDate(expression, date) {
+  const fields = expression.trim().split(/\s+/);
+  if (fields.length !== 5) {
+    throw new Error(`Invalid cron expression: expected 5 fields, got ${fields.length}`);
+  }
+  const [, , domField, monthField, dowField] = fields;
+  const daysOfMonth = parseField(domField, 1, 31);
+  const months = parseField(monthField, 1, 12);
+  const daysOfWeek = parseField(dowField, 0, 6);
+  return daysOfMonth.has(date.getDate()) && months.has(date.getMonth() + 1) && daysOfWeek.has(date.getDay());
+}
 
 // src/maintenance/scheduler.ts
 var MaintenanceScheduler = class {
@@ -11430,7 +11782,7 @@ var SingleProcessLeaderElector = class {
 };
 
 // src/maintenance/reporter.ts
-import * as fs16 from "fs";
+import * as fs14 from "fs";
 import * as path18 from "path";
 import { z as z17 } from "zod";
 var RunResultSchema = z17.object({
@@ -11466,9 +11818,9 @@ var MaintenanceReporter = class {
    */
   async load() {
     try {
-      await fs16.promises.mkdir(this.persistDir, { recursive: true });
+      await fs14.promises.mkdir(this.persistDir, { recursive: true });
       const filePath = path18.join(this.persistDir, "history.json");
-      const data = await fs16.promises.readFile(filePath, "utf-8");
+      const data = await fs14.promises.readFile(filePath, "utf-8");
       const parsed = z17.array(RunResultSchema).safeParse(JSON.parse(data));
       if (parsed.success) {
         this.history = parsed.data.slice(0, MAX_HISTORY);
@@ -11502,9 +11854,9 @@ var MaintenanceReporter = class {
    */
   async persist() {
     try {
-      await fs16.promises.mkdir(this.persistDir, { recursive: true });
+      await fs14.promises.mkdir(this.persistDir, { recursive: true });
       const filePath = path18.join(this.persistDir, "history.json");
-      await fs16.promises.writeFile(filePath, JSON.stringify(this.history, null, 2), "utf-8");
+      await fs14.promises.writeFile(filePath, JSON.stringify(this.history, null, 2), "utf-8");
     } catch (err) {
       this.logger.error("MaintenanceReporter: failed to persist history", { error: String(err) });
     }
@@ -11544,20 +11896,20 @@ var TaskRunner = class {
    * @param origin - Hermes Phase 2 trigger-source tag; defaults to `'cron'`
    *                 when called from the scheduler path.
    */
-  async run(task, origin = "cron") {
+  async run(task, origin = "cron", mode = "fix") {
     const startedAt = (/* @__PURE__ */ new Date()).toISOString();
     let result;
     let captured;
     try {
       switch (task.type) {
         case "mechanical-ai": {
-          const out = await this.runMechanicalAI(task, startedAt);
+          const out = await this.runMechanicalAI(task, startedAt, mode);
           result = out.result;
           captured = out.captured;
           break;
         }
         case "pure-ai":
-          result = await this.runPureAI(task, startedAt);
+          result = await this.runPureAI(task, startedAt, mode);
           break;
         case "report-only": {
           const out = await this.runReportOnly(task, startedAt);
@@ -11566,7 +11918,7 @@ var TaskRunner = class {
           break;
         }
         case "housekeeping": {
-          const out = await this.runHousekeeping(task, startedAt);
+          const out = await this.runHousekeeping(task, startedAt, mode);
           result = out.result;
           captured = out.captured;
           break;
@@ -11630,7 +11982,8 @@ var TaskRunner = class {
         findings: r2.findings,
         stdout: r2.output,
         stderr: r2.stderr,
-        structured: r2.structured ? r2.structured : null
+        structured: r2.structured ? r2.structured : null,
+        executionFailed: false
       };
     }
     if (!task.checkCommand || task.checkCommand.length === 0) {
@@ -11642,7 +11995,8 @@ var TaskRunner = class {
       findings: r.findings,
       stdout: r.output,
       stderr: "",
-      structured: null
+      structured: null,
+      executionFailed: r.executionFailed ?? false
     };
   }
   /**
@@ -11667,7 +12021,7 @@ var TaskRunner = class {
    * only if fixable findings exist; persist captured stdout/stderr/context
    * via the output store on the way out.
    */
-  async runMechanicalAI(task, startedAt) {
+  async runMechanicalAI(task, startedAt, mode = "fix") {
     if (!task.fixSkill) {
       return wrap(this.failureResult(task.id, startedAt, "mechanical-ai task missing fixSkill"));
     }
@@ -11689,6 +12043,27 @@ var TaskRunner = class {
     } catch (err) {
       return wrap(this.failureResult(task.id, startedAt, String(err)));
     }
+    if (check.executionFailed) {
+      const cls = classifyCheckExecutionFailure(`${check.stdout}
+${check.stderr}`);
+      if (cls.kind === "unrunnable") {
+        return wrap(
+          this.failureResult(task.id, startedAt, checkExecutionError(check)),
+          captureFromCheck(check)
+        );
+      }
+      if (cls.kind === "precondition") {
+        return wrap(
+          this.skippedResult(task.id, startedAt, cls.reason ?? "precondition not met"),
+          captureFromCheck(check)
+        );
+      }
+      check = {
+        ...check,
+        executionFailed: false,
+        findings: check.findings > 0 ? check.findings : recoverFindingsCount(check.stdout)
+      };
+    }
     const promptContext = await this.composePromptContext(task);
     const baseCaptured = {
       stdout: check.stdout,
@@ -11697,13 +12072,14 @@ var TaskRunner = class {
       ...promptContext ? { context: promptContext } : {}
     };
     const wakeAgentExplicitlyFalse = check.structured !== null && typeof check.structured === "object" && check.structured.wakeAgent === false;
-    if (check.findings === 0 || wakeAgentExplicitlyFalse) {
+    if (check.findings === 0 || wakeAgentExplicitlyFalse || mode === "report") {
+      const reportedWithFindings = mode === "report" && check.findings > 0;
       return {
         result: {
           taskId: task.id,
           startedAt,
           completedAt: (/* @__PURE__ */ new Date()).toISOString(),
-          status: "no-issues",
+          status: reportedWithFindings ? "success" : "no-issues",
           findings: check.findings,
           fixed: 0,
           prUrl: null,
@@ -11773,7 +12149,19 @@ var TaskRunner = class {
   /**
    * Pure-AI: always dispatch agent with configured skill.
    */
-  async runPureAI(task, startedAt) {
+  async runPureAI(task, startedAt, mode = "fix") {
+    if (mode === "report") {
+      return {
+        taskId: task.id,
+        startedAt,
+        completedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        status: "no-issues",
+        findings: 0,
+        fixed: 0,
+        prUrl: null,
+        prUpdated: false
+      };
+    }
     if (!task.fixSkill) {
       return this.failureResult(task.id, startedAt, "pure-ai task missing fixSkill");
     }
@@ -11847,6 +12235,27 @@ var TaskRunner = class {
       return wrap(this.failureResult(task.id, startedAt, String(err)));
     }
     const parsed = parseStatusLine(check.stdout);
+    if (parsed === null && check.executionFailed) {
+      const cls = classifyCheckExecutionFailure(`${check.stdout}
+${check.stderr}`);
+      if (cls.kind === "unrunnable") {
+        return wrap(
+          this.failureResult(task.id, startedAt, checkExecutionError(check)),
+          captureFromCheck(check)
+        );
+      }
+      if (cls.kind === "precondition") {
+        return wrap(
+          this.skippedResult(task.id, startedAt, cls.reason ?? "precondition not met"),
+          captureFromCheck(check)
+        );
+      }
+      check = {
+        ...check,
+        executionFailed: false,
+        findings: check.findings > 0 ? check.findings : recoverFindingsCount(check.stdout)
+      };
+    }
     const status = parsed?.status ?? "success";
     const findings = parsed === null ? check.findings : typeof parsed.candidatesFound === "number" ? parsed.candidatesFound : 0;
     const result = {
@@ -11880,7 +12289,20 @@ var TaskRunner = class {
    * Hermes Phase 2: a `checkScript` may replace `checkCommand` for housekeeping
    * tasks; the runner falls through to the same JSON-status parsing path.
    */
-  async runHousekeeping(task, startedAt) {
+  async runHousekeeping(task, startedAt, mode = "fix") {
+    if (mode === "report") {
+      return wrap({
+        taskId: task.id,
+        startedAt,
+        completedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        status: "skipped",
+        findings: 0,
+        fixed: 0,
+        prUrl: null,
+        prUpdated: false,
+        error: "skipped in report mode: housekeeping may mutate and report runs are read-only"
+      });
+    }
     if (!task.checkCommand && !task.checkScript) {
       return wrap(
         this.failureResult(
@@ -11947,46 +12369,133 @@ var TaskRunner = class {
       error
     };
   }
+  /**
+   * A precondition-gated check (e.g. `predict` with <3 snapshots, or a
+   * graph-backed check before `harness scan`). The command is correctly
+   * configured; the repo just lacks the state it needs. Reported as `skipped`
+   * — distinct from a hard `failure` — carrying the refusal line as the reason
+   * (surfaced in the run-report summary column). ADR 0050.
+   */
+  skippedResult(taskId, startedAt, reason) {
+    return {
+      taskId,
+      startedAt,
+      completedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      status: "skipped",
+      findings: 0,
+      fixed: 0,
+      prUrl: null,
+      prUpdated: false,
+      error: reason
+    };
+  }
 };
 function wrap(result, captured) {
   return captured ? { result, captured } : { result };
 }
+function checkExecutionError(check) {
+  const detail = (check.stderr || check.stdout || "").trim();
+  return detail ? `check command failed to execute: ${detail}` : "check command failed to execute";
+}
+function captureFromCheck(check) {
+  return { stdout: check.stdout, stderr: check.stderr, structured: check.structured };
+}
+var PRECONDITION_PATTERNS = [
+  /requires at least \d+ snapshots?/i,
+  /Run ["'`]?harness snapshot/i,
+  /no knowledge graph found/i,
+  /Run ["'`]?harness scan/i,
+  /no graph (?:available|found)/i
+];
+var UNRUNNABLE_PATTERNS = [
+  /unknown command/i,
+  /unknown option/i,
+  /\bENOENT\b/,
+  /command not found/i,
+  /cannot find module/i,
+  // A timed-out check did not complete — it is a hard failure, never a
+  // "ran-no-count" success. The runners synthesize this message on SIGTERM.
+  /timed out/i,
+  /\bETIMEDOUT\b/
+];
+var TIMEOUT_SIGNATURE = /check timed out after \d+\s*ms/i;
+function explicitFindingsCount(output) {
+  const after = output.match(/(?:findings?|issues?|violations?|errors?)\s*[:=]\s*(\d+)/i);
+  if (after) return parseInt(after[1], 10);
+  const before = output.match(/(\d+)\s+(?:findings?|issues?|violations?|errors?)\b/i);
+  if (before) return parseInt(before[1], 10);
+  return null;
+}
+function recoverFindingsCount(output) {
+  return explicitFindingsCount(output) ?? 1;
+}
+function firstMeaningfulLine(output) {
+  const line = output.split("\n").map((l) => l.trim()).find(Boolean);
+  if (!line) return "precondition not met";
+  return line.replace(/^[x✗✓!-]\s*/u, "").trim();
+}
+var CLASSIFY_HEAD_LINES = 3;
+function classifyCheckExecutionFailure(output) {
+  const text = (output ?? "").trim();
+  if (text.length === 0) return { kind: "unrunnable" };
+  if (TIMEOUT_SIGNATURE.test(text)) return { kind: "unrunnable" };
+  if (explicitFindingsCount(text) !== null) return { kind: "ran-no-count" };
+  const head = text.split("\n").filter((l) => l.trim()).slice(0, CLASSIFY_HEAD_LINES).join("\n");
+  for (const re of PRECONDITION_PATTERNS) {
+    if (re.test(head)) return { kind: "precondition", reason: firstMeaningfulLine(text) };
+  }
+  for (const re of UNRUNNABLE_PATTERNS) {
+    if (re.test(head)) return { kind: "unrunnable" };
+  }
+  return { kind: "ran-no-count" };
+}
 function parseStatusLine(output) {
   const lines = output.split("\n").map((l) => l.trim()).filter(Boolean);
   for (let i = lines.length - 1; i >= 0; i--) {
-    const line = lines[i];
-    if (!line || !line.startsWith("{") || !line.endsWith("}")) continue;
-    try {
-      const obj = JSON.parse(line);
-      const s = obj.status;
-      if (s === "success" || s === "skipped" || s === "failure" || s === "no-issues") {
-        const parsed = { status: s, rawStatus: s };
-        if (typeof obj.candidatesFound === "number") {
-          parsed.candidatesFound = obj.candidatesFound;
-        }
-        if (typeof obj.error === "string") {
-          parsed.error = obj.error;
-        }
-        if (typeof obj.reason === "string") {
-          parsed.reason = obj.reason;
-        }
-        if (typeof obj.detail === "string" && !parsed.error) {
-          parsed.error = `${parsed.reason ?? "skipped"}: ${obj.detail}`;
-        }
-        return parsed;
-      }
-      if (s === "updated" || s === "no-op") {
-        return { status: "success", rawStatus: s };
-      }
-      if (s === "error") {
-        const message = typeof obj.message === "string" ? obj.message : "unknown error";
-        return { status: "failure", error: message, rawStatus: "error" };
-      }
-    } catch {
-    }
+    const parsed = parseStatusObjectLine(lines[i]);
+    if (parsed) return parsed;
+  }
+  return null;
+}
+function parseStatusObjectLine(line) {
+  if (!line || !line.startsWith("{") || !line.endsWith("}")) return null;
+  let obj;
+  try {
+    obj = JSON.parse(line);
+  } catch {
+    return null;
+  }
+  return classifyStatusObject(obj);
+}
+var PHASE_STATUSES = /* @__PURE__ */ new Set(["success", "skipped", "failure", "no-issues"]);
+var SYNC_SUCCESS_STATUSES = /* @__PURE__ */ new Set(["updated", "no-op"]);
+function classifyStatusObject(obj) {
+  const s = obj.status;
+  if (typeof s !== "string") return null;
+  if (PHASE_STATUSES.has(s)) return buildPhaseStatus(s, obj);
+  if (SYNC_SUCCESS_STATUSES.has(s)) return { status: "success", rawStatus: s };
+  if (s === "error") {
+    const message = typeof obj.message === "string" ? obj.message : "unknown error";
+    return { status: "failure", error: message, rawStatus: "error" };
   }
   return null;
 }
+function buildPhaseStatus(status, obj) {
+  const parsed = { status, rawStatus: status };
+  if (typeof obj.candidatesFound === "number") {
+    parsed.candidatesFound = obj.candidatesFound;
+  }
+  if (typeof obj.error === "string") {
+    parsed.error = obj.error;
+  }
+  if (typeof obj.reason === "string") {
+    parsed.reason = obj.reason;
+  }
+  if (typeof obj.detail === "string" && !parsed.error) {
+    parsed.error = `${parsed.reason ?? "skipped"}: ${obj.detail}`;
+  }
+  return parsed;
+}
 
 // src/maintenance/check-script-runner.ts
 import { execFile as execFile6 } from "child_process";
@@ -12099,8 +12608,49 @@ function heuristicResult(stdout, stderr, exitedAbnormally) {
   };
 }
 
+// src/maintenance/check-runner.ts
+import { execFile as nodeExecFile } from "child_process";
+import { promisify as promisify4 } from "util";
+var MAINTENANCE_CHECK_MAX_BUFFER = 64 * 1024 * 1024;
+var MAINTENANCE_CHECK_TIMEOUT_MS = 3e5;
+var FINDINGS_RE = /(\d+)\s+(?:finding|issue|violation|error)/i;
+var nodeExecFileAsync = promisify4(nodeExecFile);
+function isCheckTimeoutError(e) {
+  return e.killed === true || e.signal === "SIGTERM" || e.code === "ETIMEDOUT";
+}
+async function runHarnessCheck(spawn7, cwd, opts = {}) {
+  const execFileAsync2 = opts.execFileAsync ?? nodeExecFileAsync;
+  const timeoutMs = opts.timeoutMs ?? MAINTENANCE_CHECK_TIMEOUT_MS;
+  const maxBuffer = opts.maxBuffer ?? MAINTENANCE_CHECK_MAX_BUFFER;
+  try {
+    const { stdout } = await execFileAsync2(spawn7.file, spawn7.args, {
+      cwd,
+      timeout: timeoutMs,
+      maxBuffer
+    });
+    const text = String(stdout);
+    const m = text.match(FINDINGS_RE);
+    const findings = m ? parseInt(m[1], 10) : 0;
+    return { passed: findings === 0, findings, output: text, executionFailed: false };
+  } catch (err) {
+    const e = err;
+    let output = [e.stdout, e.stderr].map((v) => v == null ? "" : String(v)).filter(Boolean).join("\n");
+    if (isCheckTimeoutError(e)) {
+      const note = `check timed out after ${timeoutMs}ms`;
+      output = output.trim() ? `${output}
+${note}` : note;
+      return { passed: false, findings: 0, output, executionFailed: true };
+    }
+    const m = output.match(FINDINGS_RE);
+    if (m) {
+      return { passed: false, findings: parseInt(m[1], 10), output, executionFailed: false };
+    }
+    return { passed: false, findings: 0, output, executionFailed: true };
+  }
+}
+
 // src/maintenance/output-store.ts
-import * as fs17 from "fs";
+import * as fs15 from "fs";
 import * as path20 from "path";
 var DEFAULT_RETENTION = {
   runs: 50,
@@ -12141,13 +12691,13 @@ var TaskOutputStore = class {
   async write(taskId, entry, retention) {
     this.ensureSafeTaskId(taskId);
     const dir = this.dirFor(taskId);
-    await fs17.promises.mkdir(dir, { recursive: true });
+    await fs15.promises.mkdir(dir, { recursive: true });
     const fileName = `${sanitizeIso(entry.completedAt || (/* @__PURE__ */ new Date()).toISOString())}.json`;
     const filePath = path20.join(dir, fileName);
     const tmpPath = `${filePath}.tmp`;
     const payload = JSON.stringify(entry, null, 2);
-    await fs17.promises.writeFile(tmpPath, payload, "utf-8");
-    await fs17.promises.rename(tmpPath, filePath);
+    await fs15.promises.writeFile(tmpPath, payload, "utf-8");
+    await fs15.promises.rename(tmpPath, filePath);
     try {
       await this.applyRetention(taskId, retention);
     } catch (err) {
@@ -12198,7 +12748,7 @@ var TaskOutputStore = class {
   }
   async readEntry(filePath) {
     try {
-      const buf = await fs17.promises.readFile(filePath, "utf-8");
+      const buf = await fs15.promises.readFile(filePath, "utf-8");
       const parsed = JSON.parse(buf);
       return parsed;
     } catch {
@@ -12220,7 +12770,7 @@ var TaskOutputStore = class {
     const toRemove = /* @__PURE__ */ new Set([...overflow, ...aged]);
     for (const name of toRemove) {
       try {
-        await fs17.promises.unlink(path20.join(dir, name));
+        await fs15.promises.unlink(path20.join(dir, name));
       } catch {
       }
     }
@@ -12229,7 +12779,7 @@ var TaskOutputStore = class {
 async function listJsonFilesDescending(dir) {
   let names;
   try {
-    names = await fs17.promises.readdir(dir);
+    names = await fs15.promises.readdir(dir);
   } catch {
     return [];
   }
@@ -12338,7 +12888,7 @@ var fallbackLogger3 = {
 };
 
 // src/maintenance/custom-task-validator.ts
-import { Ok as Ok23, Err as Err20 } from "@harness-engineering/types";
+import { Ok as Ok23, Err as Err22 } from "@harness-engineering/types";
 var ID_PATTERN = /^[a-z0-9][a-z0-9-]*$/;
 var REQUIRED_FIELDS_BY_TYPE = {
   "mechanical-ai": ["branch", "fixSkill"],
@@ -12358,7 +12908,7 @@ function validateCustomTasks(customTasks, builtIns, deps = {}) {
     validateOne(id, task, builtInIds, allIds, deps, errors);
   }
   detectCycles(customTasks, builtIns, errors);
-  return errors.length === 0 ? Ok23(void 0) : Err20(errors);
+  return errors.length === 0 ? Ok23(void 0) : Err22(errors);
 }
 function validateOne(id, task, builtInIds, allIds, deps, errors) {
   const prefix = `customTasks.${id}`;
@@ -12547,6 +13097,11 @@ function deriveSeedPaths(config) {
   const roadmapPath = config.tracker.kind === "roadmap" && config.tracker.filePath ? config.tracker.filePath : "docs/roadmap.md";
   return [".harness/proposals", roadmapPath];
 }
+function normalizeHarnessCommand(command) {
+  if (command.length === 0) return [];
+  if (command[0] === "harness") return command;
+  return ["harness", ...command];
+}
 var Orchestrator = class extends EventEmitter {
   state;
   config;
@@ -12673,6 +13228,11 @@ var Orchestrator = class extends EventEmitter {
   abortControllers = /* @__PURE__ */ new Map();
   /** Guards against overlapping ticks when a tick takes longer than the polling interval */
   tickInProgress = false;
+  /** Phase 4 (DLane-5): lanes read back from the durable log on first tick, for
+   *  observability only — NOT fed into reconciliation. Empty until the first tick. */
+  persistedLanes = { tasks: {} };
+  /** Ensures the lane read-back diagnostic runs at most once (first tick). */
+  laneReadbackDone = false;
   /** Timestamp of the last stale branch sweep (at most once per hour) */
   lastBranchSweepMs = 0;
   /** Current tick-phase activity visible to the dashboard */
@@ -12830,22 +13390,7 @@ var Orchestrator = class extends EventEmitter {
       });
       webhookDelivery.start();
       this.setupNotifications(config.notifications);
-      const otlpCfg = config.telemetry?.export?.otlp;
-      if (otlpCfg) {
-        this.otlpExporter = new OTLPExporter({
-          endpoint: otlpCfg.endpoint,
-          ...otlpCfg.enabled !== void 0 ? { enabled: otlpCfg.enabled } : {},
-          ...otlpCfg.headers !== void 0 ? { headers: otlpCfg.headers } : {},
-          ...otlpCfg.flushIntervalMs !== void 0 ? { flushIntervalMs: otlpCfg.flushIntervalMs } : {},
-          ...otlpCfg.batchSize !== void 0 ? { batchSize: otlpCfg.batchSize } : {}
-        });
-        this.telemetryFanoutOff = wireTelemetryFanout({
-          bus: this,
-          exporter: this.otlpExporter,
-          webhookDelivery,
-          store: webhookStore
-        });
-      }
+      this.setupTelemetryExport(config, webhookStore, webhookDelivery);
       this.server = new OrchestratorServer(this, config.server.port, {
         interactionQueue: this.interactionQueue,
         webhooks: {
@@ -12868,24 +13413,8 @@ var Orchestrator = class extends EventEmitter {
         analysisArchive: this.analysisArchive,
         roadmapPath: config.tracker.filePath ?? null,
         dispatchAdHoc: this.dispatchAdHoc.bind(this),
-        getLocalModelStatus: () => {
-          const first = this.localResolvers.values().next();
-          return first.done ? null : first.value.getStatus();
-        },
-        getLocalModelStatuses: () => {
-          const backends = this.config.agent.backends ?? {};
-          const out = [];
-          for (const [name, resolver] of this.localResolvers) {
-            const def = backends[name];
-            if (!def || def.type !== "local" && def.type !== "pi") continue;
-            out.push({
-              ...resolver.getStatus(),
-              backendName: name,
-              endpoint: def.endpoint
-            });
-          }
-          return out;
-        }
+        getLocalModelStatus: () => this.getFirstLocalModelStatus(),
+        getLocalModelStatuses: () => this.buildLocalModelStatuses()
       });
       this.server.setRecorder(this.recorder);
       this.interactionQueue.onPush((interaction) => {
@@ -12893,6 +13422,56 @@ var Orchestrator = class extends EventEmitter {
       });
     }
   }
+  /**
+   * Phase 5: construct the OTLP/HTTP trace exporter and wire telemetry fanout.
+   * Only fires when the operator configures `telemetry.export.otlp` in
+   * harness.config.json. Extracted from the server-init block in the
+   * constructor to keep that block's cyclomatic complexity under threshold.
+   */
+  setupTelemetryExport(config, webhookStore, webhookDelivery) {
+    const otlpCfg = config.telemetry?.export?.otlp;
+    if (!otlpCfg) return;
+    this.otlpExporter = new OTLPExporter({
+      endpoint: otlpCfg.endpoint,
+      ...otlpCfg.enabled !== void 0 ? { enabled: otlpCfg.enabled } : {},
+      ...otlpCfg.headers !== void 0 ? { headers: otlpCfg.headers } : {},
+      ...otlpCfg.flushIntervalMs !== void 0 ? { flushIntervalMs: otlpCfg.flushIntervalMs } : {},
+      ...otlpCfg.batchSize !== void 0 ? { batchSize: otlpCfg.batchSize } : {}
+    });
+    this.telemetryFanoutOff = wireTelemetryFanout({
+      bus: this,
+      exporter: this.otlpExporter,
+      webhookDelivery,
+      store: webhookStore
+    });
+  }
+  /**
+   * Deprecated alias for /api/v1/local-model/status (Spec 1 endpoint retained
+   * as a compat shim per spec line 35; superseded by getLocalModelStatuses for
+   * the multi-local UI). Returns the first-registered resolver's status.
+   */
+  getFirstLocalModelStatus() {
+    const first = this.localResolvers.values().next();
+    return first.done ? null : first.value.getStatus();
+  }
+  /**
+   * SC38: build NamedLocalModelStatus[] from each registered resolver, tagged
+   * with its backendName + endpoint from the config.
+   */
+  buildLocalModelStatuses() {
+    const backends = this.config.agent.backends ?? {};
+    const out = [];
+    for (const [name, resolver] of this.localResolvers) {
+      const def = backends[name];
+      if (!def || def.type !== "local" && def.type !== "pi") continue;
+      out.push({
+        ...resolver.getStatus(),
+        backendName: name,
+        endpoint: def.endpoint
+      });
+    }
+    return out;
+  }
   createTracker() {
     if (this.config.tracker.kind === "github-issues") {
       const trackerCfg = {
@@ -12919,48 +13498,30 @@ var Orchestrator = class extends EventEmitter {
     const logger = this.logger;
     const checkRunner = {
       run: async (command, cwd) => {
-        const { execFile: execFile7 } = await import("child_process");
-        const { promisify: promisify5 } = await import("util");
-        const execFileAsync2 = promisify5(execFile7);
-        const [cmd, ...args] = command;
-        if (!cmd) return { passed: true, findings: 0, output: "" };
-        try {
-          const { stdout } = await execFileAsync2(cmd, args, { cwd, timeout: 12e4 });
-          const findingsMatch = stdout.match(/(\d+)\s+(?:finding|issue|violation|error)/i);
-          const findings = findingsMatch ? parseInt(findingsMatch[1], 10) : 0;
-          return { passed: findings === 0, findings, output: stdout };
-        } catch (err) {
-          const error = err;
-          const output = [error.stdout, error.stderr].filter(Boolean).join("\n");
-          const findingsMatch = output.match(/(\d+)\s+(?:finding|issue|violation|error)/i);
-          const findings = findingsMatch ? parseInt(findingsMatch[1], 10) : 1;
-          return { passed: false, findings, output };
-        }
-      }
-    };
-    const agentDispatcher = {
-      dispatch: async (skill, branch, backendName, cwd) => {
-        logger.info(
-          "Maintenance agent dispatcher invoked (stub \u2014 skill dispatch integration pending)",
-          {
-            skill,
-            branch,
-            backendName,
-            cwd
-          }
-        );
-        return { producedCommits: false, fixed: 0 };
+        const [cmd, ...args] = normalizeHarnessCommand(command);
+        if (!cmd) return { passed: true, findings: 0, output: "", executionFailed: false };
+        return runHarnessCheck({ file: cmd, args }, cwd);
       }
     };
+    const resolveBackend2 = makeBackendResolver(this.getBackends());
+    const agentDispatcher = createAgentDispatcher({
+      resolveBackend: resolveBackend2,
+      git: (args, cwd) => execFileSync("git", args, { cwd, encoding: "utf-8" }).toString().trim(),
+      logger
+    });
     const commandExecutor = {
       exec: async (command, cwd) => {
         const { execFile: execFile7 } = await import("child_process");
-        const { promisify: promisify5 } = await import("util");
-        const execFileAsync2 = promisify5(execFile7);
-        const [cmd, ...args] = command;
+        const { promisify: promisify6 } = await import("util");
+        const execFileAsync2 = promisify6(execFile7);
+        const [cmd, ...args] = normalizeHarnessCommand(command);
         if (!cmd) return { stdout: "" };
         try {
-          const { stdout } = await execFileAsync2(cmd, args, { cwd, timeout: 12e4 });
+          const { stdout } = await execFileAsync2(cmd, args, {
+            cwd,
+            timeout: MAINTENANCE_CHECK_TIMEOUT_MS,
+            maxBuffer: MAINTENANCE_CHECK_MAX_BUFFER
+          });
           return { stdout: String(stdout) };
         } catch (err) {
           logger.warn("Maintenance command execution failed", {
@@ -13095,6 +13656,10 @@ ${messages}`);
   async asyncTick() {
     await this.ensureClaimManager();
     await this.intelligenceRunner.loadPersistedData();
+    if (!this.laneReadbackDone) {
+      this.laneReadbackDone = true;
+      await this.readBackPersistedLanes();
+    }
     const nowMs = Date.now();
     this.setTickActivity("fetching", "Polling tracker for candidates");
     const candidatesResult = await this.tracker.fetchCandidateIssues();
@@ -13247,12 +13812,48 @@ ${messages}`);
         break;
       case "escalate":
         await this.handleEscalation(effect);
+        await this.persistLaneSafe(effect.issueId, "abandon");
         break;
       case "claim":
         await this.handleClaimEffect(effect);
         break;
     }
   }
+  /**
+   * Phase 4 (DLane-5): persist an orchestrator lane transition to the durable
+   * core event log at the effect boundary. NEVER throws — `persistLane` returns
+   * an `Err` Result on failure, which is logged and swallowed here so a
+   * lane-persistence failure can never break orchestrator dispatch.
+   */
+  async persistLaneSafe(issueId, signal) {
+    const r = await persistLane(this.projectRoot, issueId, signal);
+    if (!r.ok) {
+      this.logger.warn(`lane persist failed for ${issueId} (${signal}): ${r.error.message}`);
+    }
+  }
+  /**
+   * Phase 4 (DLane-5): read persisted task lanes back from the durable log and
+   * log a one-line summary. Stores the projection on `this.persistedLanes` for
+   * observability. Read-only — never feeds reconciliation, never throws.
+   */
+  async readBackPersistedLanes() {
+    const lanes = await readPersistedLanes(this.projectRoot);
+    this.persistedLanes = lanes;
+    const entries = Object.keys(lanes.tasks).map((id) => `${id}:${lanes.tasks[id]?.lane}`);
+    const nonTerminal = entries.filter((e) => !e.endsWith(":done") && !e.endsWith(":canceled"));
+    this.logger.info(
+      `Lane read-back on startup: ${entries.length} persisted task(s), ${nonTerminal.length} non-terminal`,
+      { nonTerminal }
+    );
+  }
+  /**
+   * Phase 4 (DLane-5): the task lanes most recently read back from the durable
+   * log on startup, exposed for external observability. Read-only — a fresh
+   * `{ tasks: {} }` until the first tick's read-back has run.
+   */
+  getPersistedLanes() {
+    return this.persistedLanes;
+  }
   /**
    * Guards workspace cleanup by checking whether the agent pushed a branch
    * that does not yet have a pull request. If so, the worktree is preserved
@@ -13439,6 +14040,7 @@ ${messages}`);
       }
       return;
     }
+    await this.persistLaneSafe(effect.issue.id, "claim");
     await this.postClaimComment(effect.issue);
     await this.dispatchIssue(effect.issue, effect.attempt, effect.backend);
   }
@@ -13499,6 +14101,7 @@ ${messages}`);
     this.logger.info(`Dispatching issue: ${issue.identifier} (attempt ${attempt})`, {
       issueId: issue.id
     });
+    await this.persistLaneSafe(issue.id, "dispatch");
     try {
       const workspaceResult = await this.workspace.ensureWorkspace(issue.identifier);
       if (!workspaceResult.ok) throw workspaceResult.error;
@@ -13707,6 +14310,7 @@ ${messages}`);
    * Informs the state machine that an agent worker has exited.
    */
   async emitWorkerExit(issueId, reason, attempt, error) {
+    await this.persistLaneSafe(issueId, reason === "normal" ? "success" : "failure");
     await this.completionHandler.handleWorkerExit(
       issueId,
       reason,
@@ -14242,11 +14846,11 @@ function launchTUI(orchestrator) {
 }
 
 // src/maintenance/sync-main.ts
-import { execFile as nodeExecFile } from "child_process";
-import { promisify as promisify4 } from "util";
+import { execFile as nodeExecFile2 } from "child_process";
+import { promisify as promisify5 } from "util";
 var DEFAULT_TIMEOUT_MS3 = 6e4;
 async function git(execFileFn, args, cwd, timeoutMs) {
-  const exec = promisify4(execFileFn);
+  const exec = promisify5(execFileFn);
   const { stdout, stderr } = await exec("git", args, { cwd, timeout: timeoutMs });
   return { stdout: String(stdout), stderr: String(stderr) };
 }
@@ -14308,7 +14912,7 @@ async function isAncestor(execFileFn, a, b, cwd, timeoutMs) {
   }
 }
 async function syncMain(repoRoot, opts = {}) {
-  const execFileFn = opts.execFileFn ?? nodeExecFile;
+  const execFileFn = opts.execFileFn ?? nodeExecFile2;
   const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS3;
   try {
     const originRef = await resolveOriginDefault(execFileFn, repoRoot, timeoutMs);
@@ -14385,8 +14989,56 @@ async function syncMain(repoRoot, opts = {}) {
   }
 }
 
+// src/maintenance/overdue.ts
+var LOOKBACK_DAYS = 366;
+function previousFireTime(schedule, now) {
+  let day = new Date(now.getFullYear(), now.getMonth(), now.getDate());
+  for (let d = 0; d <= LOOKBACK_DAYS; d++) {
+    if (cronMatchesDate(schedule, day)) {
+      const dayStartMs = day.getTime();
+      const scanStart = d === 0 ? new Date(
+        now.getFullYear(),
+        now.getMonth(),
+        now.getDate(),
+        now.getHours(),
+        now.getMinutes()
+      ) : new Date(day.getFullYear(), day.getMonth(), day.getDate(), 23, 59);
+      for (let ms = scanStart.getTime(); ms >= dayStartMs; ms -= 6e4) {
+        const candidate = new Date(ms);
+        if (cronMatchesNow(schedule, candidate)) return candidate;
+      }
+    }
+    day = new Date(day.getFullYear(), day.getMonth(), day.getDate() - 1);
+  }
+  return null;
+}
+function isSatisfyingRun(r) {
+  return r.status === "success" || r.status === "no-issues";
+}
+function isOverdue(task, history, now) {
+  const satisfyingRuns = history.filter((r) => r.taskId === task.id && isSatisfyingRun(r));
+  const fire = previousFireTime(task.schedule, now);
+  if (fire === null) return satisfyingRuns.length === 0;
+  const fireMs = fire.getTime();
+  const satisfied = satisfyingRuns.some((r) => new Date(r.completedAt).getTime() >= fireMs);
+  return !satisfied;
+}
+function selectTasks(tasks, history, filter) {
+  const eligible = tasks.filter((t) => t.excludeFromHumanSweep !== true);
+  switch (filter.mode) {
+    case "all":
+      return eligible;
+    case "ids": {
+      const wanted = new Set(filter.ids ?? []);
+      return eligible.filter((t) => wanted.has(t.id));
+    }
+    case "overdue":
+      return eligible.filter((t) => isOverdue(t, history, filter.now));
+  }
+}
+
 // src/sessions/search-index.ts
-import * as fs18 from "fs";
+import * as fs16 from "fs";
 import * as path22 from "path";
 import Database2 from "better-sqlite3";
 import { INDEXED_FILE_KINDS } from "@harness-engineering/types";
@@ -14447,7 +15099,7 @@ var SqliteSearchIndex = class {
   removeSessionStmt;
   totalStmt;
   constructor(dbPath) {
-    fs18.mkdirSync(path22.dirname(dbPath), { recursive: true });
+    fs16.mkdirSync(path22.dirname(dbPath), { recursive: true });
     this.db = new Database2(dbPath);
     this.db.pragma("journal_mode = WAL");
     this.db.pragma("synchronous = NORMAL");
@@ -14553,12 +15205,12 @@ function indexSessionDirectory(idx, args) {
   for (const kind of kinds) {
     const fileName = FILE_KIND_TO_FILENAME[kind];
     const filePath = path22.join(args.sessionDir, fileName);
-    if (!fs18.existsSync(filePath)) continue;
-    let body = fs18.readFileSync(filePath, "utf8");
+    if (!fs16.existsSync(filePath)) continue;
+    let body = fs16.readFileSync(filePath, "utf8");
     if (Buffer.byteLength(body, "utf8") > cap) {
       body = body.slice(0, cap) + "\n\n[TRUNCATED]";
     }
-    const stat = fs18.statSync(filePath);
+    const stat = fs16.statSync(filePath);
     const relPath = path22.relative(args.projectPath, filePath).replaceAll("\\", "/");
     idx.upsertSessionDoc({
       sessionId: args.sessionId,
@@ -14580,8 +15232,8 @@ function reindexFromArchive(projectPath, opts = {}) {
     idx.resetArchived();
     let sessionsIndexed = 0;
     let docsWritten = 0;
-    if (fs18.existsSync(archiveBase)) {
-      const entries = fs18.readdirSync(archiveBase, { withFileTypes: true });
+    if (fs16.existsSync(archiveBase)) {
+      const entries = fs16.readdirSync(archiveBase, { withFileTypes: true });
       for (const entry of entries) {
         if (!entry.isDirectory()) continue;
         const sessionDir = path22.join(archiveBase, entry.name);
@@ -14604,12 +15256,12 @@ function reindexFromArchive(projectPath, opts = {}) {
 }
 
 // src/sessions/summarize.ts
-import * as fs19 from "fs";
+import * as fs17 from "fs";
 import * as path23 from "path";
 import {
   SessionSummarySchema
 } from "@harness-engineering/types";
-import { Ok as Ok24, Err as Err21 } from "@harness-engineering/types";
+import { Ok as Ok24, Err as Err23 } from "@harness-engineering/types";
 var LLM_SUMMARY_FILE = "llm-summary.md";
 var SUMMARY_INPUT_FILES = [
   { filename: "summary.md", kind: "summary" },
@@ -14636,9 +15288,9 @@ function readInputCorpus(archiveDir) {
   const parts = [];
   for (const { filename, kind } of SUMMARY_INPUT_FILES) {
     const p = path23.join(archiveDir, filename);
-    if (!fs19.existsSync(p)) continue;
+    if (!fs17.existsSync(p)) continue;
     try {
-      const content = fs19.readFileSync(p, "utf8");
+      const content = fs17.readFileSync(p, "utf8");
       if (content.trim().length === 0) continue;
       parts.push(`## FILE: ${kind}
 
@@ -14700,17 +15352,17 @@ status: failed
 
 - reason: ${reason}
 `;
-  fs19.writeFileSync(filePath, body, "utf8");
+  fs17.writeFileSync(filePath, body, "utf8");
   return filePath;
 }
 async function summarizeArchivedSession(ctx) {
   const writeStubOnError = ctx.writeStubOnError ?? true;
-  if (!fs19.existsSync(ctx.archiveDir)) {
-    return Err21(new Error(`archive directory not found: ${ctx.archiveDir}`));
+  if (!fs17.existsSync(ctx.archiveDir)) {
+    return Err23(new Error(`archive directory not found: ${ctx.archiveDir}`));
   }
   const corpus = readInputCorpus(ctx.archiveDir);
   if (corpus.trim().length === 0) {
-    return Err21(new Error(`no summary input files found in ${ctx.archiveDir}`));
+    return Err23(new Error(`no summary input files found in ${ctx.archiveDir}`));
   }
   const inputBudgetTokens = ctx.config?.inputBudgetTokens ?? DEFAULT_INPUT_BUDGET_TOKENS;
   const truncated = truncateForBudget(corpus, inputBudgetTokens);
@@ -14743,7 +15395,7 @@ async function summarizeArchivedSession(ctx) {
       } catch {
       }
     }
-    return Err21(
+    return Err23(
       new Error(`session summary failed: ${reason}` + (stubPath ? ` (stub: ${stubPath})` : ""))
     );
   }
@@ -14757,7 +15409,7 @@ async function summarizeArchivedSession(ctx) {
       } catch {
       }
     }
-    return Err21(new Error(reason));
+    return Err23(new Error(reason));
   }
   const meta = {
     generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
@@ -14768,7 +15420,7 @@ async function summarizeArchivedSession(ctx) {
   };
   const filePath = path23.join(ctx.archiveDir, LLM_SUMMARY_FILE);
   const body = renderLlmSummaryMarkdown(parsed.data, meta);
-  fs19.writeFileSync(filePath, body, "utf8");
+  fs17.writeFileSync(filePath, body, "utf8");
   return Ok24({ summary: parsed.data, meta, filePath });
 }
 function isSummaryEnabled(config) {
@@ -14848,13 +15500,18 @@ export {
   BUILT_IN_TASKS,
   BackendDefSchema,
   BackendRouter,
+  CheckScriptRunner,
   ClaimManager,
   GateNotReadyError,
   GateRunError,
   InteractionQueue,
+  LinearGraphQLClient,
   LinearGraphQLStub,
   LocalModelResolver,
+  MAINTENANCE_CHECK_MAX_BUFFER,
+  MAINTENANCE_CHECK_TIMEOUT_MS,
   MAX_ATTEMPTS,
+  MaintenanceReporter,
   MockBackend,
   ORCHESTRATOR_IDENTITY_FILE,
   Orchestrator,
@@ -14872,6 +15529,7 @@ export {
   SqliteSearchIndex,
   StreamRecorder,
   TaskOutputStore,
+  TaskRunner,
   TokenStore,
   WebhookQueue,
   WorkflowLoader,
@@ -14882,7 +15540,9 @@ export {
   buildArchiveHooks,
   calculateRetryDelay,
   canDispatch,
+  classifyCheckExecutionFailure,
   computeRateLimitDelay,
+  createAgentDispatcher,
   createBackend,
   createEmptyState,
   crossFieldRoutingIssues,
@@ -14894,22 +15554,27 @@ export {
   emitProposalApproved,
   emitProposalCreated,
   emitProposalRejected,
+  explicitFindingsCount,
   extractHighlights,
   extractTitlePrefix,
   getAvailableSlots,
   getDefaultConfig,
   getPerStateCount,
   indexSessionDirectory,
+  isCheckTimeoutError,
   isEligible,
   isSummaryEnabled,
   launchTUI,
   loadPublishedIndex,
+  makeBackendResolver,
   migrateAgentConfig,
   normalizeFts5Query,
+  normalizeHarnessCommand,
   normalizeLocalModel,
   openSearchIndex,
   promote,
   reconcile,
+  recoverFindingsCount,
   reindexFromArchive,
   renderAnalysisComment,
   renderLlmSummaryMarkdown,
@@ -14919,9 +15584,11 @@ export {
   routeIssue,
   routingWarnings,
   runGate,
+  runHarnessCheck,
   savePublishedIndex,
   searchIndexPath,
   selectCandidates,
+  selectTasks,
   sortCandidates,
   summarizeArchivedSession,
   syncMain,