@hasna/loops 0.4.12 → 0.4.14

package/dist/cli/index.js

@@ -3,9 +3,9 @@
 
 // src/lib/store.ts
 import { Database } from "bun:sqlite";
-import { chmodSync, existsSync, mkdirSync as mkdirSync3, mkdtempSync, rmSync as rmSync2 } from "fs";
-import { tmpdir } from "os";
-import { basename as basename2, dirname as dirname2, join as join3 } from "path";
+import { chmodSync, existsSync, mkdirSync as mkdirSync3, mkdtempSync as mkdtempSync2, rmSync as rmSync3 } from "fs";
+import { tmpdir as tmpdir2 } from "os";
+import { basename as basename2, dirname as dirname2, join as join4 } from "path";
 
 // src/lib/errors.ts
 class CodedError extends Error {
@@ -1204,6 +1204,196 @@ function discardWorkflowRunManifest(staged) {
   } catch {}
 }
 
+// src/lib/route/todos-cli.ts
+import { closeSync, mkdtempSync, openSync, readFileSync as readFileSync3, rmSync as rmSync2 } from "fs";
+import { spawnSync as spawnSync2 } from "child_process";
+import { join as join3 } from "path";
+import { homedir as homedir2, tmpdir } from "os";
+
+// src/lib/format.ts
+var TEXT_OUTPUT_LIMIT = 32 * 1024;
+var SENSITIVE_PAYLOAD_KEYS = new Set(["env", "error", "prompt", "reason", "stderr", "stdout"]);
+function redact(value, visible = 0) {
+  if (!value)
+    return value;
+  if (value.length <= visible)
+    return value;
+  if (visible <= 0)
+    return `[redacted ${value.length} chars]`;
+  return `${value.slice(0, visible)}... [redacted ${value.length - visible} chars]`;
+}
+function truncateTextOutput(value) {
+  if (value.length <= TEXT_OUTPUT_LIMIT)
+    return value;
+  return `${value.slice(0, TEXT_OUTPUT_LIMIT)}
+[truncated ${value.length - TEXT_OUTPUT_LIMIT} chars]`;
+}
+function redactSensitivePayload(value, key) {
+  if (key && SENSITIVE_PAYLOAD_KEYS.has(key)) {
+    if (typeof value === "string")
+      return redact(value);
+    if (value === undefined || value === null)
+      return value;
+    return "[redacted]";
+  }
+  if (Array.isArray(value))
+    return value.map((item) => redactSensitivePayload(item));
+  if (value && typeof value === "object") {
+    return Object.fromEntries(Object.entries(value).map(([entryKey, entryValue]) => [entryKey, redactSensitivePayload(entryValue, entryKey)]));
+  }
+  return value;
+}
+function textOutputBlocks(value, opts = {}) {
+  const indent = opts.indent ?? "";
+  const nested = `${indent}  `;
+  const blocks = [];
+  for (const [label, output] of [
+    ["stdout", value.stdout],
+    ["stderr", value.stderr]
+  ]) {
+    if (!output)
+      continue;
+    blocks.push(`${indent}${label}:`);
+    for (const line of truncateTextOutput(output).replace(/\s+$/, "").split(/\r?\n/)) {
+      blocks.push(`${nested}${line}`);
+    }
+  }
+  return blocks;
+}
+function publicLoop(loop) {
+  const target = loop.target.type === "command" ? { ...loop.target, env: loop.target.env ? "[redacted]" : undefined } : loop.target.type === "agent" ? { ...loop.target, prompt: redact(loop.target.prompt) } : loop.target;
+  return {
+    ...loop,
+    target
+  };
+}
+function publicRun(run, showOutput = false, opts = {}) {
+  return {
+    ...run,
+    stdout: showOutput ? run.stdout : run.stdout ? `[redacted ${run.stdout.length} chars]` : undefined,
+    stderr: showOutput ? run.stderr : run.stderr ? `[redacted ${run.stderr.length} chars]` : undefined,
+    error: opts.redactError ? redact(run.error) : run.error
+  };
+}
+function publicExecutorResult(result, showOutput = false) {
+  return {
+    ...result,
+    stdout: showOutput ? result.stdout : result.stdout ? `[redacted ${result.stdout.length} chars]` : undefined,
+    stderr: showOutput ? result.stderr : result.stderr ? `[redacted ${result.stderr.length} chars]` : undefined,
+    error: redact(result.error)
+  };
+}
+function publicWorkflow(workflow) {
+  return {
+    ...workflow,
+    steps: workflow.steps.map((step) => ({
+      ...step,
+      target: step.target.type === "agent" ? { ...step.target, prompt: redact(step.target.prompt) } : step.target.type === "command" && step.target.env ? { ...step.target, env: "[redacted]" } : step.target
+    }))
+  };
+}
+function publicWorkflowRun(run) {
+  return { ...run, error: redact(run.error) };
+}
+function publicWorkflowInvocation(invocation) {
+  return redactSensitivePayload(invocation);
+}
+function publicWorkflowWorkItem(item) {
+  return { ...item, lastReason: redact(item.lastReason, 240) };
+}
+function publicWorkflowStepRun(run, showOutput = false) {
+  return {
+    ...run,
+    stdout: showOutput ? run.stdout : run.stdout ? `[redacted ${run.stdout.length} chars]` : undefined,
+    stderr: showOutput ? run.stderr : run.stderr ? `[redacted ${run.stderr.length} chars]` : undefined,
+    error: redact(run.error)
+  };
+}
+function publicWorkflowEvent(event) {
+  return { ...event, payload: redactSensitivePayload(event.payload) };
+}
+function publicGoal(goal) {
+  return {
+    ...goal,
+    objective: redact(goal.objective, 120)
+  };
+}
+function publicGoalRun(run) {
+  return {
+    ...run,
+    evidence: redactSensitivePayload(run.evidence),
+    rawResponse: redactSensitivePayload(run.rawResponse)
+  };
+}
+
+// src/lib/route/todos-cli.ts
+function defaultLoopsProject() {
+  return process.env.LOOPS_TASK_PROJECT || process.env.LOOPS_DATA_DIR || `${process.env.HOME || homedir2()}/.hasna/loops`;
+}
+function runLocalCommand(command, args, opts = {}) {
+  const result = spawnSync2(command, args, {
+    input: opts.input,
+    encoding: "utf8",
+    timeout: opts.timeoutMs ?? 30000,
+    maxBuffer: opts.maxBuffer ?? 8 * 1024 * 1024,
+    env: process.env
+  });
+  return {
+    ok: result.status === 0,
+    status: result.status,
+    stdout: result.stdout || "",
+    stderr: result.stderr || "",
+    error: result.error ? String(result.error.message || result.error) : ""
+  };
+}
+function runLocalCommandWithStdoutFile(command, args, opts = {}) {
+  const tempDir = mkdtempSync(join3(tmpdir(), "loops-command-output-"));
+  const stdoutPath = join3(tempDir, "stdout");
+  const stdoutFd = openSync(stdoutPath, "w");
+  let result;
+  try {
+    result = spawnSync2(command, args, {
+      input: opts.input,
+      encoding: "utf8",
+      timeout: opts.timeoutMs ?? 30000,
+      maxBuffer: opts.maxBuffer ?? 8 * 1024 * 1024,
+      env: process.env,
+      stdio: ["pipe", stdoutFd, "pipe"]
+    });
+  } finally {
+    closeSync(stdoutFd);
+  }
+  try {
+    return {
+      ok: result.status === 0,
+      status: result.status,
+      stdout: readFileSync3(stdoutPath, "utf8"),
+      stderr: typeof result.stderr === "string" ? result.stderr : result.stderr?.toString() || "",
+      error: result.error ? String(result.error.message || result.error) : ""
+    };
+  } finally {
+    rmSync2(tempDir, { recursive: true, force: true });
+  }
+}
+function ensureTodosTaskList(project, slug, name, description) {
+  runLocalCommand("todos", ["--project", project, "task-lists", "--add", name, "--slug", slug, "-d", description]);
+  const list = runLocalCommand("todos", ["--project", project, "--json", "task-lists"]);
+  if (!list.ok)
+    throw new Error(list.stderr || list.error || "failed to list todos task lists");
+  const values = JSON.parse(list.stdout || "[]");
+  const found = values.find((entry) => entry.slug === slug);
+  if (!found)
+    throw new Error(`todos task list not found after ensure: ${slug}`);
+  return found.id;
+}
+function todosMutationSummary(result) {
+  return {
+    ok: result.ok,
+    status: result.status,
+    error: result.ok ? undefined : redact(result.stderr || result.error || "todos mutation failed", 320)
+  };
+}
+
 // src/lib/store.ts
 var DEFAULT_RECOVERY_BATCH_LIMIT = 100;
 var DEFAULT_RECOVERY_SCAN_MULTIPLIER = 5;
@@ -1213,6 +1403,7 @@ var TERMINAL_RUN_STATUSES = ["succeeded", "failed", "timed_out", "abandoned", "s
 var PRUNE_BATCH_SIZE = 400;
 var GENERATED_ROUTE_TEMPLATE_IDS = new Set(["todos-task-worker-verifier", "task-lifecycle", "event-worker-verifier"]);
 var GENERATED_ROUTE_KEYS = new Set(["todos-task", "generic-event"]);
+var TASK_LIFECYCLE_TEMPLATE_ID = "task-lifecycle";
 function rowToLoop(row) {
   return {
     id: row.id,
@@ -1263,6 +1454,9 @@ function rowToRun(row) {
     updatedAt: row.updated_at
   };
 }
+function latestRunTime(row) {
+  return row.finished_at ?? row.started_at ?? row.created_at;
+}
 function rowToWorkflow(row) {
   return {
     id: row.id,
@@ -1517,7 +1711,7 @@ class Store {
     const file = path ?? dbPath();
     if (file !== ":memory:")
       ensurePrivateStorePath(file);
-    this.rootDir = file === ":memory:" ? mkdtempSync(join3(tmpdir(), "open-loops-store-")) : dirname2(file);
+    this.rootDir = file === ":memory:" ? mkdtempSync2(join4(tmpdir2(), "open-loops-store-")) : dirname2(file);
     if (file === ":memory:")
       this.memoryRootDir = this.rootDir;
     this.db = new Database(file);
@@ -2015,7 +2209,32 @@ class Store {
     } else {
       rows = this.db.query("SELECT * FROM loops WHERE archived_at IS NULL ORDER BY status ASC, next_run_at ASC LIMIT ?").all(limit);
     }
-    return rows.map(rowToLoop);
+    return this.withLatestRunSummaries(rows.map(rowToLoop));
+  }
+  withLatestRunSummaries(loops) {
+    if (loops.length === 0)
+      return loops;
+    const placeholders = loops.map(() => "?").join(",");
+    const rows = this.db.query(`SELECT loop_id, id, status, started_at, finished_at, created_at
+         FROM (
+           SELECT loop_id, id, status, started_at, finished_at, created_at,
+             ROW_NUMBER() OVER (PARTITION BY loop_id ORDER BY created_at DESC, id DESC) AS rn
+           FROM loop_runs
+           WHERE loop_id IN (${placeholders})
+         )
+         WHERE rn = 1`).all(...loops.map((loop) => loop.id));
+    const latestByLoopId = new Map(rows.map((row) => [row.loop_id, row]));
+    return loops.map((loop) => {
+      const latest = latestByLoopId.get(loop.id);
+      if (!latest)
+        return loop;
+      return {
+        ...loop,
+        latestRunId: latest.id,
+        latestRunStatus: latest.status,
+        lastRunAt: latestRunTime(latest)
+      };
+    });
   }
   dueLoops(now, limit = 500) {
     const rows = this.db.query(`SELECT * FROM loops
@@ -2134,6 +2353,45 @@ class Store {
       throw error;
     }
   }
+  updateAgentLoopTimeout(idOrName, timeoutMs, opts = {}) {
+    const updated = (opts.now ?? new Date).toISOString();
+    this.db.exec("BEGIN IMMEDIATE");
+    try {
+      const current = this.requireUniqueLoop(idOrName);
+      if (current.archivedAt)
+        throw new LoopArchivedError(current.name || current.id);
+      if (current.target.type !== "agent")
+        throw new Error(`loop is not an agent loop: ${idOrName}`);
+      if (this.hasRunningRun(current.id))
+        throw new Error(`refusing to update running loop: ${current.id}`);
+      const target = { ...current.target, timeoutMs };
+      if (timeoutMs === null && target.idleTimeoutMs !== undefined)
+        delete target.idleTimeoutMs;
+      const res = this.db.query(`UPDATE loops SET target_json=$target, updated_at=$updated
+           WHERE id=$id
+             AND ($daemonLeaseId IS NULL OR EXISTS (
+               SELECT 1 FROM daemon_lease WHERE id=$daemonLeaseId AND expires_at > $now
+             ))`).run({
+        $id: current.id,
+        $target: JSON.stringify(target),
+        $updated: updated,
+        $daemonLeaseId: opts.daemonLeaseId ?? null,
+        $now: updated
+      });
+      if (res.changes !== 1)
+        throw new Error("daemon lease lost");
+      this.db.exec("COMMIT");
+      const after = this.getLoop(current.id);
+      if (!after)
+        throw new Error(`loop not found after timeout update: ${current.id}`);
+      return after;
+    } catch (error) {
+      try {
+        this.db.exec("ROLLBACK");
+      } catch {}
+      throw error;
+    }
+  }
   createAndRetargetWorkflowLoop(idOrName, workflowInput, opts = {}) {
     const normalized = normalizeCreateWorkflowInput(workflowInput);
     const updated = (opts.now ?? new Date).toISOString();
@@ -2464,6 +2722,59 @@ class Store {
       updated
     });
   }
+  taskLifecycleTodosPointerContext(workflowRunId) {
+    const run = this.getWorkflowRun(workflowRunId);
+    if (!run || run.status !== "succeeded" || !run.invocationId || !run.workItemId || !run.manifestPath)
+      return;
+    const workItem = this.getWorkflowWorkItem(run.workItemId);
+    if (!workItem || workItem.routeKey !== "todos-task")
+      return;
+    const invocation = this.getWorkflowInvocation(run.invocationId);
+    if (!invocation || invocation.templateId !== TASK_LIFECYCLE_TEMPLATE_ID)
+      return;
+    const projectPath = workItem.projectKey ?? invocation.scope?.projectPath;
+    const taskId = invocation.subjectRef.id ?? workItem.subjectRef;
+    if (!projectPath || !taskId)
+      return;
+    return {
+      projectPath,
+      taskId,
+      invocationId: invocation.id,
+      workflowRunId: run.id,
+      manifestPath: run.manifestPath
+    };
+  }
+  syncSuccessfulTaskLifecycleTodosPointers(workflowRunId) {
+    const context = this.taskLifecycleTodosPointerContext(workflowRunId);
+    if (!context)
+      return;
+    const result = runLocalCommand("todos", [
+      "--project",
+      context.projectPath,
+      "task",
+      "workflow-pointers",
+      context.taskId,
+      "--clear",
+      "--invocation",
+      context.invocationId,
+      "--run",
+      context.workflowRunId,
+      "--manifest",
+      context.manifestPath,
+      "--state",
+      "succeeded",
+      "--actor",
+      "openloops:task-lifecycle"
+    ]);
+    this.appendWorkflowEvent(workflowRunId, result.ok ? "todos_workflow_pointers_synced" : "todos_workflow_pointers_sync_failed", undefined, {
+      projectPath: context.projectPath,
+      taskId: context.taskId,
+      invocationId: context.invocationId,
+      workflowRunId: context.workflowRunId,
+      manifestPath: context.manifestPath,
+      mutation: todosMutationSummary(result)
+    });
+  }
   createWorkflowInvocation(input) {
     const now = nowIso();
     const sourceDedupeKey = input.sourceRef.dedupeKey ?? undefined;
@@ -3426,6 +3737,8 @@ class Store {
     const run = this.getWorkflowRun(workflowRunId);
     if (!run)
       throw new Error(`workflow run not found after finalize: ${workflowRunId}`);
+    if (changed && status === "succeeded")
+      this.syncSuccessfulTaskLifecycleTodosPointers(workflowRunId);
     return run;
   }
   cancelWorkflowRun(workflowRunId, reason = "cancelled by user") {
@@ -3487,6 +3800,17 @@ class Store {
     const row = this.db.query("SELECT COUNT(*) AS count FROM loop_runs WHERE loop_id = ? AND scheduled_for = ? AND status = 'running'").get(loopId, scheduledFor);
     return (row?.count ?? 0) > 0;
   }
+  hasBlockingRunningRunForOtherSlot(loopId, scheduledFor, nowIso2) {
+    const rows = this.db.query(`SELECT * FROM loop_runs
+         WHERE loop_id = ? AND scheduled_for <> ? AND status = 'running'`).all(loopId, scheduledFor);
+    return rows.some((row) => {
+      if (!row.lease_expires_at || row.lease_expires_at > nowIso2)
+        return true;
+      if (isRecordedProcessAlive(row.pid, row.process_started_at))
+        return true;
+      return this.hasLiveWorkflowStepProcesses(row.id);
+    });
+  }
   markRunPid(id, pid, claimedBy, opts = {}) {
     const now = (opts.now ?? new Date).toISOString();
     const startedMs = processStartTimeMs(pid);
@@ -3619,6 +3943,10 @@ class Store {
       loop = currentLoop;
       const leaseExpiresAt = new Date(now.getTime() + loop.leaseMs).toISOString();
       const existing = this.getRunBySlot(loop.id, scheduledFor);
+      if (loop.overlap === "skip" && this.hasBlockingRunningRunForOtherSlot(loop.id, scheduledFor, startedAt)) {
+        this.db.exec("COMMIT");
+        return;
+      }
       if (existing) {
         if (existing.status === "running") {
           if (existing.leaseExpiresAt && existing.leaseExpiresAt <= startedAt && isRecordedProcessAlive(existing.pid, existing.processStartedAt)) {
@@ -4190,9 +4518,9 @@ class Store {
       const runDir = dirname2(manifestPath);
       try {
         if (/^[0-9a-f]{12,64}$/.test(basename2(runDir))) {
-          rmSync2(runDir, { recursive: true, force: true });
+          rmSync3(runDir, { recursive: true, force: true });
         } else {
-          rmSync2(manifestPath, { force: true });
+          rmSync3(manifestPath, { force: true });
         }
       } catch {}
     }
@@ -4259,7 +4587,7 @@ class Store {
     this.db.close();
     if (this.memoryRootDir) {
       try {
-        rmSync2(this.memoryRootDir, { recursive: true, force: true });
+        rmSync3(this.memoryRootDir, { recursive: true, force: true });
       } catch {}
       this.memoryRootDir = undefined;
     }
@@ -4268,7 +4596,7 @@ class Store {
 // package.json
 var package_default = {
   name: "@hasna/loops",
-  version: "0.4.12",
+  version: "0.4.14",
   description: "Persistent local loop and workflow runner for deterministic commands and headless AI coding agents",
   type: "module",
   main: "dist/index.js",
@@ -4277,6 +4605,7 @@ var package_default = {
     loops: "dist/cli/index.js",
     "loops-daemon": "dist/daemon/index.js",
     "loops-api": "dist/api/index.js",
+    "loops-serve": "dist/serve/index.js",
     "loops-runner": "dist/runner/index.js",
     "loops-mcp": "dist/mcp/index.js"
   },
@@ -4289,6 +4618,14 @@ var package_default = {
       types: "./dist/sdk/index.d.ts",
       import: "./dist/sdk/index.js"
     },
+    "./sdk/http": {
+      types: "./dist/sdk/http.d.ts",
+      import: "./dist/sdk/http.js"
+    },
+    "./serve": {
+      types: "./dist/serve/index.d.ts",
+      import: "./dist/serve/index.js"
+    },
     "./mcp": {
       types: "./dist/mcp/index.d.ts",
       import: "./dist/mcp/index.js"
@@ -4334,7 +4671,7 @@ var package_default = {
     "LICENSE"
   ],
   scripts: {
-    build: "rm -rf dist && bun build src/cli/index.ts src/daemon/index.ts src/api/index.ts src/runner/index.ts src/mcp/index.ts src/index.ts src/sdk/index.ts src/lib/store.ts src/lib/mode.ts src/lib/storage/index.ts src/lib/storage/contract.ts src/lib/storage/sqlite.ts src/lib/storage/postgres.ts src/lib/storage/postgres-schema.ts --root src --outdir dist --target bun --packages external && chmod +x dist/cli/index.js dist/daemon/index.js dist/api/index.js dist/runner/index.js dist/mcp/index.js && tsc -p tsconfig.build.json --emitDeclarationOnly --outDir dist",
+    build: "rm -rf dist && bun build src/cli/index.ts src/daemon/index.ts src/api/index.ts src/serve/index.ts src/runner/index.ts src/mcp/index.ts src/index.ts src/sdk/index.ts src/sdk/http.ts src/lib/store.ts src/lib/mode.ts src/lib/storage/index.ts src/lib/storage/contract.ts src/lib/storage/sqlite.ts src/lib/storage/postgres.ts src/lib/storage/postgres-schema.ts --root src --outdir dist --target bun --packages external && chmod +x dist/cli/index.js dist/daemon/index.js dist/api/index.js dist/serve/index.js dist/runner/index.js dist/mcp/index.js && tsc -p tsconfig.build.json --emitDeclarationOnly --outDir dist",
     "build:bin": "bun build src/cli/index.ts --compile --outfile dist/loops",
     typecheck: "tsc --noEmit",
     test: "bun test",
@@ -4369,11 +4706,13 @@ var package_default = {
     bun: ">=1.0.0"
   },
   dependencies: {
+    "@hasna/contracts": "^0.4.1",
     "@hasna/events": "^0.1.9",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@openrouter/ai-sdk-provider": "2.9.1",
     ai: "6.0.204",
     commander: "^13.1.0",
+    pg: "^8.13.1",
     zod: "4.4.3"
   },
   optionalDependencies: {
@@ -4381,6 +4720,7 @@ var package_default = {
   },
   devDependencies: {
     "@types/bun": "latest",
+    "@types/pg": "^8.11.10",
     typescript: "^5.7.3"
   },
   publishConfig: {
@@ -4459,6 +4799,50 @@ function sourceOfTruthForMode(mode) {
     return "self_hosted_control_plane";
   return "cloud_control_plane";
 }
+var ROUTE_ADMISSION_GATES = [
+  "max_dispatch",
+  "max_active",
+  "max_active_per_project",
+  "max_active_per_project_group",
+  "max_active_scope",
+  "max_per_profile"
+];
+function remoteSchedulerBackendForMode(mode, config) {
+  if (mode === "local")
+    return "none";
+  if (mode === "cloud")
+    return config.cloudApiUrl ? "hosted_control_plane_contract" : "unconfigured";
+  if (config.databaseUrlPresent)
+    return "postgres_contract";
+  if (config.apiUrl)
+    return "api_control_plane_contract";
+  return "unconfigured";
+}
+function schedulerStateForMode(args) {
+  const nonLocal = args.deploymentMode !== "local";
+  return {
+    authority: args.sourceOfTruth,
+    localStore: {
+      backend: "sqlite",
+      role: args.localRole,
+      runArtifacts: "local_files",
+      routeAdmissionState: "workflow_work_items"
+    },
+    remoteStore: {
+      backend: remoteSchedulerBackendForMode(args.deploymentMode, args.config),
+      configured: nonLocal && args.controlPlaneConfigured,
+      applySupported: false,
+      objectArtifacts: nonLocal ? "object_store_contract" : "none",
+      mutatesAws: false
+    },
+    routeAdmission: {
+      stateStore: nonLocal ? "control_plane_contract" : "local_sqlite",
+      activeStatuses: ["admitted", "running"],
+      gates: ROUTE_ADMISSION_GATES,
+      dryRunEvaluatesLiveCounts: false
+    }
+  };
+}
 function displayControlPlaneUrl(value) {
   if (!value)
     return;
@@ -4484,6 +4868,9 @@ function buildDeploymentStatus(opts = {}) {
   if (deploymentMode === "self_hosted" && !controlPlaneConfigured) {
     warnings.push("self_hosted mode needs LOOPS_API_URL or LOOPS_DATABASE_URL before it can become authoritative");
   }
+  if (deploymentMode === "self_hosted" && config.databaseUrlPresent && !config.apiUrl) {
+    warnings.push("LOOPS_DATABASE_URL selects the self_hosted storage contract; loops-runner still needs LOOPS_API_URL to claim remote work");
+  }
   if (deploymentMode === "cloud" && config.apiUrl && !config.cloudApiUrl) {
     warnings.push("LOOPS_API_URL selects self_hosted; cloud mode uses LOOPS_CLOUD_API_URL");
   }
@@ -4517,6 +4904,13 @@ function buildDeploymentStatus(opts = {}) {
       required: deploymentMode !== "local",
       role: deploymentMode === "local" ? "daemon" : "control_plane_worker"
     },
+    schedulerState: schedulerStateForMode({
+      deploymentMode,
+      sourceOfTruth: sourceOfTruthForMode(deploymentMode),
+      localRole: deploymentMode === "local" ? "authoritative" : "cache_and_spool",
+      controlPlaneConfigured,
+      config
+    }),
     warnings
   };
 }
@@ -4529,142 +4923,27 @@ function deploymentStatusLine(status) {
     `source=${status.deploymentModeSource}`,
     `truth=${status.sourceOfTruth}`,
     `local=${status.localStore.role}`,
+    `scheduler=${status.schedulerState.routeAdmission.stateStore}`,
     `control_plane=${configured}`
   ].join(" ");
 }
 
 // src/cli/index.ts
 import { randomUUID as randomUUID2 } from "crypto";
-import { existsSync as existsSync10, readdirSync as readdirSync3, readFileSync as readFileSync10, rmSync as rmSync7, statSync as statSync2, writeFileSync as writeFileSync6 } from "fs";
-import { join as join11 } from "path";
+import { existsSync as existsSync10, readdirSync as readdirSync3, readFileSync as readFileSync10, rmSync as rmSync7, statSync as statSync2, writeFileSync as writeFileSync7 } from "fs";
+import { join as join12 } from "path";
 import { Database as Database3 } from "bun:sqlite";
 import { Command } from "commander";
 
-// src/lib/format.ts
-var TEXT_OUTPUT_LIMIT = 32 * 1024;
-var SENSITIVE_PAYLOAD_KEYS = new Set(["env", "error", "prompt", "reason", "stderr", "stdout"]);
-function redact(value, visible = 0) {
-  if (!value)
-    return value;
-  if (value.length <= visible)
-    return value;
-  if (visible <= 0)
-    return `[redacted ${value.length} chars]`;
-  return `${value.slice(0, visible)}... [redacted ${value.length - visible} chars]`;
-}
-function truncateTextOutput(value) {
-  if (value.length <= TEXT_OUTPUT_LIMIT)
-    return value;
-  return `${value.slice(0, TEXT_OUTPUT_LIMIT)}
-[truncated ${value.length - TEXT_OUTPUT_LIMIT} chars]`;
-}
-function redactSensitivePayload(value, key) {
-  if (key && SENSITIVE_PAYLOAD_KEYS.has(key)) {
-    if (typeof value === "string")
-      return redact(value);
-    if (value === undefined || value === null)
-      return value;
-    return "[redacted]";
-  }
-  if (Array.isArray(value))
-    return value.map((item) => redactSensitivePayload(item));
-  if (value && typeof value === "object") {
-    return Object.fromEntries(Object.entries(value).map(([entryKey, entryValue]) => [entryKey, redactSensitivePayload(entryValue, entryKey)]));
-  }
-  return value;
-}
-function textOutputBlocks(value, opts = {}) {
-  const indent = opts.indent ?? "";
-  const nested = `${indent}  `;
-  const blocks = [];
-  for (const [label, output] of [
-    ["stdout", value.stdout],
-    ["stderr", value.stderr]
-  ]) {
-    if (!output)
-      continue;
-    blocks.push(`${indent}${label}:`);
-    for (const line of truncateTextOutput(output).replace(/\s+$/, "").split(/\r?\n/)) {
-      blocks.push(`${nested}${line}`);
-    }
-  }
-  return blocks;
-}
-function publicLoop(loop) {
-  const target = loop.target.type === "command" ? { ...loop.target, env: loop.target.env ? "[redacted]" : undefined } : loop.target.type === "agent" ? { ...loop.target, prompt: redact(loop.target.prompt) } : loop.target;
-  return {
-    ...loop,
-    target
-  };
-}
-function publicRun(run, showOutput = false, opts = {}) {
-  return {
-    ...run,
-    stdout: showOutput ? run.stdout : run.stdout ? `[redacted ${run.stdout.length} chars]` : undefined,
-    stderr: showOutput ? run.stderr : run.stderr ? `[redacted ${run.stderr.length} chars]` : undefined,
-    error: opts.redactError ? redact(run.error) : run.error
-  };
-}
-function publicExecutorResult(result, showOutput = false) {
-  return {
-    ...result,
-    stdout: showOutput ? result.stdout : result.stdout ? `[redacted ${result.stdout.length} chars]` : undefined,
-    stderr: showOutput ? result.stderr : result.stderr ? `[redacted ${result.stderr.length} chars]` : undefined,
-    error: redact(result.error)
-  };
-}
-function publicWorkflow(workflow) {
-  return {
-    ...workflow,
-    steps: workflow.steps.map((step) => ({
-      ...step,
-      target: step.target.type === "agent" ? { ...step.target, prompt: redact(step.target.prompt) } : step.target.type === "command" && step.target.env ? { ...step.target, env: "[redacted]" } : step.target
-    }))
-  };
-}
-function publicWorkflowRun(run) {
-  return { ...run, error: redact(run.error) };
-}
-function publicWorkflowInvocation(invocation) {
-  return redactSensitivePayload(invocation);
-}
-function publicWorkflowWorkItem(item) {
-  return { ...item, lastReason: redact(item.lastReason, 240) };
-}
-function publicWorkflowStepRun(run, showOutput = false) {
-  return {
-    ...run,
-    stdout: showOutput ? run.stdout : run.stdout ? `[redacted ${run.stdout.length} chars]` : undefined,
-    stderr: showOutput ? run.stderr : run.stderr ? `[redacted ${run.stderr.length} chars]` : undefined,
-    error: redact(run.error)
-  };
-}
-function publicWorkflowEvent(event) {
-  return { ...event, payload: redactSensitivePayload(event.payload) };
-}
-function publicGoal(goal) {
-  return {
-    ...goal,
-    objective: redact(goal.objective, 120)
-  };
-}
-function publicGoalRun(run) {
-  return {
-    ...run,
-    evidence: redactSensitivePayload(run.evidence),
-    rawResponse: redactSensitivePayload(run.rawResponse)
-  };
-}
-
 // src/lib/executor.ts
-import { spawn as spawn2, spawnSync as spawnSync3 } from "child_process";
+import { spawn as spawn2, spawnSync as spawnSync4 } from "child_process";
 import { randomBytes as randomBytes2 } from "crypto";
 import { once } from "events";
 import { lstatSync, mkdirSync as mkdirSync4, realpathSync } from "fs";
 import { dirname as dirname3, resolve as resolve2 } from "path";
 
 // src/lib/accounts.ts
-import { spawnSync as spawnSync2 } from "child_process";
+import { spawnSync as spawnSync3 } from "child_process";
 import { existsSync as existsSync2 } from "fs";
 var EXPORT_RE = /^export\s+([A-Za-z_][A-Za-z0-9_]*)=(.*)$/;
 var ACCOUNTS_ENV_TIMEOUT_MS = 30000;
@@ -4769,7 +5048,7 @@ function resolveAccountEnvSync(account, toolHint, env) {
   if (!account)
     return {};
   const tool = requiredAccountTool(account, toolHint);
-  const result = spawnSync2("accounts", ["env", account.profile, "--tool", tool], {
+  const result = spawnSync3("accounts", ["env", account.profile, "--tool", tool], {
     encoding: "utf8",
     env,
     stdio: ["ignore", "pipe", "pipe"],
@@ -4785,8 +5064,8 @@ function resolveAccountEnvSync(account, toolHint, env) {
 
 // src/lib/env.ts
 import { accessSync, constants } from "fs";
-import { homedir as homedir2 } from "os";
-import { delimiter, join as join4 } from "path";
+import { homedir as homedir3 } from "os";
+import { delimiter, join as join5 } from "path";
 function compactPathParts(parts) {
   const seen = new Set;
   const result = [];
@@ -4800,16 +5079,16 @@ function compactPathParts(parts) {
   return result;
 }
 function commonExecutableDirs(env = process.env) {
-  const home = env.HOME || homedir2();
+  const home = env.HOME || homedir3();
   return compactPathParts([
-    join4(home, ".local", "bin"),
-    join4(home, ".bun", "bin"),
-    join4(home, ".cargo", "bin"),
-    join4(home, ".npm-global", "bin"),
-    join4(home, "bin"),
-    env.BUN_INSTALL ? join4(env.BUN_INSTALL, "bin") : undefined,
+    join5(home, ".local", "bin"),
+    join5(home, ".bun", "bin"),
+    join5(home, ".cargo", "bin"),
+    join5(home, ".npm-global", "bin"),
+    join5(home, "bin"),
+    env.BUN_INSTALL ? join5(env.BUN_INSTALL, "bin") : undefined,
     env.PNPM_HOME,
-    env.NPM_CONFIG_PREFIX ? join4(env.NPM_CONFIG_PREFIX, "bin") : undefined,
+    env.NPM_CONFIG_PREFIX ? join5(env.NPM_CONFIG_PREFIX, "bin") : undefined,
     "/opt/homebrew/bin",
     "/usr/local/bin",
     "/usr/bin",
@@ -4833,7 +5112,7 @@ function executableExists(command, env = process.env) {
   if (command.includes("/"))
     return isExecutable(command);
   for (const dir of (env.PATH ?? "").split(delimiter)) {
-    if (dir && isExecutable(join4(dir, command)))
+    if (dir && isExecutable(join5(dir, command)))
       return true;
   }
   return false;
@@ -4974,6 +5253,32 @@ function timeoutResult(startedAt, error, fields = {}) {
 function successResult(startedAt, fields = {}) {
   return buildResult("succeeded", startedAt, fields);
 }
+function codewithJsonlHasTerminalSuccess(stdout) {
+  for (const line of stdout.split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed || !trimmed.startsWith("{"))
+      continue;
+    let event;
+    try {
+      event = JSON.parse(trimmed);
+    } catch {
+      continue;
+    }
+    if (!event || typeof event !== "object")
+      continue;
+    const record = event;
+    if (record.type === "task_complete")
+      return true;
+    const payload = record.payload;
+    if (payload && typeof payload === "object" && payload.type === "task_complete") {
+      return true;
+    }
+  }
+  return false;
+}
+function codewithJsonlReconciledSuccess(spec, fields) {
+  return spec.agentProvider === "codewith" && codewithJsonlHasTerminalSuccess(fields.stdout ?? "");
+}
 function notifySpawn(pid, opts) {
   if (!pid)
     return;
@@ -4989,10 +5294,48 @@ function shellQuote(value) {
   return `'${value.replace(/'/g, `'\\''`)}'`;
 }
 function codewithProfileCandidateFromLine(line) {
-  const cols = line.trim().split(/\s+/);
-  if (cols[0] === "*")
-    return cols[1];
-  return cols[0];
+  const trimmed = line.trim();
+  if (!trimmed || trimmed === "No auth profiles saved.")
+    return;
+  const cols = trimmed.split(/\s+/);
+  const candidate = cols[0] === "*" ? cols[1] : cols[0];
+  if (candidate === "NAME" && (cols[1] === "ACCOUNT" || cols[2] === "ACCOUNT"))
+    return;
+  if (candidate === '"name":') {
+    const jsonName = trimmed.match(/"name"\s*:\s*"([^"]+)"/)?.[1];
+    if (jsonName)
+      return jsonName;
+  }
+  return candidate;
+}
+function codewithProfileCandidatesFromJson(value) {
+  const candidates = [];
+  const root = value && typeof value === "object" ? value : undefined;
+  const addProfile = (entry) => {
+    if (!entry || typeof entry !== "object")
+      return;
+    const name = entry.name;
+    if (typeof name === "string" && name)
+      candidates.push(name);
+  };
+  const data = root?.data;
+  if (Array.isArray(data))
+    data.forEach(addProfile);
+  const profiles = root?.profiles;
+  if (Array.isArray(profiles))
+    profiles.forEach(addProfile);
+  return candidates;
+}
+function codewithProfileCandidatesFromOutput(output) {
+  const trimmed = output.trim();
+  const jsonStart = trimmed.indexOf("{");
+  const jsonEnd = trimmed.lastIndexOf("}");
+  if (jsonStart >= 0 && jsonEnd >= jsonStart) {
+    try {
+      return codewithProfileCandidatesFromJson(JSON.parse(trimmed.slice(jsonStart, jsonEnd + 1)));
+    } catch {}
+  }
+  return output.split(/\r?\n/).map(codewithProfileCandidateFromLine).filter(Boolean);
 }
 function codewithProfileForError(profile) {
   return /[\u0000-\u001F\u007F]/.test(profile) ? JSON.stringify(profile) ?? profile : profile;
@@ -5085,6 +5428,7 @@ function commandSpec(target, opts) {
     preflightAnyOf: invocation.preflightAnyOf,
     stdin: invocation.stdin,
     allowlist: agentTarget.allowlist,
+    agentProvider: agentTarget.provider,
     worktree: agentTarget.worktree
   };
 }
@@ -5244,7 +5588,7 @@ function remotePreflightScript(spec, metadata) {
   }
   if (spec.nativeAuthProfile?.provider === "codewith") {
     const profileForError = codewithProfileForError(spec.nativeAuthProfile.profile);
-    lines.push(`__OPENLOOPS_CODEWITH_PROFILE=${shellQuote(spec.nativeAuthProfile.profile)}`, "export __OPENLOOPS_CODEWITH_PROFILE", `__OPENLOOPS_CODEWITH_PROFILES="$(${shellQuote(spec.command)} profile list)" || {`, `  printf '%s\\n' ${shellQuote("codewith auth profile preflight failed")} >&2`, "  exit 1", "}", `if ! printf '%s\\n' "$__OPENLOOPS_CODEWITH_PROFILES" | awk 'NR > 1 { candidate = ($1 == "*" ? $2 : $1); if (candidate == ENVIRON["__OPENLOOPS_CODEWITH_PROFILE"]) found = 1 } END { exit(found ? 0 : 1) }'; then`, `  printf '%s\\n' ${shellQuote(`codewith auth profile not found: ${profileForError}`)} >&2`, "  exit 1", "fi");
+    lines.push(`__OPENLOOPS_CODEWITH_PROFILE=${shellQuote(spec.nativeAuthProfile.profile)}`, "export __OPENLOOPS_CODEWITH_PROFILE", "__openloops_codewith_profile_list_contains() {", `  printf '%s\\n' "$__OPENLOOPS_CODEWITH_PROFILES" | awk '{ line = $0; gsub(/^[[:space:]]+|[[:space:]]+$/, "", line); if (line == "" || line == "No auth profiles saved.") next; if (line ~ /"(data|profiles)"[[:space:]]*:[[:space:]]*\\[/) { in_profiles = 1; next } if (in_profiles && line ~ /^\\]/) { in_profiles = 0; next } json = line; if (in_profiles && json ~ /"name"[[:space:]]*:[[:space:]]*"/) { sub(/^.*"name"[[:space:]]*:[[:space:]]*"/, "", json); sub(/".*$/, "", json); if (json == ENVIRON["__OPENLOOPS_CODEWITH_PROFILE"]) found = 1; next } split(line, cols, /[[:space:]]+/); candidate = (cols[1] == "*" ? cols[2] : cols[1]); if (candidate == "NAME" && (cols[2] == "ACCOUNT" || cols[3] == "ACCOUNT")) next; if (candidate == ENVIRON["__OPENLOOPS_CODEWITH_PROFILE"]) found = 1 } END { exit(found ? 0 : 1) }'`, "}", `if __OPENLOOPS_CODEWITH_PROFILES="$(${shellQuote(spec.command)} profile list --json 2>/dev/null)" && __openloops_codewith_profile_list_contains; then`, "  :", "else", `  __OPENLOOPS_CODEWITH_PROFILES="$(${shellQuote(spec.command)} profile list)" || {`, `    printf '%s\\n' ${shellQuote("codewith auth profile preflight failed")} >&2`, "    exit 1", "  }", "  if ! __openloops_codewith_profile_list_contains; then", `    printf '%s\\n' ${shellQuote(`codewith auth profile not found: ${profileForError}`)} >&2`, "    exit 1", "  fi", "fi");
   }
   return lines.join(`
 `);
@@ -5262,6 +5606,12 @@ function transportEnv(opts) {
   return env;
 }
 function assertCodewithProfileListed(profile, result) {
+  const profiles = codewithProfileSetFromResult(result);
+  if (!profiles.has(profile)) {
+    throw new Error(`codewith auth profile not found: ${codewithProfileForError(profile)}`);
+  }
+}
+function codewithProfileSetFromResult(result) {
   if (result.error) {
     throw new Error(`codewith auth profile preflight failed: ${result.error}`);
   }
@@ -5269,32 +5619,42 @@ function assertCodewithProfileListed(profile, result) {
     const detail = (result.stderr || result.stdout || `exit ${result.status ?? "unknown"}`).trim();
     throw new Error(`codewith auth profile preflight failed${detail ? `: ${detail}` : ""}`);
   }
-  const profiles = new Set((result.stdout || "").split(/\r?\n/).slice(1).map(codewithProfileCandidateFromLine).filter(Boolean));
-  if (!profiles.has(profile)) {
-    throw new Error(`codewith auth profile not found: ${codewithProfileForError(profile)}`);
-  }
+  return new Set(codewithProfileCandidatesFromOutput(result.stdout || ""));
 }
 function preflightNativeAuthProfileSync(spec, env) {
   if (spec.nativeAuthProfile?.provider !== "codewith")
     return;
-  const result = spawnSync3(spec.command, ["profile", "list"], {
-    encoding: "utf8",
-    env,
-    stdio: ["ignore", "pipe", "pipe"],
-    timeout: 15000
-  });
-  assertCodewithProfileListed(spec.nativeAuthProfile.profile, {
-    status: result.status,
-    stdout: result.stdout ?? "",
-    stderr: result.stderr ?? "",
-    error: result.error?.message
-  });
+  const runProfileList = (args) => {
+    const result = spawnSync4(spec.command, args, {
+      encoding: "utf8",
+      env,
+      stdio: ["ignore", "pipe", "pipe"],
+      timeout: 15000
+    });
+    return {
+      status: result.status,
+      stdout: result.stdout ?? "",
+      stderr: result.stderr ?? "",
+      error: result.error?.message
+    };
+  };
+  const jsonResult = runProfileList(["profile", "list", "--json"]);
+  try {
+    if (codewithProfileSetFromResult(jsonResult).has(spec.nativeAuthProfile.profile))
+      return;
+  } catch {}
+  assertCodewithProfileListed(spec.nativeAuthProfile.profile, runProfileList(["profile", "list"]));
 }
 async function preflightNativeAuthProfile(spec, env) {
   if (spec.nativeAuthProfile?.provider !== "codewith")
     return;
-  const result = await spawnCapture(spec.command, ["profile", "list"], { env, timeoutMs: 15000 });
-  assertCodewithProfileListed(spec.nativeAuthProfile.profile, result);
+  const jsonResult = await spawnCapture(spec.command, ["profile", "list", "--json"], { env, timeoutMs: 15000 });
+  try {
+    if (codewithProfileSetFromResult(jsonResult).has(spec.nativeAuthProfile.profile))
+      return;
+  } catch {}
+  const tableResult = await spawnCapture(spec.command, ["profile", "list"], { env, timeoutMs: 15000 });
+  assertCodewithProfileListed(spec.nativeAuthProfile.profile, tableResult);
 }
 function resolvedDirEquals(left, right) {
   try {
@@ -5397,7 +5757,7 @@ function worktreeFallbackSpec(target, opts, fallbackCwd) {
 }
 function preflightRemoteSpec(spec, machine, metadata, opts) {
   const plan = (opts.machineCommandResolver ?? resolveMachineCommand)(machine.id, "bash -s");
-  const result = spawnSync3(plan.command, plan.args, {
+  const result = spawnSync4(plan.command, plan.args, {
     encoding: "utf8",
     env: transportEnv(opts),
     input: remotePreflightScript(spec, metadata),
@@ -5496,6 +5856,9 @@ async function executeRemoteSpec(spec, machine, metadata, opts, fallbackSpec) {
   if (timedOut || idleTimedOut) {
     return timeoutResult(startedAt, idleTimedOut ? `idle timed out after ${spec.idleTimeoutMs}ms without stdout/stderr` : `timed out after ${spec.timeoutMs}ms`, fields);
   }
+  if (!error && exitCode !== 0 && codewithJsonlReconciledSuccess(spec, fields)) {
+    return successResult(startedAt, fields);
+  }
   if (error || exitCode !== 0) {
     return failureResult(startedAt, error ?? `remote process on ${machine.id} exited with code ${exitCode ?? "unknown"}`, fields);
   }
@@ -5631,6 +5994,9 @@ async function executeTarget(target, metadata = {}, opts = {}) {
   if (timedOut || idleTimedOut) {
     return timeoutResult(startedAt, idleTimedOut ? `idle timed out after ${spec.idleTimeoutMs}ms without stdout/stderr` : `timed out after ${spec.timeoutMs}ms`, fields);
   }
+  if (!error && exitCode !== 0 && codewithJsonlReconciledSuccess(spec, fields)) {
+    return successResult(startedAt, fields);
+  }
   if (error || exitCode !== 0) {
     return failureResult(startedAt, error ?? `process exited with code ${exitCode ?? "unknown"}`, fields);
   }
@@ -6576,12 +6942,18 @@ async function executeLoopTarget(store, loop, run, opts = {}) {
 
 // src/lib/health.ts
 import { createHash as createHash2 } from "crypto";
-import { existsSync as existsSync3, readFileSync as readFileSync3 } from "fs";
+import { existsSync as existsSync3, mkdirSync as mkdirSync5, readFileSync as readFileSync4, writeFileSync as writeFileSync2 } from "fs";
+import { join as join6 } from "path";
 var EVIDENCE_CHARS = 2000;
 var FINGERPRINT_EVIDENCE_CHARS = 120;
+var DEFAULT_SCAN_LIMIT = 200;
+var DEFAULT_SCAN_STATUSES = ["active", "paused"];
+var DEFAULT_MAX_FINDINGS = 100;
+var MIN_STALE_RUNNING_MS = 10 * 60000;
 var CLASSIFICATIONS = [
   "rate_limit",
   "auth",
+  "provider_unavailable",
   "model_not_found",
   "context_length",
   "schema_response_format",
@@ -6590,10 +6962,12 @@ var CLASSIFICATIONS = [
   "route_functional",
   "timeout",
   "sigsegv",
+  "restart_interrupted",
   "skipped_previous_active",
   "circuit_breaker",
   "unknown"
 ];
+var RESTART_INTERRUPTED_RUN_PREFIX = "daemon restart interrupted active run";
 function bounded(value, limit = EVIDENCE_CHARS) {
   if (!value)
     return;
@@ -6607,7 +6981,7 @@ function redactedEvidence(value) {
 }
 function searchableText(run) {
   return [run.error, run.stderr, run.stdout].filter(Boolean).join(`
-`).toLowerCase();
+`);
 }
 function isRecord(value) {
   return Boolean(value && typeof value === "object" && !Array.isArray(value));
@@ -6632,13 +7006,36 @@ function stableFingerprint(parts) {
   return createHash2("sha256").update(parts.join(`
 `)).digest("hex").slice(0, 16);
 }
-function stableFailureFingerprint(run, classification) {
+function stableScanFingerprint(parts) {
+  return `openloops:health-scan:${stableFingerprint(parts)}`;
+}
+function safeHost(value) {
+  if (!value)
+    return;
+  let host = value.trim().replace(/^[a-z]+:\/\//i, "").split(/[/:?#\s)"'\\]+/)[0] ?? "";
+  host = host.replace(/^\[|\]$/g, "");
+  return /^[a-z0-9.-]+$/i.test(host) ? host.toLowerCase() : undefined;
+}
+function isCursorHost(host) {
+  return host === "cursor.sh" || Boolean(host?.endsWith(".cursor.sh"));
+}
+function providerUnavailableSummary(rawText) {
+  const dns = /\bgetaddrinfo\s+(EAI_AGAIN|ENOTFOUND)\s+([a-z0-9.-]+)/i.exec(rawText);
+  if (dns) {
+    const host = safeHost(dns[2]);
+    if (isCursorHost(host))
+      return `provider DNS lookup failed: ${dns[1]} ${host}`;
+  }
+  return;
+}
+function stableFailureFingerprint(run, classification, summary) {
+  const evidence = summary ?? (classification === "provider_unavailable" ? providerUnavailableSummary(searchableText(run)) : undefined) ?? run.error ?? run.stderr ?? run.stdout ?? "";
   return stableFingerprint([
     run.loopId,
     classification,
     String(run.status),
     String(run.exitCode ?? ""),
-    (run.error ?? run.stderr ?? run.stdout ?? "").replace(/\d{4}-\d{2}-\d{2}T\S+/g, "<timestamp>").slice(0, FINGERPRINT_EVIDENCE_CHARS)
+    evidence.replace(/\d{4}-\d{2}-\d{2}T\S+/g, "<timestamp>").slice(0, FINGERPRINT_EVIDENCE_CHARS)
   ]);
 }
 function stableRouteFunctionalFingerprint(loop, reason) {
@@ -6656,13 +7053,279 @@ function healthRun(run) {
     stderr: redactedEvidence(run.stderr)
   };
 }
+function compactText(value, limit = 500) {
+  const text = redact(bounded(value, limit));
+  return text?.replace(/\s+/g, " ").trim();
+}
+function publicDoctorCheck(check) {
+  return {
+    id: check.id,
+    status: check.status,
+    message: redact(bounded(check.message, 500)) ?? "",
+    detail: redact(bounded(check.detail, 800))
+  };
+}
+function publicDoctorReport(report) {
+  return {
+    ok: report.ok,
+    checks: report.checks.map(publicDoctorCheck)
+  };
+}
+function includedStatusSet(statuses) {
+  const values = statuses?.length ? statuses : DEFAULT_SCAN_STATUSES;
+  return new Set(values);
+}
+function statusCounts(loops) {
+  return {
+    loops: loops.length,
+    active: loops.filter((loop) => loop.status === "active").length,
+    paused: loops.filter((loop) => loop.status === "paused").length,
+    stopped: loops.filter((loop) => loop.status === "stopped").length,
+    expired: loops.filter((loop) => loop.status === "expired").length
+  };
+}
+function compareLoopsForScan(left, right) {
+  const statusOrder = left.status.localeCompare(right.status);
+  if (statusOrder !== 0)
+    return statusOrder;
+  return (left.nextRunAt ?? "").localeCompare(right.nextRunAt ?? "");
+}
+function scanLoops(store, statuses, opts) {
+  const limit = opts.limit ?? DEFAULT_SCAN_LIMIT;
+  return statuses.flatMap((status) => store.listLoops({ includeArchived: opts.includeArchived, status, limit })).sort(compareLoopsForScan).slice(0, limit);
+}
+function healthReportForLoops(store, loops, generatedAt) {
+  const expectations = loops.map((loop) => expectationForLoop(store, loop));
+  const classifications = Object.fromEntries(CLASSIFICATIONS.map((key) => [key, 0]));
+  for (const expectation of expectations) {
+    if (expectation.failure)
+      classifications[expectation.failure.classification] += 1;
+  }
+  const unhealthy = expectations.filter((expectation) => !expectation.ok).length;
+  const warnings = expectations.filter((expectation) => expectation.check.status === "warn").length;
+  return {
+    ok: unhealthy === 0,
+    generatedAt,
+    summary: {
+      loops: expectations.length,
+      healthy: expectations.length - unhealthy,
+      unhealthy,
+      warnings
+    },
+    classifications,
+    expectations
+  };
+}
+function ageMs(run, now) {
+  const stamp = run.startedAt ?? run.createdAt ?? run.scheduledFor;
+  const time = Date.parse(stamp);
+  return Number.isFinite(time) ? Math.max(0, now.getTime() - time) : 0;
+}
+function shortLoop(loop) {
+  return {
+    id: loop.id,
+    name: loop.name,
+    status: loop.status,
+    nextRunAt: loop.nextRunAt,
+    leaseMs: loop.leaseMs
+  };
+}
+function priorityForSeverity(severity) {
+  if (severity === "critical")
+    return "critical";
+  if (severity === "high")
+    return "high";
+  if (severity === "low")
+    return "low";
+  return "medium";
+}
+function recommendedFindingTask(finding, route) {
+  const tags = ["bug", "openloops", "loops", "loop-health", finding.kind];
+  if (finding.classification)
+    tags.push(finding.classification);
+  const description = [
+    `OpenLoops health scan found a ${finding.kind} issue.`,
+    finding.loop ? `Loop: ${finding.loop.name} (${finding.loop.id})` : undefined,
+    finding.run ? `Run: ${finding.run.id}` : undefined,
+    finding.classification ? `Classification: ${finding.classification}` : undefined,
+    finding.ageMs !== undefined ? `AgeMs: ${finding.ageMs}` : undefined,
+    finding.staleThresholdMs !== undefined ? `StaleThresholdMs: ${finding.staleThresholdMs}` : undefined,
+    `Fingerprint: ${finding.fingerprint}`,
+    `Severity: ${finding.severity}`,
+    `No-tmux routing: Do not dispatch or paste prompts into tmux panes; use task-triggered headless worker/verifier workflows only.`,
+    route?.cwd ? `Route cwd: ${route.cwd}` : undefined,
+    route?.provider ? `Provider: ${route.provider}` : undefined,
+    "",
+    finding.message,
+    finding.run?.error ? `Error:
+${finding.run.error}` : undefined,
+    finding.run?.stderr ? `Stderr:
+${finding.run.stderr}` : undefined
+  ].filter(Boolean).join(`
+
+`);
+  return {
+    title: finding.title,
+    description,
+    priority: priorityForSeverity(finding.severity),
+    tags,
+    dedupeKey: finding.fingerprint,
+    search: { query: finding.fingerprint },
+    compatibilityFallback: {
+      search: ["todos", "search", finding.fingerprint, "--json"],
+      add: ["todos", "add", finding.title, "--description", description, "--tag", tags.join(","), "--priority", priorityForSeverity(finding.severity)],
+      comment: ["todos", "comment", "<task-id>", description]
+    },
+    futureNativeUpsert: {
+      command: "todos task upsert",
+      fields: {
+        title: finding.title,
+        description,
+        priority: priorityForSeverity(finding.severity),
+        tags,
+        dedupeKey: finding.fingerprint,
+        routeSource: route?.source ?? "openloops",
+        routeKind: route?.kind ?? "health_scan",
+        routeLoopId: finding.loop?.id ?? "",
+        routeLoopName: finding.loop?.name ?? ""
+      }
+    }
+  };
+}
+function daemonFinding(daemon) {
+  if (daemon.running && !daemon.stale)
+    return;
+  const reason = daemon.stale ? "daemon pid file is stale" : "daemon is not running";
+  const severity = "critical";
+  const finding = {
+    kind: "daemon",
+    severity,
+    fingerprint: `openloops:health-scan:daemon:${daemon.stale ? "stale" : "not-running"}`,
+    title: "OpenLoops daemon health issue",
+    message: reason
+  };
+  return {
+    ...finding,
+    recommendedTask: recommendedFindingTask(finding, undefined)
+  };
+}
+function doctorSeverity(check) {
+  if (check.status === "fail" && check.id === "data-dir")
+    return "critical";
+  if (check.status === "fail")
+    return "high";
+  return "medium";
+}
+function doctorFinding(check, loop, route) {
+  if (check.status === "ok" || check.id === "loop-runs")
+    return;
+  const kind = check.id.startsWith("loop:") && check.id.endsWith(":preflight") ? "preflight" : "doctor";
+  const severity = kind === "preflight" && check.status === "fail" ? "high" : doctorSeverity(check);
+  const fingerprint = stableScanFingerprint(["doctor", check.id, check.status, check.message, check.detail ?? ""]);
+  const finding = {
+    kind,
+    severity,
+    fingerprint,
+    title: kind === "preflight" && loop ? `OpenLoops preflight issue - ${loop.name}` : `OpenLoops doctor issue - ${check.id}`,
+    message: [check.status, check.message, check.detail].filter(Boolean).join(" "),
+    loop: loop ? shortLoop(loop) : undefined,
+    route,
+    doctorCheck: publicDoctorCheck(check)
+  };
+  return {
+    ...finding,
+    recommendedTask: recommendedFindingTask(finding, route)
+  };
+}
+function latestRunFinding(expectation) {
+  if (expectation.ok || !expectation.latestRun || expectation.latestRun.status === "running")
+    return;
+  const failure = expectation.failure;
+  if (!failure)
+    return;
+  const severity = expectation.loop.status === "active" ? "high" : "medium";
+  return {
+    kind: "latest-run",
+    severity,
+    fingerprint: expectation.recommendedTask?.dedupeKey ?? `openloops:${expectation.loop.id}:${failure.fingerprint}`,
+    title: expectation.recommendedTask?.title ?? `OpenLoops latest run failed - ${expectation.loop.name}`,
+    message: expectation.check.message,
+    loop: expectation.loop,
+    run: expectation.latestRun,
+    route: expectation.route,
+    classification: failure.classification,
+    doctorCheck: undefined,
+    recommendedTask: expectation.recommendedTask
+  };
+}
+function staleRunningFinding(loop, expectation, now, staleRunningMs) {
+  const run = expectation.latestRun;
+  if (loop.status !== "active" || run?.status !== "running")
+    return;
+  const threshold = Math.max(loop.leaseMs, staleRunningMs, MIN_STALE_RUNNING_MS);
+  const age = ageMs(run, now);
+  if (age <= threshold)
+    return;
+  const fingerprint = `openloops:health-scan:stale-running:${loop.id}:${run.id}`;
+  const message = `active loop latest run is still running after ${age}ms (threshold ${threshold}ms)`;
+  const finding = {
+    kind: "stale-running",
+    severity: "critical",
+    fingerprint,
+    title: `OpenLoops stale running run - ${loop.name}`,
+    message,
+    loop: shortLoop(loop),
+    run,
+    route: expectation.route,
+    ageMs: age,
+    staleThresholdMs: threshold
+  };
+  return {
+    ...finding,
+    recommendedTask: recommendedFindingTask(finding, expectation.route)
+  };
+}
+function scanStatus(findings) {
+  if (findings.some((finding) => finding.severity === "critical"))
+    return "critical";
+  if (findings.length > 0)
+    return "degraded";
+  return "ok";
+}
+function timestampDir(root, generatedAt) {
+  const stamp = generatedAt.replace(/[-:]/g, "").replace(/\./g, "");
+  return join6(root, stamp);
+}
+function healthScanMarkdown(scan) {
+  return [
+    "# OpenLoops Health Scan",
+    "",
+    `- status: ${scan.status}`,
+    `- generated_at: ${scan.generatedAt}`,
+    `- included_statuses: ${scan.includedStatuses.join(",")}`,
+    `- loops: total=${scan.counts.loops} active=${scan.counts.active} paused=${scan.counts.paused} stopped=${scan.counts.stopped} expired=${scan.counts.expired}`,
+    `- findings: total=${scan.counts.findings} reported=${scan.counts.reportedFindings} truncated=${scan.counts.truncatedFindings} latest_run=${scan.counts.latestRunFindings} stale_running=${scan.counts.staleRunning} daemon=${scan.counts.daemonFindings} doctor=${scan.counts.doctorFindings} preflight=${scan.counts.preflightFindings}`,
+    scan.daemon ? `- daemon: running=${scan.daemon.running} stale=${scan.daemon.stale} pid=${scan.daemon.pid ?? "none"}` : "- daemon: not checked",
+    scan.doctor ? `- doctor_ok: ${scan.doctor.ok}` : "- doctor: not checked",
+    scan.selfHeals.length ? `- self_heals: ${scan.selfHeals.map((action) => `${action.kind}:${action.attempted ? action.ok ? "ok" : "failed" : "skipped"}`).join(",")}` : "- self_heals: none",
+    "",
+    "## Findings",
+    scan.findings.length ? scan.findings.map((finding) => `- ${finding.severity} ${finding.kind} ${finding.fingerprint} ${finding.loop ? `${finding.loop.name}: ` : ""}${compactText(finding.message, 240) ?? ""}`).join(`
+`) : "None."
+  ].join(`
+`);
+}
 function classifyRunFailure(run) {
   if (run.status === "succeeded" || run.status === "running")
     return;
-  const text = searchableText(run);
+  const rawText = searchableText(run);
+  const text = rawText.toLowerCase();
   let classification = "unknown";
+  let summary;
   if (run.status === "timed_out")
     classification = "timeout";
+  else if (run.status === "skipped" && run.error?.startsWith(RESTART_INTERRUPTED_RUN_PREFIX))
+    classification = "restart_interrupted";
   else if (run.status === "skipped" && /circuit breaker open/.test(text))
     classification = "circuit_breaker";
   else if (run.status === "skipped" && /previous run still active/.test(text))
@@ -6671,8 +7334,10 @@ function classifyRunFailure(run) {
     classification = "preflight";
   else if (/rate limit|too many requests|429\b|quota exceeded/.test(text))
     classification = "rate_limit";
-  else if (/unauthorized|authentication|auth\b|api key|invalid token|permission denied|401\b|403\b/.test(text))
+  else if (/unauthorized|authentication|auth\b|api key|invalid token|permission denied|401\b|403\b|not logged in|please run \/login|login required|not authenticated|failed to authenticate/.test(text))
     classification = "auth";
+  else if (summary = providerUnavailableSummary(rawText))
+    classification = "provider_unavailable";
   else if (/model .*not found|model_not_found|unknown model|invalid model|404.*model/.test(text))
     classification = "model_not_found";
   else if (/context length|context_length|context window|maximum context|token limit|too many tokens/.test(text))
@@ -6685,8 +7350,9 @@ function classifyRunFailure(run) {
     classification = "sigsegv";
   return {
     classification,
-    fingerprint: stableFailureFingerprint(run, classification),
+    fingerprint: stableFailureFingerprint(run, classification, summary),
     evidence: {
+      summary,
       error: redactedEvidence(run.error),
       stdout: redactedEvidence(run.stdout),
       stderr: redactedEvidence(run.stderr),
@@ -6731,7 +7397,7 @@ function routeEvidenceReport(run) {
   const evidencePath = stringValue(stdoutReport?.evidencePath);
   if (evidencePath && existsSync3(evidencePath)) {
     try {
-      return parseJsonObject(readFileSync3(evidencePath, "utf8")) ?? stdoutReport;
+      return parseJsonObject(readFileSync4(evidencePath, "utf8")) ?? stdoutReport;
     } catch {
       return stdoutReport;
     }
@@ -6863,6 +7529,12 @@ function targetRoute(loop) {
     loopName: loop.name
   };
 }
+function expectationLoop(loop) {
+  return { id: loop.id, name: loop.name, status: loop.status, nextRunAt: loop.nextRunAt, retryScheduledFor: loop.retryScheduledFor };
+}
+function hasPendingRetry(loop, run) {
+  return loop.status === "active" && loop.retryScheduledFor === run.scheduledFor && run.attempt < loop.maxAttempts;
+}
 function recommendedTask(loop, run, failure, route) {
   const title = `BUG: open-loops loop failure - ${loop.name}`;
   const description = [
@@ -6874,6 +7546,7 @@ function recommendedTask(loop, run, failure, route) {
     `No-tmux routing: Do not dispatch or paste prompts into tmux panes; use task-triggered headless worker/verifier workflows only.`,
     route.cwd ? `Route cwd: ${route.cwd}` : undefined,
     route.provider ? `Provider: ${route.provider}` : undefined,
+    failure.evidence.summary ? `Summary: ${failure.evidence.summary}` : undefined,
     failure.evidence.error ? `Error:
 ${failure.evidence.error}` : undefined,
     failure.evidence.stderr ? `Stderr:
@@ -6883,7 +7556,7 @@ ${failure.evidence.stderr}` : undefined
 `);
   const dedupeKey = `openloops:${loop.id}:${failure.fingerprint}`;
   const tags = ["bug", "openloops", "loops", "loop-health", failure.classification];
-  const priority = failure.classification === "auth" || failure.classification === "rate_limit" ? "high" : "medium";
+  const priority = failure.classification === "auth" || failure.classification === "rate_limit" || failure.classification === "provider_unavailable" ? "high" : "medium";
   return {
     title,
     description,
@@ -6917,7 +7590,7 @@ function expectationForLoop(store, loop) {
   const route = targetRoute(loop);
   if (!latestRun) {
     return {
-      loop: { id: loop.id, name: loop.name, status: loop.status, nextRunAt: loop.nextRunAt },
+      loop: expectationLoop(loop),
       ok: true,
       check: { id: "latest-run-succeeded", status: "warn", message: "loop has no recorded runs yet" },
       route
@@ -6926,7 +7599,7 @@ function expectationForLoop(store, loop) {
   const routeFailure = detectRouteFunctionalFailure(store, loop, latestRun);
   if (routeFailure) {
     return {
-      loop: { id: loop.id, name: loop.name, status: loop.status, nextRunAt: loop.nextRunAt },
+      loop: expectationLoop(loop),
       ok: false,
       check: { id: "route-functional-health", status: "fail", message: routeFailure.evidence.error ?? "route functional blocker detected" },
       latestRun: healthRun(latestRun),
@@ -6937,7 +7610,7 @@ function expectationForLoop(store, loop) {
   }
   if (latestRun.status === "succeeded") {
     return {
-      loop: { id: loop.id, name: loop.name, status: loop.status, nextRunAt: loop.nextRunAt },
+      loop: expectationLoop(loop),
       ok: true,
       check: { id: "latest-run-succeeded", status: "pass", message: "latest run succeeded" },
       latestRun: healthRun(latestRun),
@@ -6948,7 +7621,7 @@ function expectationForLoop(store, loop) {
   if (failure?.classification === "circuit_breaker") {
     if (loop.status !== "paused") {
       return {
-        loop: { id: loop.id, name: loop.name, status: loop.status, nextRunAt: loop.nextRunAt },
+        loop: expectationLoop(loop),
         ok: true,
         check: { id: "latest-run-succeeded", status: "warn", message: "circuit breaker cleared by resume; awaiting next run" },
         latestRun: healthRun(latestRun),
@@ -6956,7 +7629,7 @@ function expectationForLoop(store, loop) {
       };
     }
     return {
-      loop: { id: loop.id, name: loop.name, status: loop.status, nextRunAt: loop.nextRunAt },
+      loop: expectationLoop(loop),
       ok: false,
       check: { id: "latest-run-succeeded", status: "fail", message: latestRun.error ?? "circuit breaker open; loop auto-paused" },
       latestRun: healthRun(latestRun),
@@ -6965,8 +7638,33 @@ function expectationForLoop(store, loop) {
       recommendedTask: recommendedTask(loop, latestRun, failure, route)
     };
   }
+  if (failure?.classification === "restart_interrupted") {
+    return {
+      loop: expectationLoop(loop),
+      ok: true,
+      check: { id: "latest-run-succeeded", status: "warn", message: latestRun.error ?? "daemon restart interrupted latest run" },
+      latestRun: healthRun(latestRun),
+      failure,
+      route
+    };
+  }
+  if (failure?.classification === "provider_unavailable" && hasPendingRetry(loop, latestRun)) {
+    const message = [
+      "provider unavailable/network failure; retry is scheduled",
+      loop.nextRunAt ? `next attempt at ${loop.nextRunAt}` : undefined,
+      failure.evidence.summary
+    ].filter(Boolean).join("; ");
+    return {
+      loop: expectationLoop(loop),
+      ok: true,
+      check: { id: "latest-run-succeeded", status: "warn", message },
+      latestRun: healthRun(latestRun),
+      failure,
+      route
+    };
+  }
   return {
-    loop: { id: loop.id, name: loop.name, status: loop.status, nextRunAt: loop.nextRunAt },
+    loop: expectationLoop(loop),
     ok: false,
     check: { id: "latest-run-succeeded", status: "fail", message: `latest run is ${latestRun.status}` },
     latestRun: healthRun(latestRun),
@@ -6998,6 +7696,89 @@ function buildHealthReport(store, opts = {}) {
     expectations
   };
 }
+function buildHealthScan(store, opts = {}) {
+  const generatedAt = (opts.now ?? new Date).toISOString();
+  const now = opts.now ?? new Date(generatedAt);
+  const includeStatuses = [...includedStatusSet(opts.includeStatuses)];
+  const loops = scanLoops(store, includeStatuses, opts);
+  const health = healthReportForLoops(store, loops, generatedAt);
+  const expectationsByLoopId = new Map(health.expectations.map((expectation) => [expectation.loop.id, expectation]));
+  const loopsById = new Map(loops.map((loop) => [loop.id, loop]));
+  const maxFindings = Math.max(0, opts.maxFindings ?? DEFAULT_MAX_FINDINGS);
+  const allFindings = [];
+  const pushFinding = (finding) => {
+    if (!finding)
+      return;
+    allFindings.push(finding);
+  };
+  if (opts.daemon)
+    pushFinding(daemonFinding(opts.daemon));
+  if (opts.latestRun !== false) {
+    for (const loop of loops) {
+      const expectation = expectationsByLoopId.get(loop.id);
+      if (!expectation)
+        continue;
+      pushFinding(staleRunningFinding(loop, expectation, now, opts.staleRunningMs ?? MIN_STALE_RUNNING_MS));
+      pushFinding(latestRunFinding(expectation));
+    }
+  }
+  const doctor = opts.doctor ? publicDoctorReport(opts.doctor) : undefined;
+  if (doctor) {
+    for (const check of doctor.checks) {
+      const preflightLoopId = check.id.startsWith("loop:") && check.id.endsWith(":preflight") ? check.id.slice("loop:".length, -":preflight".length) : undefined;
+      const loop = preflightLoopId ? loopsById.get(preflightLoopId) : undefined;
+      const route = preflightLoopId ? expectationsByLoopId.get(preflightLoopId)?.route : undefined;
+      pushFinding(doctorFinding(check, loop, route));
+    }
+  }
+  const findings = allFindings.slice(0, maxFindings);
+  const status = scanStatus(allFindings);
+  const baseCounts = statusCounts(loops);
+  return {
+    ok: status === "ok",
+    status,
+    generatedAt,
+    includedStatuses: includeStatuses,
+    counts: {
+      ...baseCounts,
+      latestRunFindings: allFindings.filter((finding) => finding.kind === "latest-run").length,
+      staleRunning: allFindings.filter((finding) => finding.kind === "stale-running").length,
+      daemonFindings: allFindings.filter((finding) => finding.kind === "daemon").length,
+      doctorFindings: allFindings.filter((finding) => finding.kind === "doctor").length,
+      preflightFindings: allFindings.filter((finding) => finding.kind === "preflight").length,
+      findings: allFindings.length,
+      reportedFindings: findings.length,
+      truncatedFindings: Math.max(0, allFindings.length - findings.length)
+    },
+    daemon: opts.daemon ? {
+      running: opts.daemon.running,
+      stale: opts.daemon.stale,
+      pid: opts.daemon.pid,
+      host: opts.daemon.host,
+      loops: opts.daemon.loops,
+      runs: opts.daemon.runs,
+      logPath: opts.daemon.logPath
+    } : undefined,
+    doctor,
+    health,
+    selfHeals: opts.selfHeals ?? [],
+    findings
+  };
+}
+function writeHealthScanReports(scan, opts = {}) {
+  const root = opts.reportDir ?? join6(dataDir(), "reports", "health-scan");
+  const dir = timestampDir(root, scan.generatedAt);
+  mkdirSync5(dir, { recursive: true, mode: 448 });
+  const json = join6(dir, "summary.json");
+  const markdown = join6(dir, "report.md");
+  const withReports = {
+    ...scan,
+    reports: { dir, json, markdown }
+  };
+  writeFileSync2(json, JSON.stringify(withReports, null, 2), { mode: 384 });
+  writeFileSync2(markdown, healthScanMarkdown(withReports), { mode: 384 });
+  return withReports;
+}
 
 // src/lib/scheduler.ts
 function loopLane(loop) {
@@ -7084,7 +7865,7 @@ var MAX_RETRY_EXPONENT = 20;
 function retryBackoffDelayMs(loop, run, random = Math.random) {
   const attempt = Math.max(1, run.attempt);
   const failure = classifyRunFailure(run);
-  const throttled = failure?.classification === "rate_limit" || failure?.classification === "auth";
+  const throttled = failure?.classification === "rate_limit" || failure?.classification === "auth" || failure?.classification === "provider_unavailable";
   const growth = 2 ** Math.min(attempt - 1, MAX_RETRY_EXPONENT);
   const base = loop.retryDelayMs * growth * (throttled ? THROTTLED_RETRY_MULTIPLIER : 1);
   const jitter = 0.5 + random();
@@ -7211,20 +7992,21 @@ async function executeClaimedRun(deps) {
       daemonLeaseId: deps.daemonLeaseId,
       onSpawn: (pid) => deps.store.markRunPid(run.id, pid, deps.runnerId, { daemonLeaseId: deps.daemonLeaseId })
     })))(deps.loop, deps.run);
+    const finalResult = deps.finalizeResult?.(result, deps.loop, deps.run) ?? result;
     deps.beforeFinalize?.(deps.loop, deps.run);
     return deps.store.finalizeRun(deps.run.id, {
-      status: result.status,
-      finishedAt: result.finishedAt,
-      durationMs: result.durationMs,
-      stdout: result.stdout,
-      stderr: result.stderr,
-      exitCode: result.exitCode,
-      error: result.error,
-      pid: result.pid
+      status: finalResult.status,
+      finishedAt: finalResult.finishedAt,
+      durationMs: finalResult.durationMs,
+      stdout: finalResult.stdout,
+      stderr: finalResult.stderr,
+      exitCode: finalResult.exitCode,
+      error: finalResult.error,
+      pid: finalResult.pid
     }, {
       claimedBy: deps.runnerId,
       daemonLeaseId: deps.daemonLeaseId,
-      now: deps.now?.() ?? new Date(result.finishedAt)
+      now: deps.now?.() ?? new Date(finalResult.finishedAt)
     });
   } catch (err) {
     deps.onError?.(deps.loop, err);
@@ -7459,10 +8241,10 @@ async function tick(deps) {
 }
 
 // src/daemon/control.ts
-import { existsSync as existsSync4, mkdirSync as mkdirSync5, readFileSync as readFileSync4, rmSync as rmSync3, writeFileSync as writeFileSync2 } from "fs";
-import { spawnSync as spawnSync4 } from "child_process";
+import { existsSync as existsSync4, mkdirSync as mkdirSync6, readFileSync as readFileSync5, rmSync as rmSync4, writeFileSync as writeFileSync3 } from "fs";
+import { spawnSync as spawnSync5 } from "child_process";
 import { hostname } from "os";
-import { dirname as dirname4, join as join5 } from "path";
+import { dirname as dirname4, join as join7 } from "path";
 
 // src/daemon/loop.ts
 function realSleep(ms) {
@@ -7492,7 +8274,7 @@ function readPidRecord(path = pidFilePath()) {
     return;
   let raw;
   try {
-    raw = readFileSync4(path, "utf8").trim();
+    raw = readFileSync5(path, "utf8").trim();
   } catch {
     return;
   }
@@ -7514,11 +8296,11 @@ function readPidRecord(path = pidFilePath()) {
   return Number.isInteger(pid) && pid > 0 ? { pid } : undefined;
 }
 function writePid(pid = process.pid, path = pidFilePath()) {
-  mkdirSync5(dirname4(path), { recursive: true, mode: 448 });
-  writeFileSync2(path, JSON.stringify({ pid, startedAt: processStartTimeMs(pid) }));
+  mkdirSync6(dirname4(path), { recursive: true, mode: 448 });
+  writeFileSync3(path, JSON.stringify({ pid, startedAt: processStartTimeMs(pid) }));
 }
 function removePid(path = pidFilePath()) {
-  rmSync3(path, { force: true });
+  rmSync4(path, { force: true });
 }
 function isAlive(pid, startedAt) {
   try {
@@ -7548,7 +8330,7 @@ function ownProcessGroupId() {
       return pgrp;
   }
   try {
-    const run = spawnSync4("ps", ["-o", "pgid=", "-p", String(process.pid)], { encoding: "utf8" });
+    const run = spawnSync5("ps", ["-o", "pgid=", "-p", String(process.pid)], { encoding: "utf8" });
     const pgid = Number(run.stdout.trim());
     if (run.status === 0 && Number.isInteger(pgid) && pgid > 0)
       return pgid;
@@ -7644,7 +8426,7 @@ async function stopDaemon(opts = {}) {
   if (!state.running || !state.pid)
     return { wasRunning: false, stopped: false, forced: false };
   const sleep = opts.sleep ?? realSleep;
-  const store = new Store(join5(dirname4(path), "loops.db"));
+  const store = new Store(join7(dirname4(path), "loops.db"));
   try {
     const lease = store.getDaemonLease();
     const leaseVerified = Boolean(lease && lease.pid === state.pid && new Date(lease.expiresAt).getTime() > Date.now());
@@ -7682,7 +8464,7 @@ async function stopDaemon(opts = {}) {
 }
 
 // src/daemon/daemon.ts
-import { copyFileSync, existsSync as existsSync5, openSync, renameSync as renameSync2, rmSync as rmSync4, statSync, truncateSync } from "fs";
+import { copyFileSync, existsSync as existsSync5, openSync as openSync2, renameSync as renameSync2, rmSync as rmSync5, statSync, truncateSync } from "fs";
 import { hostname as hostname2 } from "os";
 import { spawn as spawn3 } from "child_process";
 function intervalFromEnv() {
@@ -7724,7 +8506,7 @@ function rotateDaemonLog(path = daemonLogPath(), maxBytes = DAEMON_LOG_MAX_BYTES
   if (size < maxBytes)
     return false;
   try {
-    rmSync4(`${path}.${keep}`, { force: true });
+    rmSync5(`${path}.${keep}`, { force: true });
     for (let i = keep - 1;i >= 1; i--) {
       if (existsSync5(`${path}.${i}`))
         renameSync2(`${path}.${i}`, `${path}.${i + 1}`);
@@ -7773,6 +8555,7 @@ async function runDaemon(opts = {}) {
   let runAbort = new AbortController;
   const activeRuns = new Map;
   const activeByLane = { command: 0, agent: 0 };
+  const isControlledStopInterruption = (result) => stopFlag && !leaseLost && result.status === "failed" && result.error?.includes("terminated by SIGTERM") === true;
   const requestStop = (message) => {
     stopFlag = true;
     if (!runAbort.signal.aborted)
@@ -7856,6 +8639,16 @@ async function runDaemon(opts = {}) {
           store.recordRunProcess(run.id, info, { daemonLeaseId: leaseId });
         }
       })),
+      finalizeResult: (result) => {
+        if (!isControlledStopInterruption(result))
+          return result;
+        return {
+          ...result,
+          status: "skipped",
+          exitCode: undefined,
+          error: `${RESTART_INTERRUPTED_RUN_PREFIX}: child process terminated by SIGTERM during daemon stop/restart`
+        };
+      },
       onError: (loop, err) => log(`loop ${loop.id} failed: ${err instanceof Error ? err.message : String(err)}`)
     });
     ensureLease();
@@ -7949,7 +8742,7 @@ async function startDaemon(opts) {
     return { started: false, alreadyRunning: true, pid: state.pid };
   if (state.stale)
     removePid();
-  const out = openSync(daemonLogPath(), "a");
+  const out = openSync2(daemonLogPath(), "a");
   const child = spawn3(opts.execPath ?? process.execPath, [opts.cliEntry, ...opts.args ?? ["daemon", "run"]], {
     detached: true,
     stdio: ["ignore", out, out]
@@ -7967,8 +8760,8 @@ async function startDaemon(opts) {
 }
 
 // src/daemon/install.ts
-import { chmodSync as chmodSync2, mkdirSync as mkdirSync6, writeFileSync as writeFileSync3 } from "fs";
-import { spawnSync as spawnSync5 } from "child_process";
+import { chmodSync as chmodSync2, mkdirSync as mkdirSync7, writeFileSync as writeFileSync4 } from "fs";
+import { spawnSync as spawnSync6 } from "child_process";
 import { dirname as dirname5 } from "path";
 function systemdEscapeExecPart(part) {
   const escaped = part.replaceAll("%", "%%");
@@ -8000,9 +8793,9 @@ function installStartup(cliEntry, execPath = process.execPath, args = ["daemon",
   const dataDirPath = ensureDataDir();
   if (platform === "linux") {
     const path = systemdServicePath();
-    mkdirSync6(dirname5(path), { recursive: true, mode: 448 });
+    mkdirSync7(dirname5(path), { recursive: true, mode: 448 });
     const execStart = [execPath, cliEntry, ...args].map(systemdEscapeExecPart).join(" ");
-    writeFileSync3(path, `[Unit]
+    writeFileSync4(path, `[Unit]
 Description=Hasna OpenLoops daemon
 After=basic.target
 
@@ -8030,8 +8823,8 @@ WantedBy=default.target
   }
   if (platform === "darwin") {
     const path = launchdPlistPath();
-    mkdirSync6(dirname5(path), { recursive: true, mode: 448 });
-    writeFileSync3(path, `<?xml version="1.0" encoding="UTF-8"?>
+    mkdirSync7(dirname5(path), { recursive: true, mode: 448 });
+    writeFileSync4(path, `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
@@ -8068,7 +8861,7 @@ ${args.map((arg) => `    <string>${xmlEscape(arg)}</string>`).join(`
 function enableStartup(result) {
   const commands = result.platform === "linux" ? ["systemctl --user daemon-reload", "systemctl --user enable --now loops-daemon.service"] : result.platform === "darwin" ? launchctlCommands(result.path) : [];
   return commands.map((command) => {
-    const run = spawnSync5("sh", ["-c", command], {
+    const run = spawnSync6("sh", ["-c", command], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -8082,7 +8875,7 @@ function enableStartup(result) {
 }
 
 // src/lib/doctor.ts
-import { spawnSync as spawnSync6 } from "child_process";
+import { spawnSync as spawnSync7 } from "child_process";
 import { accessSync as accessSync2, constants as constants2 } from "fs";
 var PROVIDER_COMMANDS = [
   "claude",
@@ -8093,11 +8886,11 @@ var PROVIDER_COMMANDS = [
   "codex"
 ];
 function hasCommand(command) {
-  const result = spawnSync6("sh", ["-c", 'command -v "$1" >/dev/null', "sh", command], { stdio: "ignore" });
+  const result = spawnSync7("sh", ["-c", 'command -v "$1" >/dev/null', "sh", command], { stdio: "ignore" });
   return (result.status ?? 1) === 0;
 }
 function commandVersion(command) {
-  const result = spawnSync6(command, ["--version"], {
+  const result = spawnSync7(command, ["--version"], {
     encoding: "utf8",
     stdio: ["ignore", "pipe", "pipe"]
   });
@@ -8146,7 +8939,30 @@ function runDoctor(store) {
   const status = daemonStatus(store);
   checks.push(status.running ? { id: "daemon", status: "ok", message: `daemon is running pid=${status.pid}` } : { id: "daemon", status: status.stale ? "warn" : "ok", message: status.stale ? "daemon pid file is stale" : "daemon is not running" });
   const failedRuns = store.countRuns("failed");
+  const restartInterruptedRuns = store.listRuns({ status: "skipped", limit: 1000 }).filter((run) => run.error?.startsWith(RESTART_INTERRUPTED_RUN_PREFIX)).length;
   checks.push(failedRuns === 0 ? { id: "loop-runs", status: "ok", message: "no failed loop runs recorded" } : { id: "loop-runs", status: "warn", message: `${failedRuns} failed loop run(s) recorded` });
+  if (restartInterruptedRuns > 0) {
+    checks.push({
+      id: "loop-runs:restart-interrupted",
+      status: "warn",
+      message: `${restartInterruptedRuns} daemon restart-interrupted loop run(s) recorded`
+    });
+  }
+  const deployment = buildDeploymentStatus();
+  const schedulerState = deployment.schedulerState;
+  checks.push({
+    id: "scheduler-state",
+    status: deployment.deploymentMode === "local" || deployment.controlPlane.configured ? "ok" : "warn",
+    message: `scheduler state authority=${schedulerState.authority} local=${schedulerState.localStore.role} remote=${schedulerState.remoteStore.backend}`,
+    detail: [
+      `route_state=${schedulerState.routeAdmission.stateStore}`,
+      `active_statuses=${schedulerState.routeAdmission.activeStatuses.join(",")}`,
+      `gates=${schedulerState.routeAdmission.gates.join(",")}`,
+      `artifacts=${schedulerState.localStore.runArtifacts}`,
+      `remote_artifacts=${schedulerState.remoteStore.objectArtifacts}`,
+      `remote_apply=${String(schedulerState.remoteStore.applySupported)}`
+    ].join(" ")
+  });
   for (const loop of store.listLoops({ status: "active" })) {
     try {
       if (loop.target.type === "workflow") {
@@ -8177,6 +8993,365 @@ function runDoctor(store) {
   };
 }
 
+// src/cli/ui.ts
+var CLEAR_SCREEN = "\x1B[2J\x1B[H";
+var ENTER_ALT_SCREEN = "\x1B[?1049h";
+var EXIT_ALT_SCREEN = "\x1B[?1049l";
+var HIDE_CURSOR = "\x1B[?25l";
+var SHOW_CURSOR = "\x1B[?25h";
+var RESET = "\x1B[0m";
+var BOLD = "\x1B[1m";
+var DIM = "\x1B[2m";
+var CYAN = "\x1B[36m";
+var GREEN = "\x1B[32m";
+var YELLOW = "\x1B[33m";
+var RED = "\x1B[31m";
+var MAGENTA = "\x1B[35m";
+var DEFAULT_REFRESH_MS = 2000;
+var MIN_REFRESH_MS = 500;
+var MAX_ACTIVE_LOOPS = 1e4;
+var MAX_RUNNING_RUNS = 1e5;
+function buildLoopUiSnapshot(store, opts = {}) {
+  const now = opts.now ?? new Date;
+  const activeLoops = store.listLoops({ status: "active", limit: opts.limit ?? MAX_ACTIVE_LOOPS });
+  const runningRuns = store.listRuns({ status: "running", limit: MAX_RUNNING_RUNS });
+  const runningByLoop = new Map;
+  for (const run of runningRuns) {
+    runningByLoop.set(run.loopId, (runningByLoop.get(run.loopId) ?? 0) + 1);
+  }
+  return {
+    rows: activeLoops.map((loop) => {
+      const latest = store.listRuns({ loopId: loop.id, limit: 1 })[0];
+      return {
+        id: loop.id,
+        name: loop.name,
+        status: loop.status,
+        cadence: scheduleLabel(loop.schedule),
+        nextRun: nextRunLabel(loop.nextRunAt, now),
+        lastRunOutcome: runOutcomeLabel(latest),
+        provider: providerLabel(loop.target),
+        activeRuns: runningByLoop.get(loop.id) ?? 0
+      };
+    }),
+    stats: {
+      activeLoops: store.countLoops("active"),
+      pausedLoops: store.countLoops("paused"),
+      stoppedLoops: store.countLoops("stopped"),
+      runningRuns: store.countRuns("running"),
+      failedRuns: store.countRuns("failed"),
+      updatedAt: now.toISOString()
+    }
+  };
+}
+function renderLoopUiFrame(snapshot, opts = {}) {
+  const columns = Math.max(40, opts.columns ?? 100);
+  const rows = opts.rows ?? snapshot.rows.length + 8;
+  const refreshMs = opts.refreshMs ?? DEFAULT_REFRESH_MS;
+  const color = opts.color ?? false;
+  const compact2 = columns < 88;
+  const widths = tableWidths(columns, compact2);
+  const maxBodyRows = Math.max(0, rows - 7);
+  const shownRows = snapshot.rows.slice(0, maxBodyRows);
+  const hidden = snapshot.rows.length - shownRows.length;
+  const updated = timeOnly(snapshot.stats.updatedAt);
+  const statLine = [
+    `active loops ${snapshot.stats.activeLoops}`,
+    `running runs ${snapshot.stats.runningRuns}`,
+    `failed runs ${snapshot.stats.failedRuns}`,
+    `paused ${snapshot.stats.pausedLoops}`,
+    `refresh ${durationLabel(refreshMs) || `${refreshMs}ms`}`,
+    `updated ${updated}`
+  ].join(" | ");
+  const lines = [
+    paint(`OpenLoops`, `${BOLD}${CYAN}`, color) + paint(" live loops", DIM, color),
+    paint(fitLine(statLine, columns), DIM, color),
+    "",
+    paint(tableHeader(widths, compact2), `${BOLD}${CYAN}`, color),
+    paint("-".repeat(Math.min(columns, tableWidth(widths))), DIM, color)
+  ];
+  for (const row of shownRows) {
+    lines.push(tableRow(row, widths, color));
+  }
+  if (snapshot.rows.length === 0) {
+    lines.push(paint("No active loops.", DIM, color));
+  } else if (hidden > 0) {
+    lines.push(paint(`showing ${shownRows.length} of ${snapshot.rows.length} active loops`, DIM, color));
+  }
+  lines.push("");
+  lines.push(paint("q quit | Ctrl-C exit", DIM, color));
+  return `${lines.map((line) => fitLine(line, columns, color)).join(`
+`)}
+`;
+}
+async function runLoopsUiApp(opts = {}) {
+  const refreshMs = Math.max(MIN_REFRESH_MS, opts.refreshMs ?? DEFAULT_REFRESH_MS);
+  const input = opts.input ?? process.stdin;
+  const output = opts.output ?? process.stdout;
+  const storeFactory = opts.storeFactory ?? (() => new Store);
+  const rawInput = input;
+  const signalExitCodes = { SIGINT: 130, SIGTERM: 143 };
+  const signalHandlers = [];
+  let interval;
+  let closed = false;
+  let cleaned = false;
+  let rawModeEnabled = false;
+  let terminalEntered = false;
+  let store;
+  let stopApp;
+  let renderHandler;
+  const render = () => {
+    if (closed || !store)
+      return;
+    const snapshot = buildLoopUiSnapshot(store);
+    output.write(`${CLEAR_SCREEN}${renderLoopUiFrame(snapshot, {
+      columns: output.columns,
+      rows: output.rows,
+      refreshMs,
+      color: true
+    })}`);
+  };
+  const onData = (chunk) => {
+    const value = chunk.toString("utf8");
+    if (value.toLowerCase().includes("q") || value.includes("\x03") || value.includes("\x1B"))
+      stopApp?.();
+  };
+  const cleanup = () => {
+    if (cleaned)
+      return;
+    cleaned = true;
+    if (interval)
+      clearInterval(interval);
+    input.off("data", onData);
+    if (renderHandler)
+      output.off("resize", renderHandler);
+    for (const [signal, handler] of signalHandlers)
+      process.removeListener(signal, handler);
+    if (rawModeEnabled)
+      rawInput.setRawMode?.(false);
+    if (terminalEntered) {
+      try {
+        output.write(`${SHOW_CURSOR}${CLEAR_SCREEN}${EXIT_ALT_SCREEN}`);
+      } catch {}
+    }
+    try {
+      store?.close();
+    } catch {}
+  };
+  try {
+    store = storeFactory();
+    output.write(`${ENTER_ALT_SCREEN}${HIDE_CURSOR}${CLEAR_SCREEN}`);
+    terminalEntered = true;
+    await new Promise((resolve3, reject) => {
+      const fail = (error) => {
+        if (closed)
+          return;
+        closed = true;
+        cleanup();
+        reject(error);
+      };
+      const stop = () => {
+        if (closed)
+          return;
+        closed = true;
+        cleanup();
+        resolve3();
+      };
+      const safeRender = () => {
+        try {
+          render();
+        } catch (error) {
+          fail(error);
+        }
+      };
+      stopApp = stop;
+      renderHandler = safeRender;
+      for (const signal of ["SIGINT", "SIGTERM"]) {
+        const handler = () => {
+          process.exitCode = signalExitCodes[signal] ?? 1;
+          stop();
+        };
+        signalHandlers.push([signal, handler]);
+        process.once(signal, handler);
+      }
+      if (typeof rawInput.setRawMode === "function") {
+        rawInput.setRawMode(true);
+        rawModeEnabled = true;
+      }
+      input.resume();
+      input.on("data", onData);
+      output.on("resize", safeRender);
+      safeRender();
+      if (!closed)
+        interval = setInterval(safeRender, refreshMs);
+    });
+  } finally {
+    cleanup();
+  }
+}
+function tableWidths(columns, compact2) {
+  const widths = {
+    name: 20,
+    status: compact2 ? 6 : 7,
+    cadence: compact2 ? 10 : 14,
+    nextRun: compact2 ? 8 : 10,
+    lastRunOutcome: compact2 ? 8 : 11,
+    provider: compact2 ? 7 : 10,
+    activeRuns: compact2 ? 3 : 11
+  };
+  const fixed = widths.status + widths.cadence + widths.nextRun + widths.lastRunOutcome + widths.provider + widths.activeRuns + 12;
+  widths.name = Math.max(6, columns - fixed);
+  return widths;
+}
+function tableWidth(widths) {
+  return widths.name + widths.status + widths.cadence + widths.nextRun + widths.lastRunOutcome + widths.provider + widths.activeRuns + 12;
+}
+function tableHeader(widths, compact2) {
+  return [
+    cell("NAME", widths.name),
+    cell("STATUS", widths.status),
+    cell("CADENCE", widths.cadence),
+    cell("NEXT-RUN", widths.nextRun),
+    cell("LAST-RUN", widths.lastRunOutcome),
+    cell("PROVIDER", widths.provider),
+    cell(compact2 ? "RUN" : "ACTIVE-RUNS", widths.activeRuns, "right")
+  ].join("  ");
+}
+function tableRow(row, widths, color) {
+  return [
+    cell(row.name, widths.name),
+    paint(cell(row.status, widths.status), statusColor(row.status), color),
+    cell(row.cadence, widths.cadence),
+    cell(row.nextRun, widths.nextRun),
+    paint(cell(row.lastRunOutcome, widths.lastRunOutcome), outcomeColor(row.lastRunOutcome), color),
+    cell(row.provider, widths.provider),
+    cell(String(row.activeRuns), widths.activeRuns, "right")
+  ].join("  ");
+}
+function cell(value, width, align = "left") {
+  const clipped = clip(value, width);
+  return align === "right" ? clipped.padStart(width) : clipped.padEnd(width);
+}
+function clip(value, width) {
+  if (width <= 0)
+    return "";
+  if (value.length <= width)
+    return value;
+  if (width === 1)
+    return "~";
+  return `${value.slice(0, width - 1)}~`;
+}
+function fitLine(value, columns, hasAnsi = false) {
+  if (!hasAnsi)
+    return clip(value, columns).trimEnd();
+  let visible = 0;
+  let index = 0;
+  let out = "";
+  while (index < value.length) {
+    const char = value[index];
+    if (char === "\x1B" && value[index + 1] === "[") {
+      let end = index + 2;
+      while (end < value.length && !/[A-Za-z]/.test(value[end]))
+        end += 1;
+      out += value.slice(index, Math.min(end + 1, value.length));
+      index = end + 1;
+      continue;
+    }
+    if (visible < columns) {
+      out += char;
+      visible += 1;
+    }
+    index += 1;
+  }
+  return out;
+}
+function paint(value, code, enabled) {
+  return enabled ? `${code}${value}${RESET}` : value;
+}
+function statusColor(status) {
+  if (status === "active")
+    return GREEN;
+  if (status === "paused")
+    return YELLOW;
+  if (status === "expired")
+    return MAGENTA;
+  return DIM;
+}
+function outcomeColor(outcome) {
+  if (outcome.startsWith("succeeded"))
+    return GREEN;
+  if (outcome.startsWith("running"))
+    return CYAN;
+  if (outcome.startsWith("failed") || outcome.startsWith("timed_out") || outcome.startsWith("abandoned"))
+    return RED;
+  if (outcome.startsWith("skipped"))
+    return YELLOW;
+  return DIM;
+}
+function runOutcomeLabel(run) {
+  if (!run)
+    return "-";
+  if (run.status === "failed" && run.exitCode !== undefined)
+    return `failed(${run.exitCode})`;
+  return run.status;
+}
+function providerLabel(target) {
+  if (target.type === "command")
+    return "command";
+  if (target.type === "agent")
+    return target.provider;
+  return "workflow";
+}
+function scheduleLabel(schedule) {
+  if (schedule.type === "once")
+    return "once";
+  if (schedule.type === "interval")
+    return `every:${durationLabel(schedule.everyMs) || `${schedule.everyMs}ms`}`;
+  if (schedule.type === "cron")
+    return `cron:${schedule.expression}`;
+  return schedule.minIntervalMs ? `dynamic:${durationLabel(schedule.minIntervalMs) || `${schedule.minIntervalMs}ms`}` : "dynamic";
+}
+function nextRunLabel(nextRunAt, now) {
+  if (!nextRunAt)
+    return "-";
+  const date = new Date(nextRunAt);
+  if (Number.isNaN(date.getTime()))
+    return "invalid";
+  return relativeTime(date.getTime() - now.getTime());
+}
+function relativeTime(deltaMs) {
+  const past = deltaMs < 0;
+  const abs = Math.abs(deltaMs);
+  const value = durationLabel(abs);
+  if (!value || value === "0ms")
+    return "now";
+  return past ? `${value} ago` : `in ${value}`;
+}
+function durationLabel(ms) {
+  if (ms === undefined || !Number.isFinite(ms))
+    return "";
+  if (ms < 1000)
+    return `${Math.max(0, Math.round(ms))}ms`;
+  const units = [
+    [7 * 24 * 60 * 60 * 1000, "w"],
+    [24 * 60 * 60 * 1000, "d"],
+    [60 * 60 * 1000, "h"],
+    [60 * 1000, "m"],
+    [1000, "s"]
+  ];
+  for (const [unitMs, label] of units) {
+    const value = ms / unitMs;
+    if (value >= 1)
+      return `${Math.round(value)}${label}`;
+  }
+  return `${ms}ms`;
+}
+function timeOnly(value) {
+  const date = new Date(value);
+  if (Number.isNaN(date.getTime()))
+    return value;
+  return date.toISOString().slice(11, 19);
+}
+
 // src/lib/migration.ts
 import { createHash as createHash3 } from "crypto";
 import { hostname as hostname3 } from "os";
@@ -8688,7 +9863,7 @@ function selfHostedControlPlaneSummary(env = process.env) {
 
 // src/lib/hygiene.ts
 import { basename as basename3 } from "path";
-import { homedir as homedir3 } from "os";
+import { homedir as homedir4 } from "os";
 var PROVIDER_TOKENS = new Set([
   "codewith",
   "claude",
@@ -8704,7 +9879,7 @@ var REPO_GENERIC_TOKENS = new Set(["repo", "repoops"]);
 var CADENCE_SUFFIX_TOKENS = new Set(["hourly", "daily", "weekly", "monthly"]);
 var CADENCE_SUFFIX_PATTERN = /^(?:every-?)?\d+(?:s|m|h|d|w)$/;
 function userHome() {
-  return process.env.HOME || homedir3();
+  return process.env.HOME || homedir4();
 }
 function slugify(value) {
   return value.normalize("NFKD").replace(/[^\w\s.-]/g, "-").replace(/[_\s.:/]+/g, "-").replace(/[^a-zA-Z0-9-]+/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "").toLowerCase();
@@ -8942,14 +10117,14 @@ function buildScriptInventoryReport(store, opts = {}) {
 // src/lib/templates.ts
 import { execFileSync } from "child_process";
 import { existsSync as existsSync7 } from "fs";
-import { homedir as homedir4 } from "os";
-import { basename as basename4, isAbsolute as isAbsolute2, join as join7, relative, resolve as resolve4 } from "path";
+import { homedir as homedir5 } from "os";
+import { basename as basename4, isAbsolute as isAbsolute2, join as join9, relative, resolve as resolve4 } from "path";
 
 // src/lib/template-kit.ts
 var TODOS_TASK_WORKER_VERIFIER_TEMPLATE_ID = "todos-task-worker-verifier";
 var EVENT_WORKER_VERIFIER_TEMPLATE_ID = "event-worker-verifier";
 var BOUNDED_AGENT_WORKER_VERIFIER_TEMPLATE_ID = "bounded-agent-worker-verifier";
-var TASK_LIFECYCLE_TEMPLATE_ID = "task-lifecycle";
+var TASK_LIFECYCLE_TEMPLATE_ID2 = "task-lifecycle";
 var PR_REVIEW_TEMPLATE_ID = "pr-review";
 var SCHEDULED_AUDIT_TEMPLATE_ID = "scheduled-audit";
 var KNOWLEDGE_REFRESH_TEMPLATE_ID = "knowledge-refresh";
@@ -9056,7 +10231,7 @@ var BUILTIN_TEMPLATE_SUMMARIES = [
     ]
   },
   {
-    id: TASK_LIFECYCLE_TEMPLATE_ID,
+    id: TASK_LIFECYCLE_TEMPLATE_ID2,
     name: "Task Lifecycle",
     description: "Run the standard task-created lifecycle: triage/dedupe, plan, worker execution, independent verification, and todos closure/follow-up evidence.",
     kind: "workflow",
@@ -9476,6 +10651,50 @@ var PR_HANDOFF_SCRIPT = [
   "console.log(`PR handoff complete: ${finalPrUrl}`);"
 ].join(`
 `);
+var PR_HANDOFF_NO_ARTIFACT_SCRIPT = [
+  "const { spawnSync } = await import('node:child_process');",
+  "const artifactPath = process.env.OPENLOOPS_PR_HANDOFF_ARTIFACT || '';",
+  "const taskId = process.env.OPENLOOPS_PR_HANDOFF_TASK_ID || '';",
+  "const todosProject = process.env.OPENLOOPS_PR_HANDOFF_TODOS_PROJECT || '';",
+  "const worktree = process.env.OPENLOOPS_PR_HANDOFF_WORKTREE || process.cwd();",
+  "const expectedBranch = process.env.OPENLOOPS_PR_HANDOFF_EXPECTED_BRANCH || '';",
+  "const todosBin = process.env.OPENLOOPS_PR_HANDOFF_TODOS_BIN || 'todos';",
+  "const gitBin = process.env.OPENLOOPS_PR_HANDOFF_GIT_BIN || 'git';",
+  "const ghBin = process.env.OPENLOOPS_PR_HANDOFF_GH_BIN || 'gh';",
+  "process.stdout.write(`no PR handoff artifact at ${artifactPath}\\n`);",
+  "const run = (command, args, options = {}) => {",
+  "  try { return spawnSync(command, args, { encoding: 'utf8', ...options }); }",
+  "  catch (error) { return { status: 1, stdout: '', stderr: String((error && error.message) || error) }; }",
+  "};",
+  "const todosArgs = (...args) => todosProject ? ['--project', todosProject, ...args] : args;",
+  "const comment = (text) => {",
+  "  const result = run(todosBin, todosArgs('comment', taskId, text));",
+  "  if (result.status !== 0) console.error(`failed to comment original task: ${result.stderr || result.stdout || result.status}`);",
+  "};",
+  "const main = () => {",
+  "  let branch = expectedBranch;",
+  "  if (!branch) {",
+  "    const shown = run(gitBin, ['-C', worktree, 'branch', '--show-current']);",
+  "    branch = String((shown.status === 0 ? shown.stdout : '') || '').trim();",
+  "  }",
+  "  if (!branch) { console.log('pr-handoff: no artifact and no resolvable branch; nothing to hand off'); return; }",
+  "  const listed = run(ghBin, ['pr', 'list', '--head', branch, '--state', 'open', '--json', 'url,number,headRefName,headRefOid'], { cwd: worktree });",
+  "  if (listed.status !== 0) { console.log(`pr-handoff: no artifact; PR lookup failed for branch ${branch}: ${String(listed.stderr || listed.stdout || listed.status).slice(0, 300)}`); return; }",
+  "  let prs = [];",
+  "  try { prs = JSON.parse(String(listed.stdout || '[]')); } catch { prs = []; }",
+  "  const pr = Array.isArray(prs) ? prs.find((entry) => entry && entry.headRefName === branch && typeof entry.url === 'string' && entry.url) : undefined;",
+  "  if (!pr) { console.log(`pr-handoff: no artifact and no open PR for branch ${branch}; worker completed without opening a PR`); return; }",
+  "  let commit = String(pr.headRefOid || '').trim();",
+  "  if (!commit) {",
+  "    const head = run(gitBin, ['-C', worktree, 'rev-parse', 'HEAD']);",
+  "    commit = String((head.status === 0 ? head.stdout : '') || '').trim();",
+  "  }",
+  "  comment(`openloops:pr-handoff=done task=${taskId} pr=${pr.url} commit=${commit || 'unknown'} branch=${branch}`);",
+  "  console.log(`PR handoff complete (worker-opened PR): ${pr.url}`);",
+  "};",
+  "try { main(); } catch (error) { console.error(`pr-handoff no-artifact detection error (ignored): ${String((error && error.message) || error)}`); }"
+].join(`
+`);
 function prHandoffCommand(opts) {
   return [
     "set -euo pipefail",
@@ -9486,12 +10705,14 @@ function prHandoffCommand(opts) {
     `export OPENLOOPS_PR_HANDOFF_WORKTREE_ROOT=${shellQuote3(opts.worktreeRoot)}`,
     `export OPENLOOPS_PR_HANDOFF_EXPECTED_BRANCH=${shellQuote3(opts.expectedBranch)}`,
     'if [ ! -s "$OPENLOOPS_PR_HANDOFF_ARTIFACT" ]; then',
-    `  printf 'no PR handoff artifact at %s\\n' "$OPENLOOPS_PR_HANDOFF_ARTIFACT"`,
-    "  exit 0",
-    "fi",
+    "bun - <<'OPENLOOPS_PR_HANDOFF_NOARTIFACT'",
+    PR_HANDOFF_NO_ARTIFACT_SCRIPT,
+    "OPENLOOPS_PR_HANDOFF_NOARTIFACT",
+    "else",
     "bun - <<'BUN'",
     PR_HANDOFF_SCRIPT,
-    "BUN"
+    "BUN",
+    "fi"
   ].join(`
 `);
 }
@@ -9569,8 +10790,8 @@ function assignPoolAuthProfiles(input) {
   return { profiles, deferred: false, minLoad: Number.isFinite(minLoad) ? minLoad : 0 };
 }
 // src/lib/templates-custom.ts
-import { existsSync as existsSync6, lstatSync as lstatSync2, mkdirSync as mkdirSync7, readdirSync, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "fs";
-import { join as join6, resolve as resolve3 } from "path";
+import { existsSync as existsSync6, lstatSync as lstatSync2, mkdirSync as mkdirSync8, readdirSync, readFileSync as readFileSync6, writeFileSync as writeFileSync5 } from "fs";
+import { join as join8, resolve as resolve3 } from "path";
 var CUSTOM_TEMPLATE_ID_PATTERN = /^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,127}$/;
 var CUSTOM_TEMPLATE_VARIABLE_PATTERN = /^[a-zA-Z_][a-zA-Z0-9_]*$/;
 var CUSTOM_TEMPLATE_VARIABLE_TYPES = new Set(["string", "number", "boolean", "json", "string[]"]);
@@ -9597,11 +10818,11 @@ function assertTemplateKind(value, label) {
   return kind;
 }
 function customLoopTemplatesDir() {
-  return join6(dataDir(), "templates");
+  return join8(dataDir(), "templates");
 }
 function ensureCustomLoopTemplatesDir() {
   const dir = customLoopTemplatesDir();
-  mkdirSync7(dir, { recursive: true, mode: 448 });
+  mkdirSync8(dir, { recursive: true, mode: 448 });
   return dir;
 }
 function validateCustomTemplateId(id, label) {
@@ -9732,7 +10953,7 @@ function customTemplateSummary(definition, sourcePath) {
 function readCustomTemplateFile(file) {
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync5(file, "utf8"));
+    parsed = JSON.parse(readFileSync6(file, "utf8"));
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
     throw new Error(`failed to read custom template ${file}: ${message}`);
@@ -9760,7 +10981,7 @@ function loadCustomLoopTemplatesRaw() {
   if (!existsSync6(dir))
     return [];
   return readdirSync(dir, { withFileTypes: true }).filter((entry) => entry.name.endsWith(".json")).sort((left, right) => left.name.localeCompare(right.name)).map((entry) => {
-    const file = join6(dir, entry.name);
+    const file = join8(dir, entry.name);
     if (entry.isSymbolicLink())
       throw new Error(`refusing symlinked custom template file: ${file}`);
     if (!entry.isFile())
@@ -9880,7 +11101,7 @@ function importCustomLoopTemplate(file, reservedKeys, opts = {}) {
   const source = resolve3(file);
   const entry = readCustomTemplateFile(source);
   const dir = ensureCustomLoopTemplatesDir();
-  const destination = join6(dir, `${entry.definition.id}.json`);
+  const destination = join8(dir, `${entry.definition.id}.json`);
   const replaced = existsSync6(destination);
   const existing = loadCustomLoopTemplatesRaw().filter((template) => resolve3(template.path) !== resolve3(destination));
   assertNoTemplateCollisions([...existing, { ...entry, path: destination, summary: customTemplateSummary(entry.definition, destination) }], reservedKeys);
@@ -9891,7 +11112,7 @@ function importCustomLoopTemplate(file, reservedKeys, opts = {}) {
     if (!opts.replace)
       throw new Error(`custom template already exists: ${entry.definition.id}; use --replace to overwrite it`);
   }
-  writeFileSync4(destination, `${JSON.stringify(entry.definition, null, 2)}
+  writeFileSync5(destination, `${JSON.stringify(entry.definition, null, 2)}
 `, { mode: 384 });
   const imported = readCustomTemplateFile(destination);
   return { template: structuredClone(imported.summary), path: destination, replaced };
@@ -10009,10 +11230,10 @@ function normalizeWorktreeMode(mode) {
 }
 function defaultWorktreeRoot(root) {
   if (root?.trim()) {
-    const expanded = root.trim().replace(/^~(?=$|\/)/, homedir4());
+    const expanded = root.trim().replace(/^~(?=$|\/)/, homedir5());
     return isAbsolute2(expanded) ? expanded : resolve4(expanded);
   }
-  return join7(homedir4(), ".hasna", "loops", "worktrees");
+  return join9(homedir5(), ".hasna", "loops", "worktrees");
 }
 function gitRootFor(path) {
   if (!existsSync7(path))
@@ -10069,9 +11290,9 @@ function worktreePlan(input, seed) {
   const root = defaultWorktreeRoot(input.worktreeRoot);
   const repoSlug = slugSegment(basename4(repoRoot), "repo");
   const seedSlug = `${slugSegment(seed, "run").slice(0, 48)}-${stableHex(`${repoRoot}:${seed}`)}`;
-  const worktreePath = join7(root, repoSlug, seedSlug);
+  const worktreePath = join9(root, repoSlug, seedSlug);
   const relativeCwd = relative(repoRoot, originalCwd);
-  const cwd = relativeCwd && !relativeCwd.startsWith("..") && !isAbsolute2(relativeCwd) ? join7(worktreePath, relativeCwd) : worktreePath;
+  const cwd = relativeCwd && !relativeCwd.startsWith("..") && !isAbsolute2(relativeCwd) ? join9(worktreePath, relativeCwd) : worktreePath;
   const branchPrefix = (input.worktreeBranchPrefix?.trim() || "openloops").replace(/^\/+|\/+$/g, "") || "openloops";
   const branch = `${branchPrefix}/${repoSlug}/${seedSlug}`;
   return {
@@ -10190,7 +11411,7 @@ function lifecycleGateStep(opts) {
   });
 }
 function prHandoffArtifactPath(plan, taskId) {
-  return join7(plan.cwd, ".openloops", "pr-handoff", `${slugSegment(taskId, "task")}.json`);
+  return join9(plan.cwd, ".openloops", "pr-handoff", `${slugSegment(taskId, "task")}.json`);
 }
 function prHandoffStep(input, plan, todosProjectPath) {
   return commandStep({
@@ -10707,7 +11928,7 @@ var BOUNDED_LIFECYCLE_TEMPLATES = {
 };
 function renderLifecycleBoundedTemplate(id, values) {
   const base = agentTemplateInput(values);
-  if (id === TASK_LIFECYCLE_TEMPLATE_ID) {
+  if (id === TASK_LIFECYCLE_TEMPLATE_ID2) {
     const taskId = values.taskId ?? "";
     if (!taskId.trim())
       throw new Error("taskId is required");
@@ -10823,8 +12044,8 @@ function renderLoopTemplate(id, values, opts = {}) {
 
 // src/lib/backup.ts
 import { Database as Database2 } from "bun:sqlite";
-import { chmodSync as chmodSync3, existsSync as existsSync8, mkdirSync as mkdirSync8, readdirSync as readdirSync2, rmSync as rmSync5 } from "fs";
-import { dirname as dirname6, join as join8 } from "path";
+import { chmodSync as chmodSync3, existsSync as existsSync8, mkdirSync as mkdirSync9, readdirSync as readdirSync2, rmSync as rmSync6 } from "fs";
+import { dirname as dirname6, join as join10 } from "path";
 var DEFAULT_KEEP = 3;
 var DEBOUNCE_MS = 60 * 60 * 1000;
 function reasonSlug(reason) {
@@ -10855,10 +12076,10 @@ function backupDatabase(opts) {
   if (!existsSync8(file)) {
     return { skipped: true, skipReason: `database file not found: ${file}`, prunedPaths: [] };
   }
-  const dir = opts.backupsDir ?? join8(dirname6(file), "backups");
+  const dir = opts.backupsDir ?? join10(dirname6(file), "backups");
   const slug = reasonSlug(opts.reason);
   const now = opts.now ?? new Date;
-  mkdirSync8(dir, { recursive: true, mode: 448 });
+  mkdirSync9(dir, { recursive: true, mode: 448 });
   const existing = listBackups(dir, slug);
   const newest = existing[0];
   if (newest && now.getTime() - newest.timeMs < DEBOUNCE_MS) {
@@ -10868,12 +12089,12 @@ function backupDatabase(opts) {
       prunedPaths: []
     };
   }
-  const target = join8(dir, `loops-${slug}-${backupStamp(now)}.db`);
+  const target = join10(dir, `loops-${slug}-${backupStamp(now)}.db`);
   const db = new Database2(file, { readonly: true });
   try {
     db.query("VACUUM INTO ?").run(target);
   } catch (error) {
-    rmSync5(target, { force: true });
+    rmSync6(target, { force: true });
     throw error;
   } finally {
     db.close();
@@ -10881,8 +12102,8 @@ function backupDatabase(opts) {
   chmodSync3(target, 384);
   const prunedPaths = [];
   for (const entry of listBackups(dir, slug).slice(keep)) {
-    const path = join8(dir, entry.name);
-    rmSync5(path, { force: true });
+    const path = join10(dir, entry.name);
+    rmSync6(path, { force: true });
     prunedPaths.push(path);
   }
   return { path: target, skipped: false, prunedPaths };
@@ -10987,6 +12208,14 @@ function taskEventField(data, keys) {
       if (direct)
         return direct;
     }
+    const payloadTask = payload.task;
+    if (payloadTask && typeof payloadTask === "object" && !Array.isArray(payloadTask)) {
+      for (const key of keys) {
+        const direct = stringField(payloadTask[key]);
+        if (direct)
+          return direct;
+      }
+    }
   }
   return;
 }
@@ -11199,17 +12428,17 @@ function routeFieldList(records, fields) {
 }
 // src/lib/route/cursors.ts
 import { randomUUID } from "crypto";
-import { existsSync as existsSync9, mkdirSync as mkdirSync9, readFileSync as readFileSync6, writeFileSync as writeFileSync5 } from "fs";
-import { join as join9 } from "path";
+import { existsSync as existsSync9, mkdirSync as mkdirSync10, readFileSync as readFileSync7, writeFileSync as writeFileSync6 } from "fs";
+import { join as join11 } from "path";
 function routeCursorsPath() {
-  return join9(dataDir(), "route-cursors.json");
+  return join11(dataDir(), "route-cursors.json");
 }
 function readRouteCursors() {
   const path = routeCursorsPath();
   if (!existsSync9(path))
     return {};
   try {
-    const parsed = JSON.parse(readFileSync6(path, "utf8"));
+    const parsed = JSON.parse(readFileSync7(path, "utf8"));
     return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
   } catch {
     return {};
@@ -11220,15 +12449,15 @@ function writeRouteCursor(key, lastFingerprint) {
     return;
   const cursors = readRouteCursors();
   cursors[key] = { lastFingerprint, updatedAt: new Date().toISOString() };
-  writeFileSync5(routeCursorsPath(), JSON.stringify(cursors, null, 2), { mode: 384 });
+  writeFileSync6(routeCursorsPath(), JSON.stringify(cursors, null, 2), { mode: 384 });
 }
 function writeRouteEvidence(kind, value, evidenceDir) {
   if (!evidenceDir)
     return;
-  mkdirSync9(evidenceDir, { recursive: true, mode: 448 });
+  mkdirSync10(evidenceDir, { recursive: true, mode: 448 });
   const stamp = new Date().toISOString().replace(/[-:]/g, "").replace(/\./g, "");
-  const evidencePath = join9(evidenceDir, `${kind}-${stamp}-${randomUUID().slice(0, 8)}.json`);
-  writeFileSync5(evidencePath, JSON.stringify(value, null, 2), { mode: 384, flag: "wx" });
+  const evidencePath = join11(evidenceDir, `${kind}-${stamp}-${randomUUID().slice(0, 8)}.json`);
+  writeFileSync6(evidencePath, JSON.stringify(value, null, 2), { mode: 384, flag: "wx" });
   return evidencePath;
 }
 function selectRouteItems(items, maxActions, cursorKey, fingerprintOf) {
@@ -11262,7 +12491,7 @@ function routeCursorKey(kind, parts, opts) {
   return `${kind}:${stableHash([...parts, ...routeMode])}`;
 }
 // src/lib/route/gates.ts
-import { readFileSync as readFileSync7 } from "fs";
+import { readFileSync as readFileSync8 } from "fs";
 import { dirname as dirname7, resolve as resolve5 } from "path";
 class GateError extends CodedError {
   gate;
@@ -11298,7 +12527,7 @@ function normalizeWorkflowForStorage(body, context) {
 function workflowBodyFromFile(file, fallbackName, context) {
   try {
     const resolved = resolve5(file);
-    return workflowBodyFromJson(JSON.parse(readFileSync7(resolved, "utf8")), fallbackName, { baseDir: dirname7(resolved) });
+    return workflowBodyFromJson(JSON.parse(readFileSync8(resolved, "utf8")), fallbackName, { baseDir: dirname7(resolved) });
   } catch (error) {
     gateFailure("validation", error, context);
   }
@@ -11487,7 +12716,7 @@ function permissionModeFromOpts(opts, provider) {
   return mode;
 }
 // src/lib/route/pr-review.ts
-import { spawnSync as spawnSync7 } from "child_process";
+import { spawnSync as spawnSync8 } from "child_process";
 var PR_AUTHOR_FIELDS = [
   "github_author",
   "githubAuthor",
@@ -11671,13 +12900,13 @@ function prFingerprintFromTask(data, metadata) {
   return ref ? prFingerprint(ref) : undefined;
 }
 function ghAuthorResolver(ref) {
-  const result = spawnSync7("gh", ["pr", "view", String(ref.number), "--repo", `${ref.owner}/${ref.repo}`, "--json", "author", "-q", ".author.login"], { encoding: "utf8", timeout: 20000 });
+  const result = spawnSync8("gh", ["pr", "view", String(ref.number), "--repo", `${ref.owner}/${ref.repo}`, "--json", "author", "-q", ".author.login"], { encoding: "utf8", timeout: 20000 });
   if (result.error || result.status !== 0)
     return;
   return githubLogin((result.stdout ?? "").trim());
 }
 function ghStateResolver(ref) {
-  const result = spawnSync7("gh", ["pr", "view", String(ref.number), "--repo", `${ref.owner}/${ref.repo}`, "--json", "state,mergeStateStatus"], { encoding: "utf8", timeout: 20000 });
+  const result = spawnSync8("gh", ["pr", "view", String(ref.number), "--repo", `${ref.owner}/${ref.repo}`, "--json", "state,mergeStateStatus"], { encoding: "utf8", timeout: 20000 });
   if (result.error || result.status !== 0)
     return;
   try {
@@ -11806,7 +13035,7 @@ function prReviewRoutingDecision(data, metadata, opts, resolveAuthor = ghAuthorR
 }
 // src/lib/route/throttle.ts
 import { realpathSync as realpathSync2 } from "fs";
-import { spawnSync as spawnSync8 } from "child_process";
+import { spawnSync as spawnSync9 } from "child_process";
 import { resolve as resolve6 } from "path";
 function routeThrottleLimitsFromOpts(opts) {
   return {
@@ -11828,7 +13057,7 @@ function normalizeRoutePath(value) {
   } catch {
     return canonical;
   }
-  const gitRoot = spawnSync8("git", ["-C", canonical, "rev-parse", "--show-toplevel"], { encoding: "utf8" });
+  const gitRoot = spawnSync9("git", ["-C", canonical, "rev-parse", "--show-toplevel"], { encoding: "utf8" });
   if (gitRoot.status === 0 && gitRoot.stdout.trim()) {
     try {
       return realpathSync2(gitRoot.stdout.trim());
@@ -11879,7 +13108,7 @@ function routeThrottleDryRunPreview(args) {
   };
 }
 function isExistingGitProjectPath(path) {
-  const result = spawnSync8("git", ["-C", path, "rev-parse", "--is-inside-work-tree"], { encoding: "utf8" });
+  const result = spawnSync9("git", ["-C", path, "rev-parse", "--is-inside-work-tree"], { encoding: "utf8" });
   return result.status === 0;
 }
 function validateRequiredRouteWorktreeProjectPath(opts, projectPath) {
@@ -11890,7 +13119,7 @@ function validateRequiredRouteWorktreeProjectPath(opts, projectPath) {
   }
 }
 // src/lib/route/route-event.ts
-import { readFileSync as readFileSync8 } from "fs";
+import { readFileSync as readFileSync9 } from "fs";
 import { resolve as resolve7 } from "path";
 function generatedRouteSandboxPreflight(workflow) {
   const checks = [];
@@ -11946,7 +13175,7 @@ function routeWorkflowForStorage(store, workflowBody) {
 }
 var TODOS_TASK_ROUTE_TEMPLATE_IDS = new Set([
   TODOS_TASK_WORKER_VERIFIER_TEMPLATE_ID,
-  TASK_LIFECYCLE_TEMPLATE_ID
+  TASK_LIFECYCLE_TEMPLATE_ID2
 ]);
 var UNCLEARED_ROUTE_WORK_ITEM_STATUSES = new Set([
   "admitted",
@@ -11987,6 +13216,36 @@ function reactivateStaleTodosTaskWorkItem(store, routeKey, item, now = Date.now(
     reason: `re-admitted from ${item.status}: todos task still actionable after prior run (attempt ${item.attempts + 1}/${MAX_TODOS_TASK_ROUTE_REDISPATCHES})`
   });
 }
+function findRouteWorkItemByKeys(store, routeKey, idempotencyKeys) {
+  const [primaryKey, ...aliasKeys] = idempotencyKeys;
+  if (primaryKey) {
+    const existingItem = store.findWorkflowWorkItem(routeKey, primaryKey);
+    if (existingItem && isUnclearedRouteWorkItem(existingItem))
+      return existingItem;
+  }
+  for (const key of aliasKeys) {
+    const existingItem = store.findWorkflowWorkItem(routeKey, key);
+    if (existingItem && (isUnclearedRouteWorkItem(existingItem) || existingItem.status === "queued" || existingItem.status === "deferred"))
+      return existingItem;
+  }
+  return;
+}
+function isPrBacklogTask(data, metadata) {
+  const explicitFingerprint = taskEventField(data, [
+    "pr_fingerprint",
+    "prFingerprint",
+    "github_pr",
+    "githubPr",
+    "github_pr_fingerprint",
+    "githubPrFingerprint",
+    "pull_request_fingerprint",
+    "pullRequestFingerprint"
+  ]);
+  if (explicitFingerprint)
+    return true;
+  const tags = new Set(taskEventTags(taskEventRecords(data, metadata)).map((tag) => tag.toLowerCase()));
+  return tags.has("github-pr") && tags.has("pr-merge-queue");
+}
 function todosTaskRouteTemplateId(opts) {
   const id = (opts.template ?? TODOS_TASK_WORKER_VERIFIER_TEMPLATE_ID).trim();
   if (!TODOS_TASK_ROUTE_TEMPLATE_IDS.has(id)) {
@@ -11995,7 +13254,7 @@ function todosTaskRouteTemplateId(opts) {
   return id;
 }
 async function readEventEnvelopeInput(opts = {}) {
-  const raw = opts.eventJson ?? (opts.eventFile ? readFileSync8(opts.eventFile, "utf8") : process.env.HASNA_EVENT_JSON || await Bun.stdin.text());
+  const raw = opts.eventJson ?? (opts.eventFile ? readFileSync9(opts.eventFile, "utf8") : process.env.HASNA_EVENT_JSON || await Bun.stdin.text());
   const event = JSON.parse(raw);
   if (!event || typeof event !== "object" || Array.isArray(event))
     throw new ValidationError("event JSON must be an object");
@@ -12054,6 +13313,7 @@ function dedupedRoutePrint(plan, outcome) {
 function routeEvent(plan) {
   const { event, opts, idempotencyKey, workflowBody } = plan;
   const sandboxPreflight = generatedRouteSandboxPreflight(workflowBody);
+  const dedupeKeys = [idempotencyKey, ...plan.dedupeAliases ?? []];
   const workItemInput = {
     routeKey: plan.routeKey,
     idempotencyKey,
@@ -12106,8 +13366,8 @@ function routeEvent(plan) {
     let poolAssignment;
     const outcome = store.writeTransaction(() => {
       const invocation = store.createWorkflowInvocation(plan.invocationInput);
-      const existingItem = store.findWorkflowWorkItem(plan.routeKey, idempotencyKey);
-      if (existingItem && isUnclearedRouteWorkItem(existingItem)) {
+      const existingItem = findRouteWorkItemByKeys(store, plan.routeKey, dedupeKeys);
+      if (existingItem) {
         if (!reactivateStaleTodosTaskWorkItem(store, plan.routeKey, existingItem)) {
           const existingLoop = existingItem.loopId ? store.getLoop(existingItem.loopId) : undefined;
           const existingWorkflow = existingItem.workflowId ? store.getWorkflow(existingItem.workflowId) : undefined;
@@ -12270,8 +13530,10 @@ function routeTodosTaskEvent(event, opts) {
   const projectGroup = routeProjectGroup(opts.projectGroup, data, metadata);
   const throttleLimits = routeThrottleLimitsFromOpts(opts);
   const sourceProjectIdempotencyPrefix = sourceTodosProjectPath ? normalizeRoutePath(sourceTodosProjectPath) ?? resolve7(sourceTodosProjectPath) : undefined;
-  const prFingerprint2 = prFingerprintFromTask(data, metadata);
+  const prFingerprint2 = isPrBacklogTask(data, metadata) ? prFingerprintFromTask(data, metadata) : undefined;
   const idempotencyKey = prFingerprint2 ? `todos-task:pr:${prFingerprint2}` : sourceProjectIdempotencyPrefix ? `todos-task:${sourceProjectIdempotencyPrefix}:${taskId}` : `todos-task:${taskId}`;
+  const legacyTaskIdempotencyKey = `todos-task:${taskId}`;
+  const dedupeAliases = legacyTaskIdempotencyKey === idempotencyKey ? [] : [legacyTaskIdempotencyKey];
   const idempotencySuffix = stableSuffix(idempotencyKey);
   const namePrefix = opts.namePrefix ?? "event:todos-task";
   const workflowName = `${namePrefix}:${taskId.slice(0, 8)}:${idempotencySuffix}:workflow`;
@@ -12279,8 +13541,8 @@ function routeTodosTaskEvent(event, opts) {
   if (!opts.dryRun) {
     const store = new Store;
     try {
-      const existingItem = store.findWorkflowWorkItem("todos-task", idempotencyKey);
-      if (existingItem && isUnclearedRouteWorkItem(existingItem)) {
+      const existingItem = findRouteWorkItemByKeys(store, "todos-task", [idempotencyKey, ...dedupeAliases]);
+      if (existingItem) {
         if (!reactivateStaleTodosTaskWorkItem(store, "todos-task", existingItem)) {
           const existingLoop = existingItem.loopId ? store.getLoop(existingItem.loopId) : undefined;
           const existingWorkflow = existingItem.workflowId ? store.getWorkflow(existingItem.workflowId) : undefined;
@@ -12347,7 +13609,7 @@ function routeTodosTaskEvent(event, opts) {
     worktreeMode: opts.worktreeMode ?? "auto",
     worktreeRoot: opts.worktreeRoot,
     worktreeBranchPrefix: opts.worktreeBranchPrefix ?? "openloops",
-    prHandoff: templateId === TASK_LIFECYCLE_TEMPLATE_ID ? Boolean(opts.prHandoff) : false,
+    prHandoff: templateId === TASK_LIFECYCLE_TEMPLATE_ID2 ? Boolean(opts.prHandoff) : false,
     prReviewRouting: prReviewRouting.required ? prReviewRouting : undefined,
     eventId: event.id,
     eventType: event.type,
@@ -12358,7 +13620,7 @@ function routeTodosTaskEvent(event, opts) {
     type: "todos-task-event-workflow",
     event: event.id
   };
-  let workflowBody = templateId === TASK_LIFECYCLE_TEMPLATE_ID ? renderTaskLifecycleWorkflow(workflowInput) : renderTodosTaskWorkerVerifierWorkflow(workflowInput);
+  let workflowBody = templateId === TASK_LIFECYCLE_TEMPLATE_ID2 ? renderTaskLifecycleWorkflow(workflowInput) : renderTodosTaskWorkerVerifierWorkflow(workflowInput);
   workflowBody.name = workflowName;
   workflowBody.description = `Task-triggered ${templateId} workflow for ${taskTitle ?? taskId} from ${event.source}/${event.type}; ` + `idempotency=${idempotencyKey}; event=${event.id}; project=${projectPath}; projectGroup=${projectGroup ?? "-"}`;
   workflowBody = normalizeWorkflowForStorage(workflowBody, workflowContext);
@@ -12384,7 +13646,7 @@ function routeTodosTaskEvent(event, opts) {
       worktreePolicy: opts.worktreeMode ?? "auto",
       permissions: permissionMode,
       manualBreakGlass: Boolean(opts.manualBreakGlass),
-      prHandoff: templateId === TASK_LIFECYCLE_TEMPLATE_ID ? Boolean(opts.prHandoff) : false,
+      prHandoff: templateId === TASK_LIFECYCLE_TEMPLATE_ID2 ? Boolean(opts.prHandoff) : false,
       accountPolicy: providerRouting.authProfilePool?.length || providerRouting.accountPool?.length ? "pool" : hasExplicitRoleAccount ? "role-explicit" : "single",
       providerRouting: providerRoutingPublic(providerRouting),
       prReviewRouting: prReviewRouting.required ? prReviewRouting : undefined,
@@ -12400,6 +13662,7 @@ function routeTodosTaskEvent(event, opts) {
     event,
     opts,
     idempotencyKey,
+    dedupeAliases,
     workflowBody,
     workflowContext,
     invocationInput,
@@ -12541,80 +13804,6 @@ function routeEventByKind(kind, event, opts) {
 }
 // src/lib/route/drain.ts
 import { resolve as resolve8 } from "path";
-
-// src/lib/route/todos-cli.ts
-import { closeSync, mkdtempSync as mkdtempSync2, openSync as openSync2, readFileSync as readFileSync9, rmSync as rmSync6 } from "fs";
-import { spawnSync as spawnSync9 } from "child_process";
-import { join as join10 } from "path";
-import { homedir as homedir5, tmpdir as tmpdir2 } from "os";
-function defaultLoopsProject() {
-  return process.env.LOOPS_TASK_PROJECT || process.env.LOOPS_DATA_DIR || `${process.env.HOME || homedir5()}/.hasna/loops`;
-}
-function runLocalCommand(command, args, opts = {}) {
-  const result = spawnSync9(command, args, {
-    input: opts.input,
-    encoding: "utf8",
-    timeout: opts.timeoutMs ?? 30000,
-    maxBuffer: opts.maxBuffer ?? 8 * 1024 * 1024,
-    env: process.env
-  });
-  return {
-    ok: result.status === 0,
-    status: result.status,
-    stdout: result.stdout || "",
-    stderr: result.stderr || "",
-    error: result.error ? String(result.error.message || result.error) : ""
-  };
-}
-function runLocalCommandWithStdoutFile(command, args, opts = {}) {
-  const tempDir = mkdtempSync2(join10(tmpdir2(), "loops-command-output-"));
-  const stdoutPath = join10(tempDir, "stdout");
-  const stdoutFd = openSync2(stdoutPath, "w");
-  let result;
-  try {
-    result = spawnSync9(command, args, {
-      input: opts.input,
-      encoding: "utf8",
-      timeout: opts.timeoutMs ?? 30000,
-      maxBuffer: opts.maxBuffer ?? 8 * 1024 * 1024,
-      env: process.env,
-      stdio: ["pipe", stdoutFd, "pipe"]
-    });
-  } finally {
-    closeSync(stdoutFd);
-  }
-  try {
-    return {
-      ok: result.status === 0,
-      status: result.status,
-      stdout: readFileSync9(stdoutPath, "utf8"),
-      stderr: typeof result.stderr === "string" ? result.stderr : result.stderr?.toString() || "",
-      error: result.error ? String(result.error.message || result.error) : ""
-    };
-  } finally {
-    rmSync6(tempDir, { recursive: true, force: true });
-  }
-}
-function ensureTodosTaskList(project, slug, name, description) {
-  runLocalCommand("todos", ["--project", project, "task-lists", "--add", name, "--slug", slug, "-d", description]);
-  const list = runLocalCommand("todos", ["--project", project, "--json", "task-lists"]);
-  if (!list.ok)
-    throw new Error(list.stderr || list.error || "failed to list todos task lists");
-  const values = JSON.parse(list.stdout || "[]");
-  const found = values.find((entry) => entry.slug === slug);
-  if (!found)
-    throw new Error(`todos task list not found after ensure: ${slug}`);
-  return found.id;
-}
-function todosMutationSummary(result) {
-  return {
-    ok: result.ok,
-    status: result.status,
-    error: result.ok ? undefined : redact(result.stderr || result.error || "todos mutation failed", 320)
-  };
-}
-
-// src/lib/route/drain.ts
 function taskField(task, keys) {
   for (const key of keys) {
     const value = stringField(task[key]);
@@ -13517,6 +14706,24 @@ function print(value, human) {
   else
     console.log(human);
 }
+var LOOP_STATUS_VALUES = ["active", "paused", "stopped", "expired"];
+function parseLoopStatuses(value, label = "--include") {
+  const raw = splitList(value) ?? ["active", "paused"];
+  const expanded = raw.flatMap((entry) => entry === "all" ? LOOP_STATUS_VALUES : [entry]);
+  const invalid = expanded.filter((entry) => !LOOP_STATUS_VALUES.includes(entry));
+  if (invalid.length > 0)
+    throw new ValidationError(`${label} has invalid loop status: ${invalid.join(", ")}`);
+  return [...new Set(expanded)];
+}
+function compactHealthScanOutput(scan) {
+  if (!scan || typeof scan !== "object" || !("health" in scan))
+    return scan;
+  const healthValue = scan.health;
+  if (!healthValue || typeof healthValue !== "object")
+    return scan;
+  const { expectations: _expectations, ...health } = healthValue;
+  return { ...scan, health };
+}
 function reportCliError(error) {
   const message = error instanceof Error ? error.message : String(error);
   process.exitCode = 1;
@@ -13607,6 +14814,15 @@ function workflowWithAgentTimeouts(workflow, timeoutMs, opts = {}) {
     agentStepIds
   };
 }
+function agentLoopTargetWithTimeout(loop, timeoutMs) {
+  if (loop.target.type !== "agent")
+    throw new Error(`loop is not an agent loop: ${loop.name || loop.id}`);
+  const target = { ...loop.target, timeoutMs };
+  if (timeoutMs === null && target.idleTimeoutMs !== undefined)
+    delete target.idleTimeoutMs;
+  const changed = loop.target.timeoutMs !== timeoutMs || timeoutMs === null && loop.target.idleTimeoutMs !== undefined;
+  return { changed, target };
+}
 function workflowTimeoutMigrationName(workflow, timeoutMs) {
   const policy = timeoutMs === null ? "agent-timeout-unlimited" : `agent-timeout-${timeoutMs}ms`;
   const suffix = randomUUID2().replace(/-/g, "").slice(0, 8);
@@ -13685,7 +14901,7 @@ function parsePolicy(opts) {
     leaseMs: positiveDuration(opts.lease, "--lease")
   };
 }
-function durationLabel(ms) {
+function durationLabel2(ms) {
   if (!ms || !Number.isFinite(ms))
     return "";
   const units = [
@@ -13701,14 +14917,14 @@ function durationLabel(ms) {
   }
   return `${ms}ms`;
 }
-function scheduleLabel(schedule) {
+function scheduleLabel2(schedule) {
   if (schedule.type === "once")
     return `once:${schedule.at}`;
   if (schedule.type === "interval")
-    return `every:${durationLabel(schedule.everyMs) || `${schedule.everyMs}ms`}`;
+    return `every:${durationLabel2(schedule.everyMs) || `${schedule.everyMs}ms`}`;
   if (schedule.type === "cron")
     return `cron:${schedule.expression}`;
-  return schedule.minIntervalMs ? `dynamic:min-${durationLabel(schedule.minIntervalMs) || `${schedule.minIntervalMs}ms`}` : "dynamic";
+  return schedule.minIntervalMs ? `dynamic:min-${durationLabel2(schedule.minIntervalMs) || `${schedule.minIntervalMs}ms`}` : "dynamic";
 }
 function targetLabel(target) {
   if (target.type === "command")
@@ -13720,7 +14936,7 @@ function targetLabel(target) {
 function defaultLoopDescription(name, schedule, target) {
   return [
     `Why: keep ${name} running as an OpenLoops scheduled automation.`,
-    `How: ${targetLabel(target)} on cadence ${scheduleLabel(schedule)}.`,
+    `How: ${targetLabel(target)} on cadence ${scheduleLabel2(schedule)}.`,
     "Outcome: record each run, status, retries, and evidence in OpenLoops for operator review."
   ].join(" ");
 }
@@ -13950,7 +15166,7 @@ program.command("export").description("export a local OpenLoops migration bundle
       throw new ValidationError("export is not no-loss because redactions/blockers are present; rerun with --allow-redacted to write a redacted bundle");
     }
     if (!opts.dryRun)
-      writeFileSync6(opts.file, `${JSON.stringify(bundle, null, 2)}
+      writeFileSync7(opts.file, `${JSON.stringify(bundle, null, 2)}
 `, { mode: 384 });
     const output = {
       ok: true,
@@ -14248,6 +15464,7 @@ addScheduleOptions(addTodosDrainOptions(routes.command("schedule <kind> <name>")
 })).action(runAction((kind, name, opts) => {
   if (kind !== "todos-task")
     throw new ValidationError("route schedule currently supports kind todos-task");
+  todosTaskRouteTemplateId(opts);
   const store = new Store;
   try {
     const target = {
@@ -14487,7 +15704,7 @@ workflows.command("recover <runId>").description("reset interrupted running work
     store.close();
   }
 }));
-workflows.command("migrate-agent-timeouts").description("append-only migrate active workflow loops to a new agent timeout policy").option("--loop <idOrName>", "migrate only one loop instead of all active workflow loops").option("--timeout <duration>", "agent timeout policy; use none/unlimited for no timeout", "none").option("--apply", "create new workflow specs and retarget eligible loops").option("--archive-old", "archive old workflow specs after retargeting when no active loops still reference them").action(runAction((opts) => {
+workflows.command("migrate-agent-timeouts").description("migrate workflow loops, or a direct agent loop selected with --loop, to a new agent timeout policy").option("--loop <idOrName>", "migrate only one loop; required for direct agent loops").option("--timeout <duration>", "agent timeout policy; use none/unlimited for no timeout", "none").option("--apply", "create new workflow specs or update direct agent targets for eligible loops").option("--archive-old", "archive old workflow specs after retargeting when no active loops still reference them").action(runAction((opts) => {
   const store = new Store;
   try {
     const timeoutMs = timeoutDuration(opts.timeout, "--timeout") ?? null;
@@ -14498,8 +15715,45 @@ workflows.command("migrate-agent-timeouts").description("append-only migrate act
         rows.push({ loop: publicLoop(loop), status: "skipped", reason: "loop is archived" });
         continue;
       }
+      if (loop.target.type === "agent") {
+        const migration2 = agentLoopTargetWithTimeout(loop, timeoutMs);
+        if (!migration2.changed) {
+          rows.push({ loop: publicLoop(loop), status: "skipped", reason: "agent timeout policy already matches" });
+          continue;
+        }
+        if (store.hasRunningRun(loop.id)) {
+          rows.push({ loop: publicLoop(loop), status: "blocked", reason: "loop has a running run; retry after it finishes" });
+          continue;
+        }
+        if (!opts.apply) {
+          rows.push({
+            loop: publicLoop(loop),
+            status: "would_update",
+            target: { ...migration2.target, prompt: redact(migration2.target.prompt) },
+            timeoutMs
+          });
+          continue;
+        }
+        try {
+          const updated = store.updateAgentLoopTimeout(loop.id, timeoutMs);
+          rows.push({
+            loop: publicLoop(updated),
+            previousLoop: publicLoop(loop),
+            status: "updated",
+            timeoutMs
+          });
+        } catch (error) {
+          rows.push({
+            loop: publicLoop(loop),
+            status: "blocked",
+            reason: migrationErrorReason(error),
+            timeoutMs
+          });
+        }
+        continue;
+      }
       if (loop.target.type !== "workflow") {
-        rows.push({ loop: publicLoop(loop), status: "skipped", reason: "loop is not a workflow loop" });
+        rows.push({ loop: publicLoop(loop), status: "skipped", reason: "loop is not an agent or workflow loop" });
         continue;
       }
       const workflow = store.requireWorkflow(loop.target.workflowId);
@@ -14558,11 +15812,13 @@ workflows.command("migrate-agent-timeouts").description("append-only migrate act
       timeoutMs,
       total: rows.length,
       migrated: rows.filter((row) => row.status === "migrated").length,
+      updated: rows.filter((row) => row.status === "updated").length,
       wouldMigrate: rows.filter((row) => row.status === "would_migrate").length,
+      wouldUpdate: rows.filter((row) => row.status === "would_update").length,
       blocked: rows.filter((row) => row.status === "blocked").length,
       skipped: rows.filter((row) => row.status === "skipped").length
     };
-    print({ summary, rows }, opts.apply ? `migrated=${summary.migrated} blocked=${summary.blocked} skipped=${summary.skipped}` : `would_migrate=${summary.wouldMigrate} blocked=${summary.blocked} skipped=${summary.skipped}`);
+    print({ summary, rows }, opts.apply ? `migrated=${summary.migrated} updated=${summary.updated} blocked=${summary.blocked} skipped=${summary.skipped}` : `would_migrate=${summary.wouldMigrate} would_update=${summary.wouldUpdate} blocked=${summary.blocked} skipped=${summary.skipped}`);
   } finally {
     store.close();
   }
@@ -14676,13 +15932,23 @@ program.command("list").alias("ls").description("list loops with schedule and ne
       for (const loop of loops) {
         const machine = loop.machine ? `  machine=${loop.machine.id}` : "";
         const archive = loop.archivedAt ? `  archived=${loop.archivedAt} from=${loop.archivedFromStatus ?? "-"}` : "";
-        console.log(`${loop.id}  ${loop.status.padEnd(7)}  cadence=${scheduleLabel(loop.schedule)}  next=${loop.nextRunAt ?? "-"}  ${loop.name}${machine}${archive}`);
+        console.log(`${loop.id}  ${loop.status.padEnd(7)}  cadence=${scheduleLabel2(loop.schedule)}  next=${loop.nextRunAt ?? "-"}  ${loop.name}${machine}${archive}`);
       }
     }
   } finally {
     store.close();
   }
 }));
+program.command("ui").description("open a live table of active loops").option("--refresh <duration>", "refresh interval", "2s").action(runAction(async (opts) => {
+  if (!process.stdin.isTTY || !process.stdout.isTTY) {
+    console.error("OpenLoops UI requires a TTY terminal.");
+    console.error("Use `loops list`, `loops runs`, or `loops daemon status` non-interactively.");
+    process.exitCode = 1;
+    return;
+  }
+  const refreshMs = Math.max(500, parseDuration(opts.refresh ?? "2s"));
+  await runLoopsUiApp({ refreshMs });
+}));
 program.command("show <idOrName>").description("show one loop by id or name").action(runAction((idOrName) => {
   const store = new Store;
   try {
@@ -14737,8 +16003,9 @@ var health = program.command("health").description("summarize loop health and la
       console.log(JSON.stringify(report, null, 2));
     else {
       console.log(`loops=${report.summary.loops} healthy=${report.summary.healthy} unhealthy=${report.summary.unhealthy} warnings=${report.summary.warnings}`);
-      for (const expectation of report.expectations.filter((entry) => !entry.ok)) {
-        console.log(`fail  ${expectation.loop.name}  ${expectation.failure?.classification ?? "unknown"}  ${expectation.failure?.fingerprint ?? "-"}`);
+      for (const expectation of report.expectations.filter((entry) => !entry.ok || entry.check.status === "warn")) {
+        const status = expectation.ok ? "warn" : "fail";
+        console.log(`${status}  ${expectation.loop.name}  ${expectation.failure?.classification ?? "unknown"}  ${expectation.failure?.fingerprint ?? "-"}`);
       }
     }
     if (!report.ok)
@@ -14747,6 +16014,122 @@ var health = program.command("health").description("summarize loop health and la
     store.close();
   }
 }));
+health.command("scan").description("scan OpenLoops health, write bounded reports, and optionally upsert deduped todos findings").option("--include <statuses>", "comma-separated loop statuses to inventory: active,paused,stopped,expired,all", "active,paused").option("--limit <n>", "maximum loops to inspect", "200").option("--max-findings <n>", "maximum findings to include in output", "100").option("--latest-run", "include latest-run and stale-running checks").option("--no-latest-run", "skip latest-run and stale-running checks").option("--stale-running-after <duration>", "minimum age before a running latest run is stale; loop lease and 10m still apply").option("--doctor", "include doctor/preflight checks").option("--daemon", "include daemon status").option("--start-daemon", "safe self-heal: start the daemon if it is not running").option("--report-dir <path>", "write summary.json and report.md under this reports root").option("--evidence-dir <path>", "alias for --report-dir and todo evidence output").option("--upsert-todos", "upsert deduped todos tasks for scan findings").option("--project <path>", "todos project path for --upsert-todos", defaultLoopsProject()).option("--task-list <slug>", "todos task-list slug for --upsert-todos", "loop-error-self-heal").option("--max-actions <n>", "maximum todos tasks to upsert", "5").option("--dry-run", "with --upsert-todos, print intended task upserts without mutating todos").option("--auto-route", "with --upsert-todos, opt routed tasks into task-created headless worker/verifier automation").option("--route-project-path <path>", "fallback project path for --auto-route when the finding has no cwd").option("-j, --json", "print JSON for this command").action(runAction(async (opts) => {
+  const store = new Store;
+  try {
+    const includeStatuses = parseLoopStatuses(opts.include, "--include");
+    let daemon = opts.daemon || opts.startDaemon ? daemonStatus(store) : undefined;
+    const selfHeals = [];
+    if (opts.startDaemon) {
+      if (daemon?.running) {
+        selfHeals.push({
+          kind: "daemon-start",
+          attempted: false,
+          ok: true,
+          reason: "daemon already running"
+        });
+      } else {
+        const result = await startDaemon({ cliEntry: process.argv[1] ?? "loops" });
+        const ok = Boolean(result.started || result.alreadyRunning);
+        selfHeals.push({
+          kind: "daemon-start",
+          attempted: true,
+          ok,
+          reason: daemon?.stale ? "daemon pid file was stale" : "daemon was not running",
+          result
+        });
+        daemon = daemonStatus(store);
+      }
+    }
+    let scan = writeHealthScanReports(buildHealthScan(store, {
+      includeStatuses,
+      limit: positiveInteger(opts.limit, "--limit") ?? 200,
+      maxFindings: nonNegativeInteger(opts.maxFindings, "--max-findings") ?? 100,
+      latestRun: opts.latestRun !== false,
+      staleRunningMs: opts.staleRunningAfter ? positiveDuration(opts.staleRunningAfter, "--stale-running-after") : undefined,
+      doctor: opts.doctor ? runDoctor(store) : undefined,
+      daemon,
+      selfHeals
+    }), { reportDir: opts.reportDir ?? opts.evidenceDir });
+    if (opts.upsertTodos) {
+      const tasks = scan.findings.filter((finding) => finding.recommendedTask).map((finding) => {
+        const task = finding.recommendedTask;
+        const description = [
+          task.description,
+          scan.reports ? `Report: ${scan.reports.markdown}` : undefined
+        ].filter(Boolean).join(`
+
+`);
+        return {
+          title: task.title,
+          description,
+          priority: task.priority,
+          tags: task.tags,
+          fingerprint: task.dedupeKey,
+          extra: {
+            kind: finding.kind,
+            severity: finding.severity,
+            classification: finding.classification
+          },
+          metadata: {
+            source: "openloops.health.scan",
+            kind: finding.kind,
+            severity: finding.severity,
+            loop_id: finding.loop?.id,
+            loop_name: finding.loop?.name,
+            loop_status: finding.loop?.status,
+            run_id: finding.run?.id,
+            classification: finding.classification,
+            fingerprint: task.dedupeKey,
+            cwd: finding.route?.cwd,
+            provider: finding.route?.provider,
+            report_dir: scan.reports?.dir,
+            no_tmux_dispatch: true
+          }
+        };
+      });
+      const result = upsertRouteTasks({
+        project: opts.project,
+        taskList: {
+          slug: opts.taskList,
+          name: "Loop Error Self Heal",
+          description: "Deduped OpenLoops health scan findings for daemon, doctor, preflight, latest-run, and stale-running issues."
+        },
+        cursorKey: routeCursorKey("health", ["scan", opts.project, opts.taskList, includeStatuses.join(","), opts.limit, Boolean(opts.doctor), Boolean(opts.daemon)], { autoRoute: Boolean(opts.autoRoute), routeProjectPath: opts.routeProjectPath }),
+        maxActions: positiveInteger(opts.maxActions, "--max-actions") ?? 5,
+        dryRun: Boolean(opts.dryRun),
+        autoRoute: Boolean(opts.autoRoute),
+        routeProjectPath: opts.routeProjectPath,
+        source: "openloops.health.scan",
+        evidence: { kind: "health-scan-route-tasks", dir: opts.evidenceDir ?? opts.reportDir },
+        summary: {
+          status: scan.status,
+          inspected: scan.counts.loops,
+          findings: scan.counts.findings,
+          reportDir: scan.reports?.dir
+        },
+        tasks
+      });
+      scan = { ...scan, todos: result.output };
+      if (!result.ok)
+        process.exitCode = 1;
+    }
+    const jsonMode = isJson() || Boolean(opts.json);
+    if (jsonMode)
+      console.log(JSON.stringify(compactHealthScanOutput(scan), null, 2));
+    else {
+      const actions = Array.isArray(scan.todos?.actions) ? scan.todos.actions : [];
+      console.log(`health_scan status=${scan.status} loops=${scan.counts.loops} findings=${scan.counts.findings} ` + `reported=${scan.counts.reportedFindings} truncated=${scan.counts.truncatedFindings} ` + `latest=${scan.counts.latestRunFindings} stale_running=${scan.counts.staleRunning} ` + `daemon=${scan.counts.daemonFindings} doctor=${scan.counts.doctorFindings} preflight=${scan.counts.preflightFindings} ` + `report=${scan.reports?.markdown ?? "none"} todos_actions=${actions.length}`);
+      for (const finding of scan.findings) {
+        console.log(`${finding.severity} ${finding.kind} ${finding.fingerprint} ${finding.loop?.name ?? ""} ${finding.message}`);
+      }
+    }
+    if (!process.exitCode && scan.status !== "ok")
+      process.exitCode = scan.status === "critical" ? 2 : 1;
+  } finally {
+    store.close();
+  }
+}));
 health.command("route-tasks").description("upsert deduped todos tasks for failed loop health expectations").option("--project <path>", "todos project path", defaultLoopsProject()).option("--task-list <slug>", "todos task-list slug", "loop-error-self-heal").option("--limit <n>", "maximum loops to inspect", "200").option("--max-actions <n>", "maximum todos tasks to upsert", "5").option("--include-inactive", "also route stopped or expired loops").option("--auto-route", "opt routed tasks into task-created headless worker/verifier automation").option("--route-project-path <path>", "fallback project path for --auto-route when the failed loop has no cwd").option("--evidence-dir <path>", "write the route result JSON to this directory").option("--dry-run", "print intended task upserts without mutating todos").action(runAction((opts) => {
   const store = new Store;
   try {
@@ -15105,7 +16488,7 @@ function listManagedBackups(dir) {
     const group = modern ? `reason:${modern[1]}` : legacy ? `legacy:${legacy[1]}` : undefined;
     if (!group)
       continue;
-    const path = join11(dir, name);
+    const path = join12(dir, name);
     try {
       entries.push({ path, group, timeMs: statSync2(path).mtimeMs });
     } catch {}
@@ -15120,7 +16503,7 @@ function listStrayTempFiles(dirs) {
     for (const name of readdirSync3(dir)) {
       if (!name.endsWith(".tmp"))
         continue;
-      const path = join11(dir, name);
+      const path = join12(dir, name);
       try {
         if (statSync2(path).isFile())
           stray.push(path);
@@ -15143,7 +16526,7 @@ program.command("gc").description("prune old run history, rotate database backup
   } finally {
     store.close();
   }
-  const backupsDir = join11(dataDir(), "backups");
+  const backupsDir = join12(dataDir(), "backups");
   const grouped = new Map;
   for (const entry of listManagedBackups(backupsDir)) {
     const group = grouped.get(entry.group) ?? [];