@henryqw/pi-subagent 27.5.4 → 27.6.0

package/dist/schema.d.ts

@@ -10,6 +10,11 @@ export declare const CheckCommandSchema: Type.TObject<{
     command: Type.TString;
     args: Type.TArray<Type.TString>;
 }>;
+/** One display form for a check command; quoted args keep argv boundaries visible. */
+export declare function formatCheckCommand({ command, args }: {
+    command: string;
+    args: readonly string[];
+}): string;
 export declare const JudgmentSchema: Type.TObject<{
     role: Type.TString;
     modelClass: Type.TUnion<[Type.TLiteral<"fast">, Type.TLiteral<"balanced">, Type.TLiteral<"frontier">, Type.TLiteral<"fav">]>;
@@ -291,6 +296,7 @@ export type HostAllocationPlan = WorkspaceAllocationPlan | WorkerTabAllocationPl
 export type PromptRecord = Static<typeof PromptRecordSchema>;
 export type CommandEvidence = Static<typeof CommandEvidenceSchema>;
 export type CheckBatchEvidence = Static<typeof CheckBatchEvidenceSchema>;
+export type ReusedCheckSource = NonNullable<CommandEvidence["reusedFrom"]>;
 export type ReviewEvidence = Static<typeof ReviewEvidenceSchema>;
 export type WorkerTermination = Static<typeof WorkerTerminationSchema>;
 export declare const CLEANUP_KINDS: readonly ["worker_tab", "workspace", "worktree", "branch"];
@@ -430,6 +436,16 @@ declare const CommandEvidenceSchema: Type.TObject<{
     killed: Type.TBoolean;
     stdout: Type.TString;
     stderr: Type.TString;
+    reusedFrom: Type.TOptional<Type.TObject<{
+        taskId: Type.TString;
+        attempt: Type.TInteger;
+        candidate: Type.TObject<{
+            branch: Type.TString;
+            head: Type.TString;
+            index: Type.TString;
+            tree: Type.TString;
+        }>;
+    }>>;
 }>;
 declare const CheckBatchEvidenceSchema: Type.TObject<{
     phase: Type.TUnion<[Type.TLiteral<"preliminary">, Type.TLiteral<"final">]>;
@@ -452,6 +468,16 @@ declare const CheckBatchEvidenceSchema: Type.TObject<{
         killed: Type.TBoolean;
         stdout: Type.TString;
         stderr: Type.TString;
+        reusedFrom: Type.TOptional<Type.TObject<{
+            taskId: Type.TString;
+            attempt: Type.TInteger;
+            candidate: Type.TObject<{
+                branch: Type.TString;
+                head: Type.TString;
+                index: Type.TString;
+                tree: Type.TString;
+            }>;
+        }>>;
     }>>;
     passed: Type.TBoolean;
     at: Type.TInteger;
@@ -619,6 +645,16 @@ declare const TaskAttemptSchema: Type.TObject<{
             killed: Type.TBoolean;
             stdout: Type.TString;
             stderr: Type.TString;
+            reusedFrom: Type.TOptional<Type.TObject<{
+                taskId: Type.TString;
+                attempt: Type.TInteger;
+                candidate: Type.TObject<{
+                    branch: Type.TString;
+                    head: Type.TString;
+                    index: Type.TString;
+                    tree: Type.TString;
+                }>;
+            }>>;
         }>>;
         passed: Type.TBoolean;
         at: Type.TInteger;
@@ -807,6 +843,16 @@ declare const ChangesetTaskStateSchema: Type.TObject<{
                 killed: Type.TBoolean;
                 stdout: Type.TString;
                 stderr: Type.TString;
+                reusedFrom: Type.TOptional<Type.TObject<{
+                    taskId: Type.TString;
+                    attempt: Type.TInteger;
+                    candidate: Type.TObject<{
+                        branch: Type.TString;
+                        head: Type.TString;
+                        index: Type.TString;
+                        tree: Type.TString;
+                    }>;
+                }>>;
             }>>;
             passed: Type.TBoolean;
             at: Type.TInteger;
@@ -1086,6 +1132,16 @@ declare const TaskStateSchema: Type.TUnion<[Type.TObject<{
                 killed: Type.TBoolean;
                 stdout: Type.TString;
                 stderr: Type.TString;
+                reusedFrom: Type.TOptional<Type.TObject<{
+                    taskId: Type.TString;
+                    attempt: Type.TInteger;
+                    candidate: Type.TObject<{
+                        branch: Type.TString;
+                        head: Type.TString;
+                        index: Type.TString;
+                        tree: Type.TString;
+                    }>;
+                }>>;
             }>>;
             passed: Type.TBoolean;
             at: Type.TInteger;
@@ -1206,6 +1262,16 @@ declare const IntegrationCandidateSchema: Type.TObject<{
             killed: Type.TBoolean;
             stdout: Type.TString;
             stderr: Type.TString;
+            reusedFrom: Type.TOptional<Type.TObject<{
+                taskId: Type.TString;
+                attempt: Type.TInteger;
+                candidate: Type.TObject<{
+                    branch: Type.TString;
+                    head: Type.TString;
+                    index: Type.TString;
+                    tree: Type.TString;
+                }>;
+            }>>;
         }>>;
         passed: Type.TBoolean;
         at: Type.TInteger;
@@ -1350,6 +1416,16 @@ declare const IntegrationGenerationSchema: Type.TObject<{
             killed: Type.TBoolean;
             stdout: Type.TString;
             stderr: Type.TString;
+            reusedFrom: Type.TOptional<Type.TObject<{
+                taskId: Type.TString;
+                attempt: Type.TInteger;
+                candidate: Type.TObject<{
+                    branch: Type.TString;
+                    head: Type.TString;
+                    index: Type.TString;
+                    tree: Type.TString;
+                }>;
+            }>>;
         }>>;
         passed: Type.TBoolean;
         at: Type.TInteger;
@@ -1470,6 +1546,16 @@ export declare const IntegrationStateSchema: Type.TObject<{
                 killed: Type.TBoolean;
                 stdout: Type.TString;
                 stderr: Type.TString;
+                reusedFrom: Type.TOptional<Type.TObject<{
+                    taskId: Type.TString;
+                    attempt: Type.TInteger;
+                    candidate: Type.TObject<{
+                        branch: Type.TString;
+                        head: Type.TString;
+                        index: Type.TString;
+                        tree: Type.TString;
+                    }>;
+                }>>;
             }>>;
             passed: Type.TBoolean;
             at: Type.TInteger;
@@ -1590,6 +1676,16 @@ export declare const IntegrationStateSchema: Type.TObject<{
                 killed: Type.TBoolean;
                 stdout: Type.TString;
                 stderr: Type.TString;
+                reusedFrom: Type.TOptional<Type.TObject<{
+                    taskId: Type.TString;
+                    attempt: Type.TInteger;
+                    candidate: Type.TObject<{
+                        branch: Type.TString;
+                        head: Type.TString;
+                        index: Type.TString;
+                        tree: Type.TString;
+                    }>;
+                }>>;
             }>>;
             passed: Type.TBoolean;
             at: Type.TInteger;
@@ -1918,6 +2014,16 @@ declare const RunStateSchema: Type.TObject<{
                     killed: Type.TBoolean;
                     stdout: Type.TString;
                     stderr: Type.TString;
+                    reusedFrom: Type.TOptional<Type.TObject<{
+                        taskId: Type.TString;
+                        attempt: Type.TInteger;
+                        candidate: Type.TObject<{
+                            branch: Type.TString;
+                            head: Type.TString;
+                            index: Type.TString;
+                            tree: Type.TString;
+                        }>;
+                    }>>;
                 }>>;
                 passed: Type.TBoolean;
                 at: Type.TInteger;
@@ -2031,6 +2137,16 @@ declare const RunStateSchema: Type.TObject<{
                     killed: Type.TBoolean;
                     stdout: Type.TString;
                     stderr: Type.TString;
+                    reusedFrom: Type.TOptional<Type.TObject<{
+                        taskId: Type.TString;
+                        attempt: Type.TInteger;
+                        candidate: Type.TObject<{
+                            branch: Type.TString;
+                            head: Type.TString;
+                            index: Type.TString;
+                            tree: Type.TString;
+                        }>;
+                    }>>;
                 }>>;
                 passed: Type.TBoolean;
                 at: Type.TInteger;
@@ -2151,6 +2267,16 @@ declare const RunStateSchema: Type.TObject<{
                     killed: Type.TBoolean;
                     stdout: Type.TString;
                     stderr: Type.TString;
+                    reusedFrom: Type.TOptional<Type.TObject<{
+                        taskId: Type.TString;
+                        attempt: Type.TInteger;
+                        candidate: Type.TObject<{
+                            branch: Type.TString;
+                            head: Type.TString;
+                            index: Type.TString;
+                            tree: Type.TString;
+                        }>;
+                    }>>;
                 }>>;
                 passed: Type.TBoolean;
                 at: Type.TInteger;
@@ -2281,6 +2407,16 @@ declare const RunStateSchema: Type.TObject<{
                 killed: Type.TBoolean;
                 stdout: Type.TString;
                 stderr: Type.TString;
+                reusedFrom: Type.TOptional<Type.TObject<{
+                    taskId: Type.TString;
+                    attempt: Type.TInteger;
+                    candidate: Type.TObject<{
+                        branch: Type.TString;
+                        head: Type.TString;
+                        index: Type.TString;
+                        tree: Type.TString;
+                    }>;
+                }>>;
             }>>;
             passed: Type.TBoolean;
             at: Type.TInteger;
@@ -2445,11 +2581,16 @@ export declare function parseIdOnly(value: unknown): IdOnly;
 export declare function parseResumeRequest(value: unknown): ResumeRequest;
 export declare function sameIdentity(left: WorkspaceIdentity, right: WorkspaceIdentity): boolean;
 export declare function isCleanCommitted(identity: WorkspaceIdentity): boolean;
-export declare function checkBatchPasses(evidence: CheckBatchEvidence | undefined, checks: readonly CheckCommand[], candidate: WorkspaceIdentity): boolean;
+/** Reused results pass only when they still cite one of `sources` exactly; no sources accept no reuse. */
+export declare function checkBatchPasses(evidence: CheckBatchEvidence | undefined, checks: readonly CheckCommand[], candidate: WorkspaceIdentity, sources?: readonly IntegrationCandidate[]): boolean;
+/** Candidates exactly staged in this generation; only they can supply reused final results. */
+export declare function stagedCheckSources(generation: IntegrationGeneration, candidates: readonly IntegrationCandidate[]): IntegrationCandidate[];
+/** A passed preliminary result stands in for a final check only on the same tree with identical command and argv. */
+export declare function reusableCheckSource(check: CheckCommand, tip: WorkspaceIdentity, sources: readonly IntegrationCandidate[]): ReusedCheckSource | undefined;
 export declare function reviewEvidencePasses(evidence: ReviewEvidence | undefined, phase: ReviewEvidence["phase"], criterion: string, base: WorkspaceIdentity, tip: WorkspaceIdentity): boolean;
 /** Check the persisted integration projection against the request before recovery or promotion. */
 export declare function parseIntegrationState(value: unknown, request: ExecuteRequest): IntegrationState;
 /** Passing final evidence is bound to the exact assembled identity, not any worker tip. */
-export declare function integrationGenerationPasses(generation: IntegrationGeneration, request: ExecuteRequest): boolean;
+export declare function integrationGenerationPasses(generation: IntegrationGeneration, request: ExecuteRequest, candidates: readonly IntegrationCandidate[]): boolean;
 export declare function parseRunState(value: unknown): RunState;
 export {};

package/dist/schema.js

@@ -26,6 +26,10 @@ export const CheckCommandSchema = Type.Object({
     command: TextSchema,
     args: Type.Array(Type.String({ maxLength: 16_000 }), { maxItems: 128 }),
 }, { additionalProperties: false });
+/** One display form for a check command; quoted args keep argv boundaries visible. */
+export function formatCheckCommand({ command, args }) {
+    return [command, ...args.map((arg) => JSON.stringify(arg))].join(" ");
+}
 export const JudgmentSchema = Type.Object({
     role: RoleNameSchema,
     modelClass: ModelClassSchema,
@@ -219,6 +223,12 @@ const CommandEvidenceSchema = Type.Object({
     killed: Type.Boolean(),
     stdout: Type.String({ maxLength: MAX_PERSISTED_RUNTIME_TEXT_BYTES }),
     stderr: Type.String({ maxLength: MAX_PERSISTED_RUNTIME_TEXT_BYTES }),
+    // A final result copied from a staged candidate's passing preliminary result on the same tree.
+    reusedFrom: Type.Optional(Type.Object({
+        taskId: IdSchema,
+        attempt: Type.Integer({ minimum: 1, maximum: 2 }),
+        candidate: WorkspaceSchema,
+    }, { additionalProperties: false })),
 }, { additionalProperties: false });
 const CheckBatchEvidenceSchema = Type.Object({
     phase: Type.Union([Type.Literal("preliminary"), Type.Literal("final")]),
@@ -672,6 +682,9 @@ function validateCheckBatchEvidence(evidence, checks, field) {
         || evidence.results.some((result, index) => !sameCheck(result, checks[index]))) {
         throw new Error(`${field} does not retain every exact declared command and argv.`);
     }
+    if (evidence.results.some((result) => result.reusedFrom && (evidence.phase !== "final" || result.code !== 0 || result.killed))) {
+        throw new Error(`${field} has invalid reused check evidence.`);
+    }
     const commandsPassed = evidence.results.every((result) => result.code === 0 && !result.killed);
     const identityMatches = sameIdentity(evidence.candidate, evidence.identityAfter);
     if (evidence.passed !== (commandsPassed && identityMatches)) {
@@ -686,13 +699,32 @@ function validateCheckBatchEvidence(evidence, checks, field) {
         throw new Error(`${field} retains non-diagnostic command output.`);
     }
 }
-export function checkBatchPasses(evidence, checks, candidate) {
+/** Reused results pass only when they still cite one of `sources` exactly; no sources accept no reuse. */
+export function checkBatchPasses(evidence, checks, candidate, sources = []) {
     return Boolean(evidence
         && evidence.passed
         && sameIdentity(evidence.candidate, candidate)
         && sameIdentity(evidence.identityAfter, candidate)
         && evidence.results.length === checks.length
-        && evidence.results.every((result, index) => sameCheck(result, checks[index]) && result.code === 0 && !result.killed));
+        && evidence.results.every((result, index) => sameCheck(result, checks[index]) && result.code === 0 && !result.killed
+            && (!result.reusedFrom || reusedCheckExact(result, result.reusedFrom, candidate, sources))));
+}
+/** Candidates exactly staged in this generation; only they can supply reused final results. */
+export function stagedCheckSources(generation, candidates) {
+    return generation.stages.flatMap((stage) => candidates.filter((candidate) => stage.status === "staged"
+        && candidate.taskId === stage.taskId && candidate.attempt === stage.attempt && sameIdentity(candidate.tip, stage.source)));
+}
+/** A passed preliminary result stands in for a final check only on the same tree with identical command and argv. */
+export function reusableCheckSource(check, tip, sources) {
+    const source = sources.find(({ tip: candidate, checks }) => candidate.tree === tip.tree
+        && checks.phase === "preliminary" && checks.passed
+        && sameIdentity(checks.candidate, candidate) && sameIdentity(checks.identityAfter, candidate)
+        && checks.results.some((result) => !result.reusedFrom && sameCheck(result, check) && result.code === 0 && !result.killed));
+    return source && { taskId: source.taskId, attempt: source.attempt, candidate: { ...source.tip } };
+}
+function reusedCheckExact(check, reused, tip, sources) {
+    return Boolean(reusableCheckSource(check, tip, sources.filter((source) => source.taskId === reused.taskId
+        && source.attempt === reused.attempt && sameIdentity(source.tip, reused.candidate))));
 }
 export function reviewEvidencePasses(evidence, phase, criterion, base, tip) {
     return Boolean(evidence
@@ -895,7 +927,7 @@ export function parseIntegrationState(value, request) {
         if (generation.checks && !sameIdentity(generation.checks.candidate, generation.combinedTip)) {
             throw new Error(`Generation ${generation.number} checks target another tip.`);
         }
-        const passes = integrationGenerationPasses(generation, request);
+        const passes = integrationGenerationPasses(generation, request, state.candidates);
         const promotion = generation.promotion;
         if (promotion && (!passes || generation.failure !== undefined
             || !sameIdentity(promotion.expectedMain, generation.expectedMain)
@@ -958,12 +990,12 @@ export function parseIntegrationState(value, request) {
     return state;
 }
 /** Passing final evidence is bound to the exact assembled identity, not any worker tip. */
-export function integrationGenerationPasses(generation, request) {
+export function integrationGenerationPasses(generation, request, candidates) {
     return Boolean(generation.combinedTip && isCleanCommitted(generation.combinedTip)
         && generation.stages.length === generation.order.length
         && generation.stages.every((stage, index) => stage.status === "staged" && stage.taskId === generation.order[index])
         && generation.checks?.phase === "final"
-        && checkBatchPasses(generation.checks, request.finalChecks, generation.combinedTip)
+        && checkBatchPasses(generation.checks, request.finalChecks, generation.combinedTip, stagedCheckSources(generation, candidates))
         && (!request.finalJudgment || reviewEvidencePasses(generation.review, "final", request.finalJudgment.criterion, generation.expectedMain, generation.combinedTip)));
 }
 export function parseRunState(value) {
@@ -1297,7 +1329,7 @@ export function parseRunState(value) {
                 && generation.combinedTip.tree === state.final.identity.tree
                 && generation.promotion?.mainAfter && sameIdentity(generation.promotion.mainAfter, state.final.identity)
                 && JSON.stringify(generation.checks) === JSON.stringify(state.final.checks)
-                && integrationGenerationPasses(generation, request))
+                && integrationGenerationPasses(generation, request, state.integration.candidates))
             : checkBatchPasses(state.final.checks, request.finalChecks, state.final.identity);
         if (!acceptedChecks)
             throw new Error("Accepted request lacks passing final checks on its exact identity.");

package/docs/orchestration.md

@@ -69,6 +69,7 @@ Each entry has:
 | `name` | yes | Short display name without terminal controls |
 | `task` | yes | Non-empty task packet |
 | `access` | yes | `read` or `write`; Main's honest classification, not enforced |
+| `paths` | no | Write tasks only: 1 to 32 repo-relative globs (`path.matchesGlob` syntax, such as `src/**`). The change report flags changed paths outside them. A report only, not enforced |
 | `continueFrom` | no | Direct reference such as `D7.1`; continues that finished worker's Pi session. `role` must equal the recorded Role |
 | `kind` | no | `text` only (default); direct `changeset` is rejected |
 | `modelClass` | no | `fast`, `balanced`, `frontier`, or `fav` route |
@@ -78,6 +79,12 @@ An explicit model must support the route's thinking level. A launched child is n
 
 Direct `changeset` is rejected; use isolated mode for checked integration. Resource validation and recursive-delegation exclusions apply to every task. A request becomes a write request when any task declares `access: "write"`.
 
+### Dry run
+
+Set `"dryRun": true` on a direct or isolated `delegate_task` request to check it without a launch. The dry run does the same checks as a launch: request shape, Role lookup, route and model with thinking level, Skills, tools, MCP allowlist, Role extensions, config, and `continueFrom` eligibility. For an isolated request, it also checks the task graph and that Main is clean and committed. If the request has a changeset task, it also checks the canonical root `package.json` test script and adds `pnpm test` to the final checks. A failed check gives the same error as a launch.
+
+The result is a bounded plan. It shows each task's Role, resolved `provider/model`, thinking level, access or kind, dependencies, and checks. An isolated plan also shows the final checks. The dry run makes no Herdr call, Herdr tab, session record, saved state, worktree, lease, checkout admission, or follow-up. The plan lists each check it cannot do without such an effect as `Not checked: <reason>`. Examples are the Herdr host preflight, checkout admission, and the stop of a continued agent.
+
 Read requests skip checkout admission and return plain text. Parallel `tasks` run concurrently up to `maxSubagents`; chains stay ordered. The extension does not enforce `read`. Results stay in request order.
 
 Direct tasks use the declared tools, extensions, Skills, and MCP servers of the selected Role, including resources that can write. Authorization comes from your request and Main's bounded task packet, not from the capabilities of the Role. Name the permitted paths, actions, and exclusions. Preserve unrelated edits and staged changes. Authorize commits or external actions explicitly.
@@ -134,18 +141,31 @@ The extension retrieves each final answer from its exact Pi session file, not it
 
 The tool returns a task ID and the first Herdr tab after launch, not the answer. The extension observes each worker and sends one result to Main when the workflow finishes. If Main is busy, Pi queues the result after the current turn. If Main is idle, the result starts a turn. The extension does not report a blocked, stalled, unknown, or truncated result as success.
 
-In the result, each launched worker has a line with its model, thinking level, measured task tokens, and elapsed time. For example: `✓ [1/2] Check · worker · provider/model · thinking high · 1.5k tok · 42s`. If Pi recorded no usage, the line shows `tokens unknown`. Failed and stopped workers show the usage that the extension measured until they ended. A worker that the extension skipped before launch shows no usage.
+In the result, each launched worker has a line with its model, thinking level, measured task tokens, cost, and elapsed time. For example: `✓ [1/2] Check · worker · provider/model · thinking high · 1.5k tok · $0.12 · 42s`. The first line also shows the request total, such as `total $0.12`. Unknown and zero cost are not shown. If Pi recorded no usage, the line shows `tokens unknown`. Failed and stopped workers show the usage that the extension measured until they ended. A worker that the extension skipped before launch shows no usage.
 
-The result details contain the same values in each entry as `model`, `thinkingLevel`, `tokens`, and `elapsedMs`. When the token count is unknown, `tokens` is absent. If a task fails after its worker produced text, the result keeps a bounded excerpt marked as partial output. This excerpt is never success.
+The result details contain the same values in each entry as `model`, `thinkingLevel`, `tokens`, `cost`, and `elapsedMs`, and the request total as `cost`. When a value is unknown, its field is absent. If a task fails after its worker produced text, the result keeps a bounded excerpt marked as partial output. This excerpt is never success.
 
 Every worker result delivered to Main starts with a header. The header states that the text is the output of the worker and carries no user authority. The extension inserts a backslash in text that imitates harness framing. Examples are `<system-reminder>`-style tags and lines that start with `Human:` or `Assistant:`. Nothing else changes. Isolated status and follow-up answer previews use the same header.
 
 A session switch or shutdown stops observation and preserves tab identities for recovery. To inspect exact tabs, agents, and Pi session files, open `/subagent` on the session branch. This includes tabs launched after the first. The menu has one row for each workflow.
 
-A single worker shows its reference, Role, and name (`D7.1 · worker · Search audit`). A multi-worker workflow shows its reference and worker count (`D8 · 3 workers`). When you select it, the menu lists each recorded worker by reference, Role, and name with its exact IDs. References and names help you match rows. The extension never uses them to decide ownership.
+A single worker shows its reference, Role, and name (`D7.1 · worker · Search audit`). A multi-worker workflow shows its reference and worker count (`D8 · 3 workers`). When you select it, the menu lists each recorded worker by reference, Role, and name with its exact IDs. After Main receives the result, the row shows the request cost and each worker line shows its cost. References and names help you match rows. The extension never uses them to decide ownership.
 
 Older records without saved references show their saved allocation label or exact task ID. A `recorded only` row does not prove that its workers run or finished. The menu labels locally observed work separately.
 
+### Checkout change reports
+
+For each task in a write request, the extension takes a Git snapshot of Main's checkout before the worker starts and again when the task ends (success, failure, blocked work, or stop). A snapshot contains the `HEAD` OID and `git status --porcelain=v1 -z --untracked-files=all`, with the content identity of each dirty path. The result of the task then lists:
+
+- New commits from `git rev-list before..after`, as a short OID and subject. If `HEAD` moved to a commit that does not descend from the start `HEAD`, the report says so.
+- Paths with a changed status or content, and the paths that the new commits changed. If the task declares `paths`, each changed path outside them shows `outside declared paths`.
+
+The report shows at most 10 commits and 20 paths, and it counts the omitted items. Paths outside the declaration come first. The same report is in the `checkout` field of the result details entry. The report does not enforce scope. Checkout admission blocks Main writes during a write request, so the report assigns changes to the worker. It cannot exclude changes from other processes.
+
+For a read request, the extension compares the same snapshot at launch and when each task ends. If `HEAD`, status, or dirty content changed, the result of that task shows `checkout changed during task; result may be stale`.
+
+Outside a Git repository, the extension makes no report and the task continues. If a snapshot fails, the task does not fail; the result shows `change report unavailable: <reason>` (or `stale-read check unavailable: <reason>` for a read request).
+
 ### Status widgets
 
 The TUI has two separate compact status widgets. Each widget has one row for each visible worker or task. `D` marks direct work, and `I` marks isolated work. Badges such as `[S]` and `[I3]` identify the Role initial. Isolated badges also include the model class: `1` fast, `2` balanced, `3` frontier, `*` fav.
@@ -154,13 +174,13 @@ Each direct row starts with a saved direct reference such as `D7.1`. `D7` is the
 
 A session switch can move a workflow into a session that already uses its number. In that case, the workflow gets a new number there. An existing Herdr tab keeps its original launch label.
 
-The direct widget shows the launched model, thinking level, elapsed time, and measured task tokens (`— tok` until usage is available). Failed rows show before working and completed rows. When rows overflow, `… N more` includes counts by status.
+The direct widget shows the launched model, thinking level, elapsed time, measured task tokens (`— tok` until usage is available), and cost next to the tokens (such as `$0.12`; not shown when unknown or zero). Failed rows show before working and completed rows. When rows overflow, `… N more` includes counts by status.
 
 The isolated widget shows the recorded task state and any retained workspace. It does not show reliable live model, thinking, or token readings from Herdr. Attention shows before ordinary work, and overflow uses `+N more · /subagent`. An aborted request with visible tasks has its own `request aborted` row. This row does not change the recorded statuses of the tasks.
 
 A committed worker without a checked candidate can show attention, not readiness. Status glyphs use the active TUI theme. The text also names the status without color.
 
-The direct widget and result summaries show measured tokens for the current task turn. This count adds input and output tokens from completed assistant usage records. It excludes cache-read and cache-write tokens. A continued worker counts only its new task turn. Missing usage stays unknown. This display count does not change token-limit accounting.
+The direct widget and result summaries show measured tokens for the current task turn. This count adds input and output tokens from completed assistant usage records. It excludes cache-read and cache-write tokens. A continued worker counts only its new task turn. Missing usage stays unknown. This display count does not change token-limit accounting. The cost is the sum of `usage.cost.total` from the same records, read in the same session read. Isolated task state records no usage, so isolated rows show no tokens or cost.
 
 A ready isolated candidate is **not promoted** to Main. To reload the menu and the isolated widget from saved state, choose **Refresh** in `/subagent`. Refresh does not recover or change a request. Use `/subagent` or `subagent_status` for exact identities, failures, and recovery.
 
@@ -231,7 +251,7 @@ Admission and worker-wave dispatch pin Main's exact committed branch, HEAD, and
 
 Main selects exact candidates through `subagent_stage` into an owned integration checkout in explicit order. Each stage is a committed merge of the candidate, not a mutation of Main. Conflicts retain the checkout for Main to resolve; `resolve` verifies the exact two-parent merge instead of replaying an uncertain merge. Main can explicitly run dependent tasks from an exact staged tip with `subagent_integrate advance` and stage their results afterward. Independent candidates may be staged without re-running workers.
 
-Once all selected work is staged, Main calls `subagent_integrate validate` on the exact clean combined tip. It acknowledges the durably saved validation intent and continues in the session-owned background, independent of later turn cancellation; session replacement/shutdown still cancels it. A follow-up reports completion; status remains authoritative if delivery is missed. This runs every final check, including `pnpm test`, and optional final judgment in the integration checkout before any Main mutation. A failed check/review can be followed by one Main-authored committed correction in that checkout, recorded with `correct`, then another `validate`.
+Once all selected work is staged, Main calls `subagent_integrate validate` on the exact clean combined tip. It acknowledges the durably saved validation intent and continues in the session-owned background, independent of later turn cancellation; session replacement/shutdown still cancels it. A follow-up reports completion; status remains authoritative if delivery is missed. This runs every final check, including `pnpm test`, unless [exact check reuse](#validate-and-promote) applies, and optional final judgment in the integration checkout before any Main mutation. A failed check/review can be followed by one Main-authored committed correction in that checkout, recorded with `correct`, then another `validate`.
 
 Staging, combined validation, and `promote` require clean Main at the recorded committed identity. Dirty edits block these actions even when the checked candidate stays retained. The extension never replays or merges dirty work automatically. `promote` requires exact passing combined evidence and unchanged Main and uses a guarded update to Main. Only proven promotion leads to selected-worker termination and verified cleanup. A changed candidate, integration tip, or Main identity invalidates prior evidence or blocks promotion; review accepts only exact `PASS`.
 
@@ -299,6 +319,15 @@ Post-promotion cleanup handles each promoted stage separately. A blocked termina
 
 Validation acknowledges only after saving the exact generation's validation intent. Checks and final judgment then run in the background. Later turn cancellation does not cancel acknowledged validation; session replacement or shutdown does. Acknowledgement is not passing evidence. Inspect status if the completion follow-up fails.
 
+Validation reuses a passed preliminary result for a final check, and does not run that check again, only when all of these conditions are true:
+
+- The candidate is staged in this generation.
+- The tree OID of the combined tip is equal to the tree OID of the candidate. This usually occurs when you stage one candidate onto unchanged pinned Main.
+- The saved preliminary checks of the candidate passed, and their `candidate` and `identityAfter` are equal to the candidate tip.
+- The preliminary result has the identical command and argv, exit code 0, and no timeout or signal.
+
+Any mismatch runs the check normally. Each reused result records `reusedFrom` with `taskId`, `attempt`, and `candidate`. Status text and the validation follow-up show each reused command. Promotion, reconciliation, and state loading accept a reused result only after they prove these conditions again from saved identities. Final judgment still runs. Reuse assumes that checks use only tracked content. Ignored files, for example `node_modules`, can be different between the worker and integration worktrees.
+
 #### Refresh
 
 ```text

package/extensions/isolated.ts

@@ -2,7 +2,7 @@ import { basename } from "node:path";
 import type { JsonValue } from "@earendil-works/pi-ai";
 import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
 import { truncateToWidth } from "@earendil-works/pi-tui";
-import { utf8Prefix, type EphemeralSubagentExecutor } from "../dist/ephemeral.js";
+import { capEphemeralSubagentOutput, utf8Prefix, type EphemeralSubagentExecutor } from "../dist/ephemeral.js";
 import type { EffectiveExecutionPolicy } from "./config.ts";
 import {
 	createCanonicalGitRootResolver,
@@ -16,7 +16,7 @@ import { HerdrHostRuntime } from "../dist/herdr-runtime.js";
 import { inspectPruneCandidates, listHerdrPanes, removePruneCandidates, type PruneGuards, type PruneItem } from "../dist/prune.js";
 import { runProcess as directRunProcess } from "../dist/process.js";
 import { RoleLaunchRuntime, type LaunchRuntimeOptions } from "../dist/launch-runtime.js";
-import { IsolatedRunner, nextIntegrationAction, type OperationContext, type RunResponse } from "../dist/runner.js";
+import { IsolatedRunner, nextIntegrationAction, type ExecutePlan, type OperationContext, type RunResponse } from "../dist/runner.js";
 import {
 	IdOnlySchema,
 	ResumeRequestParameters,
@@ -25,6 +25,7 @@ import {
 	parseIntegrationAction,
 	parseStageRequest,
 	parseIdOnly,
+	formatCheckCommand,
 	parseResumeRequest,
 	sameIdentity,
 	StatusOutputSchema,
@@ -208,7 +209,7 @@ function publicFailedCheck(evidence: CheckBatchEvidence | undefined) {
 		phase: evidence.phase,
 		identityChanged: !sameIdentity(evidence.candidate, evidence.identityAfter),
 		...(result ? {
-			command: boundedPublicText([result.command, ...result.args.map((arg) => JSON.stringify(arg))].join(" ")),
+			command: boundedPublicText(formatCheckCommand(result)),
 			code: result.code,
 			killed: result.killed,
 			...(result.stdout ? { stdout: boundedPublicText(result.stdout) } : {}),
@@ -334,6 +335,8 @@ function publicState(state: RunState, verdictMaxBytes: number, preferredTaskId?:
 				...(combinedTip ? { combinedTip } : {}),
 				...(correction ? { correction } : {}),
 				...(checks ? { checked: checks.passed, failedCheck: publicFailedCheck(checks) } : {}),
+				...(checks?.results.some((result) => result.reusedFrom) ? { reusedChecks: checks.results.flatMap((result) =>
+					result.reusedFrom ? [{ command: boundedPublicText(formatCheckCommand(result)), reusedFrom: result.reusedFrom }] : []) } : {}),
 				...(review ? { reviewed: review.passed, failedReview: publicFailedReview(review, verdictMaxBytes) } : {}),
 				...(promotion ? { promotion: promotion.status, ...(promotion.mainAfter ? { mainAfter: promotion.mainAfter } : {}),
 					...(promotion.failure ? { promotionFailure: boundedPublicText(promotion.failure) } : {}) } : {}),
@@ -469,7 +472,50 @@ function toolResult(response: RunResponse, ctx: ExtensionContext, rowsByRequest:
 	};
 }
 
+/** Bounded dry-run plan; a route missing from the coordinator report shows as unresolved. */
+export function formatExecutePlan({ request, root, main, routes }: ExecutePlan, hostChecked: boolean): { content: [{ type: "text"; text: string }]; details: unknown } {
+	const route = (role: string, modelClass: ModelClass) => {
+		const found = routes.find((candidate) => candidate.role === role && candidate.modelClass === modelClass);
+		return found ? { model: found.model, thinkingLevel: found.thinkingLevel } : undefined;
+	};
+	const label = (role: string, modelClass: ModelClass) => {
+		const resolved = route(role, modelClass);
+		return `${role} · ${modelClass} → ${resolved ? `${resolved.model} · thinking ${resolved.thinkingLevel}` : "route not reported"}`;
+	};
+	const changesets = request.tasks.some((task) => task.kind === "changeset");
+	const notChecked = [
+		...(changesets && !hostChecked ? ["Herdr host preflight (client and server versions, API schema, lsof, current workspace identity): it calls Herdr"] : []),
+		"request ID uniqueness and saved-state admission: they need the state lock",
+	];
+	const lines = [
+		`Dry run passed: isolated request ${request.id} in ${root} at Main ${main.head.slice(0, 12)} (${main.branch}). No state, worktree, Herdr tab, lease, or follow-up was created.`,
+		...request.tasks.map((task, index) => [
+			`${index + 1}. ${task.id} · ${task.kind} · ${label(task.role, task.modelClass)}`,
+			`   depends on: ${task.dependsOn.join(", ") || "none"} · context from: ${task.contextFrom.join(", ") || "none"}`,
+			...(task.kind === "changeset" ? [`   checks: ${task.checks.map(formatCheckCommand).join("; ")}`,
+				...(task.judgment ? [`   judgment: ${label(task.judgment.role, task.judgment.modelClass)}`] : [])] : []),
+		].join("\n")),
+		`Final checks: ${request.finalChecks.map(formatCheckCommand).join("; ") || "none"}`,
+		...(request.finalJudgment ? [`Final judgment: ${label(request.finalJudgment.role, request.finalJudgment.modelClass)}`] : []),
+		...notChecked.map((reason) => `Not checked: ${reason}.`),
+	];
+	return {
+		content: [{ type: "text", text: capEphemeralSubagentOutput(lines.join("\n")) }],
+		details: {
+			dryRun: true, mode: "isolated", id: request.id, root, main,
+			tasks: request.tasks.map((task) => ({ id: task.id, kind: task.kind, role: task.role, modelClass: task.modelClass,
+				...route(task.role, task.modelClass), dependsOn: task.dependsOn, contextFrom: task.contextFrom,
+				...(task.kind === "changeset" ? { checks: task.checks, ...(task.judgment ? { judgment: { ...task.judgment, ...route(task.judgment.role, task.judgment.modelClass) } } : {}) } : {}) })),
+			finalChecks: request.finalChecks,
+			...(request.finalJudgment ? { finalJudgment: { ...request.finalJudgment, ...route(request.finalJudgment.role, request.finalJudgment.modelClass) } } : {}),
+			notChecked,
+		},
+	};
+}
+
 export interface IsolatedSurface {
+	/** Dry run of execute: validates and resolves without durable state or Herdr calls. */
+	plan(request: ExecuteRequest, signal: AbortSignal | undefined, ctx: ExtensionContext): Promise<ReturnType<typeof formatExecutePlan>>;
 	execute(request: ExecuteRequest, signal: AbortSignal | undefined, ctx: ExtensionContext): Promise<ReturnType<typeof toolResult>>;
 	inventory(cwd: string, current?: () => boolean): Promise<IsolatedInventory>;
 	recover(cwd: string): Promise<string>;
@@ -877,6 +923,13 @@ export function registerIsolatedExtension(pi: ExtensionAPI, options: RegisterIso
 			requireCurrent(current);
 			return getComponents().runner.drainFollowups(root, requestId, taskId);
 		},
+		async plan(request, signal, ctx) {
+			latestCtx = ctx;
+			latestContext();
+			const root = await lookupRoot(ctx.cwd, signal);
+			if (jobOwners.has(`${root}\0${request.id}`)) throw new Error(`Pi Subagent request ${request.id} is already active in this session runtime.`);
+			return formatExecutePlan(await getComponents().runner.plan(request, ctx.cwd, signal), false);
+		},
 		async execute(request, signal, ctx) {
 			latestCtx = ctx;
 			latestContext();