@iowarp/clio-coder 0.3.7 → 0.3.9

package/src/domains/dispatch/extension.ts

@@ -12,6 +12,7 @@
 import { createHash, randomBytes } from "node:crypto";
 import { type Dirent, existsSync, readdirSync, readFileSync } from "node:fs";
 import { isAbsolute, relative, resolve as resolvePath, sep } from "node:path";
+import { performance } from "node:perf_hooks";
 import { BusChannels, type DispatchCompletedPayload, type DispatchRunIdentity } from "../../core/bus-events.js";
 import { DEFAULT_SETTINGS, type DelegationToolGovernance } from "../../core/defaults.js";
 import type { DomainBundle, DomainContext, DomainExtension } from "../../core/domain-loader.js";
@@ -76,6 +77,9 @@ import { type EffectivePricing, resolveEffectivePricing } from "../providers/cat
 import {
 	type CapabilityFlags,
 	canonicalizeWireModelId,
+	type EndpointCapacity,
+	endpointCapacitiesForStatuses,
+	endpointCapacityForStatus,
 	firstRuntimeResolutionError,
 	isDispatchEligibleRuntime,
 	type ProvidersContract,
@@ -123,6 +127,7 @@ import { AssignmentRegistry, applyActiveRouteSelection, asAssignmentId } from ".
 import type { AssignmentAttemptStartEvent } from "./assignment-events.js";
 import { reconcileOrphanAssignments } from "./assignment-reconcile.js";
 import {
+	assignmentProcessOwnerAlive,
 	cancelStoredAssignment,
 	failQueuedAssignment,
 	getStoredAssignment,
@@ -165,8 +170,16 @@ import {
 } from "./failure-classification.js";
 import { routeFactVerdict } from "./fleet-preflight.js";
 import { competeStanceLiner, isBoundedGateRolePrompt } from "./gate-role-prompts.js";
-import { classifyHeartbeat, DEFAULT_HEARTBEAT_SPEC, type HeartbeatSpec, type HeartbeatStatus } from "./heartbeat.js";
+import {
+	classifyHeartbeat,
+	DEFAULT_HEARTBEAT_SPEC,
+	type HeartbeatSpec,
+	type HeartbeatStamp,
+	type HeartbeatStatus,
+	heartbeatMonotonicAt,
+} from "./heartbeat.js";
 import { hostVerificationRejection, runHostVerification } from "./host-verification.js";
+import { renderDispatchIntentRequirements } from "./intent-requirements.js";
 import { adaptJointRouteInput } from "./joint-route-adapter.js";
 import {
 	configuredJointNodes,
@@ -181,6 +194,12 @@ import {
 	resultContractWasDue,
 	runStatusForOutcome,
 } from "./outcome.js";
+import {
+	type DispatchPathScope,
+	declaredScopeReplacementDiagnostic,
+	declaredScopeReplacementNotice,
+	resolveDispatchPathScope,
+} from "./path-scope.js";
 import { deriveEnvelopePhaseDurations, deriveRunPhaseDurations, recordRunTimingBestEffort } from "./phase-timing.js";
 import { createFleetPlacementPreviewResolver, createFleetPlacementResolver } from "./placement.js";
 import {
@@ -197,6 +216,7 @@ import {
 	planQueueSlot,
 	type ReservationCapacitySnapshot,
 	rebindDispatchReservationMember,
+	releaseDispatchReservation,
 	releaseDispatchReservationMember,
 	reservedBudgetUsd,
 	reservedPlanPeakSlots,
@@ -278,6 +298,7 @@ import {
 	type SpawnOptions as WorkerSpawnOptions,
 	type WorkerSpec,
 } from "./worker-spawn.js";
+import type { WriteBoundaryAttribution, WriteBoundaryAttributionDowngrade } from "./write-boundary.js";
 
 interface RunTokenMeter {
 	inputTokens: number;
@@ -329,7 +350,7 @@ interface ActiveRun {
 	/** ACP event-inactivity window; null for native runs (heartbeat spec governs those). */
 	stallTimeoutMs: number | null;
 	lineage: RunLineage;
-	heartbeatAt: { current: number } | null;
+	heartbeatAt: HeartbeatStamp | null;
 	heartbeatStatus: HeartbeatStatus;
 	meter: RunTokenMeter;
 	pricing: EffectivePricing["rates"];
@@ -365,6 +386,8 @@ export interface DispatchBundleOptions {
 	heartbeatIntervalMs?: number;
 	resilienceCooldownMs?: number;
 	now?: () => number;
+	/** Monotonic clock for heartbeat age and ACP event-inactivity spans. */
+	monotonicNow?: () => number;
 	/** Immutable per-attempt session settings view; falls back to the shared snapshot. */
 	getSettings?: () => EffectiveSettings;
 	/** Live hard-block state cloned into each mediated worker spec. */
@@ -614,6 +637,14 @@ function recordWorkerRunEffect(recorder: RunEffectsRecorder, event: Record<strin
  */
 const DISPATCH_DRAIN_GRACE_MS = 2000;
 
+/**
+ * How many finalized runs keep their observed write targets in memory. The
+ * write boundary reads a run's record while closing the window it ran in, which
+ * is the same wave, so a few hundred runs of headroom is far more than the
+ * lookup ever reaches back for.
+ */
+const RUN_WRITE_TARGET_HISTORY = 512;
+
 async function awaitEventDrain(drained: Promise<void>, graceMs = DISPATCH_DRAIN_GRACE_MS): Promise<boolean> {
 	let timer: ReturnType<typeof setTimeout> | undefined;
 	const grace = new Promise<false>((resolve) => {
@@ -751,9 +782,14 @@ function pickOrchestratorScope(safety: SafetyContract): ScopeSpec {
 	return safety.scopes.workspace;
 }
 
-function pickWorkerScope(safety: SafetyContract, requestedActions: ReadonlyArray<ActionClass>): ScopeSpec {
+function pickWorkerScope(
+	safety: SafetyContract,
+	requestedActions: ReadonlyArray<ActionClass>,
+	pathScope: DispatchPathScope,
+): ScopeSpec {
 	if (requestedActions.every((action) => action === "read")) return safety.scopes.readonly;
-	return safety.scopes.workspace;
+	if (pathScope.writeBoundaries.length === 0) return safety.scopes.workspace;
+	return { ...safety.scopes.workspace, allowedWriteRoots: pathScope.writeBoundaries };
 }
 
 function deriveRequestedActions(tools: ReadonlyArray<ToolName>, safety: SafetyContract): ReadonlyArray<ActionClass> {
@@ -993,6 +1029,25 @@ function hasPersonaOverride(req: DispatchRequest): boolean {
 	return typeof req.systemPrompt === "string" && req.systemPrompt.trim().length > 0;
 }
 
+/**
+ * Whether this request's system prompt is a caller-authored persona rather
+ * than one of the coordinator's own bounded gate-role prompts.
+ *
+ * A reviewer, a compete judge, and a council synthesis all carry a system
+ * prompt the coordinator wrote, pinned by {@link isBoundedGateRolePrompt} to
+ * one exact text under one gate role and read-only autonomy. That is the
+ * topology speaking, not an operator reshaping a recipe, so it is not the
+ * thing the shadow and internal audiences are protected from. The ACP
+ * delegation path already draws the line here; without the same line, a
+ * council that seats the builtin read-only `researcher` (a shadow recipe, and
+ * the agent every unnamed council seats) refused `--synthesis judge` outright,
+ * before a single member ran.
+ */
+function hasCallerPersonaOverride(req: DispatchRequest): boolean {
+	if (!hasPersonaOverride(req)) return false;
+	return !isBoundedGateRolePrompt({ role: req.gate?.role, autonomy: req.autonomy, systemPrompt: req.systemPrompt });
+}
+
 function personaOverrideFor(req: DispatchRequest, staticCompositionHash: string | null): RunPersonaOverride | null {
 	if (!hasPersonaOverride(req) || staticCompositionHash === null) return null;
 	return { promptHash: staticCompositionHash };
@@ -1003,9 +1058,8 @@ function personaOverrideFor(req: DispatchRequest, staticCompositionHash: string
  * flows through dynamic messages, never through the system prompt. The system
  * prompt itself is stable per recipe and tool surface with one exception: the
  * operator-editable layer (`additionalFragments`) folds in path-scoped project
- * rules selected by `workerWorkingContextPaths`, which are recalled from the
- * task and briefing text, so `staticCompositionHash` can differ between two
- * runs of one recipe when a rule's glob matches one task and not the other.
+ * rules selected from the canonical request scope, so `staticCompositionHash`
+ * can differ between two runs of one recipe when their scoped rules differ.
  * A local model's worker prefix cache misses on that flip; the trade was made
  * deliberately in #96 to keep rules scoped rather than shipped wholesale.
  */
@@ -1074,35 +1128,6 @@ function workerProjectContextIncludesVerification(body: string): boolean {
 	return body.includes("\nVerification expectations:\n");
 }
 
-/**
- * Path-like tokens in free text: a slash-separated segment, or a bare
- * `name.ext` token. The model-facing dispatch tool has no structured
- * path/file field, so a worker's task text is the only working-context
- * signal available at compile time; this is best-effort recall, not a
- * parser. A false-positive token is harmless because `selectActiveRules`
- * only activates a rule when the token matches that rule's own glob.
- */
-const PATH_TOKEN_RE = /(?:[\w.-]+\/)+[\w.-]+|\b[\w-]+\.[A-Za-z0-9]{1,8}\b/g;
-
-/**
- * Best-effort working-context paths for a dispatched worker: `writeRoots`
- * when the caller set them (the precise signal, for internal/programmatic
- * callers), plus path-like tokens recalled from the task and briefing text.
- * Feeds the same `selectActiveRules` a session uses, so a worker whose task
- * touches a ruled path reads that rule instead of never hearing about it.
- */
-function workerWorkingContextPaths(req: DispatchRequest): string[] {
-	const out = new Set<string>();
-	for (const root of req.writeRoots ?? []) out.add(root);
-	const text = `${req.task}\n${req.briefing ?? ""}`;
-	for (const match of text.matchAll(PATH_TOKEN_RE)) {
-		const token = match[0];
-		if (token.startsWith("http://") || token.startsWith("https://")) continue;
-		out.add(token);
-	}
-	return [...out];
-}
-
 export function buildDynamicPromptMessages(
 	req: DispatchRequest,
 	dynamicContext: WorkerDynamicContext = {},
@@ -1126,6 +1151,10 @@ export function buildDynamicPromptMessages(
 		const body = `Safety posture: autonomy ${autonomy}. ${workerSafetyOneLiner(autonomy, permission)} Worker permission routing: ${permission}.`;
 		messages.push({ id: "dispatch-safety-posture", body, contentHash: sha256(body) });
 	}
+	const requirements = renderDispatchIntentRequirements(req.intent);
+	if (requirements !== null) {
+		messages.push({ id: "dispatch-intent-requirements", body: requirements, contentHash: sha256(requirements) });
+	}
 	if (req.competeStance !== undefined) {
 		const body = competeStanceLiner(req.competeStance);
 		messages.push({ id: "dispatch-compete-stance", body, contentHash: sha256(body) });
@@ -1250,6 +1279,7 @@ interface DispatchAdmissionStage {
 
 interface DispatchWorkerSpecInput {
 	req: DispatchRequest;
+	pathScope: DispatchPathScope;
 	target: ResolvedTarget;
 	admission: DispatchAdmissionStage;
 	recipe?: AgentRecipe | null;
@@ -1269,6 +1299,7 @@ interface DispatchWorkerSpecInput {
 
 interface DispatchLifecycleStage {
 	recipe: AgentRecipe | null;
+	pathScope: DispatchPathScope;
 	admission: DispatchAdmissionStage;
 	target: ResolvedTarget;
 	cwd: string;
@@ -1304,6 +1335,7 @@ interface DispatchLifecycleStage {
 
 interface AcpDelegationLifecycleStage {
 	admission: DispatchAdmissionStage;
+	pathScope: DispatchPathScope;
 	agentConfig: ReturnType<ConfigContract["get"]>["delegation"]["agents"][number];
 	cwd: string;
 	systemPrompt: string;
@@ -1488,10 +1520,6 @@ function explicitToolCapability(
 	return typeof fromKnowledgeBase === "boolean" ? fromKnowledgeBase : null;
 }
 
-function writeConfinedRequest(req: DispatchRequest): boolean {
-	return req.writeRoots !== undefined && req.writeRoots.length > 0;
-}
-
 function effectiveToolNames(
 	allowedTools: ReadonlyArray<ToolName>,
 	target: ResolvedTarget,
@@ -1717,6 +1745,7 @@ function resolveDispatchAdmissionStage(
 	req: DispatchRequest,
 	recipe: AgentRecipe,
 	safety: SafetyContract,
+	pathScope: DispatchPathScope,
 ): DispatchAdmissionStage {
 	const recipeTools = recipe.tools;
 	const candidateTools = recipeTools && recipeTools.length > 0 ? (Array.from(recipeTools) as ToolName[]) : [];
@@ -1730,7 +1759,7 @@ function resolveDispatchAdmissionStage(
 	}
 	const requestedActions = deriveRequestedActions(allowedTools, safety);
 	const orchScope = pickOrchestratorScope(safety);
-	const workerScope = pickWorkerScope(safety, requestedActions);
+	const workerScope = pickWorkerScope(safety, requestedActions, pathScope);
 	const verdict = admit(
 		{
 			requestedScope: workerScope,
@@ -1755,7 +1784,7 @@ function resolveDelegationAdmissionStage(req: DispatchRequest, safety: SafetyCon
 	const allowedTools = applyToolProfile([], req.toolProfile);
 	const requestedActions = deriveRequestedActions(allowedTools, safety);
 	const orchScope = pickOrchestratorScope(safety);
-	const workerScope = pickWorkerScope(safety, requestedActions);
+	const workerScope = pickWorkerScope(safety, requestedActions, resolveDispatchPathScope(req));
 	const verdict = admit(
 		{
 			requestedScope: workerScope,
@@ -1833,9 +1862,17 @@ function buildDispatchWorkerSpec(input: DispatchWorkerSpecInput, config?: Config
 	// The worker repairs against exactly the contract the orchestrator will seal.
 	// A gate role that overrides the recipe contract gets no worker-side repair,
 	// for the same reason it gets no recipe validation.
-	if (appliesRecipeResultContract(input.req.gate?.role) && input.recipe?.resultContract) {
-		spec.resultContract = input.req.resultContractOverride ?? input.recipe.resultContract;
-	}
+	//
+	// The request's own override is the contract whether or not the seated
+	// recipe declares one, because that is the resolution the seal already uses.
+	// Requiring a recipe contract here meant a caller-supplied override against a
+	// recipe with none was sealed but never sent, so the worker spent no repair
+	// round on a contract it was never told about and the run failed on a shape
+	// nothing had asked it for.
+	const workerResultContract = appliesRecipeResultContract(input.req.gate?.role)
+		? (input.req.resultContractOverride ?? input.recipe?.resultContract)
+		: undefined;
+	if (workerResultContract) spec.resultContract = workerResultContract;
 	const product = input.req.product ?? input.recipe?.product;
 	if (product) spec.product = product;
 	// The orchestrator's tool decision is the one the run was admitted under and
@@ -1886,14 +1923,9 @@ function buildDispatchWorkerSpec(input: DispatchWorkerSpecInput, config?: Config
 		if (escalation) spec.escalation = { timeoutMs: escalation.timeoutMs, fallback: escalation.fallback };
 	}
 	assertRuntimeCanHonorWorkerPermissionMode(input.target.runtime, spec.onPermission);
-	// Carry write-root confinement to the worker safety seam. Refuse it up front
-	// on runtimes that cannot mediate per-tool calls (subprocess) so it is never
-	// silently ignored. Roots are resolved against the job cwd so a relative root
-	// reaches the worker absolute, matching the validation contract.
-	if (input.req.writeRoots !== undefined && input.req.writeRoots.length > 0) {
-		const jobCwd = input.req.cwd !== undefined && input.req.cwd.length > 0 ? input.req.cwd : process.cwd();
-		spec.writeRoots = input.req.writeRoots.map((root) => resolvePath(jobCwd, root));
-	}
+	// Carry canonical write boundaries to the worker safety seam. Exact files
+	// remain exact and trailing-slash entries remain subtrees after resolution.
+	if (input.pathScope.writeBoundaries.length > 0) spec.writeRoots = [...input.pathScope.writeBoundaries];
 	assertWriteRootsEnforceable(input.target.runtime, spec.writeRoots);
 	// Carry the tool profile so external CLI runtimes that cannot mediate
 	// per-tool calls can refuse a narrowing profile they would otherwise ignore.
@@ -2380,6 +2412,7 @@ export function createDispatchBundle(
 		return DEFAULT_RESILIENCE_COOLDOWN_MS;
 	};
 	const now = options?.now ?? (() => Date.now());
+	const monotonicNow = options?.monotonicNow ?? (() => performance.now());
 	// Durable evidence owner used by shadow observation and active readiness.
 	const routeObserver: RouteObserver = options?.routeObserver ?? createRouteObserver({});
 
@@ -2388,12 +2421,32 @@ export function createDispatchBundle(
 	const active = new Map<string, ActiveRun>();
 	const targetCooldowns = new Map<string, { until: number; reason: string }>();
 	const ownedReservations = new Set<string>();
+	/**
+	 * Attribution from each finalized run's successful tool calls, newest last.
+	 * An incomplete record retains its paths as a lower bound beside the reasons
+	 * it cannot be read as a closed list.
+	 *
+	 * Held in memory rather than sealed into the receipt: the only reader is the
+	 * write boundary closing a window seconds later in this process, and a
+	 * per-run path list is run-shaped evidence the receipt schema does not carry.
+	 * Bounded because a long session finalizes many runs and none of this is
+	 * needed once its window has closed.
+	 */
+	const runWriteAttributions = new Map<string, WriteBoundaryAttribution>();
+	const recordRunWriteAttribution = (runId: string, attribution: WriteBoundaryAttribution): void => {
+		runWriteAttributions.set(runId, attribution);
+		while (runWriteAttributions.size > RUN_WRITE_TARGET_HISTORY) {
+			const oldest = runWriteAttributions.keys().next();
+			if (oldest.done === true) break;
+			runWriteAttributions.delete(oldest.value);
+		}
+	};
 	const capacityAdmission = createCapacityAdmissionController({
 		limits: () => {
 			const settings = getEffectiveSettings();
 			const nodes: Record<string, number> = { local: configuredGlobalCapacity(settings) };
 			for (const node of settings?.fleet?.nodes ?? []) nodes[node.id] = node.maxWorkers;
-			return { global: configuredGlobalCapacity(settings), nodes };
+			return { global: configuredGlobalCapacity(settings), nodes, endpoints: configuredEndpointLimits() };
 		},
 		now,
 		reservedPlanPeak: (planId) =>
@@ -2406,6 +2459,21 @@ export function createDispatchBundle(
 		}),
 	);
 
+	function configuredEndpointLimits(): Readonly<Record<string, number>> {
+		return Object.fromEntries(
+			Object.entries(endpointCapacitiesForStatuses(providers.list())).map(([key, value]) => [key, value.limit]),
+		);
+	}
+
+	function endpointCapacityForTarget(targetId: string): EndpointCapacity | null {
+		const status = providers.list().find((entry) => entry.target.id === targetId);
+		if (status === undefined) return null;
+		const endpoint = endpointCapacityForStatus(status);
+		if (endpoint === null) return null;
+		const configured = endpointCapacitiesForStatuses(providers.list())[endpoint.key];
+		return configured ?? endpoint;
+	}
+
 	function reservationCapacitySnapshot(settings: EffectiveSettings): ReservationCapacitySnapshot {
 		const preflight = scheduling.preflight();
 		// Reservation planning compares against a fresh read, never the display cache.
@@ -2415,9 +2483,21 @@ export function createDispatchBundle(
 		};
 		for (const node of settings?.fleet?.nodes ?? [])
 			nodes[node.id] = { active: usage.nodes[node.id] ?? 0, limit: node.maxWorkers };
+		const endpoints = Object.fromEntries(
+			Object.entries(configuredEndpointLimits()).map(([key, limit]) => [
+				key,
+				{
+					active: usage.endpoints[key] ?? 0,
+					limit,
+					leases: usage.endpointHolders[key]?.leases ?? 0,
+					foregroundStreams: usage.endpointHolders[key]?.foregroundStreams ?? 0,
+				},
+			]),
+		);
 		return {
 			global: { active: usage.global, limit: configuredGlobalCapacity(settings) },
 			nodes,
+			endpoints,
 			budget: { currentUsd: preflight.currentUsd, ceilingUsd: preflight.ceilingUsd },
 		};
 	}
@@ -2429,6 +2509,7 @@ export function createDispatchBundle(
 				memberId: task.memberId,
 				wave: task.wave,
 				nodeId: task.resolution.node.id,
+				...(task.resolution.endpoint !== undefined ? { endpointKey: task.resolution.endpoint.key } : {}),
 				costUpperBoundUsd: task.resolution.routeApproval?.totalCostUpperBoundUsd ?? task.resolution.costUpperBoundUsd,
 			})),
 			capacity: reservationCapacitySnapshot(getEffectiveSettings()),
@@ -2483,7 +2564,12 @@ export function createDispatchBundle(
 		return scheduling.maxWorkers?.() ?? (configured === "auto" || configured === undefined ? 4 : Math.max(1, configured));
 	}
 
-	async function admitAssignmentCapacity(req: DispatchRequest, nodeId: string, timing: RunPhaseMarks) {
+	async function admitAssignmentCapacity(
+		req: DispatchRequest,
+		nodeId: string,
+		timing: RunPhaseMarks,
+		endpoint?: EndpointCapacity | null,
+	) {
 		const queuedAt = now();
 		timing.queuedAt = new Date(queuedAt).toISOString();
 		const assignmentId = req.lineage?.rootRunId ?? `pending-${queuedAt.toString(36)}-${randomBytes(6).toString("hex")}`;
@@ -2501,9 +2587,16 @@ export function createDispatchBundle(
 			const admitted = await capacityAdmission.admit({
 				assignmentId,
 				nodeId,
+				...(endpoint !== null && endpoint !== undefined ? { endpointKey: endpoint.key } : {}),
 				deadlineAt,
 				...plan,
-				...(req.reservation !== undefined && req.lineage === undefined ? { reservation: req.reservation } : {}),
+				// A fleet's first attempt carries lineage and still owns the held
+				// reservation member that admission must transfer into its lease.
+				// Retries carry the same reservation identity after that member was
+				// consumed, so they reacquire/rebind the assignment lease normally.
+				...(req.reservation !== undefined && (req.lineage === undefined || req.lineage.attempt === 0)
+					? { reservation: req.reservation }
+					: {}),
 			});
 			timing.admittedAt = new Date(admitted.admittedAt).toISOString();
 			return admitted.lease;
@@ -2520,6 +2613,7 @@ export function createDispatchBundle(
 	function rebindReservationSlot(
 		req: DispatchRequest,
 		nodeId: string,
+		endpoint: EndpointCapacity | null,
 		costUsd: number,
 		settings: EffectiveSettings,
 	): void {
@@ -2528,6 +2622,7 @@ export function createDispatchBundle(
 		const rebind = {
 			...req.reservation,
 			nodeId,
+			...(endpoint !== null ? { endpointKey: endpoint.key } : {}),
 			costUpperBoundUsd: req.routeApproval?.totalCostUpperBoundUsd ?? costUsd,
 			capacity,
 			nowMs: now(),
@@ -2635,6 +2730,21 @@ export function createDispatchBundle(
 
 	type RetryScheduleResult = { scheduled: true } | { scheduled: false; settlementDetail?: string };
 
+	/** A reserved plan member owns its retry chain independently of the shared fleet root assignment. */
+	function retryChainIsLive(run: ActiveRun): boolean {
+		if (run.aborted) return false;
+		const reservation = run.req.reservation;
+		if (reservation === undefined) return assignments.get(run.lineage.rootRunId)?.status === "running";
+		try {
+			const record = getDispatchReservation(reservation.ownerId);
+			const member = record?.members.find((entry) => entry.memberId === reservation.memberId);
+			return record?.status === "active" && member !== undefined && member.status !== "released";
+		} catch (error) {
+			reportDispatchDiagnostic(`read retry liveness for reservation member ${reservation.memberId}`, error);
+			return false;
+		}
+	}
+
 	function maybeScheduleRetry(
 		run: ActiveRun,
 		outcome: RunOutcome,
@@ -2644,7 +2754,7 @@ export function createDispatchBundle(
 	): RetryScheduleResult {
 		if (draining) return { scheduled: false };
 		const rootRunId = run.lineage.rootRunId;
-		if (assignments.get(rootRunId)?.status !== "running") return { scheduled: false };
+		if (!retryChainIsLive(run)) return { scheduled: false };
 		if (!RETRYABLE_OUTCOMES.has(outcome)) {
 			retryBackoff.delete(rootRunId);
 			return { scheduled: false };
@@ -2791,7 +2901,7 @@ export function createDispatchBundle(
 		reason = "retry",
 		decision: RetryDecision = decideRetry("internal", run.lineage.attempt, assignmentPolicyFor(run.req).maxRetries),
 	): Promise<void> {
-		if (draining || assignments.get(run.lineage.rootRunId)?.status !== "running") return;
+		if (draining || !retryChainIsLive(run)) return;
 		const excludesNode = decision.excludedRouteParts.includes("node");
 		// Record the failed node so placement can choose an eligible survivor.
 		const rerouteHops =
@@ -2973,8 +3083,8 @@ export function createDispatchBundle(
 		}
 	}
 
-	function heartbeatIso(heartbeatMs: number): string {
-		return new Date(heartbeatMs).toISOString();
+	function heartbeatIso(heartbeat: HeartbeatStamp): string {
+		return new Date(heartbeat.current).toISOString();
 	}
 
 	function heartbeatRunStatus(status: HeartbeatStatus): RunStatus {
@@ -2995,7 +3105,7 @@ export function createDispatchBundle(
 			event: {
 				type: "heartbeat_status",
 				status,
-				heartbeatAt: run.heartbeatAt ? heartbeatIso(run.heartbeatAt.current) : null,
+				heartbeatAt: run.heartbeatAt ? heartbeatIso(run.heartbeatAt) : null,
 			},
 		});
 	}
@@ -3013,16 +3123,16 @@ export function createDispatchBundle(
 	 */
 	function checkActiveHeartbeats(): void {
 		if (!ledger) return;
-		const tickNow = now();
+		const tickMonotonic = monotonicNow();
 		for (const run of active.values()) {
 			if (run.aborted || run.stallKilled || !run.heartbeatAt) continue;
-			const heartbeatMs = run.heartbeatAt.current;
-			if (!Number.isFinite(heartbeatMs)) continue;
+			const heartbeatMonotonic = heartbeatMonotonicAt(run.heartbeatAt);
+			if (!Number.isFinite(heartbeatMonotonic) || !Number.isFinite(run.heartbeatAt.current)) continue;
 			if (run.runtimeKind === "acp-delegation") {
-				ledger.update(run.runId, { heartbeatAt: heartbeatIso(heartbeatMs) });
+				ledger.update(run.runId, { heartbeatAt: heartbeatIso(run.heartbeatAt) });
 				const stallMs = run.stallTimeoutMs;
 				if (stallMs === null || stallMs <= 0) continue;
-				if (tickNow - heartbeatMs <= stallMs) continue;
+				if (tickMonotonic - heartbeatMonotonic <= stallMs) continue;
 				run.stallKilled = true;
 				run.heartbeatStatus = "dead";
 				emitHeartbeatStatus(run, "dead");
@@ -3033,10 +3143,10 @@ export function createDispatchBundle(
 				}
 				continue;
 			}
-			const status = classifyHeartbeat(heartbeatMs, tickNow, heartbeatSpec);
+			const status = classifyHeartbeat(heartbeatMonotonic, tickMonotonic, heartbeatSpec);
 			const patch: Partial<RunEnvelope> = {
 				status: heartbeatRunStatus(status),
-				heartbeatAt: heartbeatIso(heartbeatMs),
+				heartbeatAt: heartbeatIso(run.heartbeatAt),
 			};
 			ledger.update(run.runId, patch);
 			// Node staleness display feeds off the freshest worker heartbeat.
@@ -3169,6 +3279,27 @@ export function createDispatchBundle(
 		targetCooldowns.set(key, { until: now() + cooldownMs, reason: failureClass });
 	}
 
+	function publishDispatchPathScope(req: DispatchRequest, pathScope: DispatchPathScope): void {
+		const replacementDiagnostic = declaredScopeReplacementDiagnostic(pathScope);
+		if (replacementDiagnostic !== null) {
+			reportDispatchDiagnostic("typed scope replacement", new Error(replacementDiagnostic));
+		}
+		// Only the replacement case reaches the transcript. A dispatch that
+		// declared no intent is the ordinary case rather than an anomaly, and one
+		// receipt in ninety-nine carries an intent key today, so noticing it would
+		// warn on almost every dispatch and teach the operator to skip the channel.
+		// Its provenance is not lost: the receipt seals `pathProvenance`, and the
+		// approval artifact renders every inferred entry in full before a
+		// supervised dispatch runs, which is where an operator can still act on it.
+		const notice = declaredScopeReplacementNotice(pathScope);
+		if (notice !== null) {
+			context.bus.emit(BusChannels.DispatchScopeNotice, {
+				...notice,
+				agentId: req.agentId,
+			});
+		}
+	}
+
 	async function resolveLifecycle(req: DispatchRequest, settings: EffectiveSettings): Promise<DispatchLifecycleStage> {
 		const recipe = agents.get(req.agentId);
 		if (!recipe) {
@@ -3180,7 +3311,7 @@ export function createDispatchBundle(
 				`dispatch: agent '${req.agentId}' is a ${spec.audience} agent reserved for Clio internal orchestration`,
 			);
 		}
-		if (hasPersonaOverride(req) && (spec.audience === "shadow" || spec.audience === "internal")) {
+		if (hasCallerPersonaOverride(req) && (spec.audience === "shadow" || spec.audience === "internal")) {
 			throw new Error(`dispatch: persona overrides are not allowed for ${spec.audience} agent '${req.agentId}'`);
 		}
 		// A read-only recipe pointed at a mutating task is knowable here and costs
@@ -3202,7 +3333,9 @@ export function createDispatchBundle(
 						specs: agents.listSpecs(),
 					});
 		if (capabilityMismatch?.verdict === "refuse") throw new Error(capabilityMismatch.detail);
-		const admission = resolveDispatchAdmissionStage(req, recipe, safety);
+		const pathScope = resolveDispatchPathScope(req);
+		publishDispatchPathScope(req, pathScope);
+		const admission = resolveDispatchAdmissionStage(req, recipe, safety, pathScope);
 		const targets = readWorkerTargets(settings);
 		const target = resolveDispatchTarget(
 			req,
@@ -3221,7 +3354,7 @@ export function createDispatchBundle(
 		const sessionAutonomy = settings?.autonomy ?? "auto-edit";
 		const effectiveAutonomy = clampWorkerAutonomy(sessionAutonomy, req.autonomy);
 		const effectiveTools = withLedgerToolNarrowing(
-			effectiveToolNames(admission.allowedTools, target, writeConfinedRequest(req), deniedToolNames(req)),
+			effectiveToolNames(admission.allowedTools, target, pathScope.writeBoundaries.length > 0, deniedToolNames(req)),
 			req,
 		);
 		assertPostRuntimeToolCompatibility(req.agentId, spec, effectiveTools, target);
@@ -3250,7 +3383,7 @@ export function createDispatchBundle(
 				dynamic: false,
 			},
 			cwd,
-			workingContextPaths: workerWorkingContextPaths(req),
+			workingContextPaths: pathScope.workingContextPaths,
 		});
 		const systemPrompt = compiledWorkerPrompt.systemPrompt;
 		const budgetEnvelope = resolveEffectiveWorkerBudget({
@@ -3294,6 +3427,7 @@ export function createDispatchBundle(
 		const limitations = runtimeLimitations(runtimeKind, target.runtime.id);
 		return {
 			recipe,
+			pathScope,
 			admission: effectiveAdmission,
 			target,
 			cwd,
@@ -3331,12 +3465,7 @@ export function createDispatchBundle(
 	): AcpDelegationLifecycleStage {
 		const agentId = req.delegationAgentId;
 		if (!agentId) throw new Error("dispatch: missing delegationAgentId");
-		const boundedGateRolePrompt = isBoundedGateRolePrompt({
-			role: req.gate?.role,
-			autonomy: req.autonomy,
-			systemPrompt: req.systemPrompt,
-		});
-		if (hasPersonaOverride(req) && !boundedGateRolePrompt) {
+		if (hasCallerPersonaOverride(req)) {
 			throw new Error(`dispatch: persona overrides are not allowed for ACP delegation agent '${agentId}'`);
 		}
 		if (req.agentId && maybeAgents) {
@@ -3365,6 +3494,7 @@ export function createDispatchBundle(
 			);
 		}
 		const cwd = req.cwd ?? process.cwd();
+		const pathScope = resolveDispatchPathScope(req);
 		const personaBody = workerPersonaBody(req, null, []);
 		// ACP owns an unknown external tool inventory, so it receives the raw
 		// bounded persona rather than a native Clio schema-harness claim.
@@ -3391,6 +3521,7 @@ export function createDispatchBundle(
 		const personaOverride = personaOverrideFor(req, staticCompositionHash);
 		return {
 			admission,
+			pathScope,
 			agentConfig: configured,
 			cwd,
 			systemPrompt,
@@ -3426,6 +3557,7 @@ export function createDispatchBundle(
 		finalPromise: Promise<RunReceipt>;
 	}> {
 		const lifecycle = resolveAcpDelegationLifecycle(req, settings);
+		publishDispatchPathScope(req, lifecycle.pathScope);
 		timing.decisionCompletedAt = new Date(now()).toISOString();
 		const targetId = `delegation:${lifecycle.agentConfig.id}`;
 		const runtimeId = "acp";
@@ -3434,7 +3566,7 @@ export function createDispatchBundle(
 
 		assertBudgetAdmitsRoute(req, { rates: null, provenance: "unknown" }, settings);
 
-		const capacityLease = await admitAssignmentCapacity(req, "local", timing);
+		const capacityLease = await admitAssignmentCapacity(req, "local", timing, null);
 		const leaseSlot = createLeaseSlotGuard(capacityAdmission, capacityLease.leaseId, req.lineage !== undefined);
 
 		// Resolve the ledger before starting the ACP process: an external agent
@@ -3460,6 +3592,8 @@ export function createDispatchBundle(
 				safety,
 				autonomy: lifecycle.autonomy,
 				clientVersion: readClioVersion(),
+				now,
+				monotonicNow,
 			});
 		} catch (error) {
 			leaseSlot.release();
@@ -3648,7 +3782,7 @@ export function createDispatchBundle(
 			ledgerRef.update(envelope.id, {
 				status: "running",
 				pid: acp.pid,
-				heartbeatAt: heartbeatIso(acp.heartbeatAt.current),
+				heartbeatAt: heartbeatIso(acp.heartbeatAt),
 				lineage,
 				identity,
 				node: LOCAL_RUN_NODE,
@@ -3799,6 +3933,7 @@ export function createDispatchBundle(
 				requestOrigin: lifecycle.requestOrigin,
 				task: req.task,
 				...(req.intent !== undefined ? { intent: structuredClone(req.intent) } : {}),
+				pathScope: structuredClone(lifecycle.pathScope.provenance),
 				targetId,
 				wireModelId,
 				runtimeId,
@@ -4044,7 +4179,7 @@ export function createDispatchBundle(
 					cacheReadTokenCount: receiptDraft.cacheReadTokenCount ?? 0,
 					cacheWriteTokenCount: receiptDraft.cacheWriteTokenCount ?? 0,
 					reasoningTokenCount: receiptDraft.reasoningTokenCount ?? 0,
-					heartbeatAt: heartbeatIso(acp.heartbeatAt.current),
+					heartbeatAt: heartbeatIso(acp.heartbeatAt),
 				};
 				ledgerRef.update(envelope.id, ledgerPatch);
 				const receipt = ledgerRef.recordReceipt(envelope.id, sealRouteDecision(receiptDraft, routeDecision));
@@ -4202,7 +4337,7 @@ export function createDispatchBundle(
 					"dispatch: writeRoots cannot be enforced on an ACP delegation target; the external agent runs its own tool surface. Dispatch to a native or claude-sdk worker.",
 				);
 			}
-			rebindReservationSlot(req, "local", UNKNOWN_PRICING_ADMISSION_ESTIMATE_USD, settings);
+			rebindReservationSlot(req, "local", null, UNKNOWN_PRICING_ADMISSION_ESTIMATE_USD, settings);
 			routeObservation = observeShadowRoute(req, undefined, settings);
 			return attachRouteObservation({
 				...(await dispatchAcpDelegation(req, settings, timing, routeObservation.decision, observer)),
@@ -4236,10 +4371,12 @@ export function createDispatchBundle(
 			model: lifecycle.target.wireModelId,
 			node: placement?.node?.id ?? "local",
 		};
+		const endpoint = endpointCapacityForTarget(lifecycle.target.target.id);
 		assertRouteWithinApprovedEnvelope(req, effectiveRoute);
 		rebindReservationSlot(
 			req,
 			effectiveRoute.node,
+			endpoint,
 			conservativeRouteAdmissionEstimateUsd(lifecycle.target.effectivePricing, admissionMaxOutputTokens(settings)),
 			settings,
 		);
@@ -4258,7 +4395,7 @@ export function createDispatchBundle(
 			shadow: () => observeShadowRoute(req, placed, settings),
 		});
 
-		const capacityLease = await admitAssignmentCapacity(req, placement?.node.id ?? "local", timing);
+		const capacityLease = await admitAssignmentCapacity(req, placement?.node.id ?? "local", timing, endpoint);
 		const leaseSlot = createLeaseSlotGuard(capacityAdmission, capacityLease.leaseId, req.lineage !== undefined);
 
 		const ledgerRef = (() => {
@@ -4276,6 +4413,7 @@ export function createDispatchBundle(
 		const spec = buildDispatchWorkerSpec(
 			{
 				req,
+				pathScope: lifecycle.pathScope,
 				target: lifecycle.target,
 				admission: lifecycle.admission,
 				recipe: lifecycle.recipe,
@@ -4326,6 +4464,8 @@ export function createDispatchBundle(
 		try {
 			worker = (placement?.spawn ?? spawnWorker)(spec, {
 				cwd: lifecycle.cwd,
+				now,
+				monotonicNow,
 				...(agentLedgerId !== null ? { onLedgerPost } : {}),
 			});
 		} catch (error) {
@@ -4382,10 +4522,21 @@ export function createDispatchBundle(
 		const upstreamResponses: RunReceiptUpstreamResponse[] = [];
 		const skillActivations: SkillActivation[] = [];
 		const finishContractEntries: unknown[] = [];
+		let runIdForPermissionAudit: string | null = null;
 		// The worker's own tool calls, folded into what this run changed and what
 		// it validated. The sealed mutation-report contract is measured against
 		// this, so a reported path the run never touched cannot seal as fact.
-		const runEffects = createRunEffectsRecorder(lifecycle.cwd);
+		const runEffects = createRunEffectsRecorder(lifecycle.cwd, {
+			onWriteRecordDowngraded(downgrade) {
+				const runId = runIdForPermissionAudit;
+				if (runId === null) return;
+				context.bus.emit(BusChannels.DispatchProgress, {
+					runId,
+					agentId: req.agentId,
+					event: { type: "clio_write_record_downgraded", payload: downgrade },
+				});
+			},
+		});
 		let finishContractAssistantText = "";
 		let finishContractAssistantTurnId: string | null = null;
 		let failureMessage: string | undefined;
@@ -4395,7 +4546,6 @@ export function createDispatchBundle(
 		const acceptsOutcomeCodeEvents =
 			lifecycle.runtimeKind === "http" ||
 			(lifecycle.runtimeKind === "sdk" && lifecycle.target.runtime.id === "claude-sdk");
-		let runIdForPermissionAudit: string | null = null;
 		let workerPolicyPermissionCounter = 0;
 		const outputCapture = createWorkerOutputCapture();
 		const markObservedPhase = (field: "firstModelTokenAt" | "firstToolAt"): void => {
@@ -4678,7 +4828,7 @@ export function createDispatchBundle(
 				...(req.council !== undefined ? { council: req.council } : {}),
 				...(req.plan !== undefined ? { plan: req.plan } : {}),
 				...(lifecycle.personaOverride ? { personaOverride: lifecycle.personaOverride } : {}),
-				...(heartbeatAt ? { heartbeatAt: heartbeatIso(heartbeatAt.current) } : {}),
+				...(heartbeatAt ? { heartbeatAt: heartbeatIso(heartbeatAt) } : {}),
 			});
 			observer?.onAdmitted({
 				runId: envelope.id,
@@ -4694,6 +4844,7 @@ export function createDispatchBundle(
 			// per-worker meter. All optional so consumers degrade to local/plain.
 			const fleetIdentity = {
 				budget: lifecycle.budgetEnvelope,
+				...(endpoint !== null ? { endpoint: { key: endpoint.key, label: endpoint.label, limit: endpoint.limit } } : {}),
 				...(placement !== undefined && placement !== null ? { node: placement.node.id } : {}),
 				...(req.gate !== undefined ? { gate: { role: req.gate.role, cycle: req.gate.cycle } } : {}),
 				...(req.council !== undefined ? { council: req.council } : {}),
@@ -4893,6 +5044,7 @@ export function createDispatchBundle(
 				outcomeCode,
 				lineage,
 				...(req.intent !== undefined ? { intent: structuredClone(req.intent) } : {}),
+				pathScope: structuredClone(lifecycle.pathScope.provenance),
 				identity,
 				node: placement?.node ?? LOCAL_RUN_NODE,
 				...receiptAttestationFields(worker.attestation?.() ?? null),
@@ -5269,13 +5421,51 @@ export function createDispatchBundle(
 					...(receiptDraft.cacheWriteTokenCount !== undefined
 						? { cacheWriteTokenCount: receiptDraft.cacheWriteTokenCount }
 						: {}),
-					...(activeRun.heartbeatAt ? { heartbeatAt: heartbeatIso(activeRun.heartbeatAt.current) } : {}),
+					...(activeRun.heartbeatAt ? { heartbeatAt: heartbeatIso(activeRun.heartbeatAt) } : {}),
 				};
 				if (receiptDraft.reasoningTokenCount !== undefined) {
 					ledgerPatch.reasoningTokenCount = receiptDraft.reasoningTokenCount;
 				}
 				ledgerRef.update(envelope.id, ledgerPatch);
 				const receipt = ledgerRef.recordReceipt(envelope.id, sealRouteDecision(receiptDraft, routeObservation.decision));
+				// Two independent ways a run's write record can fail to be a closed
+				// list, and either one files it as `null` rather than as an empty
+				// one. The difference decides whether the write boundary may clear a
+				// path it did not see this run touch.
+				//
+				// The telemetry axis is whether the events were seen at all: a
+				// subprocess runtime publishes no tool events, and a partial trail
+				// has its holes exactly where an unobserved write would sit.
+				//
+				// The opacity axis is whether the events that were seen say enough.
+				// A run that called bash, verify, dispatch, or steer to a clean exit
+				// could have written through a channel no argument names, so nothing
+				// in the checkout can be cleared on the strength of its absence from
+				// the set. That run's window keeps today's blame-the-whole-diff
+				// behaviour; a run that never touched such a tool keeps the
+				// protection.
+				const toolTelemetryComplete = receipt.safety?.toolTelemetry?.coverage === "complete";
+				const downgrades: WriteBoundaryAttributionDowngrade[] = observedRunEffects.writeRecordDowngrades.map((entry) => ({
+					reason: entry.reason,
+					tool: entry.tool,
+					toolCallId: entry.toolCallId,
+					runId: envelope.id,
+					stepId: null,
+				}));
+				if (!toolTelemetryComplete) {
+					downgrades.push({
+						reason: "incomplete_tool_telemetry",
+						tool: null,
+						toolCallId: null,
+						runId: envelope.id,
+						stepId: null,
+					});
+				}
+				recordRunWriteAttribution(envelope.id, {
+					recorded: [...observedRunEffects.mutatedPaths],
+					complete: toolTelemetryComplete && observedRunEffects.writeRecordComplete,
+					downgrades,
+				});
 				await ledgerRef.persist();
 				if (worktreeReceipt?.applied === true && req.taskWorktree !== undefined) {
 					try {
@@ -5510,10 +5700,11 @@ export function createDispatchBundle(
 				`dispatch: agent '${req.agentId}' is a ${agentSpec.audience} agent reserved for Clio internal orchestration`,
 			);
 		}
-		if (hasPersonaOverride(req) && (agentSpec.audience === "shadow" || agentSpec.audience === "internal")) {
+		if (hasCallerPersonaOverride(req) && (agentSpec.audience === "shadow" || agentSpec.audience === "internal")) {
 			throw new Error(`dispatch: persona overrides are not allowed for ${agentSpec.audience} agent '${req.agentId}'`);
 		}
-		const admission = resolveDispatchAdmissionStage(req, recipe, safety);
+		const pathScope = resolveDispatchPathScope(req);
+		const admission = resolveDispatchAdmissionStage(req, recipe, safety, pathScope);
 		const targets = readWorkerTargets(settings);
 		const target = resolveDispatchTarget(
 			req,
@@ -5526,14 +5717,14 @@ export function createDispatchBundle(
 		);
 		enforceCapabilityGate(target.target.id, target.modelCapabilities, req.requiredCapabilities);
 		const effectiveTools = withLedgerToolNarrowing(
-			effectiveToolNames(admission.allowedTools, target, writeConfinedRequest(req), deniedToolNames(req)),
+			effectiveToolNames(admission.allowedTools, target, pathScope.writeBoundaries.length > 0, deniedToolNames(req)),
 			req,
 		);
 		assertPostRuntimeToolCompatibility(req.agentId, agentSpec, effectiveTools, target);
 		assertRuntimeCanHonorWorkerPermissionMode(target.runtime, settings?.workers.onPermission ?? "deny");
 		assertWorkerBudgetEnforceable(target.runtime, agentSpec.budget !== null || req.budget !== undefined);
 		assertResponseSchemaEnforceable(target.runtime, target.modelCapabilities, req.responseSchema, effectiveTools.length);
-		assertWriteRootsEnforceable(target.runtime, req.writeRoots);
+		assertWriteRootsEnforceable(target.runtime, pathScope.writeBoundaries);
 		assertProtectedArtifactsEnforceable(
 			target.runtime.id,
 			target.runtime.kind !== "subprocess",
@@ -5546,12 +5737,14 @@ export function createDispatchBundle(
 			allowedTools: effectiveTools,
 			settings,
 		});
+		const endpoint = endpointCapacityForTarget(target.target.id);
 		return {
 			agentId: req.agentId,
 			specFingerprint: agentSpecFingerprint(agentSpec),
 			targetId: target.target.id,
 			wireModelId: target.wireModelId,
 			runtimeId: target.runtime.id,
+			...(endpoint !== null ? { endpoint: { key: endpoint.key, label: endpoint.label, limit: endpoint.limit } } : {}),
 			node: previewNode(req).node,
 			thinkingLevel: target.thinkingLevel,
 			toolSignature: toolSignature(effectiveTools),
@@ -5833,7 +6026,7 @@ export function createDispatchBundle(
 	async function sealCouncilSynthesis(input: {
 		group: string;
 		round: number;
-		kind: "none" | "vote";
+		kind: "none" | "vote" | "judge";
 		text: string;
 		subjects: ReadonlyArray<{ runId: string; digest: string | null }>;
 		template: RunReceipt;
@@ -5991,6 +6184,7 @@ export function createDispatchBundle(
 				const reconciledLedger = ledger;
 				const reconciled = await reconcileOrphanAssignments({
 					listRunning: () => listStoredAssignments().filter((record) => record.status === "running"),
+					ownerAlive: assignmentProcessOwnerAlive,
 					lookupAttempt: (runId) => {
 						const envelope = reconciledLedger?.get(runId) ?? null;
 						if (!envelope) return null;
@@ -6000,7 +6194,8 @@ export function createDispatchBundle(
 							succeeded: envelope.outcome === "succeeded",
 						};
 					},
-					settle: (assignmentId, terminalRunId, status) => settleStoredAssignment(assignmentId, terminalRunId, status),
+					settle: (assignmentId, terminalRunId, status, owner) =>
+						settleStoredAssignment(assignmentId, terminalRunId, status, owner),
 				});
 				if ((reconciled.recovered > 0 || reconciled.abandoned > 0) && process.env.CLIO_CODER_INTERACTIVE !== "1") {
 					process.stderr.write(
@@ -6049,19 +6244,21 @@ export function createDispatchBundle(
 	 */
 	function snapshot(): DispatchSnapshot {
 		const tickNow = now();
+		const tickMonotonic = monotonicNow();
 		const running: DispatchSnapshot["running"] = [];
 		const totals = { ...finalizedTotals };
 		const costAmounts = [...finalizedCosts];
 		for (const run of active.values()) {
 			let heartbeat: "alive" | "stale" | "dead" | "n/a" = "n/a";
-			if (run.heartbeatAt && Number.isFinite(run.heartbeatAt.current)) {
+			if (run.heartbeatAt && Number.isFinite(heartbeatMonotonicAt(run.heartbeatAt))) {
+				const heartbeatMonotonic = heartbeatMonotonicAt(run.heartbeatAt);
 				if (run.runtimeKind === "acp-delegation") {
 					const stallMs = run.stallTimeoutMs;
 					if (stallMs !== null && stallMs > 0) {
-						heartbeat = tickNow - run.heartbeatAt.current > stallMs ? "dead" : "alive";
+						heartbeat = tickMonotonic - heartbeatMonotonic > stallMs ? "dead" : "alive";
 					}
 				} else {
-					heartbeat = classifyHeartbeat(run.heartbeatAt.current, tickNow, heartbeatSpec);
+					heartbeat = classifyHeartbeat(heartbeatMonotonic, tickMonotonic, heartbeatSpec);
 				}
 			}
 			const meter = run.meter;
@@ -6187,6 +6384,7 @@ export function createDispatchBundle(
 		routeCandidates,
 		reservations: {
 			prepare: prepareReservation,
+			release: (ownerId) => releaseDispatchReservation(ownerId, now()),
 			rollback: (ownerId) => rollbackDispatchReservation(ownerId, now()),
 			rollbackUnconsumed: (ownerId) => rollbackUnconsumedDispatchReservation(ownerId, now()),
 			get: getDispatchReservation,
@@ -6204,6 +6402,21 @@ export function createDispatchBundle(
 			if (!ledger) return null;
 			return ledger.get(runId);
 		},
+		observedRunWrites(runId) {
+			// A run this process never finalized, or finalized long enough ago to
+			// have been evicted, is unknown rather than silent, so both answer null.
+			const attribution = runWriteAttributions.get(runId);
+			return attribution?.complete === true ? [...attribution.recorded] : null;
+		},
+		observedRunWriteAttribution(runId) {
+			const attribution = runWriteAttributions.get(runId);
+			if (attribution === undefined) return null;
+			return {
+				recorded: [...attribution.recorded],
+				complete: attribution.complete,
+				downgrades: attribution.downgrades?.map((entry) => ({ ...entry })) ?? [],
+			};
+		},
 		assignments: {
 			get: (id) => assignments.get(id),
 			getStored: (id) => getStoredAssignment(id),