@iowarp/clio-coder 0.4.1 → 0.4.3

package/src/domains/dispatch/extension.ts

@@ -16,6 +16,7 @@ import { performance } from "node:perf_hooks";
 import { BusChannels, type DispatchCompletedPayload, type DispatchRunIdentity } from "../../core/bus-events.js";
 import { DEFAULT_SETTINGS, type DelegationToolGovernance } from "../../core/defaults.js";
 import type { DomainBundle, DomainContext, DomainExtension } from "../../core/domain-loader.js";
+import { gatewayRoutingObservationFromRecord } from "../../core/gateway-routing.js";
 import { GUARDRAIL_DEFAULTS } from "../../core/guardrails.js";
 import { readClioVersion, readPiMonoVersion } from "../../core/package-root.js";
 import { canonicalizeExistingPath } from "../../core/path-canonical.js";
@@ -77,6 +78,7 @@ import type { PromptsContract } from "../prompts/contract.js";
 import { type EffectivePricing, resolveEffectivePricing } from "../providers/catalog.js";
 import {
 	type CapabilityFlags,
+	canonicalEndpointKey,
 	canonicalizeWireModelId,
 	type EndpointCapacity,
 	endpointCapacityFor,
@@ -157,6 +159,7 @@ import type {
 	DispatchAdmissionObserver,
 	DispatchContract,
 	DispatchPlanTaskResolution,
+	DispatchPreparationOptions,
 	DispatchRequest,
 	DispatchSnapshot,
 } from "./contract.js";
@@ -181,7 +184,12 @@ import {
 	type HeartbeatStatus,
 	heartbeatMonotonicAt,
 } from "./heartbeat.js";
-import { hostVerificationRejection, runHostVerification } from "./host-verification.js";
+import {
+	type BatchVerificationGate,
+	createBatchVerificationGate,
+	hostVerificationRejection,
+	runHostVerification,
+} from "./host-verification.js";
 import { renderDispatchIntentRequirements } from "./intent-requirements.js";
 import { adaptJointRouteInput } from "./joint-route-adapter.js";
 import {
@@ -201,6 +209,8 @@ import {
 	type DispatchPathScope,
 	declaredScopeReplacementDiagnostic,
 	declaredScopeReplacementNotice,
+	inferredScopeParentTokenDiagnostic,
+	inferredScopeParentTokenNotice,
 	resolveDispatchPathScope,
 } from "./path-scope.js";
 import { deriveEnvelopePhaseDurations, deriveRunPhaseDurations, recordRunTimingBestEffort } from "./phase-timing.js";
@@ -289,6 +299,7 @@ import {
 	validateJobSpec,
 } from "./validation.js";
 import { describeUngroundedValidations, groundClaimedValidations, invalidatesQuality } from "./validation-grounding.js";
+import { prepareWorkerModelMetadata } from "./worker-model-metadata.js";
 import {
 	type AgentLedgerBody,
 	computeSettingsFingerprint,
@@ -1431,6 +1442,13 @@ function runtimeLimitations(runtimeKind: RunKind, runtimeId: string): string[] {
 			"Claude CLI subprocess executes Claude Code tools; Clio constrains permission mode and forbids dangerous bypass unless explicitly gated",
 		];
 	}
+	if (runtimeKind === "subprocess" && runtimeId === "antigravity-code") {
+		return [
+			"Antigravity CLI owns its internal tools, network activity, prompts, and approvals; Clio observes only structured stream output and does not provide per-tool mediation or complete tool telemetry",
+			"Antigravity conversation ids are recorded only as opaque provider observations; Clio does not resume them",
+			"Antigravity runs are one-shot and never retried automatically",
+		];
+	}
 	// HTTP/native runtimes run through pi-agent-core, which Clio observes and
 	// controls directly, so there are no runtime-imposed dispatch limitations.
 	return [];
@@ -1471,13 +1489,6 @@ function assertWriteRootsEnforceable(runtime: RuntimeDescriptor, writeRoots: Rea
 	);
 }
 
-function assertWorkerBudgetEnforceable(runtime: RuntimeDescriptor, hasDeclaredBudget: boolean): void {
-	if (!hasDeclaredBudget || runtime.kind !== "subprocess") return;
-	throw new Error(
-		`dispatch: runtime '${runtime.id}' cannot enforce an explicit dispatch budget because subprocess workers do not expose per-tool mediation; choose a native or claude-sdk worker`,
-	);
-}
-
 /**
  * API families whose wire protocol carries tool calls. Membership is a property
  * of the protocol, not of any one model: every server speaking one of these can
@@ -1603,11 +1614,30 @@ function assertPostRuntimeToolCompatibility(
 }
 
 function workerToolCallHardCap(settings: EffectiveSettings): number {
-	const rawEnvCap = process.env.CLIO_CODER_WORKER_TOOL_CALL_CAP?.trim();
-	const parsedEnvCap = rawEnvCap && /^[1-9]\d*$/.test(rawEnvCap) ? Number(rawEnvCap) : Number.NaN;
-	return Number.isSafeInteger(parsedEnvCap)
-		? parsedEnvCap
-		: (settings?.fleet.limits.toolCallsPerRun ?? GUARDRAIL_DEFAULTS.workerToolCallCap);
+	return settings?.fleet.limits.toolCallsPerRun ?? GUARDRAIL_DEFAULTS.workerToolCallCap;
+}
+
+/**
+ * Only a runtime that declares its external agent loop may accept a declared
+ * per-tool budget: Clio records that budget as unobserved rather than enforced.
+ * Any other subprocess runtime cannot mediate tool calls, so a declared budget
+ * would be a claim nobody enforces.
+ */
+export function assertWorkerBudgetEnforceable(
+	runtime: Pick<RuntimeDescriptor, "id" | "kind" | "externalAgentLoop">,
+	hasDeclaredBudget: boolean,
+): void {
+	if (!hasDeclaredBudget || runtime.kind !== "subprocess" || runtime.externalAgentLoop !== undefined) return;
+	throw new Error(
+		`dispatch: runtime '${runtime.id}' cannot enforce an explicit dispatch budget because subprocess workers do not expose per-tool mediation; choose a native or claude-sdk worker`,
+	);
+}
+
+/** Per-tool budget enforcement is real only where Clio observes each tool call. */
+export function budgetEnforcementForRuntime(
+	runtime: Pick<RuntimeDescriptor, "kind">,
+): "native-per-tool" | "external-one-shot" {
+	return runtime.kind === "subprocess" ? "external-one-shot" : "native-per-tool";
 }
 
 function resolveEffectiveWorkerBudget(input: {
@@ -1616,7 +1646,9 @@ function resolveEffectiveWorkerBudget(input: {
 	declared: ReturnType<typeof normalizeAgentSpec>["budget"];
 	allowedTools: ReadonlyArray<ToolName>;
 	settings: EffectiveSettings;
+	runtime: RuntimeDescriptor;
 }): RunToolBudgetEnvelope {
+	assertWorkerBudgetEnforceable(input.runtime, input.declared !== null || input.req.budget !== undefined);
 	const hardCap = workerToolCallHardCap(input.settings);
 	const declared = input.declared ?? {
 		toolCalls: hardCap,
@@ -1631,6 +1663,7 @@ function resolveEffectiveWorkerBudget(input: {
 		hasReadTool: input.allowedTools.includes(ToolNames.Read),
 		retry: (input.req.lineage?.attempt ?? 0) > 0,
 		revision: input.req.gate?.role === "builder" && input.req.gate.cycle > 1 && input.req.gate.verdict === "revise",
+		enforcement: budgetEnforcementForRuntime(input.runtime),
 	});
 }
 
@@ -1971,6 +2004,15 @@ function clampWorkerAutonomy(session: AutonomyLevel, requested: AutonomyLevel |
 	return AUTONOMY_ORDER[requested] < AUTONOMY_ORDER[session] ? requested : session;
 }
 
+/** Read-only recipes are an authority boundary, including on opaque external loops. */
+export function effectiveWorkerAutonomy(
+	session: AutonomyLevel,
+	requested: AutonomyLevel | undefined,
+	capabilityClass: AgentCapabilityClass,
+): AutonomyLevel {
+	return clampWorkerAutonomy(session, capabilityClass === "read-only" ? "read-only" : requested);
+}
+
 function requestedAutonomyEvidence(
 	sessionAutonomy: AutonomyLevel,
 	requestedAutonomy: AutonomyLevel | undefined,
@@ -2500,6 +2542,29 @@ export function createDispatchBundle(
 		return Object.fromEntries(Object.entries(configuredEndpointCapacities()).map(([key, value]) => [key, value.limit]));
 	}
 
+	/**
+	 * Endpoints still bound by the blind one-slot default have never been
+	 * probed by any process, or their record expired. A fresh home carried that
+	 * bound into its first batch and refused two tasks on a server running
+	 * four, until the operator happened to run `targets --probe`. Probe each
+	 * such endpoint once per process, in the background and without the
+	 * inference-based reasoning check: the slot count is a header read, and the
+	 * model's first dispatch call is seconds away at the earliest. The probe
+	 * lands in the provider statuses and the durable slot store, which is where
+	 * admission already looks.
+	 */
+	const probedDefaultBoundEndpoints = new Set<string>();
+	function probeEndpointsAtDefaultBound(): void {
+		const capacities = configuredEndpointCapacities();
+		for (const target of getEffectiveSettings()?.targets ?? []) {
+			const key = canonicalEndpointKey(target);
+			if (key === null || capacities[key]?.source !== "local-native-default") continue;
+			if (probedDefaultBoundEndpoints.has(key)) continue;
+			probedDefaultBoundEndpoints.add(key);
+			void providers.probeTarget(target.id, { reasoning: false }).catch(() => undefined);
+		}
+	}
+
 	function endpointCapacityForTarget(targetId: string): EndpointCapacity | null {
 		const status = providers.list().find((entry) => entry.target.id === targetId);
 		const target = status?.target ?? providers.getTarget(targetId);
@@ -2635,6 +2700,7 @@ export function createDispatchBundle(
 		nodeId: string,
 		timing: RunPhaseMarks,
 		endpoint?: EndpointCapacity | null,
+		signal?: AbortSignal,
 	) {
 		const queuedAt = now();
 		timing.queuedAt = new Date(queuedAt).toISOString();
@@ -2650,7 +2716,12 @@ export function createDispatchBundle(
 				: planQueueSlot(req.reservation.ownerId, req.reservation.memberId, (error) =>
 						reportDispatchDiagnostic("read plan queue identity", error),
 					);
+		const cancel = (): void => {
+			capacityAdmission.cancel(assignmentId);
+		};
+		signal?.addEventListener("abort", cancel, { once: true });
 		try {
+			signal?.throwIfAborted();
 			const admitted = await capacityAdmission.admit({
 				assignmentId,
 				nodeId,
@@ -2673,6 +2744,8 @@ export function createDispatchBundle(
 				else await failQueuedAssignment(assignmentId);
 			}
 			throw error;
+		} finally {
+			signal?.removeEventListener("abort", cancel);
 		}
 	}
 
@@ -2822,6 +2895,14 @@ export function createDispatchBundle(
 		if (draining) return { scheduled: false };
 		const rootRunId = run.lineage.rootRunId;
 		if (!retryChainIsLive(run)) return { scheduled: false };
+		if (providers.getRuntime(run.runtimeId)?.externalAgentLoop?.generatingRetry === "forbidden") {
+			retryBackoff.delete(rootRunId);
+			return {
+				scheduled: false,
+				settlementDetail:
+					"automatic retry suppressed because this external agent loop is one-shot and Clio cannot prove replay is side-effect-free",
+			};
+		}
 		if (!RETRYABLE_OUTCOMES.has(outcome)) {
 			retryBackoff.delete(rootRunId);
 			return { scheduled: false };
@@ -3197,6 +3278,9 @@ export function createDispatchBundle(
 		const tickMonotonic = monotonicNow();
 		for (const run of active.values()) {
 			if (run.aborted || run.stallKilled || !run.heartbeatAt) continue;
+			// Finalizers retain active entries while awaiting ledger persistence.
+			// Their terminal status is already sealed into the receipt digest.
+			if (ledger.get(run.runId)?.endedAt !== null) continue;
 			const heartbeatMonotonic = heartbeatMonotonicAt(run.heartbeatAt);
 			if (!Number.isFinite(heartbeatMonotonic) || !Number.isFinite(run.heartbeatAt.current)) continue;
 			if (run.runtimeKind === "acp-delegation") {
@@ -3369,9 +3453,31 @@ export function createDispatchBundle(
 				agentId: req.agentId,
 			});
 		}
+		// A reinterpreted "../" token is the one legacy-mode scope fact that earns
+		// the channel: it fires only where the dispatch used to fail outright, so
+		// it cannot warn on the ordinary intent-less dispatch the comment above
+		// keeps quiet. Anchoring is reported alongside dropping because it is the
+		// half that adds to scope, putting a path in working context that the
+		// prose never literally spelled.
+		const parentTokenDiagnostic = inferredScopeParentTokenDiagnostic(pathScope);
+		if (parentTokenDiagnostic !== null) {
+			reportDispatchDiagnostic("inferred scope parent tokens", new Error(parentTokenDiagnostic));
+		}
+		const parentTokenNotice = inferredScopeParentTokenNotice(pathScope);
+		if (parentTokenNotice !== null) {
+			context.bus.emit(BusChannels.DispatchScopeNotice, {
+				...parentTokenNotice,
+				agentId: req.agentId,
+			});
+		}
 	}
 
-	async function resolveLifecycle(req: DispatchRequest, settings: EffectiveSettings): Promise<DispatchLifecycleStage> {
+	async function resolveLifecycle(
+		req: DispatchRequest,
+		settings: EffectiveSettings,
+		metadataDeadlineAt: number,
+		signal?: AbortSignal,
+	): Promise<DispatchLifecycleStage> {
 		const recipe = agents.get(req.agentId);
 		if (!recipe) {
 			throw new Error(`dispatch: unknown agent recipe: ${req.agentId}`);
@@ -3402,28 +3508,42 @@ export function createDispatchBundle(
 						autoSelected: req.agentSelection?.mode === "auto",
 						resultContractKind: spec.resultContract.kind,
 						specs: agents.listSpecs(),
+						intent: req.intent ?? null,
 					});
 		if (capabilityMismatch?.verdict === "refuse") throw new Error(capabilityMismatch.detail);
 		const pathScope = resolveDispatchPathScope(req);
 		publishDispatchPathScope(req, pathScope);
 		const admission = resolveDispatchAdmissionStage(req, recipe, safety, pathScope);
 		const targets = readWorkerTargets(settings);
-		const target = resolveDispatchTarget(
-			req,
-			recipe,
-			targets.workerDefault,
-			targets.workerProfiles,
-			targets.agentBindings,
-			targets.targetOrder,
-			providers,
-		);
+		const resolveTarget = () =>
+			resolveDispatchTarget(
+				req,
+				recipe,
+				targets.workerDefault,
+				targets.workerProfiles,
+				targets.agentBindings,
+				targets.targetOrder,
+				providers,
+			);
+		let target = resolveTarget();
+		const identity = (resolved: ResolvedTarget): string =>
+			JSON.stringify([
+				resolved.target.id,
+				resolved.runtime.id,
+				resolved.wireModelId,
+				endpointIdentityHash(resolved.target.url),
+			]);
+		const selectedIdentity = identity(target);
+		await prepareWorkerModelMetadata(providers, target.target.id, metadataDeadlineAt, signal, now);
+		target = resolveTarget();
+		if (identity(target) !== selectedIdentity) {
+			throw new Error("dispatch: worker route changed during model metadata preparation; request a fresh admission");
+		}
 		enforceCapabilityGate(target.target.id, target.modelCapabilities, req.requiredCapabilities);
 		assertRuntimeCanHonorWorkerPermissionMode(target.runtime, settings?.fleet.permissions.mode ?? "deny");
-		assertWorkerBudgetEnforceable(target.runtime, spec.budget !== null || req.budget !== undefined);
-
 		const cwd = req.cwd ?? process.cwd();
 		const sessionAutonomy = settings?.safety.autonomy ?? "auto-edit";
-		const effectiveAutonomy = clampWorkerAutonomy(sessionAutonomy, req.autonomy);
+		const effectiveAutonomy = effectiveWorkerAutonomy(sessionAutonomy, req.autonomy, spec.capabilityClass);
 		const effectiveTools = withLedgerToolNarrowing(
 			effectiveToolNames(admission.allowedTools, target, pathScope.writeBoundaries.length > 0, deniedToolNames(req)),
 			req,
@@ -3434,17 +3554,16 @@ export function createDispatchBundle(
 			allowedTools: effectiveTools,
 		};
 		const personaBody = workerPersonaBody(req, recipe, effectiveTools);
+		const hasCanonicalContext = effectiveTools.includes(ToolNames.Context);
+		const hasBoundSkills =
+			hasCanonicalContext && recipe.skills !== undefined && recipe.skills.length > 0 && req.noSkills !== true;
 		const compiledWorkerPrompt = await prompts.compileWorkerPrompt({
 			autonomy: effectiveAutonomy,
 			providerSupportsTools: target.runtime.kind === "subprocess" ? null : targetToolCapability(target),
 			toolNames: effectiveTools,
-			toolPromptHints: toolPromptHintsForNames(effectiveTools),
-			hasCanonicalContext: effectiveTools.includes(ToolNames.Context),
-			hasBoundSkills:
-				effectiveTools.includes(ToolNames.Context) &&
-				recipe.skills !== undefined &&
-				recipe.skills.length > 0 &&
-				req.noSkills !== true,
+			toolPromptHints: toolPromptHintsForNames(effectiveTools, hasBoundSkills ? "bound-worker" : "worker"),
+			hasCanonicalContext,
+			hasBoundSkills,
 			onPermission: settings?.fleet.permissions.mode ?? "deny",
 			persona: {
 				id: `persona.${recipe.id}`,
@@ -3463,6 +3582,7 @@ export function createDispatchBundle(
 			declared: spec.budget,
 			allowedTools: effectiveTools,
 			settings,
+			runtime: target.runtime,
 		});
 		// Fetch structured project context only for tiers that receive it, so
 		// read-only scouts never pay the CLIO-CODER.md read. The tier is spec policy
@@ -3783,11 +3903,13 @@ export function createDispatchBundle(
 				const responseModelIdObservation = responseModelIdObservationFromRecord(event.message, "not-observed");
 				const differingResponseModelId = readStringOrNull(event.message.responseModel);
 				const providerResponseId = readStringOrNull(event.message.responseId);
+				const gatewayRouting = gatewayRoutingObservationFromRecord(event.message);
 				upstreamResponses.push({
 					requestedModelId,
 					responseModelIdObservation,
 					differingResponseModelId,
 					providerResponseId,
+					...(gatewayRouting !== null ? { gatewayRouting } : {}),
 				});
 				if (event.message.stopReason === "error") {
 					const message = readStringOrNull(event.message.errorMessage);
@@ -4345,6 +4467,8 @@ export function createDispatchBundle(
 	async function dispatchAttempt(
 		req: DispatchRequest,
 		observer?: DispatchAdmissionObserver,
+		preparation?: DispatchPreparationOptions,
+		settlement?: BatchVerificationGate,
 	): Promise<{
 		runId: string;
 		events: AsyncIterableIterator<unknown>;
@@ -4440,14 +4564,19 @@ export function createDispatchBundle(
 			}
 			rebindReservationSlot(req, "local", null, UNKNOWN_PRICING_ADMISSION_ESTIMATE_USD, settings);
 			routeObservation = observeShadowRoute(req, undefined, settings);
-			return attachRouteObservation({
-				...(await dispatchAcpDelegation(req, settings, timing, routeObservation.decision, observer)),
-				effectiveRequest: req,
-			});
+			const delegated = await dispatchAcpDelegation(req, settings, timing, routeObservation.decision, observer);
+			// An ACP member never runs host verification, so it can only ever leave
+			// the barrier. It still edits the checkout, so the barrier has to wait
+			// for it; dispatch() releases it when its finalPromise settles.
+			settlement?.live(delegated.runId);
+			return attachRouteObservation({ ...delegated, effectiveRequest: req });
 		}
 
 		req = routeAroundCoolingTarget(req, settings) ?? req;
-		const lifecycle = await resolveLifecycle(req, settings);
+		const metadataDeadlineAt =
+			req.assignmentDeadlineAt ?? Date.parse(requestedAt) + (req.routingIntent?.deadlineMs ?? 60_000);
+		const lifecycle = await resolveLifecycle(req, settings, metadataDeadlineAt, preparation?.signal);
+		preparation?.signal?.throwIfAborted();
 		timing.decisionCompletedAt = new Date(now()).toISOString();
 		assertResponseSchemaEnforceable(
 			lifecycle.target.runtime,
@@ -4524,7 +4653,13 @@ export function createDispatchBundle(
 		if (queuedIdentity !== null) publishCapacityQueued(queuedIdentity, timing, placement?.node ?? null);
 		let capacityLease: Awaited<ReturnType<typeof admitAssignmentCapacity>>;
 		try {
-			capacityLease = await admitAssignmentCapacity(req, placement?.node.id ?? "local", timing, endpoint);
+			capacityLease = await admitAssignmentCapacity(
+				req,
+				placement?.node.id ?? "local",
+				timing,
+				endpoint,
+				preparation?.signal,
+			);
 		} catch (error) {
 			if (queuedIdentity !== null) publishCapacityAdmissionFailure(queuedIdentity, error);
 			throw error;
@@ -4535,6 +4670,7 @@ export function createDispatchBundle(
 
 		const ledgerRef = (() => {
 			try {
+				preparation?.signal?.throwIfAborted();
 				return requireLedger();
 			} catch (error) {
 				leaseSlot.release();
@@ -4597,6 +4733,7 @@ export function createDispatchBundle(
 		};
 		let worker: SpawnedWorker;
 		try {
+			preparation?.signal?.throwIfAborted();
 			worker = (placement?.spawn ?? spawnWorker)(spec, {
 				cwd: lifecycle.cwd,
 				now,
@@ -4818,11 +4955,13 @@ export function createDispatchBundle(
 				const responseModelIdObservation = responseModelIdObservationFromRecord(event.message, "not-observed");
 				const differingResponseModelId = readStringOrNull(event.message.responseModel);
 				const providerResponseId = readStringOrNull(event.message.responseId);
+				const gatewayRouting = gatewayRoutingObservationFromRecord(event.message);
 				upstreamResponses.push({
 					requestedModelId,
 					responseModelIdObservation,
 					differingResponseModelId,
 					providerResponseId,
+					...(gatewayRouting !== null ? { gatewayRouting } : {}),
 				});
 				if (event.message.stopReason === "error") {
 					const message = readStringOrNull(event.message.errorMessage);
@@ -5368,6 +5507,14 @@ export function createDispatchBundle(
 			return { assessment, rigor };
 		};
 
+		// The worker is spawned and its ledger row exists, so from here it can
+		// write and the batch barrier has to wait for it. Registered after the
+		// try/catch at 4939-5068, which aborts the worker and releases the lease on
+		// failure, so a run that never reaches the barrier is never made live.
+		// Paired with the abandon in dispatch(), which fires the moment
+		// finalPromise settles.
+		settlement?.live(envelope.id);
+
 		const finalPromise = (async (): Promise<RunReceipt> => {
 			try {
 				const result = await workerDone;
@@ -5438,7 +5585,9 @@ export function createDispatchBundle(
 					reachedTerminalResult: resultContractWasDue(finalOutcome, outcomeCode),
 					output: capturedOutput?.state === "final" ? capturedOutput.text : null,
 					cwd: lifecycle.cwd,
-					networkAllowed: lifecycle.admission.allowedTools.includes(ToolNames.WebFetch),
+					networkAllowed:
+						lifecycle.admission.allowedTools.includes(ToolNames.WebFetch) ||
+						lifecycle.target.runtime.externalAgentLoop?.network === "externally-governed-unobserved",
 					observedRunEffects,
 					filesystem: nodeResultContractFilesystem(),
 				});
@@ -5492,12 +5641,21 @@ export function createDispatchBundle(
 					finalDetail = WORKER_FINAL_OUTPUT_MISSING_DETAIL;
 					failureMessage = finalDetail;
 				}
-				const hostVerification = await runHostVerification({
+				const hostVerificationInput = {
 					runId: envelope.id,
 					request: req,
 					workerSuccessful: finalOutcome === "succeeded",
-					onDiagnostic: (error) => reportDispatchDiagnostic(`write host verification memo for ${envelope.id}`, error),
-				});
+					onDiagnostic: (error: unknown) =>
+						reportDispatchDiagnostic(`write host verification memo for ${envelope.id}`, error),
+				};
+				// This await is the batch barrier. It already sits before
+				// buildReceiptDraft below, which is why batch settlement needs no
+				// receipt restructuring: every member parks here with its outcome
+				// resolved and nothing sealed.
+				const hostVerification =
+					settlement === undefined
+						? await runHostVerification(hostVerificationInput)
+						: await settlement.arrive(hostVerificationInput);
 				const hostRejection = hostVerificationRejection(hostVerification);
 				if (hostRejection !== null && finalOutcome === "succeeded") {
 					finalOutcome = "failed";
@@ -5690,12 +5848,20 @@ export function createDispatchBundle(
 	async function dispatch(
 		req: DispatchRequest,
 		observer?: DispatchAdmissionObserver,
+		preparation?: DispatchPreparationOptions,
+		settlement?: BatchVerificationGate,
 	): Promise<{
 		runId: string;
 		events: AsyncIterableIterator<unknown>;
 		finalPromise: Promise<RunReceipt>;
 	}> {
-		let prepared = req;
+		let prepared =
+			preparation?.deadlineAt === undefined
+				? req
+				: {
+						...req,
+						assignmentDeadlineAt: Math.min(req.assignmentDeadlineAt ?? Number.POSITIVE_INFINITY, preparation.deadlineAt),
+					};
 		let createdWorktree: DispatchRequest["taskWorktree"];
 		let writerLease: CheckoutWriterLease | undefined;
 		const writerRecipe = agents.get(req.agentId);
@@ -5727,7 +5893,7 @@ export function createDispatchBundle(
 				return rel === ".." || rel.startsWith(`..${sep}`) || isAbsolute(rel) ? entry : resolvePath(taskWorktree.path, rel);
 			});
 			prepared = {
-				...req,
+				...prepared,
 				runIdHint: runId,
 				taskWorktree,
 				cwd: workerCwd,
@@ -5737,7 +5903,8 @@ export function createDispatchBundle(
 		}
 		let handle: Awaited<ReturnType<typeof dispatchAttempt>>;
 		try {
-			handle = await dispatchAttempt(prepared, observer);
+			preparation?.signal?.throwIfAborted();
+			handle = await dispatchAttempt(prepared, observer, preparation, settlement);
 		} catch (error) {
 			writerLease?.release();
 			if (createdWorktree !== undefined) {
@@ -5752,6 +5919,14 @@ export function createDispatchBundle(
 			}
 			throw error;
 		}
+		// A finalization that throws before the barrier, and an ACP handle that
+		// never reaches it at all, must not park their siblings forever. A member
+		// that already arrived is parked and abandon() is a no-op for it, so this
+		// fires harmlessly on the normal path.
+		if (settlement !== undefined) {
+			const release = (): void => settlement.abandon(handle.runId);
+			handle.finalPromise.then(release, release);
+		}
 		// Requests carrying lineage are internal attempts (retry or nested
 		// orchestration) and retain the per-attempt handle contract.
 		if (req.lineage) return { ...handle, finalPromise: handle.finalPromise.finally(() => writerLease?.release()) };
@@ -5856,7 +6031,6 @@ export function createDispatchBundle(
 		);
 		assertPostRuntimeToolCompatibility(req.agentId, agentSpec, effectiveTools, target);
 		assertRuntimeCanHonorWorkerPermissionMode(target.runtime, settings?.fleet.permissions.mode ?? "deny");
-		assertWorkerBudgetEnforceable(target.runtime, agentSpec.budget !== null || req.budget !== undefined);
 		assertResponseSchemaEnforceable(target.runtime, target.modelCapabilities, req.responseSchema, effectiveTools.length);
 		assertWriteRootsEnforceable(target.runtime, pathScope.writeBoundaries);
 		assertProtectedArtifactsEnforceable(
@@ -5870,6 +6044,7 @@ export function createDispatchBundle(
 			declared: agentSpec.budget,
 			allowedTools: effectiveTools,
 			settings,
+			runtime: target.runtime,
 		});
 		const endpoint = endpointCapacityForTarget(target.target.id);
 		return {
@@ -6118,17 +6293,29 @@ export function createDispatchBundle(
 		})();
 	}
 
-	async function dispatchBatch(reqs: ReadonlyArray<DispatchRequest>): Promise<{
+	async function dispatchBatch(
+		reqs: ReadonlyArray<DispatchRequest>,
+		preparation?: DispatchPreparationOptions,
+	): Promise<{
 		batchId: string;
 		assignmentIds: ReadonlyArray<string>;
 		events: AsyncIterableIterator<unknown>;
 		finalPromise: Promise<ReadonlyArray<RunReceipt>>;
 	}> {
 		if (reqs.length === 0) throw new Error("dispatch: batch requires at least one request");
+		// Two or more concurrent workers share one checkout, so a declared check
+		// run while a sibling is still editing judges a tree neither worker
+		// authored. The barrier only exists when there is both something to verify
+		// and something that could race it; a one-request batch and a batch with no
+		// declared check keep today's per-run path exactly.
+		const settlement =
+			reqs.length > 1 && reqs.some((req) => (req.resolvedVerification?.length ?? 0) > 0)
+				? createBatchVerificationGate()
+				: undefined;
 		const handles: Array<Awaited<ReturnType<typeof dispatch>> & { agentId: string }> = [];
 		try {
 			for (const req of reqs) {
-				const handle = await dispatch(req);
+				const handle = await dispatch(req, undefined, preparation, settlement);
 				handles.push({ ...handle, agentId: req.agentId });
 			}
 		} catch (err) {
@@ -6347,6 +6534,7 @@ export function createDispatchBundle(
 				// Reconciliation is best-effort; a failure never blocks startup.
 			}
 			startHeartbeatWatchdog();
+			probeEndpointsAtDefaultBound();
 		},
 		async stop() {
 			// Shutdown is process-local. The durable machine-wide drain belongs to