@iowarp/clio-coder 0.4.3 → 0.4.5

package/src/tools/decide.ts

@@ -0,0 +1,136 @@
+import { Type } from "typebox";
+import { ToolNames } from "../core/tool-names.js";
+import type { DecisionBoardStore } from "../domains/session/decision-board.js";
+import { decisionRef } from "../domains/session/entries.js";
+import type { ToolResult, ToolSpec } from "./registry.js";
+import { byteLength } from "./truncate-utf8.js";
+
+/**
+ * The model's own design decisions, recorded on the session decision board
+ * beside the operator's `ask_user` answers. A `decide` call appends one
+ * `decisionLedger` entry with `origin: "agent"` and one `DecisionRecord` with
+ * `source: "agent"`, the alternatives the model rejected, and why. Dispatch
+ * seals every active decision's ref onto the run envelope and receipt, and
+ * the commit seams turn the same refs into `Clio-Decision:` trailers, so a
+ * receipt or a commit names the choices it was made under.
+ */
+
+export const DECIDE_CAPS = Object.freeze({
+	keyBytes: 64,
+	valueBytes: 512,
+	alternatives: 6,
+	alternativeBytes: 256,
+	rationaleBytes: 1024,
+	labelBytes: 128,
+});
+
+const KEBAB_KEY = /^[a-z0-9]+(?:-[a-z0-9]+)*$/u;
+
+export interface DecideToolDeps {
+	decisionBoard?: DecisionBoardStore;
+}
+
+function boundedText(value: unknown, field: string, cap: number): string | Error {
+	if (typeof value !== "string") return new Error(`decide: ${field} must be a string`);
+	const trimmed = value.trim();
+	if (trimmed.length === 0) return new Error(`decide: ${field} is required`);
+	if (byteLength(trimmed) > cap) return new Error(`decide: ${field} exceeds the ${cap}-byte cap`);
+	return trimmed;
+}
+
+function boundedAlternatives(value: unknown): string[] | Error {
+	if (!Array.isArray(value) || value.length === 0) {
+		return new Error("decide: alternatives must list at least one option you rejected");
+	}
+	if (value.length > DECIDE_CAPS.alternatives) {
+		return new Error(`decide: alternatives exceeds the ${DECIDE_CAPS.alternatives}-entry cap`);
+	}
+	const alternatives: string[] = [];
+	for (const [index, entry] of value.entries()) {
+		const text = boundedText(entry, `alternatives[${index}]`, DECIDE_CAPS.alternativeBytes);
+		if (text instanceof Error) return text;
+		alternatives.push(text);
+	}
+	return alternatives;
+}
+
+export function createDecideTool(deps: DecideToolDeps = {}): ToolSpec {
+	return {
+		name: ToolNames.Decide,
+		description:
+			"Record a design decision between viable options, with rejected alternatives and rationale, before implementing. Verify implementation against the active choice before commit; decision trailers do not prove adherence. If policy changes, a call with the same key revises your earlier agent choice; operator choices require operator revision through ask_user. Record the revision before commit.",
+		parameters: Type.Object({
+			key: Type.String({
+				description: `Stable kebab-case name for the decision, e.g. "cache-key-shape" (at most ${DECIDE_CAPS.keyBytes} bytes).`,
+			}),
+			value: Type.String({ description: `The option you chose (at most ${DECIDE_CAPS.valueBytes} bytes).` }),
+			alternatives: Type.Array(Type.String(), {
+				description: `Options you considered and rejected, 1 to ${DECIDE_CAPS.alternatives} entries.`,
+			}),
+			rationale: Type.String({
+				description: `Why the chosen option won over the alternatives (at most ${DECIDE_CAPS.rationaleBytes} bytes).`,
+			}),
+			label: Type.Optional(Type.String({ description: "Short human-readable title for the decision." })),
+		}),
+		// Read class on purpose: the only effect is one session-ledger append,
+		// so it must stay available at every autonomy level without a prompt.
+		baseActionClass: "read",
+		executionMode: "sequential",
+		async run(args): Promise<ToolResult> {
+			const key = boundedText(args.key, "key", DECIDE_CAPS.keyBytes);
+			if (key instanceof Error) return { kind: "error", message: key.message };
+			if (!KEBAB_KEY.test(key)) {
+				return { kind: "error", message: "decide: key must be kebab-case (lowercase letters, digits, single hyphens)" };
+			}
+			const value = boundedText(args.value, "value", DECIDE_CAPS.valueBytes);
+			if (value instanceof Error) return { kind: "error", message: value.message };
+			const alternatives = boundedAlternatives(args.alternatives);
+			if (alternatives instanceof Error) return { kind: "error", message: alternatives.message };
+			const rationale = boundedText(args.rationale, "rationale", DECIDE_CAPS.rationaleBytes);
+			if (rationale instanceof Error) return { kind: "error", message: rationale.message };
+			let label: string | undefined;
+			if (args.label !== undefined && args.label !== null) {
+				const bounded = boundedText(args.label, "label", DECIDE_CAPS.labelBytes);
+				if (bounded instanceof Error) return { kind: "error", message: bounded.message };
+				label = bounded;
+			}
+			if (deps.decisionBoard === undefined) {
+				return { kind: "error", message: "decide: no session decision board is available in this context" };
+			}
+			let outcome: ReturnType<DecisionBoardStore["recordAgentDecision"]>;
+			try {
+				outcome = deps.decisionBoard.recordAgentDecision({
+					key,
+					value,
+					alternatives,
+					rationale,
+					...(label !== undefined ? { label } : {}),
+				});
+			} catch (error) {
+				return { kind: "error", message: error instanceof Error ? error.message : String(error) };
+			}
+			const ref = decisionRef(outcome.entry.interviewId, key);
+			const supersededNote =
+				outcome.superseded === null
+					? ""
+					: ` (supersedes ${decisionRef(outcome.superseded.interviewId, outcome.superseded.key)})`;
+			return {
+				kind: "ok",
+				output: `decision recorded: ${key} = ${value} [${ref}]${supersededNote}\n`,
+				details: {
+					decision: {
+						ref,
+						key,
+						value,
+						alternatives,
+						rationale,
+						...(label !== undefined ? { label } : {}),
+						...(outcome.superseded !== null
+							? { superseded: decisionRef(outcome.superseded.interviewId, outcome.superseded.key) }
+							: {}),
+					},
+				},
+			};
+		},
+	};
+}

package/src/tools/dispatch-admission.ts

@@ -12,6 +12,7 @@ import {
 } from "../domains/dispatch/gate-role-prompts.js";
 import { narrowDispatchIntentToReadOnly, normalizeDispatchIntent } from "../domains/dispatch/intent.js";
 import { renderDispatchReviewerTask } from "../domains/dispatch/intent-requirements.js";
+import { parallelWriterConflict } from "../domains/dispatch/parallel-writers.js";
 import { approvedRouteCandidates } from "../domains/dispatch/route-approval.js";
 import { defaultRoutingIntent } from "../domains/dispatch/routing-intent.js";
 import type { DispatchFailoverMode } from "../domains/dispatch/validation.js";
@@ -26,6 +27,7 @@ import {
 	DISPATCH_PLAN_PREPARATION_ERROR_ARGUMENT,
 	type DispatchPlanView,
 	describeDispatchPlan,
+	dispatchPlanTopology,
 	RESOLVED_DISPATCH_PLAN_ARGUMENT,
 	type ResolvedDispatchPlanArtifact,
 	resolvedDispatchPlanFromArgs,
@@ -246,6 +248,27 @@ export function createDispatchAdmissionController(deps: DispatchToolDeps): Dispa
 							argv: [...check.command],
 							cwd: resolve(process.cwd(), check.cwd),
 							timeoutMs: entry.timeoutMs,
+							// A judged check seals its kind and absolute file paths here, so
+							// host verification judges against what the catalog declared at
+							// admission rather than whatever the file says at run time.
+							...(check.kind !== "command" ? { kind: check.kind } : {}),
+							...(check.numeric !== undefined
+								? {
+										numeric: {
+											reference: resolve(process.cwd(), check.numeric.reference),
+											tolerance: { ...check.numeric.tolerance },
+										},
+									}
+								: {}),
+							...(check.perf !== undefined
+								? {
+										perf: {
+											...(check.perf.budget !== undefined ? { budget: structuredClone(check.perf.budget) } : {}),
+											...(check.perf.baseline !== undefined ? { baseline: resolve(process.cwd(), check.perf.baseline) } : {}),
+											...(check.perf.tolerance !== undefined ? { tolerance: { ...check.perf.tolerance } } : {}),
+										},
+									}
+								: {}),
 						};
 					}),
 				};
@@ -512,6 +535,10 @@ export function createDispatchAdmissionController(deps: DispatchToolDeps): Dispa
 		if (args.writers === 1 && mode !== "parallel") {
 			return shapeRejection(args, "dispatch: writers is supported only for parallel dispatch");
 		}
+		if (mode === "parallel" && args.writers !== 1) {
+			const conflict = parallelWriterConflict(parsed.requests, deps.getAgentSpecs());
+			if (conflict !== null) return shapeRejection(args, conflict);
+		}
 		const parentCheckout = gitCheckoutRoot(process.cwd());
 		for (const request of parsed.requests) {
 			if (request.worktree !== true) continue;
@@ -584,6 +611,7 @@ export function createDispatchAdmissionController(deps: DispatchToolDeps): Dispa
 						resolveTask(
 							{
 								agentId: gateDeciderAgentId(reviewResult.review.reviewer),
+								...(base.budget === undefined ? {} : { budget: base.budget }),
 								executionRole: "reviewer",
 								task: renderDispatchReviewerTask(base.task, subject.runId, cycle, base.intent),
 								systemPrompt: REVIEWER_GATE_PROMPT,
@@ -619,6 +647,7 @@ export function createDispatchAdmissionController(deps: DispatchToolDeps): Dispa
 					resolveTask(
 						{
 							agentId: gateDeciderAgentId(compete.judge?.agent),
+							...(base.budget === undefined ? {} : { budget: base.budget }),
 							executionRole: "judge",
 							task: `Plan-time capability check for the ${compete.candidates}-candidate judge.`,
 							systemPrompt: JUDGE_GATE_PROMPT,
@@ -691,6 +720,7 @@ export function createDispatchAdmissionController(deps: DispatchToolDeps): Dispa
 				if (council.synthesis === "judge") {
 					const judgeRequest: DispatchRequest = {
 						agentId: council.judge?.agent ?? base.agentId,
+						...(base.budget === undefined ? {} : { budget: base.budget }),
 						executionRole: "judge",
 						task: "Plan-time capability check for council synthesis.",
 						systemPrompt: COUNCIL_JUDGE_PROMPT,
@@ -717,7 +747,9 @@ export function createDispatchAdmissionController(deps: DispatchToolDeps): Dispa
 				for (const [index, request] of parsed.requests.entries()) tasks.push(resolveTask(request, "task", index + 1));
 			}
 
-			const topology = describeDispatchPlan(args).topology;
+			// Scope has already been resolved on tasks. Rendering the raw call here
+			// would discard its typed intent and run legacy prose inference again.
+			const topology = dispatchPlanTopology(args);
 			const planScale =
 				tasks.length > 1 ||
 				topology === "compete" ||

package/src/tools/dispatch-arguments.ts

@@ -1,5 +1,6 @@
 /** Pure model-argument parsing; every returned DispatchRequest has a concrete agent id. */
 
+import { parseResultSummaryMaxBytes } from "../domains/agents/result-contract.js";
 import type { AgentAutomationAuthority } from "../domains/agents/spec.js";
 import { type AgentTaskType, classifyAgentTask } from "../domains/dispatch/agent-candidates.js";
 import { cloneDispatchBudgetRequest } from "../domains/dispatch/budget-envelope.js";
@@ -108,6 +109,29 @@ export function maxOutputBytesArg(args: Record<string, unknown>): number {
 	return typeof value === "number" && Number.isFinite(value) && value > 0 ? Math.floor(value) : DEFAULT_MAX_OUTPUT_BYTES;
 }
 
+/**
+ * The caller's inline-summary allowance, range-checked here so a bad value is
+ * a tool error rather than a sealed run failure. The scope records whether
+ * this assignment set it or inherited a batch default (see
+ * `dispatchResultContract`).
+ */
+function resultSummaryArg(
+	args: Record<string, unknown>,
+	scope: "task" | "batch",
+): { ok: true; value: DispatchRequest["resultSummary"] } | { ok: false; message: string } {
+	if (!("result_summary_max_bytes" in args) || args.result_summary_max_bytes === undefined) {
+		return { ok: true, value: undefined };
+	}
+	try {
+		return {
+			ok: true,
+			value: { maxBytes: parseResultSummaryMaxBytes(args.result_summary_max_bytes, "result_summary_max_bytes"), scope },
+		};
+	} catch (error) {
+		return { ok: false, message: error instanceof Error ? error.message : String(error) };
+	}
+}
+
 export function timeoutMsArg(args: Record<string, unknown>): number | undefined {
 	const value = args.timeout_ms;
 	return typeof value === "number" && Number.isFinite(value) && value > 0 ? Math.floor(value) : undefined;
@@ -116,6 +140,7 @@ export function timeoutMsArg(args: Record<string, unknown>): number | undefined
 function dispatchRequestFromArgs(
 	args: Record<string, unknown>,
 	options: DispatchArgumentParserOptions,
+	resultSummaryScope: "task" | "batch" = "task",
 ): { ok: true; request: DispatchRequest } | { ok: false; message: string } {
 	const task = stringArg(args, "task");
 	if (!task) return { ok: false, message: "missing task (pass list:true to see available agents)" };
@@ -223,6 +248,9 @@ function dispatchRequestFromArgs(
 			}
 		}
 	}
+	const resultSummary = resultSummaryArg(args, resultSummaryScope);
+	if (!resultSummary.ok) return resultSummary;
+	if (resultSummary.value !== undefined) request.resultSummary = resultSummary.value;
 	if ("persona" in args && args.persona !== undefined) {
 		if (typeof args.persona !== "string") return { ok: false, message: "persona must be a string" };
 		const persona = args.persona.trim();
@@ -278,10 +306,19 @@ export function dispatchRequestsFromArgs(
 	for (let index = 0; index < tasks.length; index += 1) {
 		const item = tasks[index];
 		const itemArgs: Record<string, unknown> = isRecord(item) ? { ...shared, ...item } : { ...shared, task: item };
+		// A shared allowance over several members is inherited, not chosen for
+		// each of them; a one-task batch is the single-task form the tool
+		// normalizes every call into, so its shared value is that task's own.
+		const resultSummaryScope =
+			tasks.length > 1 &&
+			Object.hasOwn(shared, "result_summary_max_bytes") &&
+			!(isRecord(item) && Object.hasOwn(item, "result_summary_max_bytes"))
+				? "batch"
+				: "task";
 		const sharedIntent = isRecord(shared.intent) ? shared.intent : null;
 		const itemIntent = isRecord(item) && Object.hasOwn(item, "intent") && isRecord(item.intent) ? item.intent : null;
 		if (sharedIntent !== null && itemIntent !== null) itemArgs.intent = { ...sharedIntent, ...itemIntent };
-		const parsed = dispatchRequestFromArgs(itemArgs, options);
+		const parsed = dispatchRequestFromArgs(itemArgs, options, resultSummaryScope);
 		if (!parsed.ok) return { ok: false, message: `dispatch: task ${index + 1}: ${parsed.message}` };
 		if (sharedIntent !== null && itemIntent !== null) {
 			if (options.resolveIntent === undefined) {

package/src/tools/dispatch-plan.ts

@@ -376,7 +376,8 @@ function canonicalCandidates(value: unknown): DispatchFailoverCandidate[] | null
 	return out.length > 0 ? out : null;
 }
 
-function topologyOf(args: Record<string, unknown>): DispatchPlanTopology {
+/** Select topology without rendering unresolved task scope or consulting provider state. */
+export function dispatchPlanTopology(args: Record<string, unknown>): DispatchPlanTopology {
 	if (isRecord(args.apply_winner)) return "compete";
 	if (args.mode === "compete") return "compete";
 	if (args.mode === "council") return "council";
@@ -400,8 +401,8 @@ function renderPlanText(
 ): string {
 	const lines = [
 		`dispatch plan: topology=${topology} tasks=${tasks.length}`,
-		`cost ceiling: ${costCeilingUsd === undefined ? "unavailable" : `$${costCeilingUsd.toFixed(4)}`}`,
-		`deadline: ${deadlineMs === null ? "per-assignment" : `${deadlineMs}ms whole-plan`}`,
+		`advisory session cost baseline: ${costCeilingUsd === undefined ? "unavailable" : `$${costCeilingUsd.toFixed(4)}`}`,
+		`deadline: ${deadlineMs === null ? "none (advisory planning)" : `${deadlineMs}ms whole-plan`}`,
 	];
 	if (confirmation !== undefined) {
 		lines.push(
@@ -450,7 +451,7 @@ function renderPlanText(
 			const approval = task.routeApproval;
 			const selected = approval.decision.selected;
 			lines.push(
-				`    active policy=${safeField(approval.decision.policyVersion)} decision=${approval.decision.decisionHash} runtime=${safeField(selected.runtimeId)} thinking=${safeField(selected.thinkingLevel ?? "default")} totalCostUpperBoundUsd=${approval.totalCostUpperBoundUsd.toFixed(6)} deadlineMs=${approval.deadlineMs} maxAttempts=${approval.maxAttempts}`,
+				`    active policy=${safeField(approval.decision.policyVersion)} decision=${approval.decision.decisionHash} runtime=${safeField(selected.runtimeId)} thinking=${safeField(selected.thinkingLevel ?? "default")} totalCostUpperBoundUsd=${approval.totalCostUpperBoundUsd.toFixed(6)} deadlineMs=${approval.deadlineMs ?? "none"} maxAttempts=${approval.maxAttempts}`,
 			);
 		}
 		if (task.agentSelection !== null) {
@@ -487,7 +488,7 @@ function renderPlanText(
 		lines.push(...renderLegacyPathScope(task, cwd));
 		for (const check of task.resolvedVerification ?? []) {
 			lines.push(
-				`    verification check=${safeField(check.check)} argv=${JSON.stringify(check.argv)} cwd=${JSON.stringify(check.cwd)} timeout_ms=${check.timeoutMs}`,
+				`    verification check=${safeField(check.check)}${check.kind !== undefined ? ` kind=${check.kind}` : ""} argv=${JSON.stringify(check.argv)} cwd=${JSON.stringify(check.cwd)} timeout_ms=${check.timeoutMs}`,
 			);
 		}
 	}
@@ -616,7 +617,10 @@ function isResolvedTask(value: unknown): value is ResolvedDispatchPlanArtifact["
 					Array.isArray(check.argv) &&
 					check.argv.every((arg) => typeof arg === "string") &&
 					typeof check.cwd === "string" &&
-					typeof check.timeoutMs === "number",
+					typeof check.timeoutMs === "number" &&
+					(check.kind === undefined || check.kind === "numeric-compare" || check.kind === "perf-budget") &&
+					(check.numeric === undefined || (isRecord(check.numeric) && typeof check.numeric.reference === "string")) &&
+					(check.perf === undefined || isRecord(check.perf)),
 			))
 	)
 		return false;
@@ -775,8 +779,7 @@ export function resolvedDispatchPlanFromArgs(args: Record<string, unknown>): Res
 			!Number.isInteger(value.maxWorkers) ||
 			Number(value.maxWorkers) < 1 ||
 			(value.onFailure !== "stop" && value.onFailure !== "continue") ||
-			!Number.isInteger(value.deadlineMs) ||
-			Number(value.deadlineMs) < 1
+			(value.deadlineMs !== null && (!Number.isInteger(value.deadlineMs) || Number(value.deadlineMs) < 1))
 		)
 			return null;
 		if (
@@ -899,7 +902,7 @@ export function describeDispatchPlan(rawArgs: Record<string, unknown> | undefine
 	const args = prepareDispatchArguments(rawArgs ?? {});
 	const preparationFailed = typeof args[DISPATCH_PLAN_PREPARATION_ERROR_ARGUMENT] === "string";
 	const resolved = resolvedDispatchPlanFromArgs(args);
-	const topology = resolved?.topology ?? topologyOf(args);
+	const topology = resolved?.topology ?? dispatchPlanTopology(args);
 	const tasks = resolved?.tasks ?? taskViews(args);
 	const costCeilingUsd = resolved?.costCeilingUsd;
 	const deadlineMs = resolved?.deadlineMs ?? null;

package/src/tools/dispatch-runner.ts

@@ -50,6 +50,8 @@ import { extractRunProvenance, provenanceCompactSuffix } from "../domains/eviden
 import { summarizeTrustStatus } from "../domains/evidence/trust-projection.js";
 import { adaptRunReceiptTrustStatus } from "../domains/evidence/trust-status.js";
 import type { AutonomyLevel } from "../domains/safety/autonomy.js";
+import { activeDecisionRefs } from "../domains/session/decision-board.js";
+import { renderCompeteJudgeTask } from "./compete-judge-task.js";
 import {
 	type CandidateWorktree,
 	type CompeteGroupOwnership,
@@ -559,7 +561,12 @@ function dispatchDetails(
 	}
 	return {
 		mode,
-		assignmentIds: runs.map((run) => run.receipt.lineage?.rootRunId ?? run.receipt.runId),
+		assignmentIds: runs.map(
+			(run) =>
+				deps.dispatch.assignments?.getStored(run.receipt.runId)?.assignmentId ??
+				run.receipt.lineage?.rootRunId ??
+				run.receipt.runId,
+		),
 		terminalRunIds: runs.map((run) => run.receipt.runId),
 		receiptCount: runs.length,
 		failedCount: failed.length,
@@ -786,6 +793,7 @@ async function runReviewGated(
 			}
 			const reviewerRequest: DispatchRequest = {
 				agentId: gateDeciderAgentId(review.reviewer),
+				...(base.budget === undefined ? {} : { budget: base.budget }),
 				executionRole: "reviewer",
 				task: renderDispatchReviewerTask(base.task, builder.receipt.runId, cycle, base.intent),
 				systemPrompt: REVIEWER_GATE_PROMPT,
@@ -802,6 +810,7 @@ async function runReviewGated(
 				...(review.target !== undefined ? { target: review.target } : {}),
 				...(base.plan !== undefined ? { plan: base.plan } : {}),
 				...(base.parentToolCallId !== undefined ? { parentToolCallId: base.parentToolCallId } : {}),
+				...(base.decisionRefs !== undefined ? { decisionRefs: base.decisionRefs } : {}),
 				...(base.reservation !== undefined
 					? { reservation: { ownerId: base.reservation.ownerId, memberId: base.reservation.memberId } }
 					: {}),
@@ -863,20 +872,6 @@ async function runReviewGated(
 	}
 }
 
-function judgeTask(originalTask: string, candidates: ReadonlyArray<CandidateWorktree>, stats: string[]): string {
-	const lines = [
-		`Rank ${candidates.length} candidate implementations of this task and pick the best one.`,
-		"Original task:",
-		originalTask,
-		"Candidates:",
-		...candidates.map(
-			(candidate, index) =>
-				`  ${candidate.index}. branch=${candidate.branch} worktree=${candidate.path} (${stats[index] ?? "?"})`,
-		),
-	];
-	return lines.join("\n\n");
-}
-
 function readVerifiedGateReceipt(deps: DispatchToolDeps, runId: string): RunReceipt | null {
 	const envelope = deps.dispatch.getRun(runId);
 	if (envelope === null) return null;
@@ -1171,6 +1166,11 @@ async function runCompete(
 	const throwIfStopped = (): void => {
 		if (stop !== null) throw new Error(stop.message);
 	};
+	// A stopped phase still has terminal receipts worth reporting. Keep the
+	// ordinary error result and no winner, without discarding those identities
+	// through the generic exception path after the settlement barrier.
+	const stoppedOutcome = (): CompeteOutcome | null =>
+		stop === null ? null : { runs, decisions, group, winner: null, needsDecision: stop.message };
 	const settleRun = async (
 		handle: Awaited<ReturnType<DispatchContract["dispatch"]>>,
 		request: DispatchRequest,
@@ -1329,12 +1329,17 @@ async function runCompete(
 			});
 			const candidateRuns = await settledCompletedRuns(candidateOwned, "candidate settlement");
 			runs.push(...candidateRuns);
-			throwIfStopped();
+			const stoppedCandidates = stoppedOutcome();
+			if (stoppedCandidates !== null) return stoppedCandidates;
 			const stats = worktrees.map((worktree, index) => {
 				const receipt = candidateRuns[index]?.receipt;
 				const failed = receipt !== undefined && isPipelineStepFailure(receipt);
 				if (failed) return "builder failed";
-				commitCandidateWork(worktree, `clio-coder compete ${group} candidate ${worktree.index}`);
+				// The receipt records the candidate's effective authority after recipe
+				// and invocation narrowing, independently of the coordinator's autonomy.
+				if (receipt?.autonomyEnforcement?.autonomy !== "read-only") {
+					commitCandidateWork(worktree, `clio-coder compete ${group} candidate ${worktree.index}`);
+				}
 				return candidateDiffStat(root, worktree.branch);
 			});
 			if (candidateRuns.every((run) => isPipelineStepFailure(run.receipt))) {
@@ -1350,8 +1355,22 @@ async function runCompete(
 			}
 			const judgeRequest: DispatchRequest = {
 				agentId: gateDeciderAgentId(compete.judge?.agent),
+				...(base.budget === undefined ? {} : { budget: base.budget }),
 				executionRole: "judge",
-				task: judgeTask(base.task, worktrees, stats),
+				task: renderCompeteJudgeTask(base.task, worktrees, stats, candidateRuns),
+				// Candidate prose and receipt locators are evidence, not inferred authority.
+				// Read-only execution is enforced by the role/autonomy, not empty write roots.
+				intent: narrowDispatchIntentToReadOnly(
+					base.intent ?? {
+						version: 2,
+						readRoots: [],
+						writeRoots: [],
+						relevantPaths: [],
+						pathProvenance: [],
+						expectedOutputs: [],
+						verification: [],
+					},
+				),
 				systemPrompt: JUDGE_GATE_PROMPT,
 				autonomy: "read-only",
 				cwd: root,
@@ -1367,6 +1386,7 @@ async function runCompete(
 				...(compete.judge?.node !== undefined ? { node: compete.judge.node } : {}),
 				...(base.plan !== undefined ? { plan: base.plan } : {}),
 				...(base.parentToolCallId !== undefined ? { parentToolCallId: base.parentToolCallId } : {}),
+				...(base.decisionRefs !== undefined ? { decisionRefs: base.decisionRefs } : {}),
 				...(base.reservation !== undefined
 					? { reservation: { ownerId: base.reservation.ownerId, memberId: base.reservation.memberId } }
 					: {}),
@@ -1383,7 +1403,8 @@ async function runCompete(
 			const judgeRun = (await settledCompletedRuns([judgeOwned], "judge settlement"))[0];
 			if (judgeRun === undefined) throw new Error("judge produced no completed run");
 			runs.push(judgeRun);
-			throwIfStopped();
+			const stoppedJudge = stoppedOutcome();
+			if (stoppedJudge !== null) return stoppedJudge;
 			const judgeReceipt = judgeRun.receipt;
 			const judgeSummary = judgeRun.summary;
 			// Every judged outcome names the same subjects, decider, and correlation;
@@ -1525,7 +1546,7 @@ async function runCompete(
 
 	// Losers are always cleaned; the winner's worktree and branch survive
 	// only while an operator decision is pending (supervised pick or a
-	// failed merge). The durable state transition happens after the worker
+	// failed merge). Every removed candidate is archived under a durable recovery ref. The durable state transition happens after the worker
 	// barrier and before deletion, defining the safe restart boundary.
 	const winnerAtFinalization = currentWinner();
 	if (ownership !== null) {
@@ -1581,8 +1602,7 @@ async function runCompete(
 /**
  * Apply a preserved compete winner. Plan-scale by definition, so supervised
  * autonomy levels park this call for operator confirmation; the approval IS
- * the winner confirmation. After a successful merge the whole compete group
- * is cleaned up.
+ * the winner confirmation. After a successful merge scratch worktrees are cleaned up; candidate recovery refs remain.
  */
 function runApplyWinner(
 	input: { branch: string; cwd: string },
@@ -1729,7 +1749,7 @@ function runApplyWinner(
 	}
 	return {
 		kind: "ok",
-		output: `winner ${branch} merged into the current branch; compete group ${group} cleaned up`,
+		output: `winner ${branch} merged into the current branch; compete group ${group} scratch cleaned up; candidate states remain under refs/clio-coder/compete/ (list with git for-each-ref)`,
 		details: {
 			mode: "apply_winner",
 			branch,
@@ -1794,14 +1814,14 @@ function competeResult(
 	if (outcome.winner?.applied === true) {
 		return {
 			kind: "ok",
-			output: `compete winner candidate ${outcome.winner.index} applied (branch ${outcome.winner.branch} merged)\n\n${body}`,
+			output: `compete winner candidate ${outcome.winner.index} applied (branch ${outcome.winner.branch} merged); candidate states remain under refs/clio-coder/compete/ (list with git for-each-ref)\n\n${body}`,
 			details,
 		};
 	}
 	if (outcome.winner !== null && outcome.needsDecision === undefined) {
 		const lines = [
 			`compete winner: candidate ${outcome.winner.index} (branch ${outcome.winner.branch}), preserved for confirmation at autonomy ${autonomy}`,
-			`Apply it with dispatch apply_winner={branch: "${outcome.winner.branch}"}; the approval prompt is the winner confirmation. Losing candidates were cleaned up.`,
+			`Apply it with dispatch apply_winner={branch: "${outcome.winner.branch}"}; the approval prompt is the winner confirmation. Losing candidate states remain under refs/clio-coder/compete/; list them with git for-each-ref.`,
 		];
 		return { kind: "ok", output: `${lines.join("\n")}\n\n${body}`, details };
 	}
@@ -1991,6 +2011,7 @@ async function runCouncil(
 		const finalRuns = [...prior.values()];
 		const judgeRequest: DispatchRequest = {
 			agentId: council.judge?.agent ?? base.agentId,
+			...(base.budget === undefined ? {} : { budget: base.budget }),
 			executionRole: "judge",
 			task: `Synthesize the council answers for this task:\n\n${base.task}`,
 			briefing: boundedCouncilBriefing(
@@ -2010,6 +2031,7 @@ async function runCouncil(
 			...(council.judge?.node ? { node: council.judge.node } : {}),
 			...(base.plan ? { plan: base.plan } : {}),
 			...(base.parentToolCallId ? { parentToolCallId: base.parentToolCallId } : {}),
+			...(base.decisionRefs !== undefined ? { decisionRefs: base.decisionRefs } : {}),
 		};
 		const pinned = council.resolvedTasks?.find((task) => task.role === "synthesis");
 		const judgeRun = await runMember(
@@ -2157,6 +2179,7 @@ export async function runDispatchTool(
 	// admission bounds. Keep these off the serializable approved request.
 	const dispatch = deps.dispatch;
 	const preparation = {
+		...(options?.hostRun === undefined ? {} : { hostRun: structuredClone(options.hostRun) }),
 		...(options?.signal === undefined ? {} : { signal: options.signal }),
 		...(timeoutMs === undefined ? {} : { deadlineAt: Date.now() + timeoutMs }),
 	};
@@ -2189,6 +2212,12 @@ export async function runDispatchTool(
 		parentToolCallId === undefined || parentToolCallId.length === 0
 			? structuredClone(snapshot.requests)
 			: snapshot.requests.map((request) => ({ ...structuredClone(request), parentToolCallId }));
+	// Seal the parent board's active decisions onto every request on the same
+	// terms as the parent id: from the live board here, never from model
+	// arguments (the validation projection strips the field). Derived reviewer,
+	// judge, and synthesis requests copy it from their base explicitly.
+	const decisionRefs = activeDecisionRefs(deps.getDecisionBoard?.() ?? []);
+	if (decisionRefs.length > 0) requests = requests.map((request) => ({ ...request, decisionRefs }));
 	if (planView.planScale && deps.dispatch.preview !== undefined && resolvedPlan === null) {
 		return { kind: "error", message: "dispatch: resolved plan is missing after admission" };
 	}
@@ -2291,12 +2320,7 @@ export async function runDispatchTool(
 	try {
 		if (resolvedPlan?.topology === "fleet") {
 			const executionPlan = admissionState.trustedExecutionPlans.get(args);
-			if (
-				executionPlan === undefined ||
-				resolvedPlan.source === null ||
-				resolvedPlan.deadlineMs === null ||
-				reservationOwnerId === undefined
-			) {
+			if (executionPlan === undefined || resolvedPlan.source === null || reservationOwnerId === undefined) {
 				return { kind: "error", message: "dispatch: trusted Scout dependency plan is unavailable" };
 			}
 			if (executionPlan.hash !== resolvedPlan.source.executionPlanHash) {
@@ -2597,10 +2621,16 @@ async function runPipeline(
 			const { receipt, summary } = await registered.completion;
 			activeRunId = null;
 			runs.push(completeRun(deps, receipt, summary));
-			if (isPipelineStepFailure(receipt)) {
+			// Execution can succeed while a conforming report records a failed
+			// check. Keep that receipt truthful, but do not feed failed quality
+			// into a dependent step. Review/compete use failure to drive their
+			// own repair loops, so this condition belongs only to the pipeline.
+			const failedQuality = receipt.quality.resultContract?.quality === "fail";
+			if (isPipelineStepFailure(receipt) || failedQuality) {
 				const skipped = requests.length - (index + 1);
+				const reason = isPipelineStepFailure(receipt) ? pipelineFailureReason(receipt) : "result quality=fail";
 				throw new PipelineHaltError(
-					`pipeline dispatch halted at step ${index + 1}/${requests.length} (run ${receipt.runId}, ${pipelineFailureReason(receipt)}); skipped ${skipped} later step(s)`,
+					`pipeline dispatch halted at step ${index + 1}/${requests.length} (run ${receipt.runId}, ${reason}); skipped ${skipped} later step(s)`,
 					[...runs],
 				);
 			}