@khoavu882/doflow 2.0.1 → 2.0.2

package/src/runtime/storage/roots.js

@@ -31,16 +31,9 @@ function createPruneSettingsResolver({ roots, fsImpl = fs, onView }      = {})
     if (!loadedView) {
       loadedView = true;
       try {
-        let settingsRegistry;
-        if (fsImpl !== fs) {
-          const { loadSettingsRegistry } = require('../settings/registry.js');
-          const loaded = loadSettingsRegistry({ fsImpl });
-          if (!loaded.ok) throw new Error(loaded.detail);
-          settingsRegistry = loaded.registry;
-        }
-        const { loadSettings } = require('../settings/resolve.js');
+        const { loadSettings, registryOn } = require('../settings/resolve.js');
         const projectRoot = roots['project-doflow'] ? path.dirname(roots['project-doflow']) : null;
-        view = loadSettings({ projectRoot, env: resolverEnv, fsImpl, ...(settingsRegistry ? { registry: settingsRegistry } : {}) });
+        view = loadSettings({ projectRoot, env: resolverEnv, fsImpl, ...registryOn(fsImpl) });
       } catch {
         // A settings registry fault fails closed for every root, as it did for each old call.
         view = null;
@@ -69,15 +62,8 @@ function readPruneSetting({ roots, rootId, fsImpl = fs }      = {})
   const resolverEnv                         = {};
   if (roots['config-home']) resolverEnv.XDG_CONFIG_HOME = path.dirname(roots['config-home']);
   try {
-    let settingsRegistry;
-    if (fsImpl !== fs) {
-      const { loadSettingsRegistry } = require('../settings/registry.js');
-      const loaded = loadSettingsRegistry({ fsImpl });
-      if (!loaded.ok) throw new Error(loaded.detail);
-      settingsRegistry = loaded.registry;
-    }
-    const { loadSettings } = require('../settings/resolve.js');
-    const view = loadSettings({ projectRoot, global, env: resolverEnv, fsImpl, ...(settingsRegistry ? { registry: settingsRegistry } : {}) });
+    const { loadSettings, registryOn } = require('../settings/resolve.js');
+    const view = loadSettings({ projectRoot, global, env: resolverEnv, fsImpl, ...registryOn(fsImpl) });
     const resolved = view.get('storage.prune', global ? 'global' : 'project');
     return {
       setting: resolved.value === 'on' ? 'on' : 'off',

package/src/runtime/storage/rules.js

@@ -232,16 +232,15 @@ function lifecyclePathsSafe(project     , fsImpl     ) {
   }
   return true;
 }
-function definitelyMissing(fsImpl     , target     ) {
-  try { fsImpl.lstatSync(target); return false; }
-  catch (error     ) { return error.code === 'ENOENT' || error.code === 'ENOTDIR'; }
-}
 function reportCandidates(store     , entries     , context     ) {
   const { fsImpl, storeDir, roots, now, settings, shouldStop } = context;
   const project = projectRoot(roots);
   const key = project && projectKey(project, fsImpl), selected = [];
   for (const entry of entries) {
     if (shouldStop?.()) throw budgetError();
+    // A folder under another project's key stays: ENOENT or ENOTDIR on its recorded root never
+    // authorises deleting it, since an unmounted or renamed root looks the same as a gone one.
+    if (entry.name !== key) continue;
     const folder = path.join(storeDir, entry.name);
     let children, bodyNames = [];
     try {
@@ -251,50 +250,27 @@ function reportCandidates(store     , entries     , context     ) {
         if (BODY.test(name) && safeStat(fsImpl, path.join(folder, name))?.isFile()) bodyNames.push(name);
       }
     } catch (error     ) { if (error.partial) throw error; continue; }
-    if (entry.name === key) {
-      const lifecycle = path.join(project, '.doflow/state/lifecycle');
-      if (!safeStat(fsImpl, path.join(lifecycle, 'migrated.json'))?.isFile() || !lifecyclePathsSafe(project, fsImpl)) continue;
-      let snapshot;
-      try { snapshot = readEvents(project, { fsImpl, lockFallback: false, shouldStop }); }
-      catch { continue; }
-      if (snapshot.incomplete) throw budgetError();
-      if (snapshot.unreadable.length) continue;
-      const eventIds = new Set();
-      for (const event of snapshot.events) {
-        if (shouldStop?.()) throw budgetError();
-        const ids = [event.data.id, ...(Array.isArray(event.data.ids) ? event.data.ids : [])];
-        for (const id of ids) {
-          if (shouldStop?.()) throw budgetError();
-          if (typeof id === 'string' && /^FU-[0-9a-hjkmnp-tv-z]{6}$/.test(id)) eventIds.add(id);
-        }
-      }
-      for (const body of bodyNames) {
-        if (shouldStop?.()) throw budgetError();
-        const stat = safeStat(fsImpl, path.join(folder, body));
-        if (stat && !eventIds.has(body.slice(0, -4)) && now - stat.mtimeMs > settings.orphanGraceHours * HOUR)
-          selected.push({ name: `${entry.name}/${body}`, reason: 'orphan-body', bytes: stat.size, mtimeMs: stat.mtimeMs });
-      }
-    } else {
-      const marker = path.join(folder, '.root');
-      if (!safeStat(fsImpl, marker)?.isFile() || !bodyNames.length) continue;
-      let validFolder = true;
-      for (const name of children) {
+    const lifecycle = path.join(project, '.doflow/state/lifecycle');
+    if (!safeStat(fsImpl, path.join(lifecycle, 'migrated.json'))?.isFile() || !lifecyclePathsSafe(project, fsImpl)) continue;
+    let snapshot;
+    try { snapshot = readEvents(project, { fsImpl, lockFallback: false, shouldStop }); }
+    catch { continue; }
+    if (snapshot.incomplete) throw budgetError();
+    if (snapshot.unreadable.length) continue;
+    const eventIds = new Set();
+    for (const event of snapshot.events) {
+      if (shouldStop?.()) throw budgetError();
+      const ids = [event.data.id, ...(Array.isArray(event.data.ids) ? event.data.ids : [])];
+      for (const id of ids) {
         if (shouldStop?.()) throw budgetError();
-        if (name !== '.root' && !bodyNames.includes(name)) { validFolder = false; break; }
+        if (typeof id === 'string' && /^FU-[0-9a-hjkmnp-tv-z]{6}$/.test(id)) eventIds.add(id);
       }
-      if (!validFolder) continue;
-      let root;
-      try { root = fsImpl.readFileSync(marker, 'utf8').trim(); } catch { continue; }
-      if (!path.isAbsolute(root) || !definitelyMissing(fsImpl, root)) continue;
-      let newest = -Infinity;
-      for (const body of bodyNames) {
-        if (shouldStop?.()) throw budgetError();
-        const stat = safeStat(fsImpl, path.join(folder, body));
-        if (!stat) { newest = Infinity; break; }
-        newest = Math.max(newest, stat.mtimeMs);
-      }
-      if (now - newest > store.bound.foreignMaxAgeDays * DAY)
-        selected.push({ name: entry.name, reason: 'foreign-root-gone', bytes: entry.stat.size, mtimeMs: newest });
+    }
+    for (const body of bodyNames) {
+      if (shouldStop?.()) throw budgetError();
+      const stat = safeStat(fsImpl, path.join(folder, body));
+      if (stat && !eventIds.has(body.slice(0, -4)) && now - stat.mtimeMs > settings.orphanGraceHours * HOUR)
+        selected.push({ name: `${entry.name}/${body}`, reason: 'orphan-body', bytes: stat.size, mtimeMs: stat.mtimeMs });
     }
   }
   return selected;

package/src/runtime/storage/work-status.js

@@ -81,6 +81,17 @@ function isRunNamespaceDir(name        )          {
   return safeSegment(name) && !name.endsWith('.lock');
 }
 
+/**
+ * Whether a flat run is superseded by a namespaced copy: it names that copy's namespace as its own
+ * feature (`featureSlug`, else `slug`) and the copy has the same file name. A flat run that names
+ * no feature, or one whose namespace holds no copy, is a run of its own and is never dropped. The
+ * one ownership rule for every reader that walks `orchestration/` (health, trace, work status).
+ */
+function isSupersededFlatRun(name        , value     , copies                                            )          {
+  const own = stringField(value, 'featureSlug') || stringField(value, 'slug');
+  return own !== null && isRunNamespaceDir(own) && copies.some((copy) => copy.namespace === own && copy.name === name);
+}
+
 /**
  * Every run id the orchestration store holds, flat or under a `<slug>/` namespace (115 C-1: a task id
  * other than its feature's slug lives in `orchestration/<slug>/`). `cache.runLocations` maps each id
@@ -136,9 +147,8 @@ function readRunAt(cache     , runId        , where        )      {
   const file = path.join(stateRoot(cache.projectRoot), 'orchestration', ...(where ? [where] : []), `${runId}.json`);
   let result     ;
   try {
-    // A namespaced copy is a file base never read (N-4): a link, a FIFO or a device there reads as
-    // unreadable (the record is kept) and never blocks. The flat copy keeps its plain read (FU-d88kp0).
-    const text = where && typeof cache.fsImpl.lstatSync === 'function' && typeof cache.fsImpl.openSync === 'function'
+    // A link, a FIFO or a device there reads as unreadable (the record is kept) and never blocks.
+    const text = typeof cache.fsImpl.lstatSync === 'function' && typeof cache.fsImpl.openSync === 'function'
       ? require('../task-scope.js').readRegularFileText(file, cache.fsImpl) : cache.fsImpl.readFileSync(file, 'utf8');
     if (text === null) throw new Error('not a regular file');
     const value = JSON.parse(text);
@@ -542,4 +552,4 @@ function workStatus({
   return answer('finished', run ? 'run-finished' : 'no-run', resolvedRun.id, feature, since);
 }
 
-module.exports = { workStatus, recordExtension, createWorkCache, refreshedWorkCache, RUN_OPEN_STATES };
+module.exports = { workStatus, recordExtension, createWorkCache, refreshedWorkCache, RUN_OPEN_STATES, isRunNamespaceDir, isSupersededFlatRun };

package/src/runtime/task-scope.js

@@ -176,9 +176,23 @@ function readRegularFileText(file        , fsImpl      = fs)                {
   }
 }
 
+/** Whether `slug` is a register feature (it has `decisions/register.json`), for a record file under
+ * a checkout's `.doflow/state`. Such a feature never reads another feature's identity-less flat
+ * record (045 isolation). A file whose checkout cannot be told, or a feature that does not resolve,
+ * has no register. */
+function featureHasRegister(file        , slug        )          {
+  const marker = `${path.sep}.doflow${path.sep}state${path.sep}`;
+  const at = file.lastIndexOf(marker);
+  if (at <= 0) return false;
+  try {
+    const found = resolveFeature({ projectRoot: file.slice(0, at), slug });
+    return !found.error && Boolean(found.featureDir) && fs.existsSync(path.join(found.featureDir, 'decisions', 'register.json'));
+  } catch { return false; }
+}
+
 /**
  * Whether a flat record may be read as `slug`'s (D-3): it names that feature (`featureSlug` on a
- * run, `slug` on a readiness record) or names none. A file that does not parse names nobody, so a
+ * run, `slug` on a readiness record), or names none and `slug` has no decision register. A file that does not parse names nobody, so a
  * namespaced read never falls back to it. The probe never blocks and follows no link: a flat file
  * that is not a regular file of at most `MAX_RECORD_FILE_BYTES` is not read; `unsafeIsOurs` is then
  * the answer, so a caller whose reader refuses such a file (the run store's `readRunRecord`) is
@@ -198,7 +212,8 @@ function flatRecordIsOurs(file        , slug               , fsImpl      = fs, u
     data = JSON.parse(text);
   } catch { return false; }
   const named = [data?.featureSlug, data?.slug].find((value) => typeof value === 'string' && value !== '');
-  return named === undefined || named === slug;
+  if (named === undefined) return !slug || !featureHasRegister(file, slug);
+  return named === slug;
 }
 
 /**

package/src/runtime/task-state.js

@@ -376,10 +376,14 @@ function acquireLock(fsImpl     , file        , options              = {})
     + strayEntries(fsImpl, lockDir));
 }
 
-/** Names a non-directory entry in the lock (no DoFlow runtime makes one; it blocks the lock until removed). */
+/** The non-directory entries in the lock (no DoFlow runtime makes one; each blocks the lock until removed). */
+function strayNames(fsImpl     , lockDir        )           {
+  try { return fsImpl.readdirSync(lockDir, { withFileTypes: true }).filter((d     ) => !d.isDirectory()).map((d     ) => d.name); } catch { return []; }
+}
+
+/** `strayNames` as the sentence the lock timeout carries. */
 function strayEntries(fsImpl     , lockDir        )         {
-  let stray           = [];
-  try { stray = fsImpl.readdirSync(lockDir, { withFileTypes: true }).filter((d     ) => !d.isDirectory()).map((d     ) => d.name); } catch { return ''; }
+  const stray = strayNames(fsImpl, lockDir);
   if (stray.length === 0) return '';
   return ` It holds ${stray.map((name) => `'${name}'`).join(', ')}, which no DoFlow runtime makes and which keeps it locked: `
     + `remove ${stray.length > 1 ? 'them' : 'it'} once no DoFlow process is running.`;
@@ -389,7 +393,8 @@ function strayEntries(fsImpl     , lockDir        )         {
  * Takes the cross-process lock for one state file with a bounded wait.
  * Makes 1 try plus `retries` retries (default 3) separated by `waitMs` (default 5); each try is one
  * tryAcquireLock, which waits at most 40 ms, and only on a process that reached the lock at the same moment.
- * Throws an Error('store-locked') after one try plus retries.
+ * Throws an Error('store-locked') after one try plus retries, carrying `lockPath` (the lock folder) and
+ * `strayEntries` (the names in it that no DoFlow runtime makes) as properties.
  * @param {Object} fsImpl
  * @param {string} file
  * @param {Object} [options]
@@ -420,6 +425,8 @@ function boundedAcquire(
   }
   const error = new Error('store-locked');
   (error       ).code = 'store-locked';
+  (error       ).lockPath = `${file}.lock`;
+  (error       ).strayEntries = strayNames(fsImpl, `${file}.lock`);
   throw error;
 }
 

package/src/runtime/trace/analyze.js

@@ -115,8 +115,10 @@ function latencyHotspots(scopes       , th     , latency       )      {
     const groups = new Map             ();
     for (const s of sc.spans) {
       if (!Number.isInteger(s.durationMs) || !ranItself(s)) continue;
-      const key = `${s.kind}\n${s.name ?? ''}`;
-      if (!groups.has(key)) groups.set(key, { kind: s.kind, name: s.name ?? null, spans: [] });
+      // Every derived `test` span is named 'test'; the command's class tells unrelated shell commands apart.
+      const name = s.kind === 'test' && typeof s.attrs?.test_class === 'string' ? s.attrs.test_class : (s.name ?? null);
+      const key = `${s.kind}\n${name ?? ''}`;
+      if (!groups.has(key)) groups.set(key, { kind: s.kind, name, spans: [] });
       groups.get(key).spans.push(s);
     }
     for (const g of [...groups.values()].sort((a, b) => cmp(a.kind, b.kind) || cmp(a.name ?? '', b.name ?? ''))) {

package/src/runtime/trace/indicators.js

@@ -40,27 +40,33 @@ function parseAt(value     )                {
   return Number.isNaN(ms) ? null : ms;
 }
 
-/** Every record in a directory, plus the names of the ones that did not parse. A file that cannot be
- * read is counted and named rather than skipped: a report that quietly drops what it could not read
- * overstates its own coverage, which is the defect `malformedLines` already guards against for runs. */
-function readRecords(dir        , fsImpl      = fs)      {
-  if (!fsImpl.existsSync(dir)) return { records: [], unreadable: [], exists: false };
-  const records        = [];
+/** Every run the `list` action shows (flat and namespaced, this checkout and the other ones, each
+ * logical run once), plus the ones that could not be read, named with a fixed reason. A file that
+ * cannot be read is counted and named rather than skipped: a report that quietly drops what it could
+ * not read overstates its own coverage, which is the defect `malformedLines` already guards against
+ * for runs. The reason is never the error's own text, which can carry a path or file bytes. */
+function readRecords(root        )      {
+  const { orchestrationRuns, runEntriesAt, selectRunEntries, runStoreDir } = require('../implementation-gate.js');
+  const listed = orchestrationRuns({ stateRoot: root });
   const unreadable        = [];
-  for (const name of fsImpl.readdirSync(dir).sort()) {
-    if (!name.endsWith('.json')) continue;
-    try {
-      const parsed = JSON.parse(fsImpl.readFileSync(path.join(dir, name), 'utf8'));
-      if (!parsed || typeof parsed !== 'object' || !parsed.taskId) {
-        unreadable.push({ file: name, reason: 'not an orchestration record' });
-        continue;
-      }
-      records.push(parsed);
-    } catch (err     ) {
-      unreadable.push({ file: name, reason: err.message });
+  let entries       ;
+  if (listed.ok) entries = selectRunEntries(listed.entries);
+  else {
+    entries = selectRunEntries(runEntriesAt(root, 'current'));
+    unreadable.push({ file: '(other checkouts)', reason: 'could not be listed' });
+  }
+  const records        = [];
+  for (const entry of entries) {
+    const name = entry.origin === 'other' ? entry.file : path.relative(runStoreDir(entry.root), entry.file);
+    if (entry.error) {
+      unreadable.push({ file: name, reason: entry.error === 'io' ? 'not a regular file' : 'not valid JSON' });
+    } else if (!entry.record || typeof entry.record !== 'object' || !entry.record.taskId) {
+      unreadable.push({ file: name, reason: 'not an orchestration record' });
+    } else {
+      records.push(entry.record);
     }
   }
-  return { records, unreadable, exists: true };
+  return { records, unreadable, exists: entries.length > 0 || fs.existsSync(orchestrationDir(root)) };
 }
 
 /** A stage row is "not work done" when the orchestrator backfilled it or imported it rather than
@@ -196,8 +202,7 @@ function printClass(group     )       {
 }
 
 function handleIndicatorsCommand({ json = false, projectRoot = process.cwd() } = {})         {
-  const dir = orchestrationDir(projectRoot);
-  const read = readRecords(dir);
+  const read = readRecords(projectRoot);
   const view = buildIndicators(read);
 
   if (json) {

package/src/runtime/trace/spans.js

@@ -9,6 +9,7 @@ const { resolveRunsLocation, normalizeRunRecord } = require('./ledger.js');
 const { SAFE_TOKEN } = require('./telemetry.js');
 const { finish } = require('./render.js');
 const { REPO_ROOT } = require('../../helper/repo-root.js');
+const { isRunNamespaceDir, isSupersededFlatRun } = require('../storage/work-status.js');
 
 /**
  * `trace spans` (088 IC-011, FR-005, DD-5): spans projected offline from the records that already
@@ -63,7 +64,6 @@ const { REPO_ROOT } = require('../../helper/repo-root.js');
 
 const PARTITION = /^\d{4}-\d{2}-\d{2}\.jsonl$/;
 const STORE_FILE = /^[A-Za-z0-9][A-Za-z0-9._-]*\.json$/;
-const NAMESPACE_DIR = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
 const HEX16 = /^[0-9a-f]{16}$/;
 const HEX32 = /^[0-9a-f]{32}$/;
 const WORKER_RUN_ID = /^w-[0-9a-f]{12}$/;
@@ -201,15 +201,14 @@ function readStores(fsImpl     , stateDir        , rel        , gaps       , kin
   if (!namespaced) return out.map(({ file, value }) => ({ file, value }));
   let entries        = [];
   try { entries = fsImpl.readdirSync(base, { withFileTypes: true }); } catch { entries = []; }
-  const namespaces = entries.filter((entry     ) => entry.isDirectory() && NAMESPACE_DIR.test(entry.name) && !entry.name.endsWith('.lock'))
+  const namespaces = entries.filter((entry     ) => entry.isDirectory() && isRunNamespaceDir(entry.name))
     .map((entry     ) => entry.name).sort();
   for (const namespace of namespaces) {
     const dir = path.join(base, namespace);
     for (const name of listDir(fsImpl, dir, STORE_FILE)) read(`${rel}/${namespace}/${name}`, name, dir, namespace);
   }
-  const copied = (flat     )          => out.some((other) => other.namespace !== ''
-    && other.name === flat.name && (typeof flat.value.featureSlug !== 'string' || flat.value.featureSlug === other.namespace));
-  return out.filter((entry) => entry.namespace !== '' || !copied(entry)).map(({ file, value }) => ({ file, value }));
+  const copies = out.filter((other) => other.namespace !== '');
+  return out.filter((entry) => entry.namespace !== '' || !isSupersededFlatRun(entry.name, entry.value, copies)).map(({ file, value }) => ({ file, value }));
 }
 
 const objects = (v     )                       => (v && typeof v === 'object' && !Array.isArray(v)

package/src/runtime/verb-view.js

@@ -87,7 +87,8 @@ function projectValue(value     , node          )      {
     let part;
     if (child.array) {
       part = Array.isArray(value[key])
-        ? value[key].map((element     ) => (child.node.all ? element : (projectValue(element, child.node) ?? {})))
+        ? value[key].map((element     ) => (child.node.all || element === null || typeof element !== 'object' || Array.isArray(element)
+          ? element : (projectValue(element, child.node) ?? {})))
         : undefined;
     } else {
       part = projectValue(value[key], child.node);
@@ -115,7 +116,7 @@ const DIGITS = /^[0-9]+$/;
 
 function encodeCursor(key           )         {
   if (!Number.isSafeInteger(key.atMs) || key.atMs < 0 || String(key.atMs).length > 15) {
-    throw new TypeError(`cursor time must be 0 to 15 digits of milliseconds (got ${key.atMs})`);
+    throw new ViewUsageError(`cursor time must be 0 to 15 digits of milliseconds (got ${key.atMs})`);
   }
   return `${key.atMs}:${key.event}`;
 }
@@ -197,8 +198,8 @@ function commandLine(verb        , action                    , carried
  * are those the spec's `carry` names, in that order, then `--cursor`, `--limit`, `--view` (a `page` line names
  * `--view full` only when the caller's `view` is `full`). Returns no line when
  * the kind has nothing to point at (`page` without a nextCursor, `page-full` with nothing shown). In a JSON answer
- * (`json: true`) the `page-full` and `full` lines end with `--json`, so the command as written prints the full
- * payload; a text answer's lines carry no `--json`.
+ * (`json: true`) every line ends with `--json`, so the command as written prints the same JSON shape; a text
+ * answer's lines carry no `--json`.
  */
 function viewLines(kind                               , ctx   
                                                                             
@@ -222,7 +223,7 @@ function viewLines(kind                               , ctx
   } else {
     args.view = 'full';
   }
-  const asJson = ctx.json === true && kind !== 'page' ? ' --json' : '';
+  const asJson = ctx.json === true ? ' --json' : '';
   return [`${LABELS[kind]}: ${commandLine(ctx.spec.verb, ctx.spec.action, args)}${asJson}`];
 }
 

package/src/runtime/worker/command.js

@@ -285,7 +285,7 @@ function evaluate({ reg, worker, harness, needs, coverage, env, cwd, root, nowMs
     nowMs,
   );
   const requirements = readiness.requirementsFor({ harness, worker }, facts, needs, coverage, edit);
-  return { requirements, version: found.version, ...readiness.eligibility(requirements) };
+  return { requirements, version: found.version, binaryPath: found.path, ...readiness.eligibility(requirements) };
 }
 
 /** IC-011 steps 0 to 12, then the supervisor spawn and the start poll. */
@@ -365,7 +365,9 @@ async function runAction(o     ) {
     edit: editRecord, childOf, request: childOf ? o.request : null,
     ...launchRecord(worker, identity, prompt.bytes.toString('utf8'), edit, binding),
     ...(binding ? { binding: { model: binding.model, flag: binding.flag } } : {}),
-    descriptor: worker,
+    // The binary the probe found, as an absolute path: the supervisor spawns from the execution worktree,
+    // where a relative PATH entry would name another file than the one probed.
+    descriptor: evaluated.binaryPath && worker?.cli ? { ...worker, cli: { ...worker.cli, binary: evaluated.binaryPath } } : worker,
     prompt: { path: prompt.path, sha256: prompt.sha256, bytes: prompt.bytes.length },
     needs: evaluated.requirements.map((item     ) => ({ requirement: item.requirement, at: item.at ?? null })),
   };

package/src/runtime/worker/readiness.js

@@ -78,9 +78,13 @@ function workerDescriptors({ descriptors, registry, view }      = {})
   return ids.filter((id) => Object.hasOwn(descriptors, id)).map((id) => ({ harness: id, worker: descriptors[id] }));
 }
 
-/** The first executable `binary` on `env.PATH`, or null. Starts no process. */
-function findOnPath(binary        , env     , platform = process.platform)                {
-  const dirs = String(env?.PATH ?? '').split(path.delimiter).filter(Boolean);
+/**
+ * The first executable `binary` on `env.PATH`, or null. Starts no process. A relative PATH entry is
+ * read against `cwd` (the caller's directory) when one is given, so the path found is absolute and
+ * names the same file whichever directory a later process starts in.
+ */
+function findOnPath(binary        , env     , platform = process.platform, cwd         )                {
+  const dirs = String(env?.PATH ?? '').split(path.delimiter).filter(Boolean).map((dir) => (cwd ? path.resolve(cwd, dir) : dir));
   const suffixes = platform === 'win32'
     ? ['', ...String(env?.PATHEXT || '.COM;.EXE;.BAT;.CMD').split(';').filter(Boolean)]
     : [''];
@@ -116,7 +120,7 @@ function discoverOne({ harness, worker }     , { env, cwd, now, platform }     )
   if (!supported(cli)) {
     return { harness, binary: null, present: false, path: null, version: null, reason: 'cli-unknown', at: iso(now()) };
   }
-  const found = findOnPath(cli.binary, env, platform);
+  const found = findOnPath(cli.binary, env, platform, cwd);
   if (!found) return { harness, binary: cli.binary, present: false, path: null, version: null, reason: 'not-on-path', at: iso(now()) };
   const execFileImpl = (bin        , args          , options     ) => execFileSync(bin, args, { ...options, env, cwd });
   const result = runProbe([found, ...cli.versionArgv], { execFileImpl, timeoutMs: PROBE_TIMEOUT_MS });

package/src/runtime/worker/supervisor.js

@@ -321,22 +321,33 @@ function boundedWait(promise              , ms        )               {
   return Promise.race([promise, bound]).finally(() => clearTimeout(timer));
 }
 
-/** Reads only the bounded Codex output-last-message prefix; absent or unreadable files are optional. */
-function readLastMessage(parser     , file        )       {
-  if (typeof parser.lastMessage !== 'function') return;
+/** What masking did to a retained final message, in the run record beside the stdout and stderr pointers. */
+const ALTERED_WARNING = 'masking altered this final message: it is not suitable for byte-exact patch application; apply the worker\'s changes from its isolated worktree, not from this text';
+
+/**
+ * Reads only the bounded Codex output-last-message prefix; absent or unreadable files are optional.
+ * Returns the pointer the run record keeps (`path` relative to `stateRoot`, the masked `bytes`,
+ * whether masking `altered` the text and, when it did, the `warning`), or null when no file was read.
+ */
+function readLastMessage(parser     , file        , stateRoot        )      {
+  if (typeof parser.lastMessage !== 'function') return null;
   let fd                    ;
   try {
     fd = fs.openSync(file, 'r');
     const bytes = Buffer.alloc(65536);
     const length = fs.readSync(fd, bytes, 0, bytes.length, 0);
-    const masked = maskBody(bytes.subarray(0, length).toString('utf8')).text;
+    const raw = bytes.subarray(0, length).toString('utf8');
+    const masked = maskBody(raw).text;
     parser.lastMessage(masked);
     // NFR-004: the retained copy holds only the masked, bounded text, never the raw worker output.
     fs.closeSync(fd);
     fd = undefined;
-    try { fs.writeFileSync(file, masked, 'utf8'); } catch { fs.rmSync(file, { force: true }); }
+    try { fs.writeFileSync(file, masked, 'utf8'); } catch { fs.rmSync(file, { force: true }); return null; }
+    const altered = masked !== raw;
+    return { path: path.relative(stateRoot, file).split(path.sep).join('/'), bytes: Buffer.byteLength(masked), altered, ...(altered ? { warning: ALTERED_WARNING } : {}) };
   } catch {
     // Codex may not have produced this optional file; that does not change the run outcome.
+    return null;
   } finally {
     if (fd !== undefined) {
       try { fs.closeSync(fd); } catch { /* unreadable/closed files are ignored */ }
@@ -509,7 +520,8 @@ async function superviseRun({
       readOnly = { status: 'unverifiable', changes: [], head: { before: before.head, after: null }, refsChanged: null };
     }
   }
-  if (lastMessageFile) readLastMessage(parser, lastMessageFile);
+  const lastMessage = lastMessageFile ? readLastMessage(parser, lastMessageFile, stateRoot) : null;
+  if (lastMessage) (output       ).lastMessage = lastMessage;
   const report = parser.end();
   // 106 IC-002: a failure whose masked summary holds a declared quota signal is marked quota.
   const quota = quotaOf(report, run.descriptor);

package/src/runtime/workflow-orchestrator.js

@@ -484,9 +484,13 @@ class WorkflowOrchestrator {
         },
         harnessName: displayName,
         since,
-        addCommand: (server     ) => {
+        addCommand: (server     , harnessId      = null) => {
           const reach = reachOf();
-          const row = reach?.harnesses.find((item     ) => !['selected', 'configured'].includes(item.servers[server]));
+          const has = (item     ) => ['selected', 'configured'].includes(item.servers[server]);
+          // The brief's own harness is where the server was missing; another harness having it says nothing.
+          const target = harnessId ? reach?.harnesses.find((item     ) => item.id === harnessId) : null;
+          if (target) return has(target) ? null : reach.addCommand(target.id, target.scope, server);
+          const row = reach?.harnesses.find((item     ) => !has(item));
           return row ? reach.addCommand(row.id, row.scope, server) : null;
         },
       });