@kognai/orchestrator-core 0.1.0

package/dist/lib/sprint-runner-engine.js

@@ -0,0 +1,1042 @@
+"use strict";
+/**
+ * sprint-runner.ts — Auto-executes pending sprint tasks via dual-supervisor orchestrator
+ *
+ * PM2 cron: every 30 minutes — checks for pending work and runs it
+ *
+ * Flow:
+ *   1. Check lock file (prevents parallel sprints)
+ *   2. Scan sprints/ for JSON files with pending tasks
+ *      Priority: week-N.json descending (newest sprint first)
+ *   3. Read sprint JSON, inject sprint_id into each task
+ *   4. Write modified sprint to logs/sprint-runner-active.json
+ *   5. Spawn orchestrate-agents-v2.ts on the temp ACTIVE file
+ *      (Dual supervisor: Claude Sonnet + OpenAI Codex, CEO conflict resolution)
+ *   6. Telegram alert on start + finish
+ *   7. Release lock when done
+ *
+ * GitHub Issues → Sprint Tasks:
+ *   CEO creates GitHub issues as directives. To execute them, they must be
+ *   converted into a sprint JSON file (sprints/week-N.json) first.
+ *   The CEO bot or a human writes the sprint JSON; this runner executes it.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runSprintCycle = runSprintCycle;
+const fs_1 = require("fs");
+// TICKET-098: source/state split — runtime status lives in .swarm-state/, not committed source
+const sprint_state_1 = require("./sprint-state");
+const engine_paths_1 = require("./engine-paths");
+const path_1 = require("path");
+const child_process_1 = require("child_process");
+const https = __importStar(require("https"));
+// sprint-1566 F2: agent-registry validation (catches non-existent agent assignments at sprint load)
+const agent_registry_1 = require("./agent-registry");
+// ── Config ─────────────────────────────────────────────────────────────────
+// TICKET-215 Phase 3b: base all engine paths on the parameterized seam. Defaults to
+// KOGNAI_ROOT || process.cwd() — identical to the prior process.cwd() when unset, but
+// now overridable so the same engine serves any product from its own root.
+const ENGINE_PATHS = (0, engine_paths_1.resolveEnginePaths)();
+const ROOT = ENGINE_PATHS.root;
+const SPRINTS = (0, fs_1.existsSync)((0, path_1.join)(ROOT, 'workspace', 'sprints')) ? (0, path_1.join)(ROOT, 'workspace', 'sprints') : (0, path_1.join)(ROOT, 'sprints');
+const LOCK = (0, path_1.join)(ROOT, 'logs', 'sprint-runner.lock');
+const LOG = (0, path_1.join)(ROOT, 'logs', 'sprint-runner.log');
+const ACTIVE = (0, path_1.join)(ROOT, 'logs', 'sprint-runner-active.json');
+const COOLDOWN = (0, path_1.join)(ROOT, 'logs', 'sprint-runner-cooldown.json');
+const MAX_HOURS = 6; // kill orchestrator if it runs longer than this
+// Rate limiter: minimum gap between sprint executions (prevents burning Claude 5h limit)
+// Default: 30 min. Override via SPRINT_COOLDOWN_MINUTES env var.
+const COOLDOWN_MINUTES = parseInt(process.env.SPRINT_COOLDOWN_MINUTES ?? '30', 10);
+// Daily cap: max sprints per calendar day. Default: 100.
+const DAILY_SPRINT_CAP = parseInt(process.env.DAILY_SPRINT_CAP ?? '100', 10);
+// Rolling window cap: max sprints within the last N hours. Default: 20 per 5h.
+const ROLLING_CAP = parseInt(process.env.ROLLING_SPRINT_CAP ?? '20', 10);
+const ROLLING_WINDOW_HRS = parseInt(process.env.ROLLING_WINDOW_HOURS ?? '5', 10);
+// 2026-05-19 anti-burn hardening (after overnight ~$60-80 incident):
+//   - PER_TASK_LIFETIME_MAX_ATTEMPTS: skip any task that has been attempted
+//     more than this many times across ALL runs (tracked via task.attempt_count
+//     in the source sprint file). Default 5 = if 5 prior runs all rejected, stop.
+//   - DAILY_TOKEN_BUDGET_USD: refuse to spawn the orchestrator if today's
+//     cumulative LLM spend (parsed from logs) already exceeds this. Default $30.
+//   - PER_RUN_HARD_TIMEOUT_MIN: kill the orchestrator if it runs longer than
+//     this. Tighter than MAX_HOURS=6. Default 35 (under the 60-min cron gap).
+//     Bumped 25→35 on 2026-05-28 after 4 consecutive sprints died mid-CEO-
+//     governance-phase: task-exec ate ~20 min, Phase-5b/5c/6 (post-sprint
+//     CTO analysis + CEO proposal review + daily report) needed ~10 more
+//     and got SIGKILLed. 35 gives governance room without blowing past the
+//     hourly cron cadence.
+const PER_TASK_LIFETIME_MAX_ATTEMPTS = parseInt(process.env.PER_TASK_LIFETIME_MAX_ATTEMPTS ?? '5', 10);
+const DAILY_TOKEN_BUDGET_USD = parseFloat(process.env.DAILY_TOKEN_BUDGET_USD ?? '30');
+const PER_RUN_HARD_TIMEOUT_MIN = parseInt(process.env.PER_RUN_HARD_TIMEOUT_MIN ?? '35', 10);
+// ── Logging ─────────────────────────────────────────────────────────────────
+function ts() {
+    return new Date().toISOString().replace('T', ' ').slice(0, 19) + ' +00:00';
+}
+function log(msg) {
+    const line = `${ts()}: [SprintRunner] ${msg}`;
+    console.log(line);
+    try {
+        const prev = (0, fs_1.existsSync)(LOG) ? (0, fs_1.readFileSync)(LOG, 'utf8') : '';
+        (0, fs_1.writeFileSync)(LOG, prev + line + '\n');
+    }
+    catch { /* non-fatal */ }
+}
+// ── Telegram ────────────────────────────────────────────────────────────────
+function sendTelegram(text) {
+    const token = process.env.CEO_TELEGRAM_BOT_TOKEN;
+    const chatId = process.env.OWNER_TELEGRAM_CHAT_ID;
+    if (!token || !chatId)
+        return;
+    const body = JSON.stringify({ chat_id: chatId, text, parse_mode: 'Markdown' });
+    const req = https.request({
+        hostname: 'api.telegram.org',
+        path: `/bot${token}/sendMessage`,
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(body) },
+    });
+    req.on('error', () => { });
+    req.write(body);
+    req.end();
+}
+// ── Lock ────────────────────────────────────────────────────────────────────
+function isLocked() {
+    if (!(0, fs_1.existsSync)(LOCK))
+        return false;
+    try {
+        const pid = parseInt((0, fs_1.readFileSync)(LOCK, 'utf8').trim(), 10);
+        process.kill(pid, 0); // throws if PID not running
+        return true;
+    }
+    catch {
+        // stale lock
+        try {
+            (0, fs_1.unlinkSync)(LOCK);
+        }
+        catch { /* ignore */ }
+        return false;
+    }
+}
+function acquireLock() {
+    (0, fs_1.writeFileSync)(LOCK, String(process.pid));
+}
+function releaseLock() {
+    try {
+        (0, fs_1.unlinkSync)(LOCK);
+    }
+    catch { /* ignore */ }
+}
+// ── Rate Limiter (Claude 5h token budget protection) ────────────────────────
+function isInCooldown() {
+    if (!(0, fs_1.existsSync)(COOLDOWN))
+        return false;
+    try {
+        const { until } = JSON.parse((0, fs_1.readFileSync)(COOLDOWN, 'utf8'));
+        if (Date.now() < until) {
+            const remaining = Math.ceil((until - Date.now()) / 60000);
+            log(`Rate limit cooldown active — ${remaining} min remaining. Exiting.`);
+            return true;
+        }
+    }
+    catch { /* stale/corrupt cooldown file — ignore */ }
+    return false;
+}
+function setCooldown() {
+    const until = Date.now() + COOLDOWN_MINUTES * 60 * 1000;
+    try {
+        (0, fs_1.writeFileSync)(COOLDOWN, JSON.stringify({ until, set_at: new Date().toISOString(), cooldown_minutes: COOLDOWN_MINUTES }));
+        log(`Cooldown set: next sprint no earlier than ${new Date(until).toISOString()} (+${COOLDOWN_MINUTES} min)`);
+    }
+    catch { /* non-fatal */ }
+}
+// Founder directive 2026-05-26: incident records routed to CTO + CEO for
+// autonomous investigation. Each preflight or orchestrator failure writes one
+// JSON file at logs/swarm-incidents/<ts>.json. CTO/CEO agents tail this dir.
+function writeIncident(sprintPath, exitCode, elapsedMin) {
+    const dir = (0, path_1.join)(ROOT, 'logs', 'swarm-incidents');
+    if (!(0, fs_1.existsSync)(dir)) {
+        require('node:fs').mkdirSync(dir, { recursive: true });
+    }
+    const ts = new Date().toISOString().replace(/[:.]/g, '-');
+    const sprintId = sprintPath.replace(/.*\//, '').replace(/\.json$/, '');
+    // Read the last ~200 lines of the runner log to attach context.
+    let tail = '';
+    try {
+        const outLog = (0, path_1.join)(ROOT, 'logs', 'sprint-runner-out.log');
+        if ((0, fs_1.existsSync)(outLog)) {
+            const lines = (0, fs_1.readFileSync)(outLog, 'utf8').trim().split('\n');
+            tail = lines.slice(-200).join('\n');
+        }
+    }
+    catch { /* non-fatal */ }
+    const incident = {
+        ts: new Date().toISOString(),
+        sprint_id: sprintId,
+        sprint_path: sprintPath,
+        exit_code: exitCode,
+        elapsed_min: elapsedMin,
+        triage: {
+            assigned_to: ['cto', 'ceo'],
+            directive: 'Diagnose this orchestrator failure and propose a fix. Autonomous resolution preferred — escalate to founder only if blocked by external dependency (API credits, missing env var, infra access).',
+            common_patterns: [
+                'PREFLIGHT_FAILED — sprint task targets a file that does not exist yet; check depends_on_sprint chain',
+                'Anthropic credit exhausted — supervisor + chat blocked; mono-fallback should engage; if not, fix in scripts/orchestrate-agents-v2.ts',
+                'Integrity check stub overwrites — orchestrator preserved original; reset task to pending + investigate generation prompt',
+                'Per-task token budget exceeded — task too large; CTO should decompose via decomposer agent',
+            ],
+        },
+        runner_log_tail: tail,
+    };
+    const outPath = (0, path_1.join)(dir, `${ts}_${sprintId}.json`);
+    (0, fs_1.writeFileSync)(outPath, JSON.stringify(incident, null, 2));
+    log(`Incident written: ${outPath}`);
+    log(`CTO + CEO will investigate on next orchestrator run.`);
+}
+// ── Rate Guards (Claude token budget protection) ─────────────────────────────
+/** Parse unique sprint IDs from a JSONL AAR file */
+function readUniqueSprintIds(filePath) {
+    // Returns Map<sprintId, latestTimestampMs>
+    const out = new Map();
+    if (!(0, fs_1.existsSync)(filePath))
+        return out;
+    try {
+        const lines = (0, fs_1.readFileSync)(filePath, 'utf8').trim().split('\n').filter(l => l.trim());
+        for (const l of lines) {
+            try {
+                const obj = JSON.parse(l);
+                const id = obj.sprintId ?? l;
+                const ts = obj.timestamp ? new Date(obj.timestamp).getTime() : Date.now();
+                if (!out.has(id) || ts > out.get(id))
+                    out.set(id, ts);
+            }
+            catch { /* skip corrupt lines */ }
+        }
+    }
+    catch { /* non-fatal */ }
+    return out;
+}
+/** Hard daily cap: max DAILY_SPRINT_CAP unique sprints per calendar day */
+function isDailyCapReached() {
+    try {
+        const today = new Date().toISOString().slice(0, 10);
+        const aarFile = (0, path_1.join)(ROOT, 'logs', 'aar', `${today}.jsonl`);
+        const ids = readUniqueSprintIds(aarFile);
+        const count = ids.size;
+        if (count >= DAILY_SPRINT_CAP) {
+            log(`Daily cap reached: ${count}/${DAILY_SPRINT_CAP} sprints today. Pausing until midnight.`);
+            sendTelegram(`🚫 *Sprint Runner* — daily cap reached\\n\\n${count}/${DAILY_SPRINT_CAP} sprints today.\\nResuming tomorrow.`);
+            return true;
+        }
+        log(`Daily sprint count: ${count}/${DAILY_SPRINT_CAP}`);
+    }
+    catch { /* non-fatal */ }
+    return false;
+}
+/** Rolling window cap: max ROLLING_CAP unique sprints in the last ROLLING_WINDOW_HRS hours */
+function isRollingCapReached() {
+    try {
+        const now = Date.now();
+        const windowMs = ROLLING_WINDOW_HRS * 60 * 60 * 1000;
+        const cutoff = now - windowMs;
+        // Collect IDs from today's AND yesterday's AAR (window may span midnight)
+        const todayStr = new Date().toISOString().slice(0, 10);
+        const yesterdayStr = new Date(now - 86_400_000).toISOString().slice(0, 10);
+        const aarDir = (0, path_1.join)(ROOT, 'logs', 'aar');
+        const allIds = new Map();
+        for (const day of [yesterdayStr, todayStr]) {
+            const ids = readUniqueSprintIds((0, path_1.join)(aarDir, `${day}.jsonl`));
+            ids.forEach((ts, id) => {
+                if (!allIds.has(id) || ts > allIds.get(id))
+                    allIds.set(id, ts);
+            });
+        }
+        const recentTimestamps = [];
+        allIds.forEach(ts => { if (ts >= cutoff)
+            recentTimestamps.push(ts); });
+        const recentCount = recentTimestamps.length;
+        if (recentCount >= ROLLING_CAP) {
+            const oldest = recentTimestamps.reduce((min, ts) => ts < min ? ts : min, recentTimestamps[0]);
+            const resumeAt = new Date(oldest + windowMs);
+            log(`Rolling window cap: ${recentCount}/${ROLLING_CAP} sprints in last ${ROLLING_WINDOW_HRS}h. Resume ~${resumeAt.toISOString()}`);
+            sendTelegram(`⏳ *Sprint Runner* — rolling cap reached\\n\\n${recentCount}/${ROLLING_CAP} sprints in the last ${ROLLING_WINDOW_HRS}h.\\nResume: ~${resumeAt.toISOString().slice(11, 16)} UTC`);
+            return true;
+        }
+        log(`Rolling window: ${recentCount}/${ROLLING_CAP} sprints in last ${ROLLING_WINDOW_HRS}h`);
+    }
+    catch { /* non-fatal */ }
+    return false;
+}
+// ── Sprint ID Injection ────────────────────────────────────────────────────
+function deriveSprintIdFromFilename(filename) {
+    // Extract sprint-NNN from path like sprints/sprint-064.json or sprints/sprint-064
+    const base = (0, path_1.basename)(filename, '.json');
+    // If it already matches sprint-NNN pattern, use it
+    if (/^sprint-\d+$/.test(base)) {
+        return base;
+    }
+    // Fallback: use the base name as-is
+    return base;
+}
+function injectSprintIdIntoTasks(sprint, sprintFilePath) {
+    // Determine sprint_id: use explicit field, or derive from filename
+    const sprintId = sprint.sprint_id || deriveSprintIdFromFilename(sprintFilePath);
+    // Inject sprint_id into each task
+    if (sprint.tasks && Array.isArray(sprint.tasks)) {
+        for (const task of sprint.tasks) {
+            task.sprint_id = sprintId;
+        }
+    }
+    return sprint;
+}
+// ── Schema Normalizer (S66-002) ──────────────────────────────────────────────
+// Maps CEO-authored sprint schema → orchestrator schema
+function normalizeTasks(tasks) {
+    return tasks.map((task) => ({
+        ...task,
+        context: task.context ?? task.description ?? '',
+        dependencies: task.dependencies ?? task.depends_on ?? [],
+        deliverables: task.deliverables ?? (task.file ? { code: [task.file] } : task.task_target ? { code: [task.task_target] } : { code: [] }),
+        agent: task.agent ?? 'coder',
+        type: task.type ?? 'feature',
+        priority: task.priority ?? 'medium',
+        status: task.status ?? 'pending',
+    }));
+}
+function writeActiveSprint(sprint) {
+    // Ensure logs directory exists
+    const logsDir = (0, path_1.join)(ROOT, 'logs');
+    if (!(0, fs_1.existsSync)(logsDir)) {
+        (0, fs_1.mkdirSync)(logsDir, { recursive: true });
+    }
+    // Write the modified sprint to ACTIVE file
+    (0, fs_1.writeFileSync)(ACTIVE, JSON.stringify(sprint, null, 2), 'utf8');
+    return ACTIVE;
+}
+// ── Main ────────────────────────────────────────────────────────────────────
+function extractSprintNumber(filename) {
+    // Extract numeric sprint ID: sprint-1501.json → 1501, sprint-TICKET-008-PROMO-05.json → -1
+    const match = (0, path_1.basename)(filename, '.json').match(/^sprint-(\d+)$/);
+    return match ? parseInt(match[1], 10) : -1;
+}
+// Statuses that override a "pending" local state — if Notion says any of these,
+// runner skips the sprint even if the local file claims pending tasks.
+// (Multi-session safety: prevents another Claude session reverting a local file
+// from causing the runner to re-execute paused/done work.)
+const NOTION_OVERRIDE_STATUSES = new Set(['skipped', 'blocked', 'done', 'done-manual', 'loop-stuck', 'rejected']);
+async function findPendingSprint() {
+    if (!(0, fs_1.existsSync)(SPRINTS))
+        return null;
+    const files = (0, fs_1.readdirSync)(SPRINTS)
+        .filter(f => f.endsWith('.json') && f !== 'ACTIVE_SPRINT.json')
+        .sort((a, b) => {
+        // Numeric sort: highest sprint number first (1506 > 1501 > 999 > 52)
+        // Non-numeric files (TICKET-*, ZZGODMAN-*) get -1, sorted last
+        return extractSprintNumber(b) - extractSprintNumber(a);
+    });
+    // Source-of-truth: query Notion ONCE per cron run, build status map.
+    // Fail-safe: if Notion is unreachable, fall back to local-only filtering (legacy behavior).
+    let notionStatuses = null;
+    try {
+        const { getAllNotionSprintStatuses } = await Promise.resolve().then(() => __importStar(require('./notion-direct')));
+        const result = await getAllNotionSprintStatuses();
+        if (result.ok && result.data) {
+            notionStatuses = result.data;
+            log(`Notion source-of-truth: ${notionStatuses.size} sprint statuses loaded`);
+        }
+        else {
+            log(`Notion query failed (${result.reason}) — falling back to local-only filtering`);
+        }
+    }
+    catch (err) {
+        log(`Notion module load failed (${err.message}) — falling back to local-only filtering`);
+    }
+    // Pre-load all sprint statuses for dependency resolution.
+    // TICKET-098: use loadSprintMerged so status comes from .swarm-state.
+    const allSprints = new Map();
+    for (const f of files) {
+        try {
+            allSprints.set(f.replace(/\.json$/, ''), (0, sprint_state_1.loadSprintMerged)((0, path_1.join)(SPRINTS, f)));
+        }
+        catch { /* skip unparseable */ }
+    }
+    for (const file of files) {
+        const filePath = (0, path_1.join)(SPRINTS, file);
+        try {
+            const sprint = allSprints.get(file.replace(/\.json$/, '')) || (0, sprint_state_1.loadSprintMerged)(filePath);
+            const hasPending = sprint.tasks?.some((t) => t.status === 'pending');
+            if (!hasPending)
+                continue;
+            // Notion source-of-truth check: if Notion says non-pending, respect it
+            const sprintId = file.replace(/\.json$/, '');
+            const notionStatus = notionStatuses?.get(sprintId);
+            if (notionStatus && NOTION_OVERRIDE_STATUSES.has(notionStatus)) {
+                log(`Skipped ${file}: Notion source-of-truth says '${notionStatus}' (overrides local pending)`);
+                continue;
+            }
+            // Dependency check: respect depends_on_sprint — if the upstream sprint
+            // has any non-terminal task, skip this one. Founder directive 2026-05-26:
+            // swarm must never deadlock on a sprint whose prereqs haven't shipped.
+            const depId = sprint.depends_on_sprint;
+            if (depId && typeof depId === 'string') {
+                const dep = allSprints.get(depId);
+                if (dep && dep.tasks) {
+                    const depPending = dep.tasks.some((t) => t.status === 'pending' || t.status === 'in_progress' || t.status === 'blocked');
+                    if (depPending) {
+                        log(`Skipped ${file}: depends_on_sprint '${depId}' still has unfinished tasks`);
+                        continue;
+                    }
+                }
+            }
+            log(`Selected sprint: ${file} (sprint #${extractSprintNumber(file)}${notionStatus ? `, notion=${notionStatus}` : ''})`);
+            return filePath;
+        }
+        catch {
+            continue;
+        }
+    }
+    return null;
+}
+// 2026-05-19 anti-burn: kill any orphan orchestrator from a previous run
+// before spawning a new one. PM2 cron_restart used to SIGKILL the parent but
+// detach the orchestrator child, which kept making API calls indefinitely.
+// Even with cron disabled now, defensive cleanup ensures one-shot manual runs
+// can't accidentally double-spawn.
+function killOrphanOrchestrators() {
+    try {
+        const { execSync } = require('node:child_process');
+        const out = execSync("pgrep -f 'orchestrate-agents-v2.ts' || true", { encoding: 'utf8' });
+        const pids = out.trim().split('\n').filter(Boolean).map((p) => parseInt(p, 10)).filter((p) => p > 0);
+        for (const pid of pids) {
+            if (pid === process.pid)
+                continue;
+            try {
+                process.kill(pid, 'SIGKILL');
+                log(`Killed orphan orchestrator PID ${pid}`);
+            }
+            catch { /* may already be dead */ }
+        }
+    }
+    catch { /* non-fatal */ }
+}
+// 2026-05-19 anti-burn: estimate today's LLM spend by scanning the orchestrator
+// log for "Response: …, N tokens" lines and pricing per model. If we're over
+// budget, refuse to spawn. Heuristic; mostly counts coder calls (supervisors
+// are also there but interleaved).
+function isOverDailyBudget() {
+    try {
+        const outLog = (0, path_1.join)(ROOT, 'logs', 'sprint-runner-out.log');
+        if (!(0, fs_1.existsSync)(outLog))
+            return false;
+        const today = new Date().toISOString().slice(0, 10);
+        const content = (0, fs_1.readFileSync)(outLog, 'utf8');
+        // TICKET-099 (c): cost model recalibrated 2026-05-27 from $5/M → $2/M
+        // blended. Original $5/M assumed Sonnet-heavy traffic. Reality (per recent
+        // sprints): ~60% DeepSeek ($0.30/M), ~30% Haiku ($3/M), ~10% Sonnet ($10/M)
+        // = 0.18 + 0.90 + 1.00 ≈ $2.08/M. Round down to $2/M for headroom margin.
+        // Old rate caused false-positive budget freezes (6M tokens × $5/M = $30
+        // tripped the cap when actual cost was ~$12).
+        let totalTokens = 0;
+        for (const line of content.split('\n')) {
+            if (!line.startsWith(today))
+                continue;
+            const m = line.match(/Response: [\d.]+s, (\d+) tokens/);
+            if (m)
+                totalTokens += parseInt(m[1], 10);
+        }
+        const usd = (totalTokens / 1_000_000) * 2;
+        if (usd > DAILY_TOKEN_BUDGET_USD) {
+            log(`Daily token budget exceeded: ~$${usd.toFixed(2)} of $${DAILY_TOKEN_BUDGET_USD} (${totalTokens.toLocaleString()} tokens). Refusing to spawn.`);
+            sendTelegram(`🚨 *Sprint Runner* — daily budget exceeded\\n\\n~$${usd.toFixed(2)} / $${DAILY_TOKEN_BUDGET_USD}.\\nResuming tomorrow.`);
+            return true;
+        }
+        log(`Daily token estimate: ~$${usd.toFixed(2)} of $${DAILY_TOKEN_BUDGET_USD}`);
+    }
+    catch { /* non-fatal */ }
+    return false;
+}
+// 2026-05-19 anti-burn: skip tasks that have already burned through
+// PER_TASK_LIFETIME_MAX_ATTEMPTS across all runs. The orchestrator's per-run
+// 10-attempt budget doesn't help if every run starts fresh and re-tries the
+// same failing task. We bump attempt_count in the source sprint file each
+// time a task gets executed; once a task hits the lifetime ceiling, the
+// runner marks it 'rejected-stuck' and moves on.
+function gateLifetimeAttempts(sprintPath) {
+    try {
+        // TICKET-098: read merged source+state so attempt_count comes from .swarm-state
+        const sprint = (0, sprint_state_1.loadSprintMerged)(sprintPath);
+        if (!Array.isArray(sprint?.tasks))
+            return false;
+        let mutated = false;
+        let stuckIds = [];
+        const { updateTaskStatus } = require('./sprint-state');
+        for (const t of sprint.tasks) {
+            if (t.status !== 'pending')
+                continue;
+            const count = t.attempt_count || 0;
+            if (count >= PER_TASK_LIFETIME_MAX_ATTEMPTS) {
+                t.status = 'rejected-stuck';
+                t.rejected_reason = `Exceeded ${PER_TASK_LIFETIME_MAX_ATTEMPTS} lifetime attempts; needs founder intervention (likely hand-port).`;
+                stuckIds.push(t.id);
+                mutated = true;
+                // Write through to .swarm-state instead of source
+                updateTaskStatus(sprintPath, t.id, 'rejected-stuck', count, t.rejected_reason);
+            }
+        }
+        if (mutated) {
+            log(`Marked ${stuckIds.length} task(s) as 'rejected-stuck' (lifetime cap): ${stuckIds.join(', ')}`);
+            sendTelegram(`⚠️ *Sprint Runner* — tasks hit lifetime cap\\n\\n${stuckIds.length} task(s) marked rejected-stuck:\\n${stuckIds.map(i => '• ' + i).join('\\n')}`);
+        }
+        // Return true if EVERY pending task is now stuck (no real work left)
+        const stillPending = sprint.tasks.filter((t) => t.status === 'pending').length;
+        return stillPending === 0;
+    }
+    catch {
+        return false;
+    }
+}
+// sprint-1566 F1: pre-flight work gate. Returns true iff the sprint has at
+// least one EXECUTABLE pending task — i.e. status='pending' AND the task's
+// agent is known (assigned + the agent dir exists). Composes with F2
+// agent_registry_validation which marks unknown-agent tasks as 'blocked'
+// before this check runs.
+//
+// Saves the bulk of waste on sprint-1556-style no-op runs where the
+// orchestrator's CEO/CTO meta-cycle burned 193K tokens analysing a sprint
+// that had no real work to do.
+function hasExecutableWork(sprintPath) {
+    try {
+        // TICKET-098: read merged source+state
+        const sprint = (0, sprint_state_1.loadSprintMerged)(sprintPath);
+        if (!Array.isArray(sprint?.tasks))
+            return false;
+        const known = (0, agent_registry_1.listKnownAgents)();
+        const executable = sprint.tasks.filter((t) => {
+            if (!t || t.status !== 'pending')
+                return false;
+            const agent = t.agent || 'coder'; // default per orchestrate-agents-v2.ts:2479
+            return known.has(agent);
+        });
+        if (executable.length === 0) {
+            // Diagnostic breakdown for the log so the founder can see WHY there's no work
+            const counts = {};
+            for (const t of sprint.tasks) {
+                const k = t?.status || 'unknown';
+                counts[k] = (counts[k] || 0) + 1;
+            }
+            log(`  task status breakdown: ${Object.entries(counts).map(([k, v]) => `${k}=${v}`).join(', ')}`);
+            return false;
+        }
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+// ─── TICKET-204: Stuck-Task Escalation gate ──────────────────────────────────
+// Atomic-merge helper: patch a task's DEFINITION fields (task_target, context)
+// in the SOURCE sprint file so the next orchestrator spawn picks up the change.
+function patchSourceTask(sprintPath, taskId, patch) {
+    try {
+        const raw = JSON.parse((0, fs_1.readFileSync)(sprintPath, 'utf-8'));
+        if (!Array.isArray(raw?.tasks))
+            return;
+        const task = raw.tasks.find((t) => t?.id === taskId);
+        if (!task)
+            return;
+        Object.assign(task, patch);
+        const tmp = `${sprintPath}.tmp`;
+        (0, fs_1.writeFileSync)(tmp, JSON.stringify(raw, null, 2));
+        require('fs').renameSync(tmp, sprintPath);
+    }
+    catch (e) {
+        log(`patchSourceTask(${taskId}) failed: ${(e?.message || '').slice(0, 120)}`);
+    }
+}
+// Atomic-merge helper: patch a task's RUNTIME entry (score_history) in
+// .swarm-state/<sprint>.json. Preserves the file's flat-vs-{tasks} shape.
+function patchStateTask(sprintPath, taskId, patch) {
+    try {
+        const stateFile = (0, path_1.join)(ENGINE_PATHS.swarmState, (0, path_1.basename)(sprintPath));
+        if (!(0, fs_1.existsSync)(stateFile))
+            return;
+        const raw = JSON.parse((0, fs_1.readFileSync)(stateFile, 'utf-8'));
+        const bag = raw && typeof raw === 'object' && raw.tasks && typeof raw.tasks === 'object' ? raw.tasks : raw;
+        if (!bag[taskId] || typeof bag[taskId] !== 'object')
+            return;
+        Object.assign(bag[taskId], patch);
+        const tmp = `${stateFile}.tmp`;
+        (0, fs_1.writeFileSync)(tmp, JSON.stringify(raw, null, 2));
+        require('fs').renameSync(tmp, stateFile);
+    }
+    catch (e) {
+        log(`patchStateTask(${taskId}) failed: ${(e?.message || '').slice(0, 120)}`);
+    }
+}
+// The orchestrator records a single `score` per task per run; the detector needs
+// a `score_history` series for its variance test. Append the latest score once
+// per attempt (idempotent: only when attempt_count exceeds the recorded length).
+function accumulateScoreHistory(sprintPath, taskId, entry) {
+    if (typeof entry?.score !== 'number')
+        return;
+    const attempt = entry.attempt_count ?? 0;
+    const hist = Array.isArray(entry.score_history) ? entry.score_history : [];
+    if (attempt <= hist.length)
+        return; // already recorded this attempt
+    const next = hist.concat(entry.score);
+    patchStateTask(sprintPath, taskId, { score_history: next });
+    entry.score_history = next; // keep in-memory copy consistent for the detector's file re-read
+}
+// Pre-dispatch escalation gate. For each pending task: accumulate score history,
+// run detectStuckPattern, and on a stuck verdict (kill switch absent) run a
+// synchronous CEO/CTO consult and apply the decision. See
+// docs/specs/stuck-task-escalation.md §5. Non-fatal: any failure logs and the
+// runner proceeds to normal dispatch.
+async function gateStuckTasks(sprintPath) {
+    try {
+        const { detectStuckPattern, escalateStuckTask, escalationPaused } = require('./stuck-handler');
+        if (escalationPaused()) {
+            log('Stuck-task escalation: paused (kill switch present) — skipping detector.');
+            return;
+        }
+        const sprintId = (0, path_1.basename)(sprintPath).replace(/\.json$/, '');
+        const sprint = (0, sprint_state_1.loadSprintMerged)(sprintPath);
+        if (!Array.isArray(sprint?.tasks))
+            return;
+        const { readState, updateTaskStatus } = require('./sprint-state');
+        const state = readState(sprintPath) || {};
+        for (const t of sprint.tasks) {
+            if (!t || t.status !== 'pending')
+                continue;
+            const entry = state[t.id];
+            if (!entry)
+                continue;
+            accumulateScoreHistory(sprintPath, t.id, entry); // writes score_history to .swarm-state before detect
+            const detection = detectStuckPattern(sprintId, t.id);
+            if (!detection.stuck)
+                continue;
+            log(`🛑 Stuck task: ${t.id} (${detection.reason}) scores=[${detection.scores.join(', ')}]. Escalating CEO/CTO consult...`);
+            const decision = await escalateStuckTask(sprintId, t.id, t.context || '', t.title || t.id, detection);
+            log(`   decision: ${decision.action} — ${(decision.reasoning || '').slice(0, 160)}`);
+            if (decision.action === 'bump_tier' && decision.new_tier) {
+                patchSourceTask(sprintPath, t.id, { task_target: decision.new_tier });
+                log(`   → bump_tier: ${t.id}.task_target → ${decision.new_tier}`);
+            }
+            else if (decision.action === 'rephrase_context' && decision.rephrased_context) {
+                patchSourceTask(sprintPath, t.id, { context: decision.rephrased_context });
+                log(`   → rephrase_context: ${t.id} context rewritten (${decision.rephrased_context.length} chars)`);
+            }
+            else if (decision.action === 'escalate_human') {
+                updateTaskStatus(sprintPath, t.id, 'awaiting_human', entry.attempt_count ?? 0, decision.reasoning);
+                sendTelegram(decision.telegram_message || `⚠️ *Sprint Runner* — task \`${t.id}\` escalated to human (stuck loop).`);
+                log(`   → escalate_human: ${t.id} status=awaiting_human, founder notified.`);
+            }
+            else {
+                log(`   → non-actionable decision for ${t.id} (action=${decision.action}); leaving pending.`);
+            }
+        }
+    }
+    catch (e) {
+        log(`gateStuckTasks failed (non-fatal): ${(e?.message || String(e)).slice(0, 200)}`);
+    }
+}
+// TICKET-202: read the active PACT mandate (pointer → mandate file). Returns null
+// when no mandate governance is in effect or the store is unreadable. The engine
+// reads the JSON store directly — no kognai-build dependency.
+function readActiveMandate() {
+    const pointer = (0, path_1.join)(ROOT, '.swarm-state', 'mandates', 'active.json');
+    if (!(0, fs_1.existsSync)(pointer))
+        return null;
+    try {
+        const id = JSON.parse((0, fs_1.readFileSync)(pointer, 'utf8')).mandate_id;
+        if (!id)
+            return null; // pointer cleared (e.g. after a revoke) → nothing active
+        const file = (0, path_1.join)(ROOT, '.swarm-state', 'mandates', `${id}.json`);
+        if (!(0, fs_1.existsSync)(file))
+            return null;
+        return { id: String(id), file, m: JSON.parse((0, fs_1.readFileSync)(file, 'utf8')) };
+    }
+    catch {
+        return null; // fail-open: a corrupt store must not wedge the swarm
+    }
+}
+// A signed mandate is the autonomy envelope. If the active mandate is revoked or
+// breached (budget/deadline), halt dispatch — the mandate-driven analogue of the
+// .swarm-state/dispatcher-paused kill switch. Fail-closed on a clearly
+// revoked/breached/over-budget/expired mandate; fail-open otherwise.
+function mandateEnvelopeBreached() {
+    const active = readActiveMandate();
+    if (!active)
+        return false;
+    const { id, m } = active;
+    const short = id.slice(0, 8);
+    let breach = null;
+    if (m.status === 'revoked')
+        breach = 'revoked by founder';
+    else if (m.status === 'breached')
+        breach = 'already breached';
+    else if (typeof m?.cost_envelope?.max_usdc === 'number' &&
+        Number(m?.burn?.usdc_consumed) > m.cost_envelope.max_usdc) {
+        breach = `budget: burn $${Number(m.burn.usdc_consumed).toFixed(4)} > cap $${m.cost_envelope.max_usdc.toFixed(4)}`;
+    }
+    else if (m.deadline) {
+        const d = Date.parse(m.deadline);
+        if (!Number.isNaN(d) && Date.now() > d)
+            breach = `deadline ${m.deadline} passed`;
+    }
+    if (breach) {
+        log(`Mandate ${short} envelope breach (${breach}) — halting autonomous dispatch.`);
+        sendTelegram(`⛔ *Mandate ${short}* envelope breach: ${breach}\\nAutonomous dispatch halted. Sign or extend a mandate to resume.`);
+        return true;
+    }
+    return false;
+}
+// TICKET-202: accrue a finished sprint's cost to the active mandate's burn. Mirrors
+// kognai-build's updateBurn but kept self-contained in the engine. Flips status to
+// 'breached' when cumulative burn crosses the max_usdc ceiling, so the NEXT dispatch
+// is gated by mandateEnvelopeBreached(). Non-fatal.
+function accrueActiveMandateBurn(costUsd, tasksCompleted) {
+    if (!(costUsd > 0))
+        return;
+    const active = readActiveMandate();
+    if (!active || active.m.status !== 'active')
+        return; // only accrue to a live mandate
+    const { id, file, m } = active;
+    try {
+        m.burn = m.burn || { usdc_consumed: 0, tasks_completed: 0, last_updated: '' };
+        m.burn.usdc_consumed = Number((Number(m.burn.usdc_consumed || 0) + costUsd).toFixed(6));
+        m.burn.tasks_completed = Number(m.burn.tasks_completed || 0) + Math.max(0, tasksCompleted);
+        m.burn.last_updated = new Date().toISOString();
+        const cap = m?.cost_envelope?.max_usdc;
+        if (typeof cap === 'number' && m.burn.usdc_consumed > cap) {
+            m.status = 'breached';
+            log(`Mandate ${id.slice(0, 8)} BREACHED: burn $${m.burn.usdc_consumed.toFixed(4)} > cap $${cap.toFixed(4)}.`);
+            sendTelegram(`⛔ *Mandate ${id.slice(0, 8)}* budget breached ($${m.burn.usdc_consumed.toFixed(4)} > $${cap.toFixed(4)}). Autonomous dispatch halts.`);
+        }
+        (0, fs_1.writeFileSync)(file, JSON.stringify(m, null, 2));
+        log(`Mandate ${id.slice(0, 8)} burn: $${m.burn.usdc_consumed.toFixed(4)}${typeof cap === 'number' ? ` / $${cap.toFixed(4)}` : ''} (${m.burn.tasks_completed} task(s)).`);
+    }
+    catch (e) {
+        log(`Mandate burn accrual failed (non-fatal): ${(e?.message || String(e)).slice(0, 120)}`);
+    }
+}
+// TICKET-202: cost + completed-task count of the run that just finished. Guards a
+// stale latest-run.json by requiring finished_at >= sinceMs (the spawn time).
+function readLastRunReport(sinceMs) {
+    const f = (0, path_1.join)(ROOT, 'reports', 'swarm-runs', 'latest-run.json');
+    if (!(0, fs_1.existsSync)(f))
+        return { cost: 0, tasksCompleted: 0 };
+    try {
+        const r = JSON.parse((0, fs_1.readFileSync)(f, 'utf8'));
+        const finished = Date.parse(r.finished_at);
+        if (!Number.isNaN(finished) && finished < sinceMs)
+            return { cost: 0, tasksCompleted: 0 };
+        return { cost: Number(r.total_cost_usd) || 0, tasksCompleted: Number(r?.summary?.done) || 0 };
+    }
+    catch {
+        return { cost: 0, tasksCompleted: 0 };
+    }
+}
+async function runSprintCycle(opts) {
+    if (isLocked()) {
+        log('Lock present — another runner active. Exiting.');
+        return;
+    }
+    if (isInCooldown())
+        return;
+    if (isRollingCapReached())
+        return;
+    if (isDailyCapReached())
+        return;
+    // Anti-burn hardening 2026-05-19
+    killOrphanOrchestrators();
+    if (isOverDailyBudget())
+        return;
+    // TICKET-202: respect the active PACT mandate envelope (revoked / budget / deadline).
+    if (mandateEnvelopeBreached())
+        return;
+    acquireLock();
+    log('Starting sprint runner...');
+    const sprintPath = await findPendingSprint();
+    if (!sprintPath) {
+        log('No pending sprints found.');
+        releaseLock();
+        return;
+    }
+    // TICKET-204: escalate stuck tasks BEFORE the lifetime-cap kill, so a low-variance
+    // sub-ceiling loop gets a CEO/CTO consult (bump_tier / rephrase_context / escalate_human)
+    // instead of silently burning attempts until the hard cap. Kill switch: .swarm-state/escalation-paused.
+    await gateStuckTasks(sprintPath);
+    if (gateLifetimeAttempts(sprintPath)) {
+        log(`All pending tasks in ${(0, path_1.basename)(sprintPath)} have hit lifetime cap. Releasing lock + exiting.`);
+        releaseLock();
+        return;
+    }
+    // sprint-1566 F2: validate agent assignments BEFORE spawn. Any task whose
+    // agent doesn't exist in agents/ + kognai-agents/ + workspace/agents/ (or
+    // the 'coder' pseudo) gets marked status='blocked' with a clear
+    // blocked_reason. Catches the 2026-05-19 "miner-or-founder" pattern that
+    // burned 193K tokens on CEO/CTO meta-analysis after the orchestrator
+    // silently soft-rejected the task.
+    const agentCheck = (0, agent_registry_1.validateSprintAgents)(sprintPath);
+    if (!agentCheck.ok) {
+        log(`⚠️  Agent validation: ${agentCheck.unknown_agents.length} unknown agent(s) in ${(0, path_1.basename)(sprintPath)}: ${agentCheck.unknown_agents.join(', ')}`);
+        log(`   ${agentCheck.affected_tasks.length} task(s) marked blocked: ${agentCheck.affected_tasks.join(', ')}`);
+        log(`   Founder: edit the task agent assignments to one of ${(0, agent_registry_1.listKnownAgents)().size} known agents + reset status to pending.`);
+        // Don't exit here — the sprint may still have other valid pending tasks.
+        // The preflight work gate (F1) below will check if there's any real work left.
+    }
+    // sprint-1566 F1: pre-flight work gate. If after lifetime-gate + agent-registry
+    // pruning there are NO executable pending tasks, skip the orchestrator spawn
+    // entirely. This is the single biggest waste-cutter: sprint-1556 on 2026-05-19
+    // burned 193K tokens running the full CEO/CTO meta-cycle on a sprint with
+    // 4/5 done + 1 task assigned to a non-existent agent (0 real work).
+    if (!hasExecutableWork(sprintPath)) {
+        log(`✗ Preflight work gate: no executable pending tasks in ${(0, path_1.basename)(sprintPath)}. Skipping orchestrator spawn.`);
+        log(`  (all tasks are done / blocked / rejected / assigned to unknown agents)`);
+        releaseLock();
+        return;
+    }
+    log(`Found pending sprint: ${sprintPath}`);
+    // TICKET-210: build the ACTIVE sprint from the MERGED view (source definition
+    // + .swarm-state status), NOT raw source. The source file holds every task at
+    // its authored status (usually 'pending'); reading it directly meant a sprint
+    // with ANY pending task re-ran ALL its tasks — including ones already 'done' in
+    // .swarm-state — re-generating shipped files and risking reversion of later
+    // fixes (observed live 2026-05-30: sprint-1618 re-ran completed libs and nearly
+    // reverted the TICKET-207 workspace.ts fix). The gates above already use
+    // loadSprintMerged; the ACTIVE write was the one path that bypassed state.
+    // The orchestrator skips status !== 'pending' (orchestrate-agents-v2:4045), so
+    // overlaying terminal statuses here makes it run only genuinely-pending work.
+    let sprint;
+    try {
+        sprint = (0, sprint_state_1.loadSprintMerged)(sprintPath);
+    }
+    catch (err) {
+        log(`Failed to read/merge sprint JSON: ${err}`);
+        releaseLock();
+        return;
+    }
+    // TICKET-210: the merged view carries terminal statuses from .swarm-state. The
+    // orchestrator only runs status === 'pending', so DONE/skip-terminal tasks are
+    // now correctly excluded (the bug). But 'rejected' / 'in_progress' tasks must
+    // stay RUNNABLE — the bounded retry loop (capped by gateLifetimeAttempts, which
+    // already promoted over-cap tasks to 'rejected-stuck') depends on them being
+    // re-dispatched. Normalize only those retryable states back to 'pending';
+    // leave done / rejected-stuck / awaiting_human / blocked / skipped as-is so they
+    // are skipped this run.
+    const RUN_AS_PENDING = new Set(['rejected', 'in_progress']);
+    if (Array.isArray(sprint.tasks)) {
+        for (const t of sprint.tasks) {
+            if (RUN_AS_PENDING.has(t.status))
+                t.status = 'pending';
+        }
+    }
+    // Inject sprint_id into each task
+    const sprintWithIds = injectSprintIdIntoTasks(sprint, sprintPath);
+    log(`Injected sprint_id into ${sprintWithIds.tasks?.length || 0} tasks`);
+    // Normalize CEO schema → orchestrator schema (S66-002)
+    sprintWithIds.tasks = normalizeTasks(sprintWithIds.tasks);
+    log(`Normalized ${sprintWithIds.tasks.length} tasks (CEO schema → orchestrator schema)`);
+    // TICKET-202: if a PACT mandate governs this session, stamp the sprint with its
+    // id (traceability) so its cost can be accrued to that envelope after the run.
+    const governingMandate = readActiveMandate();
+    if (governingMandate) {
+        sprintWithIds.mandate_id = governingMandate.id;
+        log(`Sprint governed by mandate ${governingMandate.id.slice(0, 8)} (envelope active).`);
+    }
+    // Write modified sprint to ACTIVE file
+    const activePath = writeActiveSprint(sprintWithIds);
+    log(`Written modified sprint to: ${activePath}`);
+    // Spawn the product orchestrator script (path supplied by the thin entry).
+    const orchestratorPath = opts.orchestratorScript;
+    const start = Date.now();
+    sendTelegram(`🚀 *Sprint Runner* started\\n\\nSprint: \`${(0, path_1.basename)(sprintPath)}\`\\nTasks: ${sprintWithIds.tasks?.length || 0}`);
+    // 2026-05-19 anti-burn: hard timeout shorter than the disabled cron gap so
+    // overlapping orphans can't accumulate even if cron ever gets re-armed
+    const orchestratorTimeoutMs = PER_RUN_HARD_TIMEOUT_MIN * 60 * 1000;
+    log(`Spawning orchestrator with ${PER_RUN_HARD_TIMEOUT_MIN}-min hard timeout`);
+    const result = (0, child_process_1.spawnSync)('npx', ['ts-node', orchestratorPath, activePath], {
+        stdio: 'inherit',
+        cwd: ROOT,
+        env: { ...process.env },
+        timeout: orchestratorTimeoutMs,
+        killSignal: 'SIGKILL', // SIGTERM ignored when blocked on subprocess I/O
+    });
+    const elapsed = Math.round((Date.now() - start) / 60000);
+    const status = result.status === 0 ? '✅ Completed' : `❌ Failed (exit ${result.status})`;
+    log(`Orchestrator finished: ${status} (${elapsed} min)`);
+    // Founder directive 2026-05-26: on non-zero exit, write an incident record
+    // and emit an event for CTO + CEO to investigate autonomously. The swarm
+    // should never wait for human triage to recover.
+    if (result.status !== 0) {
+        try {
+            writeIncident(sprintPath, result.status ?? -1, elapsed);
+        }
+        catch (e) {
+            log(`incident write failed: ${e.message}`);
+        }
+    }
+    // TICKET-202: accrue this sprint's cost to the active mandate's burn envelope.
+    // Flips the mandate to 'breached' if cumulative burn crosses max_usdc, which the
+    // next run's mandateEnvelopeBreached() gate then halts on.
+    const runReport = readLastRunReport(start);
+    accrueActiveMandateBurn(runReport.cost, runReport.tasksCompleted);
+    setCooldown(); // Rate limiter: enforce gap before next sprint
+    sendTelegram(`🏁 *Sprint Runner* finished\\n\\n${status}\\nDuration: ${elapsed} min\\nNext sprint in: ${COOLDOWN_MINUTES} min`);
+    // TICKET-098: mirror task statuses from ACTIVE → .swarm-state/<sprint-id>.json
+    // (gitignored). Previously wrote to committed source sprint file, which was
+    // vulnerable to git operations clobbering state (TICKET-095 push-with-rebase
+    // catastrophically demonstrated this). State is now isolated from git.
+    try {
+        if ((0, fs_1.existsSync)(ACTIVE) && (0, fs_1.existsSync)(sprintPath)) {
+            const activeRaw = JSON.parse((0, fs_1.readFileSync)(ACTIVE, 'utf8'));
+            if (Array.isArray(activeRaw.tasks)) {
+                // Bump attempt_count for tasks whose status changed during this run.
+                // Read prior state to compute the diff (orchestrator's persistTaskStatus
+                // wrote ACTIVE; we increment attempt_count here for tasks that moved
+                // off 'pending').
+                const { readState } = require('./sprint-state');
+                const priorState = readState(sprintPath);
+                const tasksWithAttempts = activeRaw.tasks.map((t) => {
+                    if (!t || !t.id || !t.status)
+                        return t;
+                    const prior = priorState[t.id];
+                    const priorStatus = prior?.status ?? 'pending';
+                    const priorAttempts = prior?.attempt_count ?? 0;
+                    // Bump iff status changed AND new status isn't 'pending'
+                    const bump = priorStatus !== t.status && t.status !== 'pending';
+                    return {
+                        ...t,
+                        attempt_count: bump ? priorAttempts + 1 : (t.attempt_count ?? priorAttempts),
+                    };
+                });
+                const { updates, attempted } = (0, sprint_state_1.applyActiveTasksToState)(sprintPath, tasksWithAttempts);
+                if (updates > 0 || attempted > 0) {
+                    log(`Synced ${updates} status update(s) + ${attempted} attempt_count bump(s) from ACTIVE → .swarm-state/${(0, path_1.basename)(sprintPath)}`);
+                }
+                // Founder fix 2026-05-27: persist decomposer-injected split sub-tasks
+                // back to the source sprint definition so they survive ACTIVE cleanup.
+                // The atomicity pre-flight gate (CTO-20260528-002) auto-splits
+                // multi-file tasks via routeToDecomposer; those splits were being
+                // injected only into ACTIVE, then wiped at sprint-end → 0 ship.
+                // Fix: detect injected tasks (have `parent_task_id` field set) that
+                // aren't yet in the source sprint file, and append them. Tasks are
+                // definition-level, not state — they belong in the committed source.
+                try {
+                    const sourceRaw = JSON.parse((0, fs_1.readFileSync)(sprintPath, 'utf8'));
+                    if (Array.isArray(sourceRaw.tasks)) {
+                        const sourceIds = new Set(sourceRaw.tasks.map((t) => t?.id));
+                        const newSplitTasks = activeRaw.tasks.filter((t) => t && t.id && !sourceIds.has(t.id) && t.parent_task_id);
+                        if (newSplitTasks.length > 0) {
+                            // Strip per-run runtime fields (status / attempt_count) — the
+                            // source file is definition only; status lives in .swarm-state.
+                            const cleaned = newSplitTasks.map((t) => {
+                                const { status: _s, attempt_count: _a, rejected_reason: _r, ...defn } = t;
+                                return { ...defn, status: 'pending', attempt_count: 0 };
+                            });
+                            sourceRaw.tasks.push(...cleaned);
+                            // Atomic write (tmp + rename) — matches the sprint-state pattern.
+                            const tmp = `${sprintPath}.tmp.${process.pid}`;
+                            require('fs').writeFileSync(tmp, JSON.stringify(sourceRaw, null, 2));
+                            require('fs').renameSync(tmp, sprintPath);
+                            log(`Persisted ${newSplitTasks.length} decomposer-split sub-task(s) back to ${(0, path_1.basename)(sprintPath)} (survive ACTIVE cleanup)`);
+                        }
+                    }
+                }
+                catch (e) {
+                    log(`WARN: failed to persist split sub-tasks to source: ${(e?.message || '').substring(0, 200)}`);
+                }
+            }
+        }
+    }
+    catch (e) {
+        log(`WARN: failed to sync ACTIVE → .swarm-state: ${(e?.message || '').substring(0, 200)}`);
+    }
+    // TICKET-206: forensic git-log recovery for tasks that shipped past the kill
+    // signal. When the orchestrator hits the hard timeout, in-flight tasks may
+    // have completed their `git commit` (OS-atomic) before persistTaskStatus could
+    // fire — so .swarm-state shows them as pending even though commits landed on
+    // origin/main. This pass scans git log since the cron start for
+    // `feat(coder): <task_id>` matches and flips matched pending tasks to done
+    // with a recovered_from_git_log marker. Live incident 2026-05-29:
+    // knowledge_lib (0454c341b at 15:39) + memory_lib (c60b32b0b at 15:42) shipped
+    // but state showed pending after the 15:35 kill.
+    try {
+        const cronStartIso = new Date(start).toISOString();
+        const { execSync } = require('child_process');
+        const commitMsgs = execSync(`git log --since='${cronStartIso}' --pretty=format:'%s' origin/main`, { cwd: ROOT, encoding: 'utf-8', timeout: 10000 }).split('\n').filter(Boolean);
+        if (commitMsgs.length > 0) {
+            const { readState, updateTaskStatus } = require('./sprint-state');
+            const state = readState(sprintPath);
+            const pendingIds = Object.entries(state)
+                .filter(([_, v]) => v?.status === 'pending')
+                .map(([id]) => id);
+            const recovered = [];
+            for (const id of pendingIds) {
+                // Match `feat(coder): <id>` or `feat(coder): <id>-A` (auto-decomposer split)
+                const escaped = id.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+                const re = new RegExp(`feat\\(coder\\):\\s*${escaped}(\\b|-)`);
+                if (commitMsgs.some((m) => re.test(m))) {
+                    updateTaskStatus(sprintPath, id, 'done', state[id]?.attempt_count ?? 1);
+                    recovered.push(id);
+                }
+            }
+            if (recovered.length > 0) {
+                log(`Forensic recovery: ${recovered.length} task(s) marked done from git log: ${recovered.join(', ')}`);
+            }
+        }
+    }
+    catch (e) {
+        log(`forensic recovery failed (non-fatal): ${(e?.message || '').substring(0, 200)}`);
+    }
+    // Clean up ACTIVE file after run
+    try {
+        if ((0, fs_1.existsSync)(ACTIVE)) {
+            (0, fs_1.unlinkSync)(ACTIVE);
+            log('Cleaned up ACTIVE sprint file');
+        }
+    }
+    catch {
+        // non-fatal
+    }
+    // TICKET-201: post-sprint hook (e.g. dispatch-approved-proposals).
+    // Supplied by the product entry so core stays product-agnostic.
+    try {
+        opts.postSprintHook?.();
+    }
+    catch (e) {
+        log(`WARN: post-sprint hook failed (non-fatal): ${(e?.message || String(e)).substring(0, 200)}`);
+    }
+    releaseLock();
+}