@kynver-app/runtime 0.1.106 → 0.1.112

package/dist/cli.js

@@ -175,7 +175,11 @@ function scrubWorkerEnv(env) {
 
 // src/git.ts
 function git(cwd, args, options = {}) {
-  const res = spawnSync("git", args, { cwd, encoding: "utf8" });
+  const res = spawnSync(
+    "git",
+    args,
+    hiddenSpawnOptions({ cwd, encoding: "utf8" })
+  );
   if (res.status !== 0 && !options.allowFailure) {
     const message = `git ${args.join(" ")} failed: ${res.stderr || res.stdout}`;
     if (options.throwError) throw new Error(message);
@@ -191,7 +195,11 @@ function gitStatusShort(worktreePath) {
 }
 function gitCapture(cwd, args) {
   try {
-    const res = spawnSync("git", args, { cwd, encoding: "utf8" });
+    const res = spawnSync(
+      "git",
+      args,
+      hiddenSpawnOptions({ cwd, encoding: "utf8" })
+    );
     return {
       status: res.status,
       stdout: res.stdout || "",
@@ -5648,32 +5656,98 @@ function workerStatus(args) {
   writeJson(path19.join(worker.workerDir, "last-status.json"), status);
   console.log(JSON.stringify(status, null, 2));
 }
+function buildWorkerListDrilldownCommands(runId) {
+  return {
+    full: `kynver worker list --run ${runId} --full`,
+    blocked: `kynver worker list --run ${runId} --blocked`,
+    running: `kynver worker list --run ${runId} --running`,
+    task: `kynver worker list --run ${runId} --task <task-id>`,
+    worker: `kynver worker list --run ${runId} --worker <worker>`,
+    runFull: `kynver run status --run ${runId} --full`,
+    workerFull: `kynver worker status --run ${runId} --name <worker>`,
+    workerTail: `kynver worker tail --run ${runId} --name <worker> --lines 80`
+  };
+}
+function asOptionalArg(value) {
+  if (typeof value !== "string") return void 0;
+  const trimmed = value.trim();
+  return trimmed.length ? trimmed : void 0;
+}
+function activeWorkerFilters(args) {
+  const filters = {};
+  if (args.blocked === true || args.blocked === "true") filters.blocked = true;
+  if (args.running === true || args.running === "true") filters.running = true;
+  const task = asOptionalArg(args.task ?? args.taskId);
+  if (task) filters.task = task;
+  const worker = asOptionalArg(args.worker ?? args.name);
+  if (worker) filters.worker = worker;
+  const status = asOptionalArg(args.status);
+  if (status) filters.status = status;
+  return filters;
+}
+function workerMatchesFilters(worker, filters) {
+  if (filters.blocked) {
+    const attention = typeof worker.attention === "string" ? worker.attention : "";
+    const status = typeof worker.status === "string" ? worker.status : "";
+    if (!(attention === "blocked" || attention === "needs_attention" || attention === "stale" || status === "blocked")) {
+      return false;
+    }
+  }
+  if (filters.running) {
+    if (!(worker.status === "running" && worker.attention !== "blocked" && worker.attention !== "needs_attention")) {
+      return false;
+    }
+  }
+  if (typeof filters.task === "string" && worker.taskId !== filters.task) return false;
+  if (typeof filters.worker === "string" && worker.worker !== filters.worker) return false;
+  if (typeof filters.status === "string" && worker.status !== filters.status) return false;
+  return true;
+}
+function applyWorkerFilters(board, args) {
+  const filters = activeWorkerFilters(args);
+  if (Object.keys(filters).length === 0) return board;
+  const workers = board.workers.filter((worker) => workerMatchesFilters(worker, filters));
+  const filtered = {
+    ...board,
+    workerCount: workers.length,
+    needsAttention: workers.filter((w) => w.attention && w.attention !== "ok" && w.attention !== "done").map((w) => w.worker),
+    workers,
+    activeFilters: filters
+  };
+  if (board.summary) {
+    filtered.summary = {
+      statusCounts: countBy(workers, "status"),
+      attentionCounts: countBy(workers, "attention"),
+      lifecycleCounts: countBy(workers, "lifecycleStage")
+    };
+  }
+  if (board.controller) filtered.controller = buildControllerSummary(workers);
+  return filtered;
+}
 function workerList(args) {
   const runId = resolveRunTargetArg(args);
-  const explicitCompact = args.compact === true || args.compact === "true";
   const explicitFull = args.full === true || args.full === "true";
-  const run = loadRun(runId);
-  const workerCount = Object.keys(run.workers || {}).length;
-  const compact = explicitCompact || !explicitFull && workerCount > 100;
-  const board = compact ? buildCompactRunBoard(runId) : buildRunBoard(runId);
-  const autoCompact = compact && !explicitCompact;
-  const outputWorkers = autoCompact ? board.workers.filter((worker) => worker.attention && worker.attention !== "done" && worker.attention !== "ok") : board.workers;
+  const board = applyWorkerFilters(explicitFull ? buildRunBoard(runId) : buildCompactRunBoard(runId), args);
+  const outputWorkers = board.workers;
   console.log(
     JSON.stringify(
       {
         runId: board.runId,
         status: board.status,
+        projection: explicitFull ? "full" : "compact",
         workerCount: board.workerCount,
-        ...autoCompact ? {
-          compact: true,
-          compactReason: "large-worker-board",
-          omittedWorkerCount: board.workers.length - outputWorkers.length,
-          fullCommand: `kynver worker list --run ${runId} --json --full`,
-          compactCommand: `kynver worker list --run ${runId} --json --compact`
+        ...board.activeFilters ? { activeFilters: board.activeFilters } : {},
+        ...!explicitFull ? {
+          resultContract: {
+            projection: "compact",
+            rawWorkerPayloadsOmitted: true,
+            deepDetailAvailableVia: ["--full", "worker status", "worker tail", "run status --full"]
+          },
+          drilldownCommands: buildWorkerListDrilldownCommands(runId)
         } : {},
         needsAttention: board.needsAttention,
-        ...compact && "summary" in board ? { summary: board.summary } : {},
-        ...compact && "controller" in board ? { controller: board.controller } : {},
+        ..."summary" in board ? { summary: board.summary } : {},
+        ..."controller" in board ? { controller: board.controller } : {},
         workers: outputWorkers
       },
       null,
@@ -5941,9 +6015,33 @@ async function publishHarnessBoardSnapshot(args, source) {
     authRefreshFailure: res.authRefreshFailure
   };
 }
+function buildRunStatusDrilldownCommands(runId) {
+  return {
+    full: `kynver run status --run ${runId} --full`,
+    blocked: `kynver status --run ${runId} --blocked`,
+    running: `kynver status --run ${runId} --running`,
+    task: `kynver status --run ${runId} --task <task-id>`,
+    worker: `kynver status --run ${runId} --worker <worker>`,
+    workersFull: `kynver worker list --run ${runId} --full`,
+    workerFull: `kynver worker status --run ${runId} --name <worker>`,
+    workerTail: `kynver worker tail --run ${runId} --name <worker> --lines 80`,
+    monitorTick: `kynver monitor status --run ${runId} --tick`
+  };
+}
 function runStatus(args) {
-  const compact = args.compact === true || args.compact === "true";
-  const board = compact ? buildCompactRunBoard(resolveRunTargetArg(args)) : buildRunBoard(resolveRunTargetArg(args));
+  const runId = resolveRunTargetArg(args);
+  const explicitFull = args.full === true || args.full === "true";
+  const board = applyWorkerFilters(explicitFull ? buildRunBoard(runId) : buildCompactRunBoard(runId), args);
+  board.projection = explicitFull ? "full" : "compact";
+  if (!explicitFull) {
+    board.resultContract = {
+      projection: "compact",
+      rawWorkerPayloadsOmitted: true,
+      omittedWorkerFields: ["finalResult", "changedFiles", "gitAncestry", "completionResponse", "stdout/stderr tails"],
+      deepDetailAvailableVia: ["--full", "worker status", "worker tail", "monitor status --tick"]
+    };
+    board.drilldownCommands = buildRunStatusDrilldownCommands(runId);
+  }
   console.log(JSON.stringify(board, null, 2));
 }
 function tailWorker(args) {
@@ -7038,6 +7136,344 @@ async function releaseDispatchClaimAfterSpawnFailure(input) {
   };
 }
 
+// src/landing/land-pr.ts
+import { spawnSync as spawnSync5 } from "node:child_process";
+
+// src/landing/cli-auth.ts
+import { spawnSync as spawnSync4 } from "node:child_process";
+function ensureGitHubTokenFromCliAuth() {
+  if (process.env.GITHUB_TOKEN?.trim() || process.env.GH_TOKEN?.trim()) {
+    return {
+      source: "env",
+      configured: true,
+      reason: "GitHub token already configured in environment"
+    };
+  }
+  const result = spawnSync4("gh", ["auth", "token"], {
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+  if (result.status !== 0) {
+    const reason = typeof result.stderr === "string" && result.stderr.trim() ? result.stderr.trim() : "gh auth token failed; run `gh auth login` on this machine";
+    return { source: "missing", configured: false, reason };
+  }
+  const token = typeof result.stdout === "string" ? result.stdout.trim() : "";
+  if (!token) {
+    return {
+      source: "missing",
+      configured: false,
+      reason: "gh auth token returned an empty token; run `gh auth login` on this machine"
+    };
+  }
+  process.env.GH_TOKEN = token;
+  return {
+    source: "gh-cli",
+    configured: true,
+    reason: "Using local GitHub CLI auth for daemon land_pr merge"
+  };
+}
+
+// src/landing/land-pr.ts
+var SUCCESSFUL_CHECK_CONCLUSIONS = /* @__PURE__ */ new Set(["SUCCESS", "SKIPPED", "NEUTRAL"]);
+var READY_MERGE_STATES = /* @__PURE__ */ new Set(["CLEAN", "HAS_HOOKS"]);
+function repoArgs(repo) {
+  return repo?.trim() ? ["--repo", repo.trim()] : [];
+}
+function repoFromPrUrl(prUrl) {
+  const m = /github\.com\/([^/]+)\/([^/]+)\/pull\/\d+/i.exec(prUrl.trim());
+  return m ? `${m[1]}/${m[2]}` : null;
+}
+function ghJson(exec, cwd, args) {
+  const res = exec.gh(cwd, args);
+  if (res.status !== 0) {
+    throw new Error(res.stderr || res.stdout || `gh ${args.join(" ")} failed`);
+  }
+  return JSON.parse(res.stdout || "{}");
+}
+function checkName(check3) {
+  return typeof check3.name === "string" && check3.name || typeof check3.context === "string" && check3.context || typeof check3.workflowName === "string" && check3.workflowName || "unknown check";
+}
+function classifyChecks(statusCheckRollup) {
+  const checks = Array.isArray(statusCheckRollup) ? statusCheckRollup : [];
+  const pending = [];
+  const failed = [];
+  for (const raw of checks) {
+    const check3 = raw && typeof raw === "object" ? raw : {};
+    const conclusion = typeof check3.conclusion === "string" ? check3.conclusion.toUpperCase() : "";
+    const status = typeof check3.status === "string" ? check3.status.toUpperCase() : "";
+    const state = typeof check3.state === "string" ? check3.state.toUpperCase() : "";
+    if (conclusion && SUCCESSFUL_CHECK_CONCLUSIONS.has(conclusion)) continue;
+    if (conclusion) {
+      failed.push(`${checkName(check3)}=${conclusion}`);
+      continue;
+    }
+    if (state && SUCCESSFUL_CHECK_CONCLUSIONS.has(state)) continue;
+    if (state && state !== "PENDING") {
+      failed.push(`${checkName(check3)}=${state}`);
+      continue;
+    }
+    if (state === "PENDING") {
+      pending.push(`${checkName(check3)}=${state}`);
+      continue;
+    }
+    if (status && status !== "COMPLETED") {
+      pending.push(`${checkName(check3)}=${status}`);
+      continue;
+    }
+    pending.push(`${checkName(check3)}=PENDING`);
+  }
+  return { pending, failed };
+}
+function vercelCheckSuccess(statusCheckRollup) {
+  const checks = Array.isArray(statusCheckRollup) ? statusCheckRollup : [];
+  return checks.some((raw) => {
+    const check3 = raw && typeof raw === "object" ? raw : {};
+    const name = typeof check3.name === "string" && check3.name || typeof check3.context === "string" && check3.context || "";
+    const conclusion = typeof check3.conclusion === "string" ? check3.conclusion.toUpperCase() : "";
+    const state = typeof check3.state === "string" ? check3.state.toUpperCase() : "";
+    return /^vercel/i.test(name) && (conclusion === "SUCCESS" || state === "SUCCESS");
+  });
+}
+var STRUCTURED_SECTION_RE = /^##\s*(test\s*plan|verification|test\s*evidence|verify)\b/im;
+var LOCAL_VERIFICATION_RE = /typecheck|npm run (test|build|typecheck)|vitest|tsc\b|verify-pr-local|local verify|local-verify|tests? (pass|green)|build green|node --test/i;
+var DOCS_TITLE_RE = /^docs[(:]/i;
+var DOCS_BODY_RE = /docs[- ]only|documentation only|no[- ]code change|no code changes|low[- ]risk|plan tracker only|markdown only/i;
+function runtimeVerificationEvidenceSufficient(input) {
+  const title = typeof input.title === "string" ? input.title : "";
+  const body = typeof input.body === "string" ? input.body : "";
+  const docsLowRisk = DOCS_TITLE_RE.test(title) || DOCS_BODY_RE.test(body);
+  const structuredSection = STRUCTURED_SECTION_RE.test(body);
+  const localVerification = LOCAL_VERIFICATION_RE.test(body);
+  return docsLowRisk || structuredSection || localVerification || input.vercelCheckSuccess === true;
+}
+function assertVerificationEvidence(pr) {
+  const sufficient = runtimeVerificationEvidenceSufficient({
+    title: pr.title,
+    body: pr.body,
+    vercelCheckSuccess: vercelCheckSuccess(pr.statusCheckRollup)
+  });
+  if (sufficient) return;
+  throw new Error(
+    `PR #${pr.number} lacks landing verification evidence \u2014 add ## Test plan / ## Verification with local commands, Vercel preview, or docs/no-code rationale`
+  );
+}
+function assertLandingReady(pr) {
+  if (pr.state !== "OPEN") throw new Error(`PR #${pr.number} is ${pr.state}, not OPEN`);
+  if (pr.isDraft) throw new Error(`PR #${pr.number} is still a draft`);
+  if (!READY_MERGE_STATES.has(pr.mergeStateStatus)) {
+    throw new Error(`PR #${pr.number} mergeStateStatus is ${pr.mergeStateStatus}`);
+  }
+  const checks = classifyChecks(pr.statusCheckRollup);
+  if (checks.failed.length > 0) {
+    throw new Error(`PR #${pr.number} has failing checks: ${checks.failed.join(", ")}`);
+  }
+  if (checks.pending.length > 0) {
+    throw new Error(`PR #${pr.number} has pending checks: ${checks.pending.join(", ")}`);
+  }
+  assertVerificationEvidence(pr);
+}
+function landingReadinessError(pr) {
+  try {
+    assertLandingReady(pr);
+    return null;
+  } catch (err) {
+    return err instanceof Error ? err.message : String(err);
+  }
+}
+function deleteRemoteBranch(exec, cwd, repo, branch) {
+  if (!branch?.trim()) return;
+  const refPath = encodeURI(`heads/${branch}`);
+  exec.gh(cwd, ["api", "-X", "DELETE", `repos/${repo}/git/refs/${refPath}`]);
+}
+function resolveRepo(exec, cwd, repo) {
+  if (repo?.trim()) return repo.trim();
+  const res = exec.gh(cwd, ["repo", "view", "--json", "nameWithOwner"]);
+  if (res.status !== 0) throw new Error(res.stderr || "Could not resolve GitHub repo");
+  const parsed = JSON.parse(res.stdout || "{}");
+  if (!parsed.nameWithOwner) throw new Error("Could not resolve GitHub repo");
+  return parsed.nameWithOwner;
+}
+function removeBranchWorktrees(cwd, branch) {
+  if (!branch?.trim()) return;
+  const list = spawnSync5("git", ["worktree", "list", "--porcelain"], {
+    cwd,
+    encoding: "utf8"
+  });
+  if (list.status !== 0) return;
+  const lines = String(list.stdout || "").split(/\r?\n/);
+  let currentPath = null;
+  let currentBranch = null;
+  for (const line of lines) {
+    if (line.startsWith("worktree ")) {
+      currentPath = line.slice("worktree ".length).trim();
+      currentBranch = null;
+      continue;
+    }
+    if (line.startsWith("branch ") && currentPath) {
+      currentBranch = line.slice("branch ".length).trim();
+      if (currentBranch.endsWith(`/${branch}`)) {
+        spawnSync5("git", ["worktree", "remove", "--force", currentPath], {
+          cwd,
+          encoding: "utf8"
+        });
+      }
+    }
+  }
+}
+async function executeLandPrMerge(input) {
+  const cwd = input.cwd ?? process.cwd();
+  const exec = input.exec ?? defaultPrHandoffExec;
+  const prTarget = input.prUrl.trim();
+  if (!prTarget) throw new Error("prUrl is required");
+  const auth = ensureGitHubTokenFromCliAuth();
+  if (!auth.configured) {
+    return {
+      prUrl: prTarget,
+      outcome: "blocked",
+      reason: auth.reason
+    };
+  }
+  const before = ghJson(exec, cwd, [
+    "pr",
+    "view",
+    prTarget,
+    ...repoArgs(input.repo),
+    "--json",
+    [
+      "number",
+      "url",
+      "title",
+      "body",
+      "state",
+      "isDraft",
+      "mergeStateStatus",
+      "statusCheckRollup",
+      "headRefName",
+      "mergedAt",
+      "mergeCommit"
+    ].join(",")
+  ]);
+  if (before.state === "MERGED" || before.mergedAt) {
+    return {
+      prUrl: before.url || prTarget,
+      outcome: "skipped",
+      mergeCommit: before.mergeCommit?.oid ?? null,
+      reason: `PR #${before.number} is already merged \u2014 land_pr no-op (redelivery)`
+    };
+  }
+  const notReadyReason = landingReadinessError(before);
+  if (notReadyReason) {
+    if (input.skipNotReady) {
+      return {
+        prUrl: before.url || prTarget,
+        outcome: "skipped",
+        reason: notReadyReason
+      };
+    }
+    return {
+      prUrl: before.url || prTarget,
+      outcome: "blocked",
+      reason: notReadyReason
+    };
+  }
+  if (input.dryRun) {
+    return {
+      prUrl: before.url || prTarget,
+      outcome: "skipped",
+      reason: "dry-run: PR is ready to merge"
+    };
+  }
+  const target = String(before.number);
+  const mergeRes = exec.gh(cwd, [
+    "pr",
+    "merge",
+    target,
+    ...repoArgs(input.repo),
+    "--squash"
+  ]);
+  if (mergeRes.status !== 0) {
+    return {
+      prUrl: before.url || prTarget,
+      outcome: "blocked",
+      reason: mergeRes.stderr || mergeRes.stdout || "gh pr merge failed"
+    };
+  }
+  const after = ghJson(exec, cwd, [
+    "pr",
+    "view",
+    target,
+    ...repoArgs(input.repo),
+    "--json",
+    "number,url,mergedAt,mergeCommit,state"
+  ]);
+  if (after.state !== "MERGED" && !after.mergedAt) {
+    return {
+      prUrl: after.url || before.url || prTarget,
+      outcome: "blocked",
+      reason: `PR #${after.number} did not verify as merged after gh pr merge`
+    };
+  }
+  const repo = resolveRepo(exec, cwd, input.repo);
+  deleteRemoteBranch(exec, cwd, repo, before.headRefName);
+  removeBranchWorktrees(cwd, before.headRefName);
+  const mergeCommit = after.mergeCommit?.oid ?? null;
+  return {
+    prUrl: after.url || before.url || prTarget,
+    outcome: "merged",
+    mergeCommit,
+    reason: `Daemon land_pr merged PR #${after.number}`
+  };
+}
+
+// src/landing/land-pr-completion-post.ts
+async function postLandPrHarnessCompletion(input) {
+  const secret = await resolveCallbackSecretWithMint(input.secret, input.agentOsId, {
+    baseUrl: input.baseUrl
+  });
+  const taskId = String(input.task.id);
+  const url = `${input.baseUrl}/api/agent-os/by-id/${encodeURIComponent(input.agentOsId)}/harness/completion`;
+  const finishedAt = (/* @__PURE__ */ new Date()).toISOString();
+  const body = {
+    source: "kynver-harness",
+    agentOsId: input.agentOsId,
+    runId: input.runId,
+    workerName: `land-pr-${taskId}`,
+    taskId,
+    leaseToken: input.task.leaseToken ?? null,
+    startedAt: finishedAt,
+    finishedAt,
+    status: {
+      finalResult: input.report,
+      prUrl: input.report.prUrl,
+      summary: input.report.reason,
+      leaseToken: input.task.leaseToken ?? null
+    },
+    workerInjection: null
+  };
+  const result = await postJsonWithCredentialRefresh(url, secret, body, {
+    agentOsId: input.agentOsId,
+    baseUrl: input.baseUrl
+  });
+  return { ok: result.ok, status: result.status };
+}
+
+// src/verify-live/verify-live-prompt.ts
+function formatVerifyLiveCompletionContract() {
+  return [
+    "## verify_live completion contract",
+    "Finish with a JSON finalResult object:",
+    "{",
+    '  "prUrl": "<landed pr>",',
+    '  "outcome": "passed" | "failed" | "skipped" | "no_mcp_surface",',
+    '  "reason": "<human summary>",',
+    '  "mergeCommit": "<sha optional>",',
+    '  "mcpCalls": [{ "tool": "<name>", "ok": true, "summary": "..." }]',
+    "}",
+    "",
+    "Drive the feature MCP tools against live production. Do not mark passed without exercising the MCP surface."
+  ].join("\n");
+}
+
 // src/dispatch.ts
 var DEFAULT_DISPATCH_LEASE_MS = 60 * 60 * 1e3;
 function readAdmissionExhaustion(result) {
@@ -7095,6 +7531,9 @@ function buildDispatchTaskText(task, agentOsId) {
     `Board linkage: agentOsId=${agentOsId}, taskId=${task.id}, attempt=${task.attempt}, executor=${task.executor}${task.executorRef ? `, executorRef=${task.executorRef}` : ""}.`,
     "This worker was dispatched from the AgentOS board. The harness reports your completion back to the board when you finish."
   ];
+  if (task.executor === "verify_live") {
+    lines.push("", formatVerifyLiveCompletionContract());
+  }
   const outboxRef = extractPlanOutboxFromTask(task);
   if (outboxRef?.outboxId) {
     const item = loadOutboxById(outboxRef.outboxId);
@@ -7128,6 +7567,12 @@ function requestedTargetTaskIds(args) {
 async function dispatchRun(args) {
   const pipeline = args.pipeline === true || args.pipeline === "true";
   try {
+    let isLandPrDecision2 = function(decision) {
+      if (decision.landPrDispatch === true) return true;
+      const task = decision.task;
+      return task?.executor === "land_pr";
+    };
+    var isLandPrDecision = isLandPrDecision2;
     const run = loadRun(String(required(String(args.run || ""), "--run")));
     const agentOsId = String(required(String(args.agentOsId || ""), "--agent-os-id"));
     const base = resolveBaseUrl(args.baseUrl ? String(args.baseUrl) : void 0);
@@ -7262,6 +7707,66 @@ async function dispatchRun(args) {
       });
       return false;
     }
+    async function runLandPrClaimed(decision) {
+      const task = decision.task;
+      const taskId = String(task.id);
+      const prUrl = task.prUrl ? String(task.prUrl) : "";
+      if (!prUrl) {
+        return abortClaimedSpawn(task, "land_pr task missing prUrl");
+      }
+      try {
+        const report = await executeLandPrMerge({
+          prUrl,
+          repo: repoFromPrUrl(prUrl),
+          cwd: run.repo
+        });
+        const post = await postLandPrHarnessCompletion({
+          baseUrl: base,
+          secret,
+          agentOsId,
+          runId: run.id,
+          task,
+          report
+        });
+        outcomes.push({
+          taskId,
+          started: true,
+          landPr: true,
+          outcome: report.outcome,
+          completionStatus: post.status
+        });
+        if (!post.ok) {
+          return abortClaimedSpawn(
+            task,
+            `land_pr completion POST failed (HTTP ${post.status})`
+          );
+        }
+        return true;
+      } catch (error) {
+        return abortClaimedSpawn(task, error.message);
+      }
+    }
+    async function releaseDuplicateLocalClaim(task) {
+      const error = "duplicate_dispatch_prevented: live local worker already owns this task";
+      const release = await releaseDispatchClaimAfterSpawnFailure({
+        baseUrl: base,
+        secret,
+        agentOsId,
+        taskId: String(task.id),
+        leaseOwner,
+        failureDetail: error
+      });
+      outcomes.push({
+        taskId: task.id,
+        started: false,
+        error,
+        alreadyRunning: true,
+        nonFatal: true,
+        released: release.released,
+        releaseResponse: release.releaseResponse
+      });
+      return false;
+    }
     async function spawnClaimed(decision) {
       const task = decision.task;
       const harnessContext = readHarnessWorkerContext(decision);
@@ -7283,10 +7788,7 @@ async function dispatchRun(args) {
         );
       }
       if (hasLiveWorkerForTask(run.id, taskId)) {
-        return abortClaimedSpawn(
-          task,
-          "duplicate_dispatch_prevented: live local worker already owns this task"
-        );
+        return releaseDuplicateLocalClaim(task);
       }
       const attempt = Number(task.attempt) || 1;
       if (attempt > retryLimits.maxTaskAttempts) {
@@ -7379,7 +7881,8 @@ async function dispatchRun(args) {
     }
     let shouldContinueDispatch = true;
     for (const decision of result.started) {
-      shouldContinueDispatch = await spawnClaimed(decision) && shouldContinueDispatch;
+      const admitted = isLandPrDecision2(decision) ? await runLandPrClaimed(decision) : await spawnClaimed(decision);
+      shouldContinueDispatch = admitted && shouldContinueDispatch;
     }
     skipped.push(
       ...result.skipped ?? []
@@ -7417,7 +7920,8 @@ async function dispatchRun(args) {
       if (started.length === 0) break;
       for (const decision of started) {
         if (outcomes.length >= cappedStarts) break;
-        shouldContinueDispatch = await spawnClaimed(decision) && shouldContinueDispatch;
+        const admitted = isLandPrDecision2(decision) ? await runLandPrClaimed(decision) : await spawnClaimed(decision);
+        shouldContinueDispatch = admitted && shouldContinueDispatch;
         if (!shouldContinueDispatch) break;
       }
     }
@@ -7454,11 +7958,12 @@ async function dispatchRun(args) {
       diskGate: result.diskGate,
       resourceGate: result.resourceGate
     };
+    const fatalOutcome = (outcome) => !outcome.started && outcome.nonFatal !== true;
     if (pipeline) {
-      return { ok: !outcomes.some((o) => !o.started), ...summary };
+      return { ok: !outcomes.some(fatalOutcome), ...summary };
     }
     console.log(JSON.stringify(summary, null, 2));
-    if (outcomes.some((o) => !o.started)) process.exit(1);
+    if (outcomes.some(fatalOutcome)) process.exit(1);
   } catch (error) {
     if (pipeline) return { ok: false, error: error.message };
     console.error(`run dispatch failed: ${error.message}`);
@@ -8692,11 +9197,29 @@ function validateDaemonInstallIdentity(config = loadUserConfig(), env = process.
   };
 }
 
+// src/daemon-platform-guard.ts
+function envFlag(name) {
+  const raw = process.env[name]?.trim().toLowerCase();
+  return raw === "1" || raw === "true" || raw === "yes" || raw === "on";
+}
+function assertNativeDaemonAllowed() {
+  if (process.platform !== "win32") return;
+  if (envFlag("KYNVER_DAEMON_ALLOW_NATIVE_WINDOWS")) return;
+  console.error(
+    JSON.stringify({
+      event: "daemon_start_blocked",
+      reason: "native_windows_console_flash",
+      remedy: "Run the daemon inside WSL: .\\scripts\\start-tier2-wsl.ps1 \u2014 or set KYNVER_DAEMON_ALLOW_NATIVE_WINDOWS=1 to override (flashes visible consoles)."
+    })
+  );
+  process.exit(1);
+}
+
 // src/cron/cron-env.ts
 import { existsSync as existsSync27 } from "node:fs";
 import { homedir as homedir11 } from "node:os";
 import path37 from "node:path";
-function envFlag(name, defaultValue) {
+function envFlag2(name, defaultValue) {
   const raw = process.env[name]?.trim().toLowerCase();
   if (!raw) return defaultValue;
   if (raw === "0" || raw === "false" || raw === "no" || raw === "off") return false;
@@ -8732,14 +9255,14 @@ function resolveKynverCronEnv() {
   const secret = resolveKynverCronSecret();
   const credsReady = Boolean(fireBaseUrl && secret);
   const storeExists = existsSync27(storePath);
-  const defaultEnabled = credsReady && (storeExists || envFlag("KYNVER_CRON_TICK_FORCE", false));
+  const defaultEnabled = credsReady && (storeExists || envFlag2("KYNVER_CRON_TICK_FORCE", false));
   return {
     storePath,
     statePath,
     lockPath: `${statePath}.lock`,
     fireBaseUrl,
     secret,
-    tickEnabled: envFlag("KYNVER_CRON_TICK_ENABLED", defaultEnabled),
+    tickEnabled: envFlag2("KYNVER_CRON_TICK_ENABLED", defaultEnabled),
     tickIntervalMs: envInt("KYNVER_CRON_TICK_INTERVAL_MS", 6e4, 5e3),
     missedRunPolicy: process.env.KYNVER_CRON_MISSED_RUN_POLICY?.trim().toLowerCase() === "skip" ? "skip" : "catch_up",
     maxCatchUpPerTick: envInt("KYNVER_CRON_MAX_CATCH_UP_PER_TICK", 3, 0),
@@ -9426,23 +9949,6 @@ function materialWorktreeChanges2(changedFiles) {
   });
 }
 
-// src/cleanup-index-status.ts
-function indexedWorktreeStatus(entry) {
-  if (!entry.status) {
-    entry.status = computeWorkerStatus(entry.worker, {
-      base: entry.run.base,
-      baseCommit: entry.run.baseCommit
-    });
-  }
-  return entry.status;
-}
-function indexedWorktreeHasMaterialChanges(entry) {
-  if (entry.status) {
-    return materialWorktreeChanges2(entry.status.changedFiles).length > 0;
-  }
-  return materialWorktreeChanges2(gitStatusShort(entry.worktreePath)).length > 0;
-}
-
 // src/cleanup-worktree-salvage.ts
 function prUrlFromFinalResult(finalResult) {
   if (typeof finalResult === "string") {
@@ -9469,6 +9975,83 @@ function isPrOrUnmergedWork(status) {
   return false;
 }
 
+// src/cleanup-index-status.ts
+function indexedWorktreeStatus(entry) {
+  if (!entry.status) {
+    entry.status = computeWorkerStatus(entry.worker, {
+      base: entry.run.base,
+      baseCommit: entry.run.baseCommit
+    });
+  }
+  return entry.status;
+}
+function indexedWorktreeHasMaterialChanges(entry, gitStatusCache) {
+  if (entry.status) {
+    return materialWorktreeChanges2(entry.status.changedFiles).length > 0;
+  }
+  const porcelain = gitStatusCache ? gitStatusCache.porcelain(entry.worktreePath) : gitStatusShort(entry.worktreePath);
+  return materialWorktreeChanges2(porcelain).length > 0;
+}
+function finalResultFromWorkerJson(entry) {
+  const snapshot = entry.worker.completionSnapshot?.finalResult;
+  if (snapshot !== void 0 && snapshot !== null) return snapshot;
+  if (entry.worker.taskPrUrl) {
+    return { prUrl: entry.worker.taskPrUrl };
+  }
+  return null;
+}
+function resolveWorktreeGuardStatus(entry, ctx) {
+  if (entry.status) return entry.status;
+  const worker = entry.worker;
+  const completionAcknowledged = typeof worker.completionReportedAt === "string" && worker.completionReportedAt.trim().length > 0;
+  const workerJsonTerminal = Boolean(worker.status && ["done", "exited", "blocked", "failed", "abandoned"].includes(worker.status)) || completionAcknowledged;
+  const finalResult = finalResultFromWorkerJson(entry);
+  if (workerJsonTerminal && !isPidAlive(worker.pid)) {
+    const changedFiles = ctx?.gitStatusCache ? ctx.gitStatusCache.porcelain(entry.worktreePath) : gitStatusShort(entry.worktreePath);
+    const baseLabel = entry.run.baseCommit?.trim() || entry.run.base?.trim() || "origin/main";
+    const ahead = ctx?.gitRevCache?.countAheadOfMain(entry.worktreePath, baseLabel);
+    const gitAncestry = ahead === 0 ? {
+      checked: true,
+      base: baseLabel,
+      relation: "synced"
+    } : computeGitAncestry(entry.worktreePath, {
+      base: entry.run.base,
+      baseCommit: entry.run.baseCommit
+    });
+    const status = {
+      runId: entry.runId,
+      worker: entry.workerName,
+      pid: worker.pid,
+      alive: false,
+      status: worker.status ?? (completionAcknowledged ? "done" : "exited"),
+      attention: { state: completionAcknowledged ? "done" : "stale" },
+      branch: worker.branch,
+      worktreePath: entry.worktreePath,
+      ownedPaths: worker.ownedPaths,
+      stdoutBytes: 0,
+      stderrBytes: 0,
+      heartbeatBytes: 0,
+      firstEventAt: null,
+      lastEventAt: null,
+      lastActivityAt: worker.completionReportedAt ?? null,
+      currentTool: null,
+      heartbeatCount: 0,
+      lastHeartbeatAt: null,
+      lastHeartbeatPhase: null,
+      lastHeartbeatSummary: null,
+      heartbeatBlocker: null,
+      changedFiles,
+      gitAncestry,
+      finalResult,
+      completionBlocker: typeof worker.completionBlocker === "string" ? worker.completionBlocker.trim() || null : null,
+      prUrl: worker.repairTargetPrUrl ?? worker.taskPrUrl ?? prUrlFromFinalResult(finalResult)
+    };
+    entry.status = status;
+    return status;
+  }
+  return indexedWorktreeStatus(entry);
+}
+
 // src/cleanup-completion-blocker.ts
 function completionBlockerBlocksWorktreeRemoval(indexed, status) {
   const blocker = typeof indexed.worker.completionBlocker === "string" ? indexed.worker.completionBlocker.trim() : "";
@@ -9489,13 +10072,28 @@ function completionBlockerBlocksWorktreeRemoval(indexed, status) {
 }
 
 // src/cleanup-run-liveness.ts
+var TERMINAL_WORKER_JSON_STATUSES = /* @__PURE__ */ new Set([
+  "done",
+  "exited",
+  "blocked",
+  "failed",
+  "abandoned"
+]);
 function deriveRunTerminal(indexed, ctx) {
   if (ctx) return ctx.runTerminalCache.derive(indexed.run);
   return deriveTerminalRunStatus(indexed.run);
 }
 function isWorkerProcessLive(indexed) {
   if (isPidAlive(indexed.worker.pid)) return true;
-  if (!indexed.worker.pid) return indexedWorktreeStatus(indexed).alive;
+  if (typeof indexed.worker.completionReportedAt === "string" && indexed.worker.completionReportedAt.trim().length > 0) {
+    return false;
+  }
+  const workerStatus2 = indexed.worker.status;
+  if (workerStatus2 && TERMINAL_WORKER_JSON_STATUSES.has(workerStatus2)) return false;
+  if (!indexed.worker.pid) {
+    if (workerStatus2 !== "running") return false;
+    return indexedWorktreeStatus(indexed).alive;
+  }
   return false;
 }
 function isRunStaleActive(indexed, ctx) {
@@ -9504,6 +10102,10 @@ function isRunStaleActive(indexed, ctx) {
 }
 function runBlocksWorktreeRemoval(indexed, ctx) {
   if (isWorkerProcessLive(indexed)) return true;
+  const workerStatus2 = indexed.worker.status;
+  if (workerStatus2 && TERMINAL_WORKER_JSON_STATUSES.has(workerStatus2) && !indexed.worker.completionBlocker) {
+    return false;
+  }
   const status = indexedWorktreeStatus(indexed);
   if (completionBlockerBlocksWorktreeRemoval(indexed, status)) return true;
   if (isFinishedWorkerStatus(status)) return false;
@@ -9522,7 +10124,7 @@ function effectiveWorktreeAgeMs(input) {
   if (input.liveness && isRunStaleActive(indexed, input.liveness)) {
     return terminalWorktreesAgeMs;
   }
-  if (input.liveness && isFinishedWorkerStatus(indexedWorktreeStatus(indexed)) && !isWorkerProcessLive(indexed)) {
+  if (input.liveness && isFinishedWorkerStatus(resolveWorktreeGuardStatus(indexed, input.liveness)) && !isWorkerProcessLive(indexed)) {
     return terminalWorktreesAgeMs;
   }
   return worktreesAgeMs;
@@ -9536,8 +10138,13 @@ function skipWorktreeRemoval(input) {
   const ageThresholdMs = effectiveWorktreeAgeMs(input);
   if (worktreesAgeMs <= 0 && !includeOrphans && ageThresholdMs <= 0) return "worktrees_disabled";
   if (ageThresholdMs > 0 && ageMs < ageThresholdMs) return "below_age_threshold";
-  const status = indexedWorktreeStatus(indexed);
   if (isWorkerProcessLive(indexed)) return "active_worker";
+  if (indexedWorktreeHasMaterialChanges(indexed, input.liveness?.gitStatusCache)) {
+    return "dirty_worktree";
+  }
+  const ahead = input.liveness?.gitRevCache?.countAheadOfMain(input.worktreePath);
+  if (ahead !== null && ahead !== void 0 && ahead > 0) return "pr_or_unmerged_commits";
+  const status = resolveWorktreeGuardStatus(indexed, input.liveness);
   if (completionBlockerBlocksWorktreeRemoval(indexed, status)) return "completion_blocked";
   if (runBlocksWorktreeRemoval(indexed, input.liveness)) return "run_still_active";
   if (!isFinishedWorkerStatus(status)) return "run_still_active";
@@ -9568,7 +10175,9 @@ function skipDependencyCacheRemoval(input) {
   if (!diskPressure && ageMs < nodeModulesAgeMs) return "below_age_threshold";
   if (activeWorktreePaths.has(path40.resolve(worktreePath))) return "active_worker";
   if (indexed && isWorkerProcessLive(indexed)) return "active_worker";
-  if (indexed && indexedWorktreeHasMaterialChanges(indexed)) return "dirty_worktree";
+  if (indexed && indexedWorktreeHasMaterialChanges(indexed, input.gitStatusCache)) {
+    return "dirty_worktree";
+  }
   return null;
 }
 function skipBuildCacheRemoval(input) {
@@ -9817,7 +10426,7 @@ function pathHasForeignOwnedEntry(targetPath, maxEntries = 32) {
 }
 
 // src/cleanup-privileged-remove.ts
-import { spawnSync as spawnSync4 } from "node:child_process";
+import { spawnSync as spawnSync6 } from "node:child_process";
 import path45 from "node:path";
 
 // src/cleanup-harness-path-validate.ts
@@ -9862,7 +10471,7 @@ function resolvePrivilegedCleanupMode() {
   return "auto";
 }
 function runSudoNonInteractive(argv) {
-  const res = spawnSync4("sudo", ["-n", ...argv], {
+  const res = spawnSync6("sudo", ["-n", ...argv], {
     encoding: "utf8",
     stdio: ["ignore", "pipe", "pipe"]
   });
@@ -10410,7 +11019,7 @@ function buildWorktreeIndexAt(harnessRoot) {
 }
 
 // src/cleanup-retention-config.ts
-function envFlag2(name) {
+function envFlag3(name) {
   const v = process.env[name];
   return v === "1" || v === "true" || v === "yes";
 }
@@ -10421,17 +11030,17 @@ function envMs(name, fallback) {
   return Number.isFinite(n) && n >= 0 ? n : fallback;
 }
 function resolveHarnessRetention(options = {}) {
-  const execute = options.execute === true || options.execute !== false && envFlag2("KYNVER_CLEANUP_EXECUTE");
-  const finalizeStaleRuns2 = options.finalizeStaleRuns !== false && !envFlag2("KYNVER_CLEANUP_SKIP_FINALIZE");
+  const execute = options.execute === true || options.execute !== false && envFlag3("KYNVER_CLEANUP_EXECUTE");
+  const finalizeStaleRuns2 = options.finalizeStaleRuns !== false && !envFlag3("KYNVER_CLEANUP_SKIP_FINALIZE");
   const nodeModulesAgeMs = options.nodeModulesAgeMs ?? envMs("KYNVER_CLEANUP_NODE_MODULES_AGE_MS", DEFAULT_NODE_MODULES_AGE_MS);
   const worktreesAgeMs = options.worktreesAgeMs ?? envMs("KYNVER_CLEANUP_WORKTREES_AGE_MS", 0);
   const terminalWorktreesAgeMs = options.terminalWorktreesAgeMs ?? envMs("KYNVER_CLEANUP_TERMINAL_WORKTREES_AGE_MS", DEFAULT_TERMINAL_WORKTREES_AGE_MS);
   const runDirectoriesAgeMs = options.runDirectoriesAgeMs ?? envMs("KYNVER_CLEANUP_RUN_DIRECTORIES_AGE_MS", DEFAULT_RUN_DIRECTORIES_AGE_MS);
   const maxActionsPerSweep = options.maxActionsPerSweep ?? envMs("KYNVER_CLEANUP_MAX_ACTIONS_PER_SWEEP", DEFAULT_MAX_ACTIONS_PER_SWEEP);
-  const includeOrphans = options.includeOrphans === true || envFlag2("KYNVER_CLEANUP_INCLUDE_ORPHANS");
-  const scopeAll = envFlag2("KYNVER_CLEANUP_SCOPE_ALL") || process.env.KYNVER_CLEANUP_SCOPE === "all";
+  const includeOrphans = options.includeOrphans === true || envFlag3("KYNVER_CLEANUP_INCLUDE_ORPHANS");
+  const scopeAll = envFlag3("KYNVER_CLEANUP_SCOPE_ALL") || process.env.KYNVER_CLEANUP_SCOPE === "all";
   const runIdFilter = scopeAll ? options.runIdFilter : options.runIdFilter ?? (process.env.KYNVER_CLEANUP_RUN_ID || void 0);
-  const accountBytes = options.accountBytes !== false && !envFlag2("KYNVER_CLEANUP_SKIP_BYTE_ACCOUNTING");
+  const accountBytes = options.accountBytes !== false && !envFlag3("KYNVER_CLEANUP_SKIP_BYTE_ACCOUNTING");
   const storageCapEnv = envMs("KYNVER_CLEANUP_STORAGE_ENTRY_CAP", 2e3);
   const storagePerRunEntryCap = options.storagePerRunEntryCap !== void 0 ? options.storagePerRunEntryCap : accountBytes ? storageCapEnv > 0 ? storageCapEnv : null : null;
   const byteCapEnv = envMs("KYNVER_CLEANUP_BYTE_ENTRY_CAP", 2e3);
@@ -10628,7 +11237,7 @@ function resolveHarnessScanRoots(options = {}) {
 }
 
 // src/cleanup-disk-pressure.ts
-function envFlag3(name) {
+function envFlag4(name) {
   const v = process.env[name];
   return v === "1" || v === "true" || v === "yes";
 }
@@ -10651,7 +11260,7 @@ function observeCleanupDiskPressure(input = {}) {
 }
 function applyDiskPressureToRetention(retention, pressure) {
   if (!pressure.pressured) return retention;
-  const executeOnPressure = retention.execute || !envFlag3("KYNVER_CLEANUP_DRY_RUN_ON_PRESSURE");
+  const executeOnPressure = retention.execute || !envFlag4("KYNVER_CLEANUP_DRY_RUN_ON_PRESSURE");
   return {
     ...retention,
     execute: executeOnPressure,
@@ -10676,6 +11285,37 @@ function emitCleanupProgress(phase, detail) {
   console.error(`[kynver cleanup] ${phase}${suffix}`);
 }
 
+// src/cleanup-git-rev-cache.ts
+var CleanupGitRevCache = class {
+  aheadOfMain = /* @__PURE__ */ new Map();
+  countAheadOfMain(worktreePath, base = "origin/main") {
+    const key = `${worktreePath}\0${base}`;
+    if (this.aheadOfMain.has(key)) return this.aheadOfMain.get(key) ?? null;
+    const result = gitCapture(worktreePath, ["rev-list", "--count", `${base}..HEAD`]);
+    if (result.status !== 0) {
+      this.aheadOfMain.set(key, null);
+      return null;
+    }
+    const count = Number(result.stdout.trim());
+    const parsed = Number.isFinite(count) ? count : null;
+    this.aheadOfMain.set(key, parsed);
+    return parsed;
+  }
+};
+
+// src/cleanup-git-status-cache.ts
+var CleanupGitStatusCache = class {
+  cache = /* @__PURE__ */ new Map();
+  porcelain(worktreePath) {
+    const resolved = worktreePath;
+    const cached = this.cache.get(resolved);
+    if (cached !== void 0) return cached;
+    const lines = gitStatusShort(resolved);
+    this.cache.set(resolved, lines);
+    return lines;
+  }
+};
+
 // src/cleanup-run-terminal-cache.ts
 var CleanupRunTerminalCache = class {
   cache = /* @__PURE__ */ new Map();
@@ -10793,7 +11433,11 @@ function runHarnessCleanup(options = {}) {
   emitCleanupProgress("index", "building worktree index");
   const index = mergeWorktreeIndexes(paths.scanRoots);
   emitCleanupProgress("index", `${index.size} indexed worktree(s)`);
-  const liveness = { runTerminalCache: new CleanupRunTerminalCache() };
+  const liveness = {
+    runTerminalCache: new CleanupRunTerminalCache(),
+    gitStatusCache: new CleanupGitStatusCache(),
+    gitRevCache: new CleanupGitRevCache()
+  };
   const skips = [];
   const actions = [];
   const processedPaths = /* @__PURE__ */ new Set();
@@ -10813,8 +11457,15 @@ function runHarnessCleanup(options = {}) {
       index,
       now: paths.now
     };
-    for (const raw of scanDependencyCacheCandidates(scanOpts)) {
+    const dependencyCandidates = scanDependencyCacheCandidates(scanOpts);
+    emitCleanupProgress("dependency", `${dependencyCandidates.length} cache candidate(s) at ${harnessRoot}`);
+    let dependencyProcessed = 0;
+    for (const raw of dependencyCandidates) {
       if (atSweepCap()) break;
+      dependencyProcessed += 1;
+      if (dependencyProcessed % 50 === 0) {
+        emitCleanupProgress("dependency", `${dependencyProcessed}/${dependencyCandidates.length} evaluated`);
+      }
       const resolved = path53.resolve(raw.path);
       if (processedPaths.has(resolved)) continue;
       processedPaths.add(resolved);
@@ -10834,7 +11485,8 @@ function runHarnessCleanup(options = {}) {
         ageMs: candidate.ageMs,
         worktreePath,
         activeWorktreePaths: activeGuards.activeWorktreePaths,
-        diskPressure: retention.diskPressure
+        diskPressure: retention.diskPressure,
+        gitStatusCache: liveness.gitStatusCache
       });
       if (guardReason) {
         recordSkip(skips, candidate.path, guardReason);
@@ -10869,7 +11521,8 @@ function runHarnessCleanup(options = {}) {
         ageMs: candidate.ageMs,
         worktreePath,
         activeWorktreePaths: activeGuards.activeWorktreePaths,
-        diskPressure: retention.diskPressure
+        diskPressure: retention.diskPressure,
+        gitStatusCache: liveness.gitStatusCache
       });
       if (guardReason) {
         recordSkip(skips, candidate.path, guardReason);
@@ -10889,8 +11542,13 @@ function runHarnessCleanup(options = {}) {
     ];
     emitCleanupProgress("worktrees", `${worktreeCandidates.length} candidate(s) at ${harnessRoot}`);
     const worktreeSeen = /* @__PURE__ */ new Set();
+    let worktreeProcessed = 0;
     for (const raw of worktreeCandidates) {
       if (atSweepCap()) break;
+      worktreeProcessed += 1;
+      if (worktreeProcessed % 50 === 0) {
+        emitCleanupProgress("worktrees", `${worktreeProcessed}/${worktreeCandidates.length} evaluated`);
+      }
       const resolved = path53.resolve(raw.path);
       if (worktreeSeen.has(resolved)) continue;
       worktreeSeen.add(resolved);
@@ -11486,6 +12144,7 @@ async function awaitDaemonBackoff(ms, isStopping) {
   }
 }
 async function runDaemon(args) {
+  assertNativeDaemonAllowed();
   const runId = String(required(String(args.run || ""), "--run"));
   const agentOsId = String(required(String(args.agentOsId || loadUserConfig().agentOsId || ""), "--agent-os-id"));
   const execute = args.execute !== false && args.execute !== "false";
@@ -11590,7 +12249,7 @@ function formatNodeOptionsFlag(mb = resolveNodeOldSpaceSizeMb()) {
 }
 
 // src/bounded-build/systemd-wrap.ts
-import { spawnSync as spawnSync5 } from "node:child_process";
+import { spawnSync as spawnSync7 } from "node:child_process";
 var systemdAvailableCache;
 function isSystemdRunAvailable() {
   if (process.env.KYNVER_BUILD_SKIP_SYSTEMD === "1" || process.env.KYNVER_BUILD_SKIP_SYSTEMD === "true") {
@@ -11601,7 +12260,7 @@ function isSystemdRunAvailable() {
     systemdAvailableCache = false;
     return false;
   }
-  const res = spawnSync5("systemd-run", ["--version"], { encoding: "utf8", stdio: ["ignore", "ignore", "pipe"] });
+  const res = spawnSync7("systemd-run", ["--version"], { encoding: "utf8", stdio: ["ignore", "ignore", "pipe"] });
   systemdAvailableCache = res.status === 0;
   return systemdAvailableCache;
 }
@@ -11625,7 +12284,7 @@ function buildSystemdRunArgv(opts) {
 }
 
 // src/bounded-build/admission.ts
-import { spawnSync as spawnSync6 } from "node:child_process";
+import { spawnSync as spawnSync8 } from "node:child_process";
 function positiveInt4(value, fallback) {
   const n = Number(value);
   if (!Number.isFinite(n) || n <= 0) return fallback;
@@ -11661,7 +12320,7 @@ function assessBuildAdmission(opts = {}) {
 }
 function sleepMs2(ms) {
   if (ms <= 0) return;
-  spawnSync6(process.execPath, ["-e", `const d=Date.now()+${Math.floor(ms)};while(Date.now()<d);`], {
+  spawnSync8(process.execPath, ["-e", `const d=Date.now()+${Math.floor(ms)};while(Date.now()<d);`], {
     stdio: "ignore"
   });
 }
@@ -11682,7 +12341,7 @@ function waitForBuildAdmission(timeoutMs, pollMs = 2e3, opts = {}) {
 }
 
 // src/bounded-build/exec.ts
-import { spawnSync as spawnSync8 } from "node:child_process";
+import { spawnSync as spawnSync10 } from "node:child_process";
 
 // src/heavy-verification/slot.ts
 import {
@@ -11888,10 +12547,10 @@ function assessHeavyVerificationGate(command, opts = {}) {
 }
 
 // src/heavy-verification/gate.ts
-import { spawnSync as spawnSync7 } from "node:child_process";
+import { spawnSync as spawnSync9 } from "node:child_process";
 function sleepMs3(ms) {
   if (ms <= 0) return;
-  spawnSync7(process.execPath, ["-e", `const d=Date.now()+${Math.floor(ms)};while(Date.now()<d);`], {
+  spawnSync9(process.execPath, ["-e", `const d=Date.now()+${Math.floor(ms)};while(Date.now()<d);`], {
     stdio: "ignore"
   });
 }
@@ -11934,7 +12593,7 @@ function envArgv(env) {
   return out;
 }
 function runSpawn(argv, opts) {
-  const res = spawnSync8(argv[0], argv.slice(1), {
+  const res = spawnSync10(argv[0], argv.slice(1), {
     cwd: opts.cwd,
     env: opts.env,
     encoding: "utf8",
@@ -13214,10 +13873,10 @@ import path68 from "node:path";
 import { accessSync, constants, existsSync as existsSync45, readFileSync as readFileSync17 } from "node:fs";
 import { homedir as homedir15 } from "node:os";
 import path67 from "node:path";
-import { spawnSync as spawnSync9 } from "node:child_process";
+import { spawnSync as spawnSync11 } from "node:child_process";
 function captureCommand(bin, args) {
   try {
-    const res = spawnSync9(bin, args, { encoding: "utf8" });
+    const res = spawnSync11(bin, args, { encoding: "utf8" });
     const stdout = (res.stdout || "").trim();
     const stderr = (res.stderr || "").trim();
     const ok = res.status === 0;
@@ -13466,12 +14125,12 @@ function assessRuntimeTakeoverScheduler(env, ctx) {
     return check({
       id: "hotspot_openclaw_scheduler",
       label: "Scheduler provider (runtime daemon vs OpenClaw cron)",
-      status: "pass",
-      summary: "KYNVER_SCHEDULER_PROVIDER unset on hosted deployment; scheduler resolves to kynver-cron (Kynver-owned, not OpenClaw)",
-      remediation: "For production hosted AgentOS schedules, set QSTASH_TOKEN and KYNVER_SCHEDULER_PROVIDER=qstash on the Kynver server. Dev/harness hosts may rely on kynver-cron or `kynver daemon` without OpenClaw.",
+      status: "warn",
+      summary: "Hosted deployment with no QSTASH_TOKEN and no KYNVER_SCHEDULER_PROVIDER \u2014 kynver-cron is an in-process stub here and will NOT fire; no firing scheduler is configured",
+      remediation: "Set QSTASH_TOKEN + KYNVER_SCHEDULER_PROVIDER=qstash on the Kynver server for hosted AgentOS schedules. Only use kynver-cron when a `kynver daemon` (or local cron store) actually owns firing on this box.",
       details: {
         schedulerProvider: null,
-        resolvedFallback: "kynver-cron",
+        resolvedFallback: "none",
         qstashTokenPresent: false,
         hostedDeployment
       }
@@ -14117,7 +14776,7 @@ var LANDING_MAINTAINER_LANE_SPEC = {
 };
 
 // src/lane/landing-maintainer-local.ts
-import { spawnSync as spawnSync10 } from "node:child_process";
+import { spawnSync as spawnSync12 } from "node:child_process";
 import path70 from "node:path";
 function runLandingWrapper(prNumber, repoRoot, execute) {
   const script = path70.join(repoRoot, LANDING_MAINTAINER_LANE_SPEC.landScript);
@@ -14131,7 +14790,7 @@ function runLandingWrapper(prNumber, repoRoot, execute) {
       stderr: ""
     };
   }
-  const result = spawnSync10("node", args, {
+  const result = spawnSync12("node", args, {
     cwd: repoRoot,
     encoding: "utf8",
     timeout: 10 * 60 * 1e3
@@ -14273,14 +14932,15 @@ function usage(code = 0) {
       "  kynver runner credential [--agent-os-id ID] [--base-url URL]",
       "  kynver setup [--api-base-url URL] [--agent-os-id ID] [--agent-os-slug SLUG] [--box-kind forge|ghost] [--repo PATH] [--discover-repo] [--max-workers N] [--provider claude|cursor]",
       "  kynver daemon --run RUN_ID --agent-os-id AOS_ID [--execute] [--interval-ms MS]",
+      "  kynver status --run RUN_ID [--blocked] [--running] [--task TASK_ID] [--worker WORKER] [--full]  # top-level compact run status",
       "  kynver run create [--repo /path/repo] [--name name] [--base origin/main]",
       "  kynver run list",
       "  kynver run resolve --name RUN_NAME",
-      "  kynver run status --run RUN_ID [--json] [--compact]",
+      "  kynver run status --run RUN_ID [--full]  # defaults to compact shallow map with drill-down commands",
       "  kynver run dispatch --run RUN_ID --agent-os-id AOS_ID [--base-url URL] [--secret SECRET] [--execute] [--lane any|implementation|review|landing] [--target-task-id TASK_ID] [--executor harness] [--max-starts 1] [--lease-ms MS] [--owned path[,path]] [--model claude-opus-4-8] [--disk-path /] [--reconcile-stale-blockers]",
       "  kynver run sweep --run RUN_ID --agent-os-id AOS_ID [--base-url URL] [--secret SECRET] [--grace-ms MS]",
       '  kynver worker start --run RUN_ID --name worker --task "..." [--owned path[,path]] [--model MODEL] [--provider claude|cursor] [--agent-os-id AOS_ID] [--task-id TASK_ID] [--wait]',
-      "  kynver worker list --run RUN_ID [--json] [--compact] [--full]",
+      "  kynver worker list --run RUN_ID [--full]  # defaults to compact shallow map with drill-down commands",
       "  kynver worker status --run RUN_ID --name worker",
       "  kynver worker tail --run RUN_ID --name worker [--lines 40] [--raw]",
       "  kynver worker stop --run RUN_ID --name worker",
@@ -14334,6 +14994,9 @@ async function main(argv = process.argv.slice(2)) {
   const { runsDir, worktreesDir } = getPaths();
   mkdirSync10(runsDir, { recursive: true });
   mkdirSync10(worktreesDir, { recursive: true });
+  if (scope === "daemon") {
+    assertNativeDaemonAllowed();
+  }
   if (shouldEnforceMemoryCostPackageGuardCli(scope, action)) {
     let repoRoot;
     const runId = args.run ? String(args.run).trim() : "";
@@ -14350,6 +15013,7 @@ async function main(argv = process.argv.slice(2)) {
     });
   }
   if (scope === "login") return void await runLogin(args);
+  if (scope === "status") return runStatus(args);
   if (scope === "runner" && action === "credential") return void await mintRunnerCredential(args);
   if (scope === "setup") return void await runSetup(args);
   if (scope === "daemon") return void await runDaemon(args);